From: Sasha Levin Date: Mon, 18 Nov 2019 16:54:01 +0000 (-0500) Subject: fixes for 4.9 X-Git-Tag: v5.3.12~21^2~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cb3f39f94e63a3dd7ef64fbd439aa79e4c0f05d3;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.9 Signed-off-by: Sasha Levin --- diff --git a/queue-4.9/alsa-intel8x0m-register-irq-handler-after-register-i.patch b/queue-4.9/alsa-intel8x0m-register-irq-handler-after-register-i.patch new file mode 100644 index 00000000000..e1cf1b97f3c --- /dev/null +++ b/queue-4.9/alsa-intel8x0m-register-irq-handler-after-register-i.patch @@ -0,0 +1,66 @@ +From 8be3022a5ae87e12645266e0143be64d9f470d3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Aug 2018 16:39:10 +0200 +Subject: ALSA: intel8x0m: Register irq handler after register initializations + +From: Takashi Iwai + +[ Upstream commit 7064f376d4a10686f51c879401a569bb4babf9c6 ] + +The interrupt handler has to be acquired after the other resource +initialization when allocated with IRQF_SHARED. Otherwise it's +triggered before the resource gets ready, and may lead to unpleasant +behavior. + +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/intel8x0m.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/sound/pci/intel8x0m.c b/sound/pci/intel8x0m.c +index 1bc98c867133d..2286dfd72ff7e 100644 +--- a/sound/pci/intel8x0m.c ++++ b/sound/pci/intel8x0m.c +@@ -1171,16 +1171,6 @@ static int snd_intel8x0m_create(struct snd_card *card, + } + + port_inited: +- if (request_irq(pci->irq, snd_intel8x0m_interrupt, IRQF_SHARED, +- KBUILD_MODNAME, chip)) { +- dev_err(card->dev, "unable to grab IRQ %d\n", pci->irq); +- snd_intel8x0m_free(chip); +- return -EBUSY; +- } +- chip->irq = pci->irq; +- pci_set_master(pci); +- synchronize_irq(chip->irq); +- + /* initialize offsets */ + chip->bdbars_count = 2; + tbl = intel_regs; +@@ -1224,11 +1214,21 @@ static int snd_intel8x0m_create(struct snd_card *card, + chip->int_sta_reg = ICH_REG_GLOB_STA; + chip->int_sta_mask = int_sta_masks; + ++ pci_set_master(pci); ++ + if ((err = snd_intel8x0m_chip_init(chip, 1)) < 0) { + snd_intel8x0m_free(chip); + return err; + } + ++ if (request_irq(pci->irq, snd_intel8x0m_interrupt, IRQF_SHARED, ++ KBUILD_MODNAME, chip)) { ++ dev_err(card->dev, "unable to grab IRQ %d\n", pci->irq); ++ snd_intel8x0m_free(chip); ++ return -EBUSY; ++ } ++ chip->irq = pci->irq; ++ + if ((err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops)) < 0) { + snd_intel8x0m_free(chip); + return err; +-- +2.20.1 + diff --git a/queue-4.9/alsa-pcm-signedness-bug-in-snd_pcm_plug_alloc.patch b/queue-4.9/alsa-pcm-signedness-bug-in-snd_pcm_plug_alloc.patch new file mode 100644 index 00000000000..a011489e708 --- /dev/null +++ b/queue-4.9/alsa-pcm-signedness-bug-in-snd_pcm_plug_alloc.patch @@ -0,0 +1,44 @@ +From c8c0e76fe4a4079b255efb0fe9632437a2ad602f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Aug 2018 12:21:45 +0300 +Subject: ALSA: pcm: signedness bug in snd_pcm_plug_alloc() + +From: Dan Carpenter + +[ Upstream commit 6f128fa41f310e1f39ebcea9621d2905549ecf52 ] + +The "frames" variable is unsigned so the error handling doesn't work +properly. + +Signed-off-by: Dan Carpenter +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/oss/pcm_plugin.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c +index a84a1d3d23e56..c6888d76ca5e9 100644 +--- a/sound/core/oss/pcm_plugin.c ++++ b/sound/core/oss/pcm_plugin.c +@@ -111,7 +111,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames) + while (plugin->next) { + if (plugin->dst_frames) + frames = plugin->dst_frames(plugin, frames); +- if (snd_BUG_ON(frames <= 0)) ++ if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0)) + return -ENXIO; + plugin = plugin->next; + err = snd_pcm_plugin_alloc(plugin, frames); +@@ -123,7 +123,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames) + while (plugin->prev) { + if (plugin->src_frames) + frames = plugin->src_frames(plugin, frames); +- if (snd_BUG_ON(frames <= 0)) ++ if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0)) + return -ENXIO; + plugin = plugin->prev; + err = snd_pcm_plugin_alloc(plugin, frames); +-- +2.20.1 + diff --git a/queue-4.9/alsa-seq-do-error-checks-at-creating-system-ports.patch b/queue-4.9/alsa-seq-do-error-checks-at-creating-system-ports.patch new file mode 100644 index 00000000000..c4f4895bbb9 --- /dev/null +++ b/queue-4.9/alsa-seq-do-error-checks-at-creating-system-ports.patch @@ -0,0 +1,72 @@ +From 7579047c03ea4e8caeff1190a555ad161da8d885 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Aug 2018 12:49:43 +0200 +Subject: ALSA: seq: Do error checks at creating system ports + +From: Takashi Iwai + +[ Upstream commit b8e131542b47b81236ecf6768c923128e1f5db6e ] + +snd_seq_system_client_init() doesn't check the errors returned from +its port creations. Let's do it properly and handle the error paths. + +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/seq/seq_system.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +diff --git a/sound/core/seq/seq_system.c b/sound/core/seq/seq_system.c +index 8ce1d0b40dce1..ce1f1e4727ab1 100644 +--- a/sound/core/seq/seq_system.c ++++ b/sound/core/seq/seq_system.c +@@ -123,6 +123,7 @@ int __init snd_seq_system_client_init(void) + { + struct snd_seq_port_callback pcallbacks; + struct snd_seq_port_info *port; ++ int err; + + port = kzalloc(sizeof(*port), GFP_KERNEL); + if (!port) +@@ -144,7 +145,10 @@ int __init snd_seq_system_client_init(void) + port->flags = SNDRV_SEQ_PORT_FLG_GIVEN_PORT; + port->addr.client = sysclient; + port->addr.port = SNDRV_SEQ_PORT_SYSTEM_TIMER; +- snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT, port); ++ err = snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT, ++ port); ++ if (err < 0) ++ goto error_port; + + /* register announcement port */ + strcpy(port->name, "Announce"); +@@ -154,16 +158,24 @@ int __init snd_seq_system_client_init(void) + port->flags = SNDRV_SEQ_PORT_FLG_GIVEN_PORT; + port->addr.client = sysclient; + port->addr.port = SNDRV_SEQ_PORT_SYSTEM_ANNOUNCE; +- snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT, port); ++ err = snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT, ++ port); ++ if (err < 0) ++ goto error_port; + announce_port = port->addr.port; + + kfree(port); + return 0; ++ ++ error_port: ++ snd_seq_system_client_done(); ++ kfree(port); ++ return err; + } + + + /* unregister our internal client */ +-void __exit snd_seq_system_client_done(void) ++void snd_seq_system_client_done(void) + { + int oldsysclient = sysclient; + +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-am335x-evm-fix-number-of-cpsw.patch b/queue-4.9/arm-dts-am335x-evm-fix-number-of-cpsw.patch new file mode 100644 index 00000000000..249b74e6638 --- /dev/null +++ b/queue-4.9/arm-dts-am335x-evm-fix-number-of-cpsw.patch @@ -0,0 +1,59 @@ +From 0625741e91818d8e54778929316dfd420a77d98a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Sep 2018 17:33:40 -0500 +Subject: ARM: dts: am335x-evm: fix number of cpsw + +From: Grygorii Strashko + +[ Upstream commit dcbf6b18d81bcdc51390ca1b258c17e2e13b7d0c ] + +am335x-evm has only one CPSW external port physically wired, but DT defines +2 ext. ports. As result, PHY connection failure reported for the second +ext. port. + +Update DT to reflect am335x-evm board HW configuration, and, while here, +switch to use phy-handle instead of phy_id. + +Signed-off-by: Grygorii Strashko +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am335x-evm.dts | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts +index e82432c79f85f..3f3ad09c7cd5f 100644 +--- a/arch/arm/boot/dts/am335x-evm.dts ++++ b/arch/arm/boot/dts/am335x-evm.dts +@@ -701,6 +701,7 @@ + pinctrl-0 = <&cpsw_default>; + pinctrl-1 = <&cpsw_sleep>; + status = "okay"; ++ slaves = <1>; + }; + + &davinci_mdio { +@@ -708,15 +709,14 @@ + pinctrl-0 = <&davinci_mdio_default>; + pinctrl-1 = <&davinci_mdio_sleep>; + status = "okay"; +-}; + +-&cpsw_emac0 { +- phy_id = <&davinci_mdio>, <0>; +- phy-mode = "rgmii-txid"; ++ ethphy0: ethernet-phy@0 { ++ reg = <0>; ++ }; + }; + +-&cpsw_emac1 { +- phy_id = <&davinci_mdio>, <1>; ++&cpsw_emac0 { ++ phy-handle = <ðphy0>; + phy-mode = "rgmii-txid"; + }; + +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-at91-trivial-fix-usart1-definition-for-at91s.patch b/queue-4.9/arm-dts-at91-trivial-fix-usart1-definition-for-at91s.patch new file mode 100644 index 00000000000..fa7166d7fa4 --- /dev/null +++ b/queue-4.9/arm-dts-at91-trivial-fix-usart1-definition-for-at91s.patch @@ -0,0 +1,35 @@ +From e04b8945cfc11a22fef25f0b5ed6fc59be1528e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Aug 2018 11:42:01 +0200 +Subject: ARM: dts: at91/trivial: Fix USART1 definition for at91sam9g45 + +From: Jay Foster + +[ Upstream commit 10af10db8c76fa5b9bf1f52a895c1cb2c0ac24da ] + +Fix a typo. No functional change made by this patch. + +Signed-off-by: Jay Foster +Signed-off-by: Nicolas Ferre +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91sam9g45.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi +index b3501ae2a3bd1..4fba898b8f4f9 100644 +--- a/arch/arm/boot/dts/at91sam9g45.dtsi ++++ b/arch/arm/boot/dts/at91sam9g45.dtsi +@@ -546,7 +546,7 @@ + }; + }; + +- uart1 { ++ usart1 { + pinctrl_usart1: usart1-0 { + atmel,pins = + +Date: Thu, 6 Sep 2018 17:41:35 +0200 +Subject: ARM: dts: exynos: Disable pull control for S5M8767 PMIC + +From: Marek Szyprowski + +[ Upstream commit ef2ecab9af5feae97c47b7f61cdd96f7f49b2c23 ] + +S5M8767 PMIC interrupt line on Exynos5250-based Arndale board has +external pull-up resistors, so disable any pull control for it in +in controller node. This fixes support for S5M8767 interrupts and +enables operation of wakeup from S5M8767 RTC alarm. + +Signed-off-by: Marek Szyprowski +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5250-arndale.dts | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/arch/arm/boot/dts/exynos5250-arndale.dts b/arch/arm/boot/dts/exynos5250-arndale.dts +index 6098dacd09f11..1b2709af2a42b 100644 +--- a/arch/arm/boot/dts/exynos5250-arndale.dts ++++ b/arch/arm/boot/dts/exynos5250-arndale.dts +@@ -170,6 +170,8 @@ + reg = <0x66>; + interrupt-parent = <&gpx3>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&s5m8767_irq>; + + vinb1-supply = <&main_dc_reg>; + vinb2-supply = <&main_dc_reg>; +@@ -547,6 +549,13 @@ + cap-sd-highspeed; + }; + ++&pinctrl_0 { ++ s5m8767_irq: s5m8767-irq { ++ samsung,pins = "gpx3-2"; ++ samsung,pin-pud = ; ++ }; ++}; ++ + &rtc { + status = "okay"; + }; +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-exynos-fix-regulators-configuration-on-peach.patch b/queue-4.9/arm-dts-exynos-fix-regulators-configuration-on-peach.patch new file mode 100644 index 00000000000..f6042d06bd0 --- /dev/null +++ b/queue-4.9/arm-dts-exynos-fix-regulators-configuration-on-peach.patch @@ -0,0 +1,87 @@ +From 6559141b7636889b4959f99f6db4c07d09954e49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Aug 2018 10:04:25 +0200 +Subject: ARM: dts: exynos: Fix regulators configuration on Peach Pi/Pit + Chromebooks + +From: Marek Szyprowski + +[ Upstream commit f8f3b7fc21b1cb59385b780acd9b9a26d04cb7b2 ] + +Regulators, which are marked as 'on-in-suspend' seems to be critical for +board operation, thus they must not be disabled anytime. This can be +only assured by marking them as 'always-on', because otherwise some +actions of their clients might result in turning them off. This patch +restores suspend/resume operation on Peach-Pit Chromebook board. It +partially reverts 'always-on' property removal done by the commit +mentioned in the Fixes tag. + +Fixes: 665c441eea3d ("ARM: dts: exynos: Remove unneded always-on for regulators on Peach boards") +Signed-off-by: Marek Szyprowski +Tested-by: Tomasz Figa +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5420-peach-pit.dts | 3 +++ + arch/arm/boot/dts/exynos5800-peach-pi.dts | 3 +++ + 2 files changed, 6 insertions(+) + +diff --git a/arch/arm/boot/dts/exynos5420-peach-pit.dts b/arch/arm/boot/dts/exynos5420-peach-pit.dts +index 8b754ae8c8f7d..c9d379b1a1669 100644 +--- a/arch/arm/boot/dts/exynos5420-peach-pit.dts ++++ b/arch/arm/boot/dts/exynos5420-peach-pit.dts +@@ -302,6 +302,7 @@ + regulator-name = "vdd_1v35"; + regulator-min-microvolt = <1350000>; + regulator-max-microvolt = <1350000>; ++ regulator-always-on; + regulator-boot-on; + regulator-state-mem { + regulator-on-in-suspend; +@@ -323,6 +324,7 @@ + regulator-name = "vdd_2v"; + regulator-min-microvolt = <2000000>; + regulator-max-microvolt = <2000000>; ++ regulator-always-on; + regulator-boot-on; + regulator-state-mem { + regulator-on-in-suspend; +@@ -333,6 +335,7 @@ + regulator-name = "vdd_1v8"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; ++ regulator-always-on; + regulator-boot-on; + regulator-state-mem { + regulator-on-in-suspend; +diff --git a/arch/arm/boot/dts/exynos5800-peach-pi.dts b/arch/arm/boot/dts/exynos5800-peach-pi.dts +index 1f90df2d7ecd8..ae58b8d6f6144 100644 +--- a/arch/arm/boot/dts/exynos5800-peach-pi.dts ++++ b/arch/arm/boot/dts/exynos5800-peach-pi.dts +@@ -302,6 +302,7 @@ + regulator-name = "vdd_1v35"; + regulator-min-microvolt = <1350000>; + regulator-max-microvolt = <1350000>; ++ regulator-always-on; + regulator-boot-on; + regulator-state-mem { + regulator-on-in-suspend; +@@ -323,6 +324,7 @@ + regulator-name = "vdd_2v"; + regulator-min-microvolt = <2000000>; + regulator-max-microvolt = <2000000>; ++ regulator-always-on; + regulator-boot-on; + regulator-state-mem { + regulator-on-in-suspend; +@@ -333,6 +335,7 @@ + regulator-name = "vdd_1v8"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; ++ regulator-always-on; + regulator-boot-on; + regulator-state-mem { + regulator-on-in-suspend; +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-exynos-fix-sound-in-snow-rev5-chromebook.patch b/queue-4.9/arm-dts-exynos-fix-sound-in-snow-rev5-chromebook.patch new file mode 100644 index 00000000000..8f0c831e678 --- /dev/null +++ b/queue-4.9/arm-dts-exynos-fix-sound-in-snow-rev5-chromebook.patch @@ -0,0 +1,57 @@ +From 1339a70db967a1dfdd187bba6999915ef0f425cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Aug 2018 12:55:32 +0200 +Subject: ARM: dts: exynos: Fix sound in Snow-rev5 Chromebook + +From: Marek Szyprowski + +[ Upstream commit 64858773d78e820003a94e5a7179d368213655d6 ] + +This patch adds missing properties to the CODEC and sound nodes, so the +audio will work also on Snow rev5 Chromebook. This patch is an extension +to the commit e9eefc3f8ce0 ("ARM: dts: exynos: Add missing clock and +DAI properties to the max98095 node in Snow Chromebook") +and commit 6ab569936d60 ("ARM: dts: exynos: Enable HDMI audio on Snow +Chromebook"). It has been reported that such changes work fine on the +rev5 board too. + +Signed-off-by: Marek Szyprowski +[krzk: Fixed typo in phandle to &max98090] +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5250-snow-rev5.dts | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/arch/arm/boot/dts/exynos5250-snow-rev5.dts b/arch/arm/boot/dts/exynos5250-snow-rev5.dts +index 90560c316f644..cb986175b69b4 100644 +--- a/arch/arm/boot/dts/exynos5250-snow-rev5.dts ++++ b/arch/arm/boot/dts/exynos5250-snow-rev5.dts +@@ -23,6 +23,14 @@ + + samsung,model = "Snow-I2S-MAX98090"; + samsung,audio-codec = <&max98090>; ++ ++ cpu { ++ sound-dai = <&i2s0 0>; ++ }; ++ ++ codec { ++ sound-dai = <&max98090 0>, <&hdmi>; ++ }; + }; + }; + +@@ -34,6 +42,9 @@ + interrupt-parent = <&gpx0>; + pinctrl-names = "default"; + pinctrl-0 = <&max98090_irq>; ++ clocks = <&pmu_system_controller 0>; ++ clock-names = "mclk"; ++ #sound-dai-cells = <1>; + }; + }; + +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-lpc32xx-fix-spi-controller-node-names.patch b/queue-4.9/arm-dts-lpc32xx-fix-spi-controller-node-names.patch new file mode 100644 index 00000000000..7d21a005c18 --- /dev/null +++ b/queue-4.9/arm-dts-lpc32xx-fix-spi-controller-node-names.patch @@ -0,0 +1,46 @@ +From 888d337ec6eb376b61a61888561ca2a57d068490 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Sep 2018 13:12:33 -0500 +Subject: ARM: dts: lpc32xx: Fix SPI controller node names + +From: Rob Herring + +[ Upstream commit 11236ef582b8d66290bb3b3710e03ca1d85d8ad8 ] + +SPI controller nodes should be named 'spi' rather than 'ssp'. Fixing the +name enables dtc SPI bus checks. + +Cc: Vladimir Zapolskiy +Cc: Sylvain Lemieux +Signed-off-by: Rob Herring +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/lpc32xx.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi +index 0d20aadc78bb1..5fa3111731cb0 100644 +--- a/arch/arm/boot/dts/lpc32xx.dtsi ++++ b/arch/arm/boot/dts/lpc32xx.dtsi +@@ -179,7 +179,7 @@ + * ssp0 and spi1 are shared pins; + * enable one in your board dts, as needed. + */ +- ssp0: ssp@20084000 { ++ ssp0: spi@20084000 { + compatible = "arm,pl022", "arm,primecell"; + reg = <0x20084000 0x1000>; + interrupts = <20 IRQ_TYPE_LEVEL_HIGH>; +@@ -199,7 +199,7 @@ + * ssp1 and spi2 are shared pins; + * enable one in your board dts, as needed. + */ +- ssp1: ssp@2008c000 { ++ ssp1: spi@2008c000 { + compatible = "arm,pl022", "arm,primecell"; + reg = <0x2008c000 0x1000>; + interrupts = <21 IRQ_TYPE_LEVEL_HIGH>; +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-marvell-fix-spi-and-i2c-bus-warnings.patch b/queue-4.9/arm-dts-marvell-fix-spi-and-i2c-bus-warnings.patch new file mode 100644 index 00000000000..63f59e5e6d9 --- /dev/null +++ b/queue-4.9/arm-dts-marvell-fix-spi-and-i2c-bus-warnings.patch @@ -0,0 +1,97 @@ +From 57039f8d09b77f9dd9c79667ee9b5180d15c3513 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Sep 2018 13:12:31 -0500 +Subject: ARM: dts: marvell: Fix SPI and I2C bus warnings + +From: Rob Herring + +[ Upstream commit cf680cc5251487b9a39919c3cda31a108af19cf8 ] + +dtc has new checks for I2C and SPI buses. Fix the warnings in node names +and unit-addresses. + +arch/arm/boot/dts/dove-cubox.dtb: Warning (i2c_bus_reg): /i2c-mux/i2c@0/clock-generator: I2C bus unit address format error, expected "60" +arch/arm/boot/dts/dove-cubox-es.dtb: Warning (i2c_bus_reg): /i2c-mux/i2c@0/clock-generator: I2C bus unit address format error, expected "60" +arch/arm/boot/dts/dove-cubox.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@10600: node name for SPI buses should be 'spi' +arch/arm/boot/dts/dove-cubox-es.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@10600: node name for SPI buses should be 'spi' +arch/arm/boot/dts/dove-dove-db.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@10600: node name for SPI buses should be 'spi' +arch/arm/boot/dts/dove-sbc-a510.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@10600: node name for SPI buses should be 'spi' +arch/arm/boot/dts/dove-sbc-a510.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@14600: node name for SPI buses should be 'spi' +arch/arm/boot/dts/orion5x-kuroboxpro.dtb: Warning (i2c_bus_reg): /soc/internal-regs/i2c@11000/rtc: I2C bus unit address format error, expected "32" +arch/arm/boot/dts/orion5x-linkstation-lschl.dtb: Warning (i2c_bus_reg): /soc/internal-regs/i2c@11000/rtc: I2C bus unit address format error, expected "32" +arch/arm/boot/dts/orion5x-linkstation-lsgl.dtb: Warning (i2c_bus_reg): /soc/internal-regs/i2c@11000/rtc: I2C bus unit address format error, expected "32" +arch/arm/boot/dts/orion5x-linkstation-lswtgl.dtb: Warning (i2c_bus_reg): /soc/internal-regs/i2c@11000/rtc: I2C bus unit address format error, expected "32" + +Cc: Jason Cooper +Cc: Andrew Lunn +Cc: Sebastian Hesselbarth +Cc: Gregory Clement +Signed-off-by: Rob Herring +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/dove-cubox.dts | 2 +- + arch/arm/boot/dts/dove.dtsi | 6 +++--- + arch/arm/boot/dts/orion5x-linkstation.dtsi | 2 +- + 3 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/dove-cubox.dts b/arch/arm/boot/dts/dove-cubox.dts +index af3cb633135fc..ee32315e3d3af 100644 +--- a/arch/arm/boot/dts/dove-cubox.dts ++++ b/arch/arm/boot/dts/dove-cubox.dts +@@ -86,7 +86,7 @@ + status = "okay"; + clock-frequency = <100000>; + +- si5351: clock-generator { ++ si5351: clock-generator@60 { + compatible = "silabs,si5351a-msop"; + reg = <0x60>; + #address-cells = <1>; +diff --git a/arch/arm/boot/dts/dove.dtsi b/arch/arm/boot/dts/dove.dtsi +index 698d58cea20d2..11342aeccb73a 100644 +--- a/arch/arm/boot/dts/dove.dtsi ++++ b/arch/arm/boot/dts/dove.dtsi +@@ -152,7 +152,7 @@ + 0xffffe000 MBUS_ID(0x03, 0x01) 0 0x0000800 /* CESA SRAM 2k */ + 0xfffff000 MBUS_ID(0x0d, 0x00) 0 0x0000800>; /* PMU SRAM 2k */ + +- spi0: spi-ctrl@10600 { ++ spi0: spi@10600 { + compatible = "marvell,orion-spi"; + #address-cells = <1>; + #size-cells = <0>; +@@ -165,7 +165,7 @@ + status = "disabled"; + }; + +- i2c: i2c-ctrl@11000 { ++ i2c: i2c@11000 { + compatible = "marvell,mv64xxx-i2c"; + reg = <0x11000 0x20>; + #address-cells = <1>; +@@ -215,7 +215,7 @@ + status = "disabled"; + }; + +- spi1: spi-ctrl@14600 { ++ spi1: spi@14600 { + compatible = "marvell,orion-spi"; + #address-cells = <1>; + #size-cells = <0>; +diff --git a/arch/arm/boot/dts/orion5x-linkstation.dtsi b/arch/arm/boot/dts/orion5x-linkstation.dtsi +index ed456ab35fd84..c1bc8376d4eb0 100644 +--- a/arch/arm/boot/dts/orion5x-linkstation.dtsi ++++ b/arch/arm/boot/dts/orion5x-linkstation.dtsi +@@ -156,7 +156,7 @@ + &i2c { + status = "okay"; + +- rtc { ++ rtc@32 { + compatible = "ricoh,rs5c372a"; + reg = <0x32>; + }; +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-omap3-gta04-fix-touchscreen-tsc2007.patch b/queue-4.9/arm-dts-omap3-gta04-fix-touchscreen-tsc2007.patch new file mode 100644 index 00000000000..aa11fe0e4ff --- /dev/null +++ b/queue-4.9/arm-dts-omap3-gta04-fix-touchscreen-tsc2007.patch @@ -0,0 +1,61 @@ +From 23d05dc563344f2723543baf5bad63638ef97713 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jul 2018 09:11:10 +0200 +Subject: ARM: dts: omap3-gta04: fix touchscreen tsc2007 + +From: H. Nikolaus Schaller + +[ Upstream commit 7384a24248eda140a234d356b6c840701ee9f055 ] + +we fix penirq polarity, add penirq pinmux and touchscreen +properties. + +Signed-off-by: H. Nikolaus Schaller +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap3-gta04.dtsi | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi +index e86f42086a29b..6e809b0ff5c9f 100644 +--- a/arch/arm/boot/dts/omap3-gta04.dtsi ++++ b/arch/arm/boot/dts/omap3-gta04.dtsi +@@ -274,6 +274,13 @@ + OMAP3_CORE1_IOPAD(0x2134, PIN_INPUT_PULLUP | MUX_MODE4) /* gpio112 */ + >; + }; ++ ++ penirq_pins: pinmux_penirq_pins { ++ pinctrl-single,pins = < ++ /* here we could enable to wakeup the cpu from suspend by a pen touch */ ++ OMAP3_CORE1_IOPAD(0x2194, PIN_INPUT_PULLUP | MUX_MODE4) /* gpio160 */ ++ >; ++ }; + }; + + &omap3_pmx_core2 { +@@ -411,10 +418,19 @@ + tsc2007@48 { + compatible = "ti,tsc2007"; + reg = <0x48>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&penirq_pins>; + interrupt-parent = <&gpio6>; + interrupts = <0 IRQ_TYPE_EDGE_FALLING>; /* GPIO_160 */ +- gpios = <&gpio6 0 GPIO_ACTIVE_LOW>; ++ gpios = <&gpio6 0 GPIO_ACTIVE_LOW>; /* GPIO_160 */ + ti,x-plate-ohms = <600>; ++ touchscreen-size-x = <480>; ++ touchscreen-size-y = <640>; ++ touchscreen-max-pressure = <1000>; ++ touchscreen-fuzz-x = <3>; ++ touchscreen-fuzz-y = <8>; ++ touchscreen-fuzz-pressure = <10>; ++ touchscreen-inverted-y; + }; + + /* RFID EEPROM */ +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-omap3-gta04-fixes-for-tvout-venc.patch b/queue-4.9/arm-dts-omap3-gta04-fixes-for-tvout-venc.patch new file mode 100644 index 00000000000..339615cf799 --- /dev/null +++ b/queue-4.9/arm-dts-omap3-gta04-fixes-for-tvout-venc.patch @@ -0,0 +1,62 @@ +From 07a194ca3e042f812fe03feee363053a324cbb8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jul 2018 09:11:07 +0200 +Subject: ARM: dts: omap3-gta04: fixes for tvout / venc + +From: H. Nikolaus Schaller + +[ Upstream commit f6591391373dbff2c0200e1055d4ff86191578d2 ] + +* fix connector compatibility (composite) +* add comment for gpio1 23 +* add proper #address-cells +* we use only one venc_out channel for composite + +Signed-off-by: H. Nikolaus Schaller +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap3-gta04.dtsi | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi +index 95c6ac44e307f..67b50dbe28189 100644 +--- a/arch/arm/boot/dts/omap3-gta04.dtsi ++++ b/arch/arm/boot/dts/omap3-gta04.dtsi +@@ -122,7 +122,7 @@ + }; + + tv0: connector { +- compatible = "svideo-connector"; ++ compatible = "composite-video-connector"; + label = "tv"; + + port { +@@ -134,7 +134,7 @@ + + tv_amp: opa362 { + compatible = "ti,opa362"; +- enable-gpios = <&gpio1 23 GPIO_ACTIVE_HIGH>; ++ enable-gpios = <&gpio1 23 GPIO_ACTIVE_HIGH>; /* GPIO_23 to enable video out amplifier */ + + ports { + #address-cells = <1>; +@@ -539,10 +539,14 @@ + + vdda-supply = <&vdac>; + ++ #address-cells = <1>; ++ #size-cells = <0>; ++ + port { ++ reg = <0>; + venc_out: endpoint { + remote-endpoint = <&opa_in>; +- ti,channels = <2>; ++ ti,channels = <1>; + ti,invert-polarity; + }; + }; +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-omap3-gta04-give-spi_lcd-node-a-label-so-tha.patch b/queue-4.9/arm-dts-omap3-gta04-give-spi_lcd-node-a-label-so-tha.patch new file mode 100644 index 00000000000..97494b8b3a3 --- /dev/null +++ b/queue-4.9/arm-dts-omap3-gta04-give-spi_lcd-node-a-label-so-tha.patch @@ -0,0 +1,36 @@ +From f5ff50a65092315d2671c4d2c9a34313d6d51148 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jul 2018 09:11:06 +0200 +Subject: ARM: dts: omap3-gta04: give spi_lcd node a label so that we can + overwrite in other DTS files + +From: H. Nikolaus Schaller + +[ Upstream commit fa0d7dc355c890725b6178dab0cc11b194203afa ] + +needed for device variants based on GTA04 board but with +different display panel (driver). + +Signed-off-by: H. Nikolaus Schaller +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap3-gta04.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi +index b3a8b1f24499a..95c6ac44e307f 100644 +--- a/arch/arm/boot/dts/omap3-gta04.dtsi ++++ b/arch/arm/boot/dts/omap3-gta04.dtsi +@@ -70,7 +70,7 @@ + #sound-dai-cells = <0>; + }; + +- spi_lcd { ++ spi_lcd: spi_lcd { + compatible = "spi-gpio"; + #address-cells = <0x1>; + #size-cells = <0x0>; +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-omap3-gta04-keep-vpll2-always-on.patch b/queue-4.9/arm-dts-omap3-gta04-keep-vpll2-always-on.patch new file mode 100644 index 00000000000..20a016571da --- /dev/null +++ b/queue-4.9/arm-dts-omap3-gta04-keep-vpll2-always-on.patch @@ -0,0 +1,39 @@ +From 48b795e7224a16bbb2f0bf5516d0b6ad2140350f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jul 2018 09:11:14 +0200 +Subject: ARM: dts: omap3-gta04: keep vpll2 always on + +From: H. Nikolaus Schaller + +[ Upstream commit 1ae00833e30c9b4af5cbfda65d75b1de12f74013 ] + +This is needed to make the display and venc work properly. +Compare to omap3-beagle.dts. + +Signed-off-by: H. Nikolaus Schaller +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap3-gta04.dtsi | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi +index 6b8e013e49bb9..7191506934494 100644 +--- a/arch/arm/boot/dts/omap3-gta04.dtsi ++++ b/arch/arm/boot/dts/omap3-gta04.dtsi +@@ -536,6 +536,12 @@ + regulator-max-microvolt = <3150000>; + }; + ++/* Needed to power the DPI pins */ ++ ++&vpll2 { ++ regulator-always-on; ++}; ++ + &dss { + pinctrl-names = "default"; + pinctrl-0 = < &dss_dpi_pins >; +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-omap3-gta04-make-nand-partitions-compatible-.patch b/queue-4.9/arm-dts-omap3-gta04-make-nand-partitions-compatible-.patch new file mode 100644 index 00000000000..4637809e4ae --- /dev/null +++ b/queue-4.9/arm-dts-omap3-gta04-make-nand-partitions-compatible-.patch @@ -0,0 +1,62 @@ +From 50254e80b7850564ac5c7d2ae443af31a9ae0ac4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jul 2018 09:11:12 +0200 +Subject: ARM: dts: omap3-gta04: make NAND partitions compatible with recent + U-Boot + +From: H. Nikolaus Schaller + +[ Upstream commit fa99c21ecb3cd4021a60d0e8bf880e78b5bd0729 ] + +Vendor defined U-Boot has changed the partition scheme a while ago: + +* kernel partition 6MB +* file system partition uses the remainder up to end of the NAND +* increased size of the environment partition (to get an OneNAND compatible base address) +* shrink the U-Boot partition + +Let's be compatible (e.g. Debian kernel built from upstream). + +Signed-off-by: H. Nikolaus Schaller +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap3-gta04.dtsi | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi +index 6e809b0ff5c9f..6b8e013e49bb9 100644 +--- a/arch/arm/boot/dts/omap3-gta04.dtsi ++++ b/arch/arm/boot/dts/omap3-gta04.dtsi +@@ -607,22 +607,22 @@ + + bootloaders@80000 { + label = "U-Boot"; +- reg = <0x80000 0x1e0000>; ++ reg = <0x80000 0x1c0000>; + }; + +- bootloaders_env@260000 { ++ bootloaders_env@240000 { + label = "U-Boot Env"; +- reg = <0x260000 0x20000>; ++ reg = <0x240000 0x40000>; + }; + + kernel@280000 { + label = "Kernel"; +- reg = <0x280000 0x400000>; ++ reg = <0x280000 0x600000>; + }; + +- filesystem@680000 { ++ filesystem@880000 { + label = "File System"; +- reg = <0x680000 0xf980000>; ++ reg = <0x880000 0>; /* 0 = MTDPART_SIZ_FULL */ + }; + }; + }; +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-omap3-gta04-tvout-enable-as-display1-alias.patch b/queue-4.9/arm-dts-omap3-gta04-tvout-enable-as-display1-alias.patch new file mode 100644 index 00000000000..ac0fc726304 --- /dev/null +++ b/queue-4.9/arm-dts-omap3-gta04-tvout-enable-as-display1-alias.patch @@ -0,0 +1,35 @@ +From 4c810614b7e2c3cd8b2c1c10374fcdedb8020864 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jul 2018 09:11:09 +0200 +Subject: ARM: dts: omap3-gta04: tvout: enable as display1 alias + +From: H. Nikolaus Schaller + +[ Upstream commit 8905592b6e50cec905e6c6035bbd36201a3bfac1 ] + +The omap dss susbystem takes the display aliases to find +out which displays exist. To enable tv-out we must define +an alias. + +Signed-off-by: H. Nikolaus Schaller +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap3-gta04.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi +index 67b50dbe28189..e86f42086a29b 100644 +--- a/arch/arm/boot/dts/omap3-gta04.dtsi ++++ b/arch/arm/boot/dts/omap3-gta04.dtsi +@@ -28,6 +28,7 @@ + + aliases { + display0 = &lcd; ++ display1 = &tv0; + }; + + gpio-keys { +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-paz00-fix-wakeup-gpio-keycode.patch b/queue-4.9/arm-dts-paz00-fix-wakeup-gpio-keycode.patch new file mode 100644 index 00000000000..b467f4d459c --- /dev/null +++ b/queue-4.9/arm-dts-paz00-fix-wakeup-gpio-keycode.patch @@ -0,0 +1,42 @@ +From 3afd5837462b81c737ad327e8de8ee359896638d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Aug 2018 10:45:40 +0200 +Subject: ARM: dts: paz00: fix wakeup gpio keycode + +From: Marc Dietrich + +[ Upstream commit ebea2a43fdafdbce918bd7e200b709d6c33b9f3b ] + +The power key is controlled solely by the EC, which only tiggeres this +gpio after wakeup. +Fixes immediately return to suspend after wake from LP1. + +Signed-off-by: Marc Dietrich +Tested-by: Nicolas Chauvet +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/tegra20-paz00.dts | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/tegra20-paz00.dts b/arch/arm/boot/dts/tegra20-paz00.dts +index b4bfa5586c233..23d4c837b87a6 100644 +--- a/arch/arm/boot/dts/tegra20-paz00.dts ++++ b/arch/arm/boot/dts/tegra20-paz00.dts +@@ -521,10 +521,10 @@ + gpio-keys { + compatible = "gpio-keys"; + +- power { +- label = "Power"; ++ wakeup { ++ label = "Wakeup"; + gpios = <&gpio TEGRA_GPIO(J, 7) GPIO_ACTIVE_LOW>; +- linux,code = ; ++ linux,code = ; + wakeup-source; + }; + }; +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-pxa-fix-power-i2c-base-address.patch b/queue-4.9/arm-dts-pxa-fix-power-i2c-base-address.patch new file mode 100644 index 00000000000..f8e0f0d87f7 --- /dev/null +++ b/queue-4.9/arm-dts-pxa-fix-power-i2c-base-address.patch @@ -0,0 +1,34 @@ +From 49f3a87162fe27e79be0375d587c42b0f7203754 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Aug 2018 14:03:09 +0200 +Subject: ARM: dts: pxa: fix power i2c base address + +From: Marcel Ziswiler + +[ Upstream commit 8a1ecc01a473b75ab97be9b36f623e4551a6e9ae ] + +There is one too many zeroes in the Power I2C base address. Fix this. + +Signed-off-by: Marcel Ziswiler +Signed-off-by: Robert Jarzmik +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/pxa27x.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi +index 9e73dc6b3ed3e..0e1320afa1562 100644 +--- a/arch/arm/boot/dts/pxa27x.dtsi ++++ b/arch/arm/boot/dts/pxa27x.dtsi +@@ -70,7 +70,7 @@ + clocks = <&clks CLK_PWM1>; + }; + +- pwri2c: i2c@40f000180 { ++ pwri2c: i2c@40f00180 { + compatible = "mrvl,pxa-i2c"; + reg = <0x40f00180 0x24>; + interrupts = <6>; +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-qcom-ipq4019-fix-cpu0-s-qcom-saw2-reg-value.patch b/queue-4.9/arm-dts-qcom-ipq4019-fix-cpu0-s-qcom-saw2-reg-value.patch new file mode 100644 index 00000000000..223c444380d --- /dev/null +++ b/queue-4.9/arm-dts-qcom-ipq4019-fix-cpu0-s-qcom-saw2-reg-value.patch @@ -0,0 +1,44 @@ +From ae08fe4594dec0319c7e5b29082f73d2af9102b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jul 2018 10:37:47 +0200 +Subject: ARM: dts: qcom: ipq4019: fix cpu0's qcom,saw2 reg value + +From: Christian Lamparter + +[ Upstream commit bd73a3dd257fb838bd456a18eeee0ef0224b7a40 ] + +while compiling an ipq4019 target, dtc will complain: +regulator@b089000 unit address format error, expected "2089000" + +The saw0 regulator reg value seems to be +copied and pasted from qcom-ipq8064.dtsi. + +This patch fixes the reg value to match that of the +unit address which in turn silences the warning. +(There is no driver for qcom,saw2 right now. +So this went unnoticed) + +Signed-off-by: Christian Lamparter +Signed-off-by: John Crispin +Signed-off-by: Andy Gross +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-ipq4019.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi +index 4b7d97275c621..5ee84e3cb3e97 100644 +--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi ++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi +@@ -211,7 +211,7 @@ + + saw0: regulator@b089000 { + compatible = "qcom,saw2"; +- reg = <0x02089000 0x1000>, <0x0b009000 0x1000>; ++ reg = <0x0b089000 0x1000>, <0x0b009000 0x1000>; + regulator; + }; + +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-realview-fix-spi-controller-node-names.patch b/queue-4.9/arm-dts-realview-fix-spi-controller-node-names.patch new file mode 100644 index 00000000000..59d0fe176de --- /dev/null +++ b/queue-4.9/arm-dts-realview-fix-spi-controller-node-names.patch @@ -0,0 +1,92 @@ +From 83cf9b28fb00675da3df23d7a13f8117447e36f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Sep 2018 13:12:26 -0500 +Subject: ARM: dts: realview: Fix SPI controller node names + +From: Rob Herring + +[ Upstream commit 016add12977bcc30f77d7e48fc9a3a024cb46645 ] + +SPI controller nodes should be named 'spi' rather than 'ssp'. Fixing the +name enables dtc SPI bus checks. + +Cc: Linus Walleij +Signed-off-by: Rob Herring +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/arm-realview-eb.dtsi | 2 +- + arch/arm/boot/dts/arm-realview-pb1176.dts | 2 +- + arch/arm/boot/dts/arm-realview-pb11mp.dts | 2 +- + arch/arm/boot/dts/arm-realview-pbx.dtsi | 2 +- + arch/arm/boot/dts/versatile-ab.dts | 2 +- + 5 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/arm-realview-eb.dtsi b/arch/arm/boot/dts/arm-realview-eb.dtsi +index e2e9599596e25..05379b6c1c13b 100644 +--- a/arch/arm/boot/dts/arm-realview-eb.dtsi ++++ b/arch/arm/boot/dts/arm-realview-eb.dtsi +@@ -334,7 +334,7 @@ + clock-names = "uartclk", "apb_pclk"; + }; + +- ssp: ssp@1000d000 { ++ ssp: spi@1000d000 { + compatible = "arm,pl022", "arm,primecell"; + reg = <0x1000d000 0x1000>; + clocks = <&sspclk>, <&pclk>; +diff --git a/arch/arm/boot/dts/arm-realview-pb1176.dts b/arch/arm/boot/dts/arm-realview-pb1176.dts +index c789564f28033..c1fd5615ddfe3 100644 +--- a/arch/arm/boot/dts/arm-realview-pb1176.dts ++++ b/arch/arm/boot/dts/arm-realview-pb1176.dts +@@ -343,7 +343,7 @@ + clock-names = "apb_pclk"; + }; + +- pb1176_ssp: ssp@1010b000 { ++ pb1176_ssp: spi@1010b000 { + compatible = "arm,pl022", "arm,primecell"; + reg = <0x1010b000 0x1000>; + interrupt-parent = <&intc_dc1176>; +diff --git a/arch/arm/boot/dts/arm-realview-pb11mp.dts b/arch/arm/boot/dts/arm-realview-pb11mp.dts +index 3944765ac4b06..e306f1cceb4ec 100644 +--- a/arch/arm/boot/dts/arm-realview-pb11mp.dts ++++ b/arch/arm/boot/dts/arm-realview-pb11mp.dts +@@ -480,7 +480,7 @@ + clock-names = "uartclk", "apb_pclk"; + }; + +- ssp@1000d000 { ++ spi@1000d000 { + compatible = "arm,pl022", "arm,primecell"; + reg = <0x1000d000 0x1000>; + interrupt-parent = <&intc_pb11mp>; +diff --git a/arch/arm/boot/dts/arm-realview-pbx.dtsi b/arch/arm/boot/dts/arm-realview-pbx.dtsi +index aeb49c4bd773f..2bf3958b2e6b9 100644 +--- a/arch/arm/boot/dts/arm-realview-pbx.dtsi ++++ b/arch/arm/boot/dts/arm-realview-pbx.dtsi +@@ -318,7 +318,7 @@ + clock-names = "uartclk", "apb_pclk"; + }; + +- ssp: ssp@1000d000 { ++ ssp: spi@1000d000 { + compatible = "arm,pl022", "arm,primecell"; + reg = <0x1000d000 0x1000>; + clocks = <&sspclk>, <&pclk>; +diff --git a/arch/arm/boot/dts/versatile-ab.dts b/arch/arm/boot/dts/versatile-ab.dts +index 409e069b3a845..00d7d28e86f0b 100644 +--- a/arch/arm/boot/dts/versatile-ab.dts ++++ b/arch/arm/boot/dts/versatile-ab.dts +@@ -303,7 +303,7 @@ + clock-names = "apb_pclk"; + }; + +- ssp@101f4000 { ++ spi@101f4000 { + compatible = "arm,pl022", "arm,primecell"; + reg = <0x101f4000 0x1000>; + interrupts = <11>; +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-rockchip-fix-erroneous-spi-bus-dtc-warnings-.patch b/queue-4.9/arm-dts-rockchip-fix-erroneous-spi-bus-dtc-warnings-.patch new file mode 100644 index 00000000000..e21c1ee4031 --- /dev/null +++ b/queue-4.9/arm-dts-rockchip-fix-erroneous-spi-bus-dtc-warnings-.patch @@ -0,0 +1,43 @@ +From 46329b28a80bc3074a66343f87f8240138ade710 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Sep 2018 13:12:36 -0500 +Subject: ARM: dts: rockchip: Fix erroneous SPI bus dtc warnings on rk3036 + +From: Rob Herring + +[ Upstream commit 131c3eb428ccd5f0c784b9edb4f72ec296a045d2 ] + +dtc has new checks for SPI buses. The rk3036 dts file has a node named +spi' which causes false positive warnings. As the node is a pinctrl child +node, change the node name to be 'spi-pins' to fix the warnings. + +arch/arm/boot/dts/rk3036-evb.dtb: Warning (spi_bus_bridge): /pinctrl/spi: incorrect #address-cells for SPI bus +arch/arm/boot/dts/rk3036-kylin.dtb: Warning (spi_bus_bridge): /pinctrl/spi: incorrect #address-cells for SPI bus +arch/arm/boot/dts/rk3036-evb.dtb: Warning (spi_bus_bridge): /pinctrl/spi: incorrect #size-cells for SPI bus +arch/arm/boot/dts/rk3036-kylin.dtb: Warning (spi_bus_bridge): /pinctrl/spi: incorrect #size-cells for SPI bus + +Cc: Heiko Stuebner +Cc: linux-rockchip@lists.infradead.org +Signed-off-by: Rob Herring +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rk3036.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/rk3036.dtsi b/arch/arm/boot/dts/rk3036.dtsi +index a935523a1eb85..147c73f68f1d9 100644 +--- a/arch/arm/boot/dts/rk3036.dtsi ++++ b/arch/arm/boot/dts/rk3036.dtsi +@@ -744,7 +744,7 @@ + /* no rts / cts for uart2 */ + }; + +- spi { ++ spi-pins { + spi_txd:spi-txd { + rockchip,pins = <1 29 RK_FUNC_3 &pcfg_pull_default>; + }; +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-socfpga-fix-i2c-bus-unit-address-error.patch b/queue-4.9/arm-dts-socfpga-fix-i2c-bus-unit-address-error.patch new file mode 100644 index 00000000000..a78c91e0b80 --- /dev/null +++ b/queue-4.9/arm-dts-socfpga-fix-i2c-bus-unit-address-error.patch @@ -0,0 +1,36 @@ +From f9aab5c0aaaae6a807abb8455dcfb991985587b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Sep 2018 23:52:49 -0500 +Subject: ARM: dts: socfpga: Fix I2C bus unit-address error + +From: Dinh Nguyen + +[ Upstream commit cbbc488ed85061a765cf370c3e41f383c1e0add6 ] + +dtc has new checks for I2C buses. Fix the warnings in unit-addresses. + +arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dtb: Warning (i2c_bus_reg): /soc/i2c@ffc04000/adxl345@0: I2C bus unit address format error, expected "53" + +Signed-off-by: Rob Herring +Signed-off-by: Dinh Nguyen +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts b/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts +index afea3645ada43..89d55894d9162 100644 +--- a/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts ++++ b/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts +@@ -88,7 +88,7 @@ + status = "okay"; + speed-mode = <0>; + +- adxl345: adxl345@0 { ++ adxl345: adxl345@53 { + compatible = "adi,adxl345"; + reg = <0x53>; + +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-ste-fix-spi-controller-node-names.patch b/queue-4.9/arm-dts-ste-fix-spi-controller-node-names.patch new file mode 100644 index 00000000000..3ec3ab4d3f2 --- /dev/null +++ b/queue-4.9/arm-dts-ste-fix-spi-controller-node-names.patch @@ -0,0 +1,86 @@ +From e7c4e0dd3911a2ceefba6be52b78ae705df0c2c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Sep 2018 13:12:34 -0500 +Subject: ARM: dts: ste: Fix SPI controller node names + +From: Rob Herring + +[ Upstream commit 2f967f9e9fa076affb711da1a8389b5d33814fc6 ] + +SPI controller nodes should be named 'spi' rather than 'ssp'. Fixing the +name enables dtc SPI bus checks. + +Signed-off-by: Rob Herring +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ste-dbx5x0.dtsi | 4 ++-- + arch/arm/boot/dts/ste-hrefprev60.dtsi | 2 +- + arch/arm/boot/dts/ste-snowball.dts | 2 +- + arch/arm/boot/dts/ste-u300.dts | 2 +- + 4 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi +index 45869c3234358..5f1769209526a 100644 +--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi ++++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi +@@ -864,7 +864,7 @@ + power-domains = <&pm_domains DOMAIN_VAPE>; + }; + +- ssp@80002000 { ++ spi@80002000 { + compatible = "arm,pl022", "arm,primecell"; + reg = <0x80002000 0x1000>; + interrupts = ; +@@ -878,7 +878,7 @@ + power-domains = <&pm_domains DOMAIN_VAPE>; + }; + +- ssp@80003000 { ++ spi@80003000 { + compatible = "arm,pl022", "arm,primecell"; + reg = <0x80003000 0x1000>; + interrupts = ; +diff --git a/arch/arm/boot/dts/ste-hrefprev60.dtsi b/arch/arm/boot/dts/ste-hrefprev60.dtsi +index ece222d51717c..cf8d03bc42c15 100644 +--- a/arch/arm/boot/dts/ste-hrefprev60.dtsi ++++ b/arch/arm/boot/dts/ste-hrefprev60.dtsi +@@ -57,7 +57,7 @@ + }; + }; + +- ssp@80002000 { ++ spi@80002000 { + /* + * On the first generation boards, this SSP/SPI port was connected + * to the AB8500. +diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts +index 386eee6de2320..272d36c3d223b 100644 +--- a/arch/arm/boot/dts/ste-snowball.dts ++++ b/arch/arm/boot/dts/ste-snowball.dts +@@ -386,7 +386,7 @@ + pinctrl-1 = <&i2c3_sleep_mode>; + }; + +- ssp@80002000 { ++ spi@80002000 { + pinctrl-names = "default"; + pinctrl-0 = <&ssp0_snowball_mode>; + }; +diff --git a/arch/arm/boot/dts/ste-u300.dts b/arch/arm/boot/dts/ste-u300.dts +index 2f5107ffeef04..ea6768b96a9df 100644 +--- a/arch/arm/boot/dts/ste-u300.dts ++++ b/arch/arm/boot/dts/ste-u300.dts +@@ -441,7 +441,7 @@ + dma-names = "rx"; + }; + +- spi: ssp@c0006000 { ++ spi: spi@c0006000 { + compatible = "arm,pl022", "arm,primecell"; + reg = <0xc0006000 0x1000>; + interrupt-parent = <&vica>; +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-tegra30-fix-xcvr-setup-use-fuses.patch b/queue-4.9/arm-dts-tegra30-fix-xcvr-setup-use-fuses.patch new file mode 100644 index 00000000000..6c29cff9630 --- /dev/null +++ b/queue-4.9/arm-dts-tegra30-fix-xcvr-setup-use-fuses.patch @@ -0,0 +1,52 @@ +From 577b5466c771a045d93a5172d12edb5a18bf70e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Aug 2018 14:42:33 +0200 +Subject: ARM: dts: tegra30: fix xcvr-setup-use-fuses + +From: Marcel Ziswiler + +[ Upstream commit 564706f65cda3de52b09e51feb423a43940fe661 ] + +There was a dot instead of a comma. Fix this. + +Signed-off-by: Marcel Ziswiler +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/tegra30.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/tegra30.dtsi b/arch/arm/boot/dts/tegra30.dtsi +index 5030065cbdfe3..ad30d2a51af15 100644 +--- a/arch/arm/boot/dts/tegra30.dtsi ++++ b/arch/arm/boot/dts/tegra30.dtsi +@@ -823,7 +823,7 @@ + nvidia,elastic-limit = <16>; + nvidia,term-range-adj = <6>; + nvidia,xcvr-setup = <51>; +- nvidia.xcvr-setup-use-fuses; ++ nvidia,xcvr-setup-use-fuses; + nvidia,xcvr-lsfslew = <1>; + nvidia,xcvr-lsrslew = <1>; + nvidia,xcvr-hsslew = <32>; +@@ -860,7 +860,7 @@ + nvidia,elastic-limit = <16>; + nvidia,term-range-adj = <6>; + nvidia,xcvr-setup = <51>; +- nvidia.xcvr-setup-use-fuses; ++ nvidia,xcvr-setup-use-fuses; + nvidia,xcvr-lsfslew = <2>; + nvidia,xcvr-lsrslew = <2>; + nvidia,xcvr-hsslew = <32>; +@@ -896,7 +896,7 @@ + nvidia,elastic-limit = <16>; + nvidia,term-range-adj = <6>; + nvidia,xcvr-setup = <51>; +- nvidia.xcvr-setup-use-fuses; ++ nvidia,xcvr-setup-use-fuses; + nvidia,xcvr-lsfslew = <2>; + nvidia,xcvr-lsrslew = <2>; + nvidia,xcvr-hsslew = <32>; +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-ux500-correct-scu-unit-address.patch b/queue-4.9/arm-dts-ux500-correct-scu-unit-address.patch new file mode 100644 index 00000000000..999135a1bd0 --- /dev/null +++ b/queue-4.9/arm-dts-ux500-correct-scu-unit-address.patch @@ -0,0 +1,35 @@ +From 18ccf467df3e4ab9a722bdd2bd1fa901960fb5d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jun 2018 09:50:09 +0200 +Subject: ARM: dts: ux500: Correct SCU unit address + +From: Geert Uytterhoeven + +[ Upstream commit 2f217d24ecaec2012e628d21e244eef0608656a4 ] + +The unit address of the Cortex-A9 SCU device node contains one zero too +many. Remove it. + +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ste-dbx5x0.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi +index d309314f3a364..45869c3234358 100644 +--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi ++++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi +@@ -188,7 +188,7 @@ + <0xa0410100 0x100>; + }; + +- scu@a04100000 { ++ scu@a0410000 { + compatible = "arm,cortex-a9-scu"; + reg = <0xa0410000 0x100>; + }; +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-ux500-fix-lcda-clock-line-muxing.patch b/queue-4.9/arm-dts-ux500-fix-lcda-clock-line-muxing.patch new file mode 100644 index 00000000000..26599ad735c --- /dev/null +++ b/queue-4.9/arm-dts-ux500-fix-lcda-clock-line-muxing.patch @@ -0,0 +1,49 @@ +From 3d191d51991862a69f73d563bb37dd35c1430e2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Jul 2018 10:30:03 +0200 +Subject: ARM: dts: ux500: Fix LCDA clock line muxing + +From: Linus Walleij + +[ Upstream commit ecde29569e3484e1d0a032bf4074449bce4d4a03 ] + +The "lcdaclk_b_1" group is muxed with the function "lcd" +but needs a separate entry to be muxed in with "lcda" +rather than "lcd". + +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ste-href-family-pinctrl.dtsi | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi b/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi +index 5c5cea232743d..1ec193b0c5065 100644 +--- a/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi ++++ b/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi +@@ -607,16 +607,20 @@ + + mcde { + lcd_default_mode: lcd_default { +- default_mux { ++ default_mux1 { + /* Mux in VSI0 and all the data lines */ + function = "lcd"; + groups = + "lcdvsi0_a_1", /* VSI0 for LCD */ + "lcd_d0_d7_a_1", /* Data lines */ + "lcd_d8_d11_a_1", /* TV-out */ +- "lcdaclk_b_1", /* Clock line for TV-out */ + "lcdvsi1_a_1"; /* VSI1 for HDMI */ + }; ++ default_mux2 { ++ function = "lcda"; ++ groups = ++ "lcdaclk_b_1"; /* Clock line for TV-out */ ++ }; + default_cfg1 { + pins = + "GPIO68_E1", /* VSI0 */ +-- +2.20.1 + diff --git a/queue-4.9/arm-imx6-register-pm_power_off-handler-if-fsl-pmic-s.patch b/queue-4.9/arm-imx6-register-pm_power_off-handler-if-fsl-pmic-s.patch new file mode 100644 index 00000000000..b2525a18186 --- /dev/null +++ b/queue-4.9/arm-imx6-register-pm_power_off-handler-if-fsl-pmic-s.patch @@ -0,0 +1,75 @@ +From 7c696d5453382dc0db1482db55b16e98972a2475 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Aug 2018 12:34:21 +0200 +Subject: ARM: imx6: register pm_power_off handler if "fsl,pmic-stby-poweroff" + is set + +From: Oleksij Rempel + +[ Upstream commit 8148d2136002da2e2887caf6a07bbd9c033f14f3 ] + +One of the Freescale recommended sequences for power off with external +PMIC is the following: +... +3. SoC is programming PMIC for power off when standby is asserted. +4. In CCM STOP mode, Standby is asserted, PMIC gates SoC supplies. + +See: +http://www.nxp.com/assets/documents/data/en/reference-manuals/IMX6DQRM.pdf +page 5083 + +This patch implements step 4. of this sequence. + +Signed-off-by: Oleksij Rempel +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/mach-imx/pm-imx6.c | 25 +++++++++++++++++++++++++ + 1 file changed, 25 insertions(+) + +diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c +index 1515e498d348c..dd9eb3f14f45c 100644 +--- a/arch/arm/mach-imx/pm-imx6.c ++++ b/arch/arm/mach-imx/pm-imx6.c +@@ -602,6 +602,28 @@ static void __init imx6_pm_common_init(const struct imx6_pm_socdata + IMX6Q_GPR1_GINT); + } + ++static void imx6_pm_stby_poweroff(void) ++{ ++ imx6_set_lpm(STOP_POWER_OFF); ++ imx6q_suspend_finish(0); ++ ++ mdelay(1000); ++ ++ pr_emerg("Unable to poweroff system\n"); ++} ++ ++static int imx6_pm_stby_poweroff_probe(void) ++{ ++ if (pm_power_off) { ++ pr_warn("%s: pm_power_off already claimed %p %pf!\n", ++ __func__, pm_power_off, pm_power_off); ++ return -EBUSY; ++ } ++ ++ pm_power_off = imx6_pm_stby_poweroff; ++ return 0; ++} ++ + void __init imx6_pm_ccm_init(const char *ccm_compat) + { + struct device_node *np; +@@ -618,6 +640,9 @@ void __init imx6_pm_ccm_init(const char *ccm_compat) + val = readl_relaxed(ccm_base + CLPCR); + val &= ~BM_CLPCR_LPM; + writel_relaxed(val, ccm_base + CLPCR); ++ ++ if (of_property_read_bool(np, "fsl,pmic-stby-poweroff")) ++ imx6_pm_stby_poweroff_probe(); + } + + void __init imx6q_pm_init(void) +-- +2.20.1 + diff --git a/queue-4.9/arm-tegra-apalis_t30-fix-mmc1-cmd-pull-up.patch b/queue-4.9/arm-tegra-apalis_t30-fix-mmc1-cmd-pull-up.patch new file mode 100644 index 00000000000..d33c4fbd0f9 --- /dev/null +++ b/queue-4.9/arm-tegra-apalis_t30-fix-mmc1-cmd-pull-up.patch @@ -0,0 +1,44 @@ +From df01d438be33f06540a8667840b682d645d48201 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Aug 2018 18:37:43 +0200 +Subject: ARM: tegra: apalis_t30: fix mmc1 cmd pull-up + +From: Marcel Ziswiler + +[ Upstream commit 1c997fe4becdc6fcbc06e23982ceb65621e6572a ] + +Fix MMC1 cmd pin pull-up causing issues on carrier boards without +external pull-up. + +Signed-off-by: Marcel Ziswiler +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/tegra30-apalis.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/tegra30-apalis.dtsi b/arch/arm/boot/dts/tegra30-apalis.dtsi +index 192b95177aac3..826bdd0b8a257 100644 +--- a/arch/arm/boot/dts/tegra30-apalis.dtsi ++++ b/arch/arm/boot/dts/tegra30-apalis.dtsi +@@ -147,14 +147,14 @@ + + /* Apalis MMC1 */ + sdmmc3_clk_pa6 { +- nvidia,pins = "sdmmc3_clk_pa6", +- "sdmmc3_cmd_pa7"; ++ nvidia,pins = "sdmmc3_clk_pa6"; + nvidia,function = "sdmmc3"; + nvidia,pull = ; + nvidia,tristate = ; + }; + sdmmc3_dat0_pb7 { +- nvidia,pins = "sdmmc3_dat0_pb7", ++ nvidia,pins = "sdmmc3_cmd_pa7", ++ "sdmmc3_dat0_pb7", + "sdmmc3_dat1_pb6", + "sdmmc3_dat2_pb5", + "sdmmc3_dat3_pb4", +-- +2.20.1 + diff --git a/queue-4.9/arm64-dts-amd-fix-spi-bus-warnings.patch b/queue-4.9/arm64-dts-amd-fix-spi-bus-warnings.patch new file mode 100644 index 00000000000..1d1546205e6 --- /dev/null +++ b/queue-4.9/arm64-dts-amd-fix-spi-bus-warnings.patch @@ -0,0 +1,50 @@ +From b5cee8062323eab16591cd746c92c8a0388ba8ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Sep 2018 13:12:40 -0500 +Subject: arm64: dts: amd: Fix SPI bus warnings + +From: Rob Herring + +[ Upstream commit e9f0878c4b2004ac19581274c1ae4c61ae3ca70e ] + +dtc has new checks for SPI buses. Fix the warnings in node names. + +arch/arm64/boot/dts/amd/amd-overdrive.dtb: Warning (spi_bus_bridge): /smb/ssp@e1030000: node name for SPI buses should be 'spi' +arch/arm64/boot/dts/amd/amd-overdrive-rev-b0.dtb: Warning (spi_bus_bridge): /smb/ssp@e1030000: node name for SPI buses should be 'spi' +arch/arm64/boot/dts/amd/amd-overdrive-rev-b1.dtb: Warning (spi_bus_bridge): /smb/ssp@e1030000: node name for SPI buses should be 'spi' + +Cc: Brijesh Singh +Cc: Suravee Suthikulpanit +Cc: Tom Lendacky +Signed-off-by: Rob Herring +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi b/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi +index bd3adeac374f4..2973a14523eaf 100644 +--- a/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi ++++ b/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi +@@ -106,7 +106,7 @@ + clock-names = "uartclk", "apb_pclk"; + }; + +- spi0: ssp@e1020000 { ++ spi0: spi@e1020000 { + status = "disabled"; + compatible = "arm,pl022", "arm,primecell"; + reg = <0 0xe1020000 0 0x1000>; +@@ -116,7 +116,7 @@ + clock-names = "apb_pclk"; + }; + +- spi1: ssp@e1030000 { ++ spi1: spi@e1030000 { + status = "disabled"; + compatible = "arm,pl022", "arm,primecell"; + reg = <0 0xe1030000 0 0x1000>; +-- +2.20.1 + diff --git a/queue-4.9/arm64-dts-lg-fix-spi-controller-node-names.patch b/queue-4.9/arm64-dts-lg-fix-spi-controller-node-names.patch new file mode 100644 index 00000000000..07bc7740f2a --- /dev/null +++ b/queue-4.9/arm64-dts-lg-fix-spi-controller-node-names.patch @@ -0,0 +1,66 @@ +From c6c8942ff9a11933c65ab6a8d6b26be387789382 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Sep 2018 13:12:44 -0500 +Subject: arm64: dts: lg: Fix SPI controller node names + +From: Rob Herring + +[ Upstream commit 09bae3b64cb580c95329bd8d16f08f0a5cb81ec9 ] + +SPI controller nodes should be named 'spi' rather than 'ssp'. Fixing the +name enables dtc SPI bus checks. + +Cc: Chanho Min +Signed-off-by: Rob Herring +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/lg/lg1312.dtsi | 4 ++-- + arch/arm64/boot/dts/lg/lg1313.dtsi | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/lg/lg1312.dtsi b/arch/arm64/boot/dts/lg/lg1312.dtsi +index fbafa24cd5335..5e0c5dc973e33 100644 +--- a/arch/arm64/boot/dts/lg/lg1312.dtsi ++++ b/arch/arm64/boot/dts/lg/lg1312.dtsi +@@ -167,14 +167,14 @@ + clock-names = "apb_pclk"; + status="disabled"; + }; +- spi0: ssp@fe800000 { ++ spi0: spi@fe800000 { + compatible = "arm,pl022", "arm,primecell"; + reg = <0x0 0xfe800000 0x1000>; + interrupts = ; + clocks = <&clk_bus>; + clock-names = "apb_pclk"; + }; +- spi1: ssp@fe900000 { ++ spi1: spi@fe900000 { + compatible = "arm,pl022", "arm,primecell"; + reg = <0x0 0xfe900000 0x1000>; + interrupts = ; +diff --git a/arch/arm64/boot/dts/lg/lg1313.dtsi b/arch/arm64/boot/dts/lg/lg1313.dtsi +index e703e1149c757..f3b1ba6f74220 100644 +--- a/arch/arm64/boot/dts/lg/lg1313.dtsi ++++ b/arch/arm64/boot/dts/lg/lg1313.dtsi +@@ -167,14 +167,14 @@ + clock-names = "apb_pclk"; + status="disabled"; + }; +- spi0: ssp@fe800000 { ++ spi0: spi@fe800000 { + compatible = "arm,pl022", "arm,primecell"; + reg = <0x0 0xfe800000 0x1000>; + interrupts = ; + clocks = <&clk_bus>; + clock-names = "apb_pclk"; + }; +- spi1: ssp@fe900000 { ++ spi1: spi@fe900000 { + compatible = "arm,pl022", "arm,primecell"; + reg = <0x0 0xfe900000 0x1000>; + interrupts = ; +-- +2.20.1 + diff --git a/queue-4.9/arm64-dts-tegra210-p2180-correct-sdmmc4-vqmmc-supply.patch b/queue-4.9/arm64-dts-tegra210-p2180-correct-sdmmc4-vqmmc-supply.patch new file mode 100644 index 00000000000..e38e8c034c1 --- /dev/null +++ b/queue-4.9/arm64-dts-tegra210-p2180-correct-sdmmc4-vqmmc-supply.patch @@ -0,0 +1,34 @@ +From 57bbbb30d483df9446998679fea3c0a048e650ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Aug 2018 21:08:35 +0300 +Subject: arm64: dts: tegra210-p2180: Correct sdmmc4 vqmmc-supply + +From: Aapo Vienamo + +[ Upstream commit 6ff7705da8806de45ca1490194f0b4eb07725804 ] + +On p2180 sdmmc4 is powered from a fixed 1.8 V regulator. + +Signed-off-by: Aapo Vienamo +Reviewed-by: Mikko Perttunen +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi +index 6a51d282ec636..d1e687b4911f5 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi +@@ -281,6 +281,7 @@ + status = "okay"; + bus-width = <8>; + non-removable; ++ vqmmc-supply = <&vdd_1v8>; + }; + + clocks { +-- +2.20.1 + diff --git a/queue-4.9/asoc-dpcm-properly-initialise-hw-rate_max.patch b/queue-4.9/asoc-dpcm-properly-initialise-hw-rate_max.patch new file mode 100644 index 00000000000..26a2b544f52 --- /dev/null +++ b/queue-4.9/asoc-dpcm-properly-initialise-hw-rate_max.patch @@ -0,0 +1,42 @@ +From a83c75b2733a25728f33def48089c890c8bcdafa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Aug 2018 14:26:47 +0100 +Subject: ASoC: dpcm: Properly initialise hw->rate_max + +From: Charles Keepax + +[ Upstream commit e33ffbd9cd39da09831ce62c11025d830bf78d9e ] + +If the CPU DAI does not initialise rate_max, say if using +using KNOT or CONTINUOUS, then the rate_max field will be +initialised to 0. A value of zero in the rate_max field of +the hardware runtime will cause the sound card to support no +sample rates at all. Obviously this is not desired, just a +different mechanism is being used to apply the constraints. As +such update the setting of rate_max in dpcm_init_runtime_hw +to be consistent with the non-DPCM cases and set rate_max to +UINT_MAX if nothing is defined on the CPU DAI. + +Signed-off-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-pcm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index 1d00f6e894ef4..d69559e458725 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -1592,7 +1592,7 @@ static void dpcm_init_runtime_hw(struct snd_pcm_runtime *runtime, + u64 formats) + { + runtime->hw.rate_min = stream->rate_min; +- runtime->hw.rate_max = stream->rate_max; ++ runtime->hw.rate_max = min_not_zero(stream->rate_max, UINT_MAX); + runtime->hw.channels_min = stream->channels_min; + runtime->hw.channels_max = stream->channels_max; + if (runtime->hw.formats) +-- +2.20.1 + diff --git a/queue-4.9/asoc-intel-hdac_hdmi-limit-sampling-rates-at-dai-cre.patch b/queue-4.9/asoc-intel-hdac_hdmi-limit-sampling-rates-at-dai-cre.patch new file mode 100644 index 00000000000..0e1271afe3d --- /dev/null +++ b/queue-4.9/asoc-intel-hdac_hdmi-limit-sampling-rates-at-dai-cre.patch @@ -0,0 +1,46 @@ +From 1c6063031197df61d60a7c00e259fd71d31cafba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Aug 2018 12:19:16 -0500 +Subject: ASoC: Intel: hdac_hdmi: Limit sampling rates at dai creation + +From: Yong Zhi + +[ Upstream commit 3b857472f34faa7d11001afa5e158833812c98d7 ] + +Playback of 44.1Khz contents with HDMI plugged returns +"Invalid pipe config" because HDMI paths in the FW +topology are configured to operate at 48Khz. + +This patch filters out sampling rates not supported +at hdac_hdmi_create_dais() to let user space SRC +to do the converting. + +Signed-off-by: Yong Zhi +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Takashi Iwai +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/hdac_hdmi.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c +index c602c4960924c..88355d1719a30 100644 +--- a/sound/soc/codecs/hdac_hdmi.c ++++ b/sound/soc/codecs/hdac_hdmi.c +@@ -1267,6 +1267,12 @@ static int hdac_hdmi_create_dais(struct hdac_device *hdac, + if (ret) + return ret; + ++ /* Filter out 44.1, 88.2 and 176.4Khz */ ++ rates &= ~(SNDRV_PCM_RATE_44100 | SNDRV_PCM_RATE_88200 | ++ SNDRV_PCM_RATE_176400); ++ if (!rates) ++ return -EINVAL; ++ + sprintf(dai_name, "intel-hdmi-hifi%d", i+1); + hdmi_dais[i].name = devm_kstrdup(&hdac->dev, + dai_name, GFP_KERNEL); +-- +2.20.1 + diff --git a/queue-4.9/asoc-sgtl5000-avoid-division-by-zero-if-lo_vag-is-ze.patch b/queue-4.9/asoc-sgtl5000-avoid-division-by-zero-if-lo_vag-is-ze.patch new file mode 100644 index 00000000000..1add2b1053a --- /dev/null +++ b/queue-4.9/asoc-sgtl5000-avoid-division-by-zero-if-lo_vag-is-ze.patch @@ -0,0 +1,38 @@ +From 8a2e6fd95336d466d9304ba0674c7f2121236c37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Sep 2018 11:41:52 +0100 +Subject: ASoC: sgtl5000: avoid division by zero if lo_vag is zero + +From: Colin Ian King + +[ Upstream commit 9ab708aef61f5620113269a9d1bdb1543d1207d0 ] + +In the case where lo_vag <= SGTL5000_LINE_OUT_GND_BASE, lo_vag +is set to zero and later vol_quot is computed by dividing by +lo_vag causing a division by zero error. Fix this by avoiding +a zero division and set vol_quot to zero in this specific case +so that the lowest setting for i is correctly set. + +Signed-off-by: Colin Ian King +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/sgtl5000.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c +index 7406ea5c9a4f7..39810b713d5f2 100644 +--- a/sound/soc/codecs/sgtl5000.c ++++ b/sound/soc/codecs/sgtl5000.c +@@ -1217,7 +1217,7 @@ static int sgtl5000_set_power_regs(struct snd_soc_codec *codec) + * Searching for a suitable index solving this formula: + * idx = 40 * log10(vag_val / lo_cagcntrl) + 15 + */ +- vol_quot = (vag * 100) / lo_vag; ++ vol_quot = lo_vag ? (vag * 100) / lo_vag : 0; + lo_vol = 0; + for (i = 0; i < ARRAY_SIZE(vol_quot_table); i++) { + if (vol_quot >= vol_quot_table[i]) +-- +2.20.1 + diff --git a/queue-4.9/ath10k-fix-kernel-panic-by-moving-pci-flush-after-na.patch b/queue-4.9/ath10k-fix-kernel-panic-by-moving-pci-flush-after-na.patch new file mode 100644 index 00000000000..4837820e733 --- /dev/null +++ b/queue-4.9/ath10k-fix-kernel-panic-by-moving-pci-flush-after-na.patch @@ -0,0 +1,89 @@ +From 3720a43d0d314c1b5d3fb23d3805ec72f7f016e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Aug 2018 12:39:01 +0300 +Subject: ath10k: fix kernel panic by moving pci flush after napi_disable + +From: Tamizh chelvam + +[ Upstream commit bd1d395070cca4f42a93e520b0597274789274a4 ] + +When continuously running wifi up/down sequence, the napi poll +can be scheduled after the CE buffers being freed by ath10k_pci_flush + +Steps: + In a certain condition, during wifi down below scenario might occur. + +ath10k_stop->ath10k_hif_stop->napi_schedule->ath10k_pci_flush->napi_poll(napi_synchronize). + +In the above scenario, CE buffer entries will be freed up and become NULL in +ath10k_pci_flush. And the napi_poll has been invoked after the flush process +and it will try to get the skb from the CE buffer entry and perform some action on that. +Since the CE buffer already cleaned by pci flush this action will create NULL +pointer dereference and trigger below kernel panic. + +Unable to handle kernel NULL pointer dereference at virtual address 0000005c +PC is at ath10k_pci_htt_rx_cb+0x64/0x3ec [ath10k_pci] +ath10k_pci_htt_rx_cb [ath10k_pci] +ath10k_ce_per_engine_service+0x74/0xc4 [ath10k_pci] +ath10k_ce_per_engine_service [ath10k_pci] +ath10k_ce_per_engine_service_any+0x74/0x80 [ath10k_pci] +ath10k_ce_per_engine_service_any [ath10k_pci] +ath10k_pci_napi_poll+0x48/0xec [ath10k_pci] +ath10k_pci_napi_poll [ath10k_pci] +net_rx_action+0xac/0x160 +net_rx_action +__do_softirq+0xdc/0x208 +__do_softirq +irq_exit+0x84/0xe0 +irq_exit +__handle_domain_irq+0x80/0xa0 +__handle_domain_irq +gic_handle_irq+0x38/0x5c +gic_handle_irq +__irq_usr+0x44/0x60 + +Tested on QCA4019 and firmware version 10.4.3.2.1.1-00010 + +Signed-off-by: Tamizh chelvam +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/ahb.c | 4 ++-- + drivers/net/wireless/ath/ath10k/pci.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/ahb.c b/drivers/net/wireless/ath/ath10k/ahb.c +index da770af830369..125b5c31b2b0a 100644 +--- a/drivers/net/wireless/ath/ath10k/ahb.c ++++ b/drivers/net/wireless/ath/ath10k/ahb.c +@@ -658,10 +658,10 @@ static void ath10k_ahb_hif_stop(struct ath10k *ar) + ath10k_ahb_irq_disable(ar); + synchronize_irq(ar_ahb->irq); + +- ath10k_pci_flush(ar); +- + napi_synchronize(&ar->napi); + napi_disable(&ar->napi); ++ ++ ath10k_pci_flush(ar); + } + + static int ath10k_ahb_hif_power_up(struct ath10k *ar) +diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c +index 25b8d501d437e..b7bac14d1487b 100644 +--- a/drivers/net/wireless/ath/ath10k/pci.c ++++ b/drivers/net/wireless/ath/ath10k/pci.c +@@ -1781,9 +1781,9 @@ static void ath10k_pci_hif_stop(struct ath10k *ar) + + ath10k_pci_irq_disable(ar); + ath10k_pci_irq_sync(ar); +- ath10k_pci_flush(ar); + napi_synchronize(&ar->napi); + napi_disable(&ar->napi); ++ ath10k_pci_flush(ar); + + spin_lock_irqsave(&ar_pci->ps_lock, flags); + WARN_ON(ar_pci->ps_wake_refcount > 0); +-- +2.20.1 + diff --git a/queue-4.9/ath10k-wmi-disable-softirq-s-while-calling-ieee80211.patch b/queue-4.9/ath10k-wmi-disable-softirq-s-while-calling-ieee80211.patch new file mode 100644 index 00000000000..46c67267e30 --- /dev/null +++ b/queue-4.9/ath10k-wmi-disable-softirq-s-while-calling-ieee80211.patch @@ -0,0 +1,50 @@ +From 941f77ed2569a56ea6c126e9c99475c8067c65ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Sep 2018 15:07:07 +0300 +Subject: ath10k: wmi: disable softirq's while calling ieee80211_rx + +From: Erik Stromdahl + +[ Upstream commit 37f62c0d5822f631b786b29a1b1069ab714d1a28 ] + +This is done in order not to trig the below warning in +ieee80211_rx_napi: + +WARN_ON_ONCE(softirq_count() == 0); + +ieee80211_rx_napi requires that softirq's are disabled during +execution. + +The High latency bus drivers (SDIO and USB) sometimes call the wmi +ep_rx_complete callback from non softirq context, resulting in a trigger +of the above warning. + +Calling ieee80211_rx_ni with softirq's already disabled (e.g., from +softirq context) should be safe as the local_bh_disable and +local_bh_enable functions (called from ieee80211_rx_ni) are fully +reentrant. + +Signed-off-by: Erik Stromdahl +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index bbfe7be214e12..c208fed048554 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -2384,7 +2384,8 @@ int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb) + status->freq, status->band, status->signal, + status->rate_idx); + +- ieee80211_rx(ar->hw, skb); ++ ieee80211_rx_ni(ar->hw, skb); ++ + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.9/ath9k-add-back-support-for-using-active-monitor-inte.patch b/queue-4.9/ath9k-add-back-support-for-using-active-monitor-inte.patch new file mode 100644 index 00000000000..df747398ff1 --- /dev/null +++ b/queue-4.9/ath9k-add-back-support-for-using-active-monitor-inte.patch @@ -0,0 +1,118 @@ +From 679b0d8322e6ca8395f05c0bf0c04c001e9f05d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Sep 2018 18:49:05 +0200 +Subject: ath9k: add back support for using active monitor interfaces for tx99 + +From: Felix Fietkau + +[ Upstream commit 6df0580be8bc30803c4d8b2ed9c2230a2740c795 ] + +Various documented examples on how to set up tx99 with ath9k rely +on setting up a regular monitor interface for setting the channel. +My previous patch "ath9k: fix tx99 with monitor mode interface" made +it possible to set it up this way again. However, it was removing support +for using an active monitor interface, which is required for controlling +the bitrate as well, since the bitrate is not passed down with a regular +monitor interface. + +This patch partially reverts the previous one, but keeps support for using +a regular monitor interface to keep documented steps working in cases +where the bitrate does not matter + +Fixes: d9c52fd17cb48 ("ath9k: fix tx99 with monitor mode interface") +Signed-off-by: Felix Fietkau +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/ath9k.h | 1 + + drivers/net/wireless/ath/ath9k/main.c | 10 ++++++++-- + drivers/net/wireless/ath/ath9k/tx99.c | 7 +++++++ + drivers/net/wireless/ath/ath9k/xmit.c | 2 +- + 4 files changed, 17 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h +index 51e878a9d5211..7bda18c61eb6e 100644 +--- a/drivers/net/wireless/ath/ath9k/ath9k.h ++++ b/drivers/net/wireless/ath/ath9k/ath9k.h +@@ -1033,6 +1033,7 @@ struct ath_softc { + + struct ath_spec_scan_priv spec_priv; + ++ struct ieee80211_vif *tx99_vif; + struct sk_buff *tx99_skb; + bool tx99_state; + s16 tx99_power; +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index fbc34beee1580..f6151a00041d6 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -1249,8 +1249,13 @@ static int ath9k_add_interface(struct ieee80211_hw *hw, + struct ath_vif *avp = (void *)vif->drv_priv; + struct ath_node *an = &avp->mcast_node; + +- if (IS_ENABLED(CONFIG_ATH9K_TX99)) +- return -EOPNOTSUPP; ++ if (IS_ENABLED(CONFIG_ATH9K_TX99)) { ++ if (sc->cur_chan->nvifs >= 1) { ++ mutex_unlock(&sc->mutex); ++ return -EOPNOTSUPP; ++ } ++ sc->tx99_vif = vif; ++ } + + mutex_lock(&sc->mutex); + +@@ -1335,6 +1340,7 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw, + ath9k_p2p_remove_vif(sc, vif); + + sc->cur_chan->nvifs--; ++ sc->tx99_vif = NULL; + if (!ath9k_is_chanctx_enabled()) + list_del(&avp->list); + +diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c +index 0cb5b2a873be8..096902e0fdf5c 100644 +--- a/drivers/net/wireless/ath/ath9k/tx99.c ++++ b/drivers/net/wireless/ath/ath9k/tx99.c +@@ -54,6 +54,7 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc) + struct ieee80211_hdr *hdr; + struct ieee80211_tx_info *tx_info; + struct sk_buff *skb; ++ struct ath_vif *avp; + + skb = alloc_skb(len, GFP_KERNEL); + if (!skb) +@@ -71,11 +72,17 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc) + memcpy(hdr->addr2, hw->wiphy->perm_addr, ETH_ALEN); + memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN); + ++ if (sc->tx99_vif) { ++ avp = (struct ath_vif *) sc->tx99_vif->drv_priv; ++ hdr->seq_ctrl |= cpu_to_le16(avp->seq_no); ++ } ++ + tx_info = IEEE80211_SKB_CB(skb); + memset(tx_info, 0, sizeof(*tx_info)); + rate = &tx_info->control.rates[0]; + tx_info->band = sc->cur_chan->chandef.chan->band; + tx_info->flags = IEEE80211_TX_CTL_NO_ACK; ++ tx_info->control.vif = sc->tx99_vif; + rate->count = 1; + if (ah->curchan && IS_CHAN_HT(ah->curchan)) { + rate->flags |= IEEE80211_TX_RC_MCS; +diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c +index 2c35819f65426..0ef27d99bef33 100644 +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -2970,7 +2970,7 @@ int ath9k_tx99_send(struct ath_softc *sc, struct sk_buff *skb, + return -EINVAL; + } + +- ath_set_rates(NULL, NULL, bf); ++ ath_set_rates(sc->tx99_vif, NULL, bf); + + ath9k_hw_set_desc_link(sc->sc_ah, bf->bf_desc, bf->bf_daddr); + ath9k_hw_tx99_start(sc->sc_ah, txctl->txq->axq_qnum); +-- +2.20.1 + diff --git a/queue-4.9/ath9k-fix-a-locking-bug-in-ath9k_add_interface.patch b/queue-4.9/ath9k-fix-a-locking-bug-in-ath9k_add_interface.patch new file mode 100644 index 00000000000..cde202d21de --- /dev/null +++ b/queue-4.9/ath9k-fix-a-locking-bug-in-ath9k_add_interface.patch @@ -0,0 +1,48 @@ +From b2cf42593b46e5c77ee78d84f739ac7267f7b7d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Oct 2018 23:08:43 +0300 +Subject: ath9k: Fix a locking bug in ath9k_add_interface() + +From: Dan Carpenter + +[ Upstream commit 461cf036057477805a8a391e5fd0f5264a5e56a8 ] + +We tried to revert commit d9c52fd17cb4 ("ath9k: fix tx99 with monitor +mode interface") but accidentally missed part of the locking change. + +The lock has to be held earlier so that we're holding it when we do +"sc->tx99_vif = vif;" and also there in the current code there is a +stray unlock before we have taken the lock. + +Fixes: 6df0580be8bc ("ath9k: add back support for using active monitor interfaces for tx99") +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index f6151a00041d6..abc997427bae5 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -1249,6 +1249,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw, + struct ath_vif *avp = (void *)vif->drv_priv; + struct ath_node *an = &avp->mcast_node; + ++ mutex_lock(&sc->mutex); + if (IS_ENABLED(CONFIG_ATH9K_TX99)) { + if (sc->cur_chan->nvifs >= 1) { + mutex_unlock(&sc->mutex); +@@ -1257,8 +1258,6 @@ static int ath9k_add_interface(struct ieee80211_hw *hw, + sc->tx99_vif = vif; + } + +- mutex_lock(&sc->mutex); +- + ath_dbg(common, CONFIG, "Attach a VIF of type: %d\n", vif->type); + sc->cur_chan->nvifs++; + +-- +2.20.1 + diff --git a/queue-4.9/ath9k-fix-tx99-with-monitor-mode-interface.patch b/queue-4.9/ath9k-fix-tx99-with-monitor-mode-interface.patch new file mode 100644 index 00000000000..ec5c5863248 --- /dev/null +++ b/queue-4.9/ath9k-fix-tx99-with-monitor-mode-interface.patch @@ -0,0 +1,116 @@ +From 2b502d1d22c3940bc686180c57af8420c34dd2f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Aug 2018 11:37:51 +0200 +Subject: ath9k: fix tx99 with monitor mode interface + +From: Felix Fietkau + +[ Upstream commit d9c52fd17cb483bd8a470398afcb79f86c1b77c8 ] + +Tx99 is typically configured via a monitor mode interface, which does +not get added to the driver as a vif. Since the code currently expects +a configured virtual interface for tx99, enabling tx99 via debugfs fails. +Since the vif is not needed anyway, remove all checks for it. + +Signed-off-by: Felix Fietkau +[kvalo@codeaurora.org: s/CPTCFG/CONFIG/] +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/ath9k.h | 1 - + drivers/net/wireless/ath/ath9k/main.c | 12 +++--------- + drivers/net/wireless/ath/ath9k/tx99.c | 9 --------- + drivers/net/wireless/ath/ath9k/xmit.c | 2 +- + 4 files changed, 4 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h +index 7bda18c61eb6e..51e878a9d5211 100644 +--- a/drivers/net/wireless/ath/ath9k/ath9k.h ++++ b/drivers/net/wireless/ath/ath9k/ath9k.h +@@ -1033,7 +1033,6 @@ struct ath_softc { + + struct ath_spec_scan_priv spec_priv; + +- struct ieee80211_vif *tx99_vif; + struct sk_buff *tx99_skb; + bool tx99_state; + s16 tx99_power; +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index b868f02ced893..fbc34beee1580 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -1249,15 +1249,10 @@ static int ath9k_add_interface(struct ieee80211_hw *hw, + struct ath_vif *avp = (void *)vif->drv_priv; + struct ath_node *an = &avp->mcast_node; + +- mutex_lock(&sc->mutex); ++ if (IS_ENABLED(CONFIG_ATH9K_TX99)) ++ return -EOPNOTSUPP; + +- if (IS_ENABLED(CONFIG_ATH9K_TX99)) { +- if (sc->cur_chan->nvifs >= 1) { +- mutex_unlock(&sc->mutex); +- return -EOPNOTSUPP; +- } +- sc->tx99_vif = vif; +- } ++ mutex_lock(&sc->mutex); + + ath_dbg(common, CONFIG, "Attach a VIF of type: %d\n", vif->type); + sc->cur_chan->nvifs++; +@@ -1340,7 +1335,6 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw, + ath9k_p2p_remove_vif(sc, vif); + + sc->cur_chan->nvifs--; +- sc->tx99_vif = NULL; + if (!ath9k_is_chanctx_enabled()) + list_del(&avp->list); + +diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c +index 8e9480cc33e15..0cb5b2a873be8 100644 +--- a/drivers/net/wireless/ath/ath9k/tx99.c ++++ b/drivers/net/wireless/ath/ath9k/tx99.c +@@ -54,12 +54,6 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc) + struct ieee80211_hdr *hdr; + struct ieee80211_tx_info *tx_info; + struct sk_buff *skb; +- struct ath_vif *avp; +- +- if (!sc->tx99_vif) +- return NULL; +- +- avp = (struct ath_vif *)sc->tx99_vif->drv_priv; + + skb = alloc_skb(len, GFP_KERNEL); + if (!skb) +@@ -77,14 +71,11 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc) + memcpy(hdr->addr2, hw->wiphy->perm_addr, ETH_ALEN); + memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN); + +- hdr->seq_ctrl |= cpu_to_le16(avp->seq_no); +- + tx_info = IEEE80211_SKB_CB(skb); + memset(tx_info, 0, sizeof(*tx_info)); + rate = &tx_info->control.rates[0]; + tx_info->band = sc->cur_chan->chandef.chan->band; + tx_info->flags = IEEE80211_TX_CTL_NO_ACK; +- tx_info->control.vif = sc->tx99_vif; + rate->count = 1; + if (ah->curchan && IS_CHAN_HT(ah->curchan)) { + rate->flags |= IEEE80211_TX_RC_MCS; +diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c +index 0ef27d99bef33..2c35819f65426 100644 +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -2970,7 +2970,7 @@ int ath9k_tx99_send(struct ath_softc *sc, struct sk_buff *skb, + return -EINVAL; + } + +- ath_set_rates(sc->tx99_vif, NULL, bf); ++ ath_set_rates(NULL, NULL, bf); + + ath9k_hw_set_desc_link(sc->sc_ah, bf->bf_desc, bf->bf_daddr); + ath9k_hw_tx99_start(sc->sc_ah, txctl->txq->axq_qnum); +-- +2.20.1 + diff --git a/queue-4.9/bluetooth-l2cap-detect-if-remote-is-not-able-to-use-.patch b/queue-4.9/bluetooth-l2cap-detect-if-remote-is-not-able-to-use-.patch new file mode 100644 index 00000000000..d80879a4a2e --- /dev/null +++ b/queue-4.9/bluetooth-l2cap-detect-if-remote-is-not-able-to-use-.patch @@ -0,0 +1,44 @@ +From ac6a65bf87fc0e8b78ce852a2c6863f700c5c327 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Sep 2018 13:39:22 +0300 +Subject: Bluetooth: L2CAP: Detect if remote is not able to use the whole MPS + +From: Luiz Augusto von Dentz + +[ Upstream commit a5c3021bb62b970713550db3f7fd08aa70665d7e ] + +If the remote is not able to fully utilize the MPS choosen recalculate +the credits based on the actual amount it is sending that way it can +still send packets of MTU size without credits dropping to 0. + +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/l2cap_core.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 48d23abfe7992..1306962a792af 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -6811,6 +6811,16 @@ static int l2cap_le_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb) + chan->sdu_len = sdu_len; + chan->sdu_last_frag = skb; + ++ /* Detect if remote is not able to use the selected MPS */ ++ if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) { ++ u16 mps_len = skb->len + L2CAP_SDULEN_SIZE; ++ ++ /* Adjust the number of credits */ ++ BT_DBG("chan->mps %u -> %u", chan->mps, mps_len); ++ chan->mps = mps_len; ++ l2cap_chan_le_send_credits(chan); ++ } ++ + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.9/bnx2x-ignore-bandwidth-attention-in-single-function-.patch b/queue-4.9/bnx2x-ignore-bandwidth-attention-in-single-function-.patch new file mode 100644 index 00000000000..984cb41e861 --- /dev/null +++ b/queue-4.9/bnx2x-ignore-bandwidth-attention-in-single-function-.patch @@ -0,0 +1,47 @@ +From f629320f003f468187410588ca2afc6b52e1a22a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Sep 2018 11:22:51 -0700 +Subject: bnx2x: Ignore bandwidth attention in single function mode + +From: Shahed Shaikh + +[ Upstream commit 75a110a1783ef8324ffd763b24f4ac268253cbca ] + +This is a workaround for FW bug - +MFW generates bandwidth attention in single function mode, which +is only expected to be generated in multi function mode. +This undesired attention in SF mode results in incorrect HW +configuration and resulting into Tx timeout. + +Signed-off-by: Shahed Shaikh +Signed-off-by: Ariel Elior +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +index a9681b191304a..ce8a777b1e975 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -3540,6 +3540,16 @@ static void bnx2x_drv_info_iscsi_stat(struct bnx2x *bp) + */ + static void bnx2x_config_mf_bw(struct bnx2x *bp) + { ++ /* Workaround for MFW bug. ++ * MFW is not supposed to generate BW attention in ++ * single function mode. ++ */ ++ if (!IS_MF(bp)) { ++ DP(BNX2X_MSG_MCP, ++ "Ignoring MF BW config in single function mode\n"); ++ return; ++ } ++ + if (bp->link_vars.link_up) { + bnx2x_cmng_fns_init(bp, true, CMNG_FNS_MINMAX); + bnx2x_link_sync_notify(bp); +-- +2.20.1 + diff --git a/queue-4.9/cfg80211-avoid-regulatory-restore-when-country_ie_ig.patch b/queue-4.9/cfg80211-avoid-regulatory-restore-when-country_ie_ig.patch new file mode 100644 index 00000000000..a6ad5249fec --- /dev/null +++ b/queue-4.9/cfg80211-avoid-regulatory-restore-when-country_ie_ig.patch @@ -0,0 +1,95 @@ +From ac5f05b7480bf14067322499d4b8efeb1d83f0ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jul 2018 18:46:13 +0530 +Subject: cfg80211: Avoid regulatory restore when COUNTRY_IE_IGNORE is set + +From: Rajeev Kumar Sirasanagandla + +[ Upstream commit 7417844b63d4b0dc8ab23f88259bf95de7d09b57 ] + +When REGULATORY_COUNTRY_IE_IGNORE is set, __reg_process_hint_country_ie() +ignores the country code change request from __cfg80211_connect_result() +via regulatory_hint_country_ie(). + +After Disconnect, similar to above, country code should not be reset to +world when country IE ignore is set. But this is violated and restore of +regulatory settings is invoked by cfg80211_disconnect_work via +regulatory_hint_disconnect(). + +To address this, avoid regulatory restore from regulatory_hint_disconnect() +when COUNTRY_IE_IGNORE is set. + +Note: Currently, restore_regulatory_settings() takes care of clearing +beacon hints. But in the proposed change, regulatory restore is avoided. +Therefore, explicitly clear beacon hints when DISABLE_BEACON_HINTS +is not set. + +Signed-off-by: Rajeev Kumar Sirasanagandla +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/reg.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 46 insertions(+) + +diff --git a/net/wireless/reg.c b/net/wireless/reg.c +index 44befe9f9ff08..dde741f298de7 100644 +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -2616,8 +2616,54 @@ static void restore_regulatory_settings(bool reset_user) + schedule_work(®_work); + } + ++static bool is_wiphy_all_set_reg_flag(enum ieee80211_regulatory_flags flag) ++{ ++ struct cfg80211_registered_device *rdev; ++ struct wireless_dev *wdev; ++ ++ list_for_each_entry(rdev, &cfg80211_rdev_list, list) { ++ list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { ++ wdev_lock(wdev); ++ if (!(wdev->wiphy->regulatory_flags & flag)) { ++ wdev_unlock(wdev); ++ return false; ++ } ++ wdev_unlock(wdev); ++ } ++ } ++ ++ return true; ++} ++ + void regulatory_hint_disconnect(void) + { ++ /* Restore of regulatory settings is not required when wiphy(s) ++ * ignore IE from connected access point but clearance of beacon hints ++ * is required when wiphy(s) supports beacon hints. ++ */ ++ if (is_wiphy_all_set_reg_flag(REGULATORY_COUNTRY_IE_IGNORE)) { ++ struct reg_beacon *reg_beacon, *btmp; ++ ++ if (is_wiphy_all_set_reg_flag(REGULATORY_DISABLE_BEACON_HINTS)) ++ return; ++ ++ spin_lock_bh(®_pending_beacons_lock); ++ list_for_each_entry_safe(reg_beacon, btmp, ++ ®_pending_beacons, list) { ++ list_del(®_beacon->list); ++ kfree(reg_beacon); ++ } ++ spin_unlock_bh(®_pending_beacons_lock); ++ ++ list_for_each_entry_safe(reg_beacon, btmp, ++ ®_beacon_list, list) { ++ list_del(®_beacon->list); ++ kfree(reg_beacon); ++ } ++ ++ return; ++ } ++ + pr_debug("All devices are disconnected, going to restore regulatory settings\n"); + restore_regulatory_settings(false); + } +-- +2.20.1 + diff --git a/queue-4.9/component-fix-loop-condition-to-call-unbind-if-bind-.patch b/queue-4.9/component-fix-loop-condition-to-call-unbind-if-bind-.patch new file mode 100644 index 00000000000..585ddd87a0b --- /dev/null +++ b/queue-4.9/component-fix-loop-condition-to-call-unbind-if-bind-.patch @@ -0,0 +1,52 @@ +From fa520477520422d97190491b946032cd1661dde1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Aug 2018 21:15:39 -0700 +Subject: component: fix loop condition to call unbind() if bind() fails + +From: Banajit Goswami + +[ Upstream commit bdae566d5d9733b6e32b378668b84eadf28a94d4 ] + +During component_bind_all(), if bind() fails for any +particular component associated with a master, unbind() +should be called for all previous components in that +master's match array, whose bind() might have completed +successfully. As per the current logic, if bind() fails +for the component at position 'n' in the master's match +array, it would start calling unbind() from component in +'n'th position itself and work backwards, and will always +skip calling unbind() for component in 0th position in the +master's match array. +Fix this by updating the loop condition, and the logic to +refer to the components in master's match array, so that +unbind() is called for all components starting from 'n-1'st +position in the array, until (and including) component in +0th position. + +Signed-off-by: Banajit Goswami +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/component.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/base/component.c b/drivers/base/component.c +index 89b032f2ffd22..08da6160e94dd 100644 +--- a/drivers/base/component.c ++++ b/drivers/base/component.c +@@ -461,9 +461,9 @@ int component_bind_all(struct device *master_dev, void *data) + } + + if (ret != 0) { +- for (; i--; ) +- if (!master->match->compare[i].duplicate) { +- c = master->match->compare[i].component; ++ for (; i > 0; i--) ++ if (!master->match->compare[i - 1].duplicate) { ++ c = master->match->compare[i - 1].component; + component_unbind(c, master, data); + } + } +-- +2.20.1 + diff --git a/queue-4.9/coresight-etm4x-configure-el2-exception-level-when-k.patch b/queue-4.9/coresight-etm4x-configure-el2-exception-level-when-k.patch new file mode 100644 index 00000000000..09b6bfc6ce1 --- /dev/null +++ b/queue-4.9/coresight-etm4x-configure-el2-exception-level-when-k.patch @@ -0,0 +1,110 @@ +From 62ced2335527de07d900c4adf01e346c443ed372 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Sep 2018 13:18:00 -0600 +Subject: coresight: etm4x: Configure EL2 exception level when kernel is + running in HYP + +From: Tomasz Nowicki + +[ Upstream commit b860801e3237ec4c74cf8de0be4816996757ae5c ] + +For non-VHE systems host kernel runs at EL1 and jumps to EL2 whenever +hypervisor code should be executed. In this case ETM4x driver must +restrict configuration to EL1 when it setups kernel tracing. +However, there is no separate hypervisor privilege level when VHE +is enabled, the host kernel runs at EL2. + +This patch fixes configuration of TRCACATRn register for VHE systems +so that ETM_EXLEVEL_NS_HYP bit is used instead of ETM_EXLEVEL_NS_OS +to on/off kernel tracing. At the same time, it moves common code +to new helper. + +Signed-off-by: Tomasz Nowicki +Signed-off-by: Mathieu Poirier +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etm4x.c | 40 +++++++++---------- + 1 file changed, 20 insertions(+), 20 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c +index 44d6c29e26448..22079f886f452 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + + #include "coresight-etm4x.h" + #include "coresight-etm-perf.h" +@@ -615,7 +616,7 @@ static void etm4_set_default_config(struct etmv4_config *config) + config->vinst_ctrl |= BIT(0); + } + +-static u64 etm4_get_access_type(struct etmv4_config *config) ++static u64 etm4_get_ns_access_type(struct etmv4_config *config) + { + u64 access_type = 0; + +@@ -626,17 +627,26 @@ static u64 etm4_get_access_type(struct etmv4_config *config) + * Bit[13] Exception level 1 - OS + * Bit[14] Exception level 2 - Hypervisor + * Bit[15] Never implemented +- * +- * Always stay away from hypervisor mode. + */ +- access_type = ETM_EXLEVEL_NS_HYP; +- +- if (config->mode & ETM_MODE_EXCL_KERN) +- access_type |= ETM_EXLEVEL_NS_OS; ++ if (!is_kernel_in_hyp_mode()) { ++ /* Stay away from hypervisor mode for non-VHE */ ++ access_type = ETM_EXLEVEL_NS_HYP; ++ if (config->mode & ETM_MODE_EXCL_KERN) ++ access_type |= ETM_EXLEVEL_NS_OS; ++ } else if (config->mode & ETM_MODE_EXCL_KERN) { ++ access_type = ETM_EXLEVEL_NS_HYP; ++ } + + if (config->mode & ETM_MODE_EXCL_USER) + access_type |= ETM_EXLEVEL_NS_APP; + ++ return access_type; ++} ++ ++static u64 etm4_get_access_type(struct etmv4_config *config) ++{ ++ u64 access_type = etm4_get_ns_access_type(config); ++ + /* + * EXLEVEL_S, bits[11:8], don't trace anything happening + * in secure state. +@@ -890,20 +900,10 @@ void etm4_config_trace_mode(struct etmv4_config *config) + + addr_acc = config->addr_acc[ETM_DEFAULT_ADDR_COMP]; + /* clear default config */ +- addr_acc &= ~(ETM_EXLEVEL_NS_APP | ETM_EXLEVEL_NS_OS); ++ addr_acc &= ~(ETM_EXLEVEL_NS_APP | ETM_EXLEVEL_NS_OS | ++ ETM_EXLEVEL_NS_HYP); + +- /* +- * EXLEVEL_NS, bits[15:12] +- * The Exception levels are: +- * Bit[12] Exception level 0 - Application +- * Bit[13] Exception level 1 - OS +- * Bit[14] Exception level 2 - Hypervisor +- * Bit[15] Never implemented +- */ +- if (mode & ETM_MODE_EXCL_KERN) +- addr_acc |= ETM_EXLEVEL_NS_OS; +- else +- addr_acc |= ETM_EXLEVEL_NS_APP; ++ addr_acc |= etm4_get_ns_access_type(config); + + config->addr_acc[ETM_DEFAULT_ADDR_COMP] = addr_acc; + config->addr_acc[ETM_DEFAULT_ADDR_COMP + 1] = addr_acc; +-- +2.20.1 + diff --git a/queue-4.9/coresight-fix-handling-of-sinks.patch b/queue-4.9/coresight-fix-handling-of-sinks.patch new file mode 100644 index 00000000000..32c1dc0ff4d --- /dev/null +++ b/queue-4.9/coresight-fix-handling-of-sinks.patch @@ -0,0 +1,80 @@ +From 4538d90856dd4c9f5f90d056fc23b3d7eb444c35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Sep 2018 13:17:45 -0600 +Subject: coresight: Fix handling of sinks + +From: Suzuki K Poulose + +[ Upstream commit c71369de02b285d9da526a526d8f2affc7b17c59 ] + +The coresight components could be operated either in sysfs mode or in perf +mode. For some of the components, the mode of operation doesn't matter as +they simply relay the data to the next component in the trace path. But for +sinks, they need to be able to provide the trace data back to the user. +Thus we need to make sure that "mode" is handled appropriately. e.g, +the sysfs mode could have multiple sources driving the trace data, while +perf mode doesn't allow sharing the sink. + +The coresight_enable_sink() however doesn't really allow this check to +trigger as it skips the "enable_sink" callback if the component is +already enabled, irrespective of the mode. This could cause mixing +of data from different modes or even same mode (in perf), if the +sources are different. Also, if we fail to enable the sink while +enabling a path (where sink is the first component enabled), +we could end up in disabling the components in the "entire" +path which were not enabled in this trial, causing disruptions +in the existing trace paths. + +Cc: Mathieu Poirier +Signed-off-by: Suzuki K Poulose +Signed-off-by: Mathieu Poirier +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight.c | 22 +++++++++++++++------- + 1 file changed, 15 insertions(+), 7 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c +index 398e44a9ec45d..5ffabc388630e 100644 +--- a/drivers/hwtracing/coresight/coresight.c ++++ b/drivers/hwtracing/coresight/coresight.c +@@ -132,12 +132,14 @@ static int coresight_enable_sink(struct coresight_device *csdev, u32 mode) + { + int ret; + +- if (!csdev->enable) { +- if (sink_ops(csdev)->enable) { +- ret = sink_ops(csdev)->enable(csdev, mode); +- if (ret) +- return ret; +- } ++ /* ++ * We need to make sure the "new" session is compatible with the ++ * existing "mode" of operation. ++ */ ++ if (sink_ops(csdev)->enable) { ++ ret = sink_ops(csdev)->enable(csdev, mode); ++ if (ret) ++ return ret; + csdev->enable = true; + } + +@@ -331,8 +333,14 @@ int coresight_enable_path(struct list_head *path, u32 mode) + switch (type) { + case CORESIGHT_DEV_TYPE_SINK: + ret = coresight_enable_sink(csdev, mode); ++ /* ++ * Sink is the first component turned on. If we ++ * failed to enable the sink, there are no components ++ * that need disabling. Disabling the path here ++ * would mean we could disrupt an existing session. ++ */ + if (ret) +- goto err; ++ goto out; + break; + case CORESIGHT_DEV_TYPE_SOURCE: + /* sources are enabled from either sysFS or Perf */ +-- +2.20.1 + diff --git a/queue-4.9/coresight-tmc-fix-byte-address-alignment-for-rrp.patch b/queue-4.9/coresight-tmc-fix-byte-address-alignment-for-rrp.patch new file mode 100644 index 00000000000..4803e43a0fe --- /dev/null +++ b/queue-4.9/coresight-tmc-fix-byte-address-alignment-for-rrp.patch @@ -0,0 +1,54 @@ +From e7d1b12732e548dccf4ed1d1861f0433ff335966 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Sep 2018 13:18:02 -0600 +Subject: coresight: tmc: Fix byte-address alignment for RRP + +From: Leo Yan + +[ Upstream commit e7753f3937610633a540f2be81be87531f96ff04 ] + +>From the comment in the code, it claims the requirement for byte-address +alignment for RRP register: 'for 32-bit, 64-bit and 128-bit wide trace +memory, the four LSBs must be 0s. For 256-bit wide trace memory, the +five LSBs must be 0s'. This isn't consistent with the program, the +program sets five LSBs as zeros for 32/64/128-bit wide trace memory and +set six LSBs zeros for 256-bit wide trace memory. + +After checking with the CoreSight Trace Memory Controller technical +reference manual (ARM DDI 0461B, section 3.3.4 RAM Read Pointer +Register), it proves the comment is right and the program does wrong +setting. + +This patch fixes byte-address alignment for RRP by following correct +definition in the technical reference manual. + +Cc: Mathieu Poirier +Cc: Mike Leach +Signed-off-by: Leo Yan +Signed-off-by: Mathieu Poirier +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-tmc-etf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c +index d6941ea24d8df..14df4e34c21cf 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c +@@ -425,10 +425,10 @@ static void tmc_update_etf_buffer(struct coresight_device *csdev, + case TMC_MEM_INTF_WIDTH_32BITS: + case TMC_MEM_INTF_WIDTH_64BITS: + case TMC_MEM_INTF_WIDTH_128BITS: +- mask = GENMASK(31, 5); ++ mask = GENMASK(31, 4); + break; + case TMC_MEM_INTF_WIDTH_256BITS: +- mask = GENMASK(31, 6); ++ mask = GENMASK(31, 5); + break; + } + +-- +2.20.1 + diff --git a/queue-4.9/cpufeature-avoid-warning-when-compiling-with-clang.patch b/queue-4.9/cpufeature-avoid-warning-when-compiling-with-clang.patch new file mode 100644 index 00000000000..cc91abbe4c0 --- /dev/null +++ b/queue-4.9/cpufeature-avoid-warning-when-compiling-with-clang.patch @@ -0,0 +1,46 @@ +From 3163536035784be9324d20f930d9e2b3174d259e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Sep 2018 21:38:24 -0700 +Subject: cpufeature: avoid warning when compiling with clang + +From: Stefan Agner + +[ Upstream commit c785896b21dd8e156326ff660050b0074d3431df ] + +The table id (second) argument to MODULE_DEVICE_TABLE is often +referenced otherwise. This is not the case for CPU features. This +leads to warnings when building the kernel with Clang: + arch/arm/crypto/aes-ce-glue.c:450:1: warning: variable + 'cpu_feature_match_AES' is not needed and will not be emitted + [-Wunneeded-internal-declaration] + module_cpu_feature_match(AES, aes_init); + ^ + +Avoid warnings by using __maybe_unused, similar to commit 1f318a8bafcf +("modules: mark __inittest/__exittest as __maybe_unused"). + +Fixes: 67bad2fdb754 ("cpu: add generic support for CPU feature based module autoloading") +Signed-off-by: Stefan Agner +Acked-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + include/linux/cpufeature.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/cpufeature.h b/include/linux/cpufeature.h +index 986c06c88d814..84d3c81b59781 100644 +--- a/include/linux/cpufeature.h ++++ b/include/linux/cpufeature.h +@@ -45,7 +45,7 @@ + * 'asm/cpufeature.h' of your favorite architecture. + */ + #define module_cpu_feature_match(x, __initfunc) \ +-static struct cpu_feature const cpu_feature_match_ ## x[] = \ ++static struct cpu_feature const __maybe_unused cpu_feature_match_ ## x[] = \ + { { .feature = cpu_feature(x) }, { } }; \ + MODULE_DEVICE_TABLE(cpu, cpu_feature_match_ ## x); \ + \ +-- +2.20.1 + diff --git a/queue-4.9/crypto-fix-a-memory-leak-in-rsa-kcs1pad-s-encryption.patch b/queue-4.9/crypto-fix-a-memory-leak-in-rsa-kcs1pad-s-encryption.patch new file mode 100644 index 00000000000..293f4b1d2b6 --- /dev/null +++ b/queue-4.9/crypto-fix-a-memory-leak-in-rsa-kcs1pad-s-encryption.patch @@ -0,0 +1,46 @@ +From c37b5a43c157cd012d047ebfe929138664730d64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Sep 2018 20:24:32 +0300 +Subject: crypto: fix a memory leak in rsa-kcs1pad's encryption mode + +From: Dan Aloni + +[ Upstream commit 3944f139d5592790b70bc64f197162e643a8512b ] + +The encryption mode of pkcs1pad never uses out_sg and out_buf, so +there's no need to allocate the buffer, which presently is not even +being freed. + +CC: Herbert Xu +CC: linux-crypto@vger.kernel.org +CC: "David S. Miller" +Signed-off-by: Dan Aloni +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/rsa-pkcs1pad.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c +index 7830d304dff6f..d58224d808675 100644 +--- a/crypto/rsa-pkcs1pad.c ++++ b/crypto/rsa-pkcs1pad.c +@@ -267,15 +267,6 @@ static int pkcs1pad_encrypt(struct akcipher_request *req) + pkcs1pad_sg_set_buf(req_ctx->in_sg, req_ctx->in_buf, + ctx->key_size - 1 - req->src_len, req->src); + +- req_ctx->out_buf = kmalloc(ctx->key_size, GFP_KERNEL); +- if (!req_ctx->out_buf) { +- kfree(req_ctx->in_buf); +- return -ENOMEM; +- } +- +- pkcs1pad_sg_set_buf(req_ctx->out_sg, req_ctx->out_buf, +- ctx->key_size, NULL); +- + akcipher_request_set_tfm(&req_ctx->child_req, ctx->child); + akcipher_request_set_callback(&req_ctx->child_req, req->base.flags, + pkcs1pad_encrypt_sign_complete_cb, req); +-- +2.20.1 + diff --git a/queue-4.9/crypto-s5p-sss-fix-fix-argument-list-alignment.patch b/queue-4.9/crypto-s5p-sss-fix-fix-argument-list-alignment.patch new file mode 100644 index 00000000000..db0dbfd45c0 --- /dev/null +++ b/queue-4.9/crypto-s5p-sss-fix-fix-argument-list-alignment.patch @@ -0,0 +1,45 @@ +From 9b39badf2081f0ac94eb306ed378429085fb1a9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Sep 2018 17:09:28 +0200 +Subject: crypto: s5p-sss: Fix Fix argument list alignment + +From: Christoph Manszewski + +[ Upstream commit 6c12b6ba45490eeb820fdceccf5a53f42a26799c ] + +Fix misalignment of continued argument list. + +Signed-off-by: Christoph Manszewski +Reviewed-by: Krzysztof Kozlowski +Acked-by: Kamil Konieczny +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/s5p-sss.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c +index 500e4090e2fd4..5a37c075ee553 100644 +--- a/drivers/crypto/s5p-sss.c ++++ b/drivers/crypto/s5p-sss.c +@@ -298,7 +298,7 @@ static void s5p_unset_indata(struct s5p_aes_dev *dev) + } + + static int s5p_make_sg_cpy(struct s5p_aes_dev *dev, struct scatterlist *src, +- struct scatterlist **dst) ++ struct scatterlist **dst) + { + void *pages; + int len; +@@ -510,7 +510,7 @@ static int s5p_set_indata_start(struct s5p_aes_dev *dev, + } + + static int s5p_set_outdata_start(struct s5p_aes_dev *dev, +- struct ablkcipher_request *req) ++ struct ablkcipher_request *req) + { + struct scatterlist *sg; + int err; +-- +2.20.1 + diff --git a/queue-4.9/cxgb4-fix-endianness-issue-in-t4_fwcache.patch b/queue-4.9/cxgb4-fix-endianness-issue-in-t4_fwcache.patch new file mode 100644 index 00000000000..484dc01d564 --- /dev/null +++ b/queue-4.9/cxgb4-fix-endianness-issue-in-t4_fwcache.patch @@ -0,0 +1,35 @@ +From 31f7f3242207b1f8df37c4012ebfc8ba7760743e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Sep 2018 14:36:27 +0530 +Subject: cxgb4: Fix endianness issue in t4_fwcache() + +From: Ganesh Goudar + +[ Upstream commit 0dc235afc59a226d951352b0adf4a89b532a9d13 ] + +Do not put host-endian 0 or 1 into big endian feild. + +Reported-by: Al Viro +Signed-off-by: Ganesh Goudar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +index ebeeb3581b9c5..b4b435276a18d 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +@@ -3541,7 +3541,7 @@ int t4_fwcache(struct adapter *adap, enum fw_params_param_dev_fwcache op) + c.param[0].mnem = + cpu_to_be32(FW_PARAMS_MNEM_V(FW_PARAMS_MNEM_DEV) | + FW_PARAMS_PARAM_X_V(FW_PARAMS_PARAM_DEV_FWCACHE)); +- c.param[0].val = (__force __be32)op; ++ c.param[0].val = cpu_to_be32(op); + + return t4_wr_mbox(adap, adap->mbox, &c, sizeof(c), NULL); + } +-- +2.20.1 + diff --git a/queue-4.9/dmaengine-dma-jz4780-don-t-depend-on-mach_jz4780.patch b/queue-4.9/dmaengine-dma-jz4780-don-t-depend-on-mach_jz4780.patch new file mode 100644 index 00000000000..4ad51f065e7 --- /dev/null +++ b/queue-4.9/dmaengine-dma-jz4780-don-t-depend-on-mach_jz4780.patch @@ -0,0 +1,37 @@ +From cde908e8454f143e1f5967d4c6b93ecb1fa481de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Aug 2018 23:32:48 +0200 +Subject: dmaengine: dma-jz4780: Don't depend on MACH_JZ4780 + +From: Paul Cercueil + +[ Upstream commit c558ecd21c852c97ff98dc6c61f715ba420ec251 ] + +If we make this driver depend on MACH_JZ4780, that means it can be +enabled only if we're building a kernel specially crafted for a +JZ4780-based board, while most GNU/Linux distributions will want one +generic MIPS kernel that works on multiple boards. + +Signed-off-by: Paul Cercueil +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig +index 141aefbe37ec9..b0f798244a897 100644 +--- a/drivers/dma/Kconfig ++++ b/drivers/dma/Kconfig +@@ -120,7 +120,7 @@ config DMA_JZ4740 + + config DMA_JZ4780 + tristate "JZ4780 DMA support" +- depends on MACH_JZ4780 || COMPILE_TEST ++ depends on MIPS || COMPILE_TEST + select DMA_ENGINE + select DMA_VIRTUAL_CHANNELS + help +-- +2.20.1 + diff --git a/queue-4.9/dmaengine-dma-jz4780-further-residue-status-fix.patch b/queue-4.9/dmaengine-dma-jz4780-further-residue-status-fix.patch new file mode 100644 index 00000000000..38504262196 --- /dev/null +++ b/queue-4.9/dmaengine-dma-jz4780-further-residue-status-fix.patch @@ -0,0 +1,46 @@ +From c4d48f3d62751d9901ec8ee66e5b586d938f1522 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Aug 2018 23:32:56 +0200 +Subject: dmaengine: dma-jz4780: Further residue status fix + +From: Daniel Silsby + +[ Upstream commit 83ef4fb7556b6a673f755da670cbacab7e2c7f1b ] + +Func jz4780_dma_desc_residue() expects the index to the next hw +descriptor as its last parameter. Caller func jz4780_dma_tx_status(), +however, applied modulus before passing it. When the current hw +descriptor was last in the list, the index passed became zero. + +The resulting excess of reported residue especially caused problems +with cyclic DMA transfer clients, i.e. ALSA AIC audio output, which +rely on this for determining current DMA location within buffer. + +Combined with the recent and related residue-reporting fixes, spurious +ALSA audio underruns on jz4770 hardware are now fixed. + +Signed-off-by: Daniel Silsby +Signed-off-by: Paul Cercueil +Tested-by: Mathieu Malaterre +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dma-jz4780.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c +index 803cfb4523b08..aca2d6fd92d56 100644 +--- a/drivers/dma/dma-jz4780.c ++++ b/drivers/dma/dma-jz4780.c +@@ -580,7 +580,7 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan, + to_jz4780_dma_desc(vdesc), 0); + } else if (cookie == jzchan->desc->vdesc.tx.cookie) { + txstate->residue = jz4780_dma_desc_residue(jzchan, jzchan->desc, +- (jzchan->curr_hwdesc + 1) % jzchan->desc->count); ++ jzchan->curr_hwdesc + 1); + } else + txstate->residue = 0; + +-- +2.20.1 + diff --git a/queue-4.9/edac-raise-the-maximum-number-of-memory-controllers.patch b/queue-4.9/edac-raise-the-maximum-number-of-memory-controllers.patch new file mode 100644 index 00000000000..aeb029b83a1 --- /dev/null +++ b/queue-4.9/edac-raise-the-maximum-number-of-memory-controllers.patch @@ -0,0 +1,63 @@ +From a1cff22b306126a4162cd719f2a846203d86bb57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Sep 2018 09:34:49 -0500 +Subject: EDAC: Raise the maximum number of memory controllers + +From: Justin Ernst + +[ Upstream commit 6b58859419554fb824e09cfdd73151a195473cbc ] + +We observe an oops in the skx_edac module during boot: + + EDAC MC0: Giving out device to module skx_edac controller Skylake Socket#0 IMC#0 + EDAC MC1: Giving out device to module skx_edac controller Skylake Socket#0 IMC#1 + EDAC MC2: Giving out device to module skx_edac controller Skylake Socket#1 IMC#0 + ... + EDAC MC13: Giving out device to module skx_edac controller Skylake Socket#0 IMC#1 + EDAC MC14: Giving out device to module skx_edac controller Skylake Socket#1 IMC#0 + EDAC MC15: Giving out device to module skx_edac controller Skylake Socket#1 IMC#1 + Too many memory controllers: 16 + EDAC MC: Removed device 0 for skx_edac Skylake Socket#0 IMC#0 + +We observe there are two memory controllers per socket, with a limit +of 16. Raise the maximum number of memory controllers from 16 to 2 * +MAX_NUMNODES (1024). + +[ bp: This is just a band-aid fix until we've sorted out the whole issue + with the bus_type association and handling in EDAC and can get rid of + this arbitrary limit. ] + +Signed-off-by: Justin Ernst +Signed-off-by: Borislav Petkov +Acked-by: Russ Anderson +Cc: Mauro Carvalho Chehab +Cc: linux-edac@vger.kernel.org +Link: https://lkml.kernel.org/r/20180925143449.284634-1-justin.ernst@hpe.com +Signed-off-by: Sasha Levin +--- + include/linux/edac.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/linux/edac.h b/include/linux/edac.h +index 9e0d78966552c..c6233227720c7 100644 +--- a/include/linux/edac.h ++++ b/include/linux/edac.h +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + struct device; + +@@ -778,6 +779,6 @@ struct mem_ctl_info { + /* + * Maximum number of memory controllers in the coherent fabric. + */ +-#define EDAC_MAX_MCS 16 ++#define EDAC_MAX_MCS 2 * MAX_NUMNODES + + #endif +-- +2.20.1 + diff --git a/queue-4.9/f2fs-fix-memory-leak-of-percpu-counter-in-fill_super.patch b/queue-4.9/f2fs-fix-memory-leak-of-percpu-counter-in-fill_super.patch new file mode 100644 index 00000000000..78b865713f9 --- /dev/null +++ b/queue-4.9/f2fs-fix-memory-leak-of-percpu-counter-in-fill_super.patch @@ -0,0 +1,41 @@ +From 03020215e3ae8d2a26a3016ccf09be87adc043de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Sep 2018 14:54:02 +0800 +Subject: f2fs: fix memory leak of percpu counter in fill_super() + +From: Chao Yu + +[ Upstream commit 4a70e255449c9a13eed7a6eeecc85a1ea63cef76 ] + +In fill_super -> init_percpu_info, we should destroy percpu counter +in error path, otherwise memory allcoated for percpu counter will +leak. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/super.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 9eff18c1f3e46..e0ac676e0a35c 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -1650,8 +1650,12 @@ static int init_percpu_info(struct f2fs_sb_info *sbi) + if (err) + return err; + +- return percpu_counter_init(&sbi->total_valid_inode_count, 0, ++ err = percpu_counter_init(&sbi->total_valid_inode_count, 0, + GFP_KERNEL); ++ if (err) ++ percpu_counter_destroy(&sbi->alloc_valid_block_count); ++ ++ return err; + } + + /* +-- +2.20.1 + diff --git a/queue-4.9/f2fs-fix-to-recover-inode-s-uid-gid-during-por.patch b/queue-4.9/f2fs-fix-to-recover-inode-s-uid-gid-during-por.patch new file mode 100644 index 00000000000..b577cfa98c3 --- /dev/null +++ b/queue-4.9/f2fs-fix-to-recover-inode-s-uid-gid-during-por.patch @@ -0,0 +1,45 @@ +From ceaa5e575903e6972ce5afaa457ce47bac41e234 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Sep 2018 17:41:30 +0800 +Subject: f2fs: fix to recover inode's uid/gid during POR + +From: Chao Yu + +[ Upstream commit dc4cd1257c86451cec3e8e352cc376348e4f4af4 ] + +Step to reproduce this bug: +1. logon as root +2. mount -t f2fs /dev/sdd /mnt; +3. touch /mnt/file; +4. chown system /mnt/file; chgrp system /mnt/file; +5. xfs_io -f /mnt/file -c "fsync"; +6. godown /mnt; +7. umount /mnt; +8. mount -t f2fs /dev/sdd /mnt; + +After step 8) we will expect file's uid/gid are all system, but during +recovery, these two fields were not been recovered, fix it. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/recovery.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c +index 9de1480a86bd3..e87b7d7e80fc7 100644 +--- a/fs/f2fs/recovery.c ++++ b/fs/f2fs/recovery.c +@@ -179,6 +179,8 @@ static void recover_inode(struct inode *inode, struct page *page) + char *name; + + inode->i_mode = le16_to_cpu(raw->i_mode); ++ i_uid_write(inode, le32_to_cpu(raw->i_uid)); ++ i_gid_write(inode, le32_to_cpu(raw->i_gid)); + f2fs_i_size_write(inode, le64_to_cpu(raw->i_size)); + inode->i_atime.tv_sec = le64_to_cpu(raw->i_mtime); + inode->i_ctime.tv_sec = le64_to_cpu(raw->i_ctime); +-- +2.20.1 + diff --git a/queue-4.9/fuse-use-read_once-on-congestion_threshold-and-max_b.patch b/queue-4.9/fuse-use-read_once-on-congestion_threshold-and-max_b.patch new file mode 100644 index 00000000000..b3bd51a05b5 --- /dev/null +++ b/queue-4.9/fuse-use-read_once-on-congestion_threshold-and-max_b.patch @@ -0,0 +1,45 @@ +From 80eec71082506f14173f772d7b652d4ad5ad2047 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Aug 2018 18:29:29 +0300 +Subject: fuse: use READ_ONCE on congestion_threshold and max_background + +From: Kirill Tkhai + +[ Upstream commit 2a23f2b8adbe4bd584f936f7ac17a99750eed9d7 ] + +Since they are of unsigned int type, it's allowed to read them +unlocked during reporting to userspace. Let's underline this fact +with READ_ONCE() macroses. + +Signed-off-by: Kirill Tkhai +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/fuse/control.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/fuse/control.c b/fs/fuse/control.c +index e25c40c10f4fa..97ac2f5843fcc 100644 +--- a/fs/fuse/control.c ++++ b/fs/fuse/control.c +@@ -107,7 +107,7 @@ static ssize_t fuse_conn_max_background_read(struct file *file, + if (!fc) + return 0; + +- val = fc->max_background; ++ val = READ_ONCE(fc->max_background); + fuse_conn_put(fc); + + return fuse_conn_limit_read(file, buf, len, ppos, val); +@@ -144,7 +144,7 @@ static ssize_t fuse_conn_congestion_threshold_read(struct file *file, + if (!fc) + return 0; + +- val = fc->congestion_threshold; ++ val = READ_ONCE(fc->congestion_threshold); + fuse_conn_put(fc); + + return fuse_conn_limit_read(file, buf, len, ppos, val); +-- +2.20.1 + diff --git a/queue-4.9/gfs2-don-t-set-gfs2_rdf_uptodate-when-the-lvb-is-upd.patch b/queue-4.9/gfs2-don-t-set-gfs2_rdf_uptodate-when-the-lvb-is-upd.patch new file mode 100644 index 00000000000..9134a4aeb4b --- /dev/null +++ b/queue-4.9/gfs2-don-t-set-gfs2_rdf_uptodate-when-the-lvb-is-upd.patch @@ -0,0 +1,62 @@ +From 6e813da1f4374a06014fbf004656436f4a0584fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Aug 2018 10:32:13 -0500 +Subject: gfs2: Don't set GFS2_RDF_UPTODATE when the lvb is updated + +From: Bob Peterson + +[ Upstream commit 4f36cb36c9d14340bb200d2ad9117b03ce992cfe ] + +The GFS2_RDF_UPTODATE flag in the rgrp is used to determine when +a rgrp buffer is valid. It's cleared when the glock is invalidated, +signifying that the buffer data is now invalid. But before this +patch, function update_rgrp_lvb was setting the flag when it +determined it had a valid lvb. But that's an invalid assumption: +just because you have a valid lvb doesn't mean you have valid +buffers. After all, another node may have made the lvb valid, +and this node just fetched it from the glock via dlm. + +Consider this scenario: +1. The file system is mounted with RGRPLVB option. +2. In gfs2_inplace_reserve it locks the rgrp glock EX, but thanks + to GL_SKIP, it skips the gfs2_rgrp_bh_get. +3. Since loops == 0 and the allocation target (ap->target) is + bigger than the largest known chunk of blocks in the rgrp + (rs->rs_rbm.rgd->rd_extfail_pt) it skips that rgrp and bypasses + the call to gfs2_rgrp_bh_get there as well. +4. update_rgrp_lvb sees the lvb MAGIC number is valid, so bypasses + gfs2_rgrp_bh_get, but it still sets sets GFS2_RDF_UPTODATE due + to this invalid assumption. +5. The next time update_rgrp_lvb is called, it sees the bit is set + and just returns 0, assuming both the lvb and rgrp are both + uptodate. But since this is a smaller allocation, or space has + been freed by another node, thus adjusting the lvb values, + it decides to use the rgrp for allocations, with invalid rd_free + due to the fact it was never updated. + +This patch changes update_rgrp_lvb so it doesn't set the UPTODATE +flag anymore. That way, it has no choice but to fetch the latest +values. + +Signed-off-by: Bob Peterson +Signed-off-by: Sasha Levin +--- + fs/gfs2/rgrp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index 0731267072706..f77a38755aea6 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -1211,7 +1211,7 @@ static int update_rgrp_lvb(struct gfs2_rgrpd *rgd) + rl_flags = be32_to_cpu(rgd->rd_rgl->rl_flags); + rl_flags &= ~GFS2_RDF_MASK; + rgd->rd_flags &= GFS2_RDF_MASK; +- rgd->rd_flags |= (rl_flags | GFS2_RDF_UPTODATE | GFS2_RDF_CHECK); ++ rgd->rd_flags |= (rl_flags | GFS2_RDF_CHECK); + if (rgd->rd_rgl->rl_unlinked == 0) + rgd->rd_flags &= ~GFS2_RDF_CHECK; + rgd->rd_free = be32_to_cpu(rgd->rd_rgl->rl_free); +-- +2.20.1 + diff --git a/queue-4.9/i40e-hold-the-rtnl-lock-on-clearing-interrupt-scheme.patch b/queue-4.9/i40e-hold-the-rtnl-lock-on-clearing-interrupt-scheme.patch new file mode 100644 index 00000000000..c19fa3343af --- /dev/null +++ b/queue-4.9/i40e-hold-the-rtnl-lock-on-clearing-interrupt-scheme.patch @@ -0,0 +1,60 @@ +From ff1f12cb4140cdcefa4a76ca4b40817aafd0ca5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Aug 2018 10:16:03 -0700 +Subject: i40e: hold the rtnl lock on clearing interrupt scheme +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Patryk Małek + +[ Upstream commit 5cba17b14182696d6bb0ec83a1d087933f252241 ] + +Hold the rtnl lock when we're clearing interrupt scheme +in i40e_shutdown and in i40e_remove. + +Signed-off-by: Patryk Małek +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 886378c5334fa..043b69b5843b0 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -11360,6 +11360,7 @@ static void i40e_remove(struct pci_dev *pdev) + mutex_destroy(&hw->aq.asq_mutex); + + /* Clear all dynamic memory lists of rings, q_vectors, and VSIs */ ++ rtnl_lock(); + i40e_clear_interrupt_scheme(pf); + for (i = 0; i < pf->num_alloc_vsi; i++) { + if (pf->vsi[i]) { +@@ -11368,6 +11369,7 @@ static void i40e_remove(struct pci_dev *pdev) + pf->vsi[i] = NULL; + } + } ++ rtnl_unlock(); + + for (i = 0; i < I40E_MAX_VEB; i++) { + kfree(pf->veb[i]); +@@ -11513,7 +11515,13 @@ static void i40e_shutdown(struct pci_dev *pdev) + wr32(hw, I40E_PFPM_WUFC, + (pf->wol_en ? I40E_PFPM_WUFC_MAG_MASK : 0)); + ++ /* Since we're going to destroy queues during the ++ * i40e_clear_interrupt_scheme() we should hold the RTNL lock for this ++ * whole section ++ */ ++ rtnl_lock(); + i40e_clear_interrupt_scheme(pf); ++ rtnl_unlock(); + + if (system_state == SYSTEM_POWER_OFF) { + pci_wake_from_d3(pdev, pf->wol_en); +-- +2.20.1 + diff --git a/queue-4.9/i40e-prevent-deleting-mac-address-from-vf-when-set-b.patch b/queue-4.9/i40e-prevent-deleting-mac-address-from-vf-when-set-b.patch new file mode 100644 index 00000000000..37ca358fb48 --- /dev/null +++ b/queue-4.9/i40e-prevent-deleting-mac-address-from-vf-when-set-b.patch @@ -0,0 +1,48 @@ +From 710aec22613fd069ec86338559b106b8e1fc7b39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Aug 2018 10:16:09 -0700 +Subject: i40e: Prevent deleting MAC address from VF when set by PF +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Patryk Małek + +[ Upstream commit 5907cf6c5bbe78be2ed18b875b316c6028b20634 ] + +To prevent VF from deleting MAC address that was assigned by the +PF we need to check for that scenario when we try to delete a MAC +address from a VF. + +Signed-off-by: Patryk Małek +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 54b8ee2583f14..7484ad3c955db 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -2000,6 +2000,16 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg, u16 msglen) + ret = I40E_ERR_INVALID_MAC_ADDR; + goto error_param; + } ++ ++ if (vf->pf_set_mac && ++ ether_addr_equal(al->list[i].addr, ++ vf->default_lan_addr.addr)) { ++ dev_err(&pf->pdev->dev, ++ "MAC addr %pM has been set by PF, cannot delete it for VF %d, reset VF to change MAC addr\n", ++ vf->default_lan_addr.addr, vf->vf_id); ++ ret = I40E_ERR_PARAM; ++ goto error_param; ++ } + } + vsi = pf->vsi[vf->lan_vsi_idx]; + +-- +2.20.1 + diff --git a/queue-4.9/i40e-use-correct-length-for-strncpy.patch b/queue-4.9/i40e-use-correct-length-for-strncpy.patch new file mode 100644 index 00000000000..31f9852316f --- /dev/null +++ b/queue-4.9/i40e-use-correct-length-for-strncpy.patch @@ -0,0 +1,38 @@ +From 2f57a4ca6a399cc71ff10b7159c3283dbb129907 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Aug 2018 08:12:30 -0700 +Subject: i40e: use correct length for strncpy + +From: Mitch Williams + +[ Upstream commit 7eb74ff891b4e94b8bac48f648a21e4b94ddee64 ] + +Caught by GCC 8. When we provide a length for strncpy, we should not +include the terminating null. So we must tell it one less than the size +of the destination buffer. + +Signed-off-by: Mitch Williams +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_ptp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ptp.c b/drivers/net/ethernet/intel/i40e/i40e_ptp.c +index f1feceab758a5..41cbcb0ac2d94 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c +@@ -604,7 +604,8 @@ static long i40e_ptp_create_clock(struct i40e_pf *pf) + if (!IS_ERR_OR_NULL(pf->ptp_clock)) + return 0; + +- strncpy(pf->ptp_caps.name, i40e_driver_name, sizeof(pf->ptp_caps.name)); ++ strncpy(pf->ptp_caps.name, i40e_driver_name, ++ sizeof(pf->ptp_caps.name) - 1); + pf->ptp_caps.owner = THIS_MODULE; + pf->ptp_caps.max_adj = 999999999; + pf->ptp_caps.n_ext_ts = 0; +-- +2.20.1 + diff --git a/queue-4.9/ib-iser-fix-possible-null-deref-at-iser_inv_desc.patch b/queue-4.9/ib-iser-fix-possible-null-deref-at-iser_inv_desc.patch new file mode 100644 index 00000000000..32f1ee91041 --- /dev/null +++ b/queue-4.9/ib-iser-fix-possible-null-deref-at-iser_inv_desc.patch @@ -0,0 +1,71 @@ +From b6aaea8199692e61a3747aa8081f45915cba96ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Sep 2018 09:44:18 +0000 +Subject: IB/iser: Fix possible NULL deref at iser_inv_desc() + +From: Israel Rukshin + +[ Upstream commit 65f07f5a09dacf3b60619f196f096ea3671a5eda ] + +In case target remote invalidates bogus rkey and signature is not used, +pi_ctx is NULL deref. + +The commit also fails the connection on bogus remote invalidation. + +Fixes: 59caaed7a72a ("IB/iser: Support the remote invalidation exception") +Signed-off-by: Israel Rukshin +Reviewed-by: Max Gurtovoy +Reviewed-by: Sagi Grimberg +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/iser/iser_initiator.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c +index 81ae2e30dd125..27a7e4406f343 100644 +--- a/drivers/infiniband/ulp/iser/iser_initiator.c ++++ b/drivers/infiniband/ulp/iser/iser_initiator.c +@@ -590,13 +590,19 @@ void iser_login_rsp(struct ib_cq *cq, struct ib_wc *wc) + ib_conn->post_recv_buf_count--; + } + +-static inline void ++static inline int + iser_inv_desc(struct iser_fr_desc *desc, u32 rkey) + { +- if (likely(rkey == desc->rsc.mr->rkey)) ++ if (likely(rkey == desc->rsc.mr->rkey)) { + desc->rsc.mr_valid = 0; +- else if (likely(rkey == desc->pi_ctx->sig_mr->rkey)) ++ } else if (likely(desc->pi_ctx && rkey == desc->pi_ctx->sig_mr->rkey)) { + desc->pi_ctx->sig_mr_valid = 0; ++ } else { ++ iser_err("Bogus remote invalidation for rkey %#x\n", rkey); ++ return -EINVAL; ++ } ++ ++ return 0; + } + + static int +@@ -624,12 +630,14 @@ iser_check_remote_inv(struct iser_conn *iser_conn, + + if (iser_task->dir[ISER_DIR_IN]) { + desc = iser_task->rdma_reg[ISER_DIR_IN].mem_h; +- iser_inv_desc(desc, rkey); ++ if (unlikely(iser_inv_desc(desc, rkey))) ++ return -EINVAL; + } + + if (iser_task->dir[ISER_DIR_OUT]) { + desc = iser_task->rdma_reg[ISER_DIR_OUT].mem_h; +- iser_inv_desc(desc, rkey); ++ if (unlikely(iser_inv_desc(desc, rkey))) ++ return -EINVAL; + } + } else { + iser_err("failed to get task for itt=%d\n", hdr->itt); +-- +2.20.1 + diff --git a/queue-4.9/ib-rxe-fixes-for-rdma-read-retry.patch b/queue-4.9/ib-rxe-fixes-for-rdma-read-retry.patch new file mode 100644 index 00000000000..1db98d645a7 --- /dev/null +++ b/queue-4.9/ib-rxe-fixes-for-rdma-read-retry.patch @@ -0,0 +1,127 @@ +From 6f6c615ef7f8b44f67873054261695c6676cc5ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jun 2018 18:48:07 -0700 +Subject: IB/rxe: fixes for rdma read retry + +From: Vijay Immanuel + +[ Upstream commit 030e46e495af855a13964a0aab9753ea82a96edc ] + +When a read request is retried for the remaining partial +data, the response may restart from read response first +or read response only. So support those cases. + +Do not advance the comp psn beyond the current wqe's last_psn +as that could skip over an entire read wqe and will cause the +req_retry() logic to set an incorrect req psn. +An example sequence is as follows: +Write PSN 40 -- this is the current WQE. +Read request PSN 41 +Write PSN 42 +Receive ACK PSN 42 -- this will complete the current WQE +for PSN 40, and set the comp psn to 42 which is a problem +because the read request at PSN 41 has been skipped over. +So when req_retry() tries to retransmit the read request, +it sets the req psn to 42 which is incorrect. + +When retrying a read request, calculate the number of psns +completed based on the dma resid instead of the wqe first_psn. +The wqe first_psn could have moved if the read request was +retried multiple times. + +Set the reth length to the dma resid to handle read retries for +the remaining partial data. + +Signed-off-by: Vijay Immanuel +Signed-off-by: Doug Ledford +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_comp.c | 21 ++++++++++++++++----- + drivers/infiniband/sw/rxe/rxe_req.c | 15 +++++++++------ + 2 files changed, 25 insertions(+), 11 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c +index df15b6d7b645e..b03a6206d9be7 100644 +--- a/drivers/infiniband/sw/rxe/rxe_comp.c ++++ b/drivers/infiniband/sw/rxe/rxe_comp.c +@@ -250,6 +250,17 @@ static inline enum comp_state check_ack(struct rxe_qp *qp, + case IB_OPCODE_RC_RDMA_READ_RESPONSE_MIDDLE: + if (pkt->opcode != IB_OPCODE_RC_RDMA_READ_RESPONSE_MIDDLE && + pkt->opcode != IB_OPCODE_RC_RDMA_READ_RESPONSE_LAST) { ++ /* read retries of partial data may restart from ++ * read response first or response only. ++ */ ++ if ((pkt->psn == wqe->first_psn && ++ pkt->opcode == ++ IB_OPCODE_RC_RDMA_READ_RESPONSE_FIRST) || ++ (wqe->first_psn == wqe->last_psn && ++ pkt->opcode == ++ IB_OPCODE_RC_RDMA_READ_RESPONSE_ONLY)) ++ break; ++ + return COMPST_ERROR; + } + break; +@@ -486,11 +497,11 @@ static inline enum comp_state complete_wqe(struct rxe_qp *qp, + struct rxe_pkt_info *pkt, + struct rxe_send_wqe *wqe) + { +- qp->comp.opcode = -1; +- +- if (pkt) { +- if (psn_compare(pkt->psn, qp->comp.psn) >= 0) +- qp->comp.psn = (pkt->psn + 1) & BTH_PSN_MASK; ++ if (pkt && wqe->state == wqe_state_pending) { ++ if (psn_compare(wqe->last_psn, qp->comp.psn) >= 0) { ++ qp->comp.psn = (wqe->last_psn + 1) & BTH_PSN_MASK; ++ qp->comp.opcode = -1; ++ } + + if (qp->req.wait_psn) { + qp->req.wait_psn = 0; +diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c +index 0f9fe2ca2a91a..6fb771290c566 100644 +--- a/drivers/infiniband/sw/rxe/rxe_req.c ++++ b/drivers/infiniband/sw/rxe/rxe_req.c +@@ -72,9 +72,6 @@ static void req_retry(struct rxe_qp *qp) + int npsn; + int first = 1; + +- wqe = queue_head(qp->sq.queue); +- npsn = (qp->comp.psn - wqe->first_psn) & BTH_PSN_MASK; +- + qp->req.wqe_index = consumer_index(qp->sq.queue); + qp->req.psn = qp->comp.psn; + qp->req.opcode = -1; +@@ -106,11 +103,17 @@ static void req_retry(struct rxe_qp *qp) + if (first) { + first = 0; + +- if (mask & WR_WRITE_OR_SEND_MASK) ++ if (mask & WR_WRITE_OR_SEND_MASK) { ++ npsn = (qp->comp.psn - wqe->first_psn) & ++ BTH_PSN_MASK; + retry_first_write_send(qp, wqe, mask, npsn); ++ } + +- if (mask & WR_READ_MASK) ++ if (mask & WR_READ_MASK) { ++ npsn = (wqe->dma.length - wqe->dma.resid) / ++ qp->mtu; + wqe->iova += npsn * qp->mtu; ++ } + } + + wqe->state = wqe_state_posted; +@@ -439,7 +442,7 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp, + if (pkt->mask & RXE_RETH_MASK) { + reth_set_rkey(pkt, ibwr->wr.rdma.rkey); + reth_set_va(pkt, wqe->iova); +- reth_set_len(pkt, wqe->dma.length); ++ reth_set_len(pkt, wqe->dma.resid); + } + + if (pkt->mask & RXE_IMMDT_MASK) +-- +2.20.1 + diff --git a/queue-4.9/iio-dac-mcp4922-fix-error-handling-in-mcp4922_write_.patch b/queue-4.9/iio-dac-mcp4922-fix-error-handling-in-mcp4922_write_.patch new file mode 100644 index 00000000000..2dbb68e6334 --- /dev/null +++ b/queue-4.9/iio-dac-mcp4922-fix-error-handling-in-mcp4922_write_.patch @@ -0,0 +1,51 @@ +From f9230da01c634592b7bb4e92c9b9cfd9252d26c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Aug 2018 22:24:40 +0200 +Subject: iio: dac: mcp4922: fix error handling in mcp4922_write_raw + +From: Marcus Folkesson + +[ Upstream commit 0833627fc3f757a0dca11e2a9c46c96335a900ee ] + +Do not try to write negative values and make sure that the write goes well. + +Signed-off-by: Marcus Folkesson +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/dac/mcp4922.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/iio/dac/mcp4922.c b/drivers/iio/dac/mcp4922.c +index 3854d201a5d6c..68dd0be1ac076 100644 +--- a/drivers/iio/dac/mcp4922.c ++++ b/drivers/iio/dac/mcp4922.c +@@ -94,17 +94,22 @@ static int mcp4922_write_raw(struct iio_dev *indio_dev, + long mask) + { + struct mcp4922_state *state = iio_priv(indio_dev); ++ int ret; + + if (val2 != 0) + return -EINVAL; + + switch (mask) { + case IIO_CHAN_INFO_RAW: +- if (val > GENMASK(chan->scan_type.realbits-1, 0)) ++ if (val < 0 || val > GENMASK(chan->scan_type.realbits - 1, 0)) + return -EINVAL; + val <<= chan->scan_type.shift; +- state->value[chan->channel] = val; +- return mcp4922_spi_write(state, chan->channel, val); ++ ++ ret = mcp4922_spi_write(state, chan->channel, val); ++ if (!ret) ++ state->value[chan->channel] = val; ++ return ret; ++ + default: + return -EINVAL; + } +-- +2.20.1 + diff --git a/queue-4.9/ip_gre-fix-parsing-gre-header-in-ipgre_err.patch b/queue-4.9/ip_gre-fix-parsing-gre-header-in-ipgre_err.patch new file mode 100644 index 00000000000..5b6c30d2044 --- /dev/null +++ b/queue-4.9/ip_gre-fix-parsing-gre-header-in-ipgre_err.patch @@ -0,0 +1,72 @@ +From ae6aa100e14d8c214f39fc80b51c01599ee2965d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Sep 2018 12:26:47 +0800 +Subject: ip_gre: fix parsing gre header in ipgre_err + +From: Haishuang Yan + +[ Upstream commit b0350d51f001e6edc13ee4f253b98b50b05dd401 ] + +gre_parse_header stops parsing when csum_err is encountered, which means +tpi->key is undefined and ip_tunnel_lookup will return NULL improperly. + +This patch introduce a NULL pointer as csum_err parameter. Even when +csum_err is encountered, it won't return error and continue parsing gre +header as expected. + +Fixes: 9f57c67c379d ("gre: Remove support for sharing GRE protocol hook.") +Reported-by: Jiri Benc +Signed-off-by: Haishuang Yan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/gre_demux.c | 7 ++++--- + net/ipv4/ip_gre.c | 9 +++------ + 2 files changed, 7 insertions(+), 9 deletions(-) + +diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c +index b798862b6be5d..7efe740c06ebf 100644 +--- a/net/ipv4/gre_demux.c ++++ b/net/ipv4/gre_demux.c +@@ -86,13 +86,14 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi, + + options = (__be32 *)(greh + 1); + if (greh->flags & GRE_CSUM) { +- if (skb_checksum_simple_validate(skb)) { ++ if (!skb_checksum_simple_validate(skb)) { ++ skb_checksum_try_convert(skb, IPPROTO_GRE, 0, ++ null_compute_pseudo); ++ } else if (csum_err) { + *csum_err = true; + return -EINVAL; + } + +- skb_checksum_try_convert(skb, IPPROTO_GRE, 0, +- null_compute_pseudo); + options++; + } + +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 576f705d81809..9609ad71dd260 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -224,13 +224,10 @@ static void gre_err(struct sk_buff *skb, u32 info) + const int type = icmp_hdr(skb)->type; + const int code = icmp_hdr(skb)->code; + struct tnl_ptk_info tpi; +- bool csum_err = false; + +- if (gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP), +- iph->ihl * 4) < 0) { +- if (!csum_err) /* ignore csum errors. */ +- return; +- } ++ if (gre_parse_header(skb, &tpi, NULL, htons(ETH_P_IP), ++ iph->ihl * 4) < 0) ++ return; + + if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) { + ipv4_update_pmtu(skb, dev_net(skb->dev), info, +-- +2.20.1 + diff --git a/queue-4.9/iwlwifi-mvm-avoid-sending-too-many-bars.patch b/queue-4.9/iwlwifi-mvm-avoid-sending-too-many-bars.patch new file mode 100644 index 00000000000..cf5ba0b3b78 --- /dev/null +++ b/queue-4.9/iwlwifi-mvm-avoid-sending-too-many-bars.patch @@ -0,0 +1,50 @@ +From 0e780de4bdc70511e72b407b64ec2b10da1bd8b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 May 2018 15:12:08 +0300 +Subject: iwlwifi: mvm: avoid sending too many BARs + +From: Sara Sharon + +[ Upstream commit 1a19c139be18ed4d6d681049cc48586fae070120 ] + +When we receive TX response, we may release a few packets +due to a hole that was closed in the transmission window. + +However, if that frame failed, we will mark all the released +frames as failed and will send multiple BARs. + +This affects statistics badly, and cause unnecessary frames +transmission. + +Instead, mark all the following packets as success, with the +desired result of sending a bar for the failed frame only. + +Signed-off-by: Sara Sharon +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +index 1aa74b87599ff..63dcea640d076 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +@@ -1303,6 +1303,14 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm, + break; + } + ++ /* ++ * If we are freeing multiple frames, mark all the frames ++ * but the first one as acked, since they were acknowledged ++ * before ++ * */ ++ if (skb_freed > 1) ++ info->flags |= IEEE80211_TX_STAT_ACK; ++ + iwl_mvm_tx_status_check_trigger(mvm, status); + + info->status.rates[0].count = tx_resp->failure_frame + 1; +-- +2.20.1 + diff --git a/queue-4.9/kernfs-fix-range-checks-in-kernfs_get_target_path.patch b/queue-4.9/kernfs-fix-range-checks-in-kernfs_get_target_path.patch new file mode 100644 index 00000000000..52fd174b592 --- /dev/null +++ b/queue-4.9/kernfs-fix-range-checks-in-kernfs_get_target_path.patch @@ -0,0 +1,50 @@ +From d17d65100773b8d23ebe78030f07fd85c9434f57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Jul 2018 17:52:47 +0000 +Subject: kernfs: Fix range checks in kernfs_get_target_path + +From: Bernd Edlinger + +[ Upstream commit a75e78f21f9ad4b810868c89dbbabcc3931591ca ] + +The terminating NUL byte is only there because the buffer is +allocated with kzalloc(PAGE_SIZE, GFP_KERNEL), but since the +range-check is off-by-one, and PAGE_SIZE==PATH_MAX, the +returned string may not be zero-terminated if it is exactly +PATH_MAX characters long. Furthermore also the initial loop +may theoretically exceed PATH_MAX and cause a fault. + +Signed-off-by: Bernd Edlinger +Acked-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + fs/kernfs/symlink.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/kernfs/symlink.c b/fs/kernfs/symlink.c +index 80317b04c84a2..e431a850f2f2b 100644 +--- a/fs/kernfs/symlink.c ++++ b/fs/kernfs/symlink.c +@@ -63,6 +63,9 @@ static int kernfs_get_target_path(struct kernfs_node *parent, + if (base == kn) + break; + ++ if ((s - path) + 3 >= PATH_MAX) ++ return -ENAMETOOLONG; ++ + strcpy(s, "../"); + s += 3; + base = base->parent; +@@ -79,7 +82,7 @@ static int kernfs_get_target_path(struct kernfs_node *parent, + if (len < 2) + return -EINVAL; + len--; +- if ((s - path) + len > PATH_MAX) ++ if ((s - path) + len >= PATH_MAX) + return -ENAMETOOLONG; + + /* reverse fillup of target string from target to base */ +-- +2.20.1 + diff --git a/queue-4.9/kprobes-don-t-call-bug_on-if-there-is-a-kprobe-in-us.patch b/queue-4.9/kprobes-don-t-call-bug_on-if-there-is-a-kprobe-in-us.patch new file mode 100644 index 00000000000..7575c81a7a6 --- /dev/null +++ b/queue-4.9/kprobes-don-t-call-bug_on-if-there-is-a-kprobe-in-us.patch @@ -0,0 +1,50 @@ +From 450245029c9959b89f1d0c1c0c1b9821c0692569 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Sep 2018 19:21:09 +0900 +Subject: kprobes: Don't call BUG_ON() if there is a kprobe in use on free list + +From: Masami Hiramatsu + +[ Upstream commit cbdd96f5586151e48317d90a403941ec23f12660 ] + +Instead of calling BUG_ON(), if we find a kprobe in use on free kprobe +list, just remove it from the list and keep it on kprobe hash list +as same as other in-use kprobes. + +Signed-off-by: Masami Hiramatsu +Cc: Anil S Keshavamurthy +Cc: David S . Miller +Cc: Linus Torvalds +Cc: Naveen N . Rao +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: http://lkml.kernel.org/r/153666126882.21306.10738207224288507996.stgit@devbox +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/kprobes.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index 11863e2b01c25..1b75fb8c7735e 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -514,8 +514,14 @@ static void do_free_cleaned_kprobes(void) + struct optimized_kprobe *op, *tmp; + + list_for_each_entry_safe(op, tmp, &freeing_list, list) { +- BUG_ON(!kprobe_unused(&op->kp)); + list_del_init(&op->list); ++ if (WARN_ON_ONCE(!kprobe_unused(&op->kp))) { ++ /* ++ * This must not happen, but if there is a kprobe ++ * still in use, keep it on kprobes hash list. ++ */ ++ continue; ++ } + free_aggr_kprobe(&op->kp); + } + } +-- +2.20.1 + diff --git a/queue-4.9/libfdt-ensure-int_max-is-defined-in-libfdt_env.h.patch b/queue-4.9/libfdt-ensure-int_max-is-defined-in-libfdt_env.h.patch new file mode 100644 index 00000000000..96e3dec5bed --- /dev/null +++ b/queue-4.9/libfdt-ensure-int_max-is-defined-in-libfdt_env.h.patch @@ -0,0 +1,68 @@ +From 3825d077cb3889f76bfb502e1accfaa7df4d8880 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Sep 2018 15:16:22 -0500 +Subject: libfdt: Ensure INT_MAX is defined in libfdt_env.h + +From: Rob Herring + +[ Upstream commit 53dd9dce6979bc54d64a3a09a2fb20187a025be7 ] + +The next update of libfdt has a new dependency on INT_MAX. Update the +instances of libfdt_env.h in the kernel to either include the necessary +header with the definition or define it locally. + +Cc: Russell King +Cc: Benjamin Herrenschmidt +Cc: Paul Mackerras +Cc: Michael Ellerman +Cc: linux-arm-kernel@lists.infradead.org +Cc: linuxppc-dev@lists.ozlabs.org +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + arch/arm/boot/compressed/libfdt_env.h | 2 ++ + arch/powerpc/boot/libfdt_env.h | 2 ++ + include/linux/libfdt_env.h | 1 + + 3 files changed, 5 insertions(+) + +diff --git a/arch/arm/boot/compressed/libfdt_env.h b/arch/arm/boot/compressed/libfdt_env.h +index 17ae0f3efac8e..005bf4ff1b4cb 100644 +--- a/arch/arm/boot/compressed/libfdt_env.h ++++ b/arch/arm/boot/compressed/libfdt_env.h +@@ -5,6 +5,8 @@ + #include + #include + ++#define INT_MAX ((int)(~0U>>1)) ++ + typedef __be16 fdt16_t; + typedef __be32 fdt32_t; + typedef __be64 fdt64_t; +diff --git a/arch/powerpc/boot/libfdt_env.h b/arch/powerpc/boot/libfdt_env.h +index 7e3789ea396b8..0b3db6322c793 100644 +--- a/arch/powerpc/boot/libfdt_env.h ++++ b/arch/powerpc/boot/libfdt_env.h +@@ -4,6 +4,8 @@ + #include + #include + ++#define INT_MAX ((int)(~0U>>1)) ++ + #include "of.h" + + typedef u32 uint32_t; +diff --git a/include/linux/libfdt_env.h b/include/linux/libfdt_env.h +index 2a663c6bb4285..8850e243c9406 100644 +--- a/include/linux/libfdt_env.h ++++ b/include/linux/libfdt_env.h +@@ -1,6 +1,7 @@ + #ifndef _LIBFDT_ENV_H + #define _LIBFDT_ENV_H + ++#include /* For INT_MAX */ + #include + + #include +-- +2.20.1 + diff --git a/queue-4.9/llc-avoid-blocking-in-llc_sap_close.patch b/queue-4.9/llc-avoid-blocking-in-llc_sap_close.patch new file mode 100644 index 00000000000..b1f81d7d19b --- /dev/null +++ b/queue-4.9/llc-avoid-blocking-in-llc_sap_close.patch @@ -0,0 +1,54 @@ +From b86bee0ce40d127a76fcdd6c7d3d48900129fabb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Sep 2018 11:42:06 -0700 +Subject: llc: avoid blocking in llc_sap_close() + +From: Cong Wang + +[ Upstream commit 9708d2b5b7c648e8e0a40d11e8cea12f6277f33c ] + +llc_sap_close() is called by llc_sap_put() which +could be called in BH context in llc_rcv(). We can't +block in BH. + +There is no reason to block it here, kfree_rcu() should +be sufficient. + +Signed-off-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/llc.h | 1 + + net/llc/llc_core.c | 4 +--- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/include/net/llc.h b/include/net/llc.h +index 82d989995d18a..95e5ced4c1339 100644 +--- a/include/net/llc.h ++++ b/include/net/llc.h +@@ -66,6 +66,7 @@ struct llc_sap { + int sk_count; + struct hlist_nulls_head sk_laddr_hash[LLC_SK_LADDR_HASH_ENTRIES]; + struct hlist_head sk_dev_hash[LLC_SK_DEV_HASH_ENTRIES]; ++ struct rcu_head rcu; + }; + + static inline +diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c +index e896a2c53b120..f1e442a39db8d 100644 +--- a/net/llc/llc_core.c ++++ b/net/llc/llc_core.c +@@ -127,9 +127,7 @@ void llc_sap_close(struct llc_sap *sap) + list_del_rcu(&sap->node); + spin_unlock_bh(&llc_sap_list_lock); + +- synchronize_rcu(); +- +- kfree(sap); ++ kfree_rcu(sap, rcu); + } + + static struct packet_type llc_packet_type __read_mostly = { +-- +2.20.1 + diff --git a/queue-4.9/media-au0828-fix-incorrect-error-messages.patch b/queue-4.9/media-au0828-fix-incorrect-error-messages.patch new file mode 100644 index 00000000000..9bc64682532 --- /dev/null +++ b/queue-4.9/media-au0828-fix-incorrect-error-messages.patch @@ -0,0 +1,48 @@ +From b77a09fde0368908cbc9291ff7667bbda1c2fcd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Sep 2018 17:07:49 -0400 +Subject: media: au0828: Fix incorrect error messages + +From: Brad Love + +[ Upstream commit f347596f2bf114a3af3d80201c6e6bef538d884f ] + +Correcting red herring error messages. + +Where appropriate, replaces au0282_dev_register with: +- au0828_analog_register +- au0828_dvb_register + +Signed-off-by: Brad Love +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/au0828/au0828-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c +index 38e73ee5c8fb1..78f0bf8ee084c 100644 +--- a/drivers/media/usb/au0828/au0828-core.c ++++ b/drivers/media/usb/au0828/au0828-core.c +@@ -639,7 +639,7 @@ static int au0828_usb_probe(struct usb_interface *interface, + /* Analog TV */ + retval = au0828_analog_register(dev, interface); + if (retval) { +- pr_err("%s() au0282_dev_register failed to register on V4L2\n", ++ pr_err("%s() au0828_analog_register failed to register on V4L2\n", + __func__); + goto done; + } +@@ -647,7 +647,7 @@ static int au0828_usb_probe(struct usb_interface *interface, + /* Digital TV */ + retval = au0828_dvb_register(dev); + if (retval) +- pr_err("%s() au0282_dev_register failed\n", ++ pr_err("%s() au0828_dvb_register failed\n", + __func__); + + /* Remote controller */ +-- +2.20.1 + diff --git a/queue-4.9/media-davinci-fix-implicit-enum-conversion-warning.patch b/queue-4.9/media-davinci-fix-implicit-enum-conversion-warning.patch new file mode 100644 index 00000000000..248dfdf7224 --- /dev/null +++ b/queue-4.9/media-davinci-fix-implicit-enum-conversion-warning.patch @@ -0,0 +1,47 @@ +From 3be8f176a060ea5428394072e6c901990522f386 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Sep 2018 02:16:15 -0400 +Subject: media: davinci: Fix implicit enum conversion warning + +From: Nathan Chancellor + +[ Upstream commit 4158757395b300b6eb308fc20b96d1d231484413 ] + +Clang warns when one enumerated type is implicitly converted to another. + +drivers/media/platform/davinci/vpbe_display.c:524:24: warning: implicit +conversion from enumeration type 'enum osd_v_exp_ratio' to different +enumeration type 'enum osd_h_exp_ratio' [-Wenum-conversion] + layer_info->h_exp = V_EXP_6_OVER_5; + ~ ^~~~~~~~~~~~~~ +1 warning generated. + +This appears to be a copy and paste error judging from the couple of +lines directly above this statement and the way that height is handled +in the if block above this one. + +Reported-by: Nick Desaulniers +Signed-off-by: Nathan Chancellor +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/davinci/vpbe_display.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/davinci/vpbe_display.c b/drivers/media/platform/davinci/vpbe_display.c +index a9bc0175e4d3d..c839003953a74 100644 +--- a/drivers/media/platform/davinci/vpbe_display.c ++++ b/drivers/media/platform/davinci/vpbe_display.c +@@ -518,7 +518,7 @@ vpbe_disp_calculate_scale_factor(struct vpbe_display *disp_dev, + else if (v_scale == 4) + layer_info->v_zoom = ZOOM_X4; + if (v_exp) +- layer_info->h_exp = V_EXP_6_OVER_5; ++ layer_info->v_exp = V_EXP_6_OVER_5; + } else { + /* no scaling, only cropping. Set display area to crop area */ + cfg->ysize = expected_ysize; +-- +2.20.1 + diff --git a/queue-4.9/media-dvb-fix-compat-ioctl-translation.patch b/queue-4.9/media-dvb-fix-compat-ioctl-translation.patch new file mode 100644 index 00000000000..121c1d16ba6 --- /dev/null +++ b/queue-4.9/media-dvb-fix-compat-ioctl-translation.patch @@ -0,0 +1,82 @@ +From 10738b332054bbd3d74a7099fd7be63c89aa1cfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Aug 2018 15:56:21 -0400 +Subject: media: dvb: fix compat ioctl translation + +From: Arnd Bergmann + +[ Upstream commit 1ccbeeb888ac33627d91f1ccf0b84ef3bcadef24 ] + +The VIDEO_GET_EVENT and VIDEO_STILLPICTURE was added back in 2005 but +it never worked because the command number is wrong. + +Using the right command number means we have a better chance of them +actually doing the right thing, though clearly nobody has ever tried +it successfully. + +I noticed these while auditing the remaining users of compat_time_t +for y2038 bugs. This one is fine in that regard, it just never did +anything. + +Fixes: 6e87abd0b8cb ("[DVB]: Add compat ioctl handling.") + +Signed-off-by: Arnd Bergmann +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + fs/compat_ioctl.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c +index 4b7da4409c60c..5b832e83772a6 100644 +--- a/fs/compat_ioctl.c ++++ b/fs/compat_ioctl.c +@@ -160,6 +160,7 @@ struct compat_video_event { + unsigned int frame_rate; + } u; + }; ++#define VIDEO_GET_EVENT32 _IOR('o', 28, struct compat_video_event) + + static int do_video_get_event(struct file *file, + unsigned int cmd, struct compat_video_event __user *up) +@@ -171,7 +172,7 @@ static int do_video_get_event(struct file *file, + if (kevent == NULL) + return -EFAULT; + +- err = do_ioctl(file, cmd, (unsigned long)kevent); ++ err = do_ioctl(file, VIDEO_GET_EVENT, (unsigned long)kevent); + if (!err) { + err = convert_in_user(&kevent->type, &up->type); + err |= convert_in_user(&kevent->timestamp, &up->timestamp); +@@ -190,6 +191,7 @@ struct compat_video_still_picture { + compat_uptr_t iFrame; + int32_t size; + }; ++#define VIDEO_STILLPICTURE32 _IOW('o', 30, struct compat_video_still_picture) + + static int do_video_stillpicture(struct file *file, + unsigned int cmd, struct compat_video_still_picture __user *up) +@@ -212,7 +214,7 @@ static int do_video_stillpicture(struct file *file, + if (err) + return -EFAULT; + +- err = do_ioctl(file, cmd, (unsigned long) up_native); ++ err = do_ioctl(file, VIDEO_STILLPICTURE, (unsigned long) up_native); + + return err; + } +@@ -1484,9 +1486,9 @@ static long do_ioctl_trans(unsigned int cmd, + return rtc_ioctl(file, cmd, argp); + + /* dvb */ +- case VIDEO_GET_EVENT: ++ case VIDEO_GET_EVENT32: + return do_video_get_event(file, cmd, argp); +- case VIDEO_STILLPICTURE: ++ case VIDEO_STILLPICTURE32: + return do_video_stillpicture(file, cmd, argp); + case VIDEO_SET_SPU_PALETTE: + return do_video_set_spu_palette(file, cmd, argp); +-- +2.20.1 + diff --git a/queue-4.9/media-fix-media-pci-meye-validate-offset-to-avoid-ar.patch b/queue-4.9/media-fix-media-pci-meye-validate-offset-to-avoid-ar.patch new file mode 100644 index 00000000000..e333838041a --- /dev/null +++ b/queue-4.9/media-fix-media-pci-meye-validate-offset-to-avoid-ar.patch @@ -0,0 +1,38 @@ +From b050f096e3ecc5b1881bffc539ef00b591d09da5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jul 2018 08:15:53 -0400 +Subject: media: fix: media: pci: meye: validate offset to avoid arbitrary + access + +From: Lao Wei + +[ Upstream commit eac7230fdb4672c2cb56f6a01a1744f562c01f80 ] + +Motion eye video4linux driver for Sony Vaio PictureBook desn't validate user-controlled parameter +'vma->vm_pgoff', a malicious process might access all of kernel memory from user space by trying +pass different arbitrary address. +Discussion: http://www.openwall.com/lists/oss-security/2018/07/06/1 + +Signed-off-by: Lao Wei +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/meye/meye.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/pci/meye/meye.c b/drivers/media/pci/meye/meye.c +index ba887e8e1b171..a85c5199ccd30 100644 +--- a/drivers/media/pci/meye/meye.c ++++ b/drivers/media/pci/meye/meye.c +@@ -1469,7 +1469,7 @@ static int meye_mmap(struct file *file, struct vm_area_struct *vma) + unsigned long page, pos; + + mutex_lock(&meye.lock); +- if (size > gbuffers * gbufsize) { ++ if (size > gbuffers * gbufsize || offset > gbuffers * gbufsize - size) { + mutex_unlock(&meye.lock); + return -EINVAL; + } +-- +2.20.1 + diff --git a/queue-4.9/media-pci-ivtv-fix-a-sleep-in-atomic-context-bug-in-.patch b/queue-4.9/media-pci-ivtv-fix-a-sleep-in-atomic-context-bug-in-.patch new file mode 100644 index 00000000000..b900a396ed9 --- /dev/null +++ b/queue-4.9/media-pci-ivtv-fix-a-sleep-in-atomic-context-bug-in-.patch @@ -0,0 +1,54 @@ +From e1df996034337b16aa048956973e1a3b530f7999 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Sep 2018 07:44:09 -0400 +Subject: media: pci: ivtv: Fix a sleep-in-atomic-context bug in + ivtv_yuv_init() + +From: Jia-Ju Bai + +[ Upstream commit 8d11eb847de7d89c2754988c944d51a4f63e219b ] + +The driver may sleep in a interrupt handler. + +The function call paths (from bottom to top) in Linux-4.16 are: + +[FUNC] kzalloc(GFP_KERNEL) +drivers/media/pci/ivtv/ivtv-yuv.c, 938: + kzalloc in ivtv_yuv_init +drivers/media/pci/ivtv/ivtv-yuv.c, 960: + ivtv_yuv_init in ivtv_yuv_next_free +drivers/media/pci/ivtv/ivtv-yuv.c, 1126: + ivtv_yuv_next_free in ivtv_yuv_setup_stream_frame +drivers/media/pci/ivtv/ivtv-irq.c, 827: + ivtv_yuv_setup_stream_frame in ivtv_irq_dec_data_req +drivers/media/pci/ivtv/ivtv-irq.c, 1013: + ivtv_irq_dec_data_req in ivtv_irq_handler + +To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC. + +This bug is found by my static analysis tool DSAC. + +Signed-off-by: Jia-Ju Bai +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/ivtv/ivtv-yuv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/pci/ivtv/ivtv-yuv.c b/drivers/media/pci/ivtv/ivtv-yuv.c +index f7299d3d82449..bcb51e87c72f0 100644 +--- a/drivers/media/pci/ivtv/ivtv-yuv.c ++++ b/drivers/media/pci/ivtv/ivtv-yuv.c +@@ -935,7 +935,7 @@ static void ivtv_yuv_init(struct ivtv *itv) + } + + /* We need a buffer for blanking when Y plane is offset - non-fatal if we can't get one */ +- yi->blanking_ptr = kzalloc(720 * 16, GFP_KERNEL|__GFP_NOWARN); ++ yi->blanking_ptr = kzalloc(720 * 16, GFP_ATOMIC|__GFP_NOWARN); + if (yi->blanking_ptr) { + yi->blanking_dmaptr = pci_map_single(itv->pdev, yi->blanking_ptr, 720*16, PCI_DMA_TODEVICE); + } else { +-- +2.20.1 + diff --git a/queue-4.9/mips-bcm47xx-enable-usb-power-on-netgear-wndr3400v3.patch b/queue-4.9/mips-bcm47xx-enable-usb-power-on-netgear-wndr3400v3.patch new file mode 100644 index 00000000000..9748d1661a0 --- /dev/null +++ b/queue-4.9/mips-bcm47xx-enable-usb-power-on-netgear-wndr3400v3.patch @@ -0,0 +1,58 @@ +From b55db85a027c4a9ec53e57adc26637935c4c7958 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Aug 2018 22:20:23 +0300 +Subject: MIPS: BCM47XX: Enable USB power on Netgear WNDR3400v3 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tuomas Tynkkynen + +[ Upstream commit feef7918667b84f9d5653c501542dd8d84ae32af ] + +Setting GPIO 21 high seems to be required to enable power to USB ports +on the WNDR3400v3. As there is already similar code for WNR3500L, +make the existing USB power GPIO code generic and use that. + +Signed-off-by: Tuomas Tynkkynen +Acked-by: Hauke Mehrtens +Signed-off-by: Paul Burton +Patchwork: https://patchwork.linux-mips.org/patch/20259/ +Cc: Rafał Miłecki +Cc: linux-mips@linux-mips.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/mips/bcm47xx/workarounds.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/arch/mips/bcm47xx/workarounds.c b/arch/mips/bcm47xx/workarounds.c +index e81ce4623070e..06fb94370c7c9 100644 +--- a/arch/mips/bcm47xx/workarounds.c ++++ b/arch/mips/bcm47xx/workarounds.c +@@ -4,9 +4,8 @@ + #include + #include + +-static void __init bcm47xx_workarounds_netgear_wnr3500l(void) ++static void __init bcm47xx_workarounds_enable_usb_power(int usb_power) + { +- const int usb_power = 12; + int err; + + err = gpio_request_one(usb_power, GPIOF_OUT_INIT_HIGH, "usb_power"); +@@ -22,7 +21,10 @@ void __init bcm47xx_workarounds(void) + + switch (board) { + case BCM47XX_BOARD_NETGEAR_WNR3500L: +- bcm47xx_workarounds_netgear_wnr3500l(); ++ bcm47xx_workarounds_enable_usb_power(12); ++ break; ++ case BCM47XX_BOARD_NETGEAR_WNDR3400_V3: ++ bcm47xx_workarounds_enable_usb_power(21); + break; + default: + /* No workaround(s) needed */ +-- +2.20.1 + diff --git a/queue-4.9/mips-kexec-relax-memory-restriction.patch b/queue-4.9/mips-kexec-relax-memory-restriction.patch new file mode 100644 index 00000000000..d3a00a3d3f7 --- /dev/null +++ b/queue-4.9/mips-kexec-relax-memory-restriction.patch @@ -0,0 +1,50 @@ +From d897512ba35f0306eff60a5470f05807bb02a1b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Sep 2018 14:49:23 -0700 +Subject: MIPS: kexec: Relax memory restriction + +From: Dengcheng Zhu + +[ Upstream commit a6da4d6fdf8bd512c98d3ac7f1d16bc4bb282919 ] + +We can rely on the system kernel and the dump capture kernel themselves in +memory usage. + +Being restrictive with 512MB limit may cause kexec tool failure on some +platforms. + +Tested-by: Rachel Mozes +Reported-by: Rachel Mozes +Signed-off-by: Dengcheng Zhu +Signed-off-by: Paul Burton +Patchwork: https://patchwork.linux-mips.org/patch/20568/ +Cc: pburton@wavecomp.com +Cc: ralf@linux-mips.org +Cc: linux-mips@linux-mips.org +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/kexec.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/mips/include/asm/kexec.h b/arch/mips/include/asm/kexec.h +index 493a3cc7c39ad..cfdbe66575f4d 100644 +--- a/arch/mips/include/asm/kexec.h ++++ b/arch/mips/include/asm/kexec.h +@@ -12,11 +12,11 @@ + #include + + /* Maximum physical address we can use pages from */ +-#define KEXEC_SOURCE_MEMORY_LIMIT (0x20000000) ++#define KEXEC_SOURCE_MEMORY_LIMIT (-1UL) + /* Maximum address we can reach in physical address mode */ +-#define KEXEC_DESTINATION_MEMORY_LIMIT (0x20000000) ++#define KEXEC_DESTINATION_MEMORY_LIMIT (-1UL) + /* Maximum address we can use for the control code buffer */ +-#define KEXEC_CONTROL_MEMORY_LIMIT (0x20000000) ++#define KEXEC_CONTROL_MEMORY_LIMIT (-1UL) + /* Reserve 3*4096 bytes for board-specific info */ + #define KEXEC_CONTROL_PAGE_SIZE (4096 + 3*4096) + +-- +2.20.1 + diff --git a/queue-4.9/mips-txx9-fix-iounmap-related-issue.patch b/queue-4.9/mips-txx9-fix-iounmap-related-issue.patch new file mode 100644 index 00000000000..32bb1b2929e --- /dev/null +++ b/queue-4.9/mips-txx9-fix-iounmap-related-issue.patch @@ -0,0 +1,47 @@ +From 2098606a59bbe06e0231eabdf73eba48128ac88c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Sep 2018 12:19:19 +0800 +Subject: mips: txx9: fix iounmap related issue + +From: Ding Xiang + +[ Upstream commit c6e1241a82e6e74d1ae5cc34581dab2ffd6022d0 ] + +if device_register return error, iounmap should be called, also iounmap +need to call before put_device. + +Signed-off-by: Ding Xiang +Reviewed-by: Atsushi Nemoto +Signed-off-by: Paul Burton +Patchwork: https://patchwork.linux-mips.org/patch/20476/ +Cc: ralf@linux-mips.org +Cc: jhogan@kernel.org +Cc: linux-mips@linux-mips.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/mips/txx9/generic/setup.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/mips/txx9/generic/setup.c b/arch/mips/txx9/generic/setup.c +index a1d98b5c8fd67..5c53b8aa43d26 100644 +--- a/arch/mips/txx9/generic/setup.c ++++ b/arch/mips/txx9/generic/setup.c +@@ -959,12 +959,11 @@ void __init txx9_sramc_init(struct resource *r) + goto exit_put; + err = sysfs_create_bin_file(&dev->dev.kobj, &dev->bindata_attr); + if (err) { +- device_unregister(&dev->dev); + iounmap(dev->base); +- kfree(dev); ++ device_unregister(&dev->dev); + } + return; + exit_put: ++ iounmap(dev->base); + put_device(&dev->dev); +- return; + } +-- +2.20.1 + diff --git a/queue-4.9/misc-genwqe-should-return-proper-error-value.patch b/queue-4.9/misc-genwqe-should-return-proper-error-value.patch new file mode 100644 index 00000000000..98320ae6b88 --- /dev/null +++ b/queue-4.9/misc-genwqe-should-return-proper-error-value.patch @@ -0,0 +1,82 @@ +From eb3c2f7795b7593370fbe9c57f03a47746fd8f60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Sep 2018 10:29:13 +0800 +Subject: misc: genwqe: should return proper error value. + +From: zhong jiang + +[ Upstream commit 02241995b004faa7d9ff628e97f24056190853f8 ] + +The function should return -EFAULT when copy_from_user fails. Even +though the caller does not distinguish them. but we should keep backward +compatibility. + +Signed-off-by: zhong jiang +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/genwqe/card_utils.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c +index b642b4fd731b6..95584bffa4eaf 100644 +--- a/drivers/misc/genwqe/card_utils.c ++++ b/drivers/misc/genwqe/card_utils.c +@@ -298,7 +298,7 @@ static int genwqe_sgl_size(int num_pages) + int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, + void __user *user_addr, size_t user_size) + { +- int rc; ++ int ret = -ENOMEM; + struct pci_dev *pci_dev = cd->pci_dev; + + sgl->fpage_offs = offset_in_page((unsigned long)user_addr); +@@ -317,7 +317,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, + if (get_order(sgl->sgl_size) > MAX_ORDER) { + dev_err(&pci_dev->dev, + "[%s] err: too much memory requested!\n", __func__); +- return -ENOMEM; ++ return ret; + } + + sgl->sgl = __genwqe_alloc_consistent(cd, sgl->sgl_size, +@@ -325,7 +325,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, + if (sgl->sgl == NULL) { + dev_err(&pci_dev->dev, + "[%s] err: no memory available!\n", __func__); +- return -ENOMEM; ++ return ret; + } + + /* Only use buffering on incomplete pages */ +@@ -338,7 +338,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, + /* Sync with user memory */ + if (copy_from_user(sgl->fpage + sgl->fpage_offs, + user_addr, sgl->fpage_size)) { +- rc = -EFAULT; ++ ret = -EFAULT; + goto err_out; + } + } +@@ -351,7 +351,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, + /* Sync with user memory */ + if (copy_from_user(sgl->lpage, user_addr + user_size - + sgl->lpage_size, sgl->lpage_size)) { +- rc = -EFAULT; ++ ret = -EFAULT; + goto err_out2; + } + } +@@ -373,7 +373,8 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, + sgl->sgl = NULL; + sgl->sgl_dma_addr = 0; + sgl->sgl_size = 0; +- return -ENOMEM; ++ ++ return ret; + } + + int genwqe_setup_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, +-- +2.20.1 + diff --git a/queue-4.9/misc-kgdbts-fix-restrict-error.patch b/queue-4.9/misc-kgdbts-fix-restrict-error.patch new file mode 100644 index 00000000000..07a9a2d19f2 --- /dev/null +++ b/queue-4.9/misc-kgdbts-fix-restrict-error.patch @@ -0,0 +1,75 @@ +From d89bb381be986981fbfcbe1aae47868ed8fc7262 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Sep 2018 10:44:03 -0700 +Subject: misc: kgdbts: Fix restrict error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Laura Abbott + +[ Upstream commit fa0218ef733e6f247a1a3986e3eb12460064ac77 ] + +kgdbts current fails when compiled with restrict: + +drivers/misc/kgdbts.c: In function ‘configure_kgdbts’: +drivers/misc/kgdbts.c:1070:2: error: ‘strcpy’ source argument is the same as destination [-Werror=restrict] + strcpy(config, opt); + ^~~~~~~~~~~~~~~~~~~ + +As the error says, config is being used in both the source and destination. +Refactor the code to avoid the extra copy and put the parsing closer to +the actual location. + +Signed-off-by: Laura Abbott +Acked-by: Daniel Thompson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/kgdbts.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c +index bb3a76ad80da2..fc8cb855c6e66 100644 +--- a/drivers/misc/kgdbts.c ++++ b/drivers/misc/kgdbts.c +@@ -979,6 +979,12 @@ static void kgdbts_run_tests(void) + int nmi_sleep = 0; + int i; + ++ verbose = 0; ++ if (strstr(config, "V1")) ++ verbose = 1; ++ if (strstr(config, "V2")) ++ verbose = 2; ++ + ptr = strchr(config, 'F'); + if (ptr) + fork_test = simple_strtol(ptr + 1, NULL, 10); +@@ -1062,13 +1068,6 @@ static int kgdbts_option_setup(char *opt) + return -ENOSPC; + } + strcpy(config, opt); +- +- verbose = 0; +- if (strstr(config, "V1")) +- verbose = 1; +- if (strstr(config, "V2")) +- verbose = 2; +- + return 0; + } + +@@ -1080,9 +1079,6 @@ static int configure_kgdbts(void) + + if (!strlen(config) || isspace(config[0])) + goto noconfig; +- err = kgdbts_option_setup(config); +- if (err) +- goto noconfig; + + final_ack = 0; + run_plant_and_detach_test(1); +-- +2.20.1 + diff --git a/queue-4.9/mlxsw-spectrum-init-shaper-for-tcs-8.15.patch b/queue-4.9/mlxsw-spectrum-init-shaper-for-tcs-8.15.patch new file mode 100644 index 00000000000..3e40bf7008d --- /dev/null +++ b/queue-4.9/mlxsw-spectrum-init-shaper-for-tcs-8.15.patch @@ -0,0 +1,48 @@ +From 26173c5e0377850a6f9d0d32b8f58b036ed841f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Sep 2018 09:21:24 +0300 +Subject: mlxsw: spectrum: Init shaper for TCs 8..15 + +From: Petr Machata + +[ Upstream commit a9f36656b519a9a21309793c306941a3cd0eeb8f ] + +With introduction of MC-aware mode to mlxsw, it became necessary to +configure TCs above 7 as well. There is now code in mlxsw to disable ETS +for these higher classes, but disablement of max shaper was neglected. + +By default, max shaper is currently disabled to begin with, so the +problem is just cosmetic. However, for symmetry, do like we do for ETS +configuration, and call mlxsw_sp_port_ets_maxrate_set() for both TC i +and i + 8. + +Signed-off-by: Petr Machata +Reviewed-by: Jiri Pirko +Signed-off-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +index 585a40cc6470b..8460c4807567c 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +@@ -2191,6 +2191,13 @@ static int mlxsw_sp_port_ets_init(struct mlxsw_sp_port *mlxsw_sp_port) + MLXSW_REG_QEEC_MAS_DIS); + if (err) + return err; ++ ++ err = mlxsw_sp_port_ets_maxrate_set(mlxsw_sp_port, ++ MLXSW_REG_QEEC_HIERARCY_TC, ++ i + 8, i, ++ MLXSW_REG_QEEC_MAS_DIS); ++ if (err) ++ return err; + } + + /* Map all priorities to traffic class 0. */ +-- +2.20.1 + diff --git a/queue-4.9/net-amd-fix-return-type-of-ndo_start_xmit-function.patch b/queue-4.9/net-amd-fix-return-type-of-ndo_start_xmit-function.patch new file mode 100644 index 00000000000..c1d9120dcb8 --- /dev/null +++ b/queue-4.9/net-amd-fix-return-type-of-ndo_start_xmit-function.patch @@ -0,0 +1,140 @@ +From 19a29a3705ed8f25602dc7ebeb6b3351b5436f68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Sep 2018 18:50:17 +0800 +Subject: net: amd: fix return type of ndo_start_xmit function + +From: YueHaibing + +[ Upstream commit fe72352e37ae8478f4c97975a9831f0c50f22e73 ] + +The method ndo_start_xmit() is defined as returning an 'netdev_tx_t', +which is a typedef for an enum type, so make sure the implementation in +this driver has returns 'netdev_tx_t' value, and change the function +return type to netdev_tx_t. + +Found by coccinelle. + +Signed-off-by: YueHaibing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/am79c961a.c | 2 +- + drivers/net/ethernet/amd/atarilance.c | 6 ++++-- + drivers/net/ethernet/amd/declance.c | 2 +- + drivers/net/ethernet/amd/sun3lance.c | 6 ++++-- + drivers/net/ethernet/amd/sunlance.c | 2 +- + drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 4 ++-- + 6 files changed, 13 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/amd/am79c961a.c b/drivers/net/ethernet/amd/am79c961a.c +index fcdf5dda448f9..77d99c532917c 100644 +--- a/drivers/net/ethernet/amd/am79c961a.c ++++ b/drivers/net/ethernet/amd/am79c961a.c +@@ -440,7 +440,7 @@ static void am79c961_timeout(struct net_device *dev) + /* + * Transmit a packet + */ +-static int ++static netdev_tx_t + am79c961_sendpacket(struct sk_buff *skb, struct net_device *dev) + { + struct dev_priv *priv = netdev_priv(dev); +diff --git a/drivers/net/ethernet/amd/atarilance.c b/drivers/net/ethernet/amd/atarilance.c +index d2bc8e5dcd23b..35a9f252ceb6c 100644 +--- a/drivers/net/ethernet/amd/atarilance.c ++++ b/drivers/net/ethernet/amd/atarilance.c +@@ -339,7 +339,8 @@ static unsigned long lance_probe1( struct net_device *dev, struct lance_addr + *init_rec ); + static int lance_open( struct net_device *dev ); + static void lance_init_ring( struct net_device *dev ); +-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev ); ++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, ++ struct net_device *dev); + static irqreturn_t lance_interrupt( int irq, void *dev_id ); + static int lance_rx( struct net_device *dev ); + static int lance_close( struct net_device *dev ); +@@ -770,7 +771,8 @@ static void lance_tx_timeout (struct net_device *dev) + + /* XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX */ + +-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev ) ++static netdev_tx_t ++lance_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct lance_private *lp = netdev_priv(dev); + struct lance_ioreg *IO = lp->iobase; +diff --git a/drivers/net/ethernet/amd/declance.c b/drivers/net/ethernet/amd/declance.c +index 9e80a76c3dfe1..76393ae4cf0aa 100644 +--- a/drivers/net/ethernet/amd/declance.c ++++ b/drivers/net/ethernet/amd/declance.c +@@ -893,7 +893,7 @@ static void lance_tx_timeout(struct net_device *dev) + netif_wake_queue(dev); + } + +-static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct lance_private *lp = netdev_priv(dev); + volatile struct lance_regs *ll = lp->ll; +diff --git a/drivers/net/ethernet/amd/sun3lance.c b/drivers/net/ethernet/amd/sun3lance.c +index 3d8c6b2cdea4c..09271665712da 100644 +--- a/drivers/net/ethernet/amd/sun3lance.c ++++ b/drivers/net/ethernet/amd/sun3lance.c +@@ -235,7 +235,8 @@ struct lance_private { + static int lance_probe( struct net_device *dev); + static int lance_open( struct net_device *dev ); + static void lance_init_ring( struct net_device *dev ); +-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev ); ++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, ++ struct net_device *dev); + static irqreturn_t lance_interrupt( int irq, void *dev_id); + static int lance_rx( struct net_device *dev ); + static int lance_close( struct net_device *dev ); +@@ -511,7 +512,8 @@ static void lance_init_ring( struct net_device *dev ) + } + + +-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev ) ++static netdev_tx_t ++lance_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct lance_private *lp = netdev_priv(dev); + int entry, len; +diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c +index 3153465d4d02f..acbbe4e5a2f8c 100644 +--- a/drivers/net/ethernet/amd/sunlance.c ++++ b/drivers/net/ethernet/amd/sunlance.c +@@ -1106,7 +1106,7 @@ static void lance_tx_timeout(struct net_device *dev) + netif_wake_queue(dev); + } + +-static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct lance_private *lp = netdev_priv(dev); + int entry, skblen, len; +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +index 1e4e8b245cd55..1df7f5da8411f 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +@@ -1390,7 +1390,7 @@ static int xgbe_close(struct net_device *netdev) + return 0; + } + +-static int xgbe_xmit(struct sk_buff *skb, struct net_device *netdev) ++static netdev_tx_t xgbe_xmit(struct sk_buff *skb, struct net_device *netdev) + { + struct xgbe_prv_data *pdata = netdev_priv(netdev); + struct xgbe_hw_if *hw_if = &pdata->hw_if; +@@ -1399,7 +1399,7 @@ static int xgbe_xmit(struct sk_buff *skb, struct net_device *netdev) + struct xgbe_ring *ring; + struct xgbe_packet_data *packet; + struct netdev_queue *txq; +- int ret; ++ netdev_tx_t ret; + + DBGPR("-->xgbe_xmit: skb->len = %d\n", skb->len); + +-- +2.20.1 + diff --git a/queue-4.9/net-broadcom-fix-return-type-of-ndo_start_xmit-funct.patch b/queue-4.9/net-broadcom-fix-return-type-of-ndo_start_xmit-funct.patch new file mode 100644 index 00000000000..8e7277bdf53 --- /dev/null +++ b/queue-4.9/net-broadcom-fix-return-type-of-ndo_start_xmit-funct.patch @@ -0,0 +1,69 @@ +From 0df62b5f995c26b1ccce48a7f3ba25c5e624b194 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Sep 2018 18:45:12 +0800 +Subject: net: broadcom: fix return type of ndo_start_xmit function + +From: YueHaibing + +[ Upstream commit 0c13b8d1aee87c35a2fbc1d85a1f766227cf54b5 ] + +The method ndo_start_xmit() is defined as returning an 'netdev_tx_t', +which is a typedef for an enum type, so make sure the implementation in +this driver has returns 'netdev_tx_t' value, and change the function +return type to netdev_tx_t. + +Found by coccinelle. + +Signed-off-by: YueHaibing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bcm63xx_enet.c | 5 +++-- + drivers/net/ethernet/broadcom/sb1250-mac.c | 4 ++-- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c +index c4078401b7ded..900f2f706cbc7 100644 +--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c ++++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c +@@ -571,12 +571,13 @@ static irqreturn_t bcm_enet_isr_dma(int irq, void *dev_id) + /* + * tx request callback + */ +-static int bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t ++bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct bcm_enet_priv *priv; + struct bcm_enet_desc *desc; + u32 len_stat; +- int ret; ++ netdev_tx_t ret; + + priv = netdev_priv(dev); + +diff --git a/drivers/net/ethernet/broadcom/sb1250-mac.c b/drivers/net/ethernet/broadcom/sb1250-mac.c +index f1b81187a2010..dc7953894c351 100644 +--- a/drivers/net/ethernet/broadcom/sb1250-mac.c ++++ b/drivers/net/ethernet/broadcom/sb1250-mac.c +@@ -299,7 +299,7 @@ static enum sbmac_state sbmac_set_channel_state(struct sbmac_softc *, + static void sbmac_promiscuous_mode(struct sbmac_softc *sc, int onoff); + static uint64_t sbmac_addr2reg(unsigned char *ptr); + static irqreturn_t sbmac_intr(int irq, void *dev_instance); +-static int sbmac_start_tx(struct sk_buff *skb, struct net_device *dev); ++static netdev_tx_t sbmac_start_tx(struct sk_buff *skb, struct net_device *dev); + static void sbmac_setmulti(struct sbmac_softc *sc); + static int sbmac_init(struct platform_device *pldev, long long base); + static int sbmac_set_speed(struct sbmac_softc *s, enum sbmac_speed speed); +@@ -2032,7 +2032,7 @@ static irqreturn_t sbmac_intr(int irq,void *dev_instance) + * Return value: + * nothing + ********************************************************************* */ +-static int sbmac_start_tx(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t sbmac_start_tx(struct sk_buff *skb, struct net_device *dev) + { + struct sbmac_softc *sc = netdev_priv(dev); + unsigned long flags; +-- +2.20.1 + diff --git a/queue-4.9/net-lan78xx-bail-out-if-lan78xx_get_endpoints-fails.patch b/queue-4.9/net-lan78xx-bail-out-if-lan78xx_get_endpoints-fails.patch new file mode 100644 index 00000000000..0463e2cc135 --- /dev/null +++ b/queue-4.9/net-lan78xx-bail-out-if-lan78xx_get_endpoints-fails.patch @@ -0,0 +1,40 @@ +From cf68edc263545119215701cca8a3626b8941ce83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Sep 2018 19:29:09 +0200 +Subject: net: lan78xx: Bail out if lan78xx_get_endpoints fails + +From: Stefan Wahren + +[ Upstream commit fa8cd98c06407b5798b927cd7fd14d30f360ed02 ] + +We need to bail out if lan78xx_get_endpoints() fails, otherwise the +result is overwritten. + +Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet") +Signed-off-by: Stefan Wahren +Reviewed-by: Raghuram Chary Jallipalli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index e143a7fe93201..a3f9d8f05db4a 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -2621,6 +2621,11 @@ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf) + int i; + + ret = lan78xx_get_endpoints(dev, intf); ++ if (ret) { ++ netdev_warn(dev->net, "lan78xx_get_endpoints failed: %d\n", ++ ret); ++ return ret; ++ } + + dev->data[0] = (unsigned long)kzalloc(sizeof(*pdata), GFP_KERNEL); + +-- +2.20.1 + diff --git a/queue-4.9/net-micrel-fix-return-type-of-ndo_start_xmit-functio.patch b/queue-4.9/net-micrel-fix-return-type-of-ndo_start_xmit-functio.patch new file mode 100644 index 00000000000..d705c58edf0 --- /dev/null +++ b/queue-4.9/net-micrel-fix-return-type-of-ndo_start_xmit-functio.patch @@ -0,0 +1,56 @@ +From 495aa6076b75dcddb210c2b0a0284f229792a531 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Sep 2018 10:42:15 +0800 +Subject: net: micrel: fix return type of ndo_start_xmit function + +From: YueHaibing + +[ Upstream commit 2b49117a5abee8478b0470cba46ac74f93b4a479 ] + +The method ndo_start_xmit() is defined as returning an 'netdev_tx_t', +which is a typedef for an enum type, so make sure the implementation in +this driver has returns 'netdev_tx_t' value, and change the function +return type to netdev_tx_t. + +Found by coccinelle. + +Signed-off-by: YueHaibing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/micrel/ks8695net.c | 2 +- + drivers/net/ethernet/micrel/ks8851_mll.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/micrel/ks8695net.c b/drivers/net/ethernet/micrel/ks8695net.c +index 20cb85bc0c5f8..6135d90f368fa 100644 +--- a/drivers/net/ethernet/micrel/ks8695net.c ++++ b/drivers/net/ethernet/micrel/ks8695net.c +@@ -1156,7 +1156,7 @@ ks8695_timeout(struct net_device *ndev) + * sk_buff and adds it to the TX ring. It then kicks the TX DMA + * engine to ensure transmission begins. + */ +-static int ++static netdev_tx_t + ks8695_start_xmit(struct sk_buff *skb, struct net_device *ndev) + { + struct ks8695_priv *ksp = netdev_priv(ndev); +diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c +index 2fc5cd56c0a84..8dc1f0277117d 100644 +--- a/drivers/net/ethernet/micrel/ks8851_mll.c ++++ b/drivers/net/ethernet/micrel/ks8851_mll.c +@@ -1020,9 +1020,9 @@ static void ks_write_qmu(struct ks_net *ks, u8 *pdata, u16 len) + * spin_lock_irqsave is required because tx and rx should be mutual exclusive. + * So while tx is in-progress, prevent IRQ interrupt from happenning. + */ +-static int ks_start_xmit(struct sk_buff *skb, struct net_device *netdev) ++static netdev_tx_t ks_start_xmit(struct sk_buff *skb, struct net_device *netdev) + { +- int retv = NETDEV_TX_OK; ++ netdev_tx_t retv = NETDEV_TX_OK; + struct ks_net *ks = netdev_priv(netdev); + + disable_irq(netdev->irq); +-- +2.20.1 + diff --git a/queue-4.9/net-smsc-fix-return-type-of-ndo_start_xmit-function.patch b/queue-4.9/net-smsc-fix-return-type-of-ndo_start_xmit-function.patch new file mode 100644 index 00000000000..693bfeec755 --- /dev/null +++ b/queue-4.9/net-smsc-fix-return-type-of-ndo_start_xmit-function.patch @@ -0,0 +1,70 @@ +From abbb4964a0693bf48af063405b0ac71e0fd44581 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Sep 2018 17:06:29 +0800 +Subject: net: smsc: fix return type of ndo_start_xmit function + +From: YueHaibing + +[ Upstream commit 6323d57f335ce1490d025cacc83fc10b07792130 ] + +The method ndo_start_xmit() is defined as returning an 'netdev_tx_t', +which is a typedef for an enum type, so make sure the implementation in +this driver has returns 'netdev_tx_t' value, and change the function +return type to netdev_tx_t. + +Found by coccinelle. + +Signed-off-by: YueHaibing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/smsc/smc911x.c | 3 ++- + drivers/net/ethernet/smsc/smc91x.c | 3 ++- + drivers/net/ethernet/smsc/smsc911x.c | 3 ++- + 3 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c +index cb49c9654f0a7..323b3ac16bc0e 100644 +--- a/drivers/net/ethernet/smsc/smc911x.c ++++ b/drivers/net/ethernet/smsc/smc911x.c +@@ -514,7 +514,8 @@ static void smc911x_hardware_send_pkt(struct net_device *dev) + * now, or set the card to generates an interrupt when ready + * for the packet. + */ +-static int smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t ++smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct smc911x_local *lp = netdev_priv(dev); + unsigned int free; +diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c +index 73212590d04a3..b0c72167badec 100644 +--- a/drivers/net/ethernet/smsc/smc91x.c ++++ b/drivers/net/ethernet/smsc/smc91x.c +@@ -637,7 +637,8 @@ done: if (!THROTTLE_TX_PKTS) + * now, or set the card to generates an interrupt when ready + * for the packet. + */ +-static int smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t ++smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct smc_local *lp = netdev_priv(dev); + void __iomem *ioaddr = lp->base; +diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c +index 734caa7a557be..4143659615e10 100644 +--- a/drivers/net/ethernet/smsc/smsc911x.c ++++ b/drivers/net/ethernet/smsc/smsc911x.c +@@ -1776,7 +1776,8 @@ static int smsc911x_stop(struct net_device *dev) + } + + /* Entry point for transmitting a packet */ +-static int smsc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t ++smsc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct smsc911x_data *pdata = netdev_priv(dev); + unsigned int freespace; +-- +2.20.1 + diff --git a/queue-4.9/net-toshiba-fix-return-type-of-ndo_start_xmit-functi.patch b/queue-4.9/net-toshiba-fix-return-type-of-ndo_start_xmit-functi.patch new file mode 100644 index 00000000000..26fc29c6f5e --- /dev/null +++ b/queue-4.9/net-toshiba-fix-return-type-of-ndo_start_xmit-functi.patch @@ -0,0 +1,98 @@ +From 174c9e0bfe5c4ac6a3d52325a778664366801df6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Sep 2018 18:23:39 +0800 +Subject: net: toshiba: fix return type of ndo_start_xmit function + +From: YueHaibing + +[ Upstream commit bacade822524e02f662d88f784d2ae821a5546fb ] + +The method ndo_start_xmit() is defined as returning an 'netdev_tx_t', +which is a typedef for an enum type, so make sure the implementation in +this driver has returns 'netdev_tx_t' value, and change the function +return type to netdev_tx_t. + +Found by coccinelle. + +Signed-off-by: YueHaibing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/toshiba/ps3_gelic_net.c | 4 ++-- + drivers/net/ethernet/toshiba/ps3_gelic_net.h | 2 +- + drivers/net/ethernet/toshiba/spider_net.c | 4 ++-- + drivers/net/ethernet/toshiba/tc35815.c | 6 ++++-- + 4 files changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.c b/drivers/net/ethernet/toshiba/ps3_gelic_net.c +index 272f2b1cb7add..34f8437955310 100644 +--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.c ++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.c +@@ -845,9 +845,9 @@ static int gelic_card_kick_txdma(struct gelic_card *card, + * @skb: packet to send out + * @netdev: interface device structure + * +- * returns 0 on success, <0 on failure ++ * returns NETDEV_TX_OK on success, NETDEV_TX_BUSY on failure + */ +-int gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev) ++netdev_tx_t gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev) + { + struct gelic_card *card = netdev_card(netdev); + struct gelic_descr *descr; +diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.h b/drivers/net/ethernet/toshiba/ps3_gelic_net.h +index 8505196be9f52..d123644bd720b 100644 +--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.h ++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.h +@@ -370,7 +370,7 @@ void gelic_card_up(struct gelic_card *card); + void gelic_card_down(struct gelic_card *card); + int gelic_net_open(struct net_device *netdev); + int gelic_net_stop(struct net_device *netdev); +-int gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev); ++netdev_tx_t gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev); + void gelic_net_set_multi(struct net_device *netdev); + void gelic_net_tx_timeout(struct net_device *netdev); + int gelic_net_change_mtu(struct net_device *netdev, int new_mtu); +diff --git a/drivers/net/ethernet/toshiba/spider_net.c b/drivers/net/ethernet/toshiba/spider_net.c +index 36a6e8b54d941..1085987946212 100644 +--- a/drivers/net/ethernet/toshiba/spider_net.c ++++ b/drivers/net/ethernet/toshiba/spider_net.c +@@ -880,9 +880,9 @@ out: + * @skb: packet to send out + * @netdev: interface device structure + * +- * returns 0 on success, !0 on failure ++ * returns NETDEV_TX_OK on success, NETDEV_TX_BUSY on failure + */ +-static int ++static netdev_tx_t + spider_net_xmit(struct sk_buff *skb, struct net_device *netdev) + { + int cnt; +diff --git a/drivers/net/ethernet/toshiba/tc35815.c b/drivers/net/ethernet/toshiba/tc35815.c +index 47ebac456ae57..9b84ee736fdc1 100644 +--- a/drivers/net/ethernet/toshiba/tc35815.c ++++ b/drivers/net/ethernet/toshiba/tc35815.c +@@ -474,7 +474,8 @@ static void free_rxbuf_skb(struct pci_dev *hwdev, struct sk_buff *skb, dma_addr_ + /* Index to functions, as function prototypes. */ + + static int tc35815_open(struct net_device *dev); +-static int tc35815_send_packet(struct sk_buff *skb, struct net_device *dev); ++static netdev_tx_t tc35815_send_packet(struct sk_buff *skb, ++ struct net_device *dev); + static irqreturn_t tc35815_interrupt(int irq, void *dev_id); + static int tc35815_rx(struct net_device *dev, int limit); + static int tc35815_poll(struct napi_struct *napi, int budget); +@@ -1249,7 +1250,8 @@ tc35815_open(struct net_device *dev) + * invariant will hold if you make sure that the netif_*_queue() + * calls are done at the proper times. + */ +-static int tc35815_send_packet(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t ++tc35815_send_packet(struct sk_buff *skb, struct net_device *dev) + { + struct tc35815_local *lp = netdev_priv(dev); + struct TxFD *txfd; +-- +2.20.1 + diff --git a/queue-4.9/net-xilinx-fix-return-type-of-ndo_start_xmit-functio.patch b/queue-4.9/net-xilinx-fix-return-type-of-ndo_start_xmit-functio.patch new file mode 100644 index 00000000000..f6d1cf5c993 --- /dev/null +++ b/queue-4.9/net-xilinx-fix-return-type-of-ndo_start_xmit-functio.patch @@ -0,0 +1,91 @@ +From 949ebc121caaf97312af01bb5886ad42ae00f6e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Sep 2018 18:32:40 +0800 +Subject: net: xilinx: fix return type of ndo_start_xmit function + +From: YueHaibing + +[ Upstream commit 81255af8d9d5565004792c295dde49344df450ca ] + +The method ndo_start_xmit() is defined as returning an 'netdev_tx_t', +which is a typedef for an enum type, so make sure the implementation in +this driver has returns 'netdev_tx_t' value, and change the function +return type to netdev_tx_t. + +Found by coccinelle. + +Signed-off-by: YueHaibing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/xilinx/ll_temac_main.c | 3 ++- + drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 3 ++- + drivers/net/ethernet/xilinx/xilinx_emaclite.c | 9 +++++---- + 3 files changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c +index a9bd665fd1225..545f60877bb7d 100644 +--- a/drivers/net/ethernet/xilinx/ll_temac_main.c ++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c +@@ -673,7 +673,8 @@ static inline int temac_check_tx_bd_space(struct temac_local *lp, int num_frag) + return 0; + } + +-static int temac_start_xmit(struct sk_buff *skb, struct net_device *ndev) ++static netdev_tx_t ++temac_start_xmit(struct sk_buff *skb, struct net_device *ndev) + { + struct temac_local *lp = netdev_priv(ndev); + struct cdmac_bd *cur_p; +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +index 5f21ddff9e0f9..46fcf3ec2caf7 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -655,7 +655,8 @@ static inline int axienet_check_tx_bd_space(struct axienet_local *lp, + * start the transmission. Additionally if checksum offloading is supported, + * it populates AXI Stream Control fields with appropriate values. + */ +-static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev) ++static netdev_tx_t ++axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev) + { + u32 ii; + u32 num_frag; +diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c +index aa02a03a6d8db..034b36442ee75 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c ++++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c +@@ -1005,9 +1005,10 @@ static int xemaclite_close(struct net_device *dev) + * deferred and the Tx queue is stopped so that the deferred socket buffer can + * be transmitted when the Emaclite device is free to transmit data. + * +- * Return: 0, always. ++ * Return: NETDEV_TX_OK, always. + */ +-static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev) ++static netdev_tx_t ++xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev) + { + struct net_local *lp = netdev_priv(dev); + struct sk_buff *new_skb; +@@ -1028,7 +1029,7 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev) + /* Take the time stamp now, since we can't do this in an ISR. */ + skb_tx_timestamp(new_skb); + spin_unlock_irqrestore(&lp->reset_lock, flags); +- return 0; ++ return NETDEV_TX_OK; + } + spin_unlock_irqrestore(&lp->reset_lock, flags); + +@@ -1037,7 +1038,7 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev) + dev->stats.tx_bytes += len; + dev_consume_skb_any(new_skb); + +- return 0; ++ return NETDEV_TX_OK; + } + + /** +-- +2.20.1 + diff --git a/queue-4.9/nvmem-core-return-error-code-instead-of-null-from-nv.patch b/queue-4.9/nvmem-core-return-error-code-instead-of-null-from-nv.patch new file mode 100644 index 00000000000..7a3f91eb425 --- /dev/null +++ b/queue-4.9/nvmem-core-return-error-code-instead-of-null-from-nv.patch @@ -0,0 +1,36 @@ +From 83c7f0d1762368cdcedfc544cbcf98744413fdff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Aug 2018 13:19:35 +0100 +Subject: nvmem: core: return error code instead of NULL from nvmem_device_get + +From: Srinivas Kandagatla + +[ Upstream commit ca6ac25cecf0e740d7cc8e03e0ebbf8acbeca3df ] + +nvmem_device_get() should return ERR_PTR() on error or valid pointer +on success, but one of the code path seems to return NULL, so fix it. + +Reported-by: Niklas Cassel +Signed-off-by: Srinivas Kandagatla +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/nvmem/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c +index 9ca24e4d5d49c..2a0c5f3b0e509 100644 +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -609,7 +609,7 @@ static struct nvmem_device *nvmem_find(const char *name) + d = bus_find_device(&nvmem_bus_type, NULL, (void *)name, nvmem_match); + + if (!d) +- return NULL; ++ return ERR_PTR(-ENOENT); + + return to_nvmem_device(d); + } +-- +2.20.1 + diff --git a/queue-4.9/of-make-powermac-cache-node-search-conditional-on-co.patch b/queue-4.9/of-make-powermac-cache-node-search-conditional-on-co.patch new file mode 100644 index 00000000000..2a39106e58a --- /dev/null +++ b/queue-4.9/of-make-powermac-cache-node-search-conditional-on-co.patch @@ -0,0 +1,34 @@ +From 8fede1071acfe65d0cc382f5173268d8f371fed4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Aug 2018 09:50:09 -0500 +Subject: of: make PowerMac cache node search conditional on CONFIG_PPC_PMAC + +From: Rob Herring + +[ Upstream commit f6707fd6241e483f6fea2caae82d876e422bb11a ] + +Cache nodes under the cpu node(s) is PowerMac specific according to the +comment above, so make the code enforce that. + +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/of/base.c b/drivers/of/base.c +index f366af135d5b7..c66cdc4307fd7 100644 +--- a/drivers/of/base.c ++++ b/drivers/of/base.c +@@ -2281,7 +2281,7 @@ struct device_node *of_find_next_cache_node(const struct device_node *np) + /* OF on pmac has nodes instead of properties named "l2-cache" + * beneath CPU nodes. + */ +- if (!strcmp(np->type, "cpu")) ++ if (IS_ENABLED(CONFIG_PPC_PMAC) && !strcmp(np->type, "cpu")) + for_each_child_of_node(np, child) + if (!strcmp(child->type, "cache")) + return child; +-- +2.20.1 + diff --git a/queue-4.9/pci-acpi-correct-error-message-for-aspm-disabling.patch b/queue-4.9/pci-acpi-correct-error-message-for-aspm-disabling.patch new file mode 100644 index 00000000000..26dccb5ada4 --- /dev/null +++ b/queue-4.9/pci-acpi-correct-error-message-for-aspm-disabling.patch @@ -0,0 +1,43 @@ +From f9917be3f66506a40b5c087d5662e03054a187f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Aug 2018 04:32:11 +0000 +Subject: PCI/ACPI: Correct error message for ASPM disabling + +From: Sinan Kaya + +[ Upstream commit 1ad61b612b95980a4d970c52022aa01dfc0f6068 ] + +If _OSC execution fails today for platforms without an _OSC entry, code is +printing a misleading message saying disabling ASPM as follows: + + acpi PNP0A03:00: _OSC failed (AE_NOT_FOUND); disabling ASPM + +We need to ensure that platform supports ASPM to begin with. + +Reported-by: Michael Kelley +Signed-off-by: Sinan Kaya +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/acpi/pci_root.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c +index b66815f35be6b..317ecc2e5757b 100644 +--- a/drivers/acpi/pci_root.c ++++ b/drivers/acpi/pci_root.c +@@ -454,8 +454,9 @@ static void negotiate_os_control(struct acpi_pci_root *root, int *no_aspm) + decode_osc_support(root, "OS supports", support); + status = acpi_pci_osc_support(root, support); + if (ACPI_FAILURE(status)) { +- dev_info(&device->dev, "_OSC failed (%s); disabling ASPM\n", +- acpi_format_exception(status)); ++ dev_info(&device->dev, "_OSC failed (%s)%s\n", ++ acpi_format_exception(status), ++ pcie_aspm_support_enabled() ? "; disabling ASPM" : ""); + *no_aspm = 1; + return; + } +-- +2.20.1 + diff --git a/queue-4.9/phy-phy-twl4030-usb-fix-denied-runtime-access.patch b/queue-4.9/phy-phy-twl4030-usb-fix-denied-runtime-access.patch new file mode 100644 index 00000000000..8f1e62a3208 --- /dev/null +++ b/queue-4.9/phy-phy-twl4030-usb-fix-denied-runtime-access.patch @@ -0,0 +1,81 @@ +From 74644614b69a5052a0367609885b26f73a2c90a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Sep 2018 11:44:05 +0200 +Subject: phy: phy-twl4030-usb: fix denied runtime access + +From: Andreas Kemnade + +[ Upstream commit 6c7103aa026094a4ee2c2708ec6977a6dfc5331d ] + +When runtime is not enabled, pm_runtime_get_sync() returns -EACCESS, +the counter will be incremented but the resume callback not called, +so enumeration and charging will not start properly. +To avoid that happen, disable irq on suspend and recheck on resume. + +Practically this happens when the device is woken up from suspend by +plugging in usb. + +Signed-off-by: Andreas Kemnade +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Sasha Levin +--- + drivers/phy/phy-twl4030-usb.c | 29 +++++++++++++++++++++++++++++ + 1 file changed, 29 insertions(+) + +diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c +index 547ca7b3f0985..ddb530ee2255c 100644 +--- a/drivers/phy/phy-twl4030-usb.c ++++ b/drivers/phy/phy-twl4030-usb.c +@@ -144,6 +144,7 @@ + #define PMBR1 0x0D + #define GPIO_USB_4PIN_ULPI_2430C (3 << 0) + ++static irqreturn_t twl4030_usb_irq(int irq, void *_twl); + /* + * If VBUS is valid or ID is ground, then we know a + * cable is present and we need to be runtime-enabled +@@ -392,6 +393,33 @@ static void __twl4030_phy_power(struct twl4030_usb *twl, int on) + WARN_ON(twl4030_usb_write_verify(twl, PHY_PWR_CTRL, pwr) < 0); + } + ++static int __maybe_unused twl4030_usb_suspend(struct device *dev) ++{ ++ struct twl4030_usb *twl = dev_get_drvdata(dev); ++ ++ /* ++ * we need enabled runtime on resume, ++ * so turn irq off here, so we do not get it early ++ * note: wakeup on usb plug works independently of this ++ */ ++ dev_dbg(twl->dev, "%s\n", __func__); ++ disable_irq(twl->irq); ++ ++ return 0; ++} ++ ++static int __maybe_unused twl4030_usb_resume(struct device *dev) ++{ ++ struct twl4030_usb *twl = dev_get_drvdata(dev); ++ ++ dev_dbg(twl->dev, "%s\n", __func__); ++ enable_irq(twl->irq); ++ /* check whether cable status changed */ ++ twl4030_usb_irq(0, twl); ++ ++ return 0; ++} ++ + static int __maybe_unused twl4030_usb_runtime_suspend(struct device *dev) + { + struct twl4030_usb *twl = dev_get_drvdata(dev); +@@ -652,6 +680,7 @@ static const struct phy_ops ops = { + static const struct dev_pm_ops twl4030_usb_pm_ops = { + SET_RUNTIME_PM_OPS(twl4030_usb_runtime_suspend, + twl4030_usb_runtime_resume, NULL) ++ SET_SYSTEM_SLEEP_PM_OPS(twl4030_usb_suspend, twl4030_usb_resume) + }; + + static int twl4030_usb_probe(struct platform_device *pdev) +-- +2.20.1 + diff --git a/queue-4.9/pinctrl-at91-don-t-use-the-same-irqchip-with-multipl.patch b/queue-4.9/pinctrl-at91-don-t-use-the-same-irqchip-with-multipl.patch new file mode 100644 index 00000000000..009edc7d796 --- /dev/null +++ b/queue-4.9/pinctrl-at91-don-t-use-the-same-irqchip-with-multipl.patch @@ -0,0 +1,88 @@ +From 46377165febb4d8035dc084dc39710c9a9381553 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Sep 2018 14:42:13 +0200 +Subject: pinctrl: at91: don't use the same irqchip with multiple gpiochips + +From: Ludovic Desroches + +[ Upstream commit 0c3dfa176912b5f87732545598200fb55e9c1978 ] + +Sharing the same irqchip with multiple gpiochips is not a good +practice. For instance, when installing hooks, we change the state +of the irqchip. The initial state of the irqchip for the second +gpiochip to register is then disrupted. + +Signed-off-by: Ludovic Desroches +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-at91.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c +index 9f09041859099..9401a0630e80b 100644 +--- a/drivers/pinctrl/pinctrl-at91.c ++++ b/drivers/pinctrl/pinctrl-at91.c +@@ -1545,16 +1545,6 @@ void at91_pinctrl_gpio_resume(void) + #define gpio_irq_set_wake NULL + #endif /* CONFIG_PM */ + +-static struct irq_chip gpio_irqchip = { +- .name = "GPIO", +- .irq_ack = gpio_irq_ack, +- .irq_disable = gpio_irq_mask, +- .irq_mask = gpio_irq_mask, +- .irq_unmask = gpio_irq_unmask, +- /* .irq_set_type is set dynamically */ +- .irq_set_wake = gpio_irq_set_wake, +-}; +- + static void gpio_irq_handler(struct irq_desc *desc) + { + struct irq_chip *chip = irq_desc_get_chip(desc); +@@ -1595,12 +1585,22 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev, + struct gpio_chip *gpiochip_prev = NULL; + struct at91_gpio_chip *prev = NULL; + struct irq_data *d = irq_get_irq_data(at91_gpio->pioc_virq); ++ struct irq_chip *gpio_irqchip; + int ret, i; + ++ gpio_irqchip = devm_kzalloc(&pdev->dev, sizeof(*gpio_irqchip), GFP_KERNEL); ++ if (!gpio_irqchip) ++ return -ENOMEM; ++ + at91_gpio->pioc_hwirq = irqd_to_hwirq(d); + +- /* Setup proper .irq_set_type function */ +- gpio_irqchip.irq_set_type = at91_gpio->ops->irq_type; ++ gpio_irqchip->name = "GPIO"; ++ gpio_irqchip->irq_ack = gpio_irq_ack; ++ gpio_irqchip->irq_disable = gpio_irq_mask; ++ gpio_irqchip->irq_mask = gpio_irq_mask; ++ gpio_irqchip->irq_unmask = gpio_irq_unmask; ++ gpio_irqchip->irq_set_wake = gpio_irq_set_wake, ++ gpio_irqchip->irq_set_type = at91_gpio->ops->irq_type; + + /* Disable irqs of this PIO controller */ + writel_relaxed(~0, at91_gpio->regbase + PIO_IDR); +@@ -1611,7 +1611,7 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev, + * interrupt. + */ + ret = gpiochip_irqchip_add(&at91_gpio->chip, +- &gpio_irqchip, ++ gpio_irqchip, + 0, + handle_edge_irq, + IRQ_TYPE_NONE); +@@ -1629,7 +1629,7 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev, + if (!gpiochip_prev) { + /* Then register the chain on the parent IRQ */ + gpiochip_set_chained_irqchip(&at91_gpio->chip, +- &gpio_irqchip, ++ gpio_irqchip, + at91_gpio->pioc_virq, + gpio_irq_handler); + return 0; +-- +2.20.1 + diff --git a/queue-4.9/pinctrl-at91-pio4-fix-has_config-check-in-atmel_pctl.patch b/queue-4.9/pinctrl-at91-pio4-fix-has_config-check-in-atmel_pctl.patch new file mode 100644 index 00000000000..5be133c81cc --- /dev/null +++ b/queue-4.9/pinctrl-at91-pio4-fix-has_config-check-in-atmel_pctl.patch @@ -0,0 +1,71 @@ +From 88d560eea85306ea53b566743049f52faaf1d18c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Sep 2018 11:37:45 +0300 +Subject: pinctrl: at91-pio4: fix has_config check in + atmel_pctl_dt_subnode_to_map() + +From: Dan Carpenter + +[ Upstream commit b97760ae8e3dc8bb91881c13425a0bff55f2bd85 ] + +Smatch complains about this condition: + + if (has_config && num_pins >= 1) + +The "has_config" variable is either uninitialized or true. The +"num_pins" variable is unsigned and we verified that it is non-zero on +the lines before so we know "num_pines >= 1" is true. Really, we could +just check "num_configs" directly and remove the "has_config" variable. + +Fixes: 776180848b57 ("pinctrl: introduce driver for Atmel PIO4 controller") +Signed-off-by: Dan Carpenter +Acked-by: Ludovic Desroches +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-at91-pio4.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c +index 88ba9c50cc8ed..b596f45426ea0 100644 +--- a/drivers/pinctrl/pinctrl-at91-pio4.c ++++ b/drivers/pinctrl/pinctrl-at91-pio4.c +@@ -479,7 +479,6 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev, + unsigned num_pins, num_configs, reserve; + unsigned long *configs; + struct property *pins; +- bool has_config; + u32 pinfunc; + int ret, i; + +@@ -495,9 +494,6 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev, + return ret; + } + +- if (num_configs) +- has_config = true; +- + num_pins = pins->length / sizeof(u32); + if (!num_pins) { + dev_err(pctldev->dev, "no pins found in node %s\n", +@@ -511,7 +507,7 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev, + * map for each pin. + */ + reserve = 1; +- if (has_config && num_pins >= 1) ++ if (num_configs) + reserve++; + reserve *= num_pins; + ret = pinctrl_utils_reserve_map(pctldev, map, reserved_maps, num_maps, +@@ -534,7 +530,7 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev, + pinctrl_utils_add_map_mux(pctldev, map, reserved_maps, num_maps, + group, func); + +- if (has_config) { ++ if (num_configs) { + ret = pinctrl_utils_add_map_configs(pctldev, map, + reserved_maps, num_maps, group, + configs, num_configs, +-- +2.20.1 + diff --git a/queue-4.9/power-reset-at91-poweroff-do-not-procede-if-at91_shd.patch b/queue-4.9/power-reset-at91-poweroff-do-not-procede-if-at91_shd.patch new file mode 100644 index 00000000000..fa60f61fe8a --- /dev/null +++ b/queue-4.9/power-reset-at91-poweroff-do-not-procede-if-at91_shd.patch @@ -0,0 +1,39 @@ +From 22ca56090beda547963957f6a4b76f7e9c53e7fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Aug 2018 14:50:11 +0300 +Subject: power: reset: at91-poweroff: do not procede if at91_shdwc is + allocated + +From: Claudiu Beznea + +[ Upstream commit 9f1e44774be578fb92776add95f1fcaf8284d692 ] + +There should be only one instance of struct shdwc in the system. This is +referenced through at91_shdwc. Return in probe if at91_shdwc is already +allocated. + +Signed-off-by: Claudiu Beznea +Acked-by: Nicolas Ferre +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/reset/at91-sama5d2_shdwc.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/power/reset/at91-sama5d2_shdwc.c b/drivers/power/reset/at91-sama5d2_shdwc.c +index 90b0b5a70ce52..04ca990e8f6cb 100644 +--- a/drivers/power/reset/at91-sama5d2_shdwc.c ++++ b/drivers/power/reset/at91-sama5d2_shdwc.c +@@ -246,6 +246,9 @@ static int __init at91_shdwc_probe(struct platform_device *pdev) + if (!pdev->dev.of_node) + return -ENODEV; + ++ if (at91_shdwc) ++ return -EBUSY; ++ + at91_shdwc = devm_kzalloc(&pdev->dev, sizeof(*at91_shdwc), GFP_KERNEL); + if (!at91_shdwc) + return -ENOMEM; +-- +2.20.1 + diff --git a/queue-4.9/power-supply-ab8500_fg-silence-uninitialized-variabl.patch b/queue-4.9/power-supply-ab8500_fg-silence-uninitialized-variabl.patch new file mode 100644 index 00000000000..562d3b2910e --- /dev/null +++ b/queue-4.9/power-supply-ab8500_fg-silence-uninitialized-variabl.patch @@ -0,0 +1,78 @@ +From 094f489c94fa541d61ad0b178169f52afe4b93c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Sep 2018 11:39:04 +0300 +Subject: power: supply: ab8500_fg: silence uninitialized variable warnings + +From: Dan Carpenter + +[ Upstream commit 54baff8d4e5dce2cef61953b1dc22079cda1ddb1 ] + +If kstrtoul() fails then we print "charge_full" when it's uninitialized. +The debug printk doesn't add anything so I deleted it and cleaned these +two functions up a bit. + +Signed-off-by: Dan Carpenter +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/ab8500_fg.c | 31 ++++++++++++------------------- + 1 file changed, 12 insertions(+), 19 deletions(-) + +diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c +index 2199f673118c0..ea8c26a108f00 100644 +--- a/drivers/power/supply/ab8500_fg.c ++++ b/drivers/power/supply/ab8500_fg.c +@@ -2437,17 +2437,14 @@ static ssize_t charge_full_store(struct ab8500_fg *di, const char *buf, + size_t count) + { + unsigned long charge_full; +- ssize_t ret; ++ int ret; + + ret = kstrtoul(buf, 10, &charge_full); ++ if (ret) ++ return ret; + +- dev_dbg(di->dev, "Ret %zd charge_full %lu", ret, charge_full); +- +- if (!ret) { +- di->bat_cap.max_mah = (int) charge_full; +- ret = count; +- } +- return ret; ++ di->bat_cap.max_mah = (int) charge_full; ++ return count; + } + + static ssize_t charge_now_show(struct ab8500_fg *di, char *buf) +@@ -2459,20 +2456,16 @@ static ssize_t charge_now_store(struct ab8500_fg *di, const char *buf, + size_t count) + { + unsigned long charge_now; +- ssize_t ret; ++ int ret; + + ret = kstrtoul(buf, 10, &charge_now); ++ if (ret) ++ return ret; + +- dev_dbg(di->dev, "Ret %zd charge_now %lu was %d", +- ret, charge_now, di->bat_cap.prev_mah); +- +- if (!ret) { +- di->bat_cap.user_mah = (int) charge_now; +- di->flags.user_cap = true; +- ret = count; +- queue_delayed_work(di->fg_wq, &di->fg_periodic_work, 0); +- } +- return ret; ++ di->bat_cap.user_mah = (int) charge_now; ++ di->flags.user_cap = true; ++ queue_delayed_work(di->fg_wq, &di->fg_periodic_work, 0); ++ return count; + } + + static struct ab8500_fg_sysfs_entry charge_full_attr = +-- +2.20.1 + diff --git a/queue-4.9/power-supply-max8998-charger-fix-platform-data-retri.patch b/queue-4.9/power-supply-max8998-charger-fix-platform-data-retri.patch new file mode 100644 index 00000000000..983c8fa8464 --- /dev/null +++ b/queue-4.9/power-supply-max8998-charger-fix-platform-data-retri.patch @@ -0,0 +1,41 @@ +From 31858512cff37cc7dfc7bc1c1f6e3942a1b922a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jul 2018 18:05:07 +0200 +Subject: power: supply: max8998-charger: Fix platform data retrieval +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tomasz Figa + +[ Upstream commit cb90a2c6f77fe9b43d1e3f759bb2f13fe7fa1811 ] + +Since the max8998 MFD driver supports instantiation by DT, platform data +retrieval is handled in MFD probe and cell drivers should get use +the pdata field of max8998_dev struct to obtain them. + +Fixes: ee999fb3f17f ("mfd: max8998: Add support for Device Tree") +Signed-off-by: Tomasz Figa +Signed-off-by: Paweł Chmiel +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/max8998_charger.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/power/supply/max8998_charger.c b/drivers/power/supply/max8998_charger.c +index b64cf0f141425..66438029bdd0c 100644 +--- a/drivers/power/supply/max8998_charger.c ++++ b/drivers/power/supply/max8998_charger.c +@@ -85,7 +85,7 @@ static const struct power_supply_desc max8998_battery_desc = { + static int max8998_battery_probe(struct platform_device *pdev) + { + struct max8998_dev *iodev = dev_get_drvdata(pdev->dev.parent); +- struct max8998_platform_data *pdata = dev_get_platdata(iodev->dev); ++ struct max8998_platform_data *pdata = iodev->pdata; + struct power_supply_config psy_cfg = {}; + struct max8998_battery_data *max8998; + struct i2c_client *i2c; +-- +2.20.1 + diff --git a/queue-4.9/power-supply-twl4030_charger-disable-eoc-interrupt-o.patch b/queue-4.9/power-supply-twl4030_charger-disable-eoc-interrupt-o.patch new file mode 100644 index 00000000000..6c88cfda26c --- /dev/null +++ b/queue-4.9/power-supply-twl4030_charger-disable-eoc-interrupt-o.patch @@ -0,0 +1,76 @@ +From 2d515f292cf20dba027e5b6a13c13b84ca6c1e5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Sep 2018 07:00:07 +0200 +Subject: power: supply: twl4030_charger: disable eoc interrupt on linear + charge + +From: Andreas Kemnade + +[ Upstream commit 079cdff3d0a09c5da10ae1be35def7a116776328 ] + +This avoids getting woken up from suspend after power interruptions +when the bci wrongly thinks the battery is full just because +of input current going low because of low input power + +Signed-off-by: Andreas Kemnade +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/twl4030_charger.c | 27 +++++++++++++++++++++++++- + 1 file changed, 26 insertions(+), 1 deletion(-) + +diff --git a/drivers/power/supply/twl4030_charger.c b/drivers/power/supply/twl4030_charger.c +index 14fed11e8f6e3..5b1f147b11cb0 100644 +--- a/drivers/power/supply/twl4030_charger.c ++++ b/drivers/power/supply/twl4030_charger.c +@@ -469,6 +469,7 @@ static void twl4030_current_worker(struct work_struct *data) + static int twl4030_charger_enable_usb(struct twl4030_bci *bci, bool enable) + { + int ret; ++ u32 reg; + + if (bci->usb_mode == CHARGE_OFF) + enable = false; +@@ -482,14 +483,38 @@ static int twl4030_charger_enable_usb(struct twl4030_bci *bci, bool enable) + bci->usb_enabled = 1; + } + +- if (bci->usb_mode == CHARGE_AUTO) ++ if (bci->usb_mode == CHARGE_AUTO) { ++ /* Enable interrupts now. */ ++ reg = ~(u32)(TWL4030_ICHGLOW | TWL4030_ICHGEOC | ++ TWL4030_TBATOR2 | TWL4030_TBATOR1 | ++ TWL4030_BATSTS); ++ ret = twl_i2c_write_u8(TWL4030_MODULE_INTERRUPTS, reg, ++ TWL4030_INTERRUPTS_BCIIMR1A); ++ if (ret < 0) { ++ dev_err(bci->dev, ++ "failed to unmask interrupts: %d\n", ++ ret); ++ return ret; ++ } + /* forcing the field BCIAUTOUSB (BOOT_BCI[1]) to 1 */ + ret = twl4030_clear_set_boot_bci(0, TWL4030_BCIAUTOUSB); ++ } + + /* forcing USBFASTMCHG(BCIMFSTS4[2]) to 1 */ + ret = twl4030_clear_set(TWL_MODULE_MAIN_CHARGE, 0, + TWL4030_USBFASTMCHG, TWL4030_BCIMFSTS4); + if (bci->usb_mode == CHARGE_LINEAR) { ++ /* Enable interrupts now. */ ++ reg = ~(u32)(TWL4030_ICHGLOW | TWL4030_TBATOR2 | ++ TWL4030_TBATOR1 | TWL4030_BATSTS); ++ ret = twl_i2c_write_u8(TWL4030_MODULE_INTERRUPTS, reg, ++ TWL4030_INTERRUPTS_BCIIMR1A); ++ if (ret < 0) { ++ dev_err(bci->dev, ++ "failed to unmask interrupts: %d\n", ++ ret); ++ return ret; ++ } + twl4030_clear_set_boot_bci(TWL4030_BCIAUTOAC|TWL4030_CVENAC, 0); + /* Watch dog key: WOVF acknowledge */ + ret = twl_i2c_write_u8(TWL_MODULE_MAIN_CHARGE, 0x33, +-- +2.20.1 + diff --git a/queue-4.9/power-supply-twl4030_charger-fix-charging-current-ou.patch b/queue-4.9/power-supply-twl4030_charger-fix-charging-current-ou.patch new file mode 100644 index 00000000000..e3eae6cedf7 --- /dev/null +++ b/queue-4.9/power-supply-twl4030_charger-fix-charging-current-ou.patch @@ -0,0 +1,38 @@ +From 8593a2a9dcf1938a6b8e8c77979f476a47f284e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Sep 2018 07:20:35 +0200 +Subject: power: supply: twl4030_charger: fix charging current out-of-bounds + +From: Andreas Kemnade + +[ Upstream commit 8314c212f995bc0d06b54ad02ef0ab4089781540 ] + +the charging current uses unsigned int variables, if we step back +if the current is still low, we would run into negative which +means setting the target to a huge value. +Better add checks here. + +Signed-off-by: Andreas Kemnade +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/twl4030_charger.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/power/supply/twl4030_charger.c b/drivers/power/supply/twl4030_charger.c +index bcd4dc304f270..14fed11e8f6e3 100644 +--- a/drivers/power/supply/twl4030_charger.c ++++ b/drivers/power/supply/twl4030_charger.c +@@ -449,7 +449,8 @@ static void twl4030_current_worker(struct work_struct *data) + + if (v < USB_MIN_VOLT) { + /* Back up and stop adjusting. */ +- bci->usb_cur -= USB_CUR_STEP; ++ if (bci->usb_cur >= USB_CUR_STEP) ++ bci->usb_cur -= USB_CUR_STEP; + bci->usb_cur_target = bci->usb_cur; + } else if (bci->usb_cur >= bci->usb_cur_target || + bci->usb_cur + USB_CUR_STEP > USB_MAX_CURRENT) { +-- +2.20.1 + diff --git a/queue-4.9/powerpc-64s-hash-fix-stab_rr-off-by-one-initializati.patch b/queue-4.9/powerpc-64s-hash-fix-stab_rr-off-by-one-initializati.patch new file mode 100644 index 00000000000..5a735db3024 --- /dev/null +++ b/queue-4.9/powerpc-64s-hash-fix-stab_rr-off-by-one-initializati.patch @@ -0,0 +1,36 @@ +From 806286ff7fd65b3c99024cbc8a1a3335348803f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Sep 2018 01:30:45 +1000 +Subject: powerpc/64s/hash: Fix stab_rr off by one initialization + +From: Nicholas Piggin + +[ Upstream commit 09b4438db13fa83b6219aee5993711a2aa2a0c64 ] + +This causes SLB alloation to start 1 beyond the start of the SLB. +There is no real problem because after it wraps it stats behaving +properly, it's just surprisig to see when looking at SLB traces. + +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/slb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/mm/slb.c b/arch/powerpc/mm/slb.c +index 64c9a91773af4..96c41b55b106b 100644 +--- a/arch/powerpc/mm/slb.c ++++ b/arch/powerpc/mm/slb.c +@@ -321,7 +321,7 @@ void slb_initialize(void) + #endif + } + +- get_paca()->stab_rr = SLB_NUM_BOLTED; ++ get_paca()->stab_rr = SLB_NUM_BOLTED - 1; + + lflags = SLB_VSID_KERNEL | linear_llp; + vflags = SLB_VSID_KERNEL | vmalloc_llp; +-- +2.20.1 + diff --git a/queue-4.9/powerpc-iommu-avoid-derefence-before-pointer-check.patch b/queue-4.9/powerpc-iommu-avoid-derefence-before-pointer-check.patch new file mode 100644 index 00000000000..cbb9c043c21 --- /dev/null +++ b/queue-4.9/powerpc-iommu-avoid-derefence-before-pointer-check.patch @@ -0,0 +1,40 @@ +From e2639deec4f677bd100a812506e038cd39b90ce9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Aug 2018 15:44:48 -0300 +Subject: powerpc/iommu: Avoid derefence before pointer check + +From: Breno Leitao + +[ Upstream commit 984ecdd68de0fa1f63ce205d6c19ef5a7bc67b40 ] + +The tbl pointer is being derefenced by IOMMU_PAGE_SIZE prior the check +if it is not NULL. + +Just moving the dereference code to after the check, where there will +be guarantee that 'tbl' will not be NULL. + +Signed-off-by: Breno Leitao +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c +index 5f202a566ec5f..9bfdd2510fd5e 100644 +--- a/arch/powerpc/kernel/iommu.c ++++ b/arch/powerpc/kernel/iommu.c +@@ -765,9 +765,9 @@ dma_addr_t iommu_map_page(struct device *dev, struct iommu_table *tbl, + + vaddr = page_address(page) + offset; + uaddr = (unsigned long)vaddr; +- npages = iommu_num_pages(uaddr, size, IOMMU_PAGE_SIZE(tbl)); + + if (tbl) { ++ npages = iommu_num_pages(uaddr, size, IOMMU_PAGE_SIZE(tbl)); + align = 0; + if (tbl->it_page_shift < PAGE_SHIFT && size >= PAGE_SIZE && + ((unsigned long)vaddr & ~PAGE_MASK) == 0) +-- +2.20.1 + diff --git a/queue-4.9/powerpc-pseries-disable-cpu-hotplug-across-migration.patch b/queue-4.9/powerpc-pseries-disable-cpu-hotplug-across-migration.patch new file mode 100644 index 00000000000..4eae4570834 --- /dev/null +++ b/queue-4.9/powerpc-pseries-disable-cpu-hotplug-across-migration.patch @@ -0,0 +1,53 @@ +From fe44480f5a62fa61c905f4cb13fd03b4ae067ba5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Sep 2018 14:14:02 -0500 +Subject: powerpc/pseries: Disable CPU hotplug across migrations + +From: Nathan Fontenot + +[ Upstream commit 85a88cabad57d26d826dd94ea34d3a785824d802 ] + +When performing partition migrations all present CPUs must be online +as all present CPUs must make the H_JOIN call as part of the migration +process. Once all present CPUs make the H_JOIN call, one CPU is returned +to make the rtas call to perform the migration to the destination system. + +During testing of migration and changing the SMT state we have found +instances where CPUs are offlined, as part of the SMT state change, +before they make the H_JOIN call. This results in a hung system where +every CPU is either in H_JOIN or offline. + +To prevent this this patch disables CPU hotplug during the migration +process. + +Signed-off-by: Nathan Fontenot +Reviewed-by: Tyrel Datwyler +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/rtas.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c +index a309a7a29cc60..641f3e4c33808 100644 +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -984,6 +984,7 @@ int rtas_ibm_suspend_me(u64 handle) + goto out; + } + ++ cpu_hotplug_disable(); + stop_topology_update(); + + /* Call function on all CPUs. One of us will make the +@@ -998,6 +999,7 @@ int rtas_ibm_suspend_me(u64 handle) + printk(KERN_ERR "Error doing global join\n"); + + start_topology_update(); ++ cpu_hotplug_enable(); + + /* Take down CPUs not online prior to suspend */ + cpuret = rtas_offline_cpus_mask(offline_mask); +-- +2.20.1 + diff --git a/queue-4.9/powerpc-vdso-correct-call-frame-information.patch b/queue-4.9/powerpc-vdso-correct-call-frame-information.patch new file mode 100644 index 00000000000..3edaacf94e6 --- /dev/null +++ b/queue-4.9/powerpc-vdso-correct-call-frame-information.patch @@ -0,0 +1,100 @@ +From d381cc74f4786d9821df7b13bfe2a1cd5ea6a595 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Sep 2018 13:10:04 +0930 +Subject: powerpc/vdso: Correct call frame information + +From: Alan Modra + +[ Upstream commit 56d20861c027498b5a1112b4f9f05b56d906fdda ] + +Call Frame Information is used by gdb for back-traces and inserting +breakpoints on function return for the "finish" command. This failed +when inside __kernel_clock_gettime. More concerning than difficulty +debugging is that CFI is also used by stack frame unwinding code to +implement exceptions. If you have an app that needs to handle +asynchronous exceptions for some reason, and you are unlucky enough to +get one inside the VDSO time functions, your app will crash. + +What's wrong: There is control flow in __kernel_clock_gettime that +reaches label 99 without saving lr in r12. CFI info however is +interpreted by the unwinder without reference to control flow: It's a +simple matter of "Execute all the CFI opcodes up to the current +address". That means the unwinder thinks r12 contains the return +address at label 99. Disabuse it of that notion by resetting CFI for +the return address at label 99. + +Note that the ".cfi_restore lr" could have gone anywhere from the +"mtlr r12" a few instructions earlier to the instruction at label 99. +I put the CFI as late as possible, because in general that's best +practice (and if possible grouped with other CFI in order to reduce +the number of CFI opcodes executed when unwinding). Using r12 as the +return address is perfectly fine after the "mtlr r12" since r12 on +that code path still contains the return address. + +__get_datapage also has a CFI error. That function temporarily saves +lr in r0, and reflects that fact with ".cfi_register lr,r0". A later +use of r0 means the CFI at that point isn't correct, as r0 no longer +contains the return address. Fix that too. + +Signed-off-by: Alan Modra +Tested-by: Reza Arbab +Signed-off-by: Paul Mackerras +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/vdso32/datapage.S | 1 + + arch/powerpc/kernel/vdso32/gettimeofday.S | 1 + + arch/powerpc/kernel/vdso64/datapage.S | 1 + + arch/powerpc/kernel/vdso64/gettimeofday.S | 1 + + 4 files changed, 4 insertions(+) + +diff --git a/arch/powerpc/kernel/vdso32/datapage.S b/arch/powerpc/kernel/vdso32/datapage.S +index 3745113fcc652..2a7eb5452aba7 100644 +--- a/arch/powerpc/kernel/vdso32/datapage.S ++++ b/arch/powerpc/kernel/vdso32/datapage.S +@@ -37,6 +37,7 @@ data_page_branch: + mtlr r0 + addi r3, r3, __kernel_datapage_offset-data_page_branch + lwz r0,0(r3) ++ .cfi_restore lr + add r3,r0,r3 + blr + .cfi_endproc +diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S +index 6b2b69616e776..7b341b86216c2 100644 +--- a/arch/powerpc/kernel/vdso32/gettimeofday.S ++++ b/arch/powerpc/kernel/vdso32/gettimeofday.S +@@ -139,6 +139,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime) + */ + 99: + li r0,__NR_clock_gettime ++ .cfi_restore lr + sc + blr + .cfi_endproc +diff --git a/arch/powerpc/kernel/vdso64/datapage.S b/arch/powerpc/kernel/vdso64/datapage.S +index abf17feffe404..bf96686915116 100644 +--- a/arch/powerpc/kernel/vdso64/datapage.S ++++ b/arch/powerpc/kernel/vdso64/datapage.S +@@ -37,6 +37,7 @@ data_page_branch: + mtlr r0 + addi r3, r3, __kernel_datapage_offset-data_page_branch + lwz r0,0(r3) ++ .cfi_restore lr + add r3,r0,r3 + blr + .cfi_endproc +diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S +index 3820213248836..09b2a49f6dd53 100644 +--- a/arch/powerpc/kernel/vdso64/gettimeofday.S ++++ b/arch/powerpc/kernel/vdso64/gettimeofday.S +@@ -124,6 +124,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime) + */ + 99: + li r0,__NR_clock_gettime ++ .cfi_restore lr + sc + blr + .cfi_endproc +-- +2.20.1 + diff --git a/queue-4.9/rdma-i40iw-fix-incorrect-iterator-type.patch b/queue-4.9/rdma-i40iw-fix-incorrect-iterator-type.patch new file mode 100644 index 00000000000..1b871b7c53e --- /dev/null +++ b/queue-4.9/rdma-i40iw-fix-incorrect-iterator-type.patch @@ -0,0 +1,40 @@ +From 3fa2da82f0d9fe8013741cf060f25304ec391680 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Sep 2018 16:07:07 +0200 +Subject: RDMA/i40iw: Fix incorrect iterator type +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit 802fa45cd320de319e86c93bca72abec028ba059 ] + +Commit f27b4746f378 ("i40iw: add connection management code") uses an +incorrect rcu iterator, whilst holding the rtnl_lock. Since the +critical region invokes i40iw_manage_qhash(), which is a sleeping +function, the rcu locking and traversal cannot be used. + +Signed-off-by: HÃ¥kon Bugge +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/i40iw/i40iw_cm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c +index 85637696f6e96..282a726351c81 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c +@@ -1652,7 +1652,7 @@ static enum i40iw_status_code i40iw_add_mqh_6(struct i40iw_device *iwdev, + unsigned long flags; + + rtnl_lock(); +- for_each_netdev_rcu(&init_net, ip_dev) { ++ for_each_netdev(&init_net, ip_dev) { + if ((((rdma_vlan_dev_vlan_id(ip_dev) < I40IW_NO_VLAN) && + (rdma_vlan_dev_real_dev(ip_dev) == iwdev->netdev)) || + (ip_dev == iwdev->netdev)) && (ip_dev->flags & IFF_UP)) { +-- +2.20.1 + diff --git a/queue-4.9/rtl8187-fix-warning-generated-when-strncpy-destinati.patch b/queue-4.9/rtl8187-fix-warning-generated-when-strncpy-destinati.patch new file mode 100644 index 00000000000..76dd3cc3c1c --- /dev/null +++ b/queue-4.9/rtl8187-fix-warning-generated-when-strncpy-destinati.patch @@ -0,0 +1,37 @@ +From 00a506c272d2970081e1b870d4d5f957ba34224e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Aug 2018 13:48:31 -0500 +Subject: rtl8187: Fix warning generated when strncpy() destination length + matches the sixe argument + +From: Larry Finger + +[ Upstream commit 199ba9faca909e77ac533449ecd1248123ce89e7 ] + +In gcc8, when the 3rd argument (size) of a call to strncpy() matches the +length of the first argument, the compiler warns of the possibility of an +unterminated string. Using strlcpy() forces a null at the end. + +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c +index c2d5b495c179a..c089540116fa7 100644 +--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c ++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c +@@ -146,7 +146,7 @@ static int rtl8187_register_led(struct ieee80211_hw *dev, + led->dev = dev; + led->ledpin = ledpin; + led->is_radio = is_radio; +- strncpy(led->name, name, sizeof(led->name)); ++ strlcpy(led->name, name, sizeof(led->name)); + + led->led_dev.name = led->name; + led->led_dev.default_trigger = default_trigger; +-- +2.20.1 + diff --git a/queue-4.9/s390-qeth-invoke-softirqs-after-napi_schedule.patch b/queue-4.9/s390-qeth-invoke-softirqs-after-napi_schedule.patch new file mode 100644 index 00000000000..aed19a20db1 --- /dev/null +++ b/queue-4.9/s390-qeth-invoke-softirqs-after-napi_schedule.patch @@ -0,0 +1,62 @@ +From 9fc05c2134e7fdb8904bffa1e9d6f701927d8504 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Sep 2018 17:36:06 +0200 +Subject: s390/qeth: invoke softirqs after napi_schedule() + +From: Julian Wiedmann + +[ Upstream commit 4d19db777a2f32c9b76f6fd517ed8960576cb43e ] + +Calling napi_schedule() from process context does not ensure that the +NET_RX softirq is run in a timely fashion. So trigger it manually. + +This is no big issue with current code. A call to ndo_open() is usually +followed by a ndo_set_rx_mode() call, and for qeth this contains a +spin_unlock_bh(). Except for OSN, where qeth_l2_set_rx_mode() bails out +early. +Nevertheless it's best to not depend on this behaviour, and just fix +the issue at its source like all other drivers do. For instance see +commit 83a0c6e58901 ("i40e: Invoke softirqs after napi_reschedule"). + +Fixes: a1c3ed4c9ca0 ("qeth: NAPI support for l2 and l3 discipline") +Signed-off-by: Julian Wiedmann +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/s390/net/qeth_l2_main.c | 3 +++ + drivers/s390/net/qeth_l3_main.c | 3 +++ + 2 files changed, 6 insertions(+) + +diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c +index 6ba4e921d2fd3..51152681aba6e 100644 +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -991,7 +991,10 @@ static int __qeth_l2_open(struct net_device *dev) + + if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) { + napi_enable(&card->napi); ++ local_bh_disable(); + napi_schedule(&card->napi); ++ /* kick-start the NAPI softirq: */ ++ local_bh_enable(); + } else + rc = -EIO; + return rc; +diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c +index 6e6ba1baf9c48..b40a61d9ad9ec 100644 +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -3005,7 +3005,10 @@ static int __qeth_l3_open(struct net_device *dev) + + if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) { + napi_enable(&card->napi); ++ local_bh_disable(); + napi_schedule(&card->napi); ++ /* kick-start the NAPI softirq: */ ++ local_bh_enable(); + } else + rc = -EIO; + return rc; +-- +2.20.1 + diff --git a/queue-4.9/scsi-libsas-always-unregister-the-old-device-if-goin.patch b/queue-4.9/scsi-libsas-always-unregister-the-old-device-if-goin.patch new file mode 100644 index 00000000000..ec439e189e0 --- /dev/null +++ b/queue-4.9/scsi-libsas-always-unregister-the-old-device-if-goin.patch @@ -0,0 +1,61 @@ +From 26c328dd1fcad20620b2b45ef167550991f4b7f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Sep 2018 10:56:52 +0800 +Subject: scsi: libsas: always unregister the old device if going to discover + new + +From: Jason Yan + +[ Upstream commit 32c850bf587f993b2620b91e5af8a64a7813f504 ] + +If we went into sas_rediscover_dev() the attached_sas_addr was already insured +not to be zero. So it's unnecessary to check if the attached_sas_addr is zero. + +And although if the sas address is not changed, we always have to unregister +the old device when we are going to register a new one. We cannot just leave +the device there and bring up the new. + +Signed-off-by: Jason Yan +CC: chenxiang +CC: John Garry +CC: Johannes Thumshirn +CC: Ewan Milne +CC: Christoph Hellwig +CC: Tomas Henzl +CC: Dan Williams +CC: Hannes Reinecke +Reviewed-by: Johannes Thumshirn +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libsas/sas_expander.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c +index 400eee9d77832..d44f18f773c0f 100644 +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -2049,14 +2049,11 @@ static int sas_rediscover_dev(struct domain_device *dev, int phy_id, bool last) + return res; + } + +- /* delete the old link */ +- if (SAS_ADDR(phy->attached_sas_addr) && +- SAS_ADDR(sas_addr) != SAS_ADDR(phy->attached_sas_addr)) { +- SAS_DPRINTK("ex %016llx phy 0x%x replace %016llx\n", +- SAS_ADDR(dev->sas_addr), phy_id, +- SAS_ADDR(phy->attached_sas_addr)); +- sas_unregister_devs_sas_addr(dev, phy_id, last); +- } ++ /* we always have to delete the old device when we went here */ ++ SAS_DPRINTK("ex %016llx phy 0x%x replace %016llx\n", ++ SAS_ADDR(dev->sas_addr), phy_id, ++ SAS_ADDR(phy->attached_sas_addr)); ++ sas_unregister_devs_sas_addr(dev, phy_id, last); + + return sas_discover_new(dev, phy_id); + } +-- +2.20.1 + diff --git a/queue-4.9/scsi-ncr5380-check-for-invalid-reselection-target.patch b/queue-4.9/scsi-ncr5380-check-for-invalid-reselection-target.patch new file mode 100644 index 00000000000..37f325ca432 --- /dev/null +++ b/queue-4.9/scsi-ncr5380-check-for-invalid-reselection-target.patch @@ -0,0 +1,41 @@ +From 2434f6ad1b5f95433f7a5bcf112f0b9ec38dc749 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Sep 2018 11:17:11 +1000 +Subject: scsi: NCR5380: Check for invalid reselection target + +From: Finn Thain + +[ Upstream commit 7ef55f6744c45e3d7c85a3f74ada39b67ac741dd ] + +The X3T9.2 specification (draft) says, under "6.1.4.1 RESELECTION", that "the +initiator shall not respond to a RESELECTION phase if other than two SCSI ID +bits are on the DATA BUS." This issue (too many bits set) has been observed in +the wild, so add a check. + +Tested-by: Michael Schmitz +Signed-off-by: Finn Thain +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/NCR5380.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c +index 35419ba32c467..15c0fff7519be 100644 +--- a/drivers/scsi/NCR5380.c ++++ b/drivers/scsi/NCR5380.c +@@ -2102,6 +2102,11 @@ static void NCR5380_reselect(struct Scsi_Host *instance) + NCR5380_write(MODE_REG, MR_BASE); + + target_mask = NCR5380_read(CURRENT_SCSI_DATA_REG) & ~(hostdata->id_mask); ++ if (!target_mask || target_mask & (target_mask - 1)) { ++ shost_printk(KERN_WARNING, instance, ++ "reselect: bad target_mask 0x%02x\n", target_mask); ++ return; ++ } + + dsprintk(NDEBUG_RESELECTION, instance, "reselect\n"); + +-- +2.20.1 + diff --git a/queue-4.9/scsi-ncr5380-clear-all-unissued-commands-on-host-res.patch b/queue-4.9/scsi-ncr5380-clear-all-unissued-commands-on-host-res.patch new file mode 100644 index 00000000000..bfb771db3ce --- /dev/null +++ b/queue-4.9/scsi-ncr5380-clear-all-unissued-commands-on-host-res.patch @@ -0,0 +1,55 @@ +From 69f16e423f61b61c8ac7c58ba2bc8b0fe364d517 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Sep 2018 11:17:11 +1000 +Subject: scsi: NCR5380: Clear all unissued commands on host reset + +From: Hannes Reinecke + +[ Upstream commit 1aeeeed7f03c576f096eede7b0384f99a98f588c ] + +When doing a host reset we should be clearing all outstanding commands, not +just the command triggering the reset. + +[mkp: adjusted Hannes' SoB address] + +Signed-off-by: Hannes Reinecke +Reviewed-by: Johannes Thumshirn +Cc: Ondrey Zary +Signed-off-by: Finn Thain +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/NCR5380.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c +index 3cfab8868c989..ba7b3aef3ef0b 100644 +--- a/drivers/scsi/NCR5380.c ++++ b/drivers/scsi/NCR5380.c +@@ -2392,7 +2392,7 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd) + spin_lock_irqsave(&hostdata->lock, flags); + + #if (NDEBUG & NDEBUG_ANY) +- scmd_printk(KERN_INFO, cmd, __func__); ++ shost_printk(KERN_INFO, instance, __func__); + #endif + NCR5380_dprint(NDEBUG_ANY, instance); + NCR5380_dprint_phase(NDEBUG_ANY, instance); +@@ -2410,10 +2410,13 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd) + * commands! + */ + +- if (list_del_cmd(&hostdata->unissued, cmd)) { ++ list_for_each_entry(ncmd, &hostdata->unissued, list) { ++ struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd); ++ + cmd->result = DID_RESET << 16; + cmd->scsi_done(cmd); + } ++ INIT_LIST_HEAD(&hostdata->unissued); + + if (hostdata->selecting) { + hostdata->selecting->result = DID_RESET << 16; +-- +2.20.1 + diff --git a/queue-4.9/scsi-ncr5380-don-t-call-dsprintk-following-reselecti.patch b/queue-4.9/scsi-ncr5380-don-t-call-dsprintk-following-reselecti.patch new file mode 100644 index 00000000000..096a3d96bc6 --- /dev/null +++ b/queue-4.9/scsi-ncr5380-don-t-call-dsprintk-following-reselecti.patch @@ -0,0 +1,59 @@ +From cc5954743ffc1e91b35726cf6a4ea17d5541d5f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Sep 2018 11:17:11 +1000 +Subject: scsi: NCR5380: Don't call dsprintk() following reselection interrupt + +From: Finn Thain + +[ Upstream commit 08267216b3f8aa5adc204bdccf8deb72c1cd7665 ] + +The X3T9.2 specification (draft) says, under "6.1.4.1 RESELECTION", + + ... The reselected initiator shall then assert the BSY signal + within a selection abort time of its most recent detection of being + reselected; this is required for correct operation of the time-out + procedure. + +The selection abort time is only 200 us which may be insufficient time for a +printk() call. Move the diagnostics to the error paths. + +Tested-by: Michael Schmitz +Signed-off-by: Finn Thain +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/NCR5380.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c +index a4856eeac26f6..03f9ddbc37fbb 100644 +--- a/drivers/scsi/NCR5380.c ++++ b/drivers/scsi/NCR5380.c +@@ -2109,8 +2109,6 @@ static void NCR5380_reselect(struct Scsi_Host *instance) + return; + } + +- dsprintk(NDEBUG_RESELECTION, instance, "reselect\n"); +- + /* + * At this point, we have detected that our SCSI ID is on the bus, + * SEL is true and BSY was false for at least one bus settle delay +@@ -2123,6 +2121,7 @@ static void NCR5380_reselect(struct Scsi_Host *instance) + NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE | ICR_ASSERT_BSY); + if (NCR5380_poll_politely(instance, + STATUS_REG, SR_SEL, 0, 2 * HZ) < 0) { ++ shost_printk(KERN_ERR, instance, "reselect: !SEL timeout\n"); + NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE); + return; + } +@@ -2134,6 +2133,7 @@ static void NCR5380_reselect(struct Scsi_Host *instance) + + if (NCR5380_poll_politely(instance, + STATUS_REG, SR_REQ, SR_REQ, 2 * HZ) < 0) { ++ shost_printk(KERN_ERR, instance, "reselect: REQ timeout\n"); + do_abort(instance); + return; + } +-- +2.20.1 + diff --git a/queue-4.9/scsi-ncr5380-don-t-clear-busy-flag-when-abort-fails.patch b/queue-4.9/scsi-ncr5380-don-t-clear-busy-flag-when-abort-fails.patch new file mode 100644 index 00000000000..90702f35690 --- /dev/null +++ b/queue-4.9/scsi-ncr5380-don-t-clear-busy-flag-when-abort-fails.patch @@ -0,0 +1,93 @@ +From c8f1dc70c76118223520c64cd1f23f14745d0409 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Sep 2018 11:17:11 +1000 +Subject: scsi: NCR5380: Don't clear busy flag when abort fails + +From: Finn Thain + +[ Upstream commit 45ddc1b24806cc8f1a09f23dd4e7b6e4a8ae36e1 ] + +When NCR5380_abort() returns FAILED, the driver forgets that the target is +still busy. Hence, further commands may be sent to the target, which may fail +during selection and produce the error message, "reselection after won +arbitration?". Prevent this by leaving the busy flag set when NCR5380_abort() +fails. + +Tested-by: Michael Schmitz +Signed-off-by: Finn Thain +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/NCR5380.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c +index 15c0fff7519be..a4856eeac26f6 100644 +--- a/drivers/scsi/NCR5380.c ++++ b/drivers/scsi/NCR5380.c +@@ -626,8 +626,6 @@ static void complete_cmd(struct Scsi_Host *instance, + hostdata->sensing = NULL; + } + +- hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun); +- + cmd->scsi_done(cmd); + } + +@@ -1799,6 +1797,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) + cmd->result = DID_ERROR << 16; + complete_cmd(instance, cmd); + hostdata->connected = NULL; ++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun); + return; + #endif + case PHASE_DATAIN: +@@ -1881,6 +1880,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) + cmd, scmd_id(cmd), cmd->device->lun); + + hostdata->connected = NULL; ++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun); + + cmd->result &= ~0xffff; + cmd->result |= cmd->SCp.Status; +@@ -2040,6 +2040,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance) + NCR5380_transfer_pio(instance, &phase, &len, &data); + if (msgout == ABORT) { + hostdata->connected = NULL; ++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun); + cmd->result = DID_ERROR << 16; + complete_cmd(instance, cmd); + maybe_release_dma_irq(instance); +@@ -2194,13 +2195,16 @@ static void NCR5380_reselect(struct Scsi_Host *instance) + dsprintk(NDEBUG_RESELECTION | NDEBUG_QUEUES, instance, + "reselect: removed %p from disconnected queue\n", tmp); + } else { ++ int target = ffs(target_mask) - 1; ++ + shost_printk(KERN_ERR, instance, "target bitmask 0x%02x lun %d not in disconnected queue.\n", + target_mask, lun); + /* + * Since we have an established nexus that we can't do anything + * with, we must abort it. + */ +- do_abort(instance); ++ if (do_abort(instance) == 0) ++ hostdata->busy[target] &= ~(1 << lun); + return; + } + +@@ -2368,8 +2372,10 @@ static int NCR5380_abort(struct scsi_cmnd *cmd) + out: + if (result == FAILED) + dsprintk(NDEBUG_ABORT, instance, "abort: failed to abort %p\n", cmd); +- else ++ else { ++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun); + dsprintk(NDEBUG_ABORT, instance, "abort: successfully aborted %p\n", cmd); ++ } + + queue_work(hostdata->work_q, &hostdata->main_task); + maybe_release_dma_irq(instance); +-- +2.20.1 + diff --git a/queue-4.9/scsi-ncr5380-handle-bus-free-during-reselection.patch b/queue-4.9/scsi-ncr5380-handle-bus-free-during-reselection.patch new file mode 100644 index 00000000000..5a8233a031d --- /dev/null +++ b/queue-4.9/scsi-ncr5380-handle-bus-free-during-reselection.patch @@ -0,0 +1,40 @@ +From 03dbdb33ee1e9e8ef2f3230ecf6e0aa911d65fc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Sep 2018 11:17:11 +1000 +Subject: scsi: NCR5380: Handle BUS FREE during reselection + +From: Finn Thain + +[ Upstream commit ca694afad707cb3ae2fdef3b28454444d9ac726e ] + +The X3T9.2 specification (draft) says, under "6.1.4.2 RESELECTION time-out +procedure", that a target may assert RST or go to BUS FREE phase if the +initiator does not respond within 200 us. Something like this has been +observed with AztecMonster II target. When it happens, all we can do is wait +for the target to try again. + +Tested-by: Michael Schmitz +Signed-off-by: Finn Thain +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/NCR5380.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c +index 03f9ddbc37fbb..27270631c70c2 100644 +--- a/drivers/scsi/NCR5380.c ++++ b/drivers/scsi/NCR5380.c +@@ -2133,6 +2133,9 @@ static void NCR5380_reselect(struct Scsi_Host *instance) + + if (NCR5380_poll_politely(instance, + STATUS_REG, SR_REQ, SR_REQ, 2 * HZ) < 0) { ++ if ((NCR5380_read(STATUS_REG) & (SR_BSY | SR_SEL)) == 0) ++ /* BUS FREE phase */ ++ return; + shost_printk(KERN_ERR, instance, "reselect: REQ timeout\n"); + do_abort(instance); + return; +-- +2.20.1 + diff --git a/queue-4.9/scsi-ncr5380-use-driver_sense-to-indicate-valid-sens.patch b/queue-4.9/scsi-ncr5380-use-driver_sense-to-indicate-valid-sens.patch new file mode 100644 index 00000000000..ea5f4370db3 --- /dev/null +++ b/queue-4.9/scsi-ncr5380-use-driver_sense-to-indicate-valid-sens.patch @@ -0,0 +1,60 @@ +From e01243a9784887b3a6da16bc187e0fd7e0b4c9df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Sep 2018 11:17:11 +1000 +Subject: scsi: NCR5380: Use DRIVER_SENSE to indicate valid sense data + +From: Finn Thain + +[ Upstream commit 070356513963be6196142acff56acc8359069fa1 ] + +When sense data is valid, call set_driver_byte(cmd, DRIVER_SENSE). Otherwise +some callers of scsi_execute() will ignore sense data. Don't set DID_ERROR or +DID_RESET just because sense data is missing. + +Tested-by: Michael Schmitz +Signed-off-by: Finn Thain +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/NCR5380.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c +index ba7b3aef3ef0b..35419ba32c467 100644 +--- a/drivers/scsi/NCR5380.c ++++ b/drivers/scsi/NCR5380.c +@@ -617,11 +617,12 @@ static void complete_cmd(struct Scsi_Host *instance, + + if (hostdata->sensing == cmd) { + /* Autosense processing ends here */ +- if ((cmd->result & 0xff) != SAM_STAT_GOOD) { ++ if (status_byte(cmd->result) != GOOD) { + scsi_eh_restore_cmnd(cmd, &hostdata->ses); +- set_host_byte(cmd, DID_ERROR); +- } else ++ } else { + scsi_eh_restore_cmnd(cmd, &hostdata->ses); ++ set_driver_byte(cmd, DRIVER_SENSE); ++ } + hostdata->sensing = NULL; + } + +@@ -2356,7 +2357,6 @@ static int NCR5380_abort(struct scsi_cmnd *cmd) + if (list_del_cmd(&hostdata->autosense, cmd)) { + dsprintk(NDEBUG_ABORT, instance, + "abort: removed %p from sense queue\n", cmd); +- set_host_byte(cmd, DID_ERROR); + complete_cmd(instance, cmd); + } + +@@ -2435,7 +2435,6 @@ static int NCR5380_bus_reset(struct scsi_cmnd *cmd) + list_for_each_entry(ncmd, &hostdata->autosense, list) { + struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd); + +- set_host_byte(cmd, DID_RESET); + cmd->scsi_done(cmd); + } + INIT_LIST_HEAD(&hostdata->autosense); +-- +2.20.1 + diff --git a/queue-4.9/scsi-pm80xx-corrected-dma_unmap_sg-parameter.patch b/queue-4.9/scsi-pm80xx-corrected-dma_unmap_sg-parameter.patch new file mode 100644 index 00000000000..5b4b72b34a9 --- /dev/null +++ b/queue-4.9/scsi-pm80xx-corrected-dma_unmap_sg-parameter.patch @@ -0,0 +1,37 @@ +From 6366fe23f880714b90b8fea3205f85e9ef75f508 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Sep 2018 14:18:03 +0530 +Subject: scsi: pm80xx: Corrected dma_unmap_sg() parameter + +From: Deepak Ukey + +[ Upstream commit 76cb25b058034d37244be6aca97a2ad52a5fbcad ] + +For the function dma_unmap_sg(), the parameter should be number of +elements in the scatter list prior to the mapping, not after the mapping. + +Signed-off-by: Deepak Ukey +Signed-off-by: Viswas G +Acked-by: Jack Wang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_sas.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index ce584c31d36e5..d1fcd21f7f7dd 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -466,7 +466,7 @@ err_out: + dev_printk(KERN_ERR, pm8001_ha->dev, "pm8001 exec failed[%d]!\n", rc); + if (!sas_protocol_ata(t->task_proto)) + if (n_elem) +- dma_unmap_sg(pm8001_ha->dev, t->scatter, n_elem, ++ dma_unmap_sg(pm8001_ha->dev, t->scatter, t->num_scatter, + t->data_dir); + out_done: + spin_unlock_irqrestore(&pm8001_ha->lock, flags); +-- +2.20.1 + diff --git a/queue-4.9/scsi-pm80xx-fixed-system-hang-issue-during-kexec-boo.patch b/queue-4.9/scsi-pm80xx-fixed-system-hang-issue-during-kexec-boo.patch new file mode 100644 index 00000000000..04e776b71e0 --- /dev/null +++ b/queue-4.9/scsi-pm80xx-fixed-system-hang-issue-during-kexec-boo.patch @@ -0,0 +1,215 @@ +From a32174b76e37a9f22a86200e98d44cba1788ae8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Sep 2018 14:18:04 +0530 +Subject: scsi: pm80xx: Fixed system hang issue during kexec boot + +From: Deepak Ukey + +[ Upstream commit 72349b62a571effd6faadd0600b8e657dd87afbf ] + +When the firmware is not responding, execution of kexec boot causes a system +hang. When firmware assertion happened, driver get notified with interrupt +vector updated in MPI configuration table. Then, the driver will read +scratchpad register and set controller_fatal_error flag to true. + +Signed-off-by: Deepak Ukey +Signed-off-by: Viswas G +Acked-by: Jack Wang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_hwi.c | 6 +++ + drivers/scsi/pm8001/pm8001_sas.c | 7 +++ + drivers/scsi/pm8001/pm8001_sas.h | 1 + + drivers/scsi/pm8001/pm80xx_hwi.c | 80 +++++++++++++++++++++++++++++--- + drivers/scsi/pm8001/pm80xx_hwi.h | 3 ++ + 5 files changed, 91 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c +index 10546faac58c6..f374abfb7f1f8 100644 +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -1479,6 +1479,12 @@ u32 pm8001_mpi_msg_consume(struct pm8001_hba_info *pm8001_ha, + } else { + u32 producer_index; + void *pi_virt = circularQ->pi_virt; ++ /* spurious interrupt during setup if ++ * kexec-ing and driver doing a doorbell access ++ * with the pre-kexec oq interrupt setup ++ */ ++ if (!pi_virt) ++ break; + /* Update the producer index from SPC */ + producer_index = pm8001_read_32(pi_virt); + circularQ->producer_index = cpu_to_le32(producer_index); +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index d1fcd21f7f7dd..e64a13f0bce17 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -374,6 +374,13 @@ static int pm8001_task_exec(struct sas_task *task, + return 0; + } + pm8001_ha = pm8001_find_ha_by_dev(task->dev); ++ if (pm8001_ha->controller_fatal_error) { ++ struct task_status_struct *ts = &t->task_status; ++ ++ ts->resp = SAS_TASK_UNDELIVERED; ++ t->task_done(t); ++ return 0; ++ } + PM8001_IO_DBG(pm8001_ha, pm8001_printk("pm8001_task_exec device \n ")); + spin_lock_irqsave(&pm8001_ha->lock, flags); + do { +diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h +index 6628cc38316c2..d8768ac41ebbf 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.h ++++ b/drivers/scsi/pm8001/pm8001_sas.h +@@ -531,6 +531,7 @@ struct pm8001_hba_info { + u32 logging_level; + u32 fw_status; + u32 smp_exp_mode; ++ bool controller_fatal_error; + const struct firmware *fw_image; + struct isr_param irq_vector[PM8001_MAX_MSIX_VEC]; + }; +diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c +index eb4fee61df729..9edd61c063a1a 100644 +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -572,6 +572,9 @@ static void update_main_config_table(struct pm8001_hba_info *pm8001_ha) + pm8001_ha->main_cfg_tbl.pm80xx_tbl.pcs_event_log_size); + pm8001_mw32(address, MAIN_PCS_EVENT_LOG_OPTION, + pm8001_ha->main_cfg_tbl.pm80xx_tbl.pcs_event_log_severity); ++ /* Update Fatal error interrupt vector */ ++ pm8001_ha->main_cfg_tbl.pm80xx_tbl.fatal_err_interrupt |= ++ ((pm8001_ha->number_of_intr - 1) << 8); + pm8001_mw32(address, MAIN_FATAL_ERROR_INTERRUPT, + pm8001_ha->main_cfg_tbl.pm80xx_tbl.fatal_err_interrupt); + pm8001_mw32(address, MAIN_EVENT_CRC_CHECK, +@@ -1099,6 +1102,9 @@ static int pm80xx_chip_init(struct pm8001_hba_info *pm8001_ha) + return -EBUSY; + } + ++ /* Initialize the controller fatal error flag */ ++ pm8001_ha->controller_fatal_error = false; ++ + /* Initialize pci space address eg: mpi offset */ + init_pci_device_addresses(pm8001_ha); + init_default_table_values(pm8001_ha); +@@ -1207,13 +1213,17 @@ pm80xx_chip_soft_rst(struct pm8001_hba_info *pm8001_ha) + u32 bootloader_state; + u32 ibutton0, ibutton1; + +- /* Check if MPI is in ready state to reset */ +- if (mpi_uninit_check(pm8001_ha) != 0) { +- PM8001_FAIL_DBG(pm8001_ha, +- pm8001_printk("MPI state is not ready\n")); +- return -1; ++ /* Process MPI table uninitialization only if FW is ready */ ++ if (!pm8001_ha->controller_fatal_error) { ++ /* Check if MPI is in ready state to reset */ ++ if (mpi_uninit_check(pm8001_ha) != 0) { ++ regval = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1); ++ PM8001_FAIL_DBG(pm8001_ha, pm8001_printk( ++ "MPI state is not ready scratch1 :0x%x\n", ++ regval)); ++ return -1; ++ } + } +- + /* checked for reset register normal state; 0x0 */ + regval = pm8001_cr32(pm8001_ha, 0, SPC_REG_SOFT_RESET); + PM8001_INIT_DBG(pm8001_ha, +@@ -3717,6 +3727,46 @@ static void process_one_iomb(struct pm8001_hba_info *pm8001_ha, void *piomb) + } + } + ++static void print_scratchpad_registers(struct pm8001_hba_info *pm8001_ha) ++{ ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_SCRATCH_PAD_0: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_0))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_SCRATCH_PAD_1:0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_SCRATCH_PAD_2: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_2))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_SCRATCH_PAD_3: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_3))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_0: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_0))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_1: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_1))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_2: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_2))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_3: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_3))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_4: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_4))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_5: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_5))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_RSVD_SCRATCH_PAD_0: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_6))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_RSVD_SCRATCH_PAD_1: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_7))); ++} ++ + static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec) + { + struct outbound_queue_table *circularQ; +@@ -3724,10 +3774,28 @@ static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec) + u8 uninitialized_var(bc); + u32 ret = MPI_IO_STATUS_FAIL; + unsigned long flags; ++ u32 regval; + ++ if (vec == (pm8001_ha->number_of_intr - 1)) { ++ regval = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1); ++ if ((regval & SCRATCH_PAD_MIPSALL_READY) != ++ SCRATCH_PAD_MIPSALL_READY) { ++ pm8001_ha->controller_fatal_error = true; ++ PM8001_FAIL_DBG(pm8001_ha, pm8001_printk( ++ "Firmware Fatal error! Regval:0x%x\n", regval)); ++ print_scratchpad_registers(pm8001_ha); ++ return ret; ++ } ++ } + spin_lock_irqsave(&pm8001_ha->lock, flags); + circularQ = &pm8001_ha->outbnd_q_tbl[vec]; + do { ++ /* spurious interrupt during setup if kexec-ing and ++ * driver doing a doorbell access w/ the pre-kexec oq ++ * interrupt setup. ++ */ ++ if (!circularQ->pi_virt) ++ break; + ret = pm8001_mpi_msg_consume(pm8001_ha, circularQ, &pMsg1, &bc); + if (MPI_IO_STATUS_SUCCESS == ret) { + /* process the outbound message */ +diff --git a/drivers/scsi/pm8001/pm80xx_hwi.h b/drivers/scsi/pm8001/pm80xx_hwi.h +index 7a443bad61634..411b414a9a0ef 100644 +--- a/drivers/scsi/pm8001/pm80xx_hwi.h ++++ b/drivers/scsi/pm8001/pm80xx_hwi.h +@@ -1288,6 +1288,9 @@ typedef struct SASProtocolTimerConfig SASProtocolTimerConfig_t; + #define SCRATCH_PAD_BOOT_LOAD_SUCCESS 0x0 + #define SCRATCH_PAD_IOP0_READY 0xC00 + #define SCRATCH_PAD_IOP1_READY 0x3000 ++#define SCRATCH_PAD_MIPSALL_READY (SCRATCH_PAD_IOP1_READY | \ ++ SCRATCH_PAD_IOP0_READY | \ ++ SCRATCH_PAD_RAAE_READY) + + /* boot loader state */ + #define SCRATCH_PAD1_BOOTSTATE_MASK 0x70 /* Bit 4-6 */ +-- +2.20.1 + diff --git a/queue-4.9/scsi-sym53c8xx-fix-null-pointer-dereference-panic-in.patch b/queue-4.9/scsi-sym53c8xx-fix-null-pointer-dereference-panic-in.patch new file mode 100644 index 00000000000..4b4b9f47be5 --- /dev/null +++ b/queue-4.9/scsi-sym53c8xx-fix-null-pointer-dereference-panic-in.patch @@ -0,0 +1,79 @@ +From 4211a356110397027d739aec789a807e290dbf0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Aug 2018 11:38:16 -0400 +Subject: scsi: sym53c8xx: fix NULL pointer dereference panic in sym_int_sir() + +From: George Kennedy + +[ Upstream commit 288315e95264b6355e26609e9dec5dc4563d4ab0 ] + +sym_int_sir() in sym_hipd.c does not check the command pointer for NULL before +using it in debug message prints. + +Suggested-by: Matthew Wilcox +Signed-off-by: George Kennedy +Reviewed-by: Mark Kanda +Acked-by: Matthew Wilcox +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/sym53c8xx_2/sym_hipd.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c +index c6425e3df5a04..f1c7714377524 100644 +--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c ++++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c +@@ -4371,6 +4371,13 @@ static void sym_nego_rejected(struct sym_hcb *np, struct sym_tcb *tp, struct sym + OUTB(np, HS_PRT, HS_BUSY); + } + ++#define sym_printk(lvl, tp, cp, fmt, v...) do { \ ++ if (cp) \ ++ scmd_printk(lvl, cp->cmd, fmt, ##v); \ ++ else \ ++ starget_printk(lvl, tp->starget, fmt, ##v); \ ++} while (0) ++ + /* + * chip exception handler for programmed interrupts. + */ +@@ -4416,7 +4423,7 @@ static void sym_int_sir(struct sym_hcb *np) + * been selected with ATN. We do not want to handle that. + */ + case SIR_SEL_ATN_NO_MSG_OUT: +- scmd_printk(KERN_WARNING, cp->cmd, ++ sym_printk(KERN_WARNING, tp, cp, + "No MSG OUT phase after selection with ATN\n"); + goto out_stuck; + /* +@@ -4424,7 +4431,7 @@ static void sym_int_sir(struct sym_hcb *np) + * having reselected the initiator. + */ + case SIR_RESEL_NO_MSG_IN: +- scmd_printk(KERN_WARNING, cp->cmd, ++ sym_printk(KERN_WARNING, tp, cp, + "No MSG IN phase after reselection\n"); + goto out_stuck; + /* +@@ -4432,7 +4439,7 @@ static void sym_int_sir(struct sym_hcb *np) + * an IDENTIFY. + */ + case SIR_RESEL_NO_IDENTIFY: +- scmd_printk(KERN_WARNING, cp->cmd, ++ sym_printk(KERN_WARNING, tp, cp, + "No IDENTIFY after reselection\n"); + goto out_stuck; + /* +@@ -4461,7 +4468,7 @@ static void sym_int_sir(struct sym_hcb *np) + case SIR_RESEL_ABORTED: + np->lastmsg = np->msgout[0]; + np->msgout[0] = M_NOOP; +- scmd_printk(KERN_WARNING, cp->cmd, ++ sym_printk(KERN_WARNING, tp, cp, + "message %x sent on bad reselection\n", np->lastmsg); + goto out; + /* +-- +2.20.1 + diff --git a/queue-4.9/serial-mxs-auart-fix-potential-infinite-loop.patch b/queue-4.9/serial-mxs-auart-fix-potential-infinite-loop.patch new file mode 100644 index 00000000000..2ee498c3689 --- /dev/null +++ b/queue-4.9/serial-mxs-auart-fix-potential-infinite-loop.patch @@ -0,0 +1,48 @@ +From 896fa25ebac769fad7dd708f3e771f2c45e1f359 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Aug 2018 13:59:05 +0300 +Subject: serial: mxs-auart: Fix potential infinite loop +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Anton Vasilyev + +[ Upstream commit 5963e8a3122471cadfe0eba41c4ceaeaa5c8bb4d ] + +On the error path of mxs_auart_request_gpio_irq() is performed +backward iterating with index i of enum type. Underline enum type +may be unsigned char. In this case check (--i >= 0) will be always +true and error handling goes into infinite loop. + +The patch changes the check so that it is valid for signed and unsigned +types. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Anton Vasilyev +Acked-by: Uwe Kleine-König +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/mxs-auart.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c +index 1d9d778828bae..515bf18c82943 100644 +--- a/drivers/tty/serial/mxs-auart.c ++++ b/drivers/tty/serial/mxs-auart.c +@@ -1635,8 +1635,9 @@ static int mxs_auart_request_gpio_irq(struct mxs_auart_port *s) + + /* + * If something went wrong, rollback. ++ * Be careful: i may be unsigned. + */ +- while (err && (--i >= 0)) ++ while (err && (i-- > 0)) + if (irq[i] >= 0) + free_irq(irq[i], s); + +-- +2.20.1 + diff --git a/queue-4.9/series b/queue-4.9/series index e54c1087ff1..4b71c6e47e1 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -14,3 +14,133 @@ iommu-vt-d-fix-qi_dev_iotlb_pfsid-and-qi_dev_eiotlb_pfsid-macros.patch mm-memcg-switch-to-css_tryget-in-get_mem_cgroup_from_mm.patch mm-hugetlb-switch-to-css_tryget-in-hugetlb_cgroup_charge_cgroup.patch mmc-sdhci-of-at91-fix-quirk2-overwrite.patch +ath10k-fix-kernel-panic-by-moving-pci-flush-after-na.patch +iio-dac-mcp4922-fix-error-handling-in-mcp4922_write_.patch +alsa-pcm-signedness-bug-in-snd_pcm_plug_alloc.patch +arm64-dts-tegra210-p2180-correct-sdmmc4-vqmmc-supply.patch +arm-dts-at91-trivial-fix-usart1-definition-for-at91s.patch +cfg80211-avoid-regulatory-restore-when-country_ie_ig.patch +alsa-seq-do-error-checks-at-creating-system-ports.patch +ath9k-fix-tx99-with-monitor-mode-interface.patch +gfs2-don-t-set-gfs2_rdf_uptodate-when-the-lvb-is-upd.patch +asoc-dpcm-properly-initialise-hw-rate_max.patch +mips-bcm47xx-enable-usb-power-on-netgear-wndr3400v3.patch +arm-dts-exynos-fix-sound-in-snow-rev5-chromebook.patch +arm-dts-exynos-fix-regulators-configuration-on-peach.patch +i40e-use-correct-length-for-strncpy.patch +i40e-hold-the-rtnl-lock-on-clearing-interrupt-scheme.patch +i40e-prevent-deleting-mac-address-from-vf-when-set-b.patch +ib-rxe-fixes-for-rdma-read-retry.patch +iwlwifi-mvm-avoid-sending-too-many-bars.patch +arm-dts-pxa-fix-power-i2c-base-address.patch +rtl8187-fix-warning-generated-when-strncpy-destinati.patch +net-lan78xx-bail-out-if-lan78xx_get_endpoints-fails.patch +asoc-sgtl5000-avoid-division-by-zero-if-lo_vag-is-ze.patch +arm-dts-exynos-disable-pull-control-for-s5m8767-pmic.patch +ath10k-wmi-disable-softirq-s-while-calling-ieee80211.patch +mips-txx9-fix-iounmap-related-issue.patch +asoc-intel-hdac_hdmi-limit-sampling-rates-at-dai-cre.patch +of-make-powermac-cache-node-search-conditional-on-co.patch +arm-dts-omap3-gta04-give-spi_lcd-node-a-label-so-tha.patch +arm-dts-omap3-gta04-fixes-for-tvout-venc.patch +arm-dts-omap3-gta04-tvout-enable-as-display1-alias.patch +arm-dts-omap3-gta04-fix-touchscreen-tsc2007.patch +arm-dts-omap3-gta04-make-nand-partitions-compatible-.patch +arm-dts-omap3-gta04-keep-vpll2-always-on.patch +dmaengine-dma-jz4780-don-t-depend-on-mach_jz4780.patch +dmaengine-dma-jz4780-further-residue-status-fix.patch +ath9k-add-back-support-for-using-active-monitor-inte.patch +signal-always-ignore-sigkill-and-sigstop-sent-to-the.patch +signal-properly-deliver-sigill-from-uprobes.patch +signal-properly-deliver-sigsegv-from-x86-uprobes.patch +f2fs-fix-memory-leak-of-percpu-counter-in-fill_super.patch +scsi-sym53c8xx-fix-null-pointer-dereference-panic-in.patch +arm-imx6-register-pm_power_off-handler-if-fsl-pmic-s.patch +scsi-pm80xx-corrected-dma_unmap_sg-parameter.patch +scsi-pm80xx-fixed-system-hang-issue-during-kexec-boo.patch +kprobes-don-t-call-bug_on-if-there-is-a-kprobe-in-us.patch +nvmem-core-return-error-code-instead-of-null-from-nv.patch +media-fix-media-pci-meye-validate-offset-to-avoid-ar.patch +media-dvb-fix-compat-ioctl-translation.patch +alsa-intel8x0m-register-irq-handler-after-register-i.patch +pinctrl-at91-pio4-fix-has_config-check-in-atmel_pctl.patch +llc-avoid-blocking-in-llc_sap_close.patch +arm-dts-qcom-ipq4019-fix-cpu0-s-qcom-saw2-reg-value.patch +powerpc-vdso-correct-call-frame-information.patch +arm-dts-socfpga-fix-i2c-bus-unit-address-error.patch +pinctrl-at91-don-t-use-the-same-irqchip-with-multipl.patch +cxgb4-fix-endianness-issue-in-t4_fwcache.patch +power-supply-ab8500_fg-silence-uninitialized-variabl.patch +power-reset-at91-poweroff-do-not-procede-if-at91_shd.patch +power-supply-max8998-charger-fix-platform-data-retri.patch +component-fix-loop-condition-to-call-unbind-if-bind-.patch +kernfs-fix-range-checks-in-kernfs_get_target_path.patch +ip_gre-fix-parsing-gre-header-in-ipgre_err.patch +arm-dts-rockchip-fix-erroneous-spi-bus-dtc-warnings-.patch +ath9k-fix-a-locking-bug-in-ath9k_add_interface.patch +s390-qeth-invoke-softirqs-after-napi_schedule.patch +pci-acpi-correct-error-message-for-aspm-disabling.patch +serial-mxs-auart-fix-potential-infinite-loop.patch +powerpc-iommu-avoid-derefence-before-pointer-check.patch +powerpc-64s-hash-fix-stab_rr-off-by-one-initializati.patch +powerpc-pseries-disable-cpu-hotplug-across-migration.patch +rdma-i40iw-fix-incorrect-iterator-type.patch +libfdt-ensure-int_max-is-defined-in-libfdt_env.h.patch +power-supply-twl4030_charger-fix-charging-current-ou.patch +power-supply-twl4030_charger-disable-eoc-interrupt-o.patch +net-toshiba-fix-return-type-of-ndo_start_xmit-functi.patch +net-xilinx-fix-return-type-of-ndo_start_xmit-functio.patch +net-broadcom-fix-return-type-of-ndo_start_xmit-funct.patch +net-amd-fix-return-type-of-ndo_start_xmit-function.patch +usb-chipidea-imx-enable-otg-overcurrent-in-case-usb-.patch +usb-chipidea-fix-otg-event-handler.patch +mlxsw-spectrum-init-shaper-for-tcs-8.15.patch +arm-dts-am335x-evm-fix-number-of-cpsw.patch +f2fs-fix-to-recover-inode-s-uid-gid-during-por.patch +arm-dts-ux500-correct-scu-unit-address.patch +arm-dts-ux500-fix-lcda-clock-line-muxing.patch +arm-dts-ste-fix-spi-controller-node-names.patch +spi-pic32-use-proper-enum-in-dmaengine_prep_slave_rg.patch +cpufeature-avoid-warning-when-compiling-with-clang.patch +arm-dts-marvell-fix-spi-and-i2c-bus-warnings.patch +bnx2x-ignore-bandwidth-attention-in-single-function-.patch +net-micrel-fix-return-type-of-ndo_start_xmit-functio.patch +x86-cpu-use-correct-macros-for-cyrix-calls.patch +mips-kexec-relax-memory-restriction.patch +media-pci-ivtv-fix-a-sleep-in-atomic-context-bug-in-.patch +media-au0828-fix-incorrect-error-messages.patch +media-davinci-fix-implicit-enum-conversion-warning.patch +usb-gadget-uvc-configfs-drop-leaked-references-to-co.patch +usb-gadget-uvc-configfs-prevent-format-changes-after.patch +phy-phy-twl4030-usb-fix-denied-runtime-access.patch +usb-gadget-uvc-factor-out-video-usb-request-queueing.patch +usb-gadget-uvc-only-halt-video-streaming-endpoint-in.patch +coresight-fix-handling-of-sinks.patch +coresight-etm4x-configure-el2-exception-level-when-k.patch +coresight-tmc-fix-byte-address-alignment-for-rrp.patch +misc-kgdbts-fix-restrict-error.patch +misc-genwqe-should-return-proper-error-value.patch +vfio-pci-fix-potential-memory-leak-in-vfio_msi_cap_l.patch +vfio-pci-mask-buggy-sr-iov-vf-intx-support.patch +scsi-libsas-always-unregister-the-old-device-if-goin.patch +arm-dts-tegra30-fix-xcvr-setup-use-fuses.patch +arm-tegra-apalis_t30-fix-mmc1-cmd-pull-up.patch +arm-dts-paz00-fix-wakeup-gpio-keycode.patch +net-smsc-fix-return-type-of-ndo_start_xmit-function.patch +edac-raise-the-maximum-number-of-memory-controllers.patch +arm-dts-realview-fix-spi-controller-node-names.patch +bluetooth-l2cap-detect-if-remote-is-not-able-to-use-.patch +crypto-s5p-sss-fix-fix-argument-list-alignment.patch +crypto-fix-a-memory-leak-in-rsa-kcs1pad-s-encryption.patch +scsi-ncr5380-clear-all-unissued-commands-on-host-res.patch +scsi-ncr5380-use-driver_sense-to-indicate-valid-sens.patch +scsi-ncr5380-check-for-invalid-reselection-target.patch +scsi-ncr5380-don-t-clear-busy-flag-when-abort-fails.patch +scsi-ncr5380-don-t-call-dsprintk-following-reselecti.patch +scsi-ncr5380-handle-bus-free-during-reselection.patch +arm64-dts-amd-fix-spi-bus-warnings.patch +arm64-dts-lg-fix-spi-controller-node-names.patch +arm-dts-lpc32xx-fix-spi-controller-node-names.patch +usb-xhci-mtk-fix-isoc-error-when-interval-is-zero.patch +fuse-use-read_once-on-congestion_threshold-and-max_b.patch +ib-iser-fix-possible-null-deref-at-iser_inv_desc.patch diff --git a/queue-4.9/signal-always-ignore-sigkill-and-sigstop-sent-to-the.patch b/queue-4.9/signal-always-ignore-sigkill-and-sigstop-sent-to-the.patch new file mode 100644 index 00000000000..b7ca156eca6 --- /dev/null +++ b/queue-4.9/signal-always-ignore-sigkill-and-sigstop-sent-to-the.patch @@ -0,0 +1,44 @@ +From ebde3207089ebf6fc04c86c3272fb75be515e6f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jul 2018 19:47:27 -0500 +Subject: signal: Always ignore SIGKILL and SIGSTOP sent to the global init + +From: Eric W. Biederman + +[ Upstream commit 86989c41b5ea08776c450cb759592532314a4ed6 ] + +If the first process started (aka /sbin/init) receives a SIGKILL it +will panic the system if it is delivered. Making the system unusable +and undebugable. It isn't much better if the first process started +receives SIGSTOP. + +So always ignore SIGSTOP and SIGKILL sent to init. + +This is done in a separate clause in sig_task_ignored as force_sig_info +can clear SIG_UNKILLABLE and this protection should work even then. + +Reviewed-by: Thomas Gleixner +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Sasha Levin +--- + kernel/signal.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/kernel/signal.c b/kernel/signal.c +index 2bb1f9dc86c7d..30914b3c76b21 100644 +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -71,6 +71,10 @@ static int sig_task_ignored(struct task_struct *t, int sig, bool force) + + handler = sig_handler(t, sig); + ++ /* SIGKILL and SIGSTOP may not be sent to the global init */ ++ if (unlikely(is_global_init(t) && sig_kernel_only(sig))) ++ return true; ++ + if (unlikely(t->signal->flags & SIGNAL_UNKILLABLE) && + handler == SIG_DFL && !(force && sig_kernel_only(sig))) + return 1; +-- +2.20.1 + diff --git a/queue-4.9/signal-properly-deliver-sigill-from-uprobes.patch b/queue-4.9/signal-properly-deliver-sigill-from-uprobes.patch new file mode 100644 index 00000000000..bea6c556776 --- /dev/null +++ b/queue-4.9/signal-properly-deliver-sigill-from-uprobes.patch @@ -0,0 +1,55 @@ +From bb07409ddd536fa127f338a92280d8ff3d436d71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jul 2018 20:33:53 -0500 +Subject: signal: Properly deliver SIGILL from uprobes + +From: Eric W. Biederman + +[ Upstream commit 55a3235fc71bf34303e34a95eeee235b2d2a35dd ] + +For userspace to tell the difference between a random signal and an +exception, the exception must include siginfo information. + +Using SEND_SIG_FORCED for SIGILL is thus wrong, and it will result +in userspace seeing si_code == SI_USER (like a random signal) instead +of si_code == SI_KERNEL or a more specific si_code as all exceptions +deliver. + +Therefore replace force_sig_info(SIGILL, SEND_SIG_FORCE, current) +with force_sig(SIG_ILL, current) which gets this right and is +shorter and easier to type. + +Fixes: 014940bad8e4 ("uprobes/x86: Send SIGILL if arch_uprobe_post_xol() fails") +Fixes: 0b5256c7f173 ("uprobes: Send SIGILL if handle_trampoline() fails") +Reviewed-by: Thomas Gleixner +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Sasha Levin +--- + kernel/events/uprobes.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c +index fbfab5722254a..8ddd29476c0dc 100644 +--- a/kernel/events/uprobes.c ++++ b/kernel/events/uprobes.c +@@ -1846,7 +1846,7 @@ static void handle_trampoline(struct pt_regs *regs) + + sigill: + uprobe_warn(current, "handle uretprobe, sending SIGILL."); +- force_sig_info(SIGILL, SEND_SIG_FORCED, current); ++ force_sig(SIGILL, current); + + } + +@@ -1962,7 +1962,7 @@ static void handle_singlestep(struct uprobe_task *utask, struct pt_regs *regs) + + if (unlikely(err)) { + uprobe_warn(current, "execute the probed insn, sending SIGILL."); +- force_sig_info(SIGILL, SEND_SIG_FORCED, current); ++ force_sig(SIGILL, current); + } + } + +-- +2.20.1 + diff --git a/queue-4.9/signal-properly-deliver-sigsegv-from-x86-uprobes.patch b/queue-4.9/signal-properly-deliver-sigsegv-from-x86-uprobes.patch new file mode 100644 index 00000000000..04645ff5e21 --- /dev/null +++ b/queue-4.9/signal-properly-deliver-sigsegv-from-x86-uprobes.patch @@ -0,0 +1,45 @@ +From 4f9cb56ceda8453beebec05107b9334f03f097ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jul 2018 20:48:30 -0500 +Subject: signal: Properly deliver SIGSEGV from x86 uprobes + +From: Eric W. Biederman + +[ Upstream commit 4a63c1ffd384ebdce40aac9c997dab68379137be ] + +For userspace to tell the difference between an random signal +and an exception, the exception must include siginfo information. + +Using SEND_SIG_FORCED for SIGSEGV is thus wrong, and it will result in +userspace seeing si_code == SI_USER (like a random signal) instead of +si_code == SI_KERNEL or a more specific si_code as all exceptions +deliver. + +Therefore replace force_sig_info(SIGSEGV, SEND_SIG_FORCE, current) +with force_sig(SIG_SEGV, current) which gets this right and is shorter +and easier to type. + +Fixes: 791eca10107f ("uretprobes/x86: Hijack return address") +Reviewed-by: Thomas Gleixner +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/uprobes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c +index e35466afe989d..eac679ab543f6 100644 +--- a/arch/x86/kernel/uprobes.c ++++ b/arch/x86/kernel/uprobes.c +@@ -983,7 +983,7 @@ arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs + pr_err("uprobe: return address clobbered: pid=%d, %%sp=%#lx, " + "%%ip=%#lx\n", current->pid, regs->sp, regs->ip); + +- force_sig_info(SIGSEGV, SEND_SIG_FORCED, current); ++ force_sig(SIGSEGV, current); + } + + return -1; +-- +2.20.1 + diff --git a/queue-4.9/spi-pic32-use-proper-enum-in-dmaengine_prep_slave_rg.patch b/queue-4.9/spi-pic32-use-proper-enum-in-dmaengine_prep_slave_rg.patch new file mode 100644 index 00000000000..0eea366057c --- /dev/null +++ b/queue-4.9/spi-pic32-use-proper-enum-in-dmaengine_prep_slave_rg.patch @@ -0,0 +1,59 @@ +From 388107a72fa45b3a70a9cdacdacd6fb37d6e976b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Sep 2018 16:13:37 -0700 +Subject: spi: pic32: Use proper enum in dmaengine_prep_slave_rg + +From: Nathan Chancellor + +[ Upstream commit 8cfde7847d5ed0bb77bace41519572963e43cd17 ] + +Clang warns when one enumerated type is converted implicitly to another: + +drivers/spi/spi-pic32.c:323:8: warning: implicit conversion from +enumeration type 'enum dma_data_direction' to different enumeration type +'enum dma_transfer_direction' [-Wenum-conversion] + DMA_FROM_DEVICE, + ^~~~~~~~~~~~~~~ +drivers/spi/spi-pic32.c:333:8: warning: implicit conversion from +enumeration type 'enum dma_data_direction' to different enumeration type +'enum dma_transfer_direction' [-Wenum-conversion] + DMA_TO_DEVICE, + ^~~~~~~~~~~~~ +2 warnings generated. + +Use the proper enums from dma_transfer_direction (DMA_FROM_DEVICE = +DMA_DEV_TO_MEM = 2, DMA_TO_DEVICE = DMA_MEM_TO_DEV = 1) to satify Clang. + +Link: https://github.com/ClangBuiltLinux/linux/issues/159 +Signed-off-by: Nathan Chancellor +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-pic32.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-pic32.c b/drivers/spi/spi-pic32.c +index fefb688a34328..2f4df804c4d80 100644 +--- a/drivers/spi/spi-pic32.c ++++ b/drivers/spi/spi-pic32.c +@@ -320,7 +320,7 @@ static int pic32_spi_dma_transfer(struct pic32_spi *pic32s, + desc_rx = dmaengine_prep_slave_sg(master->dma_rx, + xfer->rx_sg.sgl, + xfer->rx_sg.nents, +- DMA_FROM_DEVICE, ++ DMA_DEV_TO_MEM, + DMA_PREP_INTERRUPT | DMA_CTRL_ACK); + if (!desc_rx) { + ret = -EINVAL; +@@ -330,7 +330,7 @@ static int pic32_spi_dma_transfer(struct pic32_spi *pic32s, + desc_tx = dmaengine_prep_slave_sg(master->dma_tx, + xfer->tx_sg.sgl, + xfer->tx_sg.nents, +- DMA_TO_DEVICE, ++ DMA_MEM_TO_DEV, + DMA_PREP_INTERRUPT | DMA_CTRL_ACK); + if (!desc_tx) { + ret = -EINVAL; +-- +2.20.1 + diff --git a/queue-4.9/usb-chipidea-fix-otg-event-handler.patch b/queue-4.9/usb-chipidea-fix-otg-event-handler.patch new file mode 100644 index 00000000000..399d71d793b --- /dev/null +++ b/queue-4.9/usb-chipidea-fix-otg-event-handler.patch @@ -0,0 +1,48 @@ +From fc0d4b8f538607c45d55671fe63027c27be17b96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Sep 2018 17:18:58 +0200 +Subject: usb: chipidea: Fix otg event handler + +From: Loic Poulain + +[ Upstream commit 59739131e0ca06db7560f9073fff2fb83f6bc2a5 ] + +At OTG work running time, it's possible that several events need to be +addressed (e.g. ID and VBUS events). The current implementation handles +only one event at a time which leads to ignoring the other one. Fix it. + +Signed-off-by: Loic Poulain +Signed-off-by: Peter Chen +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/otg.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c +index f36a1ac3bfbdf..b8650210be0f7 100644 +--- a/drivers/usb/chipidea/otg.c ++++ b/drivers/usb/chipidea/otg.c +@@ -206,14 +206,17 @@ static void ci_otg_work(struct work_struct *work) + } + + pm_runtime_get_sync(ci->dev); ++ + if (ci->id_event) { + ci->id_event = false; + ci_handle_id_switch(ci); +- } else if (ci->b_sess_valid_event) { ++ } ++ ++ if (ci->b_sess_valid_event) { + ci->b_sess_valid_event = false; + ci_handle_vbus_change(ci); +- } else +- dev_err(ci->dev, "unexpected event occurs at %s\n", __func__); ++ } ++ + pm_runtime_put_sync(ci->dev); + + enable_irq(ci->irq); +-- +2.20.1 + diff --git a/queue-4.9/usb-chipidea-imx-enable-otg-overcurrent-in-case-usb-.patch b/queue-4.9/usb-chipidea-imx-enable-otg-overcurrent-in-case-usb-.patch new file mode 100644 index 00000000000..bb905b126ea --- /dev/null +++ b/queue-4.9/usb-chipidea-imx-enable-otg-overcurrent-in-case-usb-.patch @@ -0,0 +1,40 @@ +From b5e9622c03079b44ae79500dbfae87c98044412f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Aug 2018 15:59:56 +0200 +Subject: usb: chipidea: imx: enable OTG overcurrent in case USB subsystem is + already started + +From: Nicolas Adell + +[ Upstream commit 1dedbdf2bbb1ede8d96f35f9845ecae179dc1988 ] + +When initializing the USB subsystem before starting the kernel, +OTG overcurrent detection is disabled. In case the OTG polarity of +overcurrent is low active, the overcurrent detection is never enabled +again and events cannot be reported as expected. Because imx usb +overcurrent polarity is low active by default, only detection needs +to be enable in usbmisc init function. + +Signed-off-by: Nicolas Adell +Signed-off-by: Peter Chen +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/usbmisc_imx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/chipidea/usbmisc_imx.c b/drivers/usb/chipidea/usbmisc_imx.c +index 20d02a5e418d9..c6577f489d0f6 100644 +--- a/drivers/usb/chipidea/usbmisc_imx.c ++++ b/drivers/usb/chipidea/usbmisc_imx.c +@@ -273,6 +273,8 @@ static int usbmisc_imx6q_init(struct imx_usbmisc_data *data) + } else if (data->oc_polarity == 1) { + /* High active */ + reg &= ~(MX6_BM_OVER_CUR_DIS | MX6_BM_OVER_CUR_POLARITY); ++ } else { ++ reg &= ~(MX6_BM_OVER_CUR_DIS); + } + writel(reg, usbmisc->base + data->index * 4); + +-- +2.20.1 + diff --git a/queue-4.9/usb-gadget-uvc-configfs-drop-leaked-references-to-co.patch b/queue-4.9/usb-gadget-uvc-configfs-drop-leaked-references-to-co.patch new file mode 100644 index 00000000000..8f6c8302a9e --- /dev/null +++ b/queue-4.9/usb-gadget-uvc-configfs-drop-leaked-references-to-co.patch @@ -0,0 +1,59 @@ +From 73f5353b29b143b3e01d8671dcf4daa7ff2383c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Aug 2018 00:14:00 +0300 +Subject: usb: gadget: uvc: configfs: Drop leaked references to config items + +From: Laurent Pinchart + +[ Upstream commit 86f3daed59bceb4fa7981d85e89f63ebbae1d561 ] + +Some of the .allow_link() and .drop_link() operations implementations +call config_group_find_item() and then leak the reference to the +returned item. Fix this by dropping those references where needed. + +Signed-off-by: Laurent Pinchart +Reviewed-by: Kieran Bingham +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/uvc_configfs.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c +index d7dcd39fe12cb..3803dda54666b 100644 +--- a/drivers/usb/gadget/function/uvc_configfs.c ++++ b/drivers/usb/gadget/function/uvc_configfs.c +@@ -543,6 +543,7 @@ static int uvcg_control_class_allow_link(struct config_item *src, + unlock: + mutex_unlock(&opts->lock); + out: ++ config_item_put(header); + mutex_unlock(su_mutex); + return ret; + } +@@ -584,6 +585,7 @@ static int uvcg_control_class_drop_link(struct config_item *src, + unlock: + mutex_unlock(&opts->lock); + out: ++ config_item_put(header); + mutex_unlock(su_mutex); + return ret; + } +@@ -2047,6 +2049,7 @@ static int uvcg_streaming_class_allow_link(struct config_item *src, + unlock: + mutex_unlock(&opts->lock); + out: ++ config_item_put(header); + mutex_unlock(su_mutex); + return ret; + } +@@ -2091,6 +2094,7 @@ static int uvcg_streaming_class_drop_link(struct config_item *src, + unlock: + mutex_unlock(&opts->lock); + out: ++ config_item_put(header); + mutex_unlock(su_mutex); + return ret; + } +-- +2.20.1 + diff --git a/queue-4.9/usb-gadget-uvc-configfs-prevent-format-changes-after.patch b/queue-4.9/usb-gadget-uvc-configfs-prevent-format-changes-after.patch new file mode 100644 index 00000000000..409202d8ddc --- /dev/null +++ b/queue-4.9/usb-gadget-uvc-configfs-prevent-format-changes-after.patch @@ -0,0 +1,47 @@ +From b6ee7c4fe87d04ca210c6a5382eb0b6bb6d17a74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 May 2018 21:02:12 +0200 +Subject: usb: gadget: uvc: configfs: Prevent format changes after linking + header + +From: Joel Pepper + +[ Upstream commit cb2200f7af8341aaf0c6abd7ba37e4c667c41639 ] + +While checks are in place to avoid attributes and children of a format +being manipulated after the format is linked into the streaming header, +the linked flag was never actually set, invalidating the protections. +Update the flag as appropriate in the header link calls. + +Signed-off-by: Joel Pepper +Reviewed-by: Kieran Bingham +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/uvc_configfs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c +index 3803dda54666b..3d843e14447bb 100644 +--- a/drivers/usb/gadget/function/uvc_configfs.c ++++ b/drivers/usb/gadget/function/uvc_configfs.c +@@ -772,6 +772,7 @@ static int uvcg_streaming_header_allow_link(struct config_item *src, + format_ptr->fmt = target_fmt; + list_add_tail(&format_ptr->entry, &src_hdr->formats); + ++src_hdr->num_fmt; ++ ++target_fmt->linked; + + out: + mutex_unlock(&opts->lock); +@@ -810,6 +811,8 @@ static int uvcg_streaming_header_drop_link(struct config_item *src, + break; + } + ++ --target_fmt->linked; ++ + out: + mutex_unlock(&opts->lock); + mutex_unlock(su_mutex); +-- +2.20.1 + diff --git a/queue-4.9/usb-gadget-uvc-factor-out-video-usb-request-queueing.patch b/queue-4.9/usb-gadget-uvc-factor-out-video-usb-request-queueing.patch new file mode 100644 index 00000000000..a767d1b1cc7 --- /dev/null +++ b/queue-4.9/usb-gadget-uvc-factor-out-video-usb-request-queueing.patch @@ -0,0 +1,87 @@ +From d579e3b6addbb64ebc2577b80ed2ab1f681d0a7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Aug 2018 15:42:03 +0300 +Subject: usb: gadget: uvc: Factor out video USB request queueing + +From: Laurent Pinchart + +[ Upstream commit 9d1ff5dcb3cd3390b1e56f1c24ae42c72257c4a3 ] + +USB requests for video data are queued from two different locations in +the driver, with the same code block occurring twice. Factor it out to a +function. + +Signed-off-by: Laurent Pinchart +Reviewed-by: Paul Elder +Tested-by: Paul Elder +Reviewed-by: Kieran Bingham +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/uvc_video.c | 30 ++++++++++++++++--------- + 1 file changed, 20 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c +index 0f01c04d7cbd8..540917f54506a 100644 +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -129,6 +129,19 @@ uvc_video_encode_isoc(struct usb_request *req, struct uvc_video *video, + * Request handling + */ + ++static int uvcg_video_ep_queue(struct uvc_video *video, struct usb_request *req) ++{ ++ int ret; ++ ++ ret = usb_ep_queue(video->ep, req, GFP_ATOMIC); ++ if (ret < 0) { ++ printk(KERN_INFO "Failed to queue request (%d).\n", ret); ++ usb_ep_set_halt(video->ep); ++ } ++ ++ return ret; ++} ++ + /* + * I somehow feel that synchronisation won't be easy to achieve here. We have + * three events that control USB requests submission: +@@ -193,14 +206,13 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req) + + video->encode(req, video, buf); + +- if ((ret = usb_ep_queue(ep, req, GFP_ATOMIC)) < 0) { +- printk(KERN_INFO "Failed to queue request (%d).\n", ret); +- usb_ep_set_halt(ep); +- spin_unlock_irqrestore(&video->queue.irqlock, flags); ++ ret = uvcg_video_ep_queue(video, req); ++ spin_unlock_irqrestore(&video->queue.irqlock, flags); ++ ++ if (ret < 0) { + uvcg_queue_cancel(queue, 0); + goto requeue; + } +- spin_unlock_irqrestore(&video->queue.irqlock, flags); + + return; + +@@ -320,15 +332,13 @@ int uvcg_video_pump(struct uvc_video *video) + video->encode(req, video, buf); + + /* Queue the USB request */ +- ret = usb_ep_queue(video->ep, req, GFP_ATOMIC); ++ ret = uvcg_video_ep_queue(video, req); ++ spin_unlock_irqrestore(&queue->irqlock, flags); ++ + if (ret < 0) { +- printk(KERN_INFO "Failed to queue request (%d)\n", ret); +- usb_ep_set_halt(video->ep); +- spin_unlock_irqrestore(&queue->irqlock, flags); + uvcg_queue_cancel(queue, 0); + break; + } +- spin_unlock_irqrestore(&queue->irqlock, flags); + } + + spin_lock_irqsave(&video->req_lock, flags); +-- +2.20.1 + diff --git a/queue-4.9/usb-gadget-uvc-only-halt-video-streaming-endpoint-in.patch b/queue-4.9/usb-gadget-uvc-only-halt-video-streaming-endpoint-in.patch new file mode 100644 index 00000000000..b27b0970265 --- /dev/null +++ b/queue-4.9/usb-gadget-uvc-only-halt-video-streaming-endpoint-in.patch @@ -0,0 +1,44 @@ +From a35cc23d1be374183bd31bf1b481c1fa159740fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Aug 2018 15:44:57 +0300 +Subject: usb: gadget: uvc: Only halt video streaming endpoint in bulk mode + +From: Laurent Pinchart + +[ Upstream commit 8dbf9c7abefd5c1434a956d5c6b25e11183061a3 ] + +When USB requests for video data fail to be submitted, the driver +signals a problem to the host by halting the video streaming endpoint. +This is only valid in bulk mode, as isochronous transfers have no +handshake phase and can't thus report a stall. The usb_ep_set_halt() +call returns an error when using isochronous endpoints, which we happily +ignore, but some UDCs complain in the kernel log. Fix this by only +trying to halt the endpoint in bulk mode. + +Signed-off-by: Laurent Pinchart +Reviewed-by: Paul Elder +Tested-by: Paul Elder +Reviewed-by: Kieran Bingham +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/uvc_video.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c +index 540917f54506a..d6bab12b0b47d 100644 +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -136,7 +136,9 @@ static int uvcg_video_ep_queue(struct uvc_video *video, struct usb_request *req) + ret = usb_ep_queue(video->ep, req, GFP_ATOMIC); + if (ret < 0) { + printk(KERN_INFO "Failed to queue request (%d).\n", ret); +- usb_ep_set_halt(video->ep); ++ /* Isochronous endpoints can't be halted. */ ++ if (usb_endpoint_xfer_bulk(video->ep->desc)) ++ usb_ep_set_halt(video->ep); + } + + return ret; +-- +2.20.1 + diff --git a/queue-4.9/usb-xhci-mtk-fix-isoc-error-when-interval-is-zero.patch b/queue-4.9/usb-xhci-mtk-fix-isoc-error-when-interval-is-zero.patch new file mode 100644 index 00000000000..a76a4cbb5be --- /dev/null +++ b/queue-4.9/usb-xhci-mtk-fix-isoc-error-when-interval-is-zero.patch @@ -0,0 +1,38 @@ +From b3a90fe54a15ec722732a9c8710ecbcd3597e540 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Sep 2018 19:13:32 +0300 +Subject: usb: xhci-mtk: fix ISOC error when interval is zero + +From: Chunfeng Yun + +[ Upstream commit 87173acc0d8f0987bda8827da35fff67f52ad15d ] + +If the interval equal zero, needn't round up to power of two +for the number of packets in each ESIT, so fix it. + +Signed-off-by: Chunfeng Yun +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-mtk-sch.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/host/xhci-mtk-sch.c b/drivers/usb/host/xhci-mtk-sch.c +index 73f763c4f5f59..144674913c788 100644 +--- a/drivers/usb/host/xhci-mtk-sch.c ++++ b/drivers/usb/host/xhci-mtk-sch.c +@@ -122,7 +122,9 @@ static void setup_sch_info(struct usb_device *udev, + } + + if (ep_type == ISOC_IN_EP || ep_type == ISOC_OUT_EP) { +- if (esit_pkts <= sch_ep->esit) ++ if (sch_ep->esit == 1) ++ sch_ep->pkts = esit_pkts; ++ else if (esit_pkts <= sch_ep->esit) + sch_ep->pkts = 1; + else + sch_ep->pkts = roundup_pow_of_two(esit_pkts) +-- +2.20.1 + diff --git a/queue-4.9/vfio-pci-fix-potential-memory-leak-in-vfio_msi_cap_l.patch b/queue-4.9/vfio-pci-fix-potential-memory-leak-in-vfio_msi_cap_l.patch new file mode 100644 index 00000000000..f5960688e5e --- /dev/null +++ b/queue-4.9/vfio-pci-fix-potential-memory-leak-in-vfio_msi_cap_l.patch @@ -0,0 +1,38 @@ +From 087faafc00d7bbc6ef8413e5bf075dc4f3ab1ebe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Sep 2018 13:01:27 -0600 +Subject: vfio/pci: Fix potential memory leak in vfio_msi_cap_len + +From: Li Qiang + +[ Upstream commit 30ea32ab1951c80c6113f300fce2c70cd12659e4 ] + +Free allocated vdev->msi_perm in error path. + +Signed-off-by: Li Qiang +Reviewed-by: Eric Auger +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/vfio_pci_config.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c +index 7b8a957b008d2..06a20ea183dd6 100644 +--- a/drivers/vfio/pci/vfio_pci_config.c ++++ b/drivers/vfio/pci/vfio_pci_config.c +@@ -1182,8 +1182,10 @@ static int vfio_msi_cap_len(struct vfio_pci_device *vdev, u8 pos) + return -ENOMEM; + + ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); +- if (ret) ++ if (ret) { ++ kfree(vdev->msi_perm); + return ret; ++ } + + return len; + } +-- +2.20.1 + diff --git a/queue-4.9/vfio-pci-mask-buggy-sr-iov-vf-intx-support.patch b/queue-4.9/vfio-pci-mask-buggy-sr-iov-vf-intx-support.patch new file mode 100644 index 00000000000..d4958b4633c --- /dev/null +++ b/queue-4.9/vfio-pci-mask-buggy-sr-iov-vf-intx-support.patch @@ -0,0 +1,102 @@ +From b8a0dd2c0f81f5ab3760c86f02ad58ee83f0da55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Sep 2018 13:01:27 -0600 +Subject: vfio/pci: Mask buggy SR-IOV VF INTx support + +From: Alex Williamson + +[ Upstream commit db04264fe9bc0f2b62e036629f9afb530324b693 ] + +The SR-IOV spec requires that VFs must report zero for the INTx pin +register as VFs are precluded from INTx support. It's much easier for +the host kernel to understand whether a device is a VF and therefore +whether a non-zero pin register value is bogus than it is to do the +same in userspace. Override the INTx count for such devices and +virtualize the pin register to provide a consistent view of the device +to the user. + +As this is clearly a spec violation, warn about it to support hardware +validation, but also provide a known whitelist as it doesn't do much +good to continue complaining if the hardware vendor doesn't plan to +fix it. + +Known devices with this issue: 8086:270c + +Tested-by: Gage Eads +Reviewed-by: Ashok Raj +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/vfio_pci.c | 8 ++++++-- + drivers/vfio/pci/vfio_pci_config.c | 27 +++++++++++++++++++++++++++ + 2 files changed, 33 insertions(+), 2 deletions(-) + +diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c +index a1a712d18e028..da3f0ed18c769 100644 +--- a/drivers/vfio/pci/vfio_pci.c ++++ b/drivers/vfio/pci/vfio_pci.c +@@ -426,10 +426,14 @@ static int vfio_pci_get_irq_count(struct vfio_pci_device *vdev, int irq_type) + { + if (irq_type == VFIO_PCI_INTX_IRQ_INDEX) { + u8 pin; ++ ++ if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX) || ++ vdev->nointx || vdev->pdev->is_virtfn) ++ return 0; ++ + pci_read_config_byte(vdev->pdev, PCI_INTERRUPT_PIN, &pin); +- if (IS_ENABLED(CONFIG_VFIO_PCI_INTX) && !vdev->nointx && pin) +- return 1; + ++ return pin ? 1 : 0; + } else if (irq_type == VFIO_PCI_MSI_IRQ_INDEX) { + u8 pos; + u16 flags; +diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c +index 06a20ea183dd6..84905d074c4ff 100644 +--- a/drivers/vfio/pci/vfio_pci_config.c ++++ b/drivers/vfio/pci/vfio_pci_config.c +@@ -1608,6 +1608,15 @@ static int vfio_ecap_init(struct vfio_pci_device *vdev) + return 0; + } + ++/* ++ * Nag about hardware bugs, hopefully to have vendors fix them, but at least ++ * to collect a list of dependencies for the VF INTx pin quirk below. ++ */ ++static const struct pci_device_id known_bogus_vf_intx_pin[] = { ++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x270c) }, ++ {} ++}; ++ + /* + * For each device we allocate a pci_config_map that indicates the + * capability occupying each dword and thus the struct perm_bits we +@@ -1673,6 +1682,24 @@ int vfio_config_init(struct vfio_pci_device *vdev) + if (pdev->is_virtfn) { + *(__le16 *)&vconfig[PCI_VENDOR_ID] = cpu_to_le16(pdev->vendor); + *(__le16 *)&vconfig[PCI_DEVICE_ID] = cpu_to_le16(pdev->device); ++ ++ /* ++ * Per SR-IOV spec rev 1.1, 3.4.1.18 the interrupt pin register ++ * does not apply to VFs and VFs must implement this register ++ * as read-only with value zero. Userspace is not readily able ++ * to identify whether a device is a VF and thus that the pin ++ * definition on the device is bogus should it violate this ++ * requirement. We already virtualize the pin register for ++ * other purposes, so we simply need to replace the bogus value ++ * and consider VFs when we determine INTx IRQ count. ++ */ ++ if (vconfig[PCI_INTERRUPT_PIN] && ++ !pci_match_id(known_bogus_vf_intx_pin, pdev)) ++ pci_warn(pdev, ++ "Hardware bug: VF reports bogus INTx pin %d\n", ++ vconfig[PCI_INTERRUPT_PIN]); ++ ++ vconfig[PCI_INTERRUPT_PIN] = 0; /* Gratuitous for good VFs */ + } + + if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX) || vdev->nointx) +-- +2.20.1 + diff --git a/queue-4.9/x86-cpu-use-correct-macros-for-cyrix-calls.patch b/queue-4.9/x86-cpu-use-correct-macros-for-cyrix-calls.patch new file mode 100644 index 00000000000..3897e174347 --- /dev/null +++ b/queue-4.9/x86-cpu-use-correct-macros-for-cyrix-calls.patch @@ -0,0 +1,67 @@ +From 4e91555f823f4a34e9f7d62c8974befb0cfdad27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Sep 2018 17:20:40 -0400 +Subject: x86/CPU: Use correct macros for Cyrix calls + +From: Matthew Whitehead + +[ Upstream commit 03b099bdcdf7125d4a63dc9ddeefdd454e05123d ] + +There are comments in processor-cyrix.h advising you to _not_ make calls +using the deprecated macros in this style: + + setCx86_old(CX86_CCR4, getCx86_old(CX86_CCR4) | 0x80); + +This is because it expands the macro into a non-functioning calling +sequence. The calling order must be: + + outb(CX86_CCR2, 0x22); + inb(0x23); + +From the comments: + + * When using the old macros a line like + * setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x88); + * gets expanded to: + * do { + * outb((CX86_CCR2), 0x22); + * outb((({ + * outb((CX86_CCR2), 0x22); + * inb(0x23); + * }) | 0x88), 0x23); + * } while (0); + +The new macros fix this problem, so use them instead. + +Signed-off-by: Matthew Whitehead +Signed-off-by: Borislav Petkov +Reviewed-by: Andy Lutomirski +Cc: Greg Kroah-Hartman +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: Jia Zhang +Cc: Peter Zijlstra +Cc: Philippe Ombredanne +Cc: Thomas Gleixner +Link: http://lkml.kernel.org/r/20180921212041.13096-2-tedheadster@gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/cyrix.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c +index 311d0fad17e6b..a4f6e0ec4ba0f 100644 +--- a/arch/x86/kernel/cpu/cyrix.c ++++ b/arch/x86/kernel/cpu/cyrix.c +@@ -434,7 +434,7 @@ static void cyrix_identify(struct cpuinfo_x86 *c) + /* enable MAPEN */ + setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10); + /* enable cpuid */ +- setCx86_old(CX86_CCR4, getCx86_old(CX86_CCR4) | 0x80); ++ setCx86(CX86_CCR4, getCx86(CX86_CCR4) | 0x80); + /* disable MAPEN */ + setCx86(CX86_CCR3, ccr3); + local_irq_restore(flags); +-- +2.20.1 +