From: Greg Kroah-Hartman Date: Fri, 6 Jan 2017 12:34:58 +0000 (+0100) Subject: 4.4-stable patches X-Git-Tag: v4.4.41~14 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7fa020eec9e442672c281784f87bb467028ad55a;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: ath9k-really-fix-led-polarity-for-some-mini-pci-ar9220-mb92-cards.patch cfg80211-mac80211-fix-bss-leaks-when-abandoning-assoc-attempts.patch clk-bcm2835-avoid-overwriting-the-div-info-when-disabling-a-pll_div-clk.patch mmc-sdhci-fix-recovery-from-tuning-timeout.patch regulator-stw481x-vmmc-fix-ages-old-enable-error.patch rtlwifi-fix-enter-exit-power_save.patch ssb-fix-error-routine-when-fallback-sprom-fails.patch thermal-hwmon-properly-report-critical-temperature-in-sysfs.patch timekeeping_force_unsigned_clocksource_to_nanoseconds_conversion.patch --- diff --git a/queue-4.4/ath9k-really-fix-led-polarity-for-some-mini-pci-ar9220-mb92-cards.patch b/queue-4.4/ath9k-really-fix-led-polarity-for-some-mini-pci-ar9220-mb92-cards.patch new file mode 100644 index 00000000000..33ffdf41fbe --- /dev/null +++ b/queue-4.4/ath9k-really-fix-led-polarity-for-some-mini-pci-ar9220-mb92-cards.patch @@ -0,0 +1,71 @@ +From 79e57dd113d307a6c74773b8aaecf5442068988a Mon Sep 17 00:00:00 2001 +From: "Vittorio Gambaletta (VittGam)" +Date: Wed, 9 Nov 2016 03:40:56 +0200 +Subject: ath9k: Really fix LED polarity for some Mini PCI AR9220 MB92 cards. + +From: Vittorio Gambaletta (VittGam) + +commit 79e57dd113d307a6c74773b8aaecf5442068988a upstream. + +The active_high LED of my Wistron DNMA-92 is still being recognized as +active_low on 4.7.6 mainline. When I was preparing my former commit +0f9edcdd88a9 ("ath9k: Fix LED polarity for some Mini PCI AR9220 MB92 +cards.") to fix that I must have somehow messed up with testing, because +I tested the final version of that patch before sending it, and it was +apparently working; but now it is not working on 4.7.6 mainline. + +I initially added the PCI_DEVICE_SUB section for 0x0029/0x2096 above the +PCI_VDEVICE section for 0x0029; but then I moved the former below the +latter after seeing how 0x002A sections were sorted in the file. + +This turned out to be wrong: if a generic PCI_VDEVICE entry (that has +both subvendor and subdevice IDs set to PCI_ANY_ID) is put before a more +specific one (PCI_DEVICE_SUB), then the generic PCI_VDEVICE entry will +match first and will be used. + +With this patch, 0x0029/0x2096 has finally got active_high LED on 4.7.6. + +While I'm at it, let's fix 0x002A too by also moving its generic definition +below its specific ones. + +Fixes: 0f9edcdd88a9 ("ath9k: Fix LED polarity for some Mini PCI AR9220 MB92 cards.") +Signed-off-by: Vittorio Gambaletta +[kvalo@qca.qualcomm.com: improve the commit log based on email discussions] +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/pci.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/pci.c ++++ b/drivers/net/wireless/ath/ath9k/pci.c +@@ -27,7 +27,6 @@ static const struct pci_device_id ath_pc + { PCI_VDEVICE(ATHEROS, 0x0023) }, /* PCI */ + { PCI_VDEVICE(ATHEROS, 0x0024) }, /* PCI-E */ + { PCI_VDEVICE(ATHEROS, 0x0027) }, /* PCI */ +- { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI */ + + #ifdef CONFIG_ATH9K_PCOEM + /* Mini PCI AR9220 MB92 cards: Compex WLM200NX, Wistron DNMA-92 */ +@@ -38,7 +37,7 @@ static const struct pci_device_id ath_pc + .driver_data = ATH9K_PCI_LED_ACT_HI }, + #endif + +- { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */ ++ { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI */ + + #ifdef CONFIG_ATH9K_PCOEM + { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS, +@@ -86,7 +85,11 @@ static const struct pci_device_id ath_pc + 0x10CF, /* Fujitsu */ + 0x1536), + .driver_data = ATH9K_PCI_D3_L1_WAR }, ++#endif + ++ { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */ ++ ++#ifdef CONFIG_ATH9K_PCOEM + /* AR9285 card for Asus */ + { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS, + 0x002B, diff --git a/queue-4.4/cfg80211-mac80211-fix-bss-leaks-when-abandoning-assoc-attempts.patch b/queue-4.4/cfg80211-mac80211-fix-bss-leaks-when-abandoning-assoc-attempts.patch new file mode 100644 index 00000000000..dcb9949a63b --- /dev/null +++ b/queue-4.4/cfg80211-mac80211-fix-bss-leaks-when-abandoning-assoc-attempts.patch @@ -0,0 +1,214 @@ +From e6f462df9acd2a3295e5d34eb29e2823220cf129 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Thu, 8 Dec 2016 17:22:09 +0100 +Subject: cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts + +From: Johannes Berg + +commit e6f462df9acd2a3295e5d34eb29e2823220cf129 upstream. + +When mac80211 abandons an association attempt, it may free +all the data structures, but inform cfg80211 and userspace +about it only by sending the deauth frame it received, in +which case cfg80211 has no link to the BSS struct that was +used and will not cfg80211_unhold_bss() it. + +Fix this by providing a way to inform cfg80211 of this with +the BSS entry passed, so that it can clean up properly, and +use this ability in the appropriate places in mac80211. + +This isn't ideal: some code is more or less duplicated and +tracing is missing. However, it's a fairly small change and +it's thus easier to backport - cleanups can come later. + +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/cfg80211.h | 11 +++++++++++ + net/mac80211/mlme.c | 21 ++++++++++++--------- + net/wireless/core.h | 1 + + net/wireless/mlme.c | 12 ++++++++++++ + net/wireless/sme.c | 14 ++++++++++++++ + 5 files changed, 50 insertions(+), 9 deletions(-) + +--- a/include/net/cfg80211.h ++++ b/include/net/cfg80211.h +@@ -4258,6 +4258,17 @@ void cfg80211_rx_assoc_resp(struct net_d + void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss); + + /** ++ * cfg80211_abandon_assoc - notify cfg80211 of abandoned association attempt ++ * @dev: network device ++ * @bss: The BSS entry with which association was abandoned. ++ * ++ * Call this whenever - for reasons reported through other API, like deauth RX, ++ * an association attempt was abandoned. ++ * This function may sleep. The caller must hold the corresponding wdev's mutex. ++ */ ++void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss); ++ ++/** + * cfg80211_tx_mlme_mgmt - notification of transmitted deauth/disassoc frame + * @dev: network device + * @buf: 802.11 frame (header + body) +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -2517,7 +2517,7 @@ static void ieee80211_destroy_auth_data( + } + + static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata, +- bool assoc) ++ bool assoc, bool abandon) + { + struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data; + +@@ -2539,6 +2539,9 @@ static void ieee80211_destroy_assoc_data + mutex_lock(&sdata->local->mtx); + ieee80211_vif_release_channel(sdata); + mutex_unlock(&sdata->local->mtx); ++ ++ if (abandon) ++ cfg80211_abandon_assoc(sdata->dev, assoc_data->bss); + } + + kfree(assoc_data); +@@ -2768,7 +2771,7 @@ static void ieee80211_rx_mgmt_deauth(str + bssid, reason_code, + ieee80211_get_reason_code_string(reason_code)); + +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, true); + + cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len); + return; +@@ -3173,14 +3176,14 @@ static void ieee80211_rx_mgmt_assoc_resp + if (status_code != WLAN_STATUS_SUCCESS) { + sdata_info(sdata, "%pM denied association (code=%d)\n", + mgmt->sa, status_code); +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, false); + event.u.mlme.status = MLME_DENIED; + event.u.mlme.reason = status_code; + drv_event_callback(sdata->local, sdata, &event); + } else { + if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) { + /* oops -- internal error -- send timeout for now */ +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, false); + cfg80211_assoc_timeout(sdata->dev, bss); + return; + } +@@ -3193,7 +3196,7 @@ static void ieee80211_rx_mgmt_assoc_resp + * recalc after assoc_data is NULL but before associated + * is set can cause the interface to go idle + */ +- ieee80211_destroy_assoc_data(sdata, true); ++ ieee80211_destroy_assoc_data(sdata, true, false); + + /* get uapsd queues configuration */ + uapsd_queues = 0; +@@ -3888,7 +3891,7 @@ void ieee80211_sta_work(struct ieee80211 + .u.mlme.status = MLME_TIMEOUT, + }; + +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, false); + cfg80211_assoc_timeout(sdata->dev, bss); + drv_event_callback(sdata->local, sdata, &event); + } +@@ -4029,7 +4032,7 @@ void ieee80211_mgd_quiesce(struct ieee80 + WLAN_REASON_DEAUTH_LEAVING, + false, frame_buf); + if (ifmgd->assoc_data) +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, true); + if (ifmgd->auth_data) + ieee80211_destroy_auth_data(sdata, false); + cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf, +@@ -4905,7 +4908,7 @@ int ieee80211_mgd_deauth(struct ieee8021 + IEEE80211_STYPE_DEAUTH, + req->reason_code, tx, + frame_buf); +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, true); + ieee80211_report_disconnect(sdata, frame_buf, + sizeof(frame_buf), true, + req->reason_code); +@@ -4980,7 +4983,7 @@ void ieee80211_mgd_stop(struct ieee80211 + sdata_lock(sdata); + if (ifmgd->assoc_data) { + struct cfg80211_bss *bss = ifmgd->assoc_data->bss; +- ieee80211_destroy_assoc_data(sdata, false); ++ ieee80211_destroy_assoc_data(sdata, false, false); + cfg80211_assoc_timeout(sdata->dev, bss); + } + if (ifmgd->auth_data) +--- a/net/wireless/core.h ++++ b/net/wireless/core.h +@@ -398,6 +398,7 @@ void cfg80211_sme_disassoc(struct wirele + void cfg80211_sme_deauth(struct wireless_dev *wdev); + void cfg80211_sme_auth_timeout(struct wireless_dev *wdev); + void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev); ++void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev); + + /* internal helpers */ + bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher); +--- a/net/wireless/mlme.c ++++ b/net/wireless/mlme.c +@@ -149,6 +149,18 @@ void cfg80211_assoc_timeout(struct net_d + } + EXPORT_SYMBOL(cfg80211_assoc_timeout); + ++void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss) ++{ ++ struct wireless_dev *wdev = dev->ieee80211_ptr; ++ struct wiphy *wiphy = wdev->wiphy; ++ ++ cfg80211_sme_abandon_assoc(wdev); ++ ++ cfg80211_unhold_bss(bss_from_pub(bss)); ++ cfg80211_put_bss(wiphy, bss); ++} ++EXPORT_SYMBOL(cfg80211_abandon_assoc); ++ + void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len) + { + struct wireless_dev *wdev = dev->ieee80211_ptr; +--- a/net/wireless/sme.c ++++ b/net/wireless/sme.c +@@ -39,6 +39,7 @@ struct cfg80211_conn { + CFG80211_CONN_ASSOCIATING, + CFG80211_CONN_ASSOC_FAILED, + CFG80211_CONN_DEAUTH, ++ CFG80211_CONN_ABANDON, + CFG80211_CONN_CONNECTED, + } state; + u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN]; +@@ -204,6 +205,8 @@ static int cfg80211_conn_do_work(struct + cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid, + NULL, 0, + WLAN_REASON_DEAUTH_LEAVING, false); ++ /* fall through */ ++ case CFG80211_CONN_ABANDON: + /* free directly, disconnected event already sent */ + cfg80211_sme_free(wdev); + return 0; +@@ -423,6 +426,17 @@ void cfg80211_sme_assoc_timeout(struct w + schedule_work(&rdev->conn_work); + } + ++void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev) ++{ ++ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); ++ ++ if (!wdev->conn) ++ return; ++ ++ wdev->conn->state = CFG80211_CONN_ABANDON; ++ schedule_work(&rdev->conn_work); ++} ++ + static int cfg80211_sme_get_conn_ies(struct wireless_dev *wdev, + const u8 *ies, size_t ies_len, + const u8 **out_ies, size_t *out_ies_len) diff --git a/queue-4.4/clk-bcm2835-avoid-overwriting-the-div-info-when-disabling-a-pll_div-clk.patch b/queue-4.4/clk-bcm2835-avoid-overwriting-the-div-info-when-disabling-a-pll_div-clk.patch new file mode 100644 index 00000000000..39ea4909478 --- /dev/null +++ b/queue-4.4/clk-bcm2835-avoid-overwriting-the-div-info-when-disabling-a-pll_div-clk.patch @@ -0,0 +1,38 @@ +From 68af4fa8f39b542a6cde7ac19518d88e9b3099dc Mon Sep 17 00:00:00 2001 +From: Boris Brezillon +Date: Thu, 1 Dec 2016 20:27:21 +0100 +Subject: clk: bcm2835: Avoid overwriting the div info when disabling a pll_div clk + +From: Boris Brezillon + +commit 68af4fa8f39b542a6cde7ac19518d88e9b3099dc upstream. + +bcm2835_pll_divider_off() is resetting the divider field in the A2W reg +to zero when disabling the clock. + +Make sure we preserve this value by reading the previous a2w_reg value +first and ORing the result with A2W_PLL_CHANNEL_DISABLE. + +Signed-off-by: Boris Brezillon +Fixes: 41691b8862e2 ("clk: bcm2835: Add support for programming the audio domain clocks") +Reviewed-by: Eric Anholt +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/bcm/clk-bcm2835.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/clk/bcm/clk-bcm2835.c ++++ b/drivers/clk/bcm/clk-bcm2835.c +@@ -1082,7 +1082,9 @@ static void bcm2835_pll_divider_off(stru + cprman_write(cprman, data->cm_reg, + (cprman_read(cprman, data->cm_reg) & + ~data->load_mask) | data->hold_mask); +- cprman_write(cprman, data->a2w_reg, A2W_PLL_CHANNEL_DISABLE); ++ cprman_write(cprman, data->a2w_reg, ++ cprman_read(cprman, data->a2w_reg) | ++ A2W_PLL_CHANNEL_DISABLE); + spin_unlock(&cprman->regs_lock); + } + diff --git a/queue-4.4/mmc-sdhci-fix-recovery-from-tuning-timeout.patch b/queue-4.4/mmc-sdhci-fix-recovery-from-tuning-timeout.patch new file mode 100644 index 00000000000..9b8f7f27e95 --- /dev/null +++ b/queue-4.4/mmc-sdhci-fix-recovery-from-tuning-timeout.patch @@ -0,0 +1,63 @@ +From 61e53bd0047d58caee0c7170613045bf96de4458 Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Fri, 2 Dec 2016 15:14:20 +0200 +Subject: mmc: sdhci: Fix recovery from tuning timeout + +From: Adrian Hunter + +commit 61e53bd0047d58caee0c7170613045bf96de4458 upstream. + +Clearing the tuning bits should reset the tuning circuit. However there is +more to do. Reset the command and data lines for good measure, and then +for eMMC ensure the card is not still trying to process a tuning command by +sending a stop command. + +Note the JEDEC eMMC specification says the stop command (CMD12) can be used +to stop a tuning command (CMD21) whereas the SD specification is silent on +the subject with respect to the SD tuning command (CMD19). Considering that +CMD12 is not a valid SDIO command, the stop command is sent only when the +tuning command is CMD21 i.e. for eMMC. That addresses cases seen so far +which have been on eMMC. + +Note that this replaces the commit fe5fb2e3b58f ("mmc: sdhci: Reset cmd and +data circuits after tuning failure") which is being reverted for v4.9+. + +Signed-off-by: Adrian Hunter +Tested-by: Dan O'Donovan +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -2040,7 +2040,27 @@ static int sdhci_execute_tuning(struct m + ctrl &= ~SDHCI_CTRL_EXEC_TUNING; + sdhci_writew(host, ctrl, SDHCI_HOST_CONTROL2); + ++ sdhci_do_reset(host, SDHCI_RESET_CMD); ++ sdhci_do_reset(host, SDHCI_RESET_DATA); ++ + err = -EIO; ++ ++ if (cmd.opcode != MMC_SEND_TUNING_BLOCK_HS200) ++ goto out; ++ ++ sdhci_writel(host, host->ier, SDHCI_INT_ENABLE); ++ sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE); ++ ++ spin_unlock_irqrestore(&host->lock, flags); ++ ++ memset(&cmd, 0, sizeof(cmd)); ++ cmd.opcode = MMC_STOP_TRANSMISSION; ++ cmd.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC; ++ cmd.busy_timeout = 50; ++ mmc_wait_for_cmd(mmc, &cmd, 0); ++ ++ spin_lock_irqsave(&host->lock, flags); ++ + goto out; + } + diff --git a/queue-4.4/regulator-stw481x-vmmc-fix-ages-old-enable-error.patch b/queue-4.4/regulator-stw481x-vmmc-fix-ages-old-enable-error.patch new file mode 100644 index 00000000000..6b15f4eceb1 --- /dev/null +++ b/queue-4.4/regulator-stw481x-vmmc-fix-ages-old-enable-error.patch @@ -0,0 +1,35 @@ +From 295070e9aa015abb9b92cccfbb1e43954e938133 Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Sat, 12 Nov 2016 15:22:38 +0100 +Subject: regulator: stw481x-vmmc: fix ages old enable error + +From: Linus Walleij + +commit 295070e9aa015abb9b92cccfbb1e43954e938133 upstream. + +The regulator has never been properly enabled, it has been +dormant all the time. It's strange that MMC was working +at all, but it likely worked by the signals going through +the levelshifter and reaching the card anyways. + +Fixes: 3615a34ea1a6 ("regulator: add STw481x VMMC driver") +Signed-off-by: Linus Walleij +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/stw481x-vmmc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/regulator/stw481x-vmmc.c ++++ b/drivers/regulator/stw481x-vmmc.c +@@ -47,7 +47,8 @@ static struct regulator_desc vmmc_regula + .volt_table = stw481x_vmmc_voltages, + .enable_time = 200, /* FIXME: look this up */ + .enable_reg = STW_CONF1, +- .enable_mask = STW_CONF1_PDN_VMMC, ++ .enable_mask = STW_CONF1_PDN_VMMC | STW_CONF1_MMC_LS_STATUS, ++ .enable_val = STW_CONF1_PDN_VMMC, + .vsel_reg = STW_CONF1, + .vsel_mask = STW_CONF1_VMMC_MASK, + }; diff --git a/queue-4.4/rtlwifi-fix-enter-exit-power_save.patch b/queue-4.4/rtlwifi-fix-enter-exit-power_save.patch new file mode 100644 index 00000000000..0511c050506 --- /dev/null +++ b/queue-4.4/rtlwifi-fix-enter-exit-power_save.patch @@ -0,0 +1,185 @@ +From ba9f93f82abafe2552eac942ebb11c2df4f8dd7f Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Sat, 26 Nov 2016 14:43:35 -0600 +Subject: rtlwifi: Fix enter/exit power_save + +From: Larry Finger + +commit ba9f93f82abafe2552eac942ebb11c2df4f8dd7f upstream. + +In commit a5ffbe0a1993 ("rtlwifi: Fix scheduling while atomic bug") and +commit a269913c52ad ("rtlwifi: Rework rtl_lps_leave() and rtl_lps_enter() +to use work queue"), an error was introduced in the power-save routines +due to the fact that leaving PS was delayed by the use of a work queue. + +This problem is fixed by detecting if the enter or leave routines are +in interrupt mode. If so, the workqueue is used to place the request. +If in normal mode, the enter or leave routines are called directly. + +Fixes: a269913c52ad ("rtlwifi: Rework rtl_lps_leave() and rtl_lps_enter() to use work queue") +Reported-by: Ping-Ke Shih +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/realtek/rtlwifi/base.c | 8 +++--- + drivers/net/wireless/realtek/rtlwifi/core.c | 9 ++----- + drivers/net/wireless/realtek/rtlwifi/pci.c | 14 +++------- + drivers/net/wireless/realtek/rtlwifi/ps.c | 36 +++++++++++++++++++++------- + 4 files changed, 40 insertions(+), 27 deletions(-) + +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -1303,12 +1303,13 @@ EXPORT_SYMBOL_GPL(rtl_action_proc); + + static void setup_arp_tx(struct rtl_priv *rtlpriv, struct rtl_ps_ctl *ppsc) + { ++ struct ieee80211_hw *hw = rtlpriv->hw; ++ + rtlpriv->ra.is_special_data = true; + if (rtlpriv->cfg->ops->get_btc_status()) + rtlpriv->btcoexist.btc_ops->btc_special_packet_notify( + rtlpriv, 1); +- rtlpriv->enter_ps = false; +- schedule_work(&rtlpriv->works.lps_change_work); ++ rtl_lps_leave(hw); + ppsc->last_delaylps_stamp_jiffies = jiffies; + } + +@@ -1381,8 +1382,7 @@ u8 rtl_is_special_data(struct ieee80211_ + + if (is_tx) { + rtlpriv->ra.is_special_data = true; +- rtlpriv->enter_ps = false; +- schedule_work(&rtlpriv->works.lps_change_work); ++ rtl_lps_leave(hw); + ppsc->last_delaylps_stamp_jiffies = jiffies; + } + +--- a/drivers/net/wireless/realtek/rtlwifi/core.c ++++ b/drivers/net/wireless/realtek/rtlwifi/core.c +@@ -1153,10 +1153,8 @@ static void rtl_op_bss_info_changed(stru + } else { + mstatus = RT_MEDIA_DISCONNECT; + +- if (mac->link_state == MAC80211_LINKED) { +- rtlpriv->enter_ps = false; +- schedule_work(&rtlpriv->works.lps_change_work); +- } ++ if (mac->link_state == MAC80211_LINKED) ++ rtl_lps_leave(hw); + if (ppsc->p2p_ps_info.p2p_ps_mode > P2P_PS_NONE) + rtl_p2p_ps_cmd(hw, P2P_PS_DISABLE); + mac->link_state = MAC80211_NOLINK; +@@ -1432,8 +1430,7 @@ static void rtl_op_sw_scan_start(struct + } + + if (mac->link_state == MAC80211_LINKED) { +- rtlpriv->enter_ps = false; +- schedule_work(&rtlpriv->works.lps_change_work); ++ rtl_lps_leave(hw); + mac->link_state = MAC80211_LINKED_SCANNING; + } else { + rtl_ips_nic_on(hw); +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -664,11 +664,9 @@ tx_status_ok: + } + + if (((rtlpriv->link_info.num_rx_inperiod + +- rtlpriv->link_info.num_tx_inperiod) > 8) || +- (rtlpriv->link_info.num_rx_inperiod > 2)) { +- rtlpriv->enter_ps = false; +- schedule_work(&rtlpriv->works.lps_change_work); +- } ++ rtlpriv->link_info.num_tx_inperiod) > 8) || ++ (rtlpriv->link_info.num_rx_inperiod > 2)) ++ rtl_lps_leave(hw); + } + + static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw, +@@ -919,10 +917,8 @@ new_trx_end: + } + if (((rtlpriv->link_info.num_rx_inperiod + + rtlpriv->link_info.num_tx_inperiod) > 8) || +- (rtlpriv->link_info.num_rx_inperiod > 2)) { +- rtlpriv->enter_ps = false; +- schedule_work(&rtlpriv->works.lps_change_work); +- } ++ (rtlpriv->link_info.num_rx_inperiod > 2)) ++ rtl_lps_leave(hw); + skb = new_skb; + no_new: + if (rtlpriv->use_new_trx_flow) { +--- a/drivers/net/wireless/realtek/rtlwifi/ps.c ++++ b/drivers/net/wireless/realtek/rtlwifi/ps.c +@@ -414,8 +414,8 @@ void rtl_lps_set_psmode(struct ieee80211 + } + } + +-/*Enter the leisure power save mode.*/ +-void rtl_lps_enter(struct ieee80211_hw *hw) ++/* Interrupt safe routine to enter the leisure power save mode.*/ ++static void rtl_lps_enter_core(struct ieee80211_hw *hw) + { + struct rtl_mac *mac = rtl_mac(rtl_priv(hw)); + struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw)); +@@ -455,10 +455,9 @@ void rtl_lps_enter(struct ieee80211_hw * + + spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag); + } +-EXPORT_SYMBOL(rtl_lps_enter); + +-/*Leave the leisure power save mode.*/ +-void rtl_lps_leave(struct ieee80211_hw *hw) ++/* Interrupt safe routine to leave the leisure power save mode.*/ ++static void rtl_lps_leave_core(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw)); +@@ -488,7 +487,6 @@ void rtl_lps_leave(struct ieee80211_hw * + } + spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag); + } +-EXPORT_SYMBOL(rtl_lps_leave); + + /* For sw LPS*/ + void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len) +@@ -681,12 +679,34 @@ void rtl_lps_change_work_callback(struct + struct rtl_priv *rtlpriv = rtl_priv(hw); + + if (rtlpriv->enter_ps) +- rtl_lps_enter(hw); ++ rtl_lps_enter_core(hw); + else +- rtl_lps_leave(hw); ++ rtl_lps_leave_core(hw); + } + EXPORT_SYMBOL_GPL(rtl_lps_change_work_callback); + ++void rtl_lps_enter(struct ieee80211_hw *hw) ++{ ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ ++ if (!in_interrupt()) ++ return rtl_lps_enter_core(hw); ++ rtlpriv->enter_ps = true; ++ schedule_work(&rtlpriv->works.lps_change_work); ++} ++EXPORT_SYMBOL_GPL(rtl_lps_enter); ++ ++void rtl_lps_leave(struct ieee80211_hw *hw) ++{ ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ ++ if (!in_interrupt()) ++ return rtl_lps_leave_core(hw); ++ rtlpriv->enter_ps = false; ++ schedule_work(&rtlpriv->works.lps_change_work); ++} ++EXPORT_SYMBOL_GPL(rtl_lps_leave); ++ + void rtl_swlps_wq_callback(void *data) + { + struct rtl_works *rtlworks = container_of_dwork_rtl(data, diff --git a/queue-4.4/series b/queue-4.4/series new file mode 100644 index 00000000000..ad0094556c2 --- /dev/null +++ b/queue-4.4/series @@ -0,0 +1,9 @@ +ssb-fix-error-routine-when-fallback-sprom-fails.patch +rtlwifi-fix-enter-exit-power_save.patch +cfg80211-mac80211-fix-bss-leaks-when-abandoning-assoc-attempts.patch +ath9k-really-fix-led-polarity-for-some-mini-pci-ar9220-mb92-cards.patch +mmc-sdhci-fix-recovery-from-tuning-timeout.patch +regulator-stw481x-vmmc-fix-ages-old-enable-error.patch +timekeeping_force_unsigned_clocksource_to_nanoseconds_conversion.patch +clk-bcm2835-avoid-overwriting-the-div-info-when-disabling-a-pll_div-clk.patch +thermal-hwmon-properly-report-critical-temperature-in-sysfs.patch diff --git a/queue-4.4/ssb-fix-error-routine-when-fallback-sprom-fails.patch b/queue-4.4/ssb-fix-error-routine-when-fallback-sprom-fails.patch new file mode 100644 index 00000000000..e46574bb973 --- /dev/null +++ b/queue-4.4/ssb-fix-error-routine-when-fallback-sprom-fails.patch @@ -0,0 +1,31 @@ +From 8052d7245b6089992343c80b38b14dbbd8354651 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Sat, 5 Nov 2016 14:08:57 -0500 +Subject: ssb: Fix error routine when fallback SPROM fails + +From: Larry Finger + +commit 8052d7245b6089992343c80b38b14dbbd8354651 upstream. + +When there is a CRC error in the SPROM read from the device, the code +attempts to handle a fallback SPROM. When this also fails, the driver +returns zero rather than an error code. + +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ssb/pci.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/ssb/pci.c ++++ b/drivers/ssb/pci.c +@@ -909,6 +909,7 @@ static int ssb_pci_sprom_get(struct ssb_ + if (err) { + ssb_warn("WARNING: Using fallback SPROM failed (err %d)\n", + err); ++ goto out_free; + } else { + ssb_dbg("Using SPROM revision %d provided by platform\n", + sprom->revision); diff --git a/queue-4.4/thermal-hwmon-properly-report-critical-temperature-in-sysfs.patch b/queue-4.4/thermal-hwmon-properly-report-critical-temperature-in-sysfs.patch new file mode 100644 index 00000000000..1d94ed76c35 --- /dev/null +++ b/queue-4.4/thermal-hwmon-properly-report-critical-temperature-in-sysfs.patch @@ -0,0 +1,45 @@ +From f37fabb8643eaf8e3b613333a72f683770c85eca Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 22 Nov 2016 19:22:44 +0200 +Subject: thermal: hwmon: Properly report critical temperature in sysfs + +From: Krzysztof Kozlowski + +commit f37fabb8643eaf8e3b613333a72f683770c85eca upstream. + +In the critical sysfs entry the thermal hwmon was returning wrong +temperature to the user-space. It was reporting the temperature of the +first trip point instead of the temperature of critical trip point. + +For example: + /sys/class/hwmon/hwmon0/temp1_crit:50000 + /sys/class/thermal/thermal_zone0/trip_point_0_temp:50000 + /sys/class/thermal/thermal_zone0/trip_point_0_type:active + /sys/class/thermal/thermal_zone0/trip_point_3_temp:120000 + /sys/class/thermal/thermal_zone0/trip_point_3_type:critical + +Since commit e68b16abd91d ("thermal: add hwmon sysfs I/F") the driver +have been registering a sysfs entry if get_crit_temp() callback was +provided. However when accessed, it was calling get_trip_temp() instead +of the get_crit_temp(). + +Fixes: e68b16abd91d ("thermal: add hwmon sysfs I/F") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Zhang Rui +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/thermal/thermal_hwmon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/thermal/thermal_hwmon.c ++++ b/drivers/thermal/thermal_hwmon.c +@@ -98,7 +98,7 @@ temp_crit_show(struct device *dev, struc + int temperature; + int ret; + +- ret = tz->ops->get_trip_temp(tz, 0, &temperature); ++ ret = tz->ops->get_crit_temp(tz, &temperature); + if (ret) + return ret; + diff --git a/queue-4.4/timekeeping_force_unsigned_clocksource_to_nanoseconds_conversion.patch b/queue-4.4/timekeeping_force_unsigned_clocksource_to_nanoseconds_conversion.patch new file mode 100644 index 00000000000..1ef134e2574 --- /dev/null +++ b/queue-4.4/timekeeping_force_unsigned_clocksource_to_nanoseconds_conversion.patch @@ -0,0 +1,138 @@ +From 9c1645727b8fa90d07256fdfcc45bf831242a3ab Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Thu, 8 Dec 2016 20:49:32 +0000 +Subject: timekeeping_Force_unsigned_clocksource_to_nanoseconds_conversion + +From: Thomas Gleixner + +commit 9c1645727b8fa90d07256fdfcc45bf831242a3ab upstream. + +The clocksource delta to nanoseconds conversion is using signed math, but +the delta is unsigned. This makes the conversion space smaller than +necessary and in case of a multiplication overflow the conversion can +become negative. The conversion is done with scaled math: + + s64 nsec_delta = ((s64)clkdelta * clk->mult) >> clk->shift; + +Shifting a signed integer right obvioulsy preserves the sign, which has +interesting consequences: + + - Time jumps backwards + + - __iter_div_u64_rem() which is used in one of the calling code pathes + will take forever to piecewise calculate the seconds/nanoseconds part. + +This has been reported by several people with different scenarios: + +David observed that when stopping a VM with a debugger: + + "It was essentially the stopped by debugger case. I forget exactly why, + but the guest was being explicitly stopped from outside, it wasn't just + scheduling lag. I think it was something in the vicinity of 10 minutes + stopped." + + When lifting the stop the machine went dead. + +The stopped by debugger case is not really interesting, but nevertheless it +would be a good thing not to die completely. + +But this was also observed on a live system by Liav: + + "When the OS is too overloaded, delta will get a high enough value for the + msb of the sum delta * tkr->mult + tkr->xtime_nsec to be set, and so + after the shift the nsec variable will gain a value similar to + 0xffffffffff000000." + +Unfortunately this has been reintroduced recently with commit 6bd58f09e1d8 +("time: Add cycles to nanoseconds translation"). It had been fixed a year +ago already in commit 35a4933a8959 ("time: Avoid signed overflow in +timekeeping_get_ns()"). + +Though it's not surprising that the issue has been reintroduced because the +function itself and the whole call chain uses s64 for the result and the +propagation of it. The change in this recent commit is subtle: + + s64 nsec; + +- nsec = (d * m + n) >> s: ++ nsec = d * m + n; ++ nsec >>= s; + +d being type of cycle_t adds another level of obfuscation. + +This wouldn't have happened if the previous change to unsigned computation +would have made the 'nsec' variable u64 right away and a follow up patch +had cleaned up the whole call chain. + +There have been patches submitted which basically did a revert of the above +patch leaving everything else unchanged as signed. Back to square one. This +spawned a admittedly pointless discussion about potential users which rely +on the unsigned behaviour until someone pointed out that it had been fixed +before. The changelogs of said patches added further confusion as they made +finally false claims about the consequences for eventual users which expect +signed results. + +Despite delta being cycle_t, aka. u64, it's very well possible to hand in +a signed negative value and the signed computation will happily return the +correct result. But nobody actually sat down and analyzed the code which +was added as user after the propably unintended signed conversion. + +Though in sensitive code like this it's better to analyze it proper and +make sure that nothing relies on this than hunting the subtle wreckage half +a year later. After analyzing all call chains it stands that no caller can +hand in a negative value (which actually would work due to the s64 cast) +and rely on the signed math to do the right thing. + +Change the conversion function to unsigned math. The conversion of all call +chains is done in a follow up patch. + +This solves the starvation issue, which was caused by the negative result, +but it does not solve the underlying problem. It merily procrastinates +it. When the timekeeper update is deferred long enough that the unsigned +multiplication overflows, then time going backwards is observable again. + +It does neither solve the issue of clocksources with a small counter width +which will wrap around possibly several times and cause random time stamps +to be generated. But those are usually not found on systems used for +virtualization, so this is likely a non issue. + +I took the liberty to claim authorship for this simply because +analyzing all callsites and writing the changelog took substantially +more time than just making the simple s/s64/u64/ change and ignore the +rest. + +Fixes: 6bd58f09e1d8 ("time: Add cycles to nanoseconds translation") +Reported-by: David Gibson +Reported-by: Liav Rehana +Signed-off-by: Thomas Gleixner +Reviewed-by: David Gibson +Acked-by: Peter Zijlstra (Intel) +Cc: Parit Bhargava +Cc: Laurent Vivier +Cc: "Christopher S. Hall" +Cc: Chris Metcalf +Cc: Richard Cochran +Cc: John Stultz +Link: http://lkml.kernel.org/r/20161208204228.688545601@linutronix.de +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/time/timekeeping.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -298,10 +298,10 @@ u32 (*arch_gettimeoffset)(void) = defaul + static inline u32 arch_gettimeoffset(void) { return 0; } + #endif + +-static inline s64 timekeeping_delta_to_ns(struct tk_read_base *tkr, ++static inline u64 timekeeping_delta_to_ns(struct tk_read_base *tkr, + cycle_t delta) + { +- s64 nsec; ++ u64 nsec; + + nsec = delta * tkr->mult + tkr->xtime_nsec; + nsec >>= tkr->shift; diff --git a/queue-4.8/series b/queue-4.8/series new file mode 100644 index 00000000000..15ec6138330 --- /dev/null +++ b/queue-4.8/series @@ -0,0 +1,15 @@ +ssb-fix-error-routine-when-fallback-sprom-fails.patch +rtlwifi-fix-enter-exit-power_save.patch +perf-x86-fix-exclusion-of-bts-and-lbr-for-goldmont.patch +perf-x86-intel-cstate-prevent-hotplug-callback-leak.patch +rtl8xxxu-work-around-issue-with-8192eu-and-8723bu-devices-not-reconnecting.patch +cfg80211-mac80211-fix-bss-leaks-when-abandoning-assoc-attempts.patch +ath9k-fix-ath9k_hw_gpio_get-to-return-0-or-1-on-success.patch +ath9k-really-fix-led-polarity-for-some-mini-pci-ar9220-mb92-cards.patch +mmc-sdhci-fix-recovery-from-tuning-timeout.patch +regulator-stw481x-vmmc-fix-ages-old-enable-error.patch +timekeeping_force_unsigned_clocksource_to_nanoseconds_conversion.patch +gpio-chardev-return-error-for-seek-operations.patch +arm64-tegra-add-vdd_gpu-regulator-to-jetson-tx1.patch +clk-bcm2835-avoid-overwriting-the-div-info-when-disabling-a-pll_div-clk.patch +thermal-hwmon-properly-report-critical-temperature-in-sysfs.patch diff --git a/queue-4.9/series b/queue-4.9/series new file mode 100644 index 00000000000..57405f9bc41 --- /dev/null +++ b/queue-4.9/series @@ -0,0 +1,21 @@ +ssb-fix-error-routine-when-fallback-sprom-fails.patch +ath10k-fix-soft-lockup-during-firmware-crash-hw-restart.patch +rtlwifi-fix-enter-exit-power_save.patch +perf-x86-fix-exclusion-of-bts-and-lbr-for-goldmont.patch +perf-annotate-don-t-throw-error-for-zero-length-symbols.patch +perf-x86-intel-cstate-prevent-hotplug-callback-leak.patch +rtl8xxxu-work-around-issue-with-8192eu-and-8723bu-devices-not-reconnecting.patch +cfg80211-mac80211-fix-bss-leaks-when-abandoning-assoc-attempts.patch +ath9k-fix-ath9k_hw_gpio_get-to-return-0-or-1-on-success.patch +ath9k-really-fix-led-polarity-for-some-mini-pci-ar9220-mb92-cards.patch +ath9k-do-not-return-early-to-fix-rcu-unlocking.patch +revert-mmc-sdhci-reset-cmd-and-data-circuits-after-tuning-failure.patch +mmc-sdhci-fix-recovery-from-tuning-timeout.patch +regulator-stw481x-vmmc-fix-ages-old-enable-error.patch +mmc-sd-meet-alignment-requirements-for-raw_ssr-dma.patch +timekeeping_force_unsigned_clocksource_to_nanoseconds_conversion.patch +gpio-stmpe-fix-interrupt-handling-bug.patch +gpio-chardev-return-error-for-seek-operations.patch +arm64-tegra-add-vdd_gpu-regulator-to-jetson-tx1.patch +clk-bcm2835-avoid-overwriting-the-div-info-when-disabling-a-pll_div-clk.patch +thermal-hwmon-properly-report-critical-temperature-in-sysfs.patch