From: Greg Kroah-Hartman Date: Mon, 11 Jul 2016 23:39:05 +0000 (-0700) Subject: 4.6-stable patches X-Git-Tag: v4.6.5~34 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ac3656e148311709315f1a3b160509fef89542f0;p=thirdparty%2Fkernel%2Fstable-queue.git 4.6-stable patches added patches: arm-8578-1-mm-ensure-pmd_present-only-checks-the-valid-bit.patch arm-8579-1-mm-fix-definition-of-pmd_mknotpresent.patch arm-dts-sun6i-primo81-drop-constraints-on-dc1sw-regulator.patch arm-dts-sun6i-yones-toptech-bs1078-v2-drop-constraints-on-dc1sw-regulator.patch arm-imx6ul-fix-micrel-phy-mask.patch irqchip-mips-gic-fix-irqs-in-gic_dev_domain.patch mips-kvm-fix-modular-kvm-under-qemu.patch regulator-qcom_smd-add-list_voltage-callback.patch regulator-qcom_smd-add-regulator-ops-for-pm8941-lnldo.patch rpc-share-one-xps-between-all-backchannels.patch sunrpc-fix-xprt-leak-on-xps-allocation-failure.patch ubifs-implement-migratepage.patch --- diff --git a/queue-4.6/arm-8578-1-mm-ensure-pmd_present-only-checks-the-valid-bit.patch b/queue-4.6/arm-8578-1-mm-ensure-pmd_present-only-checks-the-valid-bit.patch new file mode 100644 index 00000000000..831ed0a3d62 --- /dev/null +++ b/queue-4.6/arm-8578-1-mm-ensure-pmd_present-only-checks-the-valid-bit.patch @@ -0,0 +1,66 @@ +From 624531886987f0f1b5d01fb598034d039198e090 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Tue, 7 Jun 2016 17:57:54 +0100 +Subject: ARM: 8578/1: mm: ensure pmd_present only checks the valid bit + +From: Will Deacon + +commit 624531886987f0f1b5d01fb598034d039198e090 upstream. + +In a subsequent patch, pmd_mknotpresent will clear the valid bit of the +pmd entry, resulting in a not-present entry from the hardware's +perspective. Unfortunately, pmd_present simply checks for a non-zero pmd +value and will therefore continue to return true even after a +pmd_mknotpresent operation. Since pmd_mknotpresent is only used for +managing huge entries, this is only an issue for the 3-level case. + +This patch fixes the 3-level pmd_present implementation to take into +account the valid bit. For bisectability, the change is made before the +fix to pmd_mknotpresent. + +[catalin.marinas@arm.com: comment update regarding pmd_mknotpresent patch] + +Fixes: 8d9625070073 ("ARM: mm: Transparent huge page support for LPAE systems.") +Cc: Russell King +Cc: Steve Capper +Signed-off-by: Will Deacon +Signed-off-by: Catalin Marinas +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/include/asm/pgtable-2level.h | 1 + + arch/arm/include/asm/pgtable-3level.h | 1 + + arch/arm/include/asm/pgtable.h | 1 - + 3 files changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/arm/include/asm/pgtable-2level.h ++++ b/arch/arm/include/asm/pgtable-2level.h +@@ -193,6 +193,7 @@ static inline pmd_t *pmd_offset(pud_t *p + + #define pmd_large(pmd) (pmd_val(pmd) & 2) + #define pmd_bad(pmd) (pmd_val(pmd) & 2) ++#define pmd_present(pmd) (pmd_val(pmd)) + + #define copy_pmd(pmdpd,pmdps) \ + do { \ +--- a/arch/arm/include/asm/pgtable-3level.h ++++ b/arch/arm/include/asm/pgtable-3level.h +@@ -211,6 +211,7 @@ static inline pmd_t *pmd_offset(pud_t *p + : !!(pmd_val(pmd) & (val))) + #define pmd_isclear(pmd, val) (!(pmd_val(pmd) & (val))) + ++#define pmd_present(pmd) (pmd_isset((pmd), L_PMD_SECT_VALID)) + #define pmd_young(pmd) (pmd_isset((pmd), PMD_SECT_AF)) + #define pte_special(pte) (pte_isset((pte), L_PTE_SPECIAL)) + static inline pte_t pte_mkspecial(pte_t pte) +--- a/arch/arm/include/asm/pgtable.h ++++ b/arch/arm/include/asm/pgtable.h +@@ -182,7 +182,6 @@ extern pgd_t swapper_pg_dir[PTRS_PER_PGD + #define pgd_offset_k(addr) pgd_offset(&init_mm, addr) + + #define pmd_none(pmd) (!pmd_val(pmd)) +-#define pmd_present(pmd) (pmd_val(pmd)) + + static inline pte_t *pmd_page_vaddr(pmd_t pmd) + { diff --git a/queue-4.6/arm-8579-1-mm-fix-definition-of-pmd_mknotpresent.patch b/queue-4.6/arm-8579-1-mm-fix-definition-of-pmd_mknotpresent.patch new file mode 100644 index 00000000000..641086120d7 --- /dev/null +++ b/queue-4.6/arm-8579-1-mm-fix-definition-of-pmd_mknotpresent.patch @@ -0,0 +1,51 @@ +From 56530f5d2ddc9b9fade7ef8db9cb886e9dc689b5 Mon Sep 17 00:00:00 2001 +From: Steve Capper +Date: Tue, 7 Jun 2016 17:58:06 +0100 +Subject: ARM: 8579/1: mm: Fix definition of pmd_mknotpresent + +From: Steve Capper + +commit 56530f5d2ddc9b9fade7ef8db9cb886e9dc689b5 upstream. + +Currently pmd_mknotpresent will use a zero entry to respresent an +invalidated pmd. + +Unfortunately this definition clashes with pmd_none, thus it is +possible for a race condition to occur if zap_pmd_range sees pmd_none +whilst __split_huge_pmd_locked is running too with pmdp_invalidate +just called. + +This patch fixes the race condition by modifying pmd_mknotpresent to +create non-zero faulting entries (as is done in other architectures), +removing the ambiguity with pmd_none. + +[catalin.marinas@arm.com: using L_PMD_SECT_VALID instead of PMD_TYPE_SECT] + +Fixes: 8d9625070073 ("ARM: mm: Transparent huge page support for LPAE systems.") +Reported-by: Kirill A. Shutemov +Acked-by: Will Deacon +Cc: Russell King +Signed-off-by: Steve Capper +Signed-off-by: Catalin Marinas +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/include/asm/pgtable-3level.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/include/asm/pgtable-3level.h ++++ b/arch/arm/include/asm/pgtable-3level.h +@@ -250,10 +250,10 @@ PMD_BIT_FUNC(mkyoung, |= PMD_SECT_AF); + #define pfn_pmd(pfn,prot) (__pmd(((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot))) + #define mk_pmd(page,prot) pfn_pmd(page_to_pfn(page),prot) + +-/* represent a notpresent pmd by zero, this is used by pmdp_invalidate */ ++/* represent a notpresent pmd by faulting entry, this is used by pmdp_invalidate */ + static inline pmd_t pmd_mknotpresent(pmd_t pmd) + { +- return __pmd(0); ++ return __pmd(pmd_val(pmd) & ~L_PMD_SECT_VALID); + } + + static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot) diff --git a/queue-4.6/arm-dts-sun6i-primo81-drop-constraints-on-dc1sw-regulator.patch b/queue-4.6/arm-dts-sun6i-primo81-drop-constraints-on-dc1sw-regulator.patch new file mode 100644 index 00000000000..57b889843fe --- /dev/null +++ b/queue-4.6/arm-dts-sun6i-primo81-drop-constraints-on-dc1sw-regulator.patch @@ -0,0 +1,53 @@ +From cb84f6c0a25eb76b1f838eb63e212705c0c06b5f Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Wed, 11 May 2016 13:23:13 +0800 +Subject: ARM: dts: sun6i: primo81: Drop constraints on dc1sw regulator + +From: Chen-Yu Tsai + +commit cb84f6c0a25eb76b1f838eb63e212705c0c06b5f upstream. + +This is the same issue fixed in commit dcf5341f0150 ("ARM: dts: +sun8i-q8-common: Do not set constraints on dc1sw regulator"). +Commit message copied: + +dc1sw is an on/off only regulator and as such it cannot have constraints. + +This is a limitation of the kernel regulator implementation which resolves +supplies on the first regulator_get(), which is done after applying +constraints, and applying the constrains will fail because it calls +_regulator_get_voltage() and _regulator_do_set_voltage() both of which +will fail on a switch regulator when there is no supply (yet). + +This causes registering of all axp22x regulators to fail with the +following errors: + +[ 1.395249] vcc-lcd: failed to get the current voltage(-22) +[ 1.405131] axp20x-regulator axp20x-regulator: Failed to register dc1sw +[ 1.412436] axp20x-regulator: probe of axp20x-regulator failed with error -22 + +This commit removes the constrains on dc1sw / vcc-lcd fixing this problem. +Note that dcdc1 itself is contrained to the exact same values, so this +does not change anything. + +Cc: Hans de Goede +Signed-off-by: Chen-Yu Tsai +Acked-by: Maxime Ripard +Signed-off-by: Olof Johansson +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/sun6i-a31s-primo81.dts | 2 -- + 1 file changed, 2 deletions(-) + +--- a/arch/arm/boot/dts/sun6i-a31s-primo81.dts ++++ b/arch/arm/boot/dts/sun6i-a31s-primo81.dts +@@ -176,8 +176,6 @@ + }; + + ®_dc1sw { +- regulator-min-microvolt = <3000000>; +- regulator-max-microvolt = <3000000>; + regulator-name = "vcc-lcd"; + }; + diff --git a/queue-4.6/arm-dts-sun6i-yones-toptech-bs1078-v2-drop-constraints-on-dc1sw-regulator.patch b/queue-4.6/arm-dts-sun6i-yones-toptech-bs1078-v2-drop-constraints-on-dc1sw-regulator.patch new file mode 100644 index 00000000000..246adfda624 --- /dev/null +++ b/queue-4.6/arm-dts-sun6i-yones-toptech-bs1078-v2-drop-constraints-on-dc1sw-regulator.patch @@ -0,0 +1,53 @@ +From b223d6242c372a81cca3bb81998f53d3b3e3fb70 Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Wed, 11 May 2016 13:23:14 +0800 +Subject: ARM: dts: sun6i: yones-toptech-bs1078-v2: Drop constraints on dc1sw regulator + +From: Chen-Yu Tsai + +commit b223d6242c372a81cca3bb81998f53d3b3e3fb70 upstream. + +This is the same issue fixed in commit dcf5341f0150 ("ARM: dts: +sun8i-q8-common: Do not set constraints on dc1sw regulator"). +Commit message copied: + +dc1sw is an on/off only regulator and as such it cannot have constraints. + +This is a limitation of the kernel regulator implementation which resolves +supplies on the first regulator_get(), which is done after applying +constraints, and applying the constrains will fail because it calls +_regulator_get_voltage() and _regulator_do_set_voltage() both of which +will fail on a switch regulator when there is no supply (yet). + +This causes registering of all axp22x regulators to fail with the +following errors: + +[ 1.395249] vcc-lcd: failed to get the current voltage(-22) +[ 1.405131] axp20x-regulator axp20x-regulator: Failed to register dc1sw +[ 1.412436] axp20x-regulator: probe of axp20x-regulator failed with error -22 + +This commit removes the constrains on dc1sw / vcc-lcd fixing this problem. +Note that dcdc1 itself is contrained to the exact same values, so this +does not change anything. + +Cc: Hans de Goede +Signed-off-by: Chen-Yu Tsai +Acked-by: Maxime Ripard +Signed-off-by: Olof Johansson +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/sun6i-a31s-yones-toptech-bs1078-v2.dts | 2 -- + 1 file changed, 2 deletions(-) + +--- a/arch/arm/boot/dts/sun6i-a31s-yones-toptech-bs1078-v2.dts ++++ b/arch/arm/boot/dts/sun6i-a31s-yones-toptech-bs1078-v2.dts +@@ -135,8 +135,6 @@ + + ®_dc1sw { + regulator-name = "vcc-lcd-usb2"; +- regulator-min-microvolt = <3000000>; +- regulator-max-microvolt = <3000000>; + }; + + ®_dc5ldo { diff --git a/queue-4.6/arm-imx6ul-fix-micrel-phy-mask.patch b/queue-4.6/arm-imx6ul-fix-micrel-phy-mask.patch new file mode 100644 index 00000000000..14f6a161a11 --- /dev/null +++ b/queue-4.6/arm-imx6ul-fix-micrel-phy-mask.patch @@ -0,0 +1,36 @@ +From 20c15226d1c73150c4d9107301cac5dda0b7f995 Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Wed, 11 May 2016 16:39:30 -0300 +Subject: ARM: imx6ul: Fix Micrel PHY mask + +From: Fabio Estevam + +commit 20c15226d1c73150c4d9107301cac5dda0b7f995 upstream. + +The value used for Micrel PHY mask is not correct. Use the +MICREL_PHY_ID_MASK definition instead. + +Thanks to Jiri Luznicky for proposing the fix at +https://community.freescale.com/thread/387739 + +Fixes: 709bc0657fe6f9f55 ("ARM: imx6ul: add fec MAC refrence clock and phy fixup init") +Signed-off-by: Fabio Estevam +Reviewed-by: Andrew Lunn +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-imx/mach-imx6ul.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/mach-imx/mach-imx6ul.c ++++ b/arch/arm/mach-imx/mach-imx6ul.c +@@ -46,7 +46,7 @@ static int ksz8081_phy_fixup(struct phy_ + static void __init imx6ul_enet_phy_init(void) + { + if (IS_BUILTIN(CONFIG_PHYLIB)) +- phy_register_fixup_for_uid(PHY_ID_KSZ8081, 0xffffffff, ++ phy_register_fixup_for_uid(PHY_ID_KSZ8081, MICREL_PHY_ID_MASK, + ksz8081_phy_fixup); + } + diff --git a/queue-4.6/irqchip-mips-gic-fix-irqs-in-gic_dev_domain.patch b/queue-4.6/irqchip-mips-gic-fix-irqs-in-gic_dev_domain.patch new file mode 100644 index 00000000000..48cf91bc4ee --- /dev/null +++ b/queue-4.6/irqchip-mips-gic-fix-irqs-in-gic_dev_domain.patch @@ -0,0 +1,75 @@ +From 4b2312bd0592708c85ed94368c874819e7013309 Mon Sep 17 00:00:00 2001 +From: Harvey Hunt +Date: Mon, 23 May 2016 12:05:52 +0100 +Subject: irqchip/mips-gic: Fix IRQs in gic_dev_domain + +From: Harvey Hunt + +commit 4b2312bd0592708c85ed94368c874819e7013309 upstream. + +When allocating a new device IRQ, gic_dev_domain_alloc() correctly calls +irq_domain_set_hwirq_and_chip(), but gic_irq_domain_alloc() does not. This +means that gic_irq_domain believes all IRQs from the dev domain have an +hwirq of 0 and creates incorrect mappings in the linear_revmap. As +gic_irq_domain is a parent of the gic_dev_domain, this leads to an +inability to boot on devices with a GIC. Excerpt of the error: + +[ 2.297649] irq 0: nobody cared (try booting with the "irqpoll" option) +... +[ 2.436963] handlers: +[ 2.439492] Disabling IRQ #0 + +Fix this by calling irq_domain_set_hwirq_and_chip() for both the dev and +irq domain. + +Now that we are modifying the parent domain, be sure to clear it up in +case of an allocation error. + +Fixes: c98c1822ee13 ("irqchip/mips-gic: Add device hierarchy domain") +Fixes: 2af70a962070 ("irqchip/mips-gic: Add a IPI hierarchy domain") +Signed-off-by: Harvey Hunt +Tested-by: Govindraj Raja # On Pistachio SoC +Reviewed-by: Matt Redfearn +Cc: linux-mips@linux-mips.org +Cc: Qais Yousef +Cc: jason@lakedaemon.net +Cc: marc.zyngier@arm.com +Link: http://lkml.kernel.org/r/1464001552-31174-1-git-send-email-harvey.hunt@imgtec.com +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/irqchip/irq-mips-gic.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/irqchip/irq-mips-gic.c ++++ b/drivers/irqchip/irq-mips-gic.c +@@ -734,6 +734,12 @@ static int gic_irq_domain_alloc(struct i + /* verify that it doesn't conflict with an IPI irq */ + if (test_bit(spec->hwirq, ipi_resrv)) + return -EBUSY; ++ ++ hwirq = GIC_SHARED_TO_HWIRQ(spec->hwirq); ++ ++ return irq_domain_set_hwirq_and_chip(d, virq, hwirq, ++ &gic_level_irq_controller, ++ NULL); + } else { + base_hwirq = find_first_bit(ipi_resrv, gic_shared_intrs); + if (base_hwirq == gic_shared_intrs) { +@@ -855,10 +861,14 @@ static int gic_dev_domain_alloc(struct i + &gic_level_irq_controller, + NULL); + if (ret) +- return ret; ++ goto error; + } + + return 0; ++ ++error: ++ irq_domain_free_irqs_parent(d, virq, nr_irqs); ++ return ret; + } + + void gic_dev_domain_free(struct irq_domain *d, unsigned int virq, diff --git a/queue-4.6/mips-kvm-fix-modular-kvm-under-qemu.patch b/queue-4.6/mips-kvm-fix-modular-kvm-under-qemu.patch new file mode 100644 index 00000000000..67b1b8848cd --- /dev/null +++ b/queue-4.6/mips-kvm-fix-modular-kvm-under-qemu.patch @@ -0,0 +1,104 @@ +From 797179bc4fe06c89e47a9f36f886f68640b423f8 Mon Sep 17 00:00:00 2001 +From: James Hogan +Date: Thu, 9 Jun 2016 10:50:43 +0100 +Subject: MIPS: KVM: Fix modular KVM under QEMU +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: James Hogan + +commit 797179bc4fe06c89e47a9f36f886f68640b423f8 upstream. + +Copy __kvm_mips_vcpu_run() into unmapped memory, so that we can never +get a TLB refill exception in it when KVM is built as a module. + +This was observed to happen with the host MIPS kernel running under +QEMU, due to a not entirely transparent optimisation in the QEMU TLB +handling where TLB entries replaced with TLBWR are copied to a separate +part of the TLB array. Code in those pages continue to be executable, +but those mappings persist only until the next ASID switch, even if they +are marked global. + +An ASID switch happens in __kvm_mips_vcpu_run() at exception level after +switching to the guest exception base. Subsequent TLB mapped kernel +instructions just prior to switching to the guest trigger a TLB refill +exception, which enters the guest exception handlers without updating +EPC. This appears as a guest triggered TLB refill on a host kernel +mapped (host KSeg2) address, which is not handled correctly as user +(guest) mode accesses to kernel (host) segments always generate address +error exceptions. + +Signed-off-by: James Hogan +Cc: Paolo Bonzini +Cc: Radim Krčmář +Cc: Ralf Baechle +Cc: kvm@vger.kernel.org +Cc: linux-mips@linux-mips.org +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/include/asm/kvm_host.h | 1 + + arch/mips/kvm/interrupt.h | 1 + + arch/mips/kvm/locore.S | 1 + + arch/mips/kvm/mips.c | 11 ++++++++++- + 4 files changed, 13 insertions(+), 1 deletion(-) + +--- a/arch/mips/include/asm/kvm_host.h ++++ b/arch/mips/include/asm/kvm_host.h +@@ -336,6 +336,7 @@ struct kvm_mips_tlb { + #define KVM_MIPS_GUEST_TLB_SIZE 64 + struct kvm_vcpu_arch { + void *host_ebase, *guest_ebase; ++ int (*vcpu_run)(struct kvm_run *run, struct kvm_vcpu *vcpu); + unsigned long host_stack; + unsigned long host_gp; + +--- a/arch/mips/kvm/interrupt.h ++++ b/arch/mips/kvm/interrupt.h +@@ -28,6 +28,7 @@ + #define MIPS_EXC_MAX 12 + /* XXXSL More to follow */ + ++extern char __kvm_mips_vcpu_run_end[]; + extern char mips32_exception[], mips32_exceptionEnd[]; + extern char mips32_GuestException[], mips32_GuestExceptionEnd[]; + +--- a/arch/mips/kvm/locore.S ++++ b/arch/mips/kvm/locore.S +@@ -227,6 +227,7 @@ FEXPORT(__kvm_mips_load_k0k1) + + /* Jump to guest */ + eret ++EXPORT(__kvm_mips_vcpu_run_end) + + VECTOR(MIPSX(exception), unknown) + /* Find out what mode we came from and jump to the proper handler. */ +--- a/arch/mips/kvm/mips.c ++++ b/arch/mips/kvm/mips.c +@@ -314,6 +314,15 @@ struct kvm_vcpu *kvm_arch_vcpu_create(st + memcpy(gebase + offset, mips32_GuestException, + mips32_GuestExceptionEnd - mips32_GuestException); + ++#ifdef MODULE ++ offset += mips32_GuestExceptionEnd - mips32_GuestException; ++ memcpy(gebase + offset, (char *)__kvm_mips_vcpu_run, ++ __kvm_mips_vcpu_run_end - (char *)__kvm_mips_vcpu_run); ++ vcpu->arch.vcpu_run = gebase + offset; ++#else ++ vcpu->arch.vcpu_run = __kvm_mips_vcpu_run; ++#endif ++ + /* Invalidate the icache for these ranges */ + local_flush_icache_range((unsigned long)gebase, + (unsigned long)gebase + ALIGN(size, PAGE_SIZE)); +@@ -403,7 +412,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v + /* Disable hardware page table walking while in guest */ + htw_stop(); + +- r = __kvm_mips_vcpu_run(run, vcpu); ++ r = vcpu->arch.vcpu_run(run, vcpu); + + /* Re-enable HTW before enabling interrupts */ + htw_start(); diff --git a/queue-4.6/regulator-qcom_smd-add-list_voltage-callback.patch b/queue-4.6/regulator-qcom_smd-add-list_voltage-callback.patch new file mode 100644 index 00000000000..0e64ee3589c --- /dev/null +++ b/queue-4.6/regulator-qcom_smd-add-list_voltage-callback.patch @@ -0,0 +1,32 @@ +From a8a47540ebe32f1733eebc3e5699af580ceaa3f5 Mon Sep 17 00:00:00 2001 +From: Srinivas Kandagatla +Date: Thu, 2 Jun 2016 11:23:15 +0100 +Subject: regulator: qcom_smd: add list_voltage callback + +From: Srinivas Kandagatla + +commit a8a47540ebe32f1733eebc3e5699af580ceaa3f5 upstream. + +This patch adds support to list_voltage callback, so that consumers +like mmc core, can get information of supported voltage range. + +Without this patch there is no way for mmc core to know this voltage range. + +Signed-off-by: Srinivas Kandagatla +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/qcom_smd-regulator.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/regulator/qcom_smd-regulator.c ++++ b/drivers/regulator/qcom_smd-regulator.c +@@ -140,6 +140,7 @@ static const struct regulator_ops rpm_sm + .enable = rpm_reg_enable, + .disable = rpm_reg_disable, + .is_enabled = rpm_reg_is_enabled, ++ .list_voltage = regulator_list_voltage_linear_range, + + .get_voltage = rpm_reg_get_voltage, + .set_voltage = rpm_reg_set_voltage, diff --git a/queue-4.6/regulator-qcom_smd-add-regulator-ops-for-pm8941-lnldo.patch b/queue-4.6/regulator-qcom_smd-add-regulator-ops-for-pm8941-lnldo.patch new file mode 100644 index 00000000000..3b5ad949d2c --- /dev/null +++ b/queue-4.6/regulator-qcom_smd-add-regulator-ops-for-pm8941-lnldo.patch @@ -0,0 +1,52 @@ +From d1e44b6b2823f1751ffe7e7589f545f05cfe2095 Mon Sep 17 00:00:00 2001 +From: Srinivas Kandagatla +Date: Fri, 3 Jun 2016 12:23:09 +0100 +Subject: regulator: qcom_smd: add regulator ops for pm8941 lnldo + +From: Srinivas Kandagatla + +commit d1e44b6b2823f1751ffe7e7589f545f05cfe2095 upstream. + +After "regulator: qcom_smd: add list_voltage callback" patch adding +pm8941 lnldo regulators would bug on list_voltages as it is a fixed +regulator without any linear range. +This patch fixes that issue by adding dedicated ops for pm8941 lnldo +without list_voltages callback. + +Signed-off-by: Srinivas Kandagatla +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/qcom_smd-regulator.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/regulator/qcom_smd-regulator.c ++++ b/drivers/regulator/qcom_smd-regulator.c +@@ -148,6 +148,17 @@ static const struct regulator_ops rpm_sm + .set_load = rpm_reg_set_load, + }; + ++static const struct regulator_ops rpm_smps_ldo_ops_fixed = { ++ .enable = rpm_reg_enable, ++ .disable = rpm_reg_disable, ++ .is_enabled = rpm_reg_is_enabled, ++ ++ .get_voltage = rpm_reg_get_voltage, ++ .set_voltage = rpm_reg_set_voltage, ++ ++ .set_load = rpm_reg_set_load, ++}; ++ + static const struct regulator_ops rpm_switch_ops = { + .enable = rpm_reg_enable, + .disable = rpm_reg_disable, +@@ -248,7 +259,7 @@ static const struct regulator_desc pm894 + static const struct regulator_desc pm8941_lnldo = { + .fixed_uV = 1740000, + .n_voltages = 1, +- .ops = &rpm_smps_ldo_ops, ++ .ops = &rpm_smps_ldo_ops_fixed, + }; + + static const struct regulator_desc pm8941_switch = { diff --git a/queue-4.6/rpc-share-one-xps-between-all-backchannels.patch b/queue-4.6/rpc-share-one-xps-between-all-backchannels.patch new file mode 100644 index 00000000000..b2db9bd516b --- /dev/null +++ b/queue-4.6/rpc-share-one-xps-between-all-backchannels.patch @@ -0,0 +1,95 @@ +From 39a9beab5acb83176e8b9a4f0778749a09341f1f Mon Sep 17 00:00:00 2001 +From: "J. Bruce Fields" +Date: Tue, 17 May 2016 12:38:21 -0400 +Subject: rpc: share one xps between all backchannels + +From: J. Bruce Fields + +commit 39a9beab5acb83176e8b9a4f0778749a09341f1f upstream. + +The spec allows backchannels for multiple clients to share the same tcp +connection. When that happens, we need to use the same xprt for all of +them. Similarly, we need the same xps. + +This fixes list corruption introduced by the multipath code. + +Signed-off-by: J. Bruce Fields +Acked-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/sunrpc/svc_xprt.h | 1 + + include/linux/sunrpc/xprt.h | 1 + + net/sunrpc/clnt.c | 18 ++++++++++++++---- + net/sunrpc/svc_xprt.c | 2 ++ + net/sunrpc/xprtsock.c | 1 + + 5 files changed, 19 insertions(+), 4 deletions(-) + +--- a/include/linux/sunrpc/svc_xprt.h ++++ b/include/linux/sunrpc/svc_xprt.h +@@ -84,6 +84,7 @@ struct svc_xprt { + + struct net *xpt_net; + struct rpc_xprt *xpt_bc_xprt; /* NFSv4.1 backchannel */ ++ struct rpc_xprt_switch *xpt_bc_xps; /* NFSv4.1 backchannel */ + }; + + static inline void unregister_xpt_user(struct svc_xprt *xpt, struct svc_xpt_user *u) +--- a/include/linux/sunrpc/xprt.h ++++ b/include/linux/sunrpc/xprt.h +@@ -296,6 +296,7 @@ struct xprt_create { + size_t addrlen; + const char *servername; + struct svc_xprt *bc_xprt; /* NFSv4.1 backchannel */ ++ struct rpc_xprt_switch *bc_xps; + unsigned int flags; + }; + +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -452,10 +452,20 @@ static struct rpc_clnt *rpc_create_xprt( + struct rpc_clnt *clnt = NULL; + struct rpc_xprt_switch *xps; + +- xps = xprt_switch_alloc(xprt, GFP_KERNEL); +- if (xps == NULL) { +- xprt_put(xprt); +- return ERR_PTR(-ENOMEM); ++ if (args->bc_xprt && args->bc_xprt->xpt_bc_xps) { ++ WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP); ++ xps = args->bc_xprt->xpt_bc_xps; ++ xprt_switch_get(xps); ++ } else { ++ xps = xprt_switch_alloc(xprt, GFP_KERNEL); ++ if (xps == NULL) { ++ xprt_put(xprt); ++ return ERR_PTR(-ENOMEM); ++ } ++ if (xprt->bc_xprt) { ++ xprt_switch_get(xps); ++ xprt->bc_xprt->xpt_bc_xps = xps; ++ } + } + clnt = rpc_new_client(args, xps, xprt, NULL); + if (IS_ERR(clnt)) +--- a/net/sunrpc/svc_xprt.c ++++ b/net/sunrpc/svc_xprt.c +@@ -136,6 +136,8 @@ static void svc_xprt_free(struct kref *k + /* See comment on corresponding get in xs_setup_bc_tcp(): */ + if (xprt->xpt_bc_xprt) + xprt_put(xprt->xpt_bc_xprt); ++ if (xprt->xpt_bc_xps) ++ xprt_switch_put(xprt->xpt_bc_xps); + xprt->xpt_ops->xpo_free(xprt); + module_put(owner); + } +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -3050,6 +3050,7 @@ static struct rpc_xprt *xs_setup_bc_tcp( + return xprt; + + args->bc_xprt->xpt_bc_xprt = NULL; ++ args->bc_xprt->xpt_bc_xps = NULL; + xprt_put(xprt); + ret = ERR_PTR(-EINVAL); + out_err: diff --git a/queue-4.6/series b/queue-4.6/series index 63c2e70f4e2..20f4243fad5 100644 --- a/queue-4.6/series +++ b/queue-4.6/series @@ -52,3 +52,15 @@ pnfs_nfs-fix-_cancel_empty_pagelist.patch nfs-fix-a-double-page-unlock.patch make-nfs_atomic_open-call-d_drop-on-all-open_context-errors.patch nfs-fix-another-open_downgrade-bug.patch +sunrpc-fix-xprt-leak-on-xps-allocation-failure.patch +rpc-share-one-xps-between-all-backchannels.patch +regulator-qcom_smd-add-list_voltage-callback.patch +regulator-qcom_smd-add-regulator-ops-for-pm8941-lnldo.patch +arm-imx6ul-fix-micrel-phy-mask.patch +arm-8578-1-mm-ensure-pmd_present-only-checks-the-valid-bit.patch +arm-8579-1-mm-fix-definition-of-pmd_mknotpresent.patch +arm-dts-sun6i-yones-toptech-bs1078-v2-drop-constraints-on-dc1sw-regulator.patch +arm-dts-sun6i-primo81-drop-constraints-on-dc1sw-regulator.patch +mips-kvm-fix-modular-kvm-under-qemu.patch +irqchip-mips-gic-fix-irqs-in-gic_dev_domain.patch +ubifs-implement-migratepage.patch diff --git a/queue-4.6/sunrpc-fix-xprt-leak-on-xps-allocation-failure.patch b/queue-4.6/sunrpc-fix-xprt-leak-on-xps-allocation-failure.patch new file mode 100644 index 00000000000..556e175dcb9 --- /dev/null +++ b/queue-4.6/sunrpc-fix-xprt-leak-on-xps-allocation-failure.patch @@ -0,0 +1,35 @@ +From 1208fd569c07ab84aa5d024abd863267c2953b4a Mon Sep 17 00:00:00 2001 +From: "J. Bruce Fields" +Date: Fri, 20 May 2016 17:07:17 -0400 +Subject: SUNRPC: fix xprt leak on xps allocation failure + +From: J. Bruce Fields + +commit 1208fd569c07ab84aa5d024abd863267c2953b4a upstream. + +Callers of rpc_create_xprt expect it to put the xprt on success and +failure. + +Signed-off-by: J. Bruce Fields +Acked-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/clnt.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -453,9 +453,10 @@ static struct rpc_clnt *rpc_create_xprt( + struct rpc_xprt_switch *xps; + + xps = xprt_switch_alloc(xprt, GFP_KERNEL); +- if (xps == NULL) ++ if (xps == NULL) { ++ xprt_put(xprt); + return ERR_PTR(-ENOMEM); +- ++ } + clnt = rpc_new_client(args, xps, xprt, NULL); + if (IS_ERR(clnt)) + return clnt; diff --git a/queue-4.6/ubifs-implement-migratepage.patch b/queue-4.6/ubifs-implement-migratepage.patch new file mode 100644 index 00000000000..41f04293f33 --- /dev/null +++ b/queue-4.6/ubifs-implement-migratepage.patch @@ -0,0 +1,98 @@ +From 4ac1c17b2044a1b4b2fbed74451947e905fc2992 Mon Sep 17 00:00:00 2001 +From: "Kirill A. Shutemov" +Date: Thu, 16 Jun 2016 23:26:15 +0200 +Subject: UBIFS: Implement ->migratepage() + +From: Kirill A. Shutemov + +commit 4ac1c17b2044a1b4b2fbed74451947e905fc2992 upstream. + +During page migrations UBIFS might get confused +and the following assert triggers: +[ 213.480000] UBIFS assert failed in ubifs_set_page_dirty at 1451 (pid 436) +[ 213.490000] CPU: 0 PID: 436 Comm: drm-stress-test Not tainted 4.4.4-00176-geaa802524636-dirty #1008 +[ 213.490000] Hardware name: Allwinner sun4i/sun5i Families +[ 213.490000] [] (unwind_backtrace) from [] (show_stack+0x10/0x14) +[ 213.490000] [] (show_stack) from [] (dump_stack+0x8c/0xa0) +[ 213.490000] [] (dump_stack) from [] (ubifs_set_page_dirty+0x44/0x50) +[ 213.490000] [] (ubifs_set_page_dirty) from [] (try_to_unmap_one+0x10c/0x3a8) +[ 213.490000] [] (try_to_unmap_one) from [] (rmap_walk+0xb4/0x290) +[ 213.490000] [] (rmap_walk) from [] (try_to_unmap+0x64/0x80) +[ 213.490000] [] (try_to_unmap) from [] (migrate_pages+0x328/0x7a0) +[ 213.490000] [] (migrate_pages) from [] (alloc_contig_range+0x168/0x2f4) +[ 213.490000] [] (alloc_contig_range) from [] (cma_alloc+0x170/0x2c0) +[ 213.490000] [] (cma_alloc) from [] (__alloc_from_contiguous+0x38/0xd8) +[ 213.490000] [] (__alloc_from_contiguous) from [] (__dma_alloc+0x23c/0x274) +[ 213.490000] [] (__dma_alloc) from [] (arm_dma_alloc+0x54/0x5c) +[ 213.490000] [] (arm_dma_alloc) from [] (drm_gem_cma_create+0xb8/0xf0) +[ 213.490000] [] (drm_gem_cma_create) from [] (drm_gem_cma_create_with_handle+0x1c/0xe8) +[ 213.490000] [] (drm_gem_cma_create_with_handle) from [] (drm_gem_cma_dumb_create+0x3c/0x48) +[ 213.490000] [] (drm_gem_cma_dumb_create) from [] (drm_ioctl+0x12c/0x444) +[ 213.490000] [] (drm_ioctl) from [] (do_vfs_ioctl+0x3f4/0x614) +[ 213.490000] [] (do_vfs_ioctl) from [] (SyS_ioctl+0x34/0x5c) +[ 213.490000] [] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x34) + +UBIFS is using PagePrivate() which can have different meanings across +filesystems. Therefore the generic page migration code cannot handle this +case correctly. +We have to implement our own migration function which basically does a +plain copy but also duplicates the page private flag. +UBIFS is not a block device filesystem and cannot use buffer_migrate_page(). + +Signed-off-by: Kirill A. Shutemov +[rw: Massaged changelog, build fixes, etc...] +Signed-off-by: Richard Weinberger +Acked-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ubifs/file.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +--- a/fs/ubifs/file.c ++++ b/fs/ubifs/file.c +@@ -52,6 +52,7 @@ + #include "ubifs.h" + #include + #include ++#include + + static int read_block(struct inode *inode, void *addr, unsigned int block, + struct ubifs_data_node *dn) +@@ -1452,6 +1453,26 @@ static int ubifs_set_page_dirty(struct p + return ret; + } + ++#ifdef CONFIG_MIGRATION ++static int ubifs_migrate_page(struct address_space *mapping, ++ struct page *newpage, struct page *page, enum migrate_mode mode) ++{ ++ int rc; ++ ++ rc = migrate_page_move_mapping(mapping, newpage, page, NULL, mode, 0); ++ if (rc != MIGRATEPAGE_SUCCESS) ++ return rc; ++ ++ if (PagePrivate(page)) { ++ ClearPagePrivate(page); ++ SetPagePrivate(newpage); ++ } ++ ++ migrate_page_copy(newpage, page); ++ return MIGRATEPAGE_SUCCESS; ++} ++#endif ++ + static int ubifs_releasepage(struct page *page, gfp_t unused_gfp_flags) + { + /* +@@ -1591,6 +1612,9 @@ const struct address_space_operations ub + .write_end = ubifs_write_end, + .invalidatepage = ubifs_invalidatepage, + .set_page_dirty = ubifs_set_page_dirty, ++#ifdef CONFIG_MIGRATION ++ .migratepage = ubifs_migrate_page, ++#endif + .releasepage = ubifs_releasepage, + }; +