From: Greg Kroah-Hartman Date: Tue, 1 Mar 2016 19:09:26 +0000 (-0800) Subject: 4.4-stable patches X-Git-Tag: v3.10.99~30 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c3253e44a6268830878d912b9da3ab132b78b8f2;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: bluetooth-6lowpan-fix-handling-of-uncompressed-ipv6-packets.patch bluetooth-6lowpan-fix-kernel-null-pointer-dereferences.patch bluetooth-add-support-of-toshiba-broadcom-based-devices.patch bluetooth-fix-incorrect-removing-of-irks.patch bluetooth-use-continuous-scanning-when-creating-le-connections.patch clk-exynos-use-irqsave-version-of-spin_lock-to-avoid-deadlock-with-irqs.patch clockevents-tcb_clksrc-prevent-disabling-an-already-disabled-clock.patch cputime-prevent-32bit-overflow-in-time_to_cputime.patch cxl-use-correct-operator-when-writing-pcie-config-space-values.patch drivers-hv-vmbus-fix-a-host-signaling-bug.patch edac-mc_sysfs-fix-freeing-bus-name.patch edac-robustify-workqueues-destruction.patch irqchip-atmel-aic-fix-wrong-bit-operation-for-irq-priority.patch irqchip-gic-v3-its-fix-double-icc_eoir-write-for-lpi-in-eoimode-1.patch irqchip-mxs-add-missing-set_handle_irq.patch irqchip-omap-intc-add-support-for-spurious-irq-handling.patch mips-fix-buffer-overflow-in-syscall_get_arguments.patch mips-fix-some-missing-config_cpu_mipsr6-ifdefs.patch mips-hpet-choose-a-safe-value-for-the-etime-check.patch mips-loongson-3-fix-smp_ask_c0count-ipi-handler.patch mmc-core-enable-tuning-according-to-the-actual-timing.patch mmc-mmc-fix-incorrect-use-of-driver-strength-switching-hs200-and-hs400.patch mmc-mmci-fix-an-ages-old-detection-error.patch mmc-pxamci-fix-again-read-only-gpio-detection-polarity.patch mmc-sdhci-acpi-fix-card-detect-race-for-intel-bxt-apl.patch mmc-sdhci-allow-override-of-get_cd-called-from-sdhci_request.patch mmc-sdhci-allow-override-of-mmc-host-operations.patch mmc-sdhci-fix-dma-descriptor-with-zero-data-length.patch mmc-sdhci-fix-sdhci_runtime_pm_bus_on-off.patch mmc-sdhci-pci-do-not-default-to-33-ohm-driver-strength-for-intel-spt.patch mmc-sdhci-pci-fix-card-detect-race-for-intel-bxt-apl.patch mmc-sdio-fix-invalid-vdd-in-voltage-switch-power-cycle.patch mmc-usdhi6rol0-handle-null-data-in-timeout.patch posix-clock-fix-return-code-on-the-poll-method-s-error-path.patch regulator-axp20x-fix-gpio-ldo-enable-value-for-axp22x.patch regulator-mt6311-mt6311_regulator-needs-to-select-regmap_i2c.patch revert-mips-fix-page_mask-definition.patch sparc64-fix-incorrect-sign-extension-in-sys_sparc64_personality.patch time-avoid-signed-overflow-in-timekeeping_get_ns.patch tools-hv-vss-fix-the-write-s-argument-error-vss_msg.patch --- diff --git a/queue-4.4/bluetooth-6lowpan-fix-handling-of-uncompressed-ipv6-packets.patch b/queue-4.4/bluetooth-6lowpan-fix-handling-of-uncompressed-ipv6-packets.patch new file mode 100644 index 00000000000..0f33f67af09 --- /dev/null +++ b/queue-4.4/bluetooth-6lowpan-fix-handling-of-uncompressed-ipv6-packets.patch @@ -0,0 +1,47 @@ +From 87f5fedb3bebbbb566f847dd0c567fcea49a36a6 Mon Sep 17 00:00:00 2001 +From: Lukasz Duda +Date: Wed, 13 Jan 2016 16:57:48 +0100 +Subject: Bluetooth: 6lowpan: Fix handling of uncompressed IPv6 packets + +From: Lukasz Duda + +commit 87f5fedb3bebbbb566f847dd0c567fcea49a36a6 upstream. + +This patch fixes incorrect handling of the 6lowpan packets that contain +uncompressed IPv6 header. + +RFC4944 specifies a special dispatch for 6lowpan to carry uncompressed +IPv6 header. This dispatch (1 byte long) has to be removed during +reception and skb data pointer has to be moved. To correctly point in +the beginning of the IPv6 header the dispatch byte has to be pulled off +before packet can be processed by netif_rx_in(). + +Test scenario: IPv6 packets are not correctly interpreted by the network +layer when IPv6 header is not compressed (e.g. ICMPv6 Echo Reply is not +propagated correctly to the ICMPv6 layer because the extra byte will make +the header look corrupted). + +Similar approach is done for IEEE 802.15.4. + +Signed-off-by: Lukasz Duda +Signed-off-by: Glenn Ruben Bakke +Acked-by: Jukka Rissanen +Signed-off-by: Johan Hedberg +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/6lowpan.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/bluetooth/6lowpan.c ++++ b/net/bluetooth/6lowpan.c +@@ -307,6 +307,9 @@ static int recv_pkt(struct sk_buff *skb, + + /* check that it's our buffer */ + if (lowpan_is_ipv6(*skb_network_header(skb))) { ++ /* Pull off the 1-byte of 6lowpan header. */ ++ skb_pull(skb, 1); ++ + /* Copy the packet so that the IPv6 header is + * properly aligned. + */ diff --git a/queue-4.4/bluetooth-6lowpan-fix-kernel-null-pointer-dereferences.patch b/queue-4.4/bluetooth-6lowpan-fix-kernel-null-pointer-dereferences.patch new file mode 100644 index 00000000000..07764314fbd --- /dev/null +++ b/queue-4.4/bluetooth-6lowpan-fix-kernel-null-pointer-dereferences.patch @@ -0,0 +1,86 @@ +From 4c58f3282e3de43d34f8955f8eca676294380bf9 Mon Sep 17 00:00:00 2001 +From: Glenn Ruben Bakke +Date: Wed, 13 Jan 2016 16:41:42 +0100 +Subject: Bluetooth: 6lowpan: Fix kernel NULL pointer dereferences + +From: Glenn Ruben Bakke + +commit 4c58f3282e3de43d34f8955f8eca676294380bf9 upstream. + +The fixes provided in this patch assigns a valid net_device structure to +skb before dispatching it for further processing. + +Scenario #1: +============ + +Bluetooth 6lowpan receives an uncompressed IPv6 header, and dispatches it +to netif. The following error occurs: + +Null pointer dereference error #1 crash log: + +[ 845.854013] BUG: unable to handle kernel NULL pointer dereference at + 0000000000000048 +[ 845.855785] IP: [] enqueue_to_backlog+0x56/0x240 +... +[ 845.909459] Call Trace: +[ 845.911678] [] netif_rx_internal+0x44/0xf0 + +The first modification fixes the NULL pointer dereference error by +assigning dev to the local_skb in order to set a valid net_device before +processing the skb by netif_rx_ni(). + +Scenario #2: +============ + +Bluetooth 6lowpan receives an UDP compressed message which needs further +decompression by nhc_udp. The following error occurs: + +Null pointer dereference error #2 crash log: + +[ 63.295149] BUG: unable to handle kernel NULL pointer dereference at + 0000000000000840 +[ 63.295931] IP: [] udp_uncompress+0x320/0x626 + [nhc_udp] + +The second modification fixes the NULL pointer dereference error by +assigning dev to the local_skb in the case of a udp compressed packet. +The 6lowpan udp_uncompress function expects that the net_device is set in +the skb when checking lltype. + +Signed-off-by: Glenn Ruben Bakke +Signed-off-by: Lukasz Duda +Acked-by: Jukka Rissanen +Signed-off-by: Johan Hedberg +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/6lowpan.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/bluetooth/6lowpan.c ++++ b/net/bluetooth/6lowpan.c +@@ -317,6 +317,7 @@ static int recv_pkt(struct sk_buff *skb, + + local_skb->protocol = htons(ETH_P_IPV6); + local_skb->pkt_type = PACKET_HOST; ++ local_skb->dev = dev; + + skb_set_transport_header(local_skb, sizeof(struct ipv6hdr)); + +@@ -335,6 +336,8 @@ static int recv_pkt(struct sk_buff *skb, + if (!local_skb) + goto drop; + ++ local_skb->dev = dev; ++ + ret = iphc_decompress(local_skb, dev, chan); + if (ret < 0) { + kfree_skb(local_skb); +@@ -343,7 +346,6 @@ static int recv_pkt(struct sk_buff *skb, + + local_skb->protocol = htons(ETH_P_IPV6); + local_skb->pkt_type = PACKET_HOST; +- local_skb->dev = dev; + + if (give_skb_to_upper(local_skb, dev) + != NET_RX_SUCCESS) { diff --git a/queue-4.4/bluetooth-add-support-of-toshiba-broadcom-based-devices.patch b/queue-4.4/bluetooth-add-support-of-toshiba-broadcom-based-devices.patch new file mode 100644 index 00000000000..6ab650802d6 --- /dev/null +++ b/queue-4.4/bluetooth-add-support-of-toshiba-broadcom-based-devices.patch @@ -0,0 +1,44 @@ +From 1623d0bf847d3b38d8cf24367b3689ba0e3fe2aa Mon Sep 17 00:00:00 2001 +From: Dmitry Tunin +Date: Sat, 5 Dec 2015 14:09:36 +0300 +Subject: Bluetooth: Add support of Toshiba Broadcom based devices + +From: Dmitry Tunin + +commit 1623d0bf847d3b38d8cf24367b3689ba0e3fe2aa upstream. + +BugLink: https://bugs.launchpad.net/bugs/1522949 + + T: Bus=03 Lev=02 Prnt=02 Port=05 Cnt=02 Dev#= 4 Spd=12 MxCh= 0 + D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 + P: Vendor=0930 ProdID=0225 Rev=01.12 + S: Manufacturer=Broadcom Corp + S: Product=BCM43142A0 + S: SerialNumber=4CBB58034671 + C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA + I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none) + I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none) + I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) + I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none) + +Signed-off-by: Dmitry Tunin +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -153,6 +153,10 @@ static const struct usb_device_id btusb_ + { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01), + .driver_info = BTUSB_BCM_PATCHRAM }, + ++ /* Toshiba Corp - Broadcom based */ ++ { USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01), ++ .driver_info = BTUSB_BCM_PATCHRAM }, ++ + /* Intel Bluetooth USB Bootloader (RAM module) */ + { USB_DEVICE(0x8087, 0x0a5a), + .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC }, diff --git a/queue-4.4/bluetooth-fix-incorrect-removing-of-irks.patch b/queue-4.4/bluetooth-fix-incorrect-removing-of-irks.patch new file mode 100644 index 00000000000..6fbcb1689f7 --- /dev/null +++ b/queue-4.4/bluetooth-fix-incorrect-removing-of-irks.patch @@ -0,0 +1,98 @@ +From cff10ce7b4f02718ffd25e3914e60559f5ef6ca0 Mon Sep 17 00:00:00 2001 +From: Johan Hedberg +Date: Tue, 26 Jan 2016 14:31:31 -0500 +Subject: Bluetooth: Fix incorrect removing of IRKs + +From: Johan Hedberg + +commit cff10ce7b4f02718ffd25e3914e60559f5ef6ca0 upstream. + +The commit cad20c278085d893ebd616cd20c0747a8e9d53c7 was supposed to +fix handling of devices first using public addresses and then +switching to RPAs after pairing. Unfortunately it missed a couple of +key places in the code. + +1. When evaluating which devices should be removed from the existing +white list we also need to consider whether we have an IRK for them or +not, i.e. a call to hci_find_irk_by_addr() is needed. + +2. In smp_notify_keys() we should not be requiring the knowledge of +the RPA, but should simply keep the IRK around if the other conditions +require it. + +Signed-off-by: Johan Hedberg +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/hci_request.c | 28 ++++++++++++++++++---------- + net/bluetooth/smp.c | 16 ---------------- + 2 files changed, 18 insertions(+), 26 deletions(-) + +--- a/net/bluetooth/hci_request.c ++++ b/net/bluetooth/hci_request.c +@@ -175,21 +175,29 @@ static u8 update_white_list(struct hci_r + * command to remove it from the controller. + */ + list_for_each_entry(b, &hdev->le_white_list, list) { +- struct hci_cp_le_del_from_white_list cp; ++ /* If the device is neither in pend_le_conns nor ++ * pend_le_reports then remove it from the whitelist. ++ */ ++ if (!hci_pend_le_action_lookup(&hdev->pend_le_conns, ++ &b->bdaddr, b->bdaddr_type) && ++ !hci_pend_le_action_lookup(&hdev->pend_le_reports, ++ &b->bdaddr, b->bdaddr_type)) { ++ struct hci_cp_le_del_from_white_list cp; + +- if (hci_pend_le_action_lookup(&hdev->pend_le_conns, +- &b->bdaddr, b->bdaddr_type) || +- hci_pend_le_action_lookup(&hdev->pend_le_reports, +- &b->bdaddr, b->bdaddr_type)) { +- white_list_entries++; ++ cp.bdaddr_type = b->bdaddr_type; ++ bacpy(&cp.bdaddr, &b->bdaddr); ++ ++ hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST, ++ sizeof(cp), &cp); + continue; + } + +- cp.bdaddr_type = b->bdaddr_type; +- bacpy(&cp.bdaddr, &b->bdaddr); ++ if (hci_find_irk_by_addr(hdev, &b->bdaddr, b->bdaddr_type)) { ++ /* White list can not be used with RPAs */ ++ return 0x00; ++ } + +- hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST, +- sizeof(cp), &cp); ++ white_list_entries++; + } + + /* Since all no longer valid white list entries have been +--- a/net/bluetooth/smp.c ++++ b/net/bluetooth/smp.c +@@ -1072,22 +1072,6 @@ static void smp_notify_keys(struct l2cap + hcon->dst_type = smp->remote_irk->addr_type; + queue_work(hdev->workqueue, &conn->id_addr_update_work); + } +- +- /* When receiving an indentity resolving key for +- * a remote device that does not use a resolvable +- * private address, just remove the key so that +- * it is possible to use the controller white +- * list for scanning. +- * +- * Userspace will have been told to not store +- * this key at this point. So it is safe to +- * just remove it. +- */ +- if (!bacmp(&smp->remote_irk->rpa, BDADDR_ANY)) { +- list_del_rcu(&smp->remote_irk->list); +- kfree_rcu(smp->remote_irk, rcu); +- smp->remote_irk = NULL; +- } + } + + if (smp->csrk) { diff --git a/queue-4.4/bluetooth-use-continuous-scanning-when-creating-le-connections.patch b/queue-4.4/bluetooth-use-continuous-scanning-when-creating-le-connections.patch new file mode 100644 index 00000000000..a734a5e59bf --- /dev/null +++ b/queue-4.4/bluetooth-use-continuous-scanning-when-creating-le-connections.patch @@ -0,0 +1,39 @@ +From 2f99536a5b34d5b0f54723067d68f6cef3f0fdc6 Mon Sep 17 00:00:00 2001 +From: Johan Hedberg +Date: Thu, 3 Dec 2015 12:45:19 +0200 +Subject: Bluetooth: Use continuous scanning when creating LE connections + +From: Johan Hedberg + +commit 2f99536a5b34d5b0f54723067d68f6cef3f0fdc6 upstream. + +All LE connections are now triggered through a preceding passive scan +and waiting for a connectable advertising report. This means we've got +the best possible guarantee that the device is within range and should +be able to request the controller to perform continuous scanning. This +way we minimize the risk that we miss out on any advertising packets. + +Signed-off-by: Johan Hedberg +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/hci_conn.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -722,8 +722,12 @@ static void hci_req_add_le_create_conn(s + if (hci_update_random_address(req, false, &own_addr_type)) + return; + ++ /* Set window to be the same value as the interval to enable ++ * continuous scanning. ++ */ + cp.scan_interval = cpu_to_le16(hdev->le_scan_interval); +- cp.scan_window = cpu_to_le16(hdev->le_scan_window); ++ cp.scan_window = cp.scan_interval; ++ + bacpy(&cp.peer_addr, &conn->dst); + cp.peer_addr_type = conn->dst_type; + cp.own_address_type = own_addr_type; diff --git a/queue-4.4/clk-exynos-use-irqsave-version-of-spin_lock-to-avoid-deadlock-with-irqs.patch b/queue-4.4/clk-exynos-use-irqsave-version-of-spin_lock-to-avoid-deadlock-with-irqs.patch new file mode 100644 index 00000000000..d007a20cf48 --- /dev/null +++ b/queue-4.4/clk-exynos-use-irqsave-version-of-spin_lock-to-avoid-deadlock-with-irqs.patch @@ -0,0 +1,125 @@ +From 6b4feaea251a97bf08c7d41eabdec07f63a11073 Mon Sep 17 00:00:00 2001 +From: Marek Szyprowski +Date: Fri, 11 Dec 2015 15:38:40 +0100 +Subject: clk: exynos: use irqsave version of spin_lock to avoid deadlock with irqs + +From: Marek Szyprowski + +commit 6b4feaea251a97bf08c7d41eabdec07f63a11073 upstream. + +It is allowed to enable/disable clocks from interrupts, so common Exynos +ARM clock management code for CPUfreq should use 'irqsave' version of +spin_lock calls to avoid potential deadlock caused by spin_lock recursion. +The same spin_lock is used by gate/mux clocks during enable/disable calls. + +This deadlock, can be reproduced by enabling CPUfreq (ondemand or +userspace) and decoding video with s5p-mfc driver. + +Relevant stack trace: +[ 5928.061534] BUG: spinlock recursion on CPU#0, bash/1252 +[ 5928.061609] lock: 0xee80454c, .magic: dead4ead, .owner: bash/1252, .owner_cpu: 0 +[ 5928.068586] CPU: 0 PID: 1252 Comm: bash Tainted: G W 4.4.0-rc4-00001-g447a7fd #678 +[ 5928.077260] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) +[ 5928.083359] [] (unwind_backtrace) from [] (show_stack+0x10/0x14) +[ 5928.091072] [] (show_stack) from [] (dump_stack+0x68/0xb8) +[ 5928.098275] [] (dump_stack) from [] (do_raw_spin_lock+0x184/0x1ac) +[ 5928.106177] [] (do_raw_spin_lock) from [] (_raw_spin_lock_irqsave+0x20/0x28) +[ 5928.114943] [] (_raw_spin_lock_irqsave) from [] (clk_gate_endisable+0x24/0x98) +[ 5928.123882] [] (clk_gate_endisable) from [] (clk_core_disable+0x60/0x84) +[ 5928.132299] [] (clk_core_disable) from [] (clk_disable+0x24/0x30) +[ 5928.140117] [] (clk_disable) from [] (s5p_mfc_handle_frame+0x254/0x860) +[ 5928.148445] [] (s5p_mfc_handle_frame) from [] (s5p_mfc_irq+0x890/0xa24) +[ 5928.156778] [] (s5p_mfc_irq) from [] (handle_irq_event_percpu+0x50/0x14c) +[ 5928.165283] [] (handle_irq_event_percpu) from [] (handle_irq_event+0x38/0x5c) +[ 5928.174143] [] (handle_irq_event) from [] (handle_fasteoi_irq+0xdc/0x1a4) +[ 5928.182645] [] (handle_fasteoi_irq) from [] (generic_handle_irq+0x18/0x28) +[ 5928.191236] [] (generic_handle_irq) from [] (__handle_domain_irq+0x6c/0xdc) +[ 5928.199917] [] (__handle_domain_irq) from [] (gic_handle_irq+0x4c/0x98) +[ 5928.208249] [] (gic_handle_irq) from [] (__irq_svc+0x54/0x90) +[ 5928.215709] Exception stack(0xeddb5cb8 to 0xeddb5d00) +[ 5928.220745] 5ca0: ee80454c faddfadc +[ 5928.228906] 5cc0: 00000000 01000001 ee831ce0 f8114200 ee807c00 01130520 00000403 eddb5d84 +[ 5928.237063] 5ce0: ee807c48 2faf0800 ee807c0c eddb5d08 c046b618 c046b634 20000053 ffffffff +[ 5928.245225] [] (__irq_svc) from [] (exynos_cpuclk_notifier_cb+0x170/0x270) +[ 5928.253823] [] (exynos_cpuclk_notifier_cb) from [] (notifier_call_chain+0x44/0x84) +[ 5928.263106] [] (notifier_call_chain) from [] (__srcu_notifier_call_chain+0x6c/0x9c) +[ 5928.272480] [] (__srcu_notifier_call_chain) from [] (srcu_notifier_call_chain+0x18/0x20) +[ 5928.282288] [] (srcu_notifier_call_chain) from [] (__clk_notify+0x6c/0x74) +[ 5928.290881] [] (__clk_notify) from [] (clk_propagate_rate_change+0xa0/0xac) +[ 5928.299561] [] (clk_propagate_rate_change) from [] (clk_propagate_rate_change+0x90/0xac) +[ 5928.309370] [] (clk_propagate_rate_change) from [] (clk_core_set_rate_nolock+0x64/0xa8) +[ 5928.319091] [] (clk_core_set_rate_nolock) from [] (clk_set_rate+0x20/0x30) +[ 5928.327686] [] (clk_set_rate) from [] (set_target+0xe8/0x23c) +[ 5928.335152] [] (set_target) from [] (__cpufreq_driver_target+0x184/0x29c) +[ 5928.343655] [] (__cpufreq_driver_target) from [] (cpufreq_set+0x44/0x64) +[ 5928.352074] [] (cpufreq_set) from [] (store_scaling_setspeed+0x5c/0x74) +[ 5928.360407] [] (store_scaling_setspeed) from [] (store+0x7c/0x98) +[ 5928.368221] [] (store) from [] (sysfs_kf_write+0x44/0x48) +[ 5928.375338] [] (sysfs_kf_write) from [] (kernfs_fop_write+0xb8/0x1bc) +[ 5928.383496] [] (kernfs_fop_write) from [] (__vfs_write+0x2c/0xd4) +[ 5928.391308] [] (__vfs_write) from [] (vfs_write+0xa0/0x144) +[ 5928.398598] [] (vfs_write) from [] (SyS_write+0x44/0x84) +[ 5928.405631] [] (SyS_write) from [] (ret_fast_syscall+0x0/0x3c) + +Signed-off-by: Marek Szyprowski +Signed-off-by: Sylwester Nawrocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/samsung/clk-cpu.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/clk/samsung/clk-cpu.c ++++ b/drivers/clk/samsung/clk-cpu.c +@@ -148,6 +148,7 @@ static int exynos_cpuclk_pre_rate_change + unsigned long alt_prate = clk_get_rate(cpuclk->alt_parent); + unsigned long alt_div = 0, alt_div_mask = DIV_MASK; + unsigned long div0, div1 = 0, mux_reg; ++ unsigned long flags; + + /* find out the divider values to use for clock data */ + while ((cfg_data->prate * 1000) != ndata->new_rate) { +@@ -156,7 +157,7 @@ static int exynos_cpuclk_pre_rate_change + cfg_data++; + } + +- spin_lock(cpuclk->lock); ++ spin_lock_irqsave(cpuclk->lock, flags); + + /* + * For the selected PLL clock frequency, get the pre-defined divider +@@ -212,7 +213,7 @@ static int exynos_cpuclk_pre_rate_change + DIV_MASK_ALL); + } + +- spin_unlock(cpuclk->lock); ++ spin_unlock_irqrestore(cpuclk->lock, flags); + return 0; + } + +@@ -223,6 +224,7 @@ static int exynos_cpuclk_post_rate_chang + const struct exynos_cpuclk_cfg_data *cfg_data = cpuclk->cfg; + unsigned long div = 0, div_mask = DIV_MASK; + unsigned long mux_reg; ++ unsigned long flags; + + /* find out the divider values to use for clock data */ + if (cpuclk->flags & CLK_CPU_NEEDS_DEBUG_ALT_DIV) { +@@ -233,7 +235,7 @@ static int exynos_cpuclk_post_rate_chang + } + } + +- spin_lock(cpuclk->lock); ++ spin_lock_irqsave(cpuclk->lock, flags); + + /* select mout_apll as the alternate parent */ + mux_reg = readl(base + E4210_SRC_CPU); +@@ -246,7 +248,7 @@ static int exynos_cpuclk_post_rate_chang + } + + exynos_set_safe_div(base, div, div_mask); +- spin_unlock(cpuclk->lock); ++ spin_unlock_irqrestore(cpuclk->lock, flags); + return 0; + } + diff --git a/queue-4.4/clockevents-tcb_clksrc-prevent-disabling-an-already-disabled-clock.patch b/queue-4.4/clockevents-tcb_clksrc-prevent-disabling-an-already-disabled-clock.patch new file mode 100644 index 00000000000..9f1b94e6f06 --- /dev/null +++ b/queue-4.4/clockevents-tcb_clksrc-prevent-disabling-an-already-disabled-clock.patch @@ -0,0 +1,62 @@ +From f02b4b72d12cbae7020a959e2ed0410a464b4cc4 Mon Sep 17 00:00:00 2001 +From: Alexandre Belloni +Date: Fri, 15 Jan 2016 11:34:21 +0100 +Subject: clockevents/tcb_clksrc: Prevent disabling an already disabled clock + +From: Alexandre Belloni + +commit f02b4b72d12cbae7020a959e2ed0410a464b4cc4 upstream. + +clockevents_exchange_device is calling clockevents_shutdown() on the new +clockenvents device but it may have never been enabled in the first place. +This results in the tcb clock being disabled without being enabled first: + +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 1 at drivers/clk/clk.c:680 clk_disable+0x28/0x34() +Modules linked in: +CPU: 0 PID: 1 Comm: swapper Not tainted 4.4.0+ #6 +Hardware name: Atmel AT91SAM9 +[] (unwind_backtrace) from [] (show_stack+0x10/0x14) +[] (show_stack) from [] (warn_slowpath_common+0x78/0xa0) +[] (warn_slowpath_common) from [] (warn_slowpath_null+0x18/0x20) +[] (warn_slowpath_null) from [] (clk_disable+0x28/0x34) +[] (clk_disable) from [] (tc_shutdown+0x38/0x4c) +[] (tc_shutdown) from [] (clockevents_switch_state+0x38/0x6c) +[] (clockevents_switch_state) from [] (clockevents_shutdown+0x10/0x24) +[] (clockevents_shutdown) from [] (tick_check_new_device+0x84/0xac) +[] (tick_check_new_device) from [] (clockevents_register_device+0x7c/0x108) +[] (clockevents_register_device) from [] (tcb_clksrc_init+0x390/0x3e8) +[] (tcb_clksrc_init) from [] (do_one_initcall+0x114/0x1d4) +[] (do_one_initcall) from [] (kernel_init_freeable+0xfc/0x1b8) +[] (kernel_init_freeable) from [] (kernel_init+0x8/0xe0) +[] (kernel_init) from [] (ret_from_fork+0x14/0x24) +---[ end trace 0000000000000001 ]--- + +Check what state we were in before trying to disable the clock. + +Fixes: cf4541c101ea ("clockevents/drivers/tcb_clksrc: Migrate to new 'set-state' interface") +Signed-off-by: Alexandre Belloni +Cc: Nicolas Ferre +Cc: Boris Brezillon +Cc: linux-arm-kernel@lists.infradead.org +Cc: Daniel Lezcano +Link: http://lkml.kernel.org/r/1452854061-30370-1-git-send-email-alexandre.belloni@free-electrons.com +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clocksource/tcb_clksrc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/clocksource/tcb_clksrc.c ++++ b/drivers/clocksource/tcb_clksrc.c +@@ -98,7 +98,8 @@ static int tc_shutdown(struct clock_even + + __raw_writel(0xff, regs + ATMEL_TC_REG(2, IDR)); + __raw_writel(ATMEL_TC_CLKDIS, regs + ATMEL_TC_REG(2, CCR)); +- clk_disable(tcd->clk); ++ if (!clockevent_state_detached(d)) ++ clk_disable(tcd->clk); + + return 0; + } diff --git a/queue-4.4/cputime-prevent-32bit-overflow-in-time_to_cputime.patch b/queue-4.4/cputime-prevent-32bit-overflow-in-time_to_cputime.patch new file mode 100644 index 00000000000..6cfb5bc538a --- /dev/null +++ b/queue-4.4/cputime-prevent-32bit-overflow-in-time_to_cputime.patch @@ -0,0 +1,55 @@ +From 0f26922fe5dc5724b1adbbd54b21bad03590b4f3 Mon Sep 17 00:00:00 2001 +From: zengtao +Date: Tue, 2 Feb 2016 11:38:34 +0800 +Subject: cputime: Prevent 32bit overflow in time[val|spec]_to_cputime() + +From: zengtao + +commit 0f26922fe5dc5724b1adbbd54b21bad03590b4f3 upstream. + +The datatype __kernel_time_t is u32 on 32bit platform, so its subject to +overflows in the timeval/timespec to cputime conversion. + +Currently the following functions are affected: +1. setitimer() +2. timer_create/timer_settime() +3. sys_clock_nanosleep + +This can happen on MIPS32 and ARM32 with "Full dynticks CPU time accounting" +enabled, which is required for CONFIG_NO_HZ_FULL. + +Enforce u64 conversion to prevent the overflow. + +Fixes: 31c1fc818715 ("ARM: Kconfig: allow full nohz CPU accounting") +Signed-off-by: zengtao +Reviewed-by: Arnd Bergmann +Cc: +Link: http://lkml.kernel.org/r/1454384314-154784-1-git-send-email-prime.zeng@huawei.com +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + include/asm-generic/cputime_nsecs.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/include/asm-generic/cputime_nsecs.h ++++ b/include/asm-generic/cputime_nsecs.h +@@ -75,7 +75,7 @@ typedef u64 __nocast cputime64_t; + */ + static inline cputime_t timespec_to_cputime(const struct timespec *val) + { +- u64 ret = val->tv_sec * NSEC_PER_SEC + val->tv_nsec; ++ u64 ret = (u64)val->tv_sec * NSEC_PER_SEC + val->tv_nsec; + return (__force cputime_t) ret; + } + static inline void cputime_to_timespec(const cputime_t ct, struct timespec *val) +@@ -91,7 +91,8 @@ static inline void cputime_to_timespec(c + */ + static inline cputime_t timeval_to_cputime(const struct timeval *val) + { +- u64 ret = val->tv_sec * NSEC_PER_SEC + val->tv_usec * NSEC_PER_USEC; ++ u64 ret = (u64)val->tv_sec * NSEC_PER_SEC + ++ val->tv_usec * NSEC_PER_USEC; + return (__force cputime_t) ret; + } + static inline void cputime_to_timeval(const cputime_t ct, struct timeval *val) diff --git a/queue-4.4/cxl-use-correct-operator-when-writing-pcie-config-space-values.patch b/queue-4.4/cxl-use-correct-operator-when-writing-pcie-config-space-values.patch new file mode 100644 index 00000000000..757b8fece83 --- /dev/null +++ b/queue-4.4/cxl-use-correct-operator-when-writing-pcie-config-space-values.patch @@ -0,0 +1,41 @@ +From 48f0f6b717e314a30be121b67e1d044f6d311d66 Mon Sep 17 00:00:00 2001 +From: Andrew Donnellan +Date: Wed, 4 Nov 2015 13:24:09 +1100 +Subject: cxl: use correct operator when writing pcie config space values + +From: Andrew Donnellan + +commit 48f0f6b717e314a30be121b67e1d044f6d311d66 upstream. + +When writing a value to config space, cxl_pcie_write_config() calls +cxl_pcie_config_info() to obtain a mask and shift value, shifts the new +value accordingly, then uses the mask to combine the shifted value with the +existing value at the address as part of a read-modify-write pattern. + +Currently, we use a logical OR operator rather than a bitwise OR operator, +which means any use of this function results in an incorrect value being +written. Replace the logical OR operator with a bitwise OR operator so the +value is written correctly. + +Reported-by: Michael Ellerman +Fixes: 6f7f0b3df6d4 ("cxl: Add AFU virtual PHB and kernel API") +Signed-off-by: Andrew Donnellan +Acked-by: Ian Munsie +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/cxl/vphb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/misc/cxl/vphb.c ++++ b/drivers/misc/cxl/vphb.c +@@ -203,7 +203,7 @@ static int cxl_pcie_write_config(struct + mask <<= shift; + val <<= shift; + +- v = (in_le32(ioaddr) & ~mask) || (val & mask); ++ v = (in_le32(ioaddr) & ~mask) | (val & mask); + + out_le32(ioaddr, v); + return PCIBIOS_SUCCESSFUL; diff --git a/queue-4.4/drivers-hv-vmbus-fix-a-host-signaling-bug.patch b/queue-4.4/drivers-hv-vmbus-fix-a-host-signaling-bug.patch new file mode 100644 index 00000000000..9908db6ff4b --- /dev/null +++ b/queue-4.4/drivers-hv-vmbus-fix-a-host-signaling-bug.patch @@ -0,0 +1,106 @@ +From 8599846d73997cdbccf63f23394d871cfad1e5e6 Mon Sep 17 00:00:00 2001 +From: "K. Y. Srinivasan" +Date: Mon, 14 Dec 2015 16:01:54 -0800 +Subject: Drivers: hv: vmbus: Fix a Host signaling bug + +From: K. Y. Srinivasan + +commit 8599846d73997cdbccf63f23394d871cfad1e5e6 upstream. + +Currently we have two policies for deciding when to signal the host: +One based on the ring buffer state and the other based on what the +VMBUS client driver wants to do. Consider the case when the client +wants to explicitly control when to signal the host. In this case, +if the client were to defer signaling, we will not be able to signal +the host subsequently when the client does want to signal since the +ring buffer state will prevent the signaling. Implement logic to +have only one signaling policy in force for a given channel. + +Signed-off-by: K. Y. Srinivasan +Reviewed-by: Haiyang Zhang +Tested-by: Haiyang Zhang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hv/channel.c | 18 ++++++++++++++++++ + include/linux/hyperv.h | 18 ++++++++++++++++++ + 2 files changed, 36 insertions(+) + +--- a/drivers/hv/channel.c ++++ b/drivers/hv/channel.c +@@ -630,10 +630,19 @@ int vmbus_sendpacket_ctl(struct vmbus_ch + * on the ring. We will not signal if more data is + * to be placed. + * ++ * Based on the channel signal state, we will decide ++ * which signaling policy will be applied. ++ * + * If we cannot write to the ring-buffer; signal the host + * even if we may not have written anything. This is a rare + * enough condition that it should not matter. + */ ++ ++ if (channel->signal_policy) ++ signal = true; ++ else ++ kick_q = true; ++ + if (((ret == 0) && kick_q && signal) || (ret)) + vmbus_setevent(channel); + +@@ -733,10 +742,19 @@ int vmbus_sendpacket_pagebuffer_ctl(stru + * on the ring. We will not signal if more data is + * to be placed. + * ++ * Based on the channel signal state, we will decide ++ * which signaling policy will be applied. ++ * + * If we cannot write to the ring-buffer; signal the host + * even if we may not have written anything. This is a rare + * enough condition that it should not matter. + */ ++ ++ if (channel->signal_policy) ++ signal = true; ++ else ++ kick_q = true; ++ + if (((ret == 0) && kick_q && signal) || (ret)) + vmbus_setevent(channel); + +--- a/include/linux/hyperv.h ++++ b/include/linux/hyperv.h +@@ -630,6 +630,11 @@ struct hv_input_signal_event_buffer { + struct hv_input_signal_event event; + }; + ++enum hv_signal_policy { ++ HV_SIGNAL_POLICY_DEFAULT = 0, ++ HV_SIGNAL_POLICY_EXPLICIT, ++}; ++ + struct vmbus_channel { + /* Unique channel id */ + int id; +@@ -757,8 +762,21 @@ struct vmbus_channel { + * link up channels based on their CPU affinity. + */ + struct list_head percpu_list; ++ /* ++ * Host signaling policy: The default policy will be ++ * based on the ring buffer state. We will also support ++ * a policy where the client driver can have explicit ++ * signaling control. ++ */ ++ enum hv_signal_policy signal_policy; + }; + ++static inline void set_channel_signal_state(struct vmbus_channel *c, ++ enum hv_signal_policy policy) ++{ ++ c->signal_policy = policy; ++} ++ + static inline void set_channel_read_state(struct vmbus_channel *c, bool state) + { + c->batched_reading = state; diff --git a/queue-4.4/edac-mc_sysfs-fix-freeing-bus-name.patch b/queue-4.4/edac-mc_sysfs-fix-freeing-bus-name.patch new file mode 100644 index 00000000000..381580a1180 --- /dev/null +++ b/queue-4.4/edac-mc_sysfs-fix-freeing-bus-name.patch @@ -0,0 +1,126 @@ +From 12e26969b32c79018165d52caff3762135614aa1 Mon Sep 17 00:00:00 2001 +From: Borislav Petkov +Date: Tue, 1 Dec 2015 15:52:36 +0100 +Subject: EDAC, mc_sysfs: Fix freeing bus' name + +From: Borislav Petkov + +commit 12e26969b32c79018165d52caff3762135614aa1 upstream. + +I get the splat below when modprobing/rmmoding EDAC drivers. It happens +because bus->name is invalid after bus_unregister() has run. The Code: section +below corresponds to: + + .loc 1 1108 0 + movq 672(%rbx), %rax # mci_1(D)->bus, mci_1(D)->bus + .loc 1 1109 0 + popq %rbx # + + .loc 1 1108 0 + movq (%rax), %rdi # _7->name, + jmp kfree # + +and %rax has some funky stuff 2030203020312030 which looks a lot like +something walked over it. + +Fix that by saving the name ptr before doing stuff to string it points to. + + general protection fault: 0000 [#1] SMP + Modules linked in: ... + CPU: 4 PID: 10318 Comm: modprobe Tainted: G I EN 3.12.51-11-default+ #48 + Hardware name: HP ProLiant DL380 G7, BIOS P67 05/05/2011 + task: ffff880311320280 ti: ffff88030da3e000 task.ti: ffff88030da3e000 + RIP: 0010:[] [] edac_unregister_sysfs+0x22/0x30 [edac_core] + RSP: 0018:ffff88030da3fe28 EFLAGS: 00010292 + RAX: 2030203020312030 RBX: ffff880311b4e000 RCX: 000000000000095c + RDX: 0000000000000001 RSI: ffff880327bb9600 RDI: 0000000000000286 + RBP: ffff880311b4e750 R08: 0000000000000000 R09: ffffffff81296110 + R10: 0000000000000400 R11: 0000000000000000 R12: ffff88030ba1ac68 + R13: 0000000000000001 R14: 00000000011b02f0 R15: 0000000000000000 + FS: 00007fc9bf8f5700(0000) GS:ffff8801a7c40000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b + CR2: 0000000000403c90 CR3: 000000019ebdf000 CR4: 00000000000007e0 + Stack: + Call Trace: + i7core_unregister_mci.isra.9 + i7core_remove + pci_device_remove + __device_release_driver + driver_detach + bus_remove_driver + pci_unregister_driver + i7core_exit + SyS_delete_module + system_call_fastpath + 0x7fc9bf426536 + Code: 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 53 48 89 fb e8 52 2a 1f e1 48 8b bb a0 02 00 00 e8 46 59 1f e1 48 8b 83 a0 02 00 00 5b <48> 8b 38 e9 26 9a fe e0 66 0f 1f 44 00 00 66 66 66 66 90 48 8b + RIP [] edac_unregister_sysfs+0x22/0x30 [edac_core] + RSP + +Signed-off-by: Borislav Petkov +Cc: Mauro Carvalho Chehab +Fixes: 7a623c039075 ("edac: rewrite the sysfs code to use struct device") +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/edac/edac_mc_sysfs.c | 21 ++++++++++++++------- + 1 file changed, 14 insertions(+), 7 deletions(-) + +--- a/drivers/edac/edac_mc_sysfs.c ++++ b/drivers/edac/edac_mc_sysfs.c +@@ -880,21 +880,26 @@ static struct device_type mci_attr_type + int edac_create_sysfs_mci_device(struct mem_ctl_info *mci, + const struct attribute_group **groups) + { ++ char *name; + int i, err; + + /* + * The memory controller needs its own bus, in order to avoid + * namespace conflicts at /sys/bus/edac. + */ +- mci->bus->name = kasprintf(GFP_KERNEL, "mc%d", mci->mc_idx); +- if (!mci->bus->name) ++ name = kasprintf(GFP_KERNEL, "mc%d", mci->mc_idx); ++ if (!name) + return -ENOMEM; + ++ mci->bus->name = name; ++ + edac_dbg(0, "creating bus %s\n", mci->bus->name); + + err = bus_register(mci->bus); +- if (err < 0) +- goto fail_free_name; ++ if (err < 0) { ++ kfree(name); ++ return err; ++ } + + /* get the /sys/devices/system/edac subsys reference */ + mci->dev.type = &mci_attr_type; +@@ -961,8 +966,8 @@ fail_unregister_dimm: + device_unregister(&mci->dev); + fail_unregister_bus: + bus_unregister(mci->bus); +-fail_free_name: +- kfree(mci->bus->name); ++ kfree(name); ++ + return err; + } + +@@ -993,10 +998,12 @@ void edac_remove_sysfs_mci_device(struct + + void edac_unregister_sysfs(struct mem_ctl_info *mci) + { ++ const char *name = mci->bus->name; ++ + edac_dbg(1, "Unregistering device %s\n", dev_name(&mci->dev)); + device_unregister(&mci->dev); + bus_unregister(mci->bus); +- kfree(mci->bus->name); ++ kfree(name); + } + + static void mc_attr_release(struct device *dev) diff --git a/queue-4.4/edac-robustify-workqueues-destruction.patch b/queue-4.4/edac-robustify-workqueues-destruction.patch new file mode 100644 index 00000000000..81eacab11a4 --- /dev/null +++ b/queue-4.4/edac-robustify-workqueues-destruction.patch @@ -0,0 +1,120 @@ +From fcd5c4dd8201595d4c598c9cca5e54760277d687 Mon Sep 17 00:00:00 2001 +From: Borislav Petkov +Date: Fri, 27 Nov 2015 10:38:38 +0100 +Subject: EDAC: Robustify workqueues destruction + +From: Borislav Petkov + +commit fcd5c4dd8201595d4c598c9cca5e54760277d687 upstream. + +EDAC workqueue destruction is really fragile. We cancel delayed work +but if it is still running and requeues itself, we still go ahead and +destroy the workqueue and the queued work explodes when workqueue core +attempts to run it. + +Make the destruction more robust by switching op_state to offline so +that requeuing stops. Cancel any pending work *synchronously* too. + + EDAC i7core: Driver loaded. + general protection fault: 0000 [#1] SMP + CPU 12 + Modules linked in: + Supported: Yes + Pid: 0, comm: kworker/0:1 Tainted: G IE 3.0.101-0-default #1 HP ProLiant DL380 G7 + RIP: 0010:[] [] __queue_work+0x17/0x3f0 + < ... regs ...> + Process kworker/0:1 (pid: 0, threadinfo ffff88019def6000, task ffff88019def4600) + Stack: + ... + Call Trace: + call_timer_fn + run_timer_softirq + __do_softirq + call_softirq + do_softirq + irq_exit + smp_apic_timer_interrupt + apic_timer_interrupt + intel_idle + cpuidle_idle_call + cpu_idle + Code: ... + RIP __queue_work + RSP <...> + +Signed-off-by: Borislav Petkov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/edac/edac_device.c | 11 ++++------- + drivers/edac/edac_mc.c | 14 +++----------- + drivers/edac/edac_pci.c | 9 ++++----- + 3 files changed, 11 insertions(+), 23 deletions(-) + +--- a/drivers/edac/edac_device.c ++++ b/drivers/edac/edac_device.c +@@ -435,16 +435,13 @@ void edac_device_workq_setup(struct edac + */ + void edac_device_workq_teardown(struct edac_device_ctl_info *edac_dev) + { +- int status; +- + if (!edac_dev->edac_check) + return; + +- status = cancel_delayed_work(&edac_dev->work); +- if (status == 0) { +- /* workq instance might be running, wait for it */ +- flush_workqueue(edac_workqueue); +- } ++ edac_dev->op_state = OP_OFFLINE; ++ ++ cancel_delayed_work_sync(&edac_dev->work); ++ flush_workqueue(edac_workqueue); + } + + /* +--- a/drivers/edac/edac_mc.c ++++ b/drivers/edac/edac_mc.c +@@ -586,18 +586,10 @@ static void edac_mc_workq_setup(struct m + */ + static void edac_mc_workq_teardown(struct mem_ctl_info *mci) + { +- int status; ++ mci->op_state = OP_OFFLINE; + +- if (mci->op_state != OP_RUNNING_POLL) +- return; +- +- status = cancel_delayed_work(&mci->work); +- if (status == 0) { +- edac_dbg(0, "not canceled, flush the queue\n"); +- +- /* workq instance might be running, wait for it */ +- flush_workqueue(edac_workqueue); +- } ++ cancel_delayed_work_sync(&mci->work); ++ flush_workqueue(edac_workqueue); + } + + /* +--- a/drivers/edac/edac_pci.c ++++ b/drivers/edac/edac_pci.c +@@ -274,13 +274,12 @@ static void edac_pci_workq_setup(struct + */ + static void edac_pci_workq_teardown(struct edac_pci_ctl_info *pci) + { +- int status; +- + edac_dbg(0, "\n"); + +- status = cancel_delayed_work(&pci->work); +- if (status == 0) +- flush_workqueue(edac_workqueue); ++ pci->op_state = OP_OFFLINE; ++ ++ cancel_delayed_work_sync(&pci->work); ++ flush_workqueue(edac_workqueue); + } + + /* diff --git a/queue-4.4/irqchip-atmel-aic-fix-wrong-bit-operation-for-irq-priority.patch b/queue-4.4/irqchip-atmel-aic-fix-wrong-bit-operation-for-irq-priority.patch new file mode 100644 index 00000000000..4492afaf98f --- /dev/null +++ b/queue-4.4/irqchip-atmel-aic-fix-wrong-bit-operation-for-irq-priority.patch @@ -0,0 +1,46 @@ +From 49f34134aea74f19ca016f055d25ee55ec359dee Mon Sep 17 00:00:00 2001 +From: Milo Kim +Date: Wed, 13 Jan 2016 16:19:50 +0900 +Subject: irqchip/atmel-aic: Fix wrong bit operation for IRQ priority + +From: Milo Kim + +commit 49f34134aea74f19ca016f055d25ee55ec359dee upstream. + +Atmel AIC has common structure for SMR (Source Mode Register). + + bit[6:5] Interrupt source type + bit[2:0] Priority level + Other bits are unused. + +To update new priority value, bit[2:0] should be cleared first and then +new priority level can be written. However, aic_common_set_priority() +helper clears source type bits instead of priority bits. +This patch fixes wrong mask bit operation. + +Fixes: b1479ebb7720 "irqchip: atmel-aic: Add atmel AIC/AIC5 drivers" +Signed-off-by: Milo Kim +Acked-by: Boris Brezillon +Cc: Jason Cooper +Cc: Marc Zyngier +Cc: Ludovic Desroches +Cc: Nicholas Ferre +Link: http://lkml.kernel.org/r/1452669592-3401-2-git-send-email-milo.kim@ti.com +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/irqchip/irq-atmel-aic-common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/irqchip/irq-atmel-aic-common.c ++++ b/drivers/irqchip/irq-atmel-aic-common.c +@@ -86,7 +86,7 @@ int aic_common_set_priority(int priority + priority > AT91_AIC_IRQ_MAX_PRIORITY) + return -EINVAL; + +- *val &= AT91_AIC_PRIOR; ++ *val &= ~AT91_AIC_PRIOR; + *val |= priority; + + return 0; diff --git a/queue-4.4/irqchip-gic-v3-its-fix-double-icc_eoir-write-for-lpi-in-eoimode-1.patch b/queue-4.4/irqchip-gic-v3-its-fix-double-icc_eoir-write-for-lpi-in-eoimode-1.patch new file mode 100644 index 00000000000..2b4700cc6fe --- /dev/null +++ b/queue-4.4/irqchip-gic-v3-its-fix-double-icc_eoir-write-for-lpi-in-eoimode-1.patch @@ -0,0 +1,58 @@ +From 004fa08d7aba2a13974446bf212a48c0b3b0d9fd Mon Sep 17 00:00:00 2001 +From: Ashok Kumar +Date: Thu, 11 Feb 2016 05:38:53 -0800 +Subject: irqchip/gic-v3-its: Fix double ICC_EOIR write for LPI in EOImode==1 + +From: Ashok Kumar + +commit 004fa08d7aba2a13974446bf212a48c0b3b0d9fd upstream. + +When the GIC is using EOImode==1, the EOI is done immediately, +leaving the deactivation to be performed when the EOI was +previously done. + +Unfortunately, the ITS is not aware of the EOImode at all, and +blindly EOIs the interrupt again. On most systems, this is ignored +(despite being a programming error), but some others do raise a +SError exception as there is no priority drop to perform for this +interrupt. + +The fix is to stop trying to be clever, and always call into the +underlying GIC to perform the right access, irrespective of the +more we're in. + +[Marc: Reworked commit message] + +Fixes: 0b996fd35957a ("irqchip/GICv3: Convert to EOImode == 1") +Acked-by: Marc Zyngier +Signed-off-by: Ashok Kumar +Signed-off-by: Marc Zyngier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/irqchip/irq-gic-v3-its.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -597,11 +597,6 @@ static void its_unmask_irq(struct irq_da + lpi_set_config(d, true); + } + +-static void its_eoi_irq(struct irq_data *d) +-{ +- gic_write_eoir(d->hwirq); +-} +- + static int its_set_affinity(struct irq_data *d, const struct cpumask *mask_val, + bool force) + { +@@ -638,7 +633,7 @@ static struct irq_chip its_irq_chip = { + .name = "ITS", + .irq_mask = its_mask_irq, + .irq_unmask = its_unmask_irq, +- .irq_eoi = its_eoi_irq, ++ .irq_eoi = irq_chip_eoi_parent, + .irq_set_affinity = its_set_affinity, + .irq_compose_msi_msg = its_irq_compose_msi_msg, + }; diff --git a/queue-4.4/irqchip-mxs-add-missing-set_handle_irq.patch b/queue-4.4/irqchip-mxs-add-missing-set_handle_irq.patch new file mode 100644 index 00000000000..0fab2cdb435 --- /dev/null +++ b/queue-4.4/irqchip-mxs-add-missing-set_handle_irq.patch @@ -0,0 +1,38 @@ +From c5b635203032462603c503ecce91a7021c1ad44a Mon Sep 17 00:00:00 2001 +From: Oleksij Rempel +Date: Fri, 29 Jan 2016 10:57:53 +0100 +Subject: irqchip/mxs: Add missing set_handle_irq() + +From: Oleksij Rempel + +commit c5b635203032462603c503ecce91a7021c1ad44a upstream. + +The rework of the driver missed to move the call to set_handle_irq() into +asm9260_of_init(). As a consequence no interrupt entry point is installed and +no interrupts are delivered + +Solution is simple: Install the interrupt entry handler. + +Fixes: 7e4ac676ee ("irqchip/mxs: Add Alphascale ASM9260 support") +Signed-off-by: Oleksij Rempel +Cc: kernel@pengutronix.de +Cc: jason@lakedaemon.net +Cc: marc.zyngier@arm.com +Link: http://lkml.kernel.org/r/1454061473-24957-1-git-send-email-linux@rempel-privat.de +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/irqchip/irq-mxs.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/irqchip/irq-mxs.c ++++ b/drivers/irqchip/irq-mxs.c +@@ -241,6 +241,7 @@ static int __init asm9260_of_init(struct + writel(0, icoll_priv.intr + i); + + icoll_add_domain(np, ASM9260_NUM_IRQS); ++ set_handle_irq(icoll_handle_irq); + + return 0; + } diff --git a/queue-4.4/irqchip-omap-intc-add-support-for-spurious-irq-handling.patch b/queue-4.4/irqchip-omap-intc-add-support-for-spurious-irq-handling.patch new file mode 100644 index 00000000000..0632c48b53b --- /dev/null +++ b/queue-4.4/irqchip-omap-intc-add-support-for-spurious-irq-handling.patch @@ -0,0 +1,85 @@ +From d3b421cd07e4c0d4d6c0bbd55ca169c054fc081d Mon Sep 17 00:00:00 2001 +From: Sekhar Nori +Date: Tue, 15 Dec 2015 19:56:12 +0530 +Subject: irqchip/omap-intc: Add support for spurious irq handling + +From: Sekhar Nori + +commit d3b421cd07e4c0d4d6c0bbd55ca169c054fc081d upstream. + +Under some conditions, irq sorting procedure used by INTC can go wrong +resulting in a spurious irq getting reported. + +If this condition is not handled, it results in endless stream of: + + unexpected IRQ trap at vector 00 + +messages from ack_bad_irq() + +Handle the spurious interrupt condition in omap-intc driver to prevent this. + +Measurements using kernel function profiler on AM335x EVM running at 720MHz +show that after this patch omap_intc_handle_irq() takes about 37.4us against +34us before this patch. + +Signed-off-by: Sekhar Nori +Acked-by: Tony Lindgren +Cc: John Ogness +Cc: Felipe Balbi +Cc: Jason Cooper +Cc: Marc Zyngier +Link: http://lkml.kernel.org/r/9c78a6db02ac55f7af7371b417b6e414d2c3095b.1450188128.git.nsekhar@ti.com +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/irqchip/irq-omap-intc.c | 27 ++++++++++++++++++++++++++- + 1 file changed, 26 insertions(+), 1 deletion(-) + +--- a/drivers/irqchip/irq-omap-intc.c ++++ b/drivers/irqchip/irq-omap-intc.c +@@ -47,6 +47,7 @@ + #define INTC_ILR0 0x0100 + + #define ACTIVEIRQ_MASK 0x7f /* omap2/3 active interrupt bits */ ++#define SPURIOUSIRQ_MASK (0x1ffffff << 7) + #define INTCPS_NR_ILR_REGS 128 + #define INTCPS_NR_MIR_REGS 4 + +@@ -330,11 +331,35 @@ static int __init omap_init_irq(u32 base + static asmlinkage void __exception_irq_entry + omap_intc_handle_irq(struct pt_regs *regs) + { ++ extern unsigned long irq_err_count; + u32 irqnr; + + irqnr = intc_readl(INTC_SIR); ++ ++ /* ++ * A spurious IRQ can result if interrupt that triggered the ++ * sorting is no longer active during the sorting (10 INTC ++ * functional clock cycles after interrupt assertion). Or a ++ * change in interrupt mask affected the result during sorting ++ * time. There is no special handling required except ignoring ++ * the SIR register value just read and retrying. ++ * See section 6.2.5 of AM335x TRM Literature Number: SPRUH73K ++ * ++ * Many a times, a spurious interrupt situation has been fixed ++ * by adding a flush for the posted write acking the IRQ in ++ * the device driver. Typically, this is going be the device ++ * driver whose interrupt was handled just before the spurious ++ * IRQ occurred. Pay attention to those device drivers if you ++ * run into hitting the spurious IRQ condition below. ++ */ ++ if (unlikely((irqnr & SPURIOUSIRQ_MASK) == SPURIOUSIRQ_MASK)) { ++ pr_err_once("%s: spurious irq!\n", __func__); ++ irq_err_count++; ++ omap_ack_irq(NULL); ++ return; ++ } ++ + irqnr &= ACTIVEIRQ_MASK; +- WARN_ONCE(!irqnr, "Spurious IRQ ?\n"); + handle_domain_irq(domain, irqnr, regs); + } + diff --git a/queue-4.4/mips-fix-buffer-overflow-in-syscall_get_arguments.patch b/queue-4.4/mips-fix-buffer-overflow-in-syscall_get_arguments.patch new file mode 100644 index 00000000000..ebf766bd047 --- /dev/null +++ b/queue-4.4/mips-fix-buffer-overflow-in-syscall_get_arguments.patch @@ -0,0 +1,53 @@ +From f4dce1ffd2e30fa31756876ef502ce6d2324be35 Mon Sep 17 00:00:00 2001 +From: James Hogan +Date: Mon, 25 Jan 2016 20:32:03 +0000 +Subject: MIPS: Fix buffer overflow in syscall_get_arguments() + +From: James Hogan + +commit f4dce1ffd2e30fa31756876ef502ce6d2324be35 upstream. + +Since commit 4c21b8fd8f14 ("MIPS: seccomp: Handle indirect system calls +(o32)"), syscall_get_arguments() attempts to handle o32 indirect syscall +arguments by incrementing both the start argument number and the number +of arguments to fetch. However only the start argument number needs to +be incremented. The number of arguments does not change, they're just +shifted up by one, and in fact the output array is provided by the +caller and is likely only n entries long, so reading more arguments +overflows the output buffer. + +In the case of seccomp, this results in it fetching 7 arguments starting +at the 2nd one, which overflows the unsigned long args[6] in +populate_seccomp_data(). This clobbers the $s0 register from +syscall_trace_enter() which __seccomp_phase1_filter() saved onto the +stack, into which syscall_trace_enter() had placed its syscall number +argument. This caused Chromium to crash. + +Credit goes to Milko for tracking it down as far as $s0 being clobbered. + +Fixes: 4c21b8fd8f14 ("MIPS: seccomp: Handle indirect system calls (o32)") +Reported-by: Milko Leporis +Signed-off-by: James Hogan +Cc: linux-mips@linux-mips.org +Patchwork: https://patchwork.linux-mips.org/patch/12213/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/include/asm/syscall.h | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/arch/mips/include/asm/syscall.h ++++ b/arch/mips/include/asm/syscall.h +@@ -101,10 +101,8 @@ static inline void syscall_get_arguments + /* O32 ABI syscall() - Either 64-bit with O32 or 32-bit */ + if ((config_enabled(CONFIG_32BIT) || + test_tsk_thread_flag(task, TIF_32BIT_REGS)) && +- (regs->regs[2] == __NR_syscall)) { ++ (regs->regs[2] == __NR_syscall)) + i++; +- n++; +- } + + while (n--) + ret |= mips_get_syscall_arg(args++, task, regs, i++); diff --git a/queue-4.4/mips-fix-some-missing-config_cpu_mipsr6-ifdefs.patch b/queue-4.4/mips-fix-some-missing-config_cpu_mipsr6-ifdefs.patch new file mode 100644 index 00000000000..8a309ce1a20 --- /dev/null +++ b/queue-4.4/mips-fix-some-missing-config_cpu_mipsr6-ifdefs.patch @@ -0,0 +1,61 @@ +From 4f33f6c522948fffc345261896042b58dea23754 Mon Sep 17 00:00:00 2001 +From: Huacai Chen +Date: Thu, 21 Jan 2016 21:09:52 +0800 +Subject: MIPS: Fix some missing CONFIG_CPU_MIPSR6 #ifdefs + +From: Huacai Chen + +commit 4f33f6c522948fffc345261896042b58dea23754 upstream. + +Commit be0c37c985eddc4 (MIPS: Rearrange PTE bits into fixed positions.) +defines fixed PTE bits for MIPS R2. Then, commit d7b631419b3d230a4d383 +(MIPS: pgtable-bits: Fix XPA damage to R6 definitions.) adds the MIPS +R6 definitions in the same way as MIPS R2. But some R6 #ifdefs in the +later commit are missing, so in this patch I fix that. + +Signed-off-by: Huacai Chen +Cc: Aurelien Jarno +Cc: Steven J. Hill +Cc: Fuxin Zhang +Cc: Zhangjin Wu +Cc: linux-mips@linux-mips.org +Patchwork: https://patchwork.linux-mips.org/patch/12164/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/include/asm/pgtable.h | 4 ++-- + arch/mips/mm/tlbex.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/mips/include/asm/pgtable.h ++++ b/arch/mips/include/asm/pgtable.h +@@ -353,7 +353,7 @@ static inline pte_t pte_mkdirty(pte_t pt + static inline pte_t pte_mkyoung(pte_t pte) + { + pte_val(pte) |= _PAGE_ACCESSED; +-#ifdef CONFIG_CPU_MIPSR2 ++#if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6) + if (!(pte_val(pte) & _PAGE_NO_READ)) + pte_val(pte) |= _PAGE_SILENT_READ; + else +@@ -560,7 +560,7 @@ static inline pmd_t pmd_mkyoung(pmd_t pm + { + pmd_val(pmd) |= _PAGE_ACCESSED; + +-#ifdef CONFIG_CPU_MIPSR2 ++#if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6) + if (!(pmd_val(pmd) & _PAGE_NO_READ)) + pmd_val(pmd) |= _PAGE_SILENT_READ; + else +--- a/arch/mips/mm/tlbex.c ++++ b/arch/mips/mm/tlbex.c +@@ -242,7 +242,7 @@ static void output_pgtable_bits_defines( + pr_define("_PAGE_HUGE_SHIFT %d\n", _PAGE_HUGE_SHIFT); + pr_define("_PAGE_SPLITTING_SHIFT %d\n", _PAGE_SPLITTING_SHIFT); + #endif +-#ifdef CONFIG_CPU_MIPSR2 ++#if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6) + if (cpu_has_rixi) { + #ifdef _PAGE_NO_EXEC_SHIFT + pr_define("_PAGE_NO_EXEC_SHIFT %d\n", _PAGE_NO_EXEC_SHIFT); diff --git a/queue-4.4/mips-hpet-choose-a-safe-value-for-the-etime-check.patch b/queue-4.4/mips-hpet-choose-a-safe-value-for-the-etime-check.patch new file mode 100644 index 00000000000..0e532a8e064 --- /dev/null +++ b/queue-4.4/mips-hpet-choose-a-safe-value-for-the-etime-check.patch @@ -0,0 +1,87 @@ +From 5610b1254e3689b6ef8ebe2db260709a74da06c8 Mon Sep 17 00:00:00 2001 +From: Huacai Chen +Date: Thu, 21 Jan 2016 21:09:50 +0800 +Subject: MIPS: hpet: Choose a safe value for the ETIME check + +From: Huacai Chen + +commit 5610b1254e3689b6ef8ebe2db260709a74da06c8 upstream. + +This patch is borrowed from x86 hpet driver and explaind below: + +Due to the overly intelligent design of HPETs, we need to workaround +the problem that the compare value which we write is already behind +the actual counter value at the point where the value hits the real +compare register. This happens for two reasons: + +1) We read out the counter, add the delta and write the result to the + compare register. When a NMI hits between the read out and the write + then the counter can be ahead of the event already. + +2) The write to the compare register is delayed by up to two HPET + cycles in AMD chipsets. + +We can work around this by reading back the compare register to make +sure that the written value has hit the hardware. But that is bad +performance wise for the normal case where the event is far enough in +the future. + +As we already know that the write can be delayed by up to two cycles +we can avoid the read back of the compare register completely if we +make the decision whether the delta has elapsed already or not based +on the following calculation: + + cmp = event - actual_count; + +If cmp is less than 64 HPET clock cycles, then we decide that the event +has happened already and return -ETIME. That covers the above #1 and #2 +problems which would cause a wait for HPET wraparound (~306 seconds). + +Signed-off-by: Huacai Chen +Cc: Aurelien Jarno +Cc: Steven J. Hill +Cc: Fuxin Zhang +Cc: Zhangjin Wu +Cc: Huacai Chen +Cc: linux-mips@linux-mips.org +Patchwork: https://patchwork.linux-mips.org/patch/12162/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/loongson64/loongson-3/hpet.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/arch/mips/loongson64/loongson-3/hpet.c ++++ b/arch/mips/loongson64/loongson-3/hpet.c +@@ -13,6 +13,9 @@ + #define SMBUS_PCI_REG64 0x64 + #define SMBUS_PCI_REGB4 0xb4 + ++#define HPET_MIN_CYCLES 64 ++#define HPET_MIN_PROG_DELTA (HPET_MIN_CYCLES + (HPET_MIN_CYCLES >> 1)) ++ + static DEFINE_SPINLOCK(hpet_lock); + DEFINE_PER_CPU(struct clock_event_device, hpet_clockevent_device); + +@@ -161,8 +164,9 @@ static int hpet_next_event(unsigned long + cnt += delta; + hpet_write(HPET_T0_CMP, cnt); + +- res = ((int)(hpet_read(HPET_COUNTER) - cnt) > 0) ? -ETIME : 0; +- return res; ++ res = (int)(cnt - hpet_read(HPET_COUNTER)); ++ ++ return res < HPET_MIN_CYCLES ? -ETIME : 0; + } + + static irqreturn_t hpet_irq_handler(int irq, void *data) +@@ -237,7 +241,7 @@ void __init setup_hpet_timer(void) + cd->cpumask = cpumask_of(cpu); + clockevent_set_clock(cd, HPET_FREQ); + cd->max_delta_ns = clockevent_delta2ns(0x7fffffff, cd); +- cd->min_delta_ns = 5000; ++ cd->min_delta_ns = clockevent_delta2ns(HPET_MIN_PROG_DELTA, cd); + + clockevents_register_device(cd); + setup_irq(HPET_T0_IRQ, &hpet_irq); diff --git a/queue-4.4/mips-loongson-3-fix-smp_ask_c0count-ipi-handler.patch b/queue-4.4/mips-loongson-3-fix-smp_ask_c0count-ipi-handler.patch new file mode 100644 index 00000000000..9277d6037ef --- /dev/null +++ b/queue-4.4/mips-loongson-3-fix-smp_ask_c0count-ipi-handler.patch @@ -0,0 +1,91 @@ +From 5754843225f78ac7cbe142a6899890a9733a5a5d Mon Sep 17 00:00:00 2001 +From: Huacai Chen +Date: Thu, 21 Jan 2016 21:09:49 +0800 +Subject: MIPS: Loongson-3: Fix SMP_ASK_C0COUNT IPI handler + +From: Huacai Chen + +commit 5754843225f78ac7cbe142a6899890a9733a5a5d upstream. + +When Core-0 handle SMP_ASK_C0COUNT IPI, we should make other cores to +see the result as soon as possible (especially when Store-Fill-Buffer +is enabled). Otherwise, C0_Count syncronization makes no sense. + +BTW, array is more suitable than per-cpu variable for syncronization, +and there is a corner case should be avoid: C0_Count of Core-0 can be +really 0. + +Signed-off-by: Huacai Chen +Cc: Aurelien Jarno +Cc: Steven J. Hill +Cc: Fuxin Zhang +Cc: Zhangjin Wu +Cc: Huacai Chen +Cc: linux-mips@linux-mips.org +Patchwork: https://patchwork.linux-mips.org/patch/12160/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/loongson64/loongson-3/smp.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +--- a/arch/mips/loongson64/loongson-3/smp.c ++++ b/arch/mips/loongson64/loongson-3/smp.c +@@ -30,13 +30,13 @@ + #include "smp.h" + + DEFINE_PER_CPU(int, cpu_state); +-DEFINE_PER_CPU(uint32_t, core0_c0count); + + static void *ipi_set0_regs[16]; + static void *ipi_clear0_regs[16]; + static void *ipi_status0_regs[16]; + static void *ipi_en0_regs[16]; + static void *ipi_mailbox_buf[16]; ++static uint32_t core0_c0count[NR_CPUS]; + + /* read a 32bit value from ipi register */ + #define loongson3_ipi_read32(addr) readl(addr) +@@ -275,12 +275,14 @@ void loongson3_ipi_interrupt(struct pt_r + if (action & SMP_ASK_C0COUNT) { + BUG_ON(cpu != 0); + c0count = read_c0_count(); +- for (i = 1; i < num_possible_cpus(); i++) +- per_cpu(core0_c0count, i) = c0count; ++ c0count = c0count ? c0count : 1; ++ for (i = 1; i < nr_cpu_ids; i++) ++ core0_c0count[i] = c0count; ++ __wbflush(); /* Let others see the result ASAP */ + } + } + +-#define MAX_LOOPS 1111 ++#define MAX_LOOPS 800 + /* + * SMP init and finish on secondary CPUs + */ +@@ -305,16 +307,20 @@ static void loongson3_init_secondary(voi + cpu_logical_map(cpu) / loongson_sysconf.cores_per_package; + + i = 0; +- __this_cpu_write(core0_c0count, 0); ++ core0_c0count[cpu] = 0; + loongson3_send_ipi_single(0, SMP_ASK_C0COUNT); +- while (!__this_cpu_read(core0_c0count)) { ++ while (!core0_c0count[cpu]) { + i++; + cpu_relax(); + } + + if (i > MAX_LOOPS) + i = MAX_LOOPS; +- initcount = __this_cpu_read(core0_c0count) + i; ++ if (cpu_data[cpu].package) ++ initcount = core0_c0count[cpu] + i; ++ else /* Local access is faster for loops */ ++ initcount = core0_c0count[cpu] + i/2; ++ + write_c0_count(initcount); + } + diff --git a/queue-4.4/mmc-core-enable-tuning-according-to-the-actual-timing.patch b/queue-4.4/mmc-core-enable-tuning-according-to-the-actual-timing.patch new file mode 100644 index 00000000000..fecdd71cf06 --- /dev/null +++ b/queue-4.4/mmc-core-enable-tuning-according-to-the-actual-timing.patch @@ -0,0 +1,66 @@ +From e10c321977091f163eceedec0650e0ef4b3cf4bb Mon Sep 17 00:00:00 2001 +From: Carlo Caione +Date: Wed, 13 Jan 2016 09:36:55 +0100 +Subject: mmc: core: Enable tuning according to the actual timing + +From: Carlo Caione + +commit e10c321977091f163eceedec0650e0ef4b3cf4bb upstream. + +While in sdhci_execute_tuning() the choice whether or not to enable the +tuning is done on the actual timing, in the mmc_sdio_init_uhs_card() the +check is done on the capability of the card. + +This difference is causing some issues with some SDIO cards in DDR50 +mode where the CDM19 is wrongly issued. + +With this patch we modify the check in both +mmc_(sd|sdio)_init_uhs_card() functions to take the proper decision +only according to the actual timing specification. + +Signed-off-by: Carlo Caione +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/core/sd.c | 8 ++++---- + drivers/mmc/core/sdio.c | 4 ++-- + 2 files changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/mmc/core/sd.c ++++ b/drivers/mmc/core/sd.c +@@ -626,9 +626,9 @@ static int mmc_sd_init_uhs_card(struct m + * SDR104 mode SD-cards. Note that tuning is mandatory for SDR104. + */ + if (!mmc_host_is_spi(card->host) && +- (card->sd_bus_speed == UHS_SDR50_BUS_SPEED || +- card->sd_bus_speed == UHS_DDR50_BUS_SPEED || +- card->sd_bus_speed == UHS_SDR104_BUS_SPEED)) { ++ (card->host->ios.timing == MMC_TIMING_UHS_SDR50 || ++ card->host->ios.timing == MMC_TIMING_UHS_DDR50 || ++ card->host->ios.timing == MMC_TIMING_UHS_SDR104)) { + err = mmc_execute_tuning(card); + + /* +@@ -638,7 +638,7 @@ static int mmc_sd_init_uhs_card(struct m + * difference between v3.00 and 3.01 spec means that CMD19 + * tuning is also available for DDR50 mode. + */ +- if (err && card->sd_bus_speed == UHS_DDR50_BUS_SPEED) { ++ if (err && card->host->ios.timing == MMC_TIMING_UHS_DDR50) { + pr_warn("%s: ddr50 tuning failed\n", + mmc_hostname(card->host)); + err = 0; +--- a/drivers/mmc/core/sdio.c ++++ b/drivers/mmc/core/sdio.c +@@ -535,8 +535,8 @@ static int mmc_sdio_init_uhs_card(struct + * SDR104 mode SD-cards. Note that tuning is mandatory for SDR104. + */ + if (!mmc_host_is_spi(card->host) && +- ((card->sw_caps.sd3_bus_mode & SD_MODE_UHS_SDR50) || +- (card->sw_caps.sd3_bus_mode & SD_MODE_UHS_SDR104))) ++ ((card->host->ios.timing == MMC_TIMING_UHS_SDR50) || ++ (card->host->ios.timing == MMC_TIMING_UHS_SDR104))) + err = mmc_execute_tuning(card); + out: + return err; diff --git a/queue-4.4/mmc-mmc-fix-incorrect-use-of-driver-strength-switching-hs200-and-hs400.patch b/queue-4.4/mmc-mmc-fix-incorrect-use-of-driver-strength-switching-hs200-and-hs400.patch new file mode 100644 index 00000000000..f513a07969f --- /dev/null +++ b/queue-4.4/mmc-mmc-fix-incorrect-use-of-driver-strength-switching-hs200-and-hs400.patch @@ -0,0 +1,49 @@ +From adb24d42a516bca8b9741ed21206509daaab5b13 Mon Sep 17 00:00:00 2001 +From: Wenkai Du +Date: Thu, 26 Nov 2015 14:00:44 +0200 +Subject: mmc: mmc: Fix incorrect use of driver strength switching HS200 and HS400 + +From: Wenkai Du + +commit adb24d42a516bca8b9741ed21206509daaab5b13 upstream. + +Commit cc4f414c885c ("mmc: mmc: Add driver strength selection") +added driver strength selection for eMMC HS200 and HS400 modes. +That patch also set the driver stength when transitioning through +High Speed mode to HS200/HS400, but driver strength is not defined +for High Speed mode. While the JEDEC specification is not clear +on this point it has been observed to cause problems for some eMMC, +and removing the driver strength setting in this case makes it +consistent with the normal use of High Speed mode. + +Signed-off-by: Wenkai Du +Signed-off-by: Adrian Hunter +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/core/mmc.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/mmc/core/mmc.c ++++ b/drivers/mmc/core/mmc.c +@@ -1076,8 +1076,7 @@ static int mmc_select_hs400(struct mmc_c + mmc_set_clock(host, max_dtr); + + /* Switch card to HS mode */ +- val = EXT_CSD_TIMING_HS | +- card->drive_strength << EXT_CSD_DRV_STR_SHIFT; ++ val = EXT_CSD_TIMING_HS; + err = __mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, + EXT_CSD_HS_TIMING, val, + card->ext_csd.generic_cmd6_time, +@@ -1160,8 +1159,7 @@ int mmc_hs400_to_hs200(struct mmc_card * + mmc_set_clock(host, max_dtr); + + /* Switch HS400 to HS DDR */ +- val = EXT_CSD_TIMING_HS | +- card->drive_strength << EXT_CSD_DRV_STR_SHIFT; ++ val = EXT_CSD_TIMING_HS; + err = __mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, EXT_CSD_HS_TIMING, + val, card->ext_csd.generic_cmd6_time, + true, send_status, true); diff --git a/queue-4.4/mmc-mmci-fix-an-ages-old-detection-error.patch b/queue-4.4/mmc-mmci-fix-an-ages-old-detection-error.patch new file mode 100644 index 00000000000..64e25911a0c --- /dev/null +++ b/queue-4.4/mmc-mmci-fix-an-ages-old-detection-error.patch @@ -0,0 +1,37 @@ +From 0bcb7efdff63564e80fe84dd36a9fbdfbf6697a4 Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Mon, 4 Jan 2016 02:21:55 +0100 +Subject: mmc: mmci: fix an ages old detection error + +From: Linus Walleij + +commit 0bcb7efdff63564e80fe84dd36a9fbdfbf6697a4 upstream. + +commit 4956e10903fd ("ARM: 6244/1: mmci: add variant data and default +MCICLOCK support") added variant data for ARM, U300 and Ux500 variants. +The Nomadik NHK8815/8820 variant was erroneously labeled as a U300 +variant, and when the proper Nomadik variant was later introduced in +commit 34fd421349ff ("ARM: 7378/1: mmci: add support for the Nomadik MMCI +variant") this was not fixes. Let's say this fixes the latter commit as +there was no proper Nomadik support until then. + +Fixes: 34fd421349ff ("ARM: 7378/1: mmci: add support for the Nomadik...") +Signed-off-by: Linus Walleij +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/mmci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/host/mmci.c ++++ b/drivers/mmc/host/mmci.c +@@ -1886,7 +1886,7 @@ static struct amba_id mmci_ids[] = { + { + .id = 0x00280180, + .mask = 0x00ffffff, +- .data = &variant_u300, ++ .data = &variant_nomadik, + }, + { + .id = 0x00480180, diff --git a/queue-4.4/mmc-pxamci-fix-again-read-only-gpio-detection-polarity.patch b/queue-4.4/mmc-pxamci-fix-again-read-only-gpio-detection-polarity.patch new file mode 100644 index 00000000000..9bd35f96136 --- /dev/null +++ b/queue-4.4/mmc-pxamci-fix-again-read-only-gpio-detection-polarity.patch @@ -0,0 +1,38 @@ +From 41c89159a6ae5472d39ed8bded5b3b4e07a37944 Mon Sep 17 00:00:00 2001 +From: Robert Jarzmik +Date: Fri, 29 Jan 2016 00:21:26 +0100 +Subject: mmc: pxamci: fix again read-only gpio detection polarity + +From: Robert Jarzmik + +commit 41c89159a6ae5472d39ed8bded5b3b4e07a37944 upstream. + +The commit fixing the conversion of pxamci to slot-gpio API fixed the +inverted the logic of the read-only gpio. Unfortunately, the commit was +tested on a non-inverted gpio, and not on the inverted one. And the fix +did work partially, by luck. + +This is the remaining missing part of the fix, trivial but still necessary. + +Fixes: Fixes: 26d49fe71953 ("mmc: pxamci: fix read-only gpio detection polarity") +Reported-by: Andrea Adami +Tested-by: Andrea Adami +Signed-off-by: Robert Jarzmik +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/pxamci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/host/pxamci.c ++++ b/drivers/mmc/host/pxamci.c +@@ -804,7 +804,7 @@ static int pxamci_probe(struct platform_ + dev_err(&pdev->dev, "Failed requesting gpio_ro %d\n", gpio_ro); + goto out; + } else { +- mmc->caps |= host->pdata->gpio_card_ro_invert ? ++ mmc->caps2 |= host->pdata->gpio_card_ro_invert ? + 0 : MMC_CAP2_RO_ACTIVE_HIGH; + } + diff --git a/queue-4.4/mmc-sdhci-acpi-fix-card-detect-race-for-intel-bxt-apl.patch b/queue-4.4/mmc-sdhci-acpi-fix-card-detect-race-for-intel-bxt-apl.patch new file mode 100644 index 00000000000..3d916255497 --- /dev/null +++ b/queue-4.4/mmc-sdhci-acpi-fix-card-detect-race-for-intel-bxt-apl.patch @@ -0,0 +1,74 @@ +From 6a645dd87a5a506779810d7d9935c25fc2ef4687 Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Tue, 9 Feb 2016 16:12:38 +0200 +Subject: mmc: sdhci-acpi: Fix card detect race for Intel BXT/APL + +From: Adrian Hunter + +commit 6a645dd87a5a506779810d7d9935c25fc2ef4687 upstream. + +Intel BXT/APL use a card detect GPIO however the host controller +will not enable bus power unless it's card detect also reflects +the presence of a card. Unfortunately those 2 things race which +can result in commands not starting, after which the controller +does nothing and there is a 10 second wait for the driver's +10-second timer to timeout. + +That is fixed by having the driver look also at the present state +register to determine if the card is present. Consequently, provide +a 'get_cd' mmc host operation for BXT/APL that does that. + +Signed-off-by: Adrian Hunter +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci-acpi.c | 30 ++++++++++++++++++++++++++++++ + 1 file changed, 30 insertions(+) + +--- a/drivers/mmc/host/sdhci-acpi.c ++++ b/drivers/mmc/host/sdhci-acpi.c +@@ -146,6 +146,33 @@ static const struct sdhci_acpi_chip sdhc + .ops = &sdhci_acpi_ops_int, + }; + ++static int bxt_get_cd(struct mmc_host *mmc) ++{ ++ int gpio_cd = mmc_gpio_get_cd(mmc); ++ struct sdhci_host *host = mmc_priv(mmc); ++ unsigned long flags; ++ int ret = 0; ++ ++ if (!gpio_cd) ++ return 0; ++ ++ pm_runtime_get_sync(mmc->parent); ++ ++ spin_lock_irqsave(&host->lock, flags); ++ ++ if (host->flags & SDHCI_DEVICE_DEAD) ++ goto out; ++ ++ ret = !!(sdhci_readl(host, SDHCI_PRESENT_STATE) & SDHCI_CARD_PRESENT); ++out: ++ spin_unlock_irqrestore(&host->lock, flags); ++ ++ pm_runtime_mark_last_busy(mmc->parent); ++ pm_runtime_put_autosuspend(mmc->parent); ++ ++ return ret; ++} ++ + static int sdhci_acpi_emmc_probe_slot(struct platform_device *pdev, + const char *hid, const char *uid) + { +@@ -196,6 +223,9 @@ static int sdhci_acpi_sd_probe_slot(stru + + /* Platform specific code during sd probe slot goes here */ + ++ if (hid && !strcmp(hid, "80865ACA")) ++ host->mmc_host_ops.get_cd = bxt_get_cd; ++ + return 0; + } + diff --git a/queue-4.4/mmc-sdhci-allow-override-of-get_cd-called-from-sdhci_request.patch b/queue-4.4/mmc-sdhci-allow-override-of-get_cd-called-from-sdhci_request.patch new file mode 100644 index 00000000000..fb405297c4d --- /dev/null +++ b/queue-4.4/mmc-sdhci-allow-override-of-get_cd-called-from-sdhci_request.patch @@ -0,0 +1,41 @@ +From 8d28b7a72fe18bcdcdb047243ba8fec36b149955 Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Tue, 9 Feb 2016 16:12:36 +0200 +Subject: mmc: sdhci: Allow override of get_cd() called from sdhci_request() + +From: Adrian Hunter + +commit 8d28b7a72fe18bcdcdb047243ba8fec36b149955 upstream. + +Drivers may need to provide their own get_cd() mmc host op, but +currently the internals of the current op (sdhci_get_cd()) are +provided by sdhci_do_get_cd() which is also called from +sdhci_request(). + +To allow override of the get_cd functionality, change sdhci_request() +to call ->get_cd() instead of sdhci_do_get_cd(). + +Note, in the future the call to ->get_cd() will likely be removed +from sdhci_request() since most drivers don't need actually it. +However this change is being done now to facilitate a subsequent +bug fix. + +Signed-off-by: Adrian Hunter +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1367,7 +1367,7 @@ static void sdhci_request(struct mmc_hos + sdhci_runtime_pm_get(host); + + /* Firstly check card presence */ +- present = sdhci_do_get_cd(host); ++ present = mmc->ops->get_cd(mmc); + + spin_lock_irqsave(&host->lock, flags); + diff --git a/queue-4.4/mmc-sdhci-allow-override-of-mmc-host-operations.patch b/queue-4.4/mmc-sdhci-allow-override-of-mmc-host-operations.patch new file mode 100644 index 00000000000..83000f136a2 --- /dev/null +++ b/queue-4.4/mmc-sdhci-allow-override-of-mmc-host-operations.patch @@ -0,0 +1,57 @@ +From bf60e592a1af4d6f65dd54593250183f14360eed Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Tue, 9 Feb 2016 16:12:35 +0200 +Subject: mmc: sdhci: Allow override of mmc host operations + +From: Adrian Hunter + +commit bf60e592a1af4d6f65dd54593250183f14360eed upstream. + +In the past, fixes for specific hardware devices were implemented +in sdhci using quirks. That approach is no longer accepted because +the growing number of quirks was starting to make the code difficult +to understand and maintain. + +One alternative to quirks, is to allow drivers to override the default +mmc host operations. This patch makes it easy to do that, and it is +needed for a subsequent bug fix, for which separate patches are +provided. + +Signed-off-by: Adrian Hunter +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci.c | 3 ++- + drivers/mmc/host/sdhci.h | 1 + + 2 files changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -2864,6 +2864,8 @@ struct sdhci_host *sdhci_alloc_host(stru + + host = mmc_priv(mmc); + host->mmc = mmc; ++ host->mmc_host_ops = sdhci_ops; ++ mmc->ops = &host->mmc_host_ops; + + return host; + } +@@ -3060,7 +3062,6 @@ int sdhci_add_host(struct sdhci_host *ho + /* + * Set host parameters. + */ +- mmc->ops = &sdhci_ops; + max_clk = host->max_clk; + + if (host->ops->get_min_clock) +--- a/drivers/mmc/host/sdhci.h ++++ b/drivers/mmc/host/sdhci.h +@@ -425,6 +425,7 @@ struct sdhci_host { + + /* Internal data */ + struct mmc_host *mmc; /* MMC structure */ ++ struct mmc_host_ops mmc_host_ops; /* MMC host ops */ + u64 dma_mask; /* custom DMA mask */ + + #if defined(CONFIG_LEDS_CLASS) || defined(CONFIG_LEDS_CLASS_MODULE) diff --git a/queue-4.4/mmc-sdhci-fix-dma-descriptor-with-zero-data-length.patch b/queue-4.4/mmc-sdhci-fix-dma-descriptor-with-zero-data-length.patch new file mode 100644 index 00000000000..45a51e92de1 --- /dev/null +++ b/queue-4.4/mmc-sdhci-fix-dma-descriptor-with-zero-data-length.patch @@ -0,0 +1,61 @@ +From 347ea32dc118326c4f2636928239a29d192cc9b8 Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Thu, 26 Nov 2015 14:00:48 +0200 +Subject: mmc: sdhci: Fix DMA descriptor with zero data length + +From: Adrian Hunter + +commit 347ea32dc118326c4f2636928239a29d192cc9b8 upstream. + +SDHCI has built-in DMA called ADMA2. ADMA2 uses a descriptor +table to define DMA scatter-gather. Each desciptor can specify +a data length up to 65536 bytes, however the length field is +only 16-bits so zero means 65536. Consequently, putting zero +when the size is zero must not be allowed. This patch fixes +one case where zero data length could be set inadvertently. + +The problem happens because unaligned data gets split and the +code did not consider that the remaining aligned portion might +be zero length. That case really only happens for SDIO because +SD and eMMC cards transfer blocks that are invariably sector- +aligned. For SDIO, access to function registers is done by +data transfer (CMD53) when the register is bigger than 1 byte. +Generally registers are 4 bytes but 2-byte registers are possible. +So DMA of 4 bytes or less can happen. When 32-bit DMA is used, +the data alignment must be 4, so 4-byte transfers won't casue a +problem, but a 2-byte transfer could. However with the introduction +of 64-bit DMA, the data alignment for 64-bit DMA was made 8 bytes, +so all 4-byte transfers not on 8-byte boundaries get "split" into +a 4-byte chunk and a 0-byte chunk, thereby hitting the bug. + +In fact, a closer look at the SDHCI specs indicates that only the +descriptor table requires 8-byte alignment for 64-bit DMA. That +will be dealt with in a separate patch, but the potential for a +2-byte access remains, so this fix is needed anyway. + +Signed-off-by: Adrian Hunter +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -540,9 +540,12 @@ static int sdhci_adma_table_pre(struct s + + BUG_ON(len > 65536); + +- /* tran, valid */ +- sdhci_adma_write_desc(host, desc, addr, len, ADMA2_TRAN_VALID); +- desc += host->desc_sz; ++ if (len) { ++ /* tran, valid */ ++ sdhci_adma_write_desc(host, desc, addr, len, ++ ADMA2_TRAN_VALID); ++ desc += host->desc_sz; ++ } + + /* + * If this triggers then we have a calculation bug diff --git a/queue-4.4/mmc-sdhci-fix-sdhci_runtime_pm_bus_on-off.patch b/queue-4.4/mmc-sdhci-fix-sdhci_runtime_pm_bus_on-off.patch new file mode 100644 index 00000000000..cfb735f1c5e --- /dev/null +++ b/queue-4.4/mmc-sdhci-fix-sdhci_runtime_pm_bus_on-off.patch @@ -0,0 +1,49 @@ +From 5c671c410c8704800f4f1673b6f572137e7e6ddd Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Thu, 26 Nov 2015 14:00:50 +0200 +Subject: mmc: sdhci: Fix sdhci_runtime_pm_bus_on/off() + +From: Adrian Hunter + +commit 5c671c410c8704800f4f1673b6f572137e7e6ddd upstream. + +sdhci has a legacy facility to prevent runtime suspend if the +bus power is on. This is needed in cases where the power to +the card is dependent on the bus power. It is controlled by +a pair of functions: sdhci_runtime_pm_bus_on() and +sdhci_runtime_pm_bus_off(). These functions use a boolean +variable 'bus_on' to ensure changes are always paired. +There is an additional check for 'runtime_suspended' which is +the problem. In fact, its use is ill-conceived as the only +requirement for the logic is that 'on' and 'off' are paired, +which is actually broken by the check, for example if the bus +power is turned on during runtime resume. So remove the check. + +Signed-off-by: Adrian Hunter +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -2763,7 +2763,7 @@ static int sdhci_runtime_pm_put(struct s + + static void sdhci_runtime_pm_bus_on(struct sdhci_host *host) + { +- if (host->runtime_suspended || host->bus_on) ++ if (host->bus_on) + return; + host->bus_on = true; + pm_runtime_get_noresume(host->mmc->parent); +@@ -2771,7 +2771,7 @@ static void sdhci_runtime_pm_bus_on(stru + + static void sdhci_runtime_pm_bus_off(struct sdhci_host *host) + { +- if (host->runtime_suspended || !host->bus_on) ++ if (!host->bus_on) + return; + host->bus_on = false; + pm_runtime_put_noidle(host->mmc->parent); diff --git a/queue-4.4/mmc-sdhci-pci-do-not-default-to-33-ohm-driver-strength-for-intel-spt.patch b/queue-4.4/mmc-sdhci-pci-do-not-default-to-33-ohm-driver-strength-for-intel-spt.patch new file mode 100644 index 00000000000..d7b9b288019 --- /dev/null +++ b/queue-4.4/mmc-sdhci-pci-do-not-default-to-33-ohm-driver-strength-for-intel-spt.patch @@ -0,0 +1,35 @@ +From 1ca896856281d3f1ad4f6f7d4e32e2943452de23 Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Thu, 26 Nov 2015 14:00:45 +0200 +Subject: mmc: sdhci-pci: Do not default to 33 Ohm driver strength for Intel SPT + +From: Adrian Hunter + +commit 1ca896856281d3f1ad4f6f7d4e32e2943452de23 upstream. + +In some cases, the stronger 33 Ohm driver strength must not be used +so it is not a suitable default. Change it to the standard default +50 Ohm value. + +The patch applies to v4.2+ except the file name changed. It is +drivers/mmc/host/sdhci-pci.c prior to v.4.4. + +Signed-off-by: Adrian Hunter +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci-pci-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/host/sdhci-pci-core.c ++++ b/drivers/mmc/host/sdhci-pci-core.c +@@ -277,7 +277,7 @@ static int spt_select_drive_strength(str + if (sdhci_pci_spt_drive_strength > 0) + drive_strength = sdhci_pci_spt_drive_strength & 0xf; + else +- drive_strength = 1; /* 33-ohm */ ++ drive_strength = 0; /* Default 50-ohm */ + + if ((mmc_driver_type_mask(drive_strength) & card_drv) == 0) + drive_strength = 0; /* Default 50-ohm */ diff --git a/queue-4.4/mmc-sdhci-pci-fix-card-detect-race-for-intel-bxt-apl.patch b/queue-4.4/mmc-sdhci-pci-fix-card-detect-race-for-intel-bxt-apl.patch new file mode 100644 index 00000000000..b50fa5c5d7b --- /dev/null +++ b/queue-4.4/mmc-sdhci-pci-fix-card-detect-race-for-intel-bxt-apl.patch @@ -0,0 +1,75 @@ +From 163cbe31e5163459908a41a2b4e0d33a28fd557a Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Tue, 9 Feb 2016 16:12:37 +0200 +Subject: mmc: sdhci-pci: Fix card detect race for Intel BXT/APL + +From: Adrian Hunter + +commit 163cbe31e5163459908a41a2b4e0d33a28fd557a upstream. + +Intel BXT/APL use a card detect GPIO however the host controller +will not enable bus power unless it's card detect also reflects +the presence of a card. Unfortunately those 2 things race which +can result in commands not starting, after which the controller +does nothing and there is a 10 second wait for the driver's +10-second timer to timeout. + +That is fixed by having the driver look also at the present state +register to determine if the card is present. Consequently, provide +a 'get_cd' mmc host operation for BXT/APL that does that. + +Signed-off-by: Adrian Hunter +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci-pci-core.c | 31 +++++++++++++++++++++++++++++++ + 1 file changed, 31 insertions(+) + +--- a/drivers/mmc/host/sdhci-pci-core.c ++++ b/drivers/mmc/host/sdhci-pci-core.c +@@ -330,6 +330,33 @@ static void spt_read_drive_strength(stru + sdhci_pci_spt_drive_strength = 0x10 | ((val >> 12) & 0xf); + } + ++static int bxt_get_cd(struct mmc_host *mmc) ++{ ++ int gpio_cd = mmc_gpio_get_cd(mmc); ++ struct sdhci_host *host = mmc_priv(mmc); ++ unsigned long flags; ++ int ret = 0; ++ ++ if (!gpio_cd) ++ return 0; ++ ++ pm_runtime_get_sync(mmc->parent); ++ ++ spin_lock_irqsave(&host->lock, flags); ++ ++ if (host->flags & SDHCI_DEVICE_DEAD) ++ goto out; ++ ++ ret = !!(sdhci_readl(host, SDHCI_PRESENT_STATE) & SDHCI_CARD_PRESENT); ++out: ++ spin_unlock_irqrestore(&host->lock, flags); ++ ++ pm_runtime_mark_last_busy(mmc->parent); ++ pm_runtime_put_autosuspend(mmc->parent); ++ ++ return ret; ++} ++ + static int byt_emmc_probe_slot(struct sdhci_pci_slot *slot) + { + slot->host->mmc->caps |= MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE | +@@ -362,6 +389,10 @@ static int byt_sd_probe_slot(struct sdhc + slot->cd_con_id = NULL; + slot->cd_idx = 0; + slot->cd_override_level = true; ++ if (slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_BXT_SD || ++ slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_APL_SD) ++ slot->host->mmc_host_ops.get_cd = bxt_get_cd; ++ + return 0; + } + diff --git a/queue-4.4/mmc-sdio-fix-invalid-vdd-in-voltage-switch-power-cycle.patch b/queue-4.4/mmc-sdio-fix-invalid-vdd-in-voltage-switch-power-cycle.patch new file mode 100644 index 00000000000..44cb8689140 --- /dev/null +++ b/queue-4.4/mmc-sdio-fix-invalid-vdd-in-voltage-switch-power-cycle.patch @@ -0,0 +1,36 @@ +From d9bfbb95ed598a09cf336adb0f190ee0ff802f0d Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Thu, 26 Nov 2015 14:00:47 +0200 +Subject: mmc: sdio: Fix invalid vdd in voltage switch power cycle + +From: Adrian Hunter + +commit d9bfbb95ed598a09cf336adb0f190ee0ff802f0d upstream. + +The 'ocr' parameter passed to mmc_set_signal_voltage() +defines the power-on voltage used when power cycling +after a failure to set the voltage. However, in the +case of mmc_sdio_init_card(), the value passed has the +R4_18V_PRESENT flag set which is not valid for power-on +and results in an invalid vdd. Fix by passing the card's +ocr value which does not have the flag. + +Signed-off-by: Adrian Hunter +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/core/sdio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/core/sdio.c ++++ b/drivers/mmc/core/sdio.c +@@ -630,7 +630,7 @@ try_again: + */ + if (!powered_resume && (rocr & ocr & R4_18V_PRESENT)) { + err = mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180, +- ocr); ++ ocr_card); + if (err == -EAGAIN) { + sdio_reset(host); + mmc_go_idle(host); diff --git a/queue-4.4/mmc-usdhi6rol0-handle-null-data-in-timeout.patch b/queue-4.4/mmc-usdhi6rol0-handle-null-data-in-timeout.patch new file mode 100644 index 00000000000..0e25fe10f8f --- /dev/null +++ b/queue-4.4/mmc-usdhi6rol0-handle-null-data-in-timeout.patch @@ -0,0 +1,43 @@ +From 05caee939f8d58d81e962071da85761e1e3a4c73 Mon Sep 17 00:00:00 2001 +From: Rabin Vincent +Date: Fri, 27 Nov 2015 12:59:11 +0100 +Subject: mmc: usdhi6rol0: handle NULL data in timeout + +From: Rabin Vincent + +commit 05caee939f8d58d81e962071da85761e1e3a4c73 upstream. + +Commit bb08a7d489bd ("mmc: usdhi6rol0: fix NULL pointer deref in debug +print") fixed one NULL pointer dereference but unfortunately introduced +another. "data" may be NULL if this is a command timeout for a command +without any data, so we should only use it if we're actually waiting for +data. + +Fixes: bb08a7d489bd ("mmc: usdhi6rol0: fix NULL pointer deref in debug print") +Signed-off-by: Rabin Vincent +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/usdhi6rol0.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/host/usdhi6rol0.c ++++ b/drivers/mmc/host/usdhi6rol0.c +@@ -1634,7 +1634,7 @@ static void usdhi6_timeout_work(struct w + struct usdhi6_host *host = container_of(d, struct usdhi6_host, timeout_work); + struct mmc_request *mrq = host->mrq; + struct mmc_data *data = mrq ? mrq->data : NULL; +- struct scatterlist *sg = host->sg ?: data->sg; ++ struct scatterlist *sg; + + dev_warn(mmc_dev(host->mmc), + "%s timeout wait %u CMD%d: IRQ 0x%08x:0x%08x, last IRQ 0x%08x\n", +@@ -1666,6 +1666,7 @@ static void usdhi6_timeout_work(struct w + case USDHI6_WAIT_FOR_MWRITE: + case USDHI6_WAIT_FOR_READ: + case USDHI6_WAIT_FOR_WRITE: ++ sg = host->sg ?: data->sg; + dev_dbg(mmc_dev(host->mmc), + "%c: page #%u @ +0x%zx %ux%u in SG%u. Current SG %u bytes @ %u\n", + data->flags & MMC_DATA_READ ? 'R' : 'W', host->page_idx, diff --git a/queue-4.4/posix-clock-fix-return-code-on-the-poll-method-s-error-path.patch b/queue-4.4/posix-clock-fix-return-code-on-the-poll-method-s-error-path.patch new file mode 100644 index 00000000000..a5bf92f103a --- /dev/null +++ b/queue-4.4/posix-clock-fix-return-code-on-the-poll-method-s-error-path.patch @@ -0,0 +1,50 @@ +From 1b9f23727abb92c5e58f139e7d180befcaa06fe0 Mon Sep 17 00:00:00 2001 +From: Richard Cochran +Date: Tue, 22 Dec 2015 22:19:58 +0100 +Subject: posix-clock: Fix return code on the poll method's error path + +From: Richard Cochran + +commit 1b9f23727abb92c5e58f139e7d180befcaa06fe0 upstream. + +The posix_clock_poll function is supposed to return a bit mask of +POLLxxx values. However, in case the hardware has disappeared (due to +hot plugging for example) this code returns -ENODEV in a futile +attempt to throw an error at the file descriptor level. The kernel's +file_operations interface does not accept such error codes from the +poll method. Instead, this function aught to return POLLERR. + +The value -ENODEV does, in fact, contain the POLLERR bit (and almost +all the other POLLxxx bits as well), but only by chance. This patch +fixes code to return a proper bit mask. + +Credit goes to Markus Elfring for pointing out the suspicious +signed/unsigned mismatch. + +Reported-by: Markus Elfring +igned-off-by: Richard Cochran +Cc: John Stultz +Cc: Julia Lawall +Link: http://lkml.kernel.org/r/1450819198-17420-1-git-send-email-richardcochran@gmail.com +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/time/posix-clock.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/time/posix-clock.c ++++ b/kernel/time/posix-clock.c +@@ -69,10 +69,10 @@ static ssize_t posix_clock_read(struct f + static unsigned int posix_clock_poll(struct file *fp, poll_table *wait) + { + struct posix_clock *clk = get_posix_clock(fp); +- int result = 0; ++ unsigned int result = 0; + + if (!clk) +- return -ENODEV; ++ return POLLERR; + + if (clk->ops.poll) + result = clk->ops.poll(clk, fp, wait); diff --git a/queue-4.4/regulator-axp20x-fix-gpio-ldo-enable-value-for-axp22x.patch b/queue-4.4/regulator-axp20x-fix-gpio-ldo-enable-value-for-axp22x.patch new file mode 100644 index 00000000000..f8833b010b7 --- /dev/null +++ b/queue-4.4/regulator-axp20x-fix-gpio-ldo-enable-value-for-axp22x.patch @@ -0,0 +1,36 @@ +From 3cb99e2ea99a454c8837a55aac88753ef05fc1eb Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Tue, 22 Dec 2015 17:08:06 +0800 +Subject: regulator: axp20x: Fix GPIO LDO enable value for AXP22x + +From: Chen-Yu Tsai + +commit 3cb99e2ea99a454c8837a55aac88753ef05fc1eb upstream. + +The enable/disable values for GPIO LDOs are reversed. It seems no one +noticed as AXP22x support was introduced recently, and no one was using +the GPIO LDOs, either because no designs actually use them or board +support hasn't caught up. + +Fixes: 1b82b4e4f954 ("regulator: axp20x: Add support for AXP22X regulators") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/axp20x-regulator.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/regulator/axp20x-regulator.c ++++ b/drivers/regulator/axp20x-regulator.c +@@ -27,8 +27,8 @@ + #define AXP20X_IO_ENABLED 0x03 + #define AXP20X_IO_DISABLED 0x07 + +-#define AXP22X_IO_ENABLED 0x04 +-#define AXP22X_IO_DISABLED 0x03 ++#define AXP22X_IO_ENABLED 0x03 ++#define AXP22X_IO_DISABLED 0x04 + + #define AXP20X_WORKMODE_DCDC2_MASK BIT(2) + #define AXP20X_WORKMODE_DCDC3_MASK BIT(1) diff --git a/queue-4.4/regulator-mt6311-mt6311_regulator-needs-to-select-regmap_i2c.patch b/queue-4.4/regulator-mt6311-mt6311_regulator-needs-to-select-regmap_i2c.patch new file mode 100644 index 00000000000..d4fd190166c --- /dev/null +++ b/queue-4.4/regulator-mt6311-mt6311_regulator-needs-to-select-regmap_i2c.patch @@ -0,0 +1,30 @@ +From aab3c3f34cc2dd8230052770712606d65de6538f Mon Sep 17 00:00:00 2001 +From: Henry Chen +Date: Tue, 17 Nov 2015 16:36:49 +0800 +Subject: regulator: mt6311: MT6311_REGULATOR needs to select REGMAP_I2C + +From: Henry Chen + +commit aab3c3f34cc2dd8230052770712606d65de6538f upstream. + +This patch fix the below build error: +drivers/regulator/mt6311-regulator.c:111: undefined reference to `__devm_regmap_init_i2c' + +Signed-off-by: Henry Chen +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/regulator/Kconfig ++++ b/drivers/regulator/Kconfig +@@ -446,6 +446,7 @@ config REGULATOR_MC13892 + config REGULATOR_MT6311 + tristate "MediaTek MT6311 PMIC" + depends on I2C ++ select REGMAP_I2C + help + Say y here to select this option to enable the power regulator of + MediaTek MT6311 PMIC. diff --git a/queue-4.4/revert-mips-fix-page_mask-definition.patch b/queue-4.4/revert-mips-fix-page_mask-definition.patch new file mode 100644 index 00000000000..c406cb9585a --- /dev/null +++ b/queue-4.4/revert-mips-fix-page_mask-definition.patch @@ -0,0 +1,38 @@ +From 800dc4f49cc002879e1e5e6b79926f86b60528e6 Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Fri, 22 Jan 2016 09:20:37 -0800 +Subject: Revert "MIPS: Fix PAGE_MASK definition" + +From: Dan Williams + +commit 800dc4f49cc002879e1e5e6b79926f86b60528e6 upstream. + +This reverts commit 22b14523994588279ae9c5ccfe64073c1e5b3c00. + +It was originally sent in an earlier revision of the pfn_t patchset. +Besides being broken, the warning is also fixed by PFN_FLAGS_MASK +casting the PAGE_MASK to an unsigned long. + +Reported-by: Manuel Lauss +Signed-off-by: Dan Williams +Cc: linux-kernel@vger.kernel.org +Cc: Linux-MIPS +Patchwork: https://patchwork.linux-mips.org/patch/12182/ +Signed-off-by: Ralf Baechle +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/include/asm/page.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/mips/include/asm/page.h ++++ b/arch/mips/include/asm/page.h +@@ -33,7 +33,7 @@ + #define PAGE_SHIFT 16 + #endif + #define PAGE_SIZE (_AC(1,UL) << PAGE_SHIFT) +-#define PAGE_MASK (~(PAGE_SIZE - 1)) ++#define PAGE_MASK (~((1 << PAGE_SHIFT) - 1)) + + /* + * This is used for calculating the real page sizes diff --git a/queue-4.4/series b/queue-4.4/series index c18fa6ff9d4..bd231e03884 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -123,3 +123,43 @@ dm-space-map-metadata-remove-unused-variable-in-brb_pop.patch dm-snapshot-fix-hung-bios-when-copy-error-occurs.patch dm-fix-dm_rq_target_io-leak-on-faults-with-.request_fn-dm-w-blk-mq-paths.patch coresight-checking-for-null-string-in-coresight_name_match.patch +irqchip-omap-intc-add-support-for-spurious-irq-handling.patch +irqchip-mxs-add-missing-set_handle_irq.patch +irqchip-atmel-aic-fix-wrong-bit-operation-for-irq-priority.patch +irqchip-gic-v3-its-fix-double-icc_eoir-write-for-lpi-in-eoimode-1.patch +posix-clock-fix-return-code-on-the-poll-method-s-error-path.patch +clockevents-tcb_clksrc-prevent-disabling-an-already-disabled-clock.patch +mmc-usdhi6rol0-handle-null-data-in-timeout.patch +mmc-sdhci-pci-do-not-default-to-33-ohm-driver-strength-for-intel-spt.patch +mmc-sdhci-fix-dma-descriptor-with-zero-data-length.patch +mmc-sdio-fix-invalid-vdd-in-voltage-switch-power-cycle.patch +mmc-mmc-fix-incorrect-use-of-driver-strength-switching-hs200-and-hs400.patch +mmc-sdhci-fix-sdhci_runtime_pm_bus_on-off.patch +mmc-core-enable-tuning-according-to-the-actual-timing.patch +mmc-mmci-fix-an-ages-old-detection-error.patch +mmc-sdhci-acpi-fix-card-detect-race-for-intel-bxt-apl.patch +mmc-pxamci-fix-again-read-only-gpio-detection-polarity.patch +mmc-sdhci-pci-fix-card-detect-race-for-intel-bxt-apl.patch +mmc-sdhci-allow-override-of-mmc-host-operations.patch +mmc-sdhci-allow-override-of-get_cd-called-from-sdhci_request.patch +tools-hv-vss-fix-the-write-s-argument-error-vss_msg.patch +drivers-hv-vmbus-fix-a-host-signaling-bug.patch +bluetooth-use-continuous-scanning-when-creating-le-connections.patch +bluetooth-add-support-of-toshiba-broadcom-based-devices.patch +bluetooth-fix-incorrect-removing-of-irks.patch +bluetooth-6lowpan-fix-kernel-null-pointer-dereferences.patch +bluetooth-6lowpan-fix-handling-of-uncompressed-ipv6-packets.patch +time-avoid-signed-overflow-in-timekeeping_get_ns.patch +cputime-prevent-32bit-overflow-in-time_to_cputime.patch +revert-mips-fix-page_mask-definition.patch +mips-loongson-3-fix-smp_ask_c0count-ipi-handler.patch +mips-hpet-choose-a-safe-value-for-the-etime-check.patch +mips-fix-some-missing-config_cpu_mipsr6-ifdefs.patch +mips-fix-buffer-overflow-in-syscall_get_arguments.patch +edac-robustify-workqueues-destruction.patch +edac-mc_sysfs-fix-freeing-bus-name.patch +sparc64-fix-incorrect-sign-extension-in-sys_sparc64_personality.patch +cxl-use-correct-operator-when-writing-pcie-config-space-values.patch +clk-exynos-use-irqsave-version-of-spin_lock-to-avoid-deadlock-with-irqs.patch +regulator-axp20x-fix-gpio-ldo-enable-value-for-axp22x.patch +regulator-mt6311-mt6311_regulator-needs-to-select-regmap_i2c.patch diff --git a/queue-4.4/sparc64-fix-incorrect-sign-extension-in-sys_sparc64_personality.patch b/queue-4.4/sparc64-fix-incorrect-sign-extension-in-sys_sparc64_personality.patch new file mode 100644 index 00000000000..9565ea9f310 --- /dev/null +++ b/queue-4.4/sparc64-fix-incorrect-sign-extension-in-sys_sparc64_personality.patch @@ -0,0 +1,39 @@ +From 525fd5a94e1be0776fa652df5c687697db508c91 Mon Sep 17 00:00:00 2001 +From: "Dmitry V. Levin" +Date: Sun, 27 Dec 2015 02:13:27 +0300 +Subject: sparc64: fix incorrect sign extension in sys_sparc64_personality + +From: Dmitry V. Levin + +commit 525fd5a94e1be0776fa652df5c687697db508c91 upstream. + +The value returned by sys_personality has type "long int". +It is saved to a variable of type "int", which is not a problem +yet because the type of task_struct->pesonality is "unsigned int". +The problem is the sign extension from "int" to "long int" +that happens on return from sys_sparc64_personality. + +For example, a userspace call personality((unsigned) -EINVAL) will +result to any subsequent personality call, including absolutely +harmless read-only personality(0xffffffff) call, failing with +errno set to EINVAL. + +Signed-off-by: Dmitry V. Levin +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc/kernel/sys_sparc_64.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/sparc/kernel/sys_sparc_64.c ++++ b/arch/sparc/kernel/sys_sparc_64.c +@@ -413,7 +413,7 @@ out: + + SYSCALL_DEFINE1(sparc64_personality, unsigned long, personality) + { +- int ret; ++ long ret; + + if (personality(current->personality) == PER_LINUX32 && + personality(personality) == PER_LINUX) diff --git a/queue-4.4/time-avoid-signed-overflow-in-timekeeping_get_ns.patch b/queue-4.4/time-avoid-signed-overflow-in-timekeeping_get_ns.patch new file mode 100644 index 00000000000..dd333f9a803 --- /dev/null +++ b/queue-4.4/time-avoid-signed-overflow-in-timekeeping_get_ns.patch @@ -0,0 +1,60 @@ +From 35a4933a895927990772ae96fdcfd2f806929ee2 Mon Sep 17 00:00:00 2001 +From: David Gibson +Date: Mon, 30 Nov 2015 12:30:30 +1100 +Subject: time: Avoid signed overflow in timekeeping_get_ns() + +From: David Gibson + +commit 35a4933a895927990772ae96fdcfd2f806929ee2 upstream. + +1e75fa8 "time: Condense timekeeper.xtime into xtime_sec" replaced a call to +clocksource_cyc2ns() from timekeeping_get_ns() with an open-coded version +of the same logic to avoid keeping a semi-redundant struct timespec +in struct timekeeper. + +However, the commit also introduced a subtle semantic change - where +clocksource_cyc2ns() uses purely unsigned math, the new version introduces +a signed temporary, meaning that if (delta * tk->mult) has a 63-bit +overflow the following shift will still give a negative result. The +choice of 'maxsec' in __clocksource_updatefreq_scale() means this will +generally happen if there's a ~10 minute pause in examining the +clocksource. + +This can be triggered on a powerpc KVM guest by stopping it from qemu for +a bit over 10 minutes. After resuming time has jumped backwards several +minutes causing numerous problems (jiffies does not advance, msleep()s can +be extended by minutes..). It doesn't happen on x86 KVM guests, because +the guest TSC is effectively frozen while the guest is stopped, which is +not the case for the powerpc timebase. + +Obviously an unsigned (64 bit) overflow will only take twice as long as a +signed, 63-bit overflow. I don't know the time code well enough to know +if that will still cause incorrect calculations, or if a 64-bit overflow +is avoided elsewhere. + +Still, an incorrect forwards clock adjustment will cause less trouble than +time going backwards. So, this patch removes the potential for +intermediate signed overflow. + +Suggested-by: Laurent Vivier +Tested-by: Laurent Vivier +Signed-off-by: David Gibson +Signed-off-by: John Stultz +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/time/timekeeping.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -305,8 +305,7 @@ static inline s64 timekeeping_get_ns(str + + delta = timekeeping_get_delta(tkr); + +- nsec = delta * tkr->mult + tkr->xtime_nsec; +- nsec >>= tkr->shift; ++ nsec = (delta * tkr->mult + tkr->xtime_nsec) >> tkr->shift; + + /* If arch requires, add in get_arch_timeoffset() */ + return nsec + arch_gettimeoffset(); diff --git a/queue-4.4/tools-hv-vss-fix-the-write-s-argument-error-vss_msg.patch b/queue-4.4/tools-hv-vss-fix-the-write-s-argument-error-vss_msg.patch new file mode 100644 index 00000000000..e484e0bda51 --- /dev/null +++ b/queue-4.4/tools-hv-vss-fix-the-write-s-argument-error-vss_msg.patch @@ -0,0 +1,32 @@ +From a689d2510f188e75391dbebacbddfd74d42f2a7e Mon Sep 17 00:00:00 2001 +From: Dexuan Cui +Date: Mon, 14 Dec 2015 16:01:58 -0800 +Subject: tools: hv: vss: fix the write()'s argument: error -> vss_msg + +From: Dexuan Cui + +commit a689d2510f188e75391dbebacbddfd74d42f2a7e upstream. + +Fix the write()'s argument in the daemon code. + +Cc: Vitaly Kuznetsov +Cc: "K. Y. Srinivasan" +Signed-off-by: Dexuan Cui +Signed-off-by: K. Y. Srinivasan +Signed-off-by: Greg Kroah-Hartman + +--- + tools/hv/hv_vss_daemon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/hv/hv_vss_daemon.c ++++ b/tools/hv/hv_vss_daemon.c +@@ -254,7 +254,7 @@ int main(int argc, char *argv[]) + syslog(LOG_ERR, "Illegal op:%d\n", op); + } + vss_msg->error = error; +- len = write(vss_fd, &error, sizeof(struct hv_vss_msg)); ++ len = write(vss_fd, vss_msg, sizeof(struct hv_vss_msg)); + if (len != sizeof(struct hv_vss_msg)) { + syslog(LOG_ERR, "write failed; error: %d %s", errno, + strerror(errno));