From: Greg Kroah-Hartman Date: Sun, 18 Mar 2018 15:58:22 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.14.28~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ce68affee3f09a43b891bcf389f1f8b209ae29a9;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: agp-intel-flush-all-chipset-writes-after-updating-the-ggtt.patch alsa-firewire-digi00x-add-support-for-console-models-of-digi00x-series.patch alsa-firewire-digi00x-handle-all-midi-messages-on-streaming-packets.patch alsa-firewire-lib-add-a-quirk-of-packet-without-valid-eoh-in-cip-format.patch alsa-hda-add-geminilake-id-to-skl_plus.patch apparmor-make-path_max-parameter-readonly.patch arm-bcm2835-enable-missing-cma-settings-for-vc4-driver.patch arm-brcmstb-enable-zone_dma-for-non-64-bit-capable-peripherals.patch arm-dra7-hwmod_data-prevent-wait_target_disable-error-for-usb_otg_ss.patch arm-dts-adjust-moxart-irq-controller-and-flags.patch arm-dts-am335x-pepper-fix-the-audio-codec-s-reset-pin.patch arm-dts-bcm2835-add-index-to-the-ethernet-alias.patch arm-dts-exynos-correct-trats2-panel-reset-line.patch arm-dts-koelsch-correct-clock-frequency-of-x2-du-clock-input.patch arm-dts-omap3-n900-fix-the-audio-codec-s-reset-pin.patch arm-dts-r7s72100-fix-ethernet-clock-parent.patch arm-dts-r8a7790-correct-parent-of-ssi-clocks.patch arm-dts-r8a7791-correct-parent-of-ssi-clocks.patch arm-dts-r8a7791-remove-unit-address-and-reg-from-integrated-cache.patch arm-dts-r8a7792-remove-unit-address-and-reg-from-integrated-cache.patch arm-dts-r8a7793-correct-parent-of-ssi-clocks.patch arm-dts-r8a7793-remove-unit-address-and-reg-from-integrated-cache.patch arm-dts-r8a7794-correct-clock-of-du1.patch arm-dts-r8a7794-remove-unit-address-and-reg-from-integrated-cache.patch arm-dts-silk-correct-clock-of-du1.patch arm64-dts-r8a7796-remove-unit-address-and-reg-from-integrated-cache.patch asoc-nuc900-fix-a-loop-timeout-test.patch asoc-rcar-ssi-don-t-set-ssicr.ckdv-000-with-ssiwsr.cont.patch asoc-rt5677-add-of-device-id-table.patch ath10k-disallow-dfs-simulation-if-dfs-channel-is-not-enabled.patch ath10k-fix-a-warning-during-channel-switch-with-multiple-vaps.patch ath10k-fix-compile-time-sanity-check-for-ce4-buffer-size.patch ath10k-fix-fetching-channel-during-potential-radar-detection.patch ath10k-fix-invalid-sts_cap_offset_mask.patch ath10k-update-tdls-teardown-state-to-target.patch batman-adv-handle-race-condition-for-claims-between-gateways.patch blk-throttle-make-sure-expire-time-isn-t-too-big.patch bluetooth-6lowpan-fix-delay-work-init-in-add_peer_chan.patch bluetooth-avoid-bt_accept_unlink-double-unlinking.patch bnxt_en-don-t-print-link-speed-1-no-longer-supported-messages.patch bonding-make-speed-duplex-setting-consistent-with-link-state.patch bonding-refine-bond_fold_stats-wrap-detection.patch braille-console-fix-value-returned-by-_braille_console_setup.patch clk-meson-gxbb-fix-wrong-clock-for-saradc-sana.patch clk-qcom-msm8916-fix-mnd_width-for-codec_digcodec.patch clk-qcom-msm8996-fix-the-vfe1-powerdomain-name.patch clk-sunxi-ng-a33-add-offset-and-minimum-value-for-ddr1-pll-n-factor.patch coresight-fixes-coresight-dt-parse-to-get-correct-output-port-id.patch dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch dmaengine-imx-sdma-add-1ms-delay-to-ensure-sdma-channel-is-stopped.patch driver-adm1275-set-the-m-b-and-r-coefficients-correctly-for-power.patch drivers-net-phy-xgene-fix-mdio-write.patch drivers-net-xgene-fix-hardware-checksum-setting.patch drivers-net-xgene-fix-rx-checksum-validation-logic.patch drivers-net-xgene-fix-wrong-logical-operation.patch drivers-perf-arm_pmu-handle-no-platform_device.patch drm-amdgpu-fail-fb-creation-from-imported-dma-bufs.-v2.patch drm-amdkfd-fix-memory-leaks-in-kfd-topology.patch drm-defer-disabling-the-vblank-irq-until-the-next-interrupt-for-instant-off.patch drm-edid-set-eld-connector-type-in-drm_edid_to_eld.patch drm-qxl-don-t-alloc-fbdev-if-emulation-is-not-supported.patch drm-radeon-fail-fb-creation-from-imported-dma-bufs.patch drm-rcar-du-handle-event-when-disabling-crtcs.patch drm-rockchip-vop-enable-pm-domain-before-vop_initial.patch drm-sun4i-fix-tcon-clock-and-regmap-initialization-sequence.patch drm-sun4i-fix-up-error-path-cleanup-for-master-bind-function.patch drm-sun4i-set-drm_crtc.port-to-the-underlying-tcon-s-output-port-node.patch drm-ttm-never-add-bo-that-failed-to-validate-to-the-lru-list.patch drm-vmwgfx-fixes-to-vmwgfx_fb.patch edac-altera-fix-peripheral-warnings-for-cyclone5.patch eventpoll.h-fix-epoll-event-masks.patch f2fs-relax-node-version-check-for-victim-data-in-gc.patch fm10k-correctly-check-if-interface-is-removed.patch hid-clamp-input-to-logical-range-if-no-null-state.patch hid-elo-clear-btn_left-mapping.patch hid-reject-input-outside-logical-range-only-if-null-state-is-set.patch i40e-acquire-nvm-lock-before-reads-on-all-devices.patch i40e-fix-ethtool-to-get-eeprom-data-from-x722-interface.patch i40e-i40evf-fix-use-after-free-in-rx-cleanup-path.patch i40e-only-register-client-on-iwarp-capable-devices.patch ib-hfi1-check-for-qsfp-presence-before-attempting-reads.patch ima-relax-requiring-a-file-signature-for-new-files-with-zero-length.patch input-qt1070-add-of-device-id-table.patch input-tsc2007-check-for-presence-and-power-down-tsc2007-during-probe.patch iommu-iova-fix-underflow-bug-in-__alloc_and_insert_iova_range.patch ipvlan-add-l2-check-for-packets-arriving-via-virtual-devices.patch iwlwifi-mvm-fix-rx-skb-header-size-and-align-it-properly.patch iwlwifi-mvm-rs-don-t-override-the-rate-history-in-the-search-cycle.patch kprobes-x86-fix-kprobe-booster-not-to-boost-far-call-instructions.patch kprobes-x86-set-kprobes-pages-read-only.patch kvm-nvmx-disallow-userspace-injected-exceptions-in-guest-mode.patch kvm-svm-setup-mcg_cap-on-amd-properly.patch leds-pm8058-silence-pointer-to-integer-size-warning.patch lkdtm-turn-off-kcov-for-lkdtm_rodata_do_nothing.patch locking-locktorture-fix-num-reader-writer-corner-cases.patch mac80211-remove-bug-when-interface-type-is-invalid.patch mac80211_hwsim-enforce-ps_manual_poll-to-be-set-after-ps_enabled.patch mac80211_hwsim-use-per-interface-power-level.patch md-raid6-fix-anomily-when-recovering-a-single-device-in-raid6.patch md.c-didn-t-unlock-the-mddev-before-return-einval-in-array_size_store.patch media-cpia2-fix-a-couple-off-by-one-bugs.patch media-i2c-soc_camera-fix-ov6650-sensor-getting-wrong-clock.patch media-vsp1-prevent-suspending-and-resuming-drm-pipelines.patch mips-bpf-fix-multiple-problems-in-jit-skb-access-helpers.patch mips-bpf-quit-clobbering-callee-saved-registers-in-jit-code.patch mips-r2-on-r6-emu-clear-bltzall-and-bgezall-debugfs-counters.patch mips-r2-on-r6-emu-fix-blezl-and-bgtzl-identification.patch mm-fix-false-positive-vm_bug_on-in-page_cache_-get-add-_speculative.patch mtd-nand-fix-interpretation-of-nand_cmd_none-in-nand_command.patch mtd-nand-ifc-update-bufnum-mask-for-ver-2.0.0.patch mwifiex-cfg80211-do-not-change-virtual-interface-during-scan-processing.patch mwifiex-fix-invalid-port-issue.patch net-8021q-create-device-with-all-possible-features-in-wanted_features.patch net-ethernet-bgmac-allow-mac-address-to-be-specified-in-dtb.patch net-faraday-add-missing-include-of-of.h.patch net-fec-add-phy-reset-gpios-probe_defer-check.patch net-hns-correct-hns-rss-key-set-function.patch net-ieee802154-adf7242-fix-bug-if-defined-debug.patch net-mvpp2-set-dma-mask-and-coherent-dma-mask-on-ppv2.2.patch net-thunderx-set-max-queue-count-taking-xdp_tx-into-account.patch net-xfrm-allow-clearing-socket-xfrm-policies.patch netem-apply-correct-delay-when-rate-throttling.patch nfc-nfcmrvl-double-free-on-error-path.patch nfc-nfcmrvl-include-unaligned.h-instead-of-access_ok.h.patch nfc-pn533-change-order-of-free_irq-and-dev-unregistration.patch of-fix-of_device_get_modalias-returned-length-when-truncating-buffers.patch omapfb-dss-handle-return-errors-in-dss_init_ports.patch pci-apply-cavium-acs-quirk-only-to-cn81xx-cn83xx-cn88xx-devices.patch pci-hv-lock-pci-bus-on-device-eject.patch pci-hv-properly-handle-pci-bus-remove.patch pci-msi-stop-disabling-msi-msi-x-in-pci_device_shutdown.patch perf-annotate-fix-a-bug-following-symbolic-link-of-a-build-id-file.patch perf-buildid-do-not-assume-that-readlink-returns-a-null-terminated-string.patch perf-evsel-return-exact-sub-event-which-failed-with-eperm-for-wildcards.patch perf-inject-copy-events-when-reordering-events-in-pipe-mode.patch perf-probe-fix-concat_probe_trace_events.patch perf-probe-return-errno-when-not-hitting-any-event.patch perf-session-don-t-rely-on-evlist-in-pipe-mode.patch perf-sort-fix-segfault-with-basic-block-cycles-sort-dimension.patch perf-stat-fix-bug-in-handling-events-in-error-state.patch perf-stat-issue-a-hw-watchdog-disable-hint.patch perf-tools-make-perf_event__synthesize_mmap_events-scale.patch perf-trace-handle-unpaired-raw_syscalls-sys_exit-event.patch power-supply-ab8500_charger-bail-out-in-case-of-error-in-ab8500_charger_init_hw_registers.patch power-supply-ab8500_charger-fix-an-error-handling-path.patch powerpc-avoid-taking-a-data-miss-on-every-userspace-instruction-miss.patch powerpc-mm-hugetlb-filter-out-hugepage-size-not-supported-by-page-table-layout.patch powerpc-modules-don-t-try-to-restore-r2-after-a-sibling-call.patch powerpc-nohash-fix-use-of-mmu_has_feature-in-setup_initial_memory_limit.patch powerpc-xmon-fix-an-unexpected-xmon-on-off-state-change.patch printk-correctly-handle-preemption-in-console_unlock.patch pwm-stmpe-fix-wrong-register-offset-for-hwpwm-2-case.patch pwm-tegra-increase-precision-in-pwm-rate-calculation.patch qed-always-publish-vf-link-from-leading-hwfn.patch qed-correct-msi-x-for-storage.patch qed-fix-tm-block-ilt-allocation.patch rcutorture-configinit-fix-build-directory-error-message.patch regulator-core-limit-propagation-of-parent-voltage-count-and-list.patch regulator-isl9305-fix-array-size.patch reiserfs-make-cancel_old_flush-reliable.patch rtmutex-fix-pi-chain-order-integrity.patch s390-topology-fix-typo-in-early-topology-code.patch sched-act_csum-don-t-mangle-tcp-and-udp-gso-packets.patch sched-stop-resched_cpu-from-sending-ipis-to-offline-cpus.patch sched-stop-switched_to_rt-from-sending-ipis-to-offline-cpus.patch scsi-be2iscsi-check-tag-in-beiscsi_mccq_compl_wait.patch scsi-core-scsi_get_device_flags_keyed-always-return-device-flags.patch scsi-devinfo-apply-to-hp-xp-the-same-flags-as-hitachi-vsp.patch scsi-dh-add-new-rdac-devices.patch scsi-fnic-fix-for-number-of-active-ios-in-fnicstats-becoming-negative.patch scsi-ipr-fix-missed-eh-wakeup.patch scsi-ses-don-t-ask-for-diagnostic-pages-repeatedly-during-probe.patch scsi-ses-don-t-get-power-status-of-ses-device-slot-on-probe.patch scsi-sg-check-for-valid-direction-before-starting-the-request.patch scsi-sg-close-race-condition-in-sg_remove_sfp_usercontext.patch selinux-check-for-address-length-in-selinux_socket_bind.patch serial-imx-setup-dcedte-early-and-ensure-dcd-and-ri-irqs-to-be-off.patch soc-tegra-fix-link-errors-with-pmc-disabled.patch solo6x10-release-vb2-buffers-in-solo_stop_streaming.patch spi-omap2-mcspi-poll-omap2_mcspi_chstat_rxs-for-pio-transfer.patch spi-sun6i-disable-unprepare-clocks-on-remove.patch staging-speakup-replace-bug_on-with-warn_on.patch staging-wilc1000-add-check-for-kmalloc-allocation-failure.patch sysrq-reset-the-watchdog-timers-while-displaying-high-resolution-timers.patch tcp-sysctl-fix-a-race-to-avoid-unexpected-0-window-from-space.patch test_firmware-fix-setting-old-custom-fw-path-back-on-exit.patch timers-sched_clock-update-timeout-for-clock-wrap.patch tools-usbip-fixes-build-with-musl-libc-toolchain.patch tty-amba-pl011-fix-spurious-tx-interrupts.patch usb-dwc2-make-sure-we-disconnect-the-gadget-state.patch usb-dwc3-make-sure-ux_exit_px-is-cleared.patch usb-gadget-dummy_hcd-fix-wrong-power-status-bit-clear-reset-in-dummy_hub_control.patch usb-misc-lvs-fix-race-condition-in-disconnect-handling.patch userns-don-t-fail-follow_automount-based-on-s_user_ns.patch v4l-vsp1-prevent-multiple-streamon-race-commencing-pipeline-early.patch v4l-vsp1-register-pipe-with-output-wpf.patch veth-set-peer-gso-values.patch vfio-powerpc-spapr_tce-enforce-iommu-type-compatibility-check.patch vfio-spapr_tce-check-kzalloc-return-when-preregistering-memory.patch video-arm-clcd-fix-dma-allocation-size.patch video-hdmi-allow-empty-hdmi-infoframes.patch vxlan-vxlan-dev-should-inherit-lowerdev-s-gso_max_size.patch wil6210-fix-memory-access-violation-in-wil_memcpy_from-toio_32.patch wil6210-fix-protection-against-connections-during-reset.patch x86-boot-32-defer-resyncing-initial_page_table-until-per-cpu-is-set-up.patch x86-mce-handle-broadcasted-mce-gracefully-with-kexec.patch x86-mce-init-some-cpu-features-early.patch x86-mm-make-mmap-map_32bit-work-correctly.patch zd1211rw-fix-null-deref-at-probe.patch --- diff --git a/queue-4.9/agp-intel-flush-all-chipset-writes-after-updating-the-ggtt.patch b/queue-4.9/agp-intel-flush-all-chipset-writes-after-updating-the-ggtt.patch new file mode 100644 index 00000000000..c9f03f05809 --- /dev/null +++ b/queue-4.9/agp-intel-flush-all-chipset-writes-after-updating-the-ggtt.patch @@ -0,0 +1,46 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Chris Wilson +Date: Fri, 8 Dec 2017 21:46:16 +0000 +Subject: agp/intel: Flush all chipset writes after updating the GGTT + +From: Chris Wilson + + +[ Upstream commit 8516673a996870ea0ceb337ee4f83c33c5ec3111 ] + +Before accessing the GGTT we must flush the PTE writes and make them +visible to the chipset, or else the indirect access may end up in the +wrong page. In commit 3497971a71d8 ("agp/intel: Flush chipset writes +after updating a single PTE"), we noticed corruption of the uploads for +pwrite and for capturing GPU error states, but it was presumed that the +explicit calls to intel_gtt_chipset_flush() were sufficient for the +execbuffer path. However, we have not been flushing the chipset between +the PTE writes and access via the GTT itself. + +For simplicity, do the flush after any PTE update rather than try and +batch the flushes on a just-in-time basis. + +References: 3497971a71d8 ("agp/intel: Flush chipset writes after updating a single PTE") +Signed-off-by: Chris Wilson +Cc: Tvrtko Ursulin +Cc: Mika Kuoppala +Cc: drm-intel-fixes@lists.freedesktop.org +Reviewed-by: Joonas Lahtinen +Link: https://patchwork.freedesktop.org/patch/msgid/20171208214616.30147-1-chris@chris-wilson.co.uk +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/agp/intel-gtt.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/char/agp/intel-gtt.c ++++ b/drivers/char/agp/intel-gtt.c +@@ -871,6 +871,8 @@ void intel_gtt_insert_sg_entries(struct + } + } + wmb(); ++ if (intel_private.driver->chipset_flush) ++ intel_private.driver->chipset_flush(); + } + EXPORT_SYMBOL(intel_gtt_insert_sg_entries); + diff --git a/queue-4.9/alsa-firewire-digi00x-add-support-for-console-models-of-digi00x-series.patch b/queue-4.9/alsa-firewire-digi00x-add-support-for-console-models-of-digi00x-series.patch new file mode 100644 index 00000000000..57d44783d64 --- /dev/null +++ b/queue-4.9/alsa-firewire-digi00x-add-support-for-console-models-of-digi00x-series.patch @@ -0,0 +1,120 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Takashi Sakamoto +Date: Sun, 2 Apr 2017 23:48:24 +0900 +Subject: ALSA: firewire-digi00x: add support for console models of Digi00x series + +From: Takashi Sakamoto + + +[ Upstream commit 13e005f9f933a35b5e55c9d36f151efe2a8383ec ] + +Digi00x series includes two types of unit; rack and console. As long as +reading information on config rom of Digi 002 console, 'MODEL_ID' field +has a different value from the one on Digi 002 rack. + +We've already got a test report from users with Digi 003 rack. We can +assume that console type and rack type has different value in the field. + +This commit adds a device entry for console type. For following commits, +this commit also adds a member to 'struct snd_digi00x' to identify console +type. + +$ cd linux-firewire-utils/src +$ python2 ./crpp < /sys/bus/firewire/devices/fw1/config_rom + ROM header and bus information block + ----------------------------------------------------------------- +400 0404f9d0 bus_info_length 4, crc_length 4, crc 63952 +404 31333934 bus_name "1394" +408 60647002 irmc 0, cmc 1, isc 1, bmc 0, cyc_clk_acc 100, max_rec 7 (256) +40c 00a07e00 company_id 00a07e | +410 00a30000 device_id 0000a30000 | EUI-64 00a07e0000a30000 + + root directory + ----------------------------------------------------------------- +414 00058a39 directory_length 5, crc 35385 +418 0c0043a0 node capabilities +41c 04000001 hardware version +420 0300a07e vendor +424 81000007 --> descriptor leaf at 440 +428 d1000001 --> unit directory at 42c + + unit directory at 42c + ----------------------------------------------------------------- +42c 00046674 directory_length 4, crc 26228 +430 120000a3 specifier id +434 13000001 version +438 17000001 model +43c 81000007 --> descriptor leaf at 458 + + descriptor leaf at 440 + ----------------------------------------------------------------- +440 00055913 leaf_length 5, crc 22803 +444 000050f2 descriptor_type 00, specifier_ID 50f2 +448 80000000 +44c 44696769 +450 64657369 +454 676e0000 + + descriptor leaf at 458 + ----------------------------------------------------------------- +458 0004a6fd leaf_length 4, crc 42749 +45c 00000000 textual descriptor +460 00000000 minimal ASCII +464 44696769 "Digi" +468 20303032 " 002" + +Signed-off-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/firewire/digi00x/digi00x.c | 13 +++++++++++-- + sound/firewire/digi00x/digi00x.h | 1 + + 2 files changed, 12 insertions(+), 2 deletions(-) + +--- a/sound/firewire/digi00x/digi00x.c ++++ b/sound/firewire/digi00x/digi00x.c +@@ -13,7 +13,8 @@ MODULE_AUTHOR("Takashi Sakamoto lock); + init_waitqueue_head(&dg00x->hwdep_wait); + ++ dg00x->is_console = entry->model_id == MODEL_CONSOLE; ++ + /* Allocate and register this sound card later. */ + INIT_DEFERRABLE_WORK(&dg00x->dwork, do_registration); + snd_fw_schedule_registration(unit, &dg00x->dwork); +@@ -183,7 +186,13 @@ static const struct ieee1394_device_id s + .match_flags = IEEE1394_MATCH_VENDOR_ID | + IEEE1394_MATCH_MODEL_ID, + .vendor_id = VENDOR_DIGIDESIGN, +- .model_id = MODEL_DIGI00X, ++ .model_id = MODEL_CONSOLE, ++ }, ++ { ++ .match_flags = IEEE1394_MATCH_VENDOR_ID | ++ IEEE1394_MATCH_MODEL_ID, ++ .vendor_id = VENDOR_DIGIDESIGN, ++ .model_id = MODEL_RACK, + }, + {} + }; +--- a/sound/firewire/digi00x/digi00x.h ++++ b/sound/firewire/digi00x/digi00x.h +@@ -60,6 +60,7 @@ struct snd_dg00x { + /* For asynchronous MIDI controls. */ + struct snd_rawmidi_substream *in_control; + struct snd_fw_async_midi_port out_control; ++ bool is_console; + }; + + #define DG00X_ADDR_BASE 0xffffe0000000ull diff --git a/queue-4.9/alsa-firewire-digi00x-handle-all-midi-messages-on-streaming-packets.patch b/queue-4.9/alsa-firewire-digi00x-handle-all-midi-messages-on-streaming-packets.patch new file mode 100644 index 00000000000..c8f28b20210 --- /dev/null +++ b/queue-4.9/alsa-firewire-digi00x-handle-all-midi-messages-on-streaming-packets.patch @@ -0,0 +1,148 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Takashi Sakamoto +Date: Sun, 2 Apr 2017 23:48:25 +0900 +Subject: ALSA: firewire-digi00x: handle all MIDI messages on streaming packets + +From: Takashi Sakamoto + + +[ Upstream commit 8820a4cf0cb4cd5c6540a9a18b2cedbdfd5a6891 ] + +At a commit 9dc5d31cdceb ("ALSA: firewire-digi00x: handle MIDI messages in +isochronous packets"), a functionality to handle MIDI messages on +isochronous packet was supported. But this includes some of my +misunderstanding. This commit is to fix them. + +For digi00x series, first data channel of data blocks in rx/tx packet +includes MIDI messages. The data channel has 0x80 in 8 bit of its MSB, +however it's against IEC 61883-6. Unique data format is applied: + - Upper 4 bits of LSB represent port number. + - 0x0: port 1. + - 0x2: port 2. + - 0xe: console port. + - Lower 4 bits of LSB represent the number of included MIDI message bytes; + 0x0/0x1/0x2. + - Two bytes of middle of this data channel have MIDI bytes. + +Especially, MIDI messages from/to console surface are also transferred by +isochronous packets, as well as physical MIDI ports. + +Signed-off-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/firewire/digi00x/amdtp-dot.c | 53 +++++++++++++++++++++++++------------ + 1 file changed, 36 insertions(+), 17 deletions(-) + +--- a/sound/firewire/digi00x/amdtp-dot.c ++++ b/sound/firewire/digi00x/amdtp-dot.c +@@ -28,6 +28,9 @@ + */ + #define MAX_MIDI_RX_BLOCKS 8 + ++/* 3 = MAX(DOT_MIDI_IN_PORTS, DOT_MIDI_OUT_PORTS) + 1. */ ++#define MAX_MIDI_PORTS 3 ++ + /* + * The double-oh-three algorithm was discovered by Robin Gareus and Damien + * Zammit in 2012, with reverse-engineering for Digi 003 Rack. +@@ -42,10 +45,8 @@ struct amdtp_dot { + unsigned int pcm_channels; + struct dot_state state; + +- unsigned int midi_ports; +- /* 2 = MAX(DOT_MIDI_IN_PORTS, DOT_MIDI_OUT_PORTS) */ +- struct snd_rawmidi_substream *midi[2]; +- int midi_fifo_used[2]; ++ struct snd_rawmidi_substream *midi[MAX_MIDI_PORTS]; ++ int midi_fifo_used[MAX_MIDI_PORTS]; + int midi_fifo_limit; + + void (*transfer_samples)(struct amdtp_stream *s, +@@ -124,8 +125,8 @@ int amdtp_dot_set_parameters(struct amdt + return -EBUSY; + + /* +- * A first data channel is for MIDI conformant data channel, the rest is +- * Multi Bit Linear Audio data channel. ++ * A first data channel is for MIDI messages, the rest is Multi Bit ++ * Linear Audio data channel. + */ + err = amdtp_stream_set_parameters(s, rate, pcm_channels + 1); + if (err < 0) +@@ -135,11 +136,6 @@ int amdtp_dot_set_parameters(struct amdt + + p->pcm_channels = pcm_channels; + +- if (s->direction == AMDTP_IN_STREAM) +- p->midi_ports = DOT_MIDI_IN_PORTS; +- else +- p->midi_ports = DOT_MIDI_OUT_PORTS; +- + /* + * We do not know the actual MIDI FIFO size of most devices. Just + * assume two bytes, i.e., one byte can be received over the bus while +@@ -281,13 +277,25 @@ static void write_midi_messages(struct a + b = (u8 *)&buffer[0]; + + len = 0; +- if (port < p->midi_ports && ++ if (port < MAX_MIDI_PORTS && + midi_ratelimit_per_packet(s, port) && + p->midi[port] != NULL) + len = snd_rawmidi_transmit(p->midi[port], b + 1, 2); + + if (len > 0) { +- b[3] = (0x10 << port) | len; ++ /* ++ * Upper 4 bits of LSB represent port number. ++ * - 0000b: physical MIDI port 1. ++ * - 0010b: physical MIDI port 2. ++ * - 1110b: console MIDI port. ++ */ ++ if (port == 2) ++ b[3] = 0xe0; ++ else if (port == 1) ++ b[3] = 0x20; ++ else ++ b[3] = 0x00; ++ b[3] |= len; + midi_use_bytes(s, port, len); + } else { + b[1] = 0; +@@ -309,11 +317,22 @@ static void read_midi_messages(struct am + + for (f = 0; f < data_blocks; f++) { + b = (u8 *)&buffer[0]; +- port = b[3] >> 4; ++ + len = b[3] & 0x0f; ++ if (len > 0) { ++ /* ++ * Upper 4 bits of LSB represent port number. ++ * - 0000b: physical MIDI port 1. Use port 0. ++ * - 1110b: console MIDI port. Use port 2. ++ */ ++ if (b[3] >> 4 > 0) ++ port = 2; ++ else ++ port = 0; + +- if (port < p->midi_ports && p->midi[port] && len > 0) +- snd_rawmidi_receive(p->midi[port], b + 1, len); ++ if (port < MAX_MIDI_PORTS && p->midi[port]) ++ snd_rawmidi_receive(p->midi[port], b + 1, len); ++ } + + buffer += s->data_block_quadlets; + } +@@ -364,7 +383,7 @@ void amdtp_dot_midi_trigger(struct amdtp + { + struct amdtp_dot *p = s->protocol; + +- if (port < p->midi_ports) ++ if (port < MAX_MIDI_PORTS) + ACCESS_ONCE(p->midi[port]) = midi; + } + diff --git a/queue-4.9/alsa-firewire-lib-add-a-quirk-of-packet-without-valid-eoh-in-cip-format.patch b/queue-4.9/alsa-firewire-lib-add-a-quirk-of-packet-without-valid-eoh-in-cip-format.patch new file mode 100644 index 00000000000..114070016c9 --- /dev/null +++ b/queue-4.9/alsa-firewire-lib-add-a-quirk-of-packet-without-valid-eoh-in-cip-format.patch @@ -0,0 +1,60 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Takashi Sakamoto +Date: Wed, 22 Mar 2017 21:30:27 +0900 +Subject: ALSA: firewire-lib: add a quirk of packet without valid EOH in CIP format + +From: Takashi Sakamoto + + +[ Upstream commit 2128f78f75a36a34dfef0e127273c2f820c5c904 ] + +In IEC 61883-1, when two quadlets CIP header is used, the most significant +bit in second CIP header stands. However, packets from units with MOTU +protocol version 3 have a quirk without this flag. Current packet streaming +layer handles this as protocol error. + +This commit adds a new enumeration constant for this quirk, to handle MOTU +protocol version 3. + +Signed-off-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/firewire/amdtp-stream.c | 5 +++-- + sound/firewire/amdtp-stream.h | 3 +++ + 2 files changed, 6 insertions(+), 2 deletions(-) + +--- a/sound/firewire/amdtp-stream.c ++++ b/sound/firewire/amdtp-stream.c +@@ -471,8 +471,9 @@ static int handle_in_packet(struct amdtp + * This module supports 'Two-quadlet CIP header with SYT field'. + * For convenience, also check FMT field is AM824 or not. + */ +- if (((cip_header[0] & CIP_EOH_MASK) == CIP_EOH) || +- ((cip_header[1] & CIP_EOH_MASK) != CIP_EOH)) { ++ if ((((cip_header[0] & CIP_EOH_MASK) == CIP_EOH) || ++ ((cip_header[1] & CIP_EOH_MASK) != CIP_EOH)) && ++ (!(s->flags & CIP_HEADER_WITHOUT_EOH))) { + dev_info_ratelimited(&s->unit->device, + "Invalid CIP header for AMDTP: %08X:%08X\n", + cip_header[0], cip_header[1]); +--- a/sound/firewire/amdtp-stream.h ++++ b/sound/firewire/amdtp-stream.h +@@ -29,6 +29,8 @@ + * @CIP_JUMBO_PAYLOAD: Only for in-stream. The number of data blocks in an + * packet is larger than IEC 61883-6 defines. Current implementation + * allows 5 times as large as IEC 61883-6 defines. ++ * @CIP_HEADER_WITHOUT_EOH: Only for in-stream. CIP Header doesn't include ++ * valid EOH. + */ + enum cip_flags { + CIP_NONBLOCKING = 0x00, +@@ -39,6 +41,7 @@ enum cip_flags { + CIP_SKIP_DBC_ZERO_CHECK = 0x10, + CIP_EMPTY_HAS_WRONG_DBC = 0x20, + CIP_JUMBO_PAYLOAD = 0x40, ++ CIP_HEADER_WITHOUT_EOH = 0x80, + }; + + /** diff --git a/queue-4.9/alsa-hda-add-geminilake-id-to-skl_plus.patch b/queue-4.9/alsa-hda-add-geminilake-id-to-skl_plus.patch new file mode 100644 index 00000000000..a7fd5b53cc3 --- /dev/null +++ b/queue-4.9/alsa-hda-add-geminilake-id-to-skl_plus.patch @@ -0,0 +1,38 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: "Subhransu S. Prusty" +Date: Wed, 12 Apr 2017 09:54:00 +0530 +Subject: ALSA: hda: Add Geminilake id to SKL_PLUS + +From: "Subhransu S. Prusty" + + +[ Upstream commit 12ee4022f67f8854061b46e5c0a7ad6258ab66c2 ] + +Geminilake is Skylake family platform. So add it's id to skl_plus check. + +Fixes: 126cfa2f5e15 ("ALSA: hda: Add Geminilake HDMI codec ID") +Signed-off-by: Subhransu S. Prusty +Cc: Senthilnathan Veppur +Cc: Vinod Koul +Cc: Takashi Iwai +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/hda_intel.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -369,8 +369,10 @@ enum { + #define IS_KBL_LP(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d71) + #define IS_KBL_H(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa2f0) + #define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98) ++#define IS_GLK(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x3198) + #define IS_SKL_PLUS(pci) (IS_SKL(pci) || IS_SKL_LP(pci) || IS_BXT(pci)) || \ +- IS_KBL(pci) || IS_KBL_LP(pci) || IS_KBL_H(pci) ++ IS_KBL(pci) || IS_KBL_LP(pci) || IS_KBL_H(pci) || \ ++ IS_GLK(pci) + + static char *driver_short_names[] = { + [AZX_DRIVER_ICH] = "HDA Intel", diff --git a/queue-4.9/apparmor-make-path_max-parameter-readonly.patch b/queue-4.9/apparmor-make-path_max-parameter-readonly.patch new file mode 100644 index 00000000000..003dd29f018 --- /dev/null +++ b/queue-4.9/apparmor-make-path_max-parameter-readonly.patch @@ -0,0 +1,83 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: John Johansen +Date: Thu, 6 Apr 2017 06:55:24 -0700 +Subject: apparmor: Make path_max parameter readonly + +From: John Johansen + + +[ Upstream commit 622f6e3265707ebf02ba776ac6e68003bcc31213 ] + +The path_max parameter determines the max size of buffers allocated +but it should not be setable at run time. If can be used to cause an +oops + +root@ubuntu:~# echo 16777216 > /sys/module/apparmor/parameters/path_max +root@ubuntu:~# cat /sys/module/apparmor/parameters/path_max +Killed + +[ 122.141911] BUG: unable to handle kernel paging request at ffff880080945fff +[ 122.143497] IP: [] d_absolute_path+0x44/0xa0 +[ 122.144742] PGD 220c067 PUD 0 +[ 122.145453] Oops: 0002 [#1] SMP +[ 122.146204] Modules linked in: vmw_vsock_vmci_transport vsock ppdev vmw_balloon snd_ens1371 btusb snd_ac97_codec gameport snd_rawmidi btrtl snd_seq_device ac97_bus btbcm btintel snd_pcm input_leds bluetooth snd_timer snd joydev soundcore serio_raw coretemp shpchp nfit parport_pc i2c_piix4 8250_fintek vmw_vmci parport mac_hid ib_iser rdma_cm iw_cm ib_cm ib_sa ib_mad ib_core ib_addr iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi autofs4 btrfs raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear hid_generic usbhid hid crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd vmwgfx psmouse mptspi ttm mptscsih drm_kms_helper mptbase syscopyarea scsi_transport_spi sysfillrect +[ 122.163365] ahci sysimgblt e1000 fb_sys_fops libahci drm pata_acpi fjes +[ 122.164747] CPU: 3 PID: 1501 Comm: bash Not tainted 4.4.0-59-generic #80-Ubuntu +[ 122.166250] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/02/2015 +[ 122.168611] task: ffff88003496aa00 ti: ffff880076474000 task.ti: ffff880076474000 +[ 122.170018] RIP: 0010:[] [] d_absolute_path+0x44/0xa0 +[ 122.171525] RSP: 0018:ffff880076477b90 EFLAGS: 00010206 +[ 122.172462] RAX: ffff880080945fff RBX: 0000000000000000 RCX: 0000000001000000 +[ 122.173709] RDX: 0000000000ffffff RSI: ffff880080946000 RDI: ffff8800348a1010 +[ 122.174978] RBP: ffff880076477bb8 R08: ffff880076477c80 R09: 0000000000000000 +[ 122.176227] R10: 00007ffffffff000 R11: ffff88007f946000 R12: ffff88007f946000 +[ 122.177496] R13: ffff880076477c80 R14: ffff8800348a1010 R15: ffff8800348a2400 +[ 122.178745] FS: 00007fd459eb4700(0000) GS:ffff88007b6c0000(0000) knlGS:0000000000000000 +[ 122.180176] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 122.181186] CR2: ffff880080945fff CR3: 0000000073422000 CR4: 00000000001406e0 +[ 122.182469] Stack: +[ 122.182843] 00ffffff00000001 ffff880080946000 0000000000000000 0000000000000000 +[ 122.184409] 00000000570f789c ffff880076477c30 ffffffff81385671 ffff88007a2e7a58 +[ 122.185810] 0000000000000000 ffff880076477c88 01000000008a1000 0000000000000000 +[ 122.187231] Call Trace: +[ 122.187680] [] aa_path_name+0x81/0x370 +[ 122.188637] [] profile_transition+0xbd/0xb80 +[ 122.190181] [] ? zone_statistics+0x7c/0xa0 +[ 122.191674] [] apparmor_bprm_set_creds+0x9b0/0xac0 +[ 122.193288] [] ? ext4_xattr_get+0x81/0x220 +[ 122.194793] [] ? ext4_xattr_security_get+0x1c/0x30 +[ 122.196392] [] ? get_vfs_caps_from_disk+0x69/0x110 +[ 122.198004] [] ? mnt_may_suid+0x3f/0x50 +[ 122.199737] [] ? cap_bprm_set_creds+0xa3/0x600 +[ 122.201377] [] security_bprm_set_creds+0x33/0x50 +[ 122.203024] [] prepare_binprm+0x85/0x190 +[ 122.204515] [] do_execveat_common.isra.33+0x485/0x710 +[ 122.206200] [] SyS_execve+0x3a/0x50 +[ 122.207615] [] stub_execve+0x5/0x5 +[ 122.208978] [] ? entry_SYSCALL_64_fastpath+0x16/0x71 +[ 122.210615] Code: f8 31 c0 48 63 c2 83 ea 01 48 c7 45 e8 00 00 00 00 48 01 c6 85 d2 48 c7 45 f0 00 00 00 00 48 89 75 e0 89 55 dc 78 0c 48 8d 46 ff 46 ff 00 48 89 45 e0 48 8d 55 e0 48 8d 4d dc 48 8d 75 e8 e8 +[ 122.217320] RIP [] d_absolute_path+0x44/0xa0 +[ 122.218860] RSP +[ 122.219919] CR2: ffff880080945fff +[ 122.220936] ---[ end trace 506cdbd85eb6c55e ]--- + +Reported-by: Tetsuo Handa +Signed-off-by: John Johansen +Signed-off-by: James Morris +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + security/apparmor/lsm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/security/apparmor/lsm.c ++++ b/security/apparmor/lsm.c +@@ -707,7 +707,7 @@ module_param_named(logsyscall, aa_g_logs + + /* Maximum pathname length before accesses will start getting rejected */ + unsigned int aa_g_path_max = 2 * PATH_MAX; +-module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR | S_IWUSR); ++module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR); + + /* Determines how paranoid loading of policy is and how much verification + * on the loaded policy is done. diff --git a/queue-4.9/arm-bcm2835-enable-missing-cma-settings-for-vc4-driver.patch b/queue-4.9/arm-bcm2835-enable-missing-cma-settings-for-vc4-driver.patch new file mode 100644 index 00000000000..7603f7c50d4 --- /dev/null +++ b/queue-4.9/arm-bcm2835-enable-missing-cma-settings-for-vc4-driver.patch @@ -0,0 +1,65 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Stefan Wahren +Date: Sat, 4 Mar 2017 09:43:51 +0000 +Subject: ARM: bcm2835: Enable missing CMA settings for VC4 driver + +From: Stefan Wahren + + +[ Upstream commit bdd3c25423cb42171446940bca0946e0443e1a84 ] + +Currently bcm2835_defconfig has CMA disabled which makes the +HDMI output on a Raspberry Pi 1 stop working during boot: + + fb: switching to vc4drmfb from simple + Console: switching to colour dummy device 80x30 + [drm] Initialized vc4 0.0.0 20140616 for soc:gpu on minor 0 + [drm] Supports vblank timestamp caching Rev 2 (21.10.2013). + [drm] Driver supports precise vblank timestamp query. + vc4-drm soc:gpu: failed to allocate buffer with size 9216000 + vc4-drm soc:gpu: Failed to set initial hw configuration. + +So enable CMA and DMA_CMA in bcm2835_defconfig. + +Signed-off-by: Stefan Wahren +Fixes: 4400d9ac05ee ("ARM: bcm2835: Enable the VC4 graphics driver in the defconfig") +Reviewed-by: Eric Anholt +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/configs/bcm2835_defconfig | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/configs/bcm2835_defconfig ++++ b/arch/arm/configs/bcm2835_defconfig +@@ -1,6 +1,5 @@ + # CONFIG_LOCALVERSION_AUTO is not set + CONFIG_SYSVIPC=y +-CONFIG_FHANDLE=y + CONFIG_NO_HZ=y + CONFIG_HIGH_RES_TIMERS=y + CONFIG_BSD_PROCESS_ACCT=y +@@ -32,6 +31,7 @@ CONFIG_PREEMPT_VOLUNTARY=y + CONFIG_AEABI=y + CONFIG_KSM=y + CONFIG_CLEANCACHE=y ++CONFIG_CMA=y + CONFIG_SECCOMP=y + CONFIG_KEXEC=y + CONFIG_CRASH_DUMP=y +@@ -52,6 +52,7 @@ CONFIG_MAC80211=y + CONFIG_DEVTMPFS=y + CONFIG_DEVTMPFS_MOUNT=y + # CONFIG_STANDALONE is not set ++CONFIG_DMA_CMA=y + CONFIG_SCSI=y + CONFIG_BLK_DEV_SD=y + CONFIG_SCSI_CONSTANTS=y +@@ -62,7 +63,6 @@ CONFIG_USB_NET_SMSC95XX=y + CONFIG_ZD1211RW=y + CONFIG_INPUT_EVDEV=y + # CONFIG_LEGACY_PTYS is not set +-# CONFIG_DEVKMEM is not set + CONFIG_SERIAL_AMBA_PL011=y + CONFIG_SERIAL_AMBA_PL011_CONSOLE=y + CONFIG_TTY_PRINTK=y diff --git a/queue-4.9/arm-brcmstb-enable-zone_dma-for-non-64-bit-capable-peripherals.patch b/queue-4.9/arm-brcmstb-enable-zone_dma-for-non-64-bit-capable-peripherals.patch new file mode 100644 index 00000000000..cfdbfb74b5c --- /dev/null +++ b/queue-4.9/arm-brcmstb-enable-zone_dma-for-non-64-bit-capable-peripherals.patch @@ -0,0 +1,45 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Al Cooper +Date: Thu, 9 Mar 2017 10:51:18 -0800 +Subject: ARM: brcmstb: Enable ZONE_DMA for non 64-bit capable peripherals + +From: Al Cooper + + +[ Upstream commit 3c51b9c7f1fae00c25f1e34da649a288e3fea1ae ] + +Some Host Controller hardware blocks, like the OHCI, EHCI and SDIO +controllers, have hardware blocks that are not capable of doing 64 bit +DMA. These host controllers fail on boards with >3GB of memory because +the memory above 3GB is located physically >= 0x100000000 and can only +be accessed using 64 DMA. The way Linux is currently configured for +BRCMSTB systems, the memory given to drivers for DMA through functions +like dma_alloc_coherent() comes from CMA memory and CMA memory is taken +from the top of physical memory. When these drivers get a DMA buffer +with an address >=0x100000000, they end up dropping the upper 32 bit of +the address causing the hardware to DMA to incorrect memory, typically +BMEM (custom memory carveout). This issue was discovered on a +BCM97449SSV_DDR4 system with 4GB or memory. + +The fix is to enable CONFIG_ZONE_DMA. On ARM systems this makes sure +that all DMA memory is located within the first 32 bits of address +space. + +Signed-off-by: Al Cooper +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-bcm/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm/mach-bcm/Kconfig ++++ b/arch/arm/mach-bcm/Kconfig +@@ -199,6 +199,7 @@ config ARCH_BRCMSTB + select BRCMSTB_L2_IRQ + select BCM7120_L2_IRQ + select ARCH_DMA_ADDR_T_64BIT if ARM_LPAE ++ select ZONE_DMA if ARM_LPAE + select SOC_BRCMSTB + select SOC_BUS + help diff --git a/queue-4.9/arm-dra7-hwmod_data-prevent-wait_target_disable-error-for-usb_otg_ss.patch b/queue-4.9/arm-dra7-hwmod_data-prevent-wait_target_disable-error-for-usb_otg_ss.patch new file mode 100644 index 00000000000..d590e57d8ee --- /dev/null +++ b/queue-4.9/arm-dra7-hwmod_data-prevent-wait_target_disable-error-for-usb_otg_ss.patch @@ -0,0 +1,47 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Roger Quadros +Date: Mon, 13 Mar 2017 13:53:16 +0200 +Subject: ARM: DRA7: hwmod_data: Prevent wait_target_disable error for usb_otg_ss + +From: Roger Quadros + + +[ Upstream commit e2d54fe76997301b49311bde7ba8ef52b47896f9 ] + +It seems that if L3_INIT clkdomain is kept in HW_AUTO while usb_otg_ss +is in use then there are random chances that the usb_otg_ss module +will fail to completely idle. i.e. IDLEST = 0x2 instead of 0x3. + +Preventing L3_INIT from HW_AUTO while usb_otg_ss module is in use +fixes this issue. + +We don't know yet if usb_otg_ss instances 3 and 4 are affected by this +issue or not so don't add this flag for those instances. + +Cc: Tero Kristo +Signed-off-by: Roger Quadros +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-omap2/omap_hwmod_7xx_data.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c ++++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c +@@ -2572,6 +2572,7 @@ static struct omap_hwmod dra7xx_usb_otg_ + .class = &dra7xx_usb_otg_ss_hwmod_class, + .clkdm_name = "l3init_clkdm", + .main_clk = "dpll_core_h13x2_ck", ++ .flags = HWMOD_CLKDM_NOAUTO, + .prcm = { + .omap4 = { + .clkctrl_offs = DRA7XX_CM_L3INIT_USB_OTG_SS1_CLKCTRL_OFFSET, +@@ -2593,6 +2594,7 @@ static struct omap_hwmod dra7xx_usb_otg_ + .class = &dra7xx_usb_otg_ss_hwmod_class, + .clkdm_name = "l3init_clkdm", + .main_clk = "dpll_core_h13x2_ck", ++ .flags = HWMOD_CLKDM_NOAUTO, + .prcm = { + .omap4 = { + .clkctrl_offs = DRA7XX_CM_L3INIT_USB_OTG_SS2_CLKCTRL_OFFSET, diff --git a/queue-4.9/arm-dts-adjust-moxart-irq-controller-and-flags.patch b/queue-4.9/arm-dts-adjust-moxart-irq-controller-and-flags.patch new file mode 100644 index 00000000000..0430625c8fd --- /dev/null +++ b/queue-4.9/arm-dts-adjust-moxart-irq-controller-and-flags.patch @@ -0,0 +1,119 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Linus Walleij +Date: Sat, 18 Mar 2017 17:40:01 +0100 +Subject: ARM: dts: Adjust moxart IRQ controller and flags + +From: Linus Walleij + + +[ Upstream commit c2a736b698008d296c5010ec39077eeb5796109f ] + +The moxart interrupt line flags were not respected in previous +driver: instead of assigning them per-consumer, a fixes mask +was set in the controller. + +With the migration to a standard Faraday driver we need to +set up and handle the consumer flags correctly. Also remove +the Moxart-specific flags when switching to using real consumer +flags. + +Extend the register window to 0x100 bytes as we may have a few +more registers in there and it doesn't hurt. + +Tested-by: Jonas Jensen +Signed-off-by: Jonas Jensen +Signed-off-by: Linus Walleij +Signed-off-by: Olof Johansson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/moxart-uc7112lx.dts | 2 +- + arch/arm/boot/dts/moxart.dtsi | 17 +++++++++-------- + 2 files changed, 10 insertions(+), 9 deletions(-) + +--- a/arch/arm/boot/dts/moxart-uc7112lx.dts ++++ b/arch/arm/boot/dts/moxart-uc7112lx.dts +@@ -6,7 +6,7 @@ + */ + + /dts-v1/; +-/include/ "moxart.dtsi" ++#include "moxart.dtsi" + + / { + model = "MOXA UC-7112-LX"; +--- a/arch/arm/boot/dts/moxart.dtsi ++++ b/arch/arm/boot/dts/moxart.dtsi +@@ -6,6 +6,7 @@ + */ + + /include/ "skeleton.dtsi" ++#include + + / { + compatible = "moxa,moxart"; +@@ -36,8 +37,8 @@ + ranges; + + intc: interrupt-controller@98800000 { +- compatible = "moxa,moxart-ic"; +- reg = <0x98800000 0x38>; ++ compatible = "moxa,moxart-ic", "faraday,ftintc010"; ++ reg = <0x98800000 0x100>; + interrupt-controller; + #interrupt-cells = <2>; + interrupt-mask = <0x00080000>; +@@ -59,7 +60,7 @@ + timer: timer@98400000 { + compatible = "moxa,moxart-timer"; + reg = <0x98400000 0x42>; +- interrupts = <19 1>; ++ interrupts = <19 IRQ_TYPE_EDGE_FALLING>; + clocks = <&clk_apb>; + }; + +@@ -80,7 +81,7 @@ + dma: dma@90500000 { + compatible = "moxa,moxart-dma"; + reg = <0x90500080 0x40>; +- interrupts = <24 0>; ++ interrupts = <24 IRQ_TYPE_LEVEL_HIGH>; + #dma-cells = <1>; + }; + +@@ -93,7 +94,7 @@ + sdhci: sdhci@98e00000 { + compatible = "moxa,moxart-sdhci"; + reg = <0x98e00000 0x5C>; +- interrupts = <5 0>; ++ interrupts = <5 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&clk_apb>; + dmas = <&dma 5>, + <&dma 5>; +@@ -120,7 +121,7 @@ + mac0: mac@90900000 { + compatible = "moxa,moxart-mac"; + reg = <0x90900000 0x90>; +- interrupts = <25 0>; ++ interrupts = <25 IRQ_TYPE_LEVEL_HIGH>; + phy-handle = <ðphy0>; + phy-mode = "mii"; + status = "disabled"; +@@ -129,7 +130,7 @@ + mac1: mac@92000000 { + compatible = "moxa,moxart-mac"; + reg = <0x92000000 0x90>; +- interrupts = <27 0>; ++ interrupts = <27 IRQ_TYPE_LEVEL_HIGH>; + phy-handle = <ðphy1>; + phy-mode = "mii"; + status = "disabled"; +@@ -138,7 +139,7 @@ + uart0: uart@98200000 { + compatible = "ns16550a"; + reg = <0x98200000 0x20>; +- interrupts = <31 8>; ++ interrupts = <31 IRQ_TYPE_LEVEL_HIGH>; + reg-shift = <2>; + reg-io-width = <4>; + clock-frequency = <14745600>; diff --git a/queue-4.9/arm-dts-am335x-pepper-fix-the-audio-codec-s-reset-pin.patch b/queue-4.9/arm-dts-am335x-pepper-fix-the-audio-codec-s-reset-pin.patch new file mode 100644 index 00000000000..a0d469a86ea --- /dev/null +++ b/queue-4.9/arm-dts-am335x-pepper-fix-the-audio-codec-s-reset-pin.patch @@ -0,0 +1,34 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: "Andrew F. Davis" +Date: Wed, 29 Nov 2017 11:13:56 -0600 +Subject: ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin + +From: "Andrew F. Davis" + + +[ Upstream commit e153db03c6b7a035c797bcdf35262586f003ee93 ] + +The correct DT property for specifying a GPIO used for reset +is "reset-gpios", fix this here. + +Fixes: 4341881d0562 ("ARM: dts: Add devicetree for Gumstix Pepper board") + +Signed-off-by: Andrew F. Davis +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/am335x-pepper.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/am335x-pepper.dts ++++ b/arch/arm/boot/dts/am335x-pepper.dts +@@ -139,7 +139,7 @@ + &audio_codec { + status = "okay"; + +- gpio-reset = <&gpio1 16 GPIO_ACTIVE_LOW>; ++ reset-gpios = <&gpio1 16 GPIO_ACTIVE_LOW>; + AVDD-supply = <&ldo3_reg>; + IOVDD-supply = <&ldo3_reg>; + DRVDD-supply = <&ldo3_reg>; diff --git a/queue-4.9/arm-dts-bcm2835-add-index-to-the-ethernet-alias.patch b/queue-4.9/arm-dts-bcm2835-add-index-to-the-ethernet-alias.patch new file mode 100644 index 00000000000..66283a8cc88 --- /dev/null +++ b/queue-4.9/arm-dts-bcm2835-add-index-to-the-ethernet-alias.patch @@ -0,0 +1,45 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Baruch Siach +Date: Mon, 30 Jan 2017 20:44:39 +0200 +Subject: ARM: dts: bcm2835: add index to the ethernet alias + +From: Baruch Siach + + +[ Upstream commit 10b6c0c2e2bb8cd1be682f8d36ef597e3419cb88 ] + +An alias name should have an index number even when it is the only of its type. +This allows U-Boot to add the local-mac-address property. Otherwise U-Boot +skips the alias. + +Fixes: 6a93792774 ("ARM: bcm2835: dt: Add the ethernet to the device trees") +Signed-off-by: Baruch Siach +Acked-by: Lubomir Rintel +Reviewed-by: Eric Anholt +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/bcm283x-rpi-smsc9512.dtsi | 2 +- + arch/arm/boot/dts/bcm283x-rpi-smsc9514.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/bcm283x-rpi-smsc9512.dtsi ++++ b/arch/arm/boot/dts/bcm283x-rpi-smsc9512.dtsi +@@ -1,6 +1,6 @@ + / { + aliases { +- ethernet = ðernet; ++ ethernet0 = ðernet; + }; + }; + +--- a/arch/arm/boot/dts/bcm283x-rpi-smsc9514.dtsi ++++ b/arch/arm/boot/dts/bcm283x-rpi-smsc9514.dtsi +@@ -1,6 +1,6 @@ + / { + aliases { +- ethernet = ðernet; ++ ethernet0 = ðernet; + }; + }; + diff --git a/queue-4.9/arm-dts-exynos-correct-trats2-panel-reset-line.patch b/queue-4.9/arm-dts-exynos-correct-trats2-panel-reset-line.patch new file mode 100644 index 00000000000..98eb3ca6636 --- /dev/null +++ b/queue-4.9/arm-dts-exynos-correct-trats2-panel-reset-line.patch @@ -0,0 +1,35 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Simon Shields +Date: Tue, 21 Nov 2017 22:24:24 +1100 +Subject: ARM: dts: exynos: Correct Trats2 panel reset line + +From: Simon Shields + + +[ Upstream commit 1b377924841df1e13ab5b225be3a83f807a92b52 ] + +Trats2 uses gpf2-1 as the panel reset GPIO. gpy4-5 was only used +on early revisions of the board. + +Fixes: 420ae8451a22 ("ARM: dts: exynos4412-trats2: add panel node") +Signed-off-by: Simon Shields +Acked-by: Marek Szyprowski +Tested-by: Marek Szyprowski +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/exynos4412-trats2.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/exynos4412-trats2.dts ++++ b/arch/arm/boot/dts/exynos4412-trats2.dts +@@ -408,7 +408,7 @@ + reg = <0>; + vdd3-supply = <&lcd_vdd3_reg>; + vci-supply = <&ldo25_reg>; +- reset-gpios = <&gpy4 5 GPIO_ACTIVE_HIGH>; ++ reset-gpios = <&gpf2 1 GPIO_ACTIVE_HIGH>; + power-on-delay= <50>; + reset-delay = <100>; + init-delay = <100>; diff --git a/queue-4.9/arm-dts-koelsch-correct-clock-frequency-of-x2-du-clock-input.patch b/queue-4.9/arm-dts-koelsch-correct-clock-frequency-of-x2-du-clock-input.patch new file mode 100644 index 00000000000..8c3bafb4a31 --- /dev/null +++ b/queue-4.9/arm-dts-koelsch-correct-clock-frequency-of-x2-du-clock-input.patch @@ -0,0 +1,35 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Geert Uytterhoeven +Date: Mon, 3 Apr 2017 11:55:19 +0200 +Subject: ARM: dts: koelsch: Correct clock frequency of X2 DU clock input + +From: Geert Uytterhoeven + + +[ Upstream commit ebf06af55c7594ed1fc18469a5cddf911c40e687 ] + +The X2 crystal oscillator on the Koelsch development board provides a +74.25 MHz clock, not a 148.5 MHz clock. + +Fixes: cd21cb46e14aae3a ("ARM: shmobile: koelsch: Add DU external pixel clocks to DT") +Signed-off-by: Geert Uytterhoeven +Acked-by: Laurent Pinchart +Tested-by: Niklas Söderlund +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/r8a7791-koelsch.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/r8a7791-koelsch.dts ++++ b/arch/arm/boot/dts/r8a7791-koelsch.dts +@@ -279,7 +279,7 @@ + x2_clk: x2-clock { + compatible = "fixed-clock"; + #clock-cells = <0>; +- clock-frequency = <148500000>; ++ clock-frequency = <74250000>; + }; + + x13_clk: x13-clock { diff --git a/queue-4.9/arm-dts-omap3-n900-fix-the-audio-codec-s-reset-pin.patch b/queue-4.9/arm-dts-omap3-n900-fix-the-audio-codec-s-reset-pin.patch new file mode 100644 index 00000000000..89f17b1a153 --- /dev/null +++ b/queue-4.9/arm-dts-omap3-n900-fix-the-audio-codec-s-reset-pin.patch @@ -0,0 +1,43 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: "Andrew F. Davis" +Date: Wed, 29 Nov 2017 11:13:59 -0600 +Subject: ARM: dts: omap3-n900: Fix the audio CODEC's reset pin + +From: "Andrew F. Davis" + + +[ Upstream commit 7be4b5dc7ffa9499ac6ef33a5ffa9ff43f9b7057 ] + +The correct DT property for specifying a GPIO used for reset +is "reset-gpios", fix this here. + +Fixes: 14e3e295b2b9 ("ARM: dts: omap3-n900: Add TLV320AIC3X support") + +Signed-off-by: Andrew F. Davis +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/omap3-n900.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/omap3-n900.dts ++++ b/arch/arm/boot/dts/omap3-n900.dts +@@ -510,7 +510,7 @@ + tlv320aic3x: tlv320aic3x@18 { + compatible = "ti,tlv320aic3x"; + reg = <0x18>; +- gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */ ++ reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */ + ai3x-gpio-func = < + 0 /* AIC3X_GPIO1_FUNC_DISABLED */ + 5 /* AIC3X_GPIO2_FUNC_DIGITAL_MIC_INPUT */ +@@ -527,7 +527,7 @@ + tlv320aic3x_aux: tlv320aic3x@19 { + compatible = "ti,tlv320aic3x"; + reg = <0x19>; +- gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */ ++ reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */ + + AVDD-supply = <&vmmc2>; + DRVDD-supply = <&vmmc2>; diff --git a/queue-4.9/arm-dts-r7s72100-fix-ethernet-clock-parent.patch b/queue-4.9/arm-dts-r7s72100-fix-ethernet-clock-parent.patch new file mode 100644 index 00000000000..9f37bfc281d --- /dev/null +++ b/queue-4.9/arm-dts-r7s72100-fix-ethernet-clock-parent.patch @@ -0,0 +1,34 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Chris Brandt +Date: Thu, 30 Mar 2017 14:16:09 -0700 +Subject: ARM: dts: r7s72100: fix ethernet clock parent + +From: Chris Brandt + + +[ Upstream commit 91a7c50cb4fabfba218549dfa84356069918bfbf ] + +Technically, the Ethernet block is run off the 133MHz Bus (B) clock, not +the 33MHz Peripheral 0 (P0) clock. + +Fixes: 969244f9c720 ("ARM: dts: r7s72100: add ethernet clock to device tree") +Signed-off-by: Chris Brandt +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/r7s72100.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/r7s72100.dtsi ++++ b/arch/arm/boot/dts/r7s72100.dtsi +@@ -112,7 +112,7 @@ + #clock-cells = <1>; + compatible = "renesas,r7s72100-mstp-clocks", "renesas,cpg-mstp-clocks"; + reg = <0xfcfe0430 4>; +- clocks = <&p0_clk>; ++ clocks = <&b_clk>; + clock-indices = ; + clock-output-names = "ether"; + }; diff --git a/queue-4.9/arm-dts-r8a7790-correct-parent-of-ssi-clocks.patch b/queue-4.9/arm-dts-r8a7790-correct-parent-of-ssi-clocks.patch new file mode 100644 index 00000000000..122fbd007b1 --- /dev/null +++ b/queue-4.9/arm-dts-r8a7790-correct-parent-of-ssi-clocks.patch @@ -0,0 +1,39 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Geert Uytterhoeven +Date: Mon, 3 Apr 2017 11:45:41 +0200 +Subject: ARM: dts: r8a7790: Correct parent of SSI[0-9] clocks + +From: Geert Uytterhoeven + + +[ Upstream commit d13d4e063d4a08eb1686e890e9183dde709871bf ] + +The SSI-ALL gate clock is located in between the P clock and the +individual SSI[0-9] clocks, hence the former should be listed as their +parent. + +Fixes: bcde372254386872 ("ARM: shmobile: r8a7790: add MSTP10 support on DTSI") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/r8a7790.dtsi | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/r8a7790.dtsi ++++ b/arch/arm/boot/dts/r8a7790.dtsi +@@ -1437,8 +1437,11 @@ + compatible = "renesas,r8a7790-mstp-clocks", "renesas,cpg-mstp-clocks"; + reg = <0 0xe6150998 0 4>, <0 0xe61509a8 0 4>; + clocks = <&p_clk>, +- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, +- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, ++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7790_CLK_SSI_ALL>, <&mstp10_clks R8A7790_CLK_SSI_ALL>, + <&p_clk>, + <&mstp10_clks R8A7790_CLK_SCU_ALL>, <&mstp10_clks R8A7790_CLK_SCU_ALL>, + <&mstp10_clks R8A7790_CLK_SCU_ALL>, <&mstp10_clks R8A7790_CLK_SCU_ALL>, diff --git a/queue-4.9/arm-dts-r8a7791-correct-parent-of-ssi-clocks.patch b/queue-4.9/arm-dts-r8a7791-correct-parent-of-ssi-clocks.patch new file mode 100644 index 00000000000..137bf643225 --- /dev/null +++ b/queue-4.9/arm-dts-r8a7791-correct-parent-of-ssi-clocks.patch @@ -0,0 +1,39 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Geert Uytterhoeven +Date: Mon, 3 Apr 2017 11:45:42 +0200 +Subject: ARM: dts: r8a7791: Correct parent of SSI[0-9] clocks + +From: Geert Uytterhoeven + + +[ Upstream commit 16fe68dcab5702a024d85229ff7e98979cb701a5 ] + +The SSI-ALL gate clock is located in between the P clock and the +individual SSI[0-9] clocks, hence the former should be listed as their +parent. + +Fixes: ee9141522dcf13f8 ("ARM: shmobile: r8a7791: add MSTP10 support on DTSI") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/r8a7791.dtsi | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/r8a7791.dtsi ++++ b/arch/arm/boot/dts/r8a7791.dtsi +@@ -1437,8 +1437,11 @@ + compatible = "renesas,r8a7791-mstp-clocks", "renesas,cpg-mstp-clocks"; + reg = <0 0xe6150998 0 4>, <0 0xe61509a8 0 4>; + clocks = <&p_clk>, +- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, +- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, ++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7791_CLK_SSI_ALL>, <&mstp10_clks R8A7791_CLK_SSI_ALL>, + <&p_clk>, + <&mstp10_clks R8A7791_CLK_SCU_ALL>, <&mstp10_clks R8A7791_CLK_SCU_ALL>, + <&mstp10_clks R8A7791_CLK_SCU_ALL>, <&mstp10_clks R8A7791_CLK_SCU_ALL>, diff --git a/queue-4.9/arm-dts-r8a7791-remove-unit-address-and-reg-from-integrated-cache.patch b/queue-4.9/arm-dts-r8a7791-remove-unit-address-and-reg-from-integrated-cache.patch new file mode 100644 index 00000000000..ac58bb20983 --- /dev/null +++ b/queue-4.9/arm-dts-r8a7791-remove-unit-address-and-reg-from-integrated-cache.patch @@ -0,0 +1,36 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Geert Uytterhoeven +Date: Mon, 6 Mar 2017 17:40:40 +0100 +Subject: ARM: dts: r8a7791: Remove unit-address and reg from integrated cache + +From: Geert Uytterhoeven + + +[ Upstream commit 5d6a2165abd4635ecf5ece3d02fe8677f00d32c5 ] + +The Cortex-A15 cache controller is an integrated controller, and thus +the device node representing it should not have a unit-addresses or reg +property. + +Fixes: 6f9314ce258c8504 ("ARM: dts: r8a7791: Fix W=1 dtc warnings") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/r8a7791.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/r8a7791.dtsi ++++ b/arch/arm/boot/dts/r8a7791.dtsi +@@ -74,9 +74,8 @@ + next-level-cache = <&L2_CA15>; + }; + +- L2_CA15: cache-controller@0 { ++ L2_CA15: cache-controller-0 { + compatible = "cache"; +- reg = <0>; + power-domains = <&sysc R8A7791_PD_CA15_SCU>; + cache-unified; + cache-level = <2>; diff --git a/queue-4.9/arm-dts-r8a7792-remove-unit-address-and-reg-from-integrated-cache.patch b/queue-4.9/arm-dts-r8a7792-remove-unit-address-and-reg-from-integrated-cache.patch new file mode 100644 index 00000000000..acb9babe2dd --- /dev/null +++ b/queue-4.9/arm-dts-r8a7792-remove-unit-address-and-reg-from-integrated-cache.patch @@ -0,0 +1,36 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Geert Uytterhoeven +Date: Mon, 6 Mar 2017 17:40:41 +0100 +Subject: ARM: dts: r8a7792: Remove unit-address and reg from integrated cache + +From: Geert Uytterhoeven + + +[ Upstream commit a0504f0880c11da301dc2b5a5135bd02376e367e ] + +The Cortex-A15 cache controller is an integrated controller, and thus +the device node representing it should not have a unit-addresses or reg +property. + +Fixes: 7c4163aae3d8e5b9 ("ARM: dts: r8a7792: initial SoC device tree") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/r8a7792.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/r8a7792.dtsi ++++ b/arch/arm/boot/dts/r8a7792.dtsi +@@ -58,9 +58,8 @@ + next-level-cache = <&L2_CA15>; + }; + +- L2_CA15: cache-controller@0 { ++ L2_CA15: cache-controller-0 { + compatible = "cache"; +- reg = <0>; + cache-unified; + cache-level = <2>; + power-domains = <&sysc R8A7792_PD_CA15_SCU>; diff --git a/queue-4.9/arm-dts-r8a7793-correct-parent-of-ssi-clocks.patch b/queue-4.9/arm-dts-r8a7793-correct-parent-of-ssi-clocks.patch new file mode 100644 index 00000000000..40c10827f44 --- /dev/null +++ b/queue-4.9/arm-dts-r8a7793-correct-parent-of-ssi-clocks.patch @@ -0,0 +1,39 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Geert Uytterhoeven +Date: Mon, 3 Apr 2017 11:45:43 +0200 +Subject: ARM: dts: r8a7793: Correct parent of SSI[0-9] clocks + +From: Geert Uytterhoeven + + +[ Upstream commit 1cd9028027c7a7c10b774df698c3cfafec6aa67d ] + +The SSI-ALL gate clock is located in between the P clock and the +individual SSI[0-9] clocks, hence the former should be listed as their +parent. + +Fixes: 072d326542e49187 ("ARM: dts: r8a7793: add MSTP10 clocks to device tree") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/r8a7793.dtsi | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/r8a7793.dtsi ++++ b/arch/arm/boot/dts/r8a7793.dtsi +@@ -1234,8 +1234,11 @@ + compatible = "renesas,r8a7793-mstp-clocks", "renesas,cpg-mstp-clocks"; + reg = <0 0xe6150998 0 4>, <0 0xe61509a8 0 4>; + clocks = <&p_clk>, +- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, +- <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>, ++ <&mstp10_clks R8A7793_CLK_SSI_ALL>, <&mstp10_clks R8A7793_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7793_CLK_SSI_ALL>, <&mstp10_clks R8A7793_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7793_CLK_SSI_ALL>, <&mstp10_clks R8A7793_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7793_CLK_SSI_ALL>, <&mstp10_clks R8A7793_CLK_SSI_ALL>, ++ <&mstp10_clks R8A7793_CLK_SSI_ALL>, <&mstp10_clks R8A7793_CLK_SSI_ALL>, + <&p_clk>, + <&mstp10_clks R8A7793_CLK_SCU_ALL>, <&mstp10_clks R8A7793_CLK_SCU_ALL>, + <&mstp10_clks R8A7793_CLK_SCU_ALL>, <&mstp10_clks R8A7793_CLK_SCU_ALL>, diff --git a/queue-4.9/arm-dts-r8a7793-remove-unit-address-and-reg-from-integrated-cache.patch b/queue-4.9/arm-dts-r8a7793-remove-unit-address-and-reg-from-integrated-cache.patch new file mode 100644 index 00000000000..7a508b2381b --- /dev/null +++ b/queue-4.9/arm-dts-r8a7793-remove-unit-address-and-reg-from-integrated-cache.patch @@ -0,0 +1,36 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Geert Uytterhoeven +Date: Mon, 6 Mar 2017 17:40:42 +0100 +Subject: ARM: dts: r8a7793: Remove unit-address and reg from integrated cache + +From: Geert Uytterhoeven + + +[ Upstream commit beffa8872a3680ef804eb0320ec77037170f4686 ] + +The Cortex-A15 cache controller is an integrated controller, and thus +the device node representing it should not have a unit-addresses or reg +property. + +Fixes: ad53f5f00b095a0d ("ARM: dts: r8a7793: Fix W=1 dtc warnings") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/r8a7793.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/r8a7793.dtsi ++++ b/arch/arm/boot/dts/r8a7793.dtsi +@@ -65,9 +65,8 @@ + power-domains = <&sysc R8A7793_PD_CA15_CPU1>; + }; + +- L2_CA15: cache-controller@0 { ++ L2_CA15: cache-controller-0 { + compatible = "cache"; +- reg = <0>; + power-domains = <&sysc R8A7793_PD_CA15_SCU>; + cache-unified; + cache-level = <2>; diff --git a/queue-4.9/arm-dts-r8a7794-correct-clock-of-du1.patch b/queue-4.9/arm-dts-r8a7794-correct-clock-of-du1.patch new file mode 100644 index 00000000000..f47bf6c6ec9 --- /dev/null +++ b/queue-4.9/arm-dts-r8a7794-correct-clock-of-du1.patch @@ -0,0 +1,34 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Geert Uytterhoeven +Date: Tue, 28 Mar 2017 12:45:31 +0200 +Subject: ARM: dts: r8a7794: Correct clock of DU1 + +From: Geert Uytterhoeven + + +[ Upstream commit 89675f36c9e17512812b9d14d9824f8ef92782c3 ] + +The second channel of the display unit uses a different module clock +than the first channel. + +Fixes: 46c4f13d04d729fa ("ARM: shmobile: r8a7794: Add DU node to device tree") +Signed-off-by: Geert Uytterhoeven +Acked-by: Laurent Pinchart +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/r8a7794.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/r8a7794.dtsi ++++ b/arch/arm/boot/dts/r8a7794.dtsi +@@ -916,7 +916,7 @@ + interrupts = , + ; + clocks = <&mstp7_clks R8A7794_CLK_DU0>, +- <&mstp7_clks R8A7794_CLK_DU0>; ++ <&mstp7_clks R8A7794_CLK_DU1>; + clock-names = "du.0", "du.1"; + status = "disabled"; + diff --git a/queue-4.9/arm-dts-r8a7794-remove-unit-address-and-reg-from-integrated-cache.patch b/queue-4.9/arm-dts-r8a7794-remove-unit-address-and-reg-from-integrated-cache.patch new file mode 100644 index 00000000000..b73dc01382d --- /dev/null +++ b/queue-4.9/arm-dts-r8a7794-remove-unit-address-and-reg-from-integrated-cache.patch @@ -0,0 +1,36 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Geert Uytterhoeven +Date: Mon, 6 Mar 2017 17:40:43 +0100 +Subject: ARM: dts: r8a7794: Remove unit-address and reg from integrated cache + +From: Geert Uytterhoeven + + +[ Upstream commit 65d0b7ed40f8a3a41a0ac5ed5ca4d1874c6aaf2d ] + +The Cortex-A7 cache controller is an integrated controller, and thus the +device node representing it should not have a unit-addresses or reg +property. + +Fixes: 34ea4b4a827b4ee7 ("ARM: dts: r8a7794: Fix W=1 dtc warnings") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/r8a7794.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/r8a7794.dtsi ++++ b/arch/arm/boot/dts/r8a7794.dtsi +@@ -56,9 +56,8 @@ + next-level-cache = <&L2_CA7>; + }; + +- L2_CA7: cache-controller@0 { ++ L2_CA7: cache-controller-0 { + compatible = "cache"; +- reg = <0>; + power-domains = <&sysc R8A7794_PD_CA7_SCU>; + cache-unified; + cache-level = <2>; diff --git a/queue-4.9/arm-dts-silk-correct-clock-of-du1.patch b/queue-4.9/arm-dts-silk-correct-clock-of-du1.patch new file mode 100644 index 00000000000..ae57efa67df --- /dev/null +++ b/queue-4.9/arm-dts-silk-correct-clock-of-du1.patch @@ -0,0 +1,34 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Geert Uytterhoeven +Date: Tue, 28 Mar 2017 12:45:33 +0200 +Subject: ARM: dts: silk: Correct clock of DU1 + +From: Geert Uytterhoeven + + +[ Upstream commit 403fe77e22eb72c962c3889efc9d4fa62e454737 ] + +The second channel of the display unit uses a different module clock +than the first channel. + +Fixes: 84e734f497cd48f6 ("ARM: dts: silk: add DU DT support") +Signed-off-by: Geert Uytterhoeven +Acked-by: Laurent Pinchart +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/r8a7794-silk.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/r8a7794-silk.dts ++++ b/arch/arm/boot/dts/r8a7794-silk.dts +@@ -425,7 +425,7 @@ + status = "okay"; + + clocks = <&mstp7_clks R8A7794_CLK_DU0>, +- <&mstp7_clks R8A7794_CLK_DU0>, ++ <&mstp7_clks R8A7794_CLK_DU1>, + <&x2_clk>, <&x3_clk>; + clock-names = "du.0", "du.1", "dclkin.0", "dclkin.1"; + diff --git a/queue-4.9/arm64-dts-r8a7796-remove-unit-address-and-reg-from-integrated-cache.patch b/queue-4.9/arm64-dts-r8a7796-remove-unit-address-and-reg-from-integrated-cache.patch new file mode 100644 index 00000000000..274d589dc59 --- /dev/null +++ b/queue-4.9/arm64-dts-r8a7796-remove-unit-address-and-reg-from-integrated-cache.patch @@ -0,0 +1,36 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Geert Uytterhoeven +Date: Fri, 3 Mar 2017 14:18:17 +0100 +Subject: arm64: dts: r8a7796: Remove unit-address and reg from integrated cache + +From: Geert Uytterhoeven + + +[ Upstream commit 57a4fd420c6e8a04b6a87ff24d34250cd7c48f15 ] + +The Cortex-A57 cache controller is an integrated controller, and thus +the device node representing it should not have a unit-addresses or reg +property. + +Fixes: 1561f20760ec96db ("arm64: dts: r8a7796: Add Renesas R8A7796 SoC support") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/renesas/r8a7796.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/arm64/boot/dts/renesas/r8a7796.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a7796.dtsi +@@ -36,9 +36,8 @@ + enable-method = "psci"; + }; + +- L2_CA57: cache-controller@0 { ++ L2_CA57: cache-controller-0 { + compatible = "cache"; +- reg = <0>; + power-domains = <&sysc R8A7796_PD_CA57_SCU>; + cache-unified; + cache-level = <2>; diff --git a/queue-4.9/asoc-nuc900-fix-a-loop-timeout-test.patch b/queue-4.9/asoc-nuc900-fix-a-loop-timeout-test.patch new file mode 100644 index 00000000000..6216f09328f --- /dev/null +++ b/queue-4.9/asoc-nuc900-fix-a-loop-timeout-test.patch @@ -0,0 +1,42 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Dan Carpenter +Date: Sat, 9 Dec 2017 14:52:28 +0300 +Subject: ASoC: nuc900: Fix a loop timeout test + +From: Dan Carpenter + + +[ Upstream commit 65a12b3aafed5fc59f4ce41b22b752b1729e6701 ] + +We should be finishing the loop with timeout set to zero but because +this is a post-op we finish with timeout == -1. + +Fixes: 1082e2703a2d ("ASoC: NUC900/audio: add nuc900 audio driver support") +Signed-off-by: Dan Carpenter +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/nuc900/nuc900-ac97.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/soc/nuc900/nuc900-ac97.c ++++ b/sound/soc/nuc900/nuc900-ac97.c +@@ -67,7 +67,7 @@ static unsigned short nuc900_ac97_read(s + + /* polling the AC_R_FINISH */ + while (!(AUDIO_READ(nuc900_audio->mmio + ACTL_ACCON) & AC_R_FINISH) +- && timeout--) ++ && --timeout) + mdelay(1); + + if (!timeout) { +@@ -121,7 +121,7 @@ static void nuc900_ac97_write(struct snd + + /* polling the AC_W_FINISH */ + while ((AUDIO_READ(nuc900_audio->mmio + ACTL_ACCON) & AC_W_FINISH) +- && timeout--) ++ && --timeout) + mdelay(1); + + if (!timeout) diff --git a/queue-4.9/asoc-rcar-ssi-don-t-set-ssicr.ckdv-000-with-ssiwsr.cont.patch b/queue-4.9/asoc-rcar-ssi-don-t-set-ssicr.ckdv-000-with-ssiwsr.cont.patch new file mode 100644 index 00000000000..ecbbc46dd1c --- /dev/null +++ b/queue-4.9/asoc-rcar-ssi-don-t-set-ssicr.ckdv-000-with-ssiwsr.cont.patch @@ -0,0 +1,43 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Kuninori Morimoto +Date: Wed, 22 Mar 2017 04:02:43 +0000 +Subject: ASoC: rcar: ssi: don't set SSICR.CKDV = 000 with SSIWSR.CONT + +From: Kuninori Morimoto + + +[ Upstream commit 6b8530cc056efd4a11b034ca5b1e9f7e9563f553 ] + +R-Car Datasheet is indicating "SSICR.CKDV = 000 is invalid when +SSIWSR.WS_MODE = 1 or SSIWSR.CONT = 1". +Current driver will set CONT, thus, we shouldn't use CKDV = 000. +This patch fixup it. + +Reported-by: Hiroyuki Yokoyama +Signed-off-by: Kuninori Morimoto +Tested-by: Hiroyuki Yokoyama +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/sh/rcar/ssi.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/sound/soc/sh/rcar/ssi.c ++++ b/sound/soc/sh/rcar/ssi.c +@@ -233,6 +233,15 @@ static int rsnd_ssi_master_clk_start(str + for (j = 0; j < ARRAY_SIZE(ssi_clk_mul_table); j++) { + + /* ++ * It will set SSIWSR.CONT here, but SSICR.CKDV = 000 ++ * with it is not allowed. (SSIWSR.WS_MODE with ++ * SSICR.CKDV = 000 is not allowed either). ++ * Skip it. See SSICR.CKDV ++ */ ++ if (j == 0) ++ continue; ++ ++ /* + * this driver is assuming that + * system word is 32bit x chan + * see rsnd_ssi_init() diff --git a/queue-4.9/asoc-rt5677-add-of-device-id-table.patch b/queue-4.9/asoc-rt5677-add-of-device-id-table.patch new file mode 100644 index 00000000000..485243bbf99 --- /dev/null +++ b/queue-4.9/asoc-rt5677-add-of-device-id-table.patch @@ -0,0 +1,65 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Javier Martinez Canillas +Date: Tue, 4 Apr 2017 15:26:30 -0400 +Subject: ASoC: rt5677: Add OF device ID table + +From: Javier Martinez Canillas + + +[ Upstream commit 7b87463edf3e2c16d72eeea3d1cf3c12bb5487c6 ] + +The driver doesn't have a struct of_device_id table but supported devices +are registered via Device Trees. This is working on the assumption that a +I2C device registered via OF will always match a legacy I2C device ID and +that the MODALIAS reported will always be of the form i2c:. + +But this could change in the future so the correct approach is to have an +OF device ID table if the devices are registered via OF. + +Before this patch: + +$ modinfo sound/soc/codecs/snd-soc-rt5677.ko | grep alias +alias: i2c:RT5677CE:00 +alias: i2c:rt5676 +alias: i2c:rt5677 + +After this patch: + +$ modinfo sound/soc/codecs/snd-soc-rt5677.ko | grep alias +alias: of:N*T*Crealtek,rt5677C* +alias: of:N*T*Crealtek,rt5677 +alias: i2c:RT5677CE:00 +alias: i2c:rt5676 +alias: i2c:rt5677 + +Signed-off-by: Javier Martinez Canillas +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/codecs/rt5677.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/sound/soc/codecs/rt5677.c ++++ b/sound/soc/codecs/rt5677.c +@@ -5035,6 +5035,12 @@ static const struct i2c_device_id rt5677 + }; + MODULE_DEVICE_TABLE(i2c, rt5677_i2c_id); + ++static const struct of_device_id rt5677_of_match[] = { ++ { .compatible = "realtek,rt5677", }, ++ { } ++}; ++MODULE_DEVICE_TABLE(of, rt5677_of_match); ++ + static const struct acpi_gpio_params plug_det_gpio = { RT5677_GPIO_PLUG_DET, 0, false }; + static const struct acpi_gpio_params mic_present_gpio = { RT5677_GPIO_MIC_PRESENT_L, 0, false }; + static const struct acpi_gpio_params headphone_enable_gpio = { RT5677_GPIO_HP_AMP_SHDN_L, 0, false }; +@@ -5294,6 +5300,7 @@ static int rt5677_i2c_remove(struct i2c_ + static struct i2c_driver rt5677_i2c_driver = { + .driver = { + .name = "rt5677", ++ .of_match_table = rt5677_of_match, + }, + .probe = rt5677_i2c_probe, + .remove = rt5677_i2c_remove, diff --git a/queue-4.9/ath10k-disallow-dfs-simulation-if-dfs-channel-is-not-enabled.patch b/queue-4.9/ath10k-disallow-dfs-simulation-if-dfs-channel-is-not-enabled.patch new file mode 100644 index 00000000000..b1cb0fc2f45 --- /dev/null +++ b/queue-4.9/ath10k-disallow-dfs-simulation-if-dfs-channel-is-not-enabled.patch @@ -0,0 +1,66 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Mohammed Shafi Shajakhan +Date: Wed, 22 Feb 2017 21:03:11 +0530 +Subject: ath10k: disallow DFS simulation if DFS channel is not enabled + +From: Mohammed Shafi Shajakhan + + +[ Upstream commit ca07baab0b1e627ae1d4a55d190fb1c9d32a3445 ] + +If DFS is not enabled in hostapd (ieee80211h=0) DFS channels shall +not be available for use even though the hardware may have the capability +to support DFS. With this configuration (DFS disabled in hostapd) trying to +bring up ath10k device in DFS channel for AP mode fails and trying to +simulate DFS in ath10k debugfs results in a warning in cfg80211 complaining +invalid channel and this should be avoided in the driver itself rather than +false propogating RADAR detection to mac80211/cfg80211. Fix this by +checking for the first vif 'is_started' state(should work for client mode +as well) as all the vifs shall be configured for the same channel + +sys/kernel/debug/ieee80211/phy1/ath10k# echo 1 > dfs_simulate_radar + +WARNING: at net/wireless/chan.c:265 cfg80211_radar_event+0x24/0x60 +Workqueue: phy0 ieee80211_dfs_radar_detected_work [mac80211] +[] (warn_slowpath_null) from +[] (cfg80211_radar_event+0x24/0x60 [cfg80211]) +[] (cfg80211_radar_event [cfg80211]) from +[] (ieee80211_dfs_radar_detected_work+0x94/0xa0 [mac80211]) +[] (ieee80211_dfs_radar_detected_work [mac80211]) from +[] (process_one_work+0x20c/0x32c) + +WARNING: at net/wireless/nl80211.c:2488 nl80211_get_mpath+0x13c/0x4cc + Workqueue: phy0 ieee80211_dfs_radar_detected_work [mac80211] +[] (warn_slowpath_null) from +[] (cfg80211_radar_event+0x24/0x60 [cfg80211]) +[] (cfg80211_radar_event [cfg80211]) from +[] (ieee80211_dfs_radar_detected_work+0x94/0xa0 [mac80211]) +[] (ieee80211_dfs_radar_detected_work [mac80211]) from +[] (process_one_work+0x20c/0x32c) + +Signed-off-by: Mohammed Shafi Shajakhan +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath10k/debug.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/net/wireless/ath/ath10k/debug.c ++++ b/drivers/net/wireless/ath/ath10k/debug.c +@@ -1942,6 +1942,15 @@ static ssize_t ath10k_write_simulate_rad + size_t count, loff_t *ppos) + { + struct ath10k *ar = file->private_data; ++ struct ath10k_vif *arvif; ++ ++ /* Just check for for the first vif alone, as all the vifs will be ++ * sharing the same channel and if the channel is disabled, all the ++ * vifs will share the same 'is_started' state. ++ */ ++ arvif = list_first_entry(&ar->arvifs, typeof(*arvif), list); ++ if (!arvif->is_started) ++ return -EINVAL; + + ieee80211_radar_detected(ar->hw); + diff --git a/queue-4.9/ath10k-fix-a-warning-during-channel-switch-with-multiple-vaps.patch b/queue-4.9/ath10k-fix-a-warning-during-channel-switch-with-multiple-vaps.patch new file mode 100644 index 00000000000..5f86b4b3f8b --- /dev/null +++ b/queue-4.9/ath10k-fix-a-warning-during-channel-switch-with-multiple-vaps.patch @@ -0,0 +1,58 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Mohammed Shafi Shajakhan +Date: Wed, 8 Mar 2017 13:52:06 +0200 +Subject: ath10k: fix a warning during channel switch with multiple vaps + +From: Mohammed Shafi Shajakhan + + +[ Upstream commit c73f8c00330f59ce9b1ace9ff698aca83390d358 ] + +Doing a channel switch via hostapd_cli seems to update +the new channel context for each VAP's appropriately as below +in 'ath10k_mac_update_vif_chan', hence we can safely suppress the +warning that shows up during this operation and dump the warning only +if no vaps are available for channel switch + +hostapd_cli -i wlan0 chan_switch 5 5200 +OK + +ath10k_pci : mac chanctx switch n_vifs 3 mode 1 +ath10k_pci : mac chanctx switch vdev_id 2 freq 5180->5200 width 0->0 +ath10k_pci : mac chanctx switch vdev_id 1 freq 5180->5200 width 0->0 +ath10k_pci : mac chanctx switch vdev_id 0 freq 5180->5200 width 0->0 + +Call Trace: + +WARNING: backports-20161201-3.14.77-9ab3068/drivers/net/wireless/ath/ath10k/mac.c:7126 +[] (warn_slowpath_null) from [] +(ath10k_reconfig_complete+0xe4/0x25c [ath10k_core]) +[] (ath10k_reconfig_complete [ath10k_core]) +[] (ath10k_mac_vif_ap_csa_work+0x214/0x370 [ath10k_core]) +[] (ath10k_mac_op_change_chanctx+0x108/0x128 [ath10k_core]) +[] (ieee80211_recalc_chanctx_min_def+0x30c/0x430 [mac80211]) +[] (ieee80211_recalc_smps_chanctx+0x2ec/0x840 [mac80211]) +[] (ieee80211_vif_use_reserved_context+0x7c/0xf8 [mac80211]) +[] (ieee80211_vif_use_reserved_context [mac80211]) +[] (ieee80211_csa_finalize_work+0x5c/0x88 [mac80211]) + +Fixes: d7bf4b4aba05 ("ath10k: fix ar->rx_channel updating logic") +Signed-off-by: Mohammed Shafi Shajakhan +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath10k/mac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -7070,7 +7070,7 @@ ath10k_mac_update_rx_channel(struct ath1 + lockdep_assert_held(&ar->data_lock); + + WARN_ON(ctx && vifs); +- WARN_ON(vifs && n_vifs != 1); ++ WARN_ON(vifs && !n_vifs); + + /* FIXME: Sort of an optimization and a workaround. Peers and vifs are + * on a linked list now. Doing a lookup peer -> vif -> chanctx for each diff --git a/queue-4.9/ath10k-fix-compile-time-sanity-check-for-ce4-buffer-size.patch b/queue-4.9/ath10k-fix-compile-time-sanity-check-for-ce4-buffer-size.patch new file mode 100644 index 00000000000..cfb52d2aaa5 --- /dev/null +++ b/queue-4.9/ath10k-fix-compile-time-sanity-check-for-ce4-buffer-size.patch @@ -0,0 +1,35 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Mohammed Shafi Shajakhan +Date: Tue, 4 Apr 2017 22:22:56 +0530 +Subject: ath10k: fix compile time sanity check for CE4 buffer size + +From: Mohammed Shafi Shajakhan + + +[ Upstream commit 62ca0690cd495bb7c1414cdf0cf790c2922a1d79 ] + +In 'ath10k_ce_alloc_pipe' the compile time sanity check to +ensure that there is sufficient buffers in CE4 for HTT Tx +MSDU descriptors, but this did not take into account of the +case with 'peer flow control' enabled, fix this. + +Cc: Michal Kazior +Signed-off-by: Mohammed Shafi Shajakhan +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath10k/ce.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath10k/ce.c ++++ b/drivers/net/wireless/ath/ath10k/ce.c +@@ -1059,7 +1059,7 @@ int ath10k_ce_alloc_pipe(struct ath10k * + */ + BUILD_BUG_ON(2 * TARGET_NUM_MSDU_DESC > + (CE_HTT_H2T_MSG_SRC_NENTRIES - 1)); +- BUILD_BUG_ON(2 * TARGET_10X_NUM_MSDU_DESC > ++ BUILD_BUG_ON(2 * TARGET_10_4_NUM_MSDU_DESC_PFC > + (CE_HTT_H2T_MSG_SRC_NENTRIES - 1)); + BUILD_BUG_ON(2 * TARGET_TLV_NUM_MSDU_DESC > + (CE_HTT_H2T_MSG_SRC_NENTRIES - 1)); diff --git a/queue-4.9/ath10k-fix-fetching-channel-during-potential-radar-detection.patch b/queue-4.9/ath10k-fix-fetching-channel-during-potential-radar-detection.patch new file mode 100644 index 00000000000..1e618edf0fe --- /dev/null +++ b/queue-4.9/ath10k-fix-fetching-channel-during-potential-radar-detection.patch @@ -0,0 +1,80 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Mohammed Shafi Shajakhan +Date: Wed, 8 Mar 2017 18:03:32 +0530 +Subject: ath10k: fix fetching channel during potential radar detection + +From: Mohammed Shafi Shajakhan + + +[ Upstream commit a28f6f27a88f047f03f04b9246ca260ebc91455e ] + +Fetch target operating channel during potential radar detection when +the interface is just brought up, but no channel is assigned from +userspace. In this scenario rx_channel may not be having a valid pointer +hence fetch the target operating channel to avoid warnings as below +which can be triggered by the commands with DFS testing over longer run + +comamnds: +iw wlan1 set type mesh +ifconfig wlan1 up (valid tgt_oper_chan only) +iw wlan1 cac trigger freq 5260 HT20 (valid rx_channel, tgt_oper_chan) +iw wlan1 cac trigger freq 5280 HT20 +iw wlan1 cac trigger freq 5300 HT20 + +Once the CAC expires, current channel context will be removed and +we are only left with the fallback option of using 'target operating +channel' + +Firmware and driver log: +ath: phy1: DFS: radar found on freq=5300: id=1, pri=1125, count=5, +count_false=4 +ath: phy1: DFS: radar found on freq=5260: id=5, pri=3151, count=6, +count_false=11 +ath: phy1: DFS: radar found on freq=5280: id=1, pri=1351, count=6, +count_false=4 +ath: phy1: DFS: radar found on freq=5300: id=1, pri=1125, count=5, +count_false=4 +ath10k_pci 0001:01:00.0: failed to derive channel for radar pulse, +treating as radar +ath10k_pci 0001:01:00.0: failed to derive channel for radar pulse, +treating as radar + +Call trace: + +WARNING: CPU: 1 PID: 2145 at +backports-20161201-3.14.77-9ab3068/net/wireless/chan.c:265 +cfg80211_set_dfs_state+0x3c/0x88 [cfg80211]() + + Workqueue: phy1 ieee80211_dfs_radar_detected_work +[mac80211] +[] (warn_slowpath_null) from [] +(cfg80211_set_dfs_state+0x3c/0x88 [cfg80211]) +[] (cfg80211_set_dfs_state [cfg80211]) from +[] (cfg80211_radar_event+0xc4/0x140 [cfg80211]) +[] (cfg80211_radar_event [cfg80211]) from +[] (ieee80211_dfs_radar_detected_work+0xa8/0xb4 [mac80211]) +[] (ieee80211_dfs_radar_detected_work +[mac80211]) from [] (process_one_work+0x298/0x4a4) + +Signed-off-by: Mohammed Shafi Shajakhan +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath10k/wmi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -3638,6 +3638,11 @@ static void ath10k_dfs_radar_report(stru + + spin_lock_bh(&ar->data_lock); + ch = ar->rx_channel; ++ ++ /* fetch target operating channel during channel change */ ++ if (!ch) ++ ch = ar->tgt_oper_chan; ++ + spin_unlock_bh(&ar->data_lock); + + if (!ch) { diff --git a/queue-4.9/ath10k-fix-invalid-sts_cap_offset_mask.patch b/queue-4.9/ath10k-fix-invalid-sts_cap_offset_mask.patch new file mode 100644 index 00000000000..e7d39e21ffa --- /dev/null +++ b/queue-4.9/ath10k-fix-invalid-sts_cap_offset_mask.patch @@ -0,0 +1,35 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Ben Greear +Date: Sat, 2 Dec 2017 16:50:49 +0200 +Subject: ath10k: fix invalid STS_CAP_OFFSET_MASK + +From: Ben Greear + + +[ Upstream commit 8cec57f5277ef0e354e37a0bf909dc71bc1f865b ] + +The 10.4 firmware defines this as a 3-bit field, as does the +mac80211 stack. The 4th bit is defined as CONF_IMPLICIT_BF +at least in the firmware header I have seen. This patch +fixes the ath10k wmi header to match the firmware. + +Signed-off-by: Ben Greear +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath10k/wmi.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath10k/wmi.h ++++ b/drivers/net/wireless/ath/ath10k/wmi.h +@@ -5017,7 +5017,8 @@ enum wmi_10_4_vdev_param { + #define WMI_VDEV_PARAM_TXBF_MU_TX_BFER BIT(3) + + #define WMI_TXBF_STS_CAP_OFFSET_LSB 4 +-#define WMI_TXBF_STS_CAP_OFFSET_MASK 0xf0 ++#define WMI_TXBF_STS_CAP_OFFSET_MASK 0x70 ++#define WMI_TXBF_CONF_IMPLICIT_BF BIT(7) + #define WMI_BF_SOUND_DIM_OFFSET_LSB 8 + #define WMI_BF_SOUND_DIM_OFFSET_MASK 0xf00 + diff --git a/queue-4.9/ath10k-update-tdls-teardown-state-to-target.patch b/queue-4.9/ath10k-update-tdls-teardown-state-to-target.patch new file mode 100644 index 00000000000..934ef754401 --- /dev/null +++ b/queue-4.9/ath10k-update-tdls-teardown-state-to-target.patch @@ -0,0 +1,47 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Manikanta Pubbisetty +Date: Mon, 6 Nov 2017 13:39:31 +0530 +Subject: ath10k: update tdls teardown state to target + +From: Manikanta Pubbisetty + + +[ Upstream commit 424ea0d174e82365f85c6770225dba098b8f1d5f ] + +It is required to update the teardown state of the peer when +a tdls link with that peer is terminated. This information is +useful for the target to perform some cleanups wrt the tdls peer. + +Without proper cleanup, target assumes that the peer is connected and +blocks future connection requests, updating the teardown state of the +peer addresses the problem. + +Tested this change on QCA9888 with 10.4-3.5.1-00018 fw version. + +Signed-off-by: Manikanta Pubbisetty +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath10k/mac.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -6054,6 +6054,16 @@ static int ath10k_sta_state(struct ieee8 + "mac vdev %d peer delete %pM sta %pK (sta gone)\n", + arvif->vdev_id, sta->addr, sta); + ++ if (sta->tdls) { ++ ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id, ++ sta, ++ WMI_TDLS_PEER_STATE_TEARDOWN); ++ if (ret) ++ ath10k_warn(ar, "failed to update tdls peer state for %pM state %d: %i\n", ++ sta->addr, ++ WMI_TDLS_PEER_STATE_TEARDOWN, ret); ++ } ++ + ret = ath10k_peer_delete(ar, arvif->vdev_id, sta->addr); + if (ret) + ath10k_warn(ar, "failed to delete peer %pM for vdev %d: %i\n", diff --git a/queue-4.9/batman-adv-handle-race-condition-for-claims-between-gateways.patch b/queue-4.9/batman-adv-handle-race-condition-for-claims-between-gateways.patch new file mode 100644 index 00000000000..a0df6d262ba --- /dev/null +++ b/queue-4.9/batman-adv-handle-race-condition-for-claims-between-gateways.patch @@ -0,0 +1,71 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Andreas Pape +Date: Mon, 5 Sep 2016 13:20:29 +0200 +Subject: batman-adv: handle race condition for claims between gateways + +From: Andreas Pape + + +[ Upstream commit a3a5129e122709306cfa6409781716c2933df99b ] + +Consider the following situation which has been found in a test setup: +Gateway B has claimed client C and gateway A has the same backbone +network as B. C sends a broad- or multicast to B and directly after +this packet decides to send another packet to A due to a better TQ +value. B will forward the broad-/multicast into the backbone as it is +the responsible gw and after that A will claim C as it has been +chosen by C as the best gateway. If it now happens that A claims C +before it has received the broad-/multicast forwarded by B (due to +backbone topology or due to some delay in B when forwarding the +packet) we get a critical situation: in the current code A will +immediately unclaim C when receiving the multicast due to the +roaming client scenario although the position of C has not changed +in the mesh. If this happens the multi-/broadcast forwarded by B +will be sent back into the mesh by A and we have looping packets +until one of the gateways claims C again. +In order to prevent this, unclaiming of a client due to the roaming +client scenario is only done after a certain time is expired after +the last claim of the client. 100 ms are used here, which should be +slow enough for big backbones and slow gateways but fast enough not +to break the roaming client use case. + +Acked-by: Simon Wunderlich +Signed-off-by: Andreas Pape +[sven@narfation.org: fix conflicts with current version] +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/bridge_loop_avoidance.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +--- a/net/batman-adv/bridge_loop_avoidance.c ++++ b/net/batman-adv/bridge_loop_avoidance.c +@@ -1964,10 +1964,22 @@ bool batadv_bla_tx(struct batadv_priv *b + /* if yes, the client has roamed and we have + * to unclaim it. + */ +- batadv_handle_unclaim(bat_priv, primary_if, +- primary_if->net_dev->dev_addr, +- ethhdr->h_source, vid); +- goto allow; ++ if (batadv_has_timed_out(claim->lasttime, 100)) { ++ /* only unclaim if the last claim entry is ++ * older than 100 ms to make sure we really ++ * have a roaming client here. ++ */ ++ batadv_dbg(BATADV_DBG_BLA, bat_priv, "bla_tx(): Roaming client %pM detected. Unclaim it.\n", ++ ethhdr->h_source); ++ batadv_handle_unclaim(bat_priv, primary_if, ++ primary_if->net_dev->dev_addr, ++ ethhdr->h_source, vid); ++ goto allow; ++ } else { ++ batadv_dbg(BATADV_DBG_BLA, bat_priv, "bla_tx(): Race for claim %pM detected. Drop packet.\n", ++ ethhdr->h_source); ++ goto handled; ++ } + } + + /* check if it is a multicast/broadcast frame */ diff --git a/queue-4.9/blk-throttle-make-sure-expire-time-isn-t-too-big.patch b/queue-4.9/blk-throttle-make-sure-expire-time-isn-t-too-big.patch new file mode 100644 index 00000000000..7a09d96d458 --- /dev/null +++ b/queue-4.9/blk-throttle-make-sure-expire-time-isn-t-too-big.patch @@ -0,0 +1,50 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Shaohua Li +Date: Mon, 27 Mar 2017 10:51:36 -0700 +Subject: blk-throttle: make sure expire time isn't too big + +From: Shaohua Li + + +[ Upstream commit 06cceedcca67a93ac7f7aa93bbd9980c7496d14e ] + +cgroup could be throttled to a limit but when all cgroups cross high +limit, queue enters a higher state and so the group should be throttled +to a higher limit. It's possible the cgroup is sleeping because of +throttle and other cgroups don't dispatch IO any more. In this case, +nobody can trigger current downgrade/upgrade logic. To fix this issue, +we could either set up a timer to wakeup the cgroup if other cgroups are +idle or make sure this cgroup doesn't sleep too long. Setting up a timer +means we must change the timer very frequently. This patch chooses the +latter. Making cgroup sleep time not too big wouldn't change cgroup +bps/iops, but could make it wakeup more frequently, which isn't a big +issue because throtl_slice * 8 is already quite big. + +Signed-off-by: Shaohua Li +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-throttle.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/block/blk-throttle.c ++++ b/block/blk-throttle.c +@@ -499,6 +499,17 @@ static void throtl_dequeue_tg(struct thr + static void throtl_schedule_pending_timer(struct throtl_service_queue *sq, + unsigned long expires) + { ++ unsigned long max_expire = jiffies + 8 * throtl_slice; ++ ++ /* ++ * Since we are adjusting the throttle limit dynamically, the sleep ++ * time calculated according to previous limit might be invalid. It's ++ * possible the cgroup sleep time is very long and no other cgroups ++ * have IO running so notify the limit changes. Make sure the cgroup ++ * doesn't sleep too long to avoid the missed notification. ++ */ ++ if (time_after(expires, max_expire)) ++ expires = max_expire; + mod_timer(&sq->pending_timer, expires); + throtl_log(sq, "schedule timer. delay=%lu jiffies=%lu", + expires - jiffies, jiffies); diff --git a/queue-4.9/bluetooth-6lowpan-fix-delay-work-init-in-add_peer_chan.patch b/queue-4.9/bluetooth-6lowpan-fix-delay-work-init-in-add_peer_chan.patch new file mode 100644 index 00000000000..d2dd9d01b21 --- /dev/null +++ b/queue-4.9/bluetooth-6lowpan-fix-delay-work-init-in-add_peer_chan.patch @@ -0,0 +1,84 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Michael Scott +Date: Tue, 28 Mar 2017 23:10:54 -0700 +Subject: Bluetooth: 6lowpan: fix delay work init in add_peer_chan() + +From: Michael Scott + + +[ Upstream commit d2891c4d071d807f01cc911dc42a68f4568d65cf ] + +When adding 6lowpan devices very rapidly we sometimes see a crash: +[23122.306615] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.9.0-43-arm64 #1 Debian 4.9.9.linaro.43-1 +[23122.315400] Hardware name: HiKey Development Board (DT) +[23122.320623] task: ffff800075443080 task.stack: ffff800075484000 +[23122.326551] PC is at expire_timers+0x70/0x150 +[23122.330907] LR is at run_timer_softirq+0xa0/0x1a0 +[23122.335616] pc : [] lr : [] pstate: 600001c5 + +This was due to add_peer_chan() unconditionally initializing the +lowpan_btle_dev->notify_peers delayed work structure, even if the +lowpan_btle_dev passed into add_peer_chan() had previously been +initialized. + +Normally, this would go unnoticed as the delayed work timer is set for +100 msec, however when calling add_peer_chan() faster than 100 msec it +clears out a previously queued delay work causing the crash above. + +To fix this, let add_peer_chan() know when a new lowpan_btle_dev is passed +in so that it only performs the delay work initialization when needed. + +Signed-off-by: Michael Scott +Acked-by: Jukka Rissanen +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/6lowpan.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/net/bluetooth/6lowpan.c ++++ b/net/bluetooth/6lowpan.c +@@ -755,7 +755,8 @@ static void set_ip_addr_bits(u8 addr_typ + } + + static struct l2cap_chan *add_peer_chan(struct l2cap_chan *chan, +- struct lowpan_btle_dev *dev) ++ struct lowpan_btle_dev *dev, ++ bool new_netdev) + { + struct lowpan_peer *peer; + +@@ -786,7 +787,8 @@ static struct l2cap_chan *add_peer_chan( + spin_unlock(&devices_lock); + + /* Notifying peers about us needs to be done without locks held */ +- INIT_DELAYED_WORK(&dev->notify_peers, do_notify_peers); ++ if (new_netdev) ++ INIT_DELAYED_WORK(&dev->notify_peers, do_notify_peers); + schedule_delayed_work(&dev->notify_peers, msecs_to_jiffies(100)); + + return peer->chan; +@@ -843,6 +845,7 @@ out: + static inline void chan_ready_cb(struct l2cap_chan *chan) + { + struct lowpan_btle_dev *dev; ++ bool new_netdev = false; + + dev = lookup_dev(chan->conn); + +@@ -853,12 +856,13 @@ static inline void chan_ready_cb(struct + l2cap_chan_del(chan, -ENOENT); + return; + } ++ new_netdev = true; + } + + if (!try_module_get(THIS_MODULE)) + return; + +- add_peer_chan(chan, dev); ++ add_peer_chan(chan, dev, new_netdev); + ifup(dev->netdev); + } + diff --git a/queue-4.9/bluetooth-avoid-bt_accept_unlink-double-unlinking.patch b/queue-4.9/bluetooth-avoid-bt_accept_unlink-double-unlinking.patch new file mode 100644 index 00000000000..fc73a7040b5 --- /dev/null +++ b/queue-4.9/bluetooth-avoid-bt_accept_unlink-double-unlinking.patch @@ -0,0 +1,99 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Dean Jenkins +Date: Fri, 10 Mar 2017 11:34:46 +0000 +Subject: Bluetooth: Avoid bt_accept_unlink() double unlinking + +From: Dean Jenkins + + +[ Upstream commit 27bfbc21a0c0f711fa5382de026c7c0700c9ea28 ] + +There is a race condition between a thread calling bt_accept_dequeue() +and a different thread calling bt_accept_unlink(). Protection against +concurrency is implemented using sk locking. However, sk locking causes +serialisation of the bt_accept_dequeue() and bt_accept_unlink() threads. +This serialisation can cause bt_accept_dequeue() to obtain the sk from the +parent list but becomes blocked waiting for the sk lock held by the +bt_accept_unlink() thread. bt_accept_unlink() unlinks sk and this thread +releases the sk lock unblocking bt_accept_dequeue() which potentially runs +bt_accept_unlink() again on the same sk causing a crash. The attempt to +double unlink the same sk from the parent list can cause a NULL pointer +dereference crash due to bt_sk(sk)->parent becoming NULL on the first +unlink, followed by the second unlink trying to execute +bt_sk(sk)->parent->sk_ack_backlog-- in bt_accept_unlink() which crashes. + +When sk is in the parent list, bt_sk(sk)->parent will be not be NULL. +When sk is removed from the parent list, bt_sk(sk)->parent is set to +NULL. Therefore, add a defensive check for bt_sk(sk)->parent not being +NULL to ensure that sk is still in the parent list after the sk lock has +been taken in bt_accept_dequeue(). If bt_sk(sk)->parent is detected as +being NULL then restart the loop so that the loop variables are refreshed +to use the latest values. This is necessary as list_for_each_entry_safe() +is not thread safe so causing a risk of an infinite loop occurring as sk +could point to itself. + +In addition, in bt_accept_dequeue() increase the sk reference count to +protect against early freeing of sk. Early freeing can be possible if the +bt_accept_unlink() thread calls l2cap_sock_kill() or rfcomm_sock_kill() +functions before bt_accept_dequeue() gets the sk lock. + +For test purposes, the probability of failure can be increased by putting +a msleep of 1 second in bt_accept_dequeue() between getting the sk and +waiting for the sk lock. This exposes the fact that the loop +list_for_each_entry_safe(p, n, &bt_sk(parent)->accept_q) is not safe from +threads that unlink sk from the list in parallel with the loop which can +cause sk to become stale within the loop. + +Signed-off-by: Dean Jenkins +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/af_bluetooth.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +--- a/net/bluetooth/af_bluetooth.c ++++ b/net/bluetooth/af_bluetooth.c +@@ -163,6 +163,9 @@ void bt_accept_enqueue(struct sock *pare + } + EXPORT_SYMBOL(bt_accept_enqueue); + ++/* Calling function must hold the sk lock. ++ * bt_sk(sk)->parent must be non-NULL meaning sk is in the parent list. ++ */ + void bt_accept_unlink(struct sock *sk) + { + BT_DBG("sk %p state %d", sk, sk->sk_state); +@@ -181,11 +184,32 @@ struct sock *bt_accept_dequeue(struct so + + BT_DBG("parent %p", parent); + ++restart: + list_for_each_entry_safe(s, n, &bt_sk(parent)->accept_q, accept_q) { + sk = (struct sock *)s; + ++ /* Prevent early freeing of sk due to unlink and sock_kill */ ++ sock_hold(sk); + lock_sock(sk); + ++ /* Check sk has not already been unlinked via ++ * bt_accept_unlink() due to serialisation caused by sk locking ++ */ ++ if (!bt_sk(sk)->parent) { ++ BT_DBG("sk %p, already unlinked", sk); ++ release_sock(sk); ++ sock_put(sk); ++ ++ /* Restart the loop as sk is no longer in the list ++ * and also avoid a potential infinite loop because ++ * list_for_each_entry_safe() is not thread safe. ++ */ ++ goto restart; ++ } ++ ++ /* sk is safely in the parent list so reduce reference count */ ++ sock_put(sk); ++ + /* FIXME: Is this check still needed */ + if (sk->sk_state == BT_CLOSED) { + bt_accept_unlink(sk); diff --git a/queue-4.9/bnxt_en-don-t-print-link-speed-1-no-longer-supported-messages.patch b/queue-4.9/bnxt_en-don-t-print-link-speed-1-no-longer-supported-messages.patch new file mode 100644 index 00000000000..41c3263041a --- /dev/null +++ b/queue-4.9/bnxt_en-don-t-print-link-speed-1-no-longer-supported-messages.patch @@ -0,0 +1,51 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Michael Chan +Date: Wed, 6 Dec 2017 17:31:22 -0500 +Subject: bnxt_en: Don't print "Link speed -1 no longer supported" messages. + +From: Michael Chan + + +[ Upstream commit a8168b6cee6e9334dfebb4b9108e8d73794f6088 ] + +On some dual port NICs, the 2 ports have to be configured with compatible +link speeds. Under some conditions, a port's configured speed may no +longer be supported. The firmware will send a message to the driver +when this happens. + +Improve this logic that prints out the warning by only printing it if +we can determine the link speed that is no longer supported. If the +speed is unknown or it is in autoneg mode, skip the warning message. + +Reported-by: Thomas Bogendoerfer +Signed-off-by: Michael Chan +Tested-by: Thomas Bogendoerfer +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -1498,12 +1498,16 @@ static int bnxt_async_event_process(stru + + if (BNXT_VF(bp)) + goto async_event_process_exit; +- if (data1 & 0x20000) { ++ ++ /* print unsupported speed warning in forced speed mode only */ ++ if (!(link_info->autoneg & BNXT_AUTONEG_SPEED) && ++ (data1 & 0x20000)) { + u16 fw_speed = link_info->force_link_speed; + u32 speed = bnxt_fw_to_ethtool_speed(fw_speed); + +- netdev_warn(bp->dev, "Link speed %d no longer supported\n", +- speed); ++ if (speed != SPEED_UNKNOWN) ++ netdev_warn(bp->dev, "Link speed %d no longer supported\n", ++ speed); + } + set_bit(BNXT_LINK_SPEED_CHNG_SP_EVENT, &bp->sp_event); + /* fall thru */ diff --git a/queue-4.9/bonding-make-speed-duplex-setting-consistent-with-link-state.patch b/queue-4.9/bonding-make-speed-duplex-setting-consistent-with-link-state.patch new file mode 100644 index 00000000000..5c7f6b46f1b --- /dev/null +++ b/queue-4.9/bonding-make-speed-duplex-setting-consistent-with-link-state.patch @@ -0,0 +1,79 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Mahesh Bandewar +Date: Mon, 27 Mar 2017 11:37:35 -0700 +Subject: bonding: make speed, duplex setting consistent with link state + +From: Mahesh Bandewar + + +[ Upstream commit c4adfc822bf5d8e97660b6114b5a8892530ce8cb ] + +bond_update_speed_duplex() retrieves speed and duplex settings. There +is a possibility of failure in retrieving these values but caller has +to assume it's always successful. This leads to having inconsistent +slave link settings. If these (speed, duplex) values cannot be +retrieved, then keeping the link UP causes problems. + +The updated bond_update_speed_duplex() returns 0 on success if it +retrieves sane values for speed and duplex. On failure it returns 1 +and marks the link down. + +Signed-off-by: Mahesh Bandewar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_main.c | 24 ++++++++++++++---------- + 1 file changed, 14 insertions(+), 10 deletions(-) + +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -371,9 +371,10 @@ down: + /* Get link speed and duplex from the slave's base driver + * using ethtool. If for some reason the call fails or the + * values are invalid, set speed and duplex to -1, +- * and return. ++ * and return. Return 1 if speed or duplex settings are ++ * UNKNOWN; 0 otherwise. + */ +-static void bond_update_speed_duplex(struct slave *slave) ++static int bond_update_speed_duplex(struct slave *slave) + { + struct net_device *slave_dev = slave->dev; + struct ethtool_link_ksettings ecmd; +@@ -383,24 +384,27 @@ static void bond_update_speed_duplex(str + slave->duplex = DUPLEX_UNKNOWN; + + res = __ethtool_get_link_ksettings(slave_dev, &ecmd); +- if (res < 0) +- return; +- +- if (ecmd.base.speed == 0 || ecmd.base.speed == ((__u32)-1)) +- return; +- ++ if (res < 0) { ++ slave->link = BOND_LINK_DOWN; ++ return 1; ++ } ++ if (ecmd.base.speed == 0 || ecmd.base.speed == ((__u32)-1)) { ++ slave->link = BOND_LINK_DOWN; ++ return 1; ++ } + switch (ecmd.base.duplex) { + case DUPLEX_FULL: + case DUPLEX_HALF: + break; + default: +- return; ++ slave->link = BOND_LINK_DOWN; ++ return 1; + } + + slave->speed = ecmd.base.speed; + slave->duplex = ecmd.base.duplex; + +- return; ++ return 0; + } + + const char *bond_slave_link_status(s8 link) diff --git a/queue-4.9/bonding-refine-bond_fold_stats-wrap-detection.patch b/queue-4.9/bonding-refine-bond_fold_stats-wrap-detection.patch new file mode 100644 index 00000000000..f2ff99acb49 --- /dev/null +++ b/queue-4.9/bonding-refine-bond_fold_stats-wrap-detection.patch @@ -0,0 +1,55 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Eric Dumazet +Date: Wed, 29 Mar 2017 10:45:44 -0700 +Subject: bonding: refine bond_fold_stats() wrap detection + +From: Eric Dumazet + + +[ Upstream commit 142c6594acbcc32391af9c15f8cd65c6c177698f ] + +Some device drivers reset their stats at down/up events, possibly +fooling bonding stats, since they operate with relative deltas. + +It is nearly not possible to fix drivers, since some of them compute the +tx/rx counters based on per rx/tx queue stats, and the queues can be +reconfigured (ethtool -L) between the down/up sequence. + +Lets avoid accumulating 'negative' values that render bonding stats +useless. + +It is better to lose small deltas, assuming the bonding stats are +fetched at a reasonable frequency. + +Fixes: 5f0c5f73e5ef ("bonding: make global bonding stats more reliable") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_main.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3331,12 +3331,17 @@ static void bond_fold_stats(struct rtnl_ + for (i = 0; i < sizeof(*_res) / sizeof(u64); i++) { + u64 nv = new[i]; + u64 ov = old[i]; ++ s64 delta = nv - ov; + + /* detects if this particular field is 32bit only */ + if (((nv | ov) >> 32) == 0) +- res[i] += (u32)nv - (u32)ov; +- else +- res[i] += nv - ov; ++ delta = (s64)(s32)((u32)nv - (u32)ov); ++ ++ /* filter anomalies, some drivers reset their stats ++ * at down/up events. ++ */ ++ if (delta > 0) ++ res[i] += delta; + } + } + diff --git a/queue-4.9/braille-console-fix-value-returned-by-_braille_console_setup.patch b/queue-4.9/braille-console-fix-value-returned-by-_braille_console_setup.patch new file mode 100644 index 00000000000..415b6450e78 --- /dev/null +++ b/queue-4.9/braille-console-fix-value-returned-by-_braille_console_setup.patch @@ -0,0 +1,104 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Samuel Thibault +Date: Sun, 26 Mar 2017 22:47:36 +0200 +Subject: braille-console: Fix value returned by _braille_console_setup + +From: Samuel Thibault + + +[ Upstream commit 2ed2b8621be2708c0f6d61fe9841e9ad8b9753f0 ] + +commit bbeddf52adc1 ("printk: move braille console support into +separate braille.[ch] files") introduced _braille_console_setup() +to outline the braille initialization code. There was however some +confusion over the value it was supposed to return. commit 2cfe6c4ac7ee +("printk: Fix return of braille_register_console()") tried to fix it +but failed to. + +This fixes and documents the returned value according to the use +in printk.c: non-zero return means a parsing error, and thus this +console configuration should be ignored. + +Signed-off-by: Samuel Thibault +Cc: Aleksey Makarov +Cc: Joe Perches +Cc: Ming Lei +Cc: Steven Rostedt +Acked-by: Petr Mladek +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/printk/braille.c | 15 ++++++++------- + kernel/printk/braille.h | 13 ++++++++++--- + 2 files changed, 18 insertions(+), 10 deletions(-) + +--- a/kernel/printk/braille.c ++++ b/kernel/printk/braille.c +@@ -2,12 +2,13 @@ + + #include + #include ++#include + #include + + #include "console_cmdline.h" + #include "braille.h" + +-char *_braille_console_setup(char **str, char **brl_options) ++int _braille_console_setup(char **str, char **brl_options) + { + if (!strncmp(*str, "brl,", 4)) { + *brl_options = ""; +@@ -15,14 +16,14 @@ char *_braille_console_setup(char **str, + } else if (!strncmp(*str, "brl=", 4)) { + *brl_options = *str + 4; + *str = strchr(*brl_options, ','); +- if (!*str) ++ if (!*str) { + pr_err("need port name after brl=\n"); +- else +- *((*str)++) = 0; +- } else +- return NULL; ++ return -EINVAL; ++ } ++ *((*str)++) = 0; ++ } + +- return *str; ++ return 0; + } + + int +--- a/kernel/printk/braille.h ++++ b/kernel/printk/braille.h +@@ -9,7 +9,14 @@ braille_set_options(struct console_cmdli + c->brl_options = brl_options; + } + +-char * ++/* ++ * Setup console according to braille options. ++ * Return -EINVAL on syntax error, 0 on success (or no braille option was ++ * actually given). ++ * Modifies str to point to the serial options ++ * Sets brl_options to the parsed braille options. ++ */ ++int + _braille_console_setup(char **str, char **brl_options); + + int +@@ -25,10 +32,10 @@ braille_set_options(struct console_cmdli + { + } + +-static inline char * ++static inline int + _braille_console_setup(char **str, char **brl_options) + { +- return NULL; ++ return 0; + } + + static inline int diff --git a/queue-4.9/clk-meson-gxbb-fix-wrong-clock-for-saradc-sana.patch b/queue-4.9/clk-meson-gxbb-fix-wrong-clock-for-saradc-sana.patch new file mode 100644 index 00000000000..a0c37d4d260 --- /dev/null +++ b/queue-4.9/clk-meson-gxbb-fix-wrong-clock-for-saradc-sana.patch @@ -0,0 +1,50 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Yixun Lan +Date: Tue, 7 Nov 2017 22:12:23 +0800 +Subject: clk: meson: gxbb: fix wrong clock for SARADC/SANA + +From: Yixun Lan + + +[ Upstream commit 75eccf5ed83250c0aeaeeb76f7288254ac0a87b4 ] + +According to the datasheet, in Meson-GXBB/GXL series, +The clock gate bit for SARADC is HHI_GCLK_MPEG2 bit[22], +while clock gate bit for SANA is HHI_GCLK_MPEG0 bit[10]. + +Test passed at gxl-s905x-p212 board. + +The following published datasheets are wrong and should be updated +[1] GXBB v1.1.4 +[2] GXL v0.3_20170314 + +Fixes: 738f66d3211d ("clk: gxbb: add AmLogic GXBB clk controller driver") +Tested-by: Xingyu Chen +Signed-off-by: Yixun Lan +Signed-off-by: Jerome Brunet +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/meson/gxbb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/clk/meson/gxbb.c ++++ b/drivers/clk/meson/gxbb.c +@@ -572,7 +572,7 @@ static MESON_GATE(gxbb_pl301, HHI_GCLK_M + static MESON_GATE(gxbb_periphs, HHI_GCLK_MPEG0, 7); + static MESON_GATE(gxbb_spicc, HHI_GCLK_MPEG0, 8); + static MESON_GATE(gxbb_i2c, HHI_GCLK_MPEG0, 9); +-static MESON_GATE(gxbb_sar_adc, HHI_GCLK_MPEG0, 10); ++static MESON_GATE(gxbb_sana, HHI_GCLK_MPEG0, 10); + static MESON_GATE(gxbb_smart_card, HHI_GCLK_MPEG0, 11); + static MESON_GATE(gxbb_rng0, HHI_GCLK_MPEG0, 12); + static MESON_GATE(gxbb_uart0, HHI_GCLK_MPEG0, 13); +@@ -623,7 +623,7 @@ static MESON_GATE(gxbb_usb0_ddr_bridge, + static MESON_GATE(gxbb_mmc_pclk, HHI_GCLK_MPEG2, 11); + static MESON_GATE(gxbb_dvin, HHI_GCLK_MPEG2, 12); + static MESON_GATE(gxbb_uart2, HHI_GCLK_MPEG2, 15); +-static MESON_GATE(gxbb_sana, HHI_GCLK_MPEG2, 22); ++static MESON_GATE(gxbb_sar_adc, HHI_GCLK_MPEG2, 22); + static MESON_GATE(gxbb_vpu_intr, HHI_GCLK_MPEG2, 25); + static MESON_GATE(gxbb_sec_ahb_ahb3_bridge, HHI_GCLK_MPEG2, 26); + static MESON_GATE(gxbb_clk81_a53, HHI_GCLK_MPEG2, 29); diff --git a/queue-4.9/clk-qcom-msm8916-fix-mnd_width-for-codec_digcodec.patch b/queue-4.9/clk-qcom-msm8916-fix-mnd_width-for-codec_digcodec.patch new file mode 100644 index 00000000000..418866eef71 --- /dev/null +++ b/queue-4.9/clk-qcom-msm8916-fix-mnd_width-for-codec_digcodec.patch @@ -0,0 +1,32 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Srinivas Kandagatla +Date: Wed, 6 Dec 2017 12:11:38 +0000 +Subject: clk: qcom: msm8916: fix mnd_width for codec_digcodec + +From: Srinivas Kandagatla + + +[ Upstream commit d8e488e8242ecf129eebc440c92d800a99ca109d ] + +This patch fixes missing mnd_width for codec_digital clk, this is now set to +8 inline with datasheet. + +Fixes: 3966fab8b6ab ("clk: qcom: Add MSM8916 Global Clock Controller support") +Signed-off-by: Srinivas Kandagatla +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/qcom/gcc-msm8916.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/clk/qcom/gcc-msm8916.c ++++ b/drivers/clk/qcom/gcc-msm8916.c +@@ -1437,6 +1437,7 @@ static const struct freq_tbl ftbl_codec_ + + static struct clk_rcg2 codec_digcodec_clk_src = { + .cmd_rcgr = 0x1c09c, ++ .mnd_width = 8, + .hid_width = 5, + .parent_map = gcc_xo_gpll1_emclk_sleep_map, + .freq_tbl = ftbl_codec_clk, diff --git a/queue-4.9/clk-qcom-msm8996-fix-the-vfe1-powerdomain-name.patch b/queue-4.9/clk-qcom-msm8996-fix-the-vfe1-powerdomain-name.patch new file mode 100644 index 00000000000..2265eb4657f --- /dev/null +++ b/queue-4.9/clk-qcom-msm8996-fix-the-vfe1-powerdomain-name.patch @@ -0,0 +1,34 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Rajendra Nayak +Date: Thu, 23 Mar 2017 13:13:40 +0530 +Subject: clk: qcom: msm8996: Fix the vfe1 powerdomain name + +From: Rajendra Nayak + + +[ Upstream commit a62ca337b36e31621b582cbe8f17d9404a48e120 ] + +Fix a typo which caused both vfe0 and vfe1 powerdomains to be +named as vfe0. + +Signed-off-by: Rajendra Nayak +Fixes: 7e824d507909 ("clk: qcom: gdsc: Add mmcc gdscs for msm8996 family") +Signed-off-by: Stephen Boyd +Signed-off-by: Michael Turquette +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/qcom/mmcc-msm8996.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/qcom/mmcc-msm8996.c ++++ b/drivers/clk/qcom/mmcc-msm8996.c +@@ -2984,7 +2984,7 @@ static struct gdsc vfe1_gdsc = { + .cxcs = (unsigned int []){ 0x36ac }, + .cxc_count = 1, + .pd = { +- .name = "vfe0", ++ .name = "vfe1", + }, + .parent = &camss_gdsc.pd, + .pwrsts = PWRSTS_OFF_ON, diff --git a/queue-4.9/clk-sunxi-ng-a33-add-offset-and-minimum-value-for-ddr1-pll-n-factor.patch b/queue-4.9/clk-sunxi-ng-a33-add-offset-and-minimum-value-for-ddr1-pll-n-factor.patch new file mode 100644 index 00000000000..3303e7e0865 --- /dev/null +++ b/queue-4.9/clk-sunxi-ng-a33-add-offset-and-minimum-value-for-ddr1-pll-n-factor.patch @@ -0,0 +1,53 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Chen-Yu Tsai +Date: Wed, 5 Apr 2017 14:37:44 +0800 +Subject: clk: sunxi-ng: a33: Add offset and minimum value for DDR1 PLL N factor + +From: Chen-Yu Tsai + + +[ Upstream commit 68f37d862403e8f95337b2eca90af15d0b8cd5d7 ] + +The DDR1 PLL on the A33 is an oddball amongst the A33 CCU clocks. +It is a clock multiplier, with the effective multiplier in the +range of 12 ~ 255 and no offset between the multiplier value and +the value programmed into the register. + +Implement the zero offset and minimum value of 12 for this clock. + +Fixes: d05c748bd730 ("clk: sunxi-ng: Add A33 CCU support") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/sunxi-ng/ccu-sun8i-a33.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +--- a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c ++++ b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c +@@ -159,13 +159,17 @@ static SUNXI_CCU_NM_WITH_FRAC_GATE_LOCK( + BIT(28), /* lock */ + CLK_SET_RATE_UNGATE); + +-/* TODO: Fix N */ +-static SUNXI_CCU_N_WITH_GATE_LOCK(pll_ddr1_clk, "pll-ddr1", +- "osc24M", 0x04c, +- 8, 6, /* N */ +- BIT(31), /* gate */ +- BIT(28), /* lock */ +- CLK_SET_RATE_UNGATE); ++static struct ccu_mult pll_ddr1_clk = { ++ .enable = BIT(31), ++ .lock = BIT(28), ++ .mult = _SUNXI_CCU_MULT_OFFSET_MIN_MAX(8, 6, 0, 12, 0), ++ .common = { ++ .reg = 0x04c, ++ .hw.init = CLK_HW_INIT("pll-ddr1", "osc24M", ++ &ccu_mult_ops, ++ CLK_SET_RATE_UNGATE), ++ }, ++}; + + static const char * const cpux_parents[] = { "osc32k", "osc24M", + "pll-cpux" , "pll-cpux" }; diff --git a/queue-4.9/coresight-fixes-coresight-dt-parse-to-get-correct-output-port-id.patch b/queue-4.9/coresight-fixes-coresight-dt-parse-to-get-correct-output-port-id.patch new file mode 100644 index 00000000000..565bf1e1b5c --- /dev/null +++ b/queue-4.9/coresight-fixes-coresight-dt-parse-to-get-correct-output-port-id.patch @@ -0,0 +1,45 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Mike Leach +Date: Mon, 27 Mar 2017 11:09:33 -0600 +Subject: coresight: Fixes coresight DT parse to get correct output port ID. + +From: Mike Leach + + +[ Upstream commit eeedc5421dd3b51de73e6106405c5c77f920f281 ] + +Corrected to get the port numbering to allow programmable replicator driver +to operate correctly. + +By convention, CoreSight devices number ports, not endpoints in +the .dts files:- + +port { + reg + endpoint { + } +} + +Existing code read endpoint number - always 0x0, rather than the correct +port number. + +Signed-off-by: Mike Leach +Signed-off-by: Mathieu Poirier +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwtracing/coresight/of_coresight.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwtracing/coresight/of_coresight.c ++++ b/drivers/hwtracing/coresight/of_coresight.c +@@ -149,7 +149,7 @@ struct coresight_platform_data *of_get_c + continue; + + /* The local out port number */ +- pdata->outports[i] = endpoint.id; ++ pdata->outports[i] = endpoint.port; + + /* + * Get a handle on the remote port and parent diff --git a/queue-4.9/dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch b/queue-4.9/dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch new file mode 100644 index 00000000000..0b5c983fc9f --- /dev/null +++ b/queue-4.9/dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch @@ -0,0 +1,58 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Peter Ujfalusi +Date: Tue, 14 Nov 2017 16:32:07 +0200 +Subject: dmaengine: bcm2835-dma: Use vchan_terminate_vdesc() instead of desc_free + +From: Peter Ujfalusi + + +[ Upstream commit de92436ac40ffe9933230aa503e24dbb5ede9201 ] + +To avoid race with vchan_complete, use the race free way to terminate +running transfer. + +Implement the device_synchronize callback to make sure that the terminated +descriptor is freed. + +Signed-off-by: Peter Ujfalusi +Acked-by: Eric Anholt +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/bcm2835-dma.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/dma/bcm2835-dma.c ++++ b/drivers/dma/bcm2835-dma.c +@@ -812,7 +812,7 @@ static int bcm2835_dma_terminate_all(str + * c->desc is NULL and exit.) + */ + if (c->desc) { +- bcm2835_dma_desc_free(&c->desc->vd); ++ vchan_terminate_vdesc(&c->desc->vd); + c->desc = NULL; + bcm2835_dma_abort(c->chan_base); + +@@ -836,6 +836,13 @@ static int bcm2835_dma_terminate_all(str + return 0; + } + ++static void bcm2835_dma_synchronize(struct dma_chan *chan) ++{ ++ struct bcm2835_chan *c = to_bcm2835_dma_chan(chan); ++ ++ vchan_synchronize(&c->vc); ++} ++ + static int bcm2835_dma_chan_init(struct bcm2835_dmadev *d, int chan_id, + int irq, unsigned int irq_flags) + { +@@ -942,6 +949,7 @@ static int bcm2835_dma_probe(struct plat + od->ddev.device_prep_dma_memcpy = bcm2835_dma_prep_dma_memcpy; + od->ddev.device_config = bcm2835_dma_slave_config; + od->ddev.device_terminate_all = bcm2835_dma_terminate_all; ++ od->ddev.device_synchronize = bcm2835_dma_synchronize; + od->ddev.src_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES); + od->ddev.dst_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES); + od->ddev.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV) | diff --git a/queue-4.9/dmaengine-imx-sdma-add-1ms-delay-to-ensure-sdma-channel-is-stopped.patch b/queue-4.9/dmaengine-imx-sdma-add-1ms-delay-to-ensure-sdma-channel-is-stopped.patch new file mode 100644 index 00000000000..a07d7726483 --- /dev/null +++ b/queue-4.9/dmaengine-imx-sdma-add-1ms-delay-to-ensure-sdma-channel-is-stopped.patch @@ -0,0 +1,66 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Jiada Wang +Date: Thu, 16 Mar 2017 23:12:09 -0700 +Subject: dmaengine: imx-sdma: add 1ms delay to ensure SDMA channel is stopped + +From: Jiada Wang + + +[ Upstream commit 7f3ff14b7eb1ffad132117f08a1973b48e653d43 ] + +sdma_disable_channel() cannot ensure dma is stopped to access +module's FIFOs. There is chance SDMA core is running and accessing +BD when disable of corresponding channel, this may cause sometimes +even after call of .sdma_disable_channel(), SDMA core still be +running and accessing module's FIFOs. + +According to NXP R&D team a delay of one BD SDMA cost time (maximum +is 1ms) should be added after disable of the channel bit, to ensure +SDMA core has really been stopped after SDMA clients call +.device_terminate_all. + +This patch introduces adds a new function sdma_disable_channel_with_delay() +which simply adds 1ms delay after call sdma_disable_channel(), +and set it as .device_terminate_all. + +Signed-off-by: Jiada Wang +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/imx-sdma.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +--- a/drivers/dma/imx-sdma.c ++++ b/drivers/dma/imx-sdma.c +@@ -937,6 +937,21 @@ static int sdma_disable_channel(struct d + return 0; + } + ++static int sdma_disable_channel_with_delay(struct dma_chan *chan) ++{ ++ sdma_disable_channel(chan); ++ ++ /* ++ * According to NXP R&D team a delay of one BD SDMA cost time ++ * (maximum is 1ms) should be added after disable of the channel ++ * bit, to ensure SDMA core has really been stopped after SDMA ++ * clients call .device_terminate_all. ++ */ ++ mdelay(1); ++ ++ return 0; ++} ++ + static void sdma_set_watermarklevel_for_p2p(struct sdma_channel *sdmac) + { + struct sdma_engine *sdma = sdmac->sdma; +@@ -1828,7 +1843,7 @@ static int sdma_probe(struct platform_de + sdma->dma_device.device_prep_slave_sg = sdma_prep_slave_sg; + sdma->dma_device.device_prep_dma_cyclic = sdma_prep_dma_cyclic; + sdma->dma_device.device_config = sdma_config; +- sdma->dma_device.device_terminate_all = sdma_disable_channel; ++ sdma->dma_device.device_terminate_all = sdma_disable_channel_with_delay; + sdma->dma_device.src_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES); + sdma->dma_device.dst_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES); + sdma->dma_device.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV); diff --git a/queue-4.9/driver-adm1275-set-the-m-b-and-r-coefficients-correctly-for-power.patch b/queue-4.9/driver-adm1275-set-the-m-b-and-r-coefficients-correctly-for-power.patch new file mode 100644 index 00000000000..49844c37e50 --- /dev/null +++ b/queue-4.9/driver-adm1275-set-the-m-b-and-r-coefficients-correctly-for-power.patch @@ -0,0 +1,39 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Shikhar Dogra +Date: Mon, 27 Mar 2017 16:16:44 -0700 +Subject: driver: (adm1275) set the m,b and R coefficients correctly for power + +From: Shikhar Dogra + + +[ Upstream commit 6faecba0b3da7b617bf72bef422bf0d3bb6dfe7d ] + +Seems like coefficient values for m, b and R under power have been +put in the wrong order. Rearranging them properly to get correct +values of coefficients for power. + +For specs, please refer to table 7 (page 35) on +http://www.analog.com/media/en/technical-documentation/data-sheets/ADM1075.pdf + +Fixes: 904b296f308d ("hwmon: (adm1275) Introduce configuration data structure for coeffcients") +Signed-off-by: Shikhar Dogra +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/pmbus/adm1275.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/hwmon/pmbus/adm1275.c ++++ b/drivers/hwmon/pmbus/adm1275.c +@@ -101,8 +101,8 @@ static const struct coefficients adm1075 + [0] = { 27169, 0, -1 }, /* voltage */ + [1] = { 806, 20475, -1 }, /* current, irange25 */ + [2] = { 404, 20475, -1 }, /* current, irange50 */ +- [3] = { 0, -1, 8549 }, /* power, irange25 */ +- [4] = { 0, -1, 4279 }, /* power, irange50 */ ++ [3] = { 8549, 0, -1 }, /* power, irange25 */ ++ [4] = { 4279, 0, -1 }, /* power, irange50 */ + }; + + static const struct coefficients adm1275_coefficients[] = { diff --git a/queue-4.9/drivers-net-phy-xgene-fix-mdio-write.patch b/queue-4.9/drivers-net-phy-xgene-fix-mdio-write.patch new file mode 100644 index 00000000000..c83c6d4d40d --- /dev/null +++ b/queue-4.9/drivers-net-phy-xgene-fix-mdio-write.patch @@ -0,0 +1,32 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Quan Nguyen +Date: Wed, 15 Mar 2017 13:27:15 -0700 +Subject: drivers: net: phy: xgene: Fix mdio write + +From: Quan Nguyen + + +[ Upstream commit 4b72436dc3dd2457056b22d6f147777368c869fa ] + +This patches fixes a typo in the argument to xgene_enet_wr_mdio_csr(). + +Signed-off-by: Quan Nguyen +Signed-off-by: Iyappan Subramanian +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/mdio-xgene.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/phy/mdio-xgene.c ++++ b/drivers/net/phy/mdio-xgene.c +@@ -232,7 +232,7 @@ static int xgene_xfi_mdio_write(struct m + + val = SET_VAL(HSTPHYADX, phy_id) | SET_VAL(HSTREGADX, reg) | + SET_VAL(HSTMIIMWRDAT, data); +- xgene_enet_wr_mdio_csr(addr, MIIM_FIELD_ADDR, data); ++ xgene_enet_wr_mdio_csr(addr, MIIM_FIELD_ADDR, val); + + val = HSTLDCMD | SET_VAL(HSTMIIMCMD, MIIM_CMD_LEGACY_WRITE); + xgene_enet_wr_mdio_csr(addr, MIIM_COMMAND_ADDR, val); diff --git a/queue-4.9/drivers-net-xgene-fix-hardware-checksum-setting.patch b/queue-4.9/drivers-net-xgene-fix-hardware-checksum-setting.patch new file mode 100644 index 00000000000..371685d4d2d --- /dev/null +++ b/queue-4.9/drivers-net-xgene-fix-hardware-checksum-setting.patch @@ -0,0 +1,44 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Quan Nguyen +Date: Wed, 15 Mar 2017 13:27:16 -0700 +Subject: drivers: net: xgene: Fix hardware checksum setting + +From: Quan Nguyen + + +[ Upstream commit e026e700d940a1ea3d3bc84d92ac668b1f015462 ] + +This patch fixes the hardware checksum settings by properly program +the classifier. Otherwise, packet may be received with checksum error +on X-Gene1 SoC. + +Signed-off-by: Quan Nguyen +Signed-off-by: Iyappan Subramanian +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/apm/xgene/xgene_enet_hw.c | 1 + + drivers/net/ethernet/apm/xgene/xgene_enet_hw.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c ++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c +@@ -560,6 +560,7 @@ static void xgene_enet_cle_bypass(struct + xgene_enet_rd_csr(pdata, CLE_BYPASS_REG0_0_ADDR, &cb); + cb |= CFG_CLE_BYPASS_EN0; + CFG_CLE_IP_PROTOCOL0_SET(&cb, 3); ++ CFG_CLE_IP_HDR_LEN_SET(&cb, 0); + xgene_enet_wr_csr(pdata, CLE_BYPASS_REG0_0_ADDR, cb); + + xgene_enet_rd_csr(pdata, CLE_BYPASS_REG1_0_ADDR, &cb); +--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h ++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h +@@ -163,6 +163,7 @@ enum xgene_enet_rm { + #define CFG_RXCLK_MUXSEL0_SET(dst, val) xgene_set_bits(dst, val, 26, 3) + + #define CFG_CLE_IP_PROTOCOL0_SET(dst, val) xgene_set_bits(dst, val, 16, 2) ++#define CFG_CLE_IP_HDR_LEN_SET(dst, val) xgene_set_bits(dst, val, 8, 5) + #define CFG_CLE_DSTQID0_SET(dst, val) xgene_set_bits(dst, val, 0, 12) + #define CFG_CLE_FPSEL0_SET(dst, val) xgene_set_bits(dst, val, 16, 4) + #define CFG_MACMODE_SET(dst, val) xgene_set_bits(dst, val, 18, 2) diff --git a/queue-4.9/drivers-net-xgene-fix-rx-checksum-validation-logic.patch b/queue-4.9/drivers-net-xgene-fix-rx-checksum-validation-logic.patch new file mode 100644 index 00000000000..69673648fa1 --- /dev/null +++ b/queue-4.9/drivers-net-xgene-fix-rx-checksum-validation-logic.patch @@ -0,0 +1,74 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Iyappan Subramanian +Date: Wed, 15 Mar 2017 13:27:18 -0700 +Subject: drivers: net: xgene: Fix Rx checksum validation logic + +From: Iyappan Subramanian + + +[ Upstream commit 0a0400c3094b5d5cedd479ddbf1329de74c09c4b ] + +This patch fixes Rx checksum validation logic and +adds NETIF_F_RXCSUM flag. + +Signed-off-by: Iyappan Subramanian +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 27 ++++++++++++++--------- + 1 file changed, 17 insertions(+), 10 deletions(-) + +--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c ++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c +@@ -505,14 +505,24 @@ static netdev_tx_t xgene_enet_start_xmit + return NETDEV_TX_OK; + } + +-static void xgene_enet_skip_csum(struct sk_buff *skb) ++static void xgene_enet_rx_csum(struct sk_buff *skb) + { ++ struct net_device *ndev = skb->dev; + struct iphdr *iph = ip_hdr(skb); + +- if (!ip_is_fragment(iph) || +- (iph->protocol != IPPROTO_TCP && iph->protocol != IPPROTO_UDP)) { +- skb->ip_summed = CHECKSUM_UNNECESSARY; +- } ++ if (!(ndev->features & NETIF_F_RXCSUM)) ++ return; ++ ++ if (skb->protocol != htons(ETH_P_IP)) ++ return; ++ ++ if (ip_is_fragment(iph)) ++ return; ++ ++ if (iph->protocol != IPPROTO_TCP && iph->protocol != IPPROTO_UDP) ++ return; ++ ++ skb->ip_summed = CHECKSUM_UNNECESSARY; + } + + static int xgene_enet_rx_frame(struct xgene_enet_desc_ring *rx_ring, +@@ -555,10 +565,7 @@ static int xgene_enet_rx_frame(struct xg + + skb_checksum_none_assert(skb); + skb->protocol = eth_type_trans(skb, ndev); +- if (likely((ndev->features & NETIF_F_IP_CSUM) && +- skb->protocol == htons(ETH_P_IP))) { +- xgene_enet_skip_csum(skb); +- } ++ xgene_enet_rx_csum(skb); + + rx_ring->rx_packets++; + rx_ring->rx_bytes += datalen; +@@ -1725,7 +1732,7 @@ static int xgene_enet_probe(struct platf + xgene_enet_setup_ops(pdata); + + if (pdata->phy_mode == PHY_INTERFACE_MODE_XGMII) { +- ndev->features |= NETIF_F_TSO; ++ ndev->features |= NETIF_F_TSO | NETIF_F_RXCSUM; + spin_lock_init(&pdata->mss_lock); + } + ndev->hw_features = ndev->features; diff --git a/queue-4.9/drivers-net-xgene-fix-wrong-logical-operation.patch b/queue-4.9/drivers-net-xgene-fix-wrong-logical-operation.patch new file mode 100644 index 00000000000..848f9450141 --- /dev/null +++ b/queue-4.9/drivers-net-xgene-fix-wrong-logical-operation.patch @@ -0,0 +1,37 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Quan Nguyen +Date: Wed, 15 Mar 2017 13:27:17 -0700 +Subject: drivers: net: xgene: Fix wrong logical operation + +From: Quan Nguyen + + +[ Upstream commit 11623fce0f9afef30c45e3f2120b063de3809a8f ] + +This patch fixes the wrong logical OR operation by changing it to +bit-wise OR operation. + +Fixes: 3bb502f83080 ("drivers: net: xgene: fix statistics counters race condition") +Signed-off-by: Iyappan Subramanian +Signed-off-by: Quan Nguyen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c ++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c +@@ -537,9 +537,9 @@ static int xgene_enet_rx_frame(struct xg + buf_pool->rx_skb[skb_index] = NULL; + + /* checking for error */ +- status = (GET_VAL(ELERR, le64_to_cpu(raw_desc->m0)) << LERR_LEN) || ++ status = (GET_VAL(ELERR, le64_to_cpu(raw_desc->m0)) << LERR_LEN) | + GET_VAL(LERR, le64_to_cpu(raw_desc->m0)); +- if (unlikely(status > 2)) { ++ if (unlikely(status)) { + dev_kfree_skb_any(skb); + xgene_enet_parse_error(rx_ring, netdev_priv(rx_ring->ndev), + status); diff --git a/queue-4.9/drivers-perf-arm_pmu-handle-no-platform_device.patch b/queue-4.9/drivers-perf-arm_pmu-handle-no-platform_device.patch new file mode 100644 index 00000000000..ca245efced7 --- /dev/null +++ b/queue-4.9/drivers-perf-arm_pmu-handle-no-platform_device.patch @@ -0,0 +1,60 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Mark Rutland +Date: Tue, 11 Apr 2017 09:39:49 +0100 +Subject: drivers/perf: arm_pmu: handle no platform_device + +From: Mark Rutland + + +[ Upstream commit 7654137071fa706e5c91f4f27bc2a5cd7e435a9b ] + +In armpmu_dispatch_irq() we look at arm_pmu::plat_device to acquire +platdata, so that we can defer to platform-specific IRQ handling, +required on some 32-bit parts. With the advent of ACPI we won't always +have a platform_device, and so we must avoid trying to dereference +fields from it. + +This patch fixes up armpmu_dispatch_irq() to avoid doing so, introducing +a new armpmu_get_platdata() helper. + +Signed-off-by: Mark Rutland +Tested-by: Jeremy Linton +Cc: Will Deacon +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/perf/arm_pmu.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/drivers/perf/arm_pmu.c ++++ b/drivers/perf/arm_pmu.c +@@ -322,10 +322,16 @@ validate_group(struct perf_event *event) + return 0; + } + ++static struct arm_pmu_platdata *armpmu_get_platdata(struct arm_pmu *armpmu) ++{ ++ struct platform_device *pdev = armpmu->plat_device; ++ ++ return pdev ? dev_get_platdata(&pdev->dev) : NULL; ++} ++ + static irqreturn_t armpmu_dispatch_irq(int irq, void *dev) + { + struct arm_pmu *armpmu; +- struct platform_device *plat_device; + struct arm_pmu_platdata *plat; + int ret; + u64 start_clock, finish_clock; +@@ -337,8 +343,8 @@ static irqreturn_t armpmu_dispatch_irq(i + * dereference. + */ + armpmu = *(void **)dev; +- plat_device = armpmu->plat_device; +- plat = dev_get_platdata(&plat_device->dev); ++ ++ plat = armpmu_get_platdata(armpmu); + + start_clock = sched_clock(); + if (plat && plat->handle_irq) diff --git a/queue-4.9/drm-amdgpu-fail-fb-creation-from-imported-dma-bufs.-v2.patch b/queue-4.9/drm-amdgpu-fail-fb-creation-from-imported-dma-bufs.-v2.patch new file mode 100644 index 00000000000..84db295493a --- /dev/null +++ b/queue-4.9/drm-amdgpu-fail-fb-creation-from-imported-dma-bufs.-v2.patch @@ -0,0 +1,41 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Christopher James Halse Rogers +Date: Wed, 29 Mar 2017 15:02:11 +1100 +Subject: drm/amdgpu: Fail fb creation from imported dma-bufs. (v2) + +From: Christopher James Halse Rogers + + +[ Upstream commit 1769152ac64b0b07583f696b621624df2ca4c840 ] + +Any use of the framebuffer will migrate it to VRAM, which is not sensible for +an imported dma-buf. + +v2: Use DRM_DEBUG_KMS to prevent userspace accidentally spamming dmesg. + +Reviewed-by: Michel Dänzer +Reviewed-by: Christian König +Signed-off-by: Christopher James Halse Rogers +CC: amd-gfx@lists.freedesktop.org +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +@@ -533,6 +533,12 @@ amdgpu_user_framebuffer_create(struct dr + return ERR_PTR(-ENOENT); + } + ++ /* Handle is imported dma-buf, so cannot be migrated to VRAM for scanout */ ++ if (obj->import_attach) { ++ DRM_DEBUG_KMS("Cannot create framebuffer from imported dma_buf\n"); ++ return ERR_PTR(-EINVAL); ++ } ++ + amdgpu_fb = kzalloc(sizeof(*amdgpu_fb), GFP_KERNEL); + if (amdgpu_fb == NULL) { + drm_gem_object_unreference_unlocked(obj); diff --git a/queue-4.9/drm-amdkfd-fix-memory-leaks-in-kfd-topology.patch b/queue-4.9/drm-amdkfd-fix-memory-leaks-in-kfd-topology.patch new file mode 100644 index 00000000000..93f226d7eba --- /dev/null +++ b/queue-4.9/drm-amdkfd-fix-memory-leaks-in-kfd-topology.patch @@ -0,0 +1,78 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Yong Zhao +Date: Fri, 8 Dec 2017 23:08:48 -0500 +Subject: drm/amdkfd: Fix memory leaks in kfd topology + +From: Yong Zhao + + +[ Upstream commit 5108d768408abc80e4e8d99f5b406a73cb04056b ] + +Kobject created using kobject_create_and_add() can be freed using +kobject_put() when there is no referenece any more. However, +kobject memory allocated with kzalloc() has to set up a release +callback in order to free it when the counter decreases to 0. +Otherwise it causes memory leak. + +Signed-off-by: Yong Zhao +Signed-off-by: Felix Kuehling +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c +@@ -519,11 +519,17 @@ static ssize_t sysprops_show(struct kobj + return ret; + } + ++static void kfd_topology_kobj_release(struct kobject *kobj) ++{ ++ kfree(kobj); ++} ++ + static const struct sysfs_ops sysprops_ops = { + .show = sysprops_show, + }; + + static struct kobj_type sysprops_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &sysprops_ops, + }; + +@@ -559,6 +565,7 @@ static const struct sysfs_ops iolink_ops + }; + + static struct kobj_type iolink_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &iolink_ops, + }; + +@@ -586,6 +593,7 @@ static const struct sysfs_ops mem_ops = + }; + + static struct kobj_type mem_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &mem_ops, + }; + +@@ -625,6 +633,7 @@ static const struct sysfs_ops cache_ops + }; + + static struct kobj_type cache_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &cache_ops, + }; + +@@ -747,6 +756,7 @@ static const struct sysfs_ops node_ops = + }; + + static struct kobj_type node_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &node_ops, + }; + diff --git a/queue-4.9/drm-defer-disabling-the-vblank-irq-until-the-next-interrupt-for-instant-off.patch b/queue-4.9/drm-defer-disabling-the-vblank-irq-until-the-next-interrupt-for-instant-off.patch new file mode 100644 index 00000000000..bcb69a4abde --- /dev/null +++ b/queue-4.9/drm-defer-disabling-the-vblank-irq-until-the-next-interrupt-for-instant-off.patch @@ -0,0 +1,108 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Chris Wilson +Date: Wed, 15 Mar 2017 20:40:25 +0000 +Subject: drm: Defer disabling the vblank IRQ until the next interrupt (for instant-off) + +From: Chris Wilson + + +[ Upstream commit 608b20506941969ea30d8c08dc9ae02bb87dbf7d ] + +On vblank instant-off systems, we can get into a situation where the cost +of enabling and disabling the vblank IRQ around a drmWaitVblank query +dominates. And with the advent of even deeper hardware sleep state, +touching registers becomes ever more expensive. However, we know that if +the user wants the current vblank counter, they are also very likely to +immediately queue a vblank wait and so we can keep the interrupt around +and only turn it off if we have no further vblank requests queued within +the interrupt interval. + +After vblank event delivery, this patch adds a shadow of one vblank where +the interrupt is kept alive for the user to query and queue another vblank +event. Similarly, if the user is using blocking drmWaitVblanks, the +interrupt will be disabled on the IRQ following the wait completion. +However, if the user is simply querying the current vblank counter and +timestamp, the interrupt will be disabled after every IRQ and the user +will enabled it again on the first query following the IRQ. + +v2: Mario Kleiner - +After testing this, one more thing that would make sense is to move +the disable block at the end of drm_handle_vblank() instead of at the +top. + +Turns out that if high precision timestaming is disabled or doesn't +work for some reason (as can be simulated by echo 0 > +/sys/module/drm/parameters/timestamp_precision_usec), then with your +delayed disable code at its current place, the vblank counter won't +increment anymore at all for instant queries, ie. with your other +"instant query" patches. Clients which repeatedly query the counter +and wait for it to progress will simply hang, spinning in an endless +query loop. There's that comment in vblank_disable_and_save: + +"* Skip this step if there isn't any high precision timestamp + * available. In that case we can't account for this and just + * hope for the best. + */ + +With the disable happening after leading edge of vblank (== hw counter +increment already happened) but before the vblank counter/timestamp +handling in drm_handle_vblank, that step is needed to keep the counter +progressing, so skipping it is bad. + +Now without high precision timestamping support, a kms driver must not +set dev->vblank_disable_immediate = true, as this would cause problems +for clients, so this shouldn't matter, but it would be good to still +make this robust against a future kms driver which might have +unreliable high precision timestamping, e.g., high precision +timestamping that intermittently doesn't work. + +v3: Patch before coffee needs extra coffee. + +Testcase: igt/kms_vblank +Signed-off-by: Chris Wilson +Cc: Ville Syrjälä +Cc: Daniel Vetter +Cc: Michel Dänzer +Cc: Laurent Pinchart +Cc: Dave Airlie , +Cc: Mario Kleiner +Reviewed-by: Ville Syrjälä +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/20170315204027.20160-1-chris@chris-wilson.co.uk +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_irq.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/drm_irq.c ++++ b/drivers/gpu/drm/drm_irq.c +@@ -1202,9 +1202,9 @@ static void drm_vblank_put(struct drm_de + if (atomic_dec_and_test(&vblank->refcount)) { + if (drm_vblank_offdelay == 0) + return; +- else if (dev->vblank_disable_immediate || drm_vblank_offdelay < 0) ++ else if (drm_vblank_offdelay < 0) + vblank_disable_fn((unsigned long)vblank); +- else ++ else if (!dev->vblank_disable_immediate) + mod_timer(&vblank->disable_timer, + jiffies + ((drm_vblank_offdelay * HZ)/1000)); + } +@@ -1819,6 +1819,16 @@ bool drm_handle_vblank(struct drm_device + wake_up(&vblank->queue); + drm_handle_vblank_events(dev, pipe); + ++ /* With instant-off, we defer disabling the interrupt until after ++ * we finish processing the following vblank. The disable has to ++ * be last (after drm_handle_vblank_events) so that the timestamp ++ * is always accurate. ++ */ ++ if (dev->vblank_disable_immediate && ++ drm_vblank_offdelay > 0 && ++ !atomic_read(&vblank->refcount)) ++ vblank_disable_fn((unsigned long)vblank); ++ + spin_unlock_irqrestore(&dev->event_lock, irqflags); + + return true; diff --git a/queue-4.9/drm-edid-set-eld-connector-type-in-drm_edid_to_eld.patch b/queue-4.9/drm-edid-set-eld-connector-type-in-drm_edid_to_eld.patch new file mode 100644 index 00000000000..f60644a9ad1 --- /dev/null +++ b/queue-4.9/drm-edid-set-eld-connector-type-in-drm_edid_to_eld.patch @@ -0,0 +1,70 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Jani Nikula +Date: Wed, 1 Nov 2017 16:20:58 +0200 +Subject: drm/edid: set ELD connector type in drm_edid_to_eld() + +From: Jani Nikula + + +[ Upstream commit 1d1c36650752b7fb81cee515a9bba4131cac4b7c ] + +Since drm_edid_to_eld() knows the connector type, we can set the type in +ELD while at it. Most connectors this gets called on are not DP +encoders, and with the HDMI type being 0, this does not change behaviour +for non-DP. + +For i915 having this in place earlier would have saved a considerable +amount of debugging that lead to the fix 2d8f63297b9f ("drm/i915: always +update ELD connector type after get modes"). I don't see other drivers, +even the ones calling drm_edid_to_eld() on DP connectors, setting the +connector type in ELD. + +Cc: Alex Deucher +Cc: Christian König +Cc: Archit Taneja +Cc: Andrzej Hajda +Cc: Russell King +Cc: CK Hu +Cc: Philipp Zabel +Cc: Ben Skeggs +Cc: Mark Yao +Cc: Benjamin Gaignard +Cc: Vincent Abriou +Cc: Thierry Reding +Cc: Eric Anholt +Reviewed-by: Ville Syrjälä +Reviewed-by: Alex Deucher +Acked-by: Thierry Reding +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/d527b31619528c477c2c136f25cdf118bc0cfc1d.1509545641.git.jani.nikula@intel.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_edid.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -3347,8 +3347,7 @@ EXPORT_SYMBOL(drm_edid_get_monitor_name) + * @edid: EDID to parse + * + * Fill the ELD (EDID-Like Data) buffer for passing to the audio driver. The +- * Conn_Type, HDCP and Port_ID ELD fields are left for the graphics driver to +- * fill in. ++ * HDCP and Port_ID ELD fields are left for the graphics driver to fill in. + */ + void drm_edid_to_eld(struct drm_connector *connector, struct edid *edid) + { +@@ -3426,6 +3425,12 @@ void drm_edid_to_eld(struct drm_connecto + } + eld[5] |= total_sad_count << 4; + ++ if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort || ++ connector->connector_type == DRM_MODE_CONNECTOR_eDP) ++ eld[DRM_ELD_SAD_COUNT_CONN_TYPE] |= DRM_ELD_CONN_TYPE_DP; ++ else ++ eld[DRM_ELD_SAD_COUNT_CONN_TYPE] |= DRM_ELD_CONN_TYPE_HDMI; ++ + eld[DRM_ELD_BASELINE_ELD_LEN] = + DIV_ROUND_UP(drm_eld_calc_baseline_block_size(eld), 4); + diff --git a/queue-4.9/drm-qxl-don-t-alloc-fbdev-if-emulation-is-not-supported.patch b/queue-4.9/drm-qxl-don-t-alloc-fbdev-if-emulation-is-not-supported.patch new file mode 100644 index 00000000000..9d694bfce25 --- /dev/null +++ b/queue-4.9/drm-qxl-don-t-alloc-fbdev-if-emulation-is-not-supported.patch @@ -0,0 +1,116 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Gabriel Krisman Bertazi +Date: Mon, 27 Feb 2017 17:33:30 -0300 +Subject: drm: qxl: Don't alloc fbdev if emulation is not supported + +From: Gabriel Krisman Bertazi + + +[ Upstream commit 861078381ba56b56808113736000d9e7ead349c8 ] + +If fbdev emulation is disabled, the QXL shutdown path will try to clean +a framebuffer that wasn't initialized, hitting the Oops below. The +problem is that even when FBDEV_EMULATION is disabled we allocate the +qfbdev strutucture, but we don't initialize it. The fix is to stop +allocating the memory, since it won't be used. This allows the existing +verification in the cleanup hook to do it's job preventing the oops. + +Now that we don't allocate the unused fbdev structure, we need to be +careful when dereferencing it in the PM suspend hook. + +[ 24.284684] BUG: unable to handle kernel NULL pointer dereference at 00000000000002e0 +[ 24.285627] IP: mutex_lock+0x18/0x30 +[ 24.286049] PGD 78cdf067 +[ 24.286050] PUD 7940f067 +[ 24.286344] PMD 0 +[ 24.286649] +[ 24.287072] Oops: 0002 [#1] SMP +[ 24.287422] Modules linked in: qxl +[ 24.287806] CPU: 0 PID: 2328 Comm: bash Not tainted 4.10.0-rc5+ #97 +[ 24.288515] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-20161025_171302-gandalf 04/01/2014 +[ 24.289681] task: ffff88007c4c0000 task.stack: ffffc90001b58000 +[ 24.290354] RIP: 0010:mutex_lock+0x18/0x30 +[ 24.290812] RSP: 0018:ffffc90001b5bcb0 EFLAGS: 00010246 +[ 24.291401] RAX: 0000000000000000 RBX: 00000000000002e0 RCX: 0000000000000000 +[ 24.292209] RDX: ffff88007c4c0000 RSI: 0000000000000001 RDI: 00000000000002e0 +[ 24.292987] RBP: ffffc90001b5bcb8 R08: fffffffffffffffe R09: 0000000000000001 +[ 24.293797] R10: ffff880078d80b80 R11: 0000000000011400 R12: 0000000000000000 +[ 24.294601] R13: 00000000000002e0 R14: ffffffffa0009c28 R15: 0000000000000060 +[ 24.295439] FS: 00007f30e3acbb40(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000 +[ 24.296364] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 24.296997] CR2: 00000000000002e0 CR3: 0000000078c7b000 CR4: 00000000000006f0 +[ 24.297813] Call Trace: +[ 24.298097] drm_framebuffer_cleanup+0x1f/0x70 +[ 24.298612] qxl_fbdev_fini+0x68/0x90 [qxl] +[ 24.299074] qxl_modeset_fini+0xd/0x30 [qxl] +[ 24.299562] qxl_pci_remove+0x22/0x50 [qxl] +[ 24.300025] pci_device_remove+0x34/0xb0 +[ 24.300507] device_release_driver_internal+0x150/0x200 +[ 24.301082] device_release_driver+0xd/0x10 +[ 24.301587] unbind_store+0x108/0x150 +[ 24.301993] drv_attr_store+0x20/0x30 +[ 24.302402] sysfs_kf_write+0x32/0x40 +[ 24.302827] kernfs_fop_write+0x108/0x190 +[ 24.303269] __vfs_write+0x23/0x120 +[ 24.303678] ? security_file_permission+0x36/0xb0 +[ 24.304193] ? rw_verify_area+0x49/0xb0 +[ 24.304636] vfs_write+0xb0/0x190 +[ 24.305004] SyS_write+0x41/0xa0 +[ 24.305362] entry_SYSCALL_64_fastpath+0x1a/0xa9 +[ 24.305887] RIP: 0033:0x7f30e31d9620 +[ 24.306285] RSP: 002b:00007ffc54b47e68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 +[ 24.307128] RAX: ffffffffffffffda RBX: 00007f30e3497600 RCX: 00007f30e31d9620 +[ 24.307928] RDX: 000000000000000d RSI: 0000000000da2008 RDI: 0000000000000001 +[ 24.308727] RBP: 000000000070bc60 R08: 00007f30e3498760 R09: 00007f30e3acbb40 +[ 24.309504] R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000001 +[ 24.310295] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffc54b47f34 +[ 24.311095] Code: 0e 01 e9 7b fe ff ff 66 90 66 2e 0f 1f 84 00 00 00 00 00 +55 48 89 e5 53 48 89 fb e8 83 e8 ff ff 65 48 8b 14 25 40 c4 00 00 31 c0 <3e> +48 0f b1 13 48 85 c0 74 08 48 89 df e8 66 fd ff ff 5b 5d c3 +[ 24.313182] RIP: mutex_lock+0x18/0x30 RSP: ffffc90001b5bcb0 +[ 24.313811] CR2: 00000000000002e0 +[ 24.314208] ---[ end trace 29669c1593cae14b ]--- + +Signed-off-by: Gabriel Krisman Bertazi +Link: http://patchwork.freedesktop.org/patch/msgid/20170227203330.18542-1-krisman@collabora.co.uk +Signed-off-by: Gerd Hoffmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/qxl/qxl_fb.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/qxl/qxl_fb.c ++++ b/drivers/gpu/drm/qxl/qxl_fb.c +@@ -387,9 +387,11 @@ static const struct drm_fb_helper_funcs + + int qxl_fbdev_init(struct qxl_device *qdev) + { ++ int ret = 0; ++ ++#ifdef CONFIG_DRM_FBDEV_EMULATION + struct qxl_fbdev *qfbdev; + int bpp_sel = 32; /* TODO: parameter from somewhere? */ +- int ret; + + qfbdev = kzalloc(sizeof(struct qxl_fbdev), GFP_KERNEL); + if (!qfbdev) +@@ -423,6 +425,8 @@ fini: + drm_fb_helper_fini(&qfbdev->helper); + free: + kfree(qfbdev); ++#endif ++ + return ret; + } + +@@ -438,6 +442,9 @@ void qxl_fbdev_fini(struct qxl_device *q + + void qxl_fbdev_set_suspend(struct qxl_device *qdev, int state) + { ++ if (!qdev->mode_info.qfbdev) ++ return; ++ + drm_fb_helper_set_suspend(&qdev->mode_info.qfbdev->helper, state); + } + diff --git a/queue-4.9/drm-radeon-fail-fb-creation-from-imported-dma-bufs.patch b/queue-4.9/drm-radeon-fail-fb-creation-from-imported-dma-bufs.patch new file mode 100644 index 00000000000..7dc5537e2f3 --- /dev/null +++ b/queue-4.9/drm-radeon-fail-fb-creation-from-imported-dma-bufs.patch @@ -0,0 +1,41 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Christopher James Halse Rogers +Date: Wed, 29 Mar 2017 15:00:54 +1100 +Subject: drm/radeon: Fail fb creation from imported dma-bufs. + +From: Christopher James Halse Rogers + + +[ Upstream commit a294043b2fbd8de69d161457ed0c7a4026bbfa5a ] + +Any use of the framebuffer will migrate it to VRAM, which is not sensible for +an imported dma-buf. + +v2: Use DRM_DEBUG_KMS to prevent userspace accidentally spamming dmesg. + +Reviewed-by: Michel Dänzer +Reviewed-by: Christian König +Signed-off-by: Christopher James Halse Rogers +CC: amd-gfx@lists.freedesktop.org +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/radeon/radeon_display.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -1352,6 +1352,12 @@ radeon_user_framebuffer_create(struct dr + return ERR_PTR(-ENOENT); + } + ++ /* Handle is imported dma-buf, so cannot be migrated to VRAM for scanout */ ++ if (obj->import_attach) { ++ DRM_DEBUG_KMS("Cannot create framebuffer from imported dma_buf\n"); ++ return ERR_PTR(-EINVAL); ++ } ++ + radeon_fb = kzalloc(sizeof(*radeon_fb), GFP_KERNEL); + if (radeon_fb == NULL) { + drm_gem_object_unreference_unlocked(obj); diff --git a/queue-4.9/drm-rcar-du-handle-event-when-disabling-crtcs.patch b/queue-4.9/drm-rcar-du-handle-event-when-disabling-crtcs.patch new file mode 100644 index 00000000000..caa46877542 --- /dev/null +++ b/queue-4.9/drm-rcar-du-handle-event-when-disabling-crtcs.patch @@ -0,0 +1,38 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Laurent Pinchart +Date: Fri, 10 Feb 2017 13:30:35 +0200 +Subject: drm: rcar-du: Handle event when disabling CRTCs + +From: Laurent Pinchart + + +[ Upstream commit 6dd47cfd03a058d08b8caffb06194aa0eb109cf1 ] + +The driver currently handles vblank events only when updating planes on +a CRTC. The atomic update API however allows requesting an event when +disabling a CRTC. This currently leads to event objects being leaked in +the kernel and to events not being sent out. Fix it. + +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c +@@ -512,6 +512,13 @@ static void rcar_du_crtc_disable(struct + rcar_du_crtc_stop(rcrtc); + rcar_du_crtc_put(rcrtc); + ++ spin_lock_irq(&crtc->dev->event_lock); ++ if (crtc->state->event) { ++ drm_crtc_send_vblank_event(crtc, crtc->state->event); ++ crtc->state->event = NULL; ++ } ++ spin_unlock_irq(&crtc->dev->event_lock); ++ + rcrtc->outputs = 0; + } + diff --git a/queue-4.9/drm-rockchip-vop-enable-pm-domain-before-vop_initial.patch b/queue-4.9/drm-rockchip-vop-enable-pm-domain-before-vop_initial.patch new file mode 100644 index 00000000000..19a4e65fd39 --- /dev/null +++ b/queue-4.9/drm-rockchip-vop-enable-pm-domain-before-vop_initial.patch @@ -0,0 +1,108 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Jeffy Chen +Date: Thu, 6 Apr 2017 20:31:20 +0800 +Subject: drm/rockchip: vop: Enable pm domain before vop_initial + +From: Jeffy Chen + + +[ Upstream commit 5e570373c015b60a68828b1cd9d475cb33d3be4b ] + +We're trying to access vop registers here, so need to make sure +the pm domain is on. + +Normally it should be enabled by the bootloader, but there's no +guarantee of it. And if we wanna do unbind/bind, it would also +cause the device to hang. + +And this patch also does these: +1/ move vop_initial to the end of vop_bind for eaiser error handling. +2/ correct the err_put_pm_runtime of vop_enable. + +Signed-off-by: Jeffy Chen +Signed-off-by: Sean Paul +Link: http://patchwork.freedesktop.org/patch/msgid/1491481885-13775-8-git-send-email-jeffy.chen@rock-chips.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 29 ++++++++++++++++++++-------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +@@ -503,7 +503,7 @@ static int vop_enable(struct drm_crtc *c + ret = pm_runtime_get_sync(vop->dev); + if (ret < 0) { + dev_err(vop->dev, "failed to get pm runtime: %d\n", ret); +- goto err_put_pm_runtime; ++ return ret; + } + + ret = clk_enable(vop->hclk); +@@ -1348,10 +1348,16 @@ static int vop_initial(struct vop *vop) + return PTR_ERR(vop->dclk); + } + ++ ret = pm_runtime_get_sync(vop->dev); ++ if (ret < 0) { ++ dev_err(vop->dev, "failed to get pm runtime: %d\n", ret); ++ return ret; ++ } ++ + ret = clk_prepare(vop->dclk); + if (ret < 0) { + dev_err(vop->dev, "failed to prepare dclk\n"); +- return ret; ++ goto err_put_pm_runtime; + } + + /* Enable both the hclk and aclk to setup the vop */ +@@ -1411,6 +1417,8 @@ static int vop_initial(struct vop *vop) + + vop->is_enabled = false; + ++ pm_runtime_put_sync(vop->dev); ++ + return 0; + + err_disable_aclk: +@@ -1419,6 +1427,8 @@ err_disable_hclk: + clk_disable_unprepare(vop->hclk); + err_unprepare_dclk: + clk_unprepare(vop->dclk); ++err_put_pm_runtime: ++ pm_runtime_put_sync(vop->dev); + return ret; + } + +@@ -1519,12 +1529,6 @@ static int vop_bind(struct device *dev, + if (!vop->regsbak) + return -ENOMEM; + +- ret = vop_initial(vop); +- if (ret < 0) { +- dev_err(&pdev->dev, "cannot initial vop dev - err %d\n", ret); +- return ret; +- } +- + irq = platform_get_irq(pdev, 0); + if (irq < 0) { + dev_err(dev, "cannot find irq for vop\n"); +@@ -1551,8 +1555,17 @@ static int vop_bind(struct device *dev, + + pm_runtime_enable(&pdev->dev); + ++ ret = vop_initial(vop); ++ if (ret < 0) { ++ dev_err(&pdev->dev, "cannot initial vop dev - err %d\n", ret); ++ goto err_disable_pm_runtime; ++ } ++ + return 0; + ++err_disable_pm_runtime: ++ pm_runtime_disable(&pdev->dev); ++ vop_destroy_crtc(vop); + err_enable_irq: + enable_irq(vop->irq); /* To balance out the disable_irq above */ + return ret; diff --git a/queue-4.9/drm-sun4i-fix-tcon-clock-and-regmap-initialization-sequence.patch b/queue-4.9/drm-sun4i-fix-tcon-clock-and-regmap-initialization-sequence.patch new file mode 100644 index 00000000000..5005d1078fc --- /dev/null +++ b/queue-4.9/drm-sun4i-fix-tcon-clock-and-regmap-initialization-sequence.patch @@ -0,0 +1,100 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Chen-Yu Tsai +Date: Thu, 9 Mar 2017 18:05:24 +0800 +Subject: drm/sun4i: Fix TCON clock and regmap initialization sequence + +From: Chen-Yu Tsai + + +[ Upstream commit 4c7f16d14a33a9cfb4af9cb780d8a73bcca64a92 ] + +The TCON driver calls sun4i_tcon_init_regmap and sun4i_tcon_init_clocks +in its bind function. The former creates a regmap and writes to several +register to clear its configuration to a known default. The latter +initializes various clocks. This includes enabling the bus clock for +register access and creating the dotclock. + +In order for the first step's writes to work, the bus clock must be +enabled which is done in the second step. but the dotclock's ops use +the regmap created in the first step. + +Rearrange the function calls such that the clocks are initialized before +the regmap, and split out the dot clock creation to after the regmap is +initialized. + +Fixes: 9026e0d122ac ("drm: Add Allwinner A10 Display Engine support") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/sun4i/sun4i_tcon.c | 22 +++++++++++++++------- + 1 file changed, 15 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c ++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c +@@ -336,12 +336,11 @@ static int sun4i_tcon_init_clocks(struct + } + } + +- return sun4i_dclk_create(dev, tcon); ++ return 0; + } + + static void sun4i_tcon_free_clocks(struct sun4i_tcon *tcon) + { +- sun4i_dclk_free(tcon); + clk_disable_unprepare(tcon->clk); + } + +@@ -506,22 +505,28 @@ static int sun4i_tcon_bind(struct device + return ret; + } + ++ ret = sun4i_tcon_init_clocks(dev, tcon); ++ if (ret) { ++ dev_err(dev, "Couldn't init our TCON clocks\n"); ++ goto err_assert_reset; ++ } ++ + ret = sun4i_tcon_init_regmap(dev, tcon); + if (ret) { + dev_err(dev, "Couldn't init our TCON regmap\n"); +- goto err_assert_reset; ++ goto err_free_clocks; + } + +- ret = sun4i_tcon_init_clocks(dev, tcon); ++ ret = sun4i_dclk_create(dev, tcon); + if (ret) { +- dev_err(dev, "Couldn't init our TCON clocks\n"); +- goto err_assert_reset; ++ dev_err(dev, "Couldn't create our TCON dot clock\n"); ++ goto err_free_clocks; + } + + ret = sun4i_tcon_init_irq(dev, tcon); + if (ret) { + dev_err(dev, "Couldn't init our TCON interrupts\n"); +- goto err_free_clocks; ++ goto err_free_dotclock; + } + + ret = sun4i_rgb_init(drm); +@@ -530,6 +535,8 @@ static int sun4i_tcon_bind(struct device + + return 0; + ++err_free_dotclock: ++ sun4i_dclk_free(tcon); + err_free_clocks: + sun4i_tcon_free_clocks(tcon); + err_assert_reset: +@@ -542,6 +549,7 @@ static void sun4i_tcon_unbind(struct dev + { + struct sun4i_tcon *tcon = dev_get_drvdata(dev); + ++ sun4i_dclk_free(tcon); + sun4i_tcon_free_clocks(tcon); + } + diff --git a/queue-4.9/drm-sun4i-fix-up-error-path-cleanup-for-master-bind-function.patch b/queue-4.9/drm-sun4i-fix-up-error-path-cleanup-for-master-bind-function.patch new file mode 100644 index 00000000000..755f34013b7 --- /dev/null +++ b/queue-4.9/drm-sun4i-fix-up-error-path-cleanup-for-master-bind-function.patch @@ -0,0 +1,85 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Chen-Yu Tsai +Date: Fri, 17 Feb 2017 11:13:25 +0800 +Subject: drm/sun4i: Fix up error path cleanup for master bind function + +From: Chen-Yu Tsai + + +[ Upstream commit 9d56defb44b15427f4342c543a70fb7886fc06f5 ] + +The master bind function calls numerous drm functions which initialize +underlying structures. It also tries to bind the various components +of the display pipeline, some of which may add additional drm objects. + +This patch adds proper cleanup functions in the error path of the +master bind function. + +This requires the patch "drm/sun4i: Move drm_mode_config_cleanup call +to main driver", which splits out drm_mode_config_cleanup from +sun4i_framebuffer_free so we can call it separately. + +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/sun4i/sun4i_drv.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/sun4i/sun4i_drv.c ++++ b/drivers/gpu/drm/sun4i/sun4i_drv.c +@@ -145,7 +145,7 @@ static int sun4i_drv_bind(struct device + ret = component_bind_all(drm->dev, drm); + if (ret) { + dev_err(drm->dev, "Couldn't bind all pipelines components\n"); +- goto free_drm; ++ goto cleanup_mode_config; + } + + /* Create our layers */ +@@ -153,7 +153,7 @@ static int sun4i_drv_bind(struct device + if (IS_ERR(drv->layers)) { + dev_err(drm->dev, "Couldn't create the planes\n"); + ret = PTR_ERR(drv->layers); +- goto free_drm; ++ goto cleanup_mode_config; + } + + /* Create our CRTC */ +@@ -161,7 +161,7 @@ static int sun4i_drv_bind(struct device + if (!drv->crtc) { + dev_err(drm->dev, "Couldn't create the CRTC\n"); + ret = -EINVAL; +- goto free_drm; ++ goto cleanup_mode_config; + } + drm->irq_enabled = true; + +@@ -173,7 +173,7 @@ static int sun4i_drv_bind(struct device + if (IS_ERR(drv->fbdev)) { + dev_err(drm->dev, "Couldn't create our framebuffer\n"); + ret = PTR_ERR(drv->fbdev); +- goto free_drm; ++ goto cleanup_mode_config; + } + + /* Enable connectors polling */ +@@ -181,10 +181,16 @@ static int sun4i_drv_bind(struct device + + ret = drm_dev_register(drm, 0); + if (ret) +- goto free_drm; ++ goto finish_poll; + + return 0; + ++finish_poll: ++ drm_kms_helper_poll_fini(drm); ++ sun4i_framebuffer_free(drm); ++cleanup_mode_config: ++ drm_mode_config_cleanup(drm); ++ drm_vblank_cleanup(drm); + free_drm: + drm_dev_unref(drm); + return ret; diff --git a/queue-4.9/drm-sun4i-set-drm_crtc.port-to-the-underlying-tcon-s-output-port-node.patch b/queue-4.9/drm-sun4i-set-drm_crtc.port-to-the-underlying-tcon-s-output-port-node.patch new file mode 100644 index 00000000000..68abedf2008 --- /dev/null +++ b/queue-4.9/drm-sun4i-set-drm_crtc.port-to-the-underlying-tcon-s-output-port-node.patch @@ -0,0 +1,43 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Chen-Yu Tsai +Date: Thu, 23 Feb 2017 16:05:34 +0800 +Subject: drm/sun4i: Set drm_crtc.port to the underlying TCON's output port node + +From: Chen-Yu Tsai + + +[ Upstream commit 7544860733d158e3edbf309f27e79e258c8f66bd ] + +The way drm_of_find_possible_crtcs works is it tries to match the +remote-endpoint of the given node's various endpoints to all the +crtc's .port field. Thus we need to set drm_crtc.port to the output +port node of the underlying TCON. + +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/sun4i/sun4i_crtc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/gpu/drm/sun4i/sun4i_crtc.c ++++ b/drivers/gpu/drm/sun4i/sun4i_crtc.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -136,5 +137,9 @@ struct sun4i_crtc *sun4i_crtc_init(struc + + drm_crtc_helper_add(&scrtc->crtc, &sun4i_crtc_helper_funcs); + ++ /* Set crtc.port to output port node of the tcon */ ++ scrtc->crtc.port = of_graph_get_port_by_id(drv->tcon->dev->of_node, ++ 1); ++ + return scrtc; + } diff --git a/queue-4.9/drm-ttm-never-add-bo-that-failed-to-validate-to-the-lru-list.patch b/queue-4.9/drm-ttm-never-add-bo-that-failed-to-validate-to-the-lru-list.patch new file mode 100644 index 00000000000..1f78eec8330 --- /dev/null +++ b/queue-4.9/drm-ttm-never-add-bo-that-failed-to-validate-to-the-lru-list.patch @@ -0,0 +1,65 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: "Nicolai Hähnle" +Date: Tue, 14 Feb 2017 09:37:12 +0100 +Subject: drm/ttm: never add BO that failed to validate to the LRU list + +From: "Nicolai Hähnle" + + +[ Upstream commit c2c139cf435b18939204800fa72c53a7207bdd68 ] + +Fixes a potential race condition in amdgpu that looks as follows: + +Task 1: attempt ttm_bo_init, but ttm_bo_validate fails +Task 1: add BO to global list anyway +Task 2: grabs hold of the BO, waits on its reservation lock +Task 1: releases its reference of the BO; never gives up the + reservation lock + +The patch "drm/amdgpu: fix a potential deadlock in +amdgpu_bo_create_restricted()" attempts to fix that by releasing +the reservation lock in amdgpu code; unfortunately, it introduces +a use-after-free when this race _doesn't_ happen. + +This patch should fix the race properly by never adding the BO +to the global list in the first place. + +Cc: zhoucm1 +Signed-off-by: Nicolai Hähnle +Tested-by: Samuel Pitoiset +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/ttm/ttm_bo.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/ttm/ttm_bo.c ++++ b/drivers/gpu/drm/ttm/ttm_bo.c +@@ -1209,18 +1209,20 @@ int ttm_bo_init(struct ttm_bo_device *bd + if (likely(!ret)) + ret = ttm_bo_validate(bo, placement, interruptible, false); + +- if (!resv) { ++ if (!resv) + ttm_bo_unreserve(bo); + +- } else if (!(bo->mem.placement & TTM_PL_FLAG_NO_EVICT)) { ++ if (unlikely(ret)) { ++ ttm_bo_unref(&bo); ++ return ret; ++ } ++ ++ if (resv && !(bo->mem.placement & TTM_PL_FLAG_NO_EVICT)) { + spin_lock(&bo->glob->lru_lock); + ttm_bo_add_to_lru(bo); + spin_unlock(&bo->glob->lru_lock); + } + +- if (unlikely(ret)) +- ttm_bo_unref(&bo); +- + return ret; + } + EXPORT_SYMBOL(ttm_bo_init); diff --git a/queue-4.9/drm-vmwgfx-fixes-to-vmwgfx_fb.patch b/queue-4.9/drm-vmwgfx-fixes-to-vmwgfx_fb.patch new file mode 100644 index 00000000000..1d2dc5f253b --- /dev/null +++ b/queue-4.9/drm-vmwgfx-fixes-to-vmwgfx_fb.patch @@ -0,0 +1,45 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Sinclair Yeh +Date: Thu, 23 Mar 2017 14:28:21 -0700 +Subject: drm/vmwgfx: Fixes to vmwgfx_fb + +From: Sinclair Yeh + + +[ Upstream commit aa74f0687cfe998e59b20d6454f45e8aa4403c45 ] + +1. When unsetting a mode, num_connector should be set to zero +2. The pixel_format field needs to be initialized as newer DRM internal + functions checks this field +3. Take the drm_modeset_lock_all() because vmw_fb_kms_detach() can + change current mode + +Signed-off-by: Sinclair Yeh +Reviewed-by: Thomas Hellstrom +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +@@ -433,7 +433,7 @@ static int vmw_fb_kms_detach(struct vmw_ + set.y = 0; + set.mode = NULL; + set.fb = NULL; +- set.num_connectors = 1; ++ set.num_connectors = 0; + set.connectors = &par->con; + ret = drm_mode_set_config_internal(&set); + if (ret) { +@@ -821,7 +821,9 @@ int vmw_fb_off(struct vmw_private *vmw_p + flush_delayed_work(&par->local_work); + + mutex_lock(&par->bo_mutex); ++ drm_modeset_lock_all(vmw_priv->dev); + (void) vmw_fb_kms_detach(par, true, false); ++ drm_modeset_unlock_all(vmw_priv->dev); + mutex_unlock(&par->bo_mutex); + + return 0; diff --git a/queue-4.9/edac-altera-fix-peripheral-warnings-for-cyclone5.patch b/queue-4.9/edac-altera-fix-peripheral-warnings-for-cyclone5.patch new file mode 100644 index 00000000000..0c1b8dfb4e0 --- /dev/null +++ b/queue-4.9/edac-altera-fix-peripheral-warnings-for-cyclone5.patch @@ -0,0 +1,68 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Thor Thayer +Date: Wed, 5 Apr 2017 13:01:02 -0500 +Subject: EDAC, altera: Fix peripheral warnings for Cyclone5 + +From: Thor Thayer + + +[ Upstream commit 25b223ddfe2a557307c05fe673e09d94ae950877 ] + +The peripherals' RAS functionality only exist on the Arria10 SoCFPGA. +The Cyclone5 initialization generates EDAC warnings when the peripherals +aren't found in the device tree. Fix by checking for Arria10 in the init +functions. + +Signed-off-by: Thor Thayer +Cc: linux-edac +Link: http://lkml.kernel.org/r/1491415262-5018-1-git-send-email-thor.thayer@linux.intel.com +Signed-off-by: Borislav Petkov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/edac/altera_edac.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +--- a/drivers/edac/altera_edac.c ++++ b/drivers/edac/altera_edac.c +@@ -1020,13 +1020,23 @@ out: + return ret; + } + ++static int socfpga_is_a10(void) ++{ ++ return of_machine_is_compatible("altr,socfpga-arria10"); ++} ++ + static int validate_parent_available(struct device_node *np); + static const struct of_device_id altr_edac_a10_device_of_match[]; + static int __init __maybe_unused altr_init_a10_ecc_device_type(char *compat) + { + int irq; +- struct device_node *child, *np = of_find_compatible_node(NULL, NULL, +- "altr,socfpga-a10-ecc-manager"); ++ struct device_node *child, *np; ++ ++ if (!socfpga_is_a10()) ++ return -ENODEV; ++ ++ np = of_find_compatible_node(NULL, NULL, ++ "altr,socfpga-a10-ecc-manager"); + if (!np) { + edac_printk(KERN_ERR, EDAC_DEVICE, "ECC Manager not found\n"); + return -ENODEV; +@@ -1542,8 +1552,12 @@ static const struct edac_device_prv_data + static int __init socfpga_init_sdmmc_ecc(void) + { + int rc = -ENODEV; +- struct device_node *child = of_find_compatible_node(NULL, NULL, +- "altr,socfpga-sdmmc-ecc"); ++ struct device_node *child; ++ ++ if (!socfpga_is_a10()) ++ return -ENODEV; ++ ++ child = of_find_compatible_node(NULL, NULL, "altr,socfpga-sdmmc-ecc"); + if (!child) { + edac_printk(KERN_WARNING, EDAC_DEVICE, "SDMMC node not found\n"); + return -ENODEV; diff --git a/queue-4.9/eventpoll.h-fix-epoll-event-masks.patch b/queue-4.9/eventpoll.h-fix-epoll-event-masks.patch new file mode 100644 index 00000000000..313e470fad2 --- /dev/null +++ b/queue-4.9/eventpoll.h-fix-epoll-event-masks.patch @@ -0,0 +1,56 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Greg KH +Date: Wed, 8 Mar 2017 19:03:03 +0100 +Subject: eventpoll.h: fix epoll event masks + +From: Greg KH + + +[ Upstream commit 6f051e4a685b768f3704c7c069aa1edee3010622 ] + +[resend due to me forgetting to cc: linux-api the first time around I +posted these back on Feb 23] + +From: Greg Kroah-Hartman + +When userspace tries to use these defines, it complains that it needs to +be an unsigned 1 that is shifted, so libc implementations have to create +their own version. Fix this by defining it properly so that libcs can +just use the kernel uapi header. + +Reported-by: Elliott Hughes +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/uapi/linux/eventpoll.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/include/uapi/linux/eventpoll.h ++++ b/include/uapi/linux/eventpoll.h +@@ -40,7 +40,7 @@ + #define EPOLLRDHUP 0x00002000 + + /* Set exclusive wakeup mode for the target file descriptor */ +-#define EPOLLEXCLUSIVE (1 << 28) ++#define EPOLLEXCLUSIVE (1U << 28) + + /* + * Request the handling of system wakeup events so as to prevent system suspends +@@ -52,13 +52,13 @@ + * + * Requires CAP_BLOCK_SUSPEND + */ +-#define EPOLLWAKEUP (1 << 29) ++#define EPOLLWAKEUP (1U << 29) + + /* Set the One Shot behaviour for the target file descriptor */ +-#define EPOLLONESHOT (1 << 30) ++#define EPOLLONESHOT (1U << 30) + + /* Set the Edge Triggered behaviour for the target file descriptor */ +-#define EPOLLET (1 << 31) ++#define EPOLLET (1U << 31) + + /* + * On x86-64 make the 64bit structure have the same alignment as the diff --git a/queue-4.9/f2fs-relax-node-version-check-for-victim-data-in-gc.patch b/queue-4.9/f2fs-relax-node-version-check-for-victim-data-in-gc.patch new file mode 100644 index 00000000000..2d3bdb37312 --- /dev/null +++ b/queue-4.9/f2fs-relax-node-version-check-for-victim-data-in-gc.patch @@ -0,0 +1,51 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Jaegeuk Kim +Date: Tue, 21 Mar 2017 10:59:50 -0400 +Subject: f2fs: relax node version check for victim data in gc + +From: Jaegeuk Kim + + +[ Upstream commit c13ff37e359bb3eacf4e1760dcea8d9760aa7459 ] + +- has_not_enough_free_secs +node_secs: 0 dent_secs: 0 freed:0 free_segments:103 reserved:104 + + - f2fs_gc + - get_victim_by_default +alloc_mode 0, gc_mode 1, max_search 2672, offset 4654, ofs_unit 1 + + - do_garbage_collect +start_segno 3976, end_segno 3977 type 0 + + - is_alive +nid 22797, blkaddr 2131882, ofs_in_node 0, version 0x8/0x0 + + - gc_data_segment 766, segno 3976, block 512/426 not alive + +So, this patch fixes subtle corrupted case where node version does not match +to summary version which results in infinite loop by gc. + +Reported-by: Yunlei He +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/gc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -538,8 +538,10 @@ static bool is_alive(struct f2fs_sb_info + get_node_info(sbi, nid, dni); + + if (sum->version != dni->version) { +- f2fs_put_page(node_page, 1); +- return false; ++ f2fs_msg(sbi->sb, KERN_WARNING, ++ "%s: valid data with mismatched node version.", ++ __func__); ++ set_sbi_flag(sbi, SBI_NEED_FSCK); + } + + *nofs = ofs_of_node(node_page); diff --git a/queue-4.9/fm10k-correctly-check-if-interface-is-removed.patch b/queue-4.9/fm10k-correctly-check-if-interface-is-removed.patch new file mode 100644 index 00000000000..eceed7abbe1 --- /dev/null +++ b/queue-4.9/fm10k-correctly-check-if-interface-is-removed.patch @@ -0,0 +1,33 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Phil Turnbull +Date: Wed, 23 Nov 2016 13:33:58 -0500 +Subject: fm10k: correctly check if interface is removed + +From: Phil Turnbull + + +[ Upstream commit 540fca35e38d15777b310f450f63f056e63039f5 ] + +FM10K_REMOVED expects a hardware address, not a 'struct fm10k_hw'. + +Fixes: 5cb8db4a4cbc ("fm10k: Add support for VF") +Signed-off-by: Phil Turnbull +Tested-by: Krishneil Singh +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c ++++ b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c +@@ -942,7 +942,7 @@ static void fm10k_self_test(struct net_d + + memset(data, 0, sizeof(*data) * FM10K_TEST_LEN); + +- if (FM10K_REMOVED(hw)) { ++ if (FM10K_REMOVED(hw->hw_addr)) { + netif_err(interface, drv, dev, + "Interface removed - test blocked\n"); + eth_test->flags |= ETH_TEST_FL_FAILED; diff --git a/queue-4.9/hid-clamp-input-to-logical-range-if-no-null-state.patch b/queue-4.9/hid-clamp-input-to-logical-range-if-no-null-state.patch new file mode 100644 index 00000000000..458fd4ae295 --- /dev/null +++ b/queue-4.9/hid-clamp-input-to-logical-range-if-no-null-state.patch @@ -0,0 +1,80 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Tomasz Kramkowski +Date: Tue, 14 Mar 2017 13:29:13 +0000 +Subject: HID: clamp input to logical range if no null state + +From: Tomasz Kramkowski + + +[ Upstream commit c3883fe06488a483658ba5d849b70e49bee15e7c ] + +This patch fixes an issue in drivers/hid/hid-input.c where values +outside of the logical range are not clamped when "null state" bit of +the input control is not set. + +This was discussed on the lists [1] and this change stems from the fact +due to the ambiguity of the HID specification it might be appropriate to +follow Microsoft's own interpretation of the specification. As noted in +Microsoft's documentation [2] in the section titled "Required HID usages +for digitizers" it is noted that values reported outside the logical +range "will be considered as invalid data and the value will be changed +to the nearest boundary value (logical min/max)." + +This patch fixes an issue where the (1292:4745) Innomedia INNEX +GENESIS/ATARI reports out of range values for its X and Y axis of the +DPad which, due to the null state bit being unset, are forwarded to +userspace as is. Now these values will get clamped to the logical range +before being forwarded to userspace. This device was also used to test +this patch. + +This patch expands on commit 3f3752705dbd ("HID: reject input outside +logical range only if null state is set"). + +[1]: http://lkml.kernel.org/r/20170307131036.GA853@gaia.local +[2]: https://msdn.microsoft.com/en-us/library/windows/hardware/dn672278(v=vs.85).asp + +Signed-off-by: Tomasz Kramkowski +Acked-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-input.c | 21 ++++++++++++++------- + 1 file changed, 14 insertions(+), 7 deletions(-) + +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -1149,19 +1149,26 @@ void hidinput_hid_event(struct hid_devic + + /* + * Ignore out-of-range values as per HID specification, +- * section 5.10 and 6.2.25. ++ * section 5.10 and 6.2.25, when NULL state bit is present. ++ * When it's not, clamp the value to match Microsoft's input ++ * driver as mentioned in "Required HID usages for digitizers": ++ * https://msdn.microsoft.com/en-us/library/windows/hardware/dn672278(v=vs.85).asp + * + * The logical_minimum < logical_maximum check is done so that we + * don't unintentionally discard values sent by devices which + * don't specify logical min and max. + */ + if ((field->flags & HID_MAIN_ITEM_VARIABLE) && +- (field->flags & HID_MAIN_ITEM_NULL_STATE) && +- (field->logical_minimum < field->logical_maximum) && +- (value < field->logical_minimum || +- value > field->logical_maximum)) { +- dbg_hid("Ignoring out-of-range value %x\n", value); +- return; ++ (field->logical_minimum < field->logical_maximum)) { ++ if (field->flags & HID_MAIN_ITEM_NULL_STATE && ++ (value < field->logical_minimum || ++ value > field->logical_maximum)) { ++ dbg_hid("Ignoring out-of-range value %x\n", value); ++ return; ++ } ++ value = clamp(value, ++ field->logical_minimum, ++ field->logical_maximum); + } + + /* diff --git a/queue-4.9/hid-elo-clear-btn_left-mapping.patch b/queue-4.9/hid-elo-clear-btn_left-mapping.patch new file mode 100644 index 00000000000..aab9752480a --- /dev/null +++ b/queue-4.9/hid-elo-clear-btn_left-mapping.patch @@ -0,0 +1,38 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Jiri Kosina +Date: Wed, 22 Nov 2017 11:19:51 +0100 +Subject: HID: elo: clear BTN_LEFT mapping + +From: Jiri Kosina + + +[ Upstream commit 9abd04af951e5734c9d5cfee9b49790844b734cf ] + +ELO devices have one Button usage in GenDesk field, which makes hid-input map +it to BTN_LEFT; that confuses userspace, which then considers the device to be +a mouse/touchpad instead of touchscreen. + +Fix that by unmapping BTN_LEFT and keeping only BTN_TOUCH in place. + +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-elo.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/hid/hid-elo.c ++++ b/drivers/hid/hid-elo.c +@@ -42,6 +42,12 @@ static int elo_input_configured(struct h + { + struct input_dev *input = hidinput->input; + ++ /* ++ * ELO devices have one Button usage in GenDesk field, which makes ++ * hid-input map it to BTN_LEFT; that confuses userspace, which then ++ * considers the device to be a mouse/touchpad instead of touchscreen. ++ */ ++ clear_bit(BTN_LEFT, input->keybit); + set_bit(BTN_TOUCH, input->keybit); + set_bit(ABS_PRESSURE, input->absbit); + input_set_abs_params(input, ABS_PRESSURE, 0, 256, 0, 0); diff --git a/queue-4.9/hid-reject-input-outside-logical-range-only-if-null-state-is-set.patch b/queue-4.9/hid-reject-input-outside-logical-range-only-if-null-state-is-set.patch new file mode 100644 index 00000000000..d04f077bac1 --- /dev/null +++ b/queue-4.9/hid-reject-input-outside-logical-range-only-if-null-state-is-set.patch @@ -0,0 +1,38 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: "Valtteri Heikkilä" +Date: Tue, 14 Feb 2017 23:14:32 +0000 +Subject: HID: reject input outside logical range only if null state is set + +From: "Valtteri Heikkilä" + + +[ Upstream commit 3f3752705dbd50b66b66ad7b4d54fe33d2f746ed ] + +This patch fixes an issue in drivers/hid/hid-input.c where USB HID +control null state flag is not checked upon rejecting inputs outside +logical minimum-maximum range. The check should be made according to USB +HID specification 1.11, section 6.2.2.5, p.31. The fix will resolve +issues with some game controllers, such as: +https://bugzilla.kernel.org/show_bug.cgi?id=68621 + +[tk@the-tk.com: shortened and fixed spelling in commit message] +Signed-off-by: Valtteri Heikkilä +Signed-off-by: Tomasz Kramkowski +Acked-By: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-input.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -1156,6 +1156,7 @@ void hidinput_hid_event(struct hid_devic + * don't specify logical min and max. + */ + if ((field->flags & HID_MAIN_ITEM_VARIABLE) && ++ (field->flags & HID_MAIN_ITEM_NULL_STATE) && + (field->logical_minimum < field->logical_maximum) && + (value < field->logical_minimum || + value > field->logical_maximum)) { diff --git a/queue-4.9/i40e-acquire-nvm-lock-before-reads-on-all-devices.patch b/queue-4.9/i40e-acquire-nvm-lock-before-reads-on-all-devices.patch new file mode 100644 index 00000000000..26556fd5744 --- /dev/null +++ b/queue-4.9/i40e-acquire-nvm-lock-before-reads-on-all-devices.patch @@ -0,0 +1,47 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Aaron Salter +Date: Fri, 2 Dec 2016 12:33:02 -0800 +Subject: i40e: Acquire NVM lock before reads on all devices + +From: Aaron Salter + + +[ Upstream commit 96a39aed25e6559b160786117df124084feb9080 ] + +Acquire NVM lock before reads on all devices. Previously, locks were +only used for X722 and later. Fixes an issue where simultaneous X710 +NVM accesses were interfering with each other. + +Change-ID: If570bb7acf958cef58725ec2a2011cead6f80638 +Signed-off-by: Aaron Salter +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_nvm.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_nvm.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_nvm.c +@@ -292,14 +292,14 @@ i40e_status i40e_read_nvm_word(struct i4 + { + enum i40e_status_code ret_code = 0; + +- if (hw->flags & I40E_HW_FLAG_AQ_SRCTL_ACCESS_ENABLE) { +- ret_code = i40e_acquire_nvm(hw, I40E_RESOURCE_READ); +- if (!ret_code) { ++ ret_code = i40e_acquire_nvm(hw, I40E_RESOURCE_READ); ++ if (!ret_code) { ++ if (hw->flags & I40E_HW_FLAG_AQ_SRCTL_ACCESS_ENABLE) { + ret_code = i40e_read_nvm_word_aq(hw, offset, data); +- i40e_release_nvm(hw); ++ } else { ++ ret_code = i40e_read_nvm_word_srctl(hw, offset, data); + } +- } else { +- ret_code = i40e_read_nvm_word_srctl(hw, offset, data); ++ i40e_release_nvm(hw); + } + return ret_code; + } diff --git a/queue-4.9/i40e-fix-ethtool-to-get-eeprom-data-from-x722-interface.patch b/queue-4.9/i40e-fix-ethtool-to-get-eeprom-data-from-x722-interface.patch new file mode 100644 index 00000000000..df605b50e3d --- /dev/null +++ b/queue-4.9/i40e-fix-ethtool-to-get-eeprom-data-from-x722-interface.patch @@ -0,0 +1,39 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Lihong Yang +Date: Mon, 30 Jan 2017 12:29:32 -0800 +Subject: i40e: fix ethtool to get EEPROM data from X722 interface + +From: Lihong Yang + + +[ Upstream commit c271dd6c391b535226cf1a81aaad9f33cb5899d3 ] + +Currently ethtool -e will error out with a X722 interface +as its EEPROM has a scope limit at offset 0x5B9FFF. +This patch fixes the issue by setting the EEPROM length to +the scope limit to avoid NVM read failure beyond that. + +Change-ID: I0b7d4dd6c7f2a57cace438af5dffa0f44c229372 +Signed-off-by: Lihong Yang +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -1135,6 +1135,11 @@ static int i40e_get_eeprom_len(struct ne + struct i40e_hw *hw = &np->vsi->back->hw; + u32 val; + ++#define X722_EEPROM_SCOPE_LIMIT 0x5B9FFF ++ if (hw->mac.type == I40E_MAC_X722) { ++ val = X722_EEPROM_SCOPE_LIMIT + 1; ++ return val; ++ } + val = (rd32(hw, I40E_GLPCI_LBARCTRL) + & I40E_GLPCI_LBARCTRL_FL_SIZE_MASK) + >> I40E_GLPCI_LBARCTRL_FL_SIZE_SHIFT; diff --git a/queue-4.9/i40e-i40evf-fix-use-after-free-in-rx-cleanup-path.patch b/queue-4.9/i40e-i40evf-fix-use-after-free-in-rx-cleanup-path.patch new file mode 100644 index 00000000000..5a35afebee9 --- /dev/null +++ b/queue-4.9/i40e-i40evf-fix-use-after-free-in-rx-cleanup-path.patch @@ -0,0 +1,44 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Alexander Duyck +Date: Tue, 21 Feb 2017 15:55:41 -0800 +Subject: i40e/i40evf: Fix use after free in Rx cleanup path + +From: Alexander Duyck + + +[ Upstream commit 741b8b832a57402380be79d7d11a59eaf57fff3b ] + +We need to reset skb back to NULL when we have freed it in the Rx cleanup +path. I found one spot where this wasn't occurring so this patch fixes it. + +Change-ID: Iaca68934200732cd4a63eb0bd83b539c95f8c4dd +Signed-off-by: Alexander Duyck +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 1 + + drivers/net/ethernet/intel/i40evf/i40e_txrx.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -1820,6 +1820,7 @@ static int i40e_clean_rx_irq(struct i40e + */ + if (unlikely(i40e_test_staterr(rx_desc, BIT(I40E_RXD_QW1_ERROR_SHIFT)))) { + dev_kfree_skb_any(skb); ++ skb = NULL; + continue; + } + +--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c +@@ -1262,6 +1262,7 @@ static int i40e_clean_rx_irq(struct i40e + */ + if (unlikely(i40e_test_staterr(rx_desc, BIT(I40E_RXD_QW1_ERROR_SHIFT)))) { + dev_kfree_skb_any(skb); ++ skb = NULL; + continue; + } + diff --git a/queue-4.9/i40e-only-register-client-on-iwarp-capable-devices.patch b/queue-4.9/i40e-only-register-client-on-iwarp-capable-devices.patch new file mode 100644 index 00000000000..c9c89139d02 --- /dev/null +++ b/queue-4.9/i40e-only-register-client-on-iwarp-capable-devices.patch @@ -0,0 +1,60 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Mitch Williams +Date: Tue, 4 Apr 2017 12:40:16 -0700 +Subject: i40e: only register client on iWarp-capable devices + +From: Mitch Williams + + +[ Upstream commit 004eb614c4d2fcc12a98714fd887a860582f203a ] + +The client interface is only intended for use on devices that support +iWarp. Only register with the client if this is the case. + +This fixes a panic when loading i40iw on X710 devices. + +Signed-off-by: Mitch Williams +Reported-by: Stefan Assmann +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -11142,10 +11142,12 @@ static int i40e_probe(struct pci_dev *pd + round_jiffies(jiffies + pf->service_timer_period)); + + /* add this PF to client device list and launch a client service task */ +- err = i40e_lan_add_device(pf); +- if (err) +- dev_info(&pdev->dev, "Failed to add PF to client API service list: %d\n", +- err); ++ if (pf->flags & I40E_FLAG_IWARP_ENABLED) { ++ err = i40e_lan_add_device(pf); ++ if (err) ++ dev_info(&pdev->dev, "Failed to add PF to client API service list: %d\n", ++ err); ++ } + + #ifdef I40E_FCOE + /* create FCoE interface */ +@@ -11323,10 +11325,11 @@ static void i40e_remove(struct pci_dev * + i40e_vsi_release(pf->vsi[pf->lan_vsi]); + + /* remove attached clients */ +- ret_code = i40e_lan_del_device(pf); +- if (ret_code) { +- dev_warn(&pdev->dev, "Failed to delete client device: %d\n", +- ret_code); ++ if (pf->flags & I40E_FLAG_IWARP_ENABLED) { ++ ret_code = i40e_lan_del_device(pf); ++ if (ret_code) ++ dev_warn(&pdev->dev, "Failed to delete client device: %d\n", ++ ret_code); + } + + /* shutdown and destroy the HMC */ diff --git a/queue-4.9/ib-hfi1-check-for-qsfp-presence-before-attempting-reads.patch b/queue-4.9/ib-hfi1-check-for-qsfp-presence-before-attempting-reads.patch new file mode 100644 index 00000000000..86d4afae84e --- /dev/null +++ b/queue-4.9/ib-hfi1-check-for-qsfp-presence-before-attempting-reads.patch @@ -0,0 +1,42 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Easwar Hariharan +Date: Mon, 20 Mar 2017 17:25:42 -0700 +Subject: IB/hfi1: Check for QSFP presence before attempting reads + +From: Easwar Hariharan + + +[ Upstream commit fb897ad315643e5dc1092a115b3cec914b66df9d ] + +Attempting to read the status of a QSFP cable creates noise in the logs +and misses out on setting an appropriate Offline/Disabled Reason if the +cable is not plugged in. Check for this prior to attempting the read and +attendant retries. + +Fixes: 673b975f1fba ("IB/hfi1: Add QSFP sanity pre-check") +Reviewed-by: Dennis Dalessandro +Signed-off-by: Easwar Hariharan +Signed-off-by: Dennis Dalessandro +Signed-off-by: Doug Ledford +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/hfi1/chip.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/hw/hfi1/chip.c ++++ b/drivers/infiniband/hw/hfi1/chip.c +@@ -9489,8 +9489,11 @@ static int test_qsfp_read(struct hfi1_pp + int ret; + u8 status; + +- /* report success if not a QSFP */ +- if (ppd->port_type != PORT_TYPE_QSFP) ++ /* ++ * Report success if not a QSFP or, if it is a QSFP, but the cable is ++ * not present ++ */ ++ if (ppd->port_type != PORT_TYPE_QSFP || !qsfp_mod_present(ppd)) + return 0; + + /* read byte 2, the status byte */ diff --git a/queue-4.9/ima-relax-requiring-a-file-signature-for-new-files-with-zero-length.patch b/queue-4.9/ima-relax-requiring-a-file-signature-for-new-files-with-zero-length.patch new file mode 100644 index 00000000000..91a863773cd --- /dev/null +++ b/queue-4.9/ima-relax-requiring-a-file-signature-for-new-files-with-zero-length.patch @@ -0,0 +1,43 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Mimi Zohar +Date: Wed, 8 Nov 2017 07:38:28 -0500 +Subject: ima: relax requiring a file signature for new files with zero length + +From: Mimi Zohar + + +[ Upstream commit b7e27bc1d42e8e0cc58b602b529c25cd0071b336 ] + +Custom policies can require file signatures based on LSM labels. These +files are normally created and only afterwards labeled, requiring them +to be signed. + +Instead of requiring file signatures based on LSM labels, entire +filesystems could require file signatures. In this case, we need the +ability of writing new files without requiring file signatures. + +The definition of a "new" file was originally defined as any file with +a length of zero. Subsequent patches redefined a "new" file to be based +on the FILE_CREATE open flag. By combining the open flag with a file +size of zero, this patch relaxes the file signature requirement. + +Fixes: 1ac202e978e1 ima: accept previously set IMA_NEW_FILE +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + security/integrity/ima/ima_appraise.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/security/integrity/ima/ima_appraise.c ++++ b/security/integrity/ima/ima_appraise.c +@@ -207,7 +207,8 @@ int ima_appraise_measurement(enum ima_ho + if (opened & FILE_CREATED) + iint->flags |= IMA_NEW_FILE; + if ((iint->flags & IMA_NEW_FILE) && +- !(iint->flags & IMA_DIGSIG_REQUIRED)) ++ (!(iint->flags & IMA_DIGSIG_REQUIRED) || ++ (inode->i_size == 0))) + status = INTEGRITY_PASS; + goto out; + } diff --git a/queue-4.9/input-qt1070-add-of-device-id-table.patch b/queue-4.9/input-qt1070-add-of-device-id-table.patch new file mode 100644 index 00000000000..acf2f32c1ea --- /dev/null +++ b/queue-4.9/input-qt1070-add-of-device-id-table.patch @@ -0,0 +1,50 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Javier Martinez Canillas +Date: Thu, 23 Mar 2017 13:33:12 -0700 +Subject: Input: qt1070 - add OF device ID table + +From: Javier Martinez Canillas + + +[ Upstream commit cf5cd9d4480a87da78768718cac194a71079b5cb ] + +The driver doesn't have a struct of_device_id table but supported devices +are registered via Device Trees. This is working on the assumption that a +I2C device registered via OF will always match a legacy I2C device ID and +that the MODALIAS reported will always be of the form i2c:. + +But this could change in the future so the correct approach is to have an +OF device ID table if the devices are registered via OF. + +The compatible strings don't have a vendor prefix because that's how it's +used currently, and changing this will be a Device Tree ABI break. + +Signed-off-by: Javier Martinez Canillas +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/keyboard/qt1070.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/input/keyboard/qt1070.c ++++ b/drivers/input/keyboard/qt1070.c +@@ -274,9 +274,18 @@ static const struct i2c_device_id qt1070 + }; + MODULE_DEVICE_TABLE(i2c, qt1070_id); + ++#ifdef CONFIG_OF ++static const struct of_device_id qt1070_of_match[] = { ++ { .compatible = "qt1070", }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(of, qt1070_of_match); ++#endif ++ + static struct i2c_driver qt1070_driver = { + .driver = { + .name = "qt1070", ++ .of_match_table = of_match_ptr(qt1070_of_match), + .pm = &qt1070_pm_ops, + }, + .id_table = qt1070_id, diff --git a/queue-4.9/input-tsc2007-check-for-presence-and-power-down-tsc2007-during-probe.patch b/queue-4.9/input-tsc2007-check-for-presence-and-power-down-tsc2007-during-probe.patch new file mode 100644 index 00000000000..8d8aa980ca9 --- /dev/null +++ b/queue-4.9/input-tsc2007-check-for-presence-and-power-down-tsc2007-during-probe.patch @@ -0,0 +1,38 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: "H. Nikolaus Schaller" +Date: Fri, 17 Feb 2017 12:51:19 -0800 +Subject: Input: tsc2007 - check for presence and power down tsc2007 during probe + +From: "H. Nikolaus Schaller" + + +[ Upstream commit 934df23171e7c5b71d937104d4957891c39748ff ] + +1. check if chip is really present and don't succeed if it isn't. +2. if it succeeds, power down the chip until accessed + +Signed-off-by: H. Nikolaus Schaller +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/touchscreen/tsc2007.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/input/touchscreen/tsc2007.c ++++ b/drivers/input/touchscreen/tsc2007.c +@@ -455,6 +455,14 @@ static int tsc2007_probe(struct i2c_clie + + tsc2007_stop(ts); + ++ /* power down the chip (TSC2007_SETUP does not ACK on I2C) */ ++ err = tsc2007_xfer(ts, PWRDOWN); ++ if (err < 0) { ++ dev_err(&client->dev, ++ "Failed to setup chip: %d\n", err); ++ return err; /* usually, chip does not respond */ ++ } ++ + err = input_register_device(input_dev); + if (err) { + dev_err(&client->dev, diff --git a/queue-4.9/iommu-iova-fix-underflow-bug-in-__alloc_and_insert_iova_range.patch b/queue-4.9/iommu-iova-fix-underflow-bug-in-__alloc_and_insert_iova_range.patch new file mode 100644 index 00000000000..5434edddaec --- /dev/null +++ b/queue-4.9/iommu-iova-fix-underflow-bug-in-__alloc_and_insert_iova_range.patch @@ -0,0 +1,68 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Nate Watterson +Date: Fri, 7 Apr 2017 01:36:20 -0400 +Subject: iommu/iova: Fix underflow bug in __alloc_and_insert_iova_range + +From: Nate Watterson + + +[ Upstream commit 5016bdb796b3726eec043ca0ce3be981f712c756 ] + +Normally, calling alloc_iova() using an iova_domain with insufficient +pfns remaining between start_pfn and dma_limit will fail and return a +NULL pointer. Unexpectedly, if such a "full" iova_domain contains an +iova with pfn_lo == 0, the alloc_iova() call will instead succeed and +return an iova containing invalid pfns. + +This is caused by an underflow bug in __alloc_and_insert_iova_range() +that occurs after walking the "full" iova tree when the search ends +at the iova with pfn_lo == 0 and limit_pfn is then adjusted to be just +below that (-1). This (now huge) limit_pfn gives the impression that a +vast amount of space is available between it and start_pfn and thus +a new iova is allocated with the invalid pfn_hi value, 0xFFF.... . + +To rememdy this, a check is introduced to ensure that adjustments to +limit_pfn will not underflow. + +This issue has been observed in the wild, and is easily reproduced with +the following sample code. + + struct iova_domain *iovad = kzalloc(sizeof(*iovad), GFP_KERNEL); + struct iova *rsvd_iova, *good_iova, *bad_iova; + unsigned long limit_pfn = 3; + unsigned long start_pfn = 1; + unsigned long va_size = 2; + + init_iova_domain(iovad, SZ_4K, start_pfn, limit_pfn); + rsvd_iova = reserve_iova(iovad, 0, 0); + good_iova = alloc_iova(iovad, va_size, limit_pfn, true); + bad_iova = alloc_iova(iovad, va_size, limit_pfn, true); + +Prior to the patch, this yielded: + *rsvd_iova == {0, 0} /* Expected */ + *good_iova == {2, 3} /* Expected */ + *bad_iova == {-2, -1} /* Oh no... */ + +After the patch, bad_iova is NULL as expected since inadequate +space remains between limit_pfn and start_pfn after allocating +good_iova. + +Signed-off-by: Nate Watterson +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iommu/iova.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iommu/iova.c ++++ b/drivers/iommu/iova.c +@@ -138,7 +138,7 @@ static int __alloc_and_insert_iova_range + break; /* found a free slot */ + } + adjust_limit_pfn: +- limit_pfn = curr_iova->pfn_lo - 1; ++ limit_pfn = curr_iova->pfn_lo ? (curr_iova->pfn_lo - 1) : 0; + move_left: + prev = curr; + curr = rb_prev(curr); diff --git a/queue-4.9/ipvlan-add-l2-check-for-packets-arriving-via-virtual-devices.patch b/queue-4.9/ipvlan-add-l2-check-for-packets-arriving-via-virtual-devices.patch new file mode 100644 index 00000000000..4a56b47cab0 --- /dev/null +++ b/queue-4.9/ipvlan-add-l2-check-for-packets-arriving-via-virtual-devices.patch @@ -0,0 +1,55 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Mahesh Bandewar +Date: Thu, 7 Dec 2017 15:15:43 -0800 +Subject: ipvlan: add L2 check for packets arriving via virtual devices + +From: Mahesh Bandewar + + +[ Upstream commit 92ff42645028fa6f9b8aa767718457b9264316b4 ] + +Packets that don't have dest mac as the mac of the master device should +not be entertained by the IPvlan rx-handler. This is mostly true as the +packet path mostly takes care of that, except when the master device is +a virtual device. As demonstrated in the following case - + + ip netns add ns1 + ip link add ve1 type veth peer name ve2 + ip link add link ve2 name iv1 type ipvlan mode l2 + ip link set dev iv1 netns ns1 + ip link set ve1 up + ip link set ve2 up + ip -n ns1 link set iv1 up + ip addr add 192.168.10.1/24 dev ve1 + ip -n ns1 addr 192.168.10.2/24 dev iv1 + ping -c2 192.168.10.2 + + ip neigh show dev ve1 + ip neigh show 192.168.10.2 lladdr dev ve1 + ping -c2 192.168.10.2 + + +This patch adds that missing check in the IPvlan rx-handler. + +Reported-by: Amit Sikka +Signed-off-by: Mahesh Bandewar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ipvlan/ipvlan_core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/ipvlan/ipvlan_core.c ++++ b/drivers/net/ipvlan/ipvlan_core.c +@@ -299,6 +299,10 @@ static int ipvlan_rcv_frame(struct ipvl_ + if (dev_forward_skb(ipvlan->dev, skb) == NET_RX_SUCCESS) + success = true; + } else { ++ if (!ether_addr_equal_64bits(eth_hdr(skb)->h_dest, ++ ipvlan->phy_dev->dev_addr)) ++ skb->pkt_type = PACKET_OTHERHOST; ++ + ret = RX_HANDLER_ANOTHER; + success = true; + } diff --git a/queue-4.9/iwlwifi-mvm-fix-rx-skb-header-size-and-align-it-properly.patch b/queue-4.9/iwlwifi-mvm-fix-rx-skb-header-size-and-align-it-properly.patch new file mode 100644 index 00000000000..d3907391398 --- /dev/null +++ b/queue-4.9/iwlwifi-mvm-fix-rx-skb-header-size-and-align-it-properly.patch @@ -0,0 +1,62 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Johannes Berg +Date: Wed, 14 Dec 2016 13:48:04 +0100 +Subject: iwlwifi: mvm: fix RX SKB header size and align it properly + +From: Johannes Berg + + +[ Upstream commit 5cddd05c9cbe420436799716d009bc0372ef8268 ] + +When receiving a frame, we currently pull in sizeof(*hdr) plus +some extra (crypto/snap), which is too much, most headers aren't +actually sizeof(*hdr) since that takes into account the 4-address +format but doesn't take into account QoS. As a result, a typical +frame will have 4 bytes of the payload in the SKB header already. + +Fix this by calculating the correct header length, and now that +we have that, align the end of the SKB header to a multiple of 4 +so that the IP header will be aligned properly when pulled in. + +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c +@@ -104,7 +104,20 @@ static void iwl_mvm_pass_packet_to_mac80 + u8 crypt_len, + struct iwl_rx_cmd_buffer *rxb) + { +- unsigned int hdrlen, fraglen; ++ unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control); ++ unsigned int fraglen; ++ ++ /* ++ * The 'hdrlen' (plus the 8 bytes for the SNAP and the crypt_len, ++ * but those are all multiples of 4 long) all goes away, but we ++ * want the *end* of it, which is going to be the start of the IP ++ * header, to be aligned when it gets pulled in. ++ * The beginning of the skb->data is aligned on at least a 4-byte ++ * boundary after allocation. Everything here is aligned at least ++ * on a 2-byte boundary so we can just take hdrlen & 3 and pad by ++ * the result. ++ */ ++ skb_reserve(skb, hdrlen & 3); + + /* If frame is small enough to fit in skb->head, pull it completely. + * If not, only pull ieee80211_hdr (including crypto if present, and +@@ -118,8 +131,7 @@ static void iwl_mvm_pass_packet_to_mac80 + * If the latter changes (there are efforts in the standards group + * to do so) we should revisit this and ieee80211_data_to_8023(). + */ +- hdrlen = (len <= skb_tailroom(skb)) ? len : +- sizeof(*hdr) + crypt_len + 8; ++ hdrlen = (len <= skb_tailroom(skb)) ? len : hdrlen + crypt_len + 8; + + memcpy(skb_put(skb, hdrlen), hdr, hdrlen); + fraglen = len - hdrlen; diff --git a/queue-4.9/iwlwifi-mvm-rs-don-t-override-the-rate-history-in-the-search-cycle.patch b/queue-4.9/iwlwifi-mvm-rs-don-t-override-the-rate-history-in-the-search-cycle.patch new file mode 100644 index 00000000000..84e5b5f9d4d --- /dev/null +++ b/queue-4.9/iwlwifi-mvm-rs-don-t-override-the-rate-history-in-the-search-cycle.patch @@ -0,0 +1,59 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Emmanuel Grumbach +Date: Thu, 19 Oct 2017 21:36:04 +0300 +Subject: iwlwifi: mvm: rs: don't override the rate history in the search cycle + +From: Emmanuel Grumbach + + +[ Upstream commit 992172e3aec19e5b0ea5b757ba40a146b9282d1e ] + +When we are in a search cycle, we try different combinations +of parameters. Those combinations are called 'columns'. +When we switch to a new column, we first need to check if +this column has a suitable rate, if not, we can't try it. +This means we must not erase the statistics we gathered +for the previous column until we are sure that we are +indeed switching column. + +The code that tries to switch to a new column first sets +a whole bunch of things for the new column, and only then +checks that we can find suitable rates in that column. +While doing that, the code mistakenly erased the rate +statistics. This code was right until +struct iwl_scale_tbl_info grew up for TPC. + +Fix this to make sure we don't erase the rate statistics +until we are sure that we can indeed switch to the new +column. + +Note that this bug is really harmless since it causes a +change in the behavior only when we can't find any rate +in the new column which should really not happen. In the +case we do find a suitable we reset the rate statistics +a few lines later anyway. + +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c +@@ -1867,12 +1867,10 @@ static int rs_switch_to_column(struct iw + struct rs_rate *rate = &search_tbl->rate; + const struct rs_tx_column *column = &rs_tx_columns[col_id]; + const struct rs_tx_column *curr_column = &rs_tx_columns[tbl->column]; +- u32 sz = (sizeof(struct iwl_scale_tbl_info) - +- (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT)); + unsigned long rate_mask = 0; + u32 rate_idx = 0; + +- memcpy(search_tbl, tbl, sz); ++ memcpy(search_tbl, tbl, offsetof(struct iwl_scale_tbl_info, win)); + + rate->sgi = column->sgi; + rate->ant = column->ant; diff --git a/queue-4.9/kprobes-x86-fix-kprobe-booster-not-to-boost-far-call-instructions.patch b/queue-4.9/kprobes-x86-fix-kprobe-booster-not-to-boost-far-call-instructions.patch new file mode 100644 index 00000000000..e6397df1a66 --- /dev/null +++ b/queue-4.9/kprobes-x86-fix-kprobe-booster-not-to-boost-far-call-instructions.patch @@ -0,0 +1,52 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Masami Hiramatsu +Date: Wed, 29 Mar 2017 13:56:56 +0900 +Subject: kprobes/x86: Fix kprobe-booster not to boost far call instructions + +From: Masami Hiramatsu + + +[ Upstream commit bd0b90676c30fe640e7ead919b3e38846ac88ab7 ] + +Fix the kprobe-booster not to boost far call instruction, +because a call may store the address in the single-step +execution buffer to the stack, which should be modified +after single stepping. + +Currently, this instruction will be filtered as not +boostable in resume_execution(), so this is not a +critical issue. + +Signed-off-by: Masami Hiramatsu +Cc: Ananth N Mavinakayanahalli +Cc: Andrey Ryabinin +Cc: Anil S Keshavamurthy +Cc: Borislav Petkov +Cc: Brian Gerst +Cc: David S . Miller +Cc: Denys Vlasenko +Cc: H. Peter Anvin +Cc: Josh Poimboeuf +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Ye Xiaolong +Link: http://lkml.kernel.org/r/149076340615.22469.14066273186134229909.stgit@devbox +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/kprobes/core.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/x86/kernel/kprobes/core.c ++++ b/arch/x86/kernel/kprobes/core.c +@@ -199,6 +199,8 @@ retry: + return (opcode != 0x62 && opcode != 0x67); + case 0x70: + return 0; /* can't boost conditional jump */ ++ case 0x90: ++ return opcode != 0x9a; /* can't boost call far */ + case 0xc0: + /* can't boost software-interruptions */ + return (0xc1 < opcode && opcode < 0xcc) || opcode == 0xcf; diff --git a/queue-4.9/kprobes-x86-set-kprobes-pages-read-only.patch b/queue-4.9/kprobes-x86-set-kprobes-pages-read-only.patch new file mode 100644 index 00000000000..4985ec3f14a --- /dev/null +++ b/queue-4.9/kprobes-x86-set-kprobes-pages-read-only.patch @@ -0,0 +1,89 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Masami Hiramatsu +Date: Wed, 29 Mar 2017 14:02:46 +0900 +Subject: kprobes/x86: Set kprobes pages read-only + +From: Masami Hiramatsu + + +[ Upstream commit d0381c81c2f782fa2131178d11e0cfb23d50d631 ] + +Set the pages which is used for kprobes' singlestep buffer +and optprobe's trampoline instruction buffer to readonly. +This can prevent unexpected (or unintended) instruction +modification. + +This also passes rodata_test as below. + +Without this patch, rodata_test shows a warning: + + WARNING: CPU: 0 PID: 1 at arch/x86/mm/dump_pagetables.c:235 note_page+0x7a9/0xa20 + x86/mm: Found insecure W+X mapping at address ffffffffa0000000/0xffffffffa0000000 + +With this fix, no W+X pages are found: + + x86/mm: Checked W+X mappings: passed, no W+X pages found. + rodata_test: all tests were successful + +Reported-by: Andrey Ryabinin +Signed-off-by: Masami Hiramatsu +Cc: Ananth N Mavinakayanahalli +Cc: Anil S Keshavamurthy +Cc: Borislav Petkov +Cc: Brian Gerst +Cc: David S . Miller +Cc: Denys Vlasenko +Cc: H. Peter Anvin +Cc: Josh Poimboeuf +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Ye Xiaolong +Link: http://lkml.kernel.org/r/149076375592.22469.14174394514338612247.stgit@devbox +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/kprobes/core.c | 4 ++++ + arch/x86/kernel/kprobes/opt.c | 3 +++ + 2 files changed, 7 insertions(+) + +--- a/arch/x86/kernel/kprobes/core.c ++++ b/arch/x86/kernel/kprobes/core.c +@@ -409,6 +409,8 @@ static int arch_copy_kprobe(struct kprob + { + int ret; + ++ set_memory_rw((unsigned long)p->ainsn.insn & PAGE_MASK, 1); ++ + /* Copy an instruction with recovering if other optprobe modifies it.*/ + ret = __copy_instruction(p->ainsn.insn, p->addr); + if (!ret) +@@ -423,6 +425,8 @@ static int arch_copy_kprobe(struct kprob + else + p->ainsn.boostable = -1; + ++ set_memory_ro((unsigned long)p->ainsn.insn & PAGE_MASK, 1); ++ + /* Check whether the instruction modifies Interrupt Flag or not */ + p->ainsn.if_modifier = is_IF_modifier(p->ainsn.insn); + +--- a/arch/x86/kernel/kprobes/opt.c ++++ b/arch/x86/kernel/kprobes/opt.c +@@ -371,6 +371,7 @@ int arch_prepare_optimized_kprobe(struct + } + + buf = (u8 *)op->optinsn.insn; ++ set_memory_rw((unsigned long)buf & PAGE_MASK, 1); + + /* Copy instructions into the out-of-line buffer */ + ret = copy_optimized_instructions(buf + TMPL_END_IDX, op->kp.addr); +@@ -393,6 +394,8 @@ int arch_prepare_optimized_kprobe(struct + synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size, + (u8 *)op->kp.addr + op->optinsn.size); + ++ set_memory_ro((unsigned long)buf & PAGE_MASK, 1); ++ + flush_icache_range((unsigned long) buf, + (unsigned long) buf + TMPL_END_IDX + + op->optinsn.size + RELATIVEJUMP_SIZE); diff --git a/queue-4.9/kvm-nvmx-disallow-userspace-injected-exceptions-in-guest-mode.patch b/queue-4.9/kvm-nvmx-disallow-userspace-injected-exceptions-in-guest-mode.patch new file mode 100644 index 00000000000..911accab0ab --- /dev/null +++ b/queue-4.9/kvm-nvmx-disallow-userspace-injected-exceptions-in-guest-mode.patch @@ -0,0 +1,65 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Jim Mattson +Date: Wed, 5 Apr 2017 09:14:40 -0700 +Subject: kvm: nVMX: Disallow userspace-injected exceptions in guest mode + +From: Jim Mattson + + +[ Upstream commit 28d06353881939703c34d82a1465136af176c620 ] + +The userspace exception injection API and code path are entirely +unprepared for exceptions that might cause a VM-exit from L2 to L1, so +the best course of action may be to simply disallow this for now. + +1. The API provides no mechanism for userspace to specify the new DR6 +bits for a #DB exception or the new CR2 value for a #PF +exception. Presumably, userspace is expected to modify these registers +directly with KVM_SET_SREGS before the next KVM_RUN ioctl. However, in +the event that L1 intercepts the exception, these registers should not +be changed. Instead, the new values should be provided in the +exit_qualification field of vmcs12 (Intel SDM vol 3, section 27.1). + +2. In the case of a userspace-injected #DB, inject_pending_event() +clears DR7.GD before calling vmx_queue_exception(). However, in the +event that L1 intercepts the exception, this is too early, because +DR7.GD should not be modified by a #DB that causes a VM-exit directly +(Intel SDM vol 3, section 27.1). + +3. If the injected exception is a #PF, nested_vmx_check_exception() +doesn't properly check whether or not L1 is interested in the +associated error code (using the #PF error code mask and match fields +from vmcs12). It may either return 0 when it should call +nested_vmx_vmexit() or vice versa. + +4. nested_vmx_check_exception() assumes that it is dealing with a +hardware-generated exception intercept from L2, with some of the +relevant details (the VM-exit interruption-information and the exit +qualification) live in vmcs02. For userspace-injected exceptions, this +is not the case. + +5. prepare_vmcs12() assumes that when its exit_intr_info argument +specifies valid information with a valid error code that it can VMREAD +the VM-exit interruption error code from vmcs02. For +userspace-injected exceptions, this is not the case. + +Signed-off-by: Jim Mattson +Signed-off-by: Radim Krčmář +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/x86.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -3070,7 +3070,8 @@ static int kvm_vcpu_ioctl_x86_set_vcpu_e + return -EINVAL; + + if (events->exception.injected && +- (events->exception.nr > 31 || events->exception.nr == NMI_VECTOR)) ++ (events->exception.nr > 31 || events->exception.nr == NMI_VECTOR || ++ is_guest_mode(vcpu))) + return -EINVAL; + + /* INITs are latched while in SMM */ diff --git a/queue-4.9/kvm-svm-setup-mcg_cap-on-amd-properly.patch b/queue-4.9/kvm-svm-setup-mcg_cap-on-amd-properly.patch new file mode 100644 index 00000000000..b7b250b9af8 --- /dev/null +++ b/queue-4.9/kvm-svm-setup-mcg_cap-on-amd-properly.patch @@ -0,0 +1,49 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Borislav Petkov +Date: Sun, 26 Mar 2017 23:51:24 +0200 +Subject: kvm/svm: Setup MCG_CAP on AMD properly + +From: Borislav Petkov + + +[ Upstream commit 74f169090b6f36b867c9df0454366dd9af6f62d1 ] + +MCG_CAP[63:9] bits are reserved on AMD. However, on an AMD guest, this +MSR returns 0x100010a. More specifically, bit 24 is set, which is simply +wrong. That bit is MCG_SER_P and is present only on Intel. Thus, clean +up the reserved bits in order not to confuse guests. + +Signed-off-by: Borislav Petkov +Cc: Joerg Roedel +Cc: Paolo Bonzini +Cc: Radim Krčmář +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/svm.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -5449,6 +5449,12 @@ static inline void avic_post_state_resto + avic_handle_ldr_update(vcpu); + } + ++static void svm_setup_mce(struct kvm_vcpu *vcpu) ++{ ++ /* [63:9] are reserved. */ ++ vcpu->arch.mcg_cap &= 0x1ff; ++} ++ + static struct kvm_x86_ops svm_x86_ops __ro_after_init = { + .cpu_has_kvm_support = has_svm, + .disabled_by_bios = is_disabled, +@@ -5564,6 +5570,7 @@ static struct kvm_x86_ops svm_x86_ops __ + .pmu_ops = &amd_pmu_ops, + .deliver_posted_interrupt = svm_deliver_avic_intr, + .update_pi_irte = svm_update_pi_irte, ++ .setup_mce = svm_setup_mce, + }; + + static int __init svm_init(void) diff --git a/queue-4.9/leds-pm8058-silence-pointer-to-integer-size-warning.patch b/queue-4.9/leds-pm8058-silence-pointer-to-integer-size-warning.patch new file mode 100644 index 00000000000..bd15219be48 --- /dev/null +++ b/queue-4.9/leds-pm8058-silence-pointer-to-integer-size-warning.patch @@ -0,0 +1,39 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Bjorn Andersson +Date: Thu, 30 Nov 2017 21:16:56 -0800 +Subject: leds: pm8058: Silence pointer to integer size warning + +From: Bjorn Andersson + + +[ Upstream commit 8f52df50d9366f770a894d14ef724e5e04574e98 ] + +The pointer returned by of_device_get_match_data() doesn't have the same +size as u32 on 64-bit architectures, causing a compile warning when +compile-testing the driver on such platform. + +Cast the return value of of_device_get_match_data() to unsigned long and +then to u32 to silence this warning. + +Fixes: 7f866986e705 ("leds: add PM8058 LEDs driver") +Signed-off-by: Bjorn Andersson +Reviewed-by: Linus Walleij +Acked-by: Pavel Machek +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/leds/leds-pm8058.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/leds/leds-pm8058.c ++++ b/drivers/leds/leds-pm8058.c +@@ -106,7 +106,7 @@ static int pm8058_led_probe(struct platf + if (!led) + return -ENOMEM; + +- led->ledtype = (u32)of_device_get_match_data(&pdev->dev); ++ led->ledtype = (u32)(unsigned long)of_device_get_match_data(&pdev->dev); + + map = dev_get_regmap(pdev->dev.parent, NULL); + if (!map) { diff --git a/queue-4.9/lkdtm-turn-off-kcov-for-lkdtm_rodata_do_nothing.patch b/queue-4.9/lkdtm-turn-off-kcov-for-lkdtm_rodata_do_nothing.patch new file mode 100644 index 00000000000..baa7e415991 --- /dev/null +++ b/queue-4.9/lkdtm-turn-off-kcov-for-lkdtm_rodata_do_nothing.patch @@ -0,0 +1,49 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Arnd Bergmann +Date: Tue, 28 Mar 2017 11:57:27 +0200 +Subject: lkdtm: turn off kcov for lkdtm_rodata_do_nothing: + +From: Arnd Bergmann + + +[ Upstream commit 7064dc7fc13b2994d33ae540ffb7a3a05ac463bf ] + +I ran into a link error on ARM64 for lkdtm_rodata_do_nothing: + +drivers/misc/built-in.o: In function `lkdtm_rodata_do_nothing': +:(.rodata+0x68c8): relocation truncated to fit: R_AARCH64_CALL26 against symbol `__sanitizer_cov_trace_pc' defined in .text section in kernel/built-in.o + +I did not analyze this further, but my theory is that we would need a trampoline +to call __sanitizer_cov_trace_pc(), but the linker (correctly) only adds trampolines +for callers in executable sections. + +Disabling KCOV for this one file avoids the build failure with no +other practical downsides I can think of. + +The problem can only happen on kernels that contain both kcov and +lkdtm, so if we want to backport this, it should be in the earliest +version that has both (v4.8). + +Fixes: 5c9a8750a640 ("kernel: add kcov code coverage") +Fixes: 9a49a528dcf3 ("lkdtm: add function for testing .rodata section") +Signed-off-by: Arnd Bergmann +Acked-by: Dmitry Vyukov +Acked-by: Kees Cook +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/Makefile | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/misc/Makefile ++++ b/drivers/misc/Makefile +@@ -61,6 +61,8 @@ lkdtm-$(CONFIG_LKDTM) += lkdtm_perms.o + lkdtm-$(CONFIG_LKDTM) += lkdtm_rodata_objcopy.o + lkdtm-$(CONFIG_LKDTM) += lkdtm_usercopy.o + ++KCOV_INSTRUMENT_lkdtm_rodata.o := n ++ + OBJCOPYFLAGS := + OBJCOPYFLAGS_lkdtm_rodata_objcopy.o := \ + --set-section-flags .text=alloc,readonly \ diff --git a/queue-4.9/locking-locktorture-fix-num-reader-writer-corner-cases.patch b/queue-4.9/locking-locktorture-fix-num-reader-writer-corner-cases.patch new file mode 100644 index 00000000000..05c07b3be11 --- /dev/null +++ b/queue-4.9/locking-locktorture-fix-num-reader-writer-corner-cases.patch @@ -0,0 +1,146 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Davidlohr Bueso +Date: Mon, 15 May 2017 02:07:23 -0700 +Subject: locking/locktorture: Fix num reader/writer corner cases + +From: Davidlohr Bueso + + +[ Upstream commit 2ce77d16db4240dd2e422fc0a5c26d3e2ec03446 ] + +Things can explode for locktorture if the user does combinations +of nwriters_stress=0 nreaders_stress=0. Fix this by not assuming +we always want to torture writer threads. + +Reported-by: Jeremy Linton +Signed-off-by: Davidlohr Bueso +Signed-off-by: Paul E. McKenney +Reviewed-by: Jeremy Linton +Tested-by: Jeremy Linton +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/locking/locktorture.c | 76 ++++++++++++++++++++++++------------------- + 1 file changed, 44 insertions(+), 32 deletions(-) + +--- a/kernel/locking/locktorture.c ++++ b/kernel/locking/locktorture.c +@@ -641,8 +641,7 @@ static void __torture_print_stats(char * + { + bool fail = 0; + int i, n_stress; +- long max = 0; +- long min = statp[0].n_lock_acquired; ++ long max = 0, min = statp ? statp[0].n_lock_acquired : 0; + long long sum = 0; + + n_stress = write ? cxt.nrealwriters_stress : cxt.nrealreaders_stress; +@@ -749,7 +748,7 @@ static void lock_torture_cleanup(void) + * such, only perform the underlying torture-specific cleanups, + * and avoid anything related to locktorture. + */ +- if (!cxt.lwsa) ++ if (!cxt.lwsa && !cxt.lrsa) + goto end; + + if (writer_tasks) { +@@ -823,6 +822,13 @@ static int __init lock_torture_init(void + firsterr = -EINVAL; + goto unwind; + } ++ ++ if (nwriters_stress == 0 && nreaders_stress == 0) { ++ pr_alert("lock-torture: must run at least one locking thread\n"); ++ firsterr = -EINVAL; ++ goto unwind; ++ } ++ + if (cxt.cur_ops->init) + cxt.cur_ops->init(); + +@@ -846,17 +852,19 @@ static int __init lock_torture_init(void + #endif + + /* Initialize the statistics so that each run gets its own numbers. */ ++ if (nwriters_stress) { ++ lock_is_write_held = 0; ++ cxt.lwsa = kmalloc(sizeof(*cxt.lwsa) * cxt.nrealwriters_stress, GFP_KERNEL); ++ if (cxt.lwsa == NULL) { ++ VERBOSE_TOROUT_STRING("cxt.lwsa: Out of memory"); ++ firsterr = -ENOMEM; ++ goto unwind; ++ } + +- lock_is_write_held = 0; +- cxt.lwsa = kmalloc(sizeof(*cxt.lwsa) * cxt.nrealwriters_stress, GFP_KERNEL); +- if (cxt.lwsa == NULL) { +- VERBOSE_TOROUT_STRING("cxt.lwsa: Out of memory"); +- firsterr = -ENOMEM; +- goto unwind; +- } +- for (i = 0; i < cxt.nrealwriters_stress; i++) { +- cxt.lwsa[i].n_lock_fail = 0; +- cxt.lwsa[i].n_lock_acquired = 0; ++ for (i = 0; i < cxt.nrealwriters_stress; i++) { ++ cxt.lwsa[i].n_lock_fail = 0; ++ cxt.lwsa[i].n_lock_acquired = 0; ++ } + } + + if (cxt.cur_ops->readlock) { +@@ -873,19 +881,21 @@ static int __init lock_torture_init(void + cxt.nrealreaders_stress = cxt.nrealwriters_stress; + } + +- lock_is_read_held = 0; +- cxt.lrsa = kmalloc(sizeof(*cxt.lrsa) * cxt.nrealreaders_stress, GFP_KERNEL); +- if (cxt.lrsa == NULL) { +- VERBOSE_TOROUT_STRING("cxt.lrsa: Out of memory"); +- firsterr = -ENOMEM; +- kfree(cxt.lwsa); +- cxt.lwsa = NULL; +- goto unwind; +- } +- +- for (i = 0; i < cxt.nrealreaders_stress; i++) { +- cxt.lrsa[i].n_lock_fail = 0; +- cxt.lrsa[i].n_lock_acquired = 0; ++ if (nreaders_stress) { ++ lock_is_read_held = 0; ++ cxt.lrsa = kmalloc(sizeof(*cxt.lrsa) * cxt.nrealreaders_stress, GFP_KERNEL); ++ if (cxt.lrsa == NULL) { ++ VERBOSE_TOROUT_STRING("cxt.lrsa: Out of memory"); ++ firsterr = -ENOMEM; ++ kfree(cxt.lwsa); ++ cxt.lwsa = NULL; ++ goto unwind; ++ } ++ ++ for (i = 0; i < cxt.nrealreaders_stress; i++) { ++ cxt.lrsa[i].n_lock_fail = 0; ++ cxt.lrsa[i].n_lock_acquired = 0; ++ } + } + } + +@@ -915,12 +925,14 @@ static int __init lock_torture_init(void + goto unwind; + } + +- writer_tasks = kzalloc(cxt.nrealwriters_stress * sizeof(writer_tasks[0]), +- GFP_KERNEL); +- if (writer_tasks == NULL) { +- VERBOSE_TOROUT_ERRSTRING("writer_tasks: Out of memory"); +- firsterr = -ENOMEM; +- goto unwind; ++ if (nwriters_stress) { ++ writer_tasks = kzalloc(cxt.nrealwriters_stress * sizeof(writer_tasks[0]), ++ GFP_KERNEL); ++ if (writer_tasks == NULL) { ++ VERBOSE_TOROUT_ERRSTRING("writer_tasks: Out of memory"); ++ firsterr = -ENOMEM; ++ goto unwind; ++ } + } + + if (cxt.cur_ops->readlock) { diff --git a/queue-4.9/mac80211-remove-bug-when-interface-type-is-invalid.patch b/queue-4.9/mac80211-remove-bug-when-interface-type-is-invalid.patch new file mode 100644 index 00000000000..1aadb662675 --- /dev/null +++ b/queue-4.9/mac80211-remove-bug-when-interface-type-is-invalid.patch @@ -0,0 +1,36 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Luca Coelho +Date: Sun, 29 Oct 2017 11:51:10 +0200 +Subject: mac80211: remove BUG() when interface type is invalid + +From: Luca Coelho + + +[ Upstream commit c7976f5272486e4ff406014c4b43e2fa3b70b052 ] + +In the ieee80211_setup_sdata() we check if the interface type is valid +and, if not, call BUG(). This should never happen, but if there is +something wrong with the code, it will not be caught until the bug +happens when an interface is being set up. Calling BUG() is too +extreme for this and a WARN_ON() would be better used instead. Change +that. + +Signed-off-by: Luca Coelho +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/mac80211/iface.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -1520,7 +1520,7 @@ static void ieee80211_setup_sdata(struct + break; + case NL80211_IFTYPE_UNSPECIFIED: + case NUM_NL80211_IFTYPES: +- BUG(); ++ WARN_ON(1); + break; + } + diff --git a/queue-4.9/mac80211_hwsim-enforce-ps_manual_poll-to-be-set-after-ps_enabled.patch b/queue-4.9/mac80211_hwsim-enforce-ps_manual_poll-to-be-set-after-ps_enabled.patch new file mode 100644 index 00000000000..361e1c37dd9 --- /dev/null +++ b/queue-4.9/mac80211_hwsim-enforce-ps_manual_poll-to-be-set-after-ps_enabled.patch @@ -0,0 +1,60 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Adiel Aloni +Date: Fri, 1 Dec 2017 13:50:53 +0200 +Subject: mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED + +From: Adiel Aloni + + +[ Upstream commit e16ea4bb516bc21ea2202f2107718b29218bea59 ] + +Enforce using PS_MANUAL_POLL in ps hwsim debugfs to trigger a poll, +only if PS_ENABLED was set before. +This is required due to commit c9491367b759 ("mac80211: always update the +PM state of a peer on MGMT / DATA frames") that enforces the ap to +check only mgmt/data frames ps bit, and then update station's power save +accordingly. +When sending only ps-poll (control frame) the ap will not be aware that +the station entered power save. +Setting ps enable before triggering ps_poll, will send NDP with PM bit +enabled first. + +Signed-off-by: Adiel Aloni +Signed-off-by: Luca Coelho +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mac80211_hwsim.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -728,16 +728,21 @@ static int hwsim_fops_ps_write(void *dat + val != PS_MANUAL_POLL) + return -EINVAL; + +- old_ps = data->ps; +- data->ps = val; +- +- local_bh_disable(); + if (val == PS_MANUAL_POLL) { ++ if (data->ps != PS_ENABLED) ++ return -EINVAL; ++ local_bh_disable(); + ieee80211_iterate_active_interfaces_atomic( + data->hw, IEEE80211_IFACE_ITER_NORMAL, + hwsim_send_ps_poll, data); +- data->ps_poll_pending = true; +- } else if (old_ps == PS_DISABLED && val != PS_DISABLED) { ++ local_bh_enable(); ++ return 0; ++ } ++ old_ps = data->ps; ++ data->ps = val; ++ ++ local_bh_disable(); ++ if (old_ps == PS_DISABLED && val != PS_DISABLED) { + ieee80211_iterate_active_interfaces_atomic( + data->hw, IEEE80211_IFACE_ITER_NORMAL, + hwsim_send_nullfunc_ps, data); diff --git a/queue-4.9/mac80211_hwsim-use-per-interface-power-level.patch b/queue-4.9/mac80211_hwsim-use-per-interface-power-level.patch new file mode 100644 index 00000000000..55855f2e9d2 --- /dev/null +++ b/queue-4.9/mac80211_hwsim-use-per-interface-power-level.patch @@ -0,0 +1,70 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Johannes Berg +Date: Thu, 13 Apr 2017 10:31:16 +0200 +Subject: mac80211_hwsim: use per-interface power level + +From: Johannes Berg + + +[ Upstream commit 1d5e9f80ab021e3e1f9436627a4ad07a143ccb2c ] + +When channel contexts are used, there's no global power level +(the power_level is always 0). Use the per-interface TX power +in mac80211_hwsim to have a proper setting for both cases. + +This fixes the bgscan_simple and bgscan_learn test cases when +the number of channels advertised by hwsim is >1 by default. + +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mac80211_hwsim.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -552,8 +552,6 @@ struct mac80211_hwsim_data { + /* wmediumd portid responsible for netgroup of this radio */ + u32 wmediumd; + +- int power_level; +- + /* difference between this hw's clock and the real clock, in usecs */ + s64 tsf_offset; + s64 bcn_delta; +@@ -1208,7 +1206,9 @@ static bool mac80211_hwsim_tx_frame_no_n + if (info->control.rates[0].flags & IEEE80211_TX_RC_SHORT_GI) + rx_status.flag |= RX_FLAG_SHORT_GI; + /* TODO: simulate real signal strength (and optional packet loss) */ +- rx_status.signal = data->power_level - 50; ++ rx_status.signal = -50; ++ if (info->control.vif) ++ rx_status.signal += info->control.vif->bss_conf.txpower; + + if (data->ps != PS_DISABLED) + hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM); +@@ -1607,7 +1607,6 @@ static int mac80211_hwsim_config(struct + + WARN_ON(data->channel && data->use_chanctx); + +- data->power_level = conf->power_level; + if (!data->started || !data->beacon_int) + tasklet_hrtimer_cancel(&data->beacon_timer); + else if (!hrtimer_is_queued(&data->beacon_timer.timer)) { +@@ -2212,7 +2211,6 @@ static const char mac80211_hwsim_gstring + "d_tx_failed", + "d_ps_mode", + "d_group", +- "d_tx_power", + }; + + #define MAC80211_HWSIM_SSTATS_LEN ARRAY_SIZE(mac80211_hwsim_gstrings_stats) +@@ -2249,7 +2247,6 @@ static void mac80211_hwsim_get_et_stats( + data[i++] = ar->tx_failed; + data[i++] = ar->ps; + data[i++] = ar->group; +- data[i++] = ar->power_level; + + WARN_ON(i != MAC80211_HWSIM_SSTATS_LEN); + } diff --git a/queue-4.9/md-raid6-fix-anomily-when-recovering-a-single-device-in-raid6.patch b/queue-4.9/md-raid6-fix-anomily-when-recovering-a-single-device-in-raid6.patch new file mode 100644 index 00000000000..524eea98565 --- /dev/null +++ b/queue-4.9/md-raid6-fix-anomily-when-recovering-a-single-device-in-raid6.patch @@ -0,0 +1,65 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: NeilBrown +Date: Mon, 3 Apr 2017 12:11:32 +1000 +Subject: md/raid6: Fix anomily when recovering a single device in RAID6. + +From: NeilBrown + + +[ Upstream commit 7471fb77ce4dc4cb81291189947fcdf621a97987 ] + +When recoverying a single missing/failed device in a RAID6, +those stripes where the Q block is on the missing device are +handled a bit differently. In these cases it is easy to +check that the P block is correct, so we do. This results +in the P block be destroy. Consequently the P block needs +to be read a second time in order to compute Q. This causes +lots of seeks and hurts performance. + +It shouldn't be necessary to re-read P as it can be computed +from the DATA. But we only compute blocks on missing +devices, since c337869d9501 ("md: do not compute parity +unless it is on a failed drive"). + +So relax the change made in that commit to allow computing +of the P block in a RAID6 which it is the only missing that +block. + +This makes RAID6 recovery run much faster as the disk just +"before" the recovering device is no longer seeking +back-and-forth. + +Reported-by-tested-by: Brad Campbell +Reviewed-by: Dan Williams +Signed-off-by: NeilBrown +Signed-off-by: Shaohua Li +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/raid5.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -3391,9 +3391,20 @@ static int fetch_block(struct stripe_hea + BUG_ON(test_bit(R5_Wantcompute, &dev->flags)); + BUG_ON(test_bit(R5_Wantread, &dev->flags)); + BUG_ON(sh->batch_head); ++ ++ /* ++ * In the raid6 case if the only non-uptodate disk is P ++ * then we already trusted P to compute the other failed ++ * drives. It is safe to compute rather than re-read P. ++ * In other cases we only compute blocks from failed ++ * devices, otherwise check/repair might fail to detect ++ * a real inconsistency. ++ */ ++ + if ((s->uptodate == disks - 1) && ++ ((sh->qd_idx >= 0 && sh->pd_idx == disk_idx) || + (s->failed && (disk_idx == s->failed_num[0] || +- disk_idx == s->failed_num[1]))) { ++ disk_idx == s->failed_num[1])))) { + /* have disk failed, and we're requested to fetch it; + * do compute it + */ diff --git a/queue-4.9/md.c-didn-t-unlock-the-mddev-before-return-einval-in-array_size_store.patch b/queue-4.9/md.c-didn-t-unlock-the-mddev-before-return-einval-in-array_size_store.patch new file mode 100644 index 00000000000..962c5e93a0c --- /dev/null +++ b/queue-4.9/md.c-didn-t-unlock-the-mddev-before-return-einval-in-array_size_store.patch @@ -0,0 +1,38 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Zhilong Liu +Date: Mon, 10 Apr 2017 14:15:55 +0800 +Subject: md.c:didn't unlock the mddev before return EINVAL in array_size_store + +From: Zhilong Liu + + +[ Upstream commit b670883bb9e55ba63a278d83e034faefc01ce2cf ] + +md.c: it needs to release the mddev lock before +the array_size_store() returns. + +Fixes: ab5a98b132fd ("md-cluster: change array_sectors and update size are not supported") + +Signed-off-by: Zhilong Liu +Reviewed-by: Guoqing Jiang +Signed-off-by: Shaohua Li +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/md.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -4826,8 +4826,10 @@ array_size_store(struct mddev *mddev, co + return err; + + /* cluster raid doesn't support change array_sectors */ +- if (mddev_is_clustered(mddev)) ++ if (mddev_is_clustered(mddev)) { ++ mddev_unlock(mddev); + return -EINVAL; ++ } + + if (strncmp(buf, "default", 7) == 0) { + if (mddev->pers) diff --git a/queue-4.9/media-cpia2-fix-a-couple-off-by-one-bugs.patch b/queue-4.9/media-cpia2-fix-a-couple-off-by-one-bugs.patch new file mode 100644 index 00000000000..004b255771e --- /dev/null +++ b/queue-4.9/media-cpia2-fix-a-couple-off-by-one-bugs.patch @@ -0,0 +1,46 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Dan Carpenter +Date: Thu, 9 Nov 2017 16:28:14 -0500 +Subject: media: cpia2: Fix a couple off by one bugs + +From: Dan Carpenter + + +[ Upstream commit d5ac225c7d64c9c3ef821239edc035634e594ec9 ] + +The cam->buffers[] array has cam->num_frames elements so the > needs to +be changed to >= to avoid going beyond the end of the array. The +->buffers[] array is allocated in cpia2_allocate_buffers() if you want +to confirm. + +Fixes: ab33d5071de7 ("V4L/DVB (3376): Add cpia2 camera support") + +Signed-off-by: Dan Carpenter +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/cpia2/cpia2_v4l.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/usb/cpia2/cpia2_v4l.c ++++ b/drivers/media/usb/cpia2/cpia2_v4l.c +@@ -812,7 +812,7 @@ static int cpia2_querybuf(struct file *f + struct camera_data *cam = video_drvdata(file); + + if(buf->type != V4L2_BUF_TYPE_VIDEO_CAPTURE || +- buf->index > cam->num_frames) ++ buf->index >= cam->num_frames) + return -EINVAL; + + buf->m.offset = cam->buffers[buf->index].data - cam->frame_buffer; +@@ -863,7 +863,7 @@ static int cpia2_qbuf(struct file *file, + + if(buf->type != V4L2_BUF_TYPE_VIDEO_CAPTURE || + buf->memory != V4L2_MEMORY_MMAP || +- buf->index > cam->num_frames) ++ buf->index >= cam->num_frames) + return -EINVAL; + + DBG("QBUF #%d\n", buf->index); diff --git a/queue-4.9/media-i2c-soc_camera-fix-ov6650-sensor-getting-wrong-clock.patch b/queue-4.9/media-i2c-soc_camera-fix-ov6650-sensor-getting-wrong-clock.patch new file mode 100644 index 00000000000..6ff6449ca74 --- /dev/null +++ b/queue-4.9/media-i2c-soc_camera-fix-ov6650-sensor-getting-wrong-clock.patch @@ -0,0 +1,41 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Janusz Krzysztofik +Date: Wed, 15 Jun 2016 19:29:50 -0300 +Subject: [media] media: i2c/soc_camera: fix ov6650 sensor getting wrong clock + +From: Janusz Krzysztofik + + +[ Upstream commit 54449af0e0b2ea43a8166611c95b730c850c3184 ] + +After changes to v4l2_clk API introduced in v4.1 by commits a37462b919 +'[media] V4L: remove clock name from v4l2_clk API' and 4f528afcfb +'[media] V4L: add CCF support to the v4l2_clk API', ov6650 sensor +stopped responding because v4l2_clk_get(), still called with +depreciated V4L2 clock name "mclk", started to return respective CCF +clock instead of the V4l2 one registered by soc_camera. Fix it by +calling v4l2_clk_get() with NULL clock name. + +Created and tested on Amstrad Delta against Linux-4.7-rc3 with +omap1_camera fixes. + +Signed-off-by: Janusz Krzysztofik +Signed-off-by: Guennadi Liakhovetski +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/soc_camera/ov6650.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/i2c/soc_camera/ov6650.c ++++ b/drivers/media/i2c/soc_camera/ov6650.c +@@ -1033,7 +1033,7 @@ static int ov6650_probe(struct i2c_clien + priv->code = MEDIA_BUS_FMT_YUYV8_2X8; + priv->colorspace = V4L2_COLORSPACE_JPEG; + +- priv->clk = v4l2_clk_get(&client->dev, "mclk"); ++ priv->clk = v4l2_clk_get(&client->dev, NULL); + if (IS_ERR(priv->clk)) { + ret = PTR_ERR(priv->clk); + goto eclkget; diff --git a/queue-4.9/media-vsp1-prevent-suspending-and-resuming-drm-pipelines.patch b/queue-4.9/media-vsp1-prevent-suspending-and-resuming-drm-pipelines.patch new file mode 100644 index 00000000000..16c4bea0745 --- /dev/null +++ b/queue-4.9/media-vsp1-prevent-suspending-and-resuming-drm-pipelines.patch @@ -0,0 +1,61 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Kieran Bingham +Date: Mon, 4 Dec 2017 06:01:11 -0500 +Subject: media: vsp1: Prevent suspending and resuming DRM pipelines + +From: Kieran Bingham + + +[ Upstream commit a17d2d6cd9985ca09a9e384f1bc71d710f7e5203 ] + +When used as part of a display pipeline, the VSP is stopped and +restarted explicitly by the DU from its suspend and resume handlers. +There is thus no need to stop or restart pipelines in the VSP suspend +and resume handlers, and doing so would cause the hardware to be +left in a misconfigured state. + +Ensure that the VSP suspend and resume handlers do not affect DRM-based +pipelines. + +Signed-off-by: Kieran Bingham +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/vsp1/vsp1_drv.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/drivers/media/platform/vsp1/vsp1_drv.c ++++ b/drivers/media/platform/vsp1/vsp1_drv.c +@@ -509,7 +509,13 @@ static int __maybe_unused vsp1_pm_suspen + { + struct vsp1_device *vsp1 = dev_get_drvdata(dev); + +- vsp1_pipelines_suspend(vsp1); ++ /* ++ * When used as part of a display pipeline, the VSP is stopped and ++ * restarted explicitly by the DU. ++ */ ++ if (!vsp1->drm) ++ vsp1_pipelines_suspend(vsp1); ++ + pm_runtime_force_suspend(vsp1->dev); + + return 0; +@@ -520,7 +526,13 @@ static int __maybe_unused vsp1_pm_resume + struct vsp1_device *vsp1 = dev_get_drvdata(dev); + + pm_runtime_force_resume(vsp1->dev); +- vsp1_pipelines_resume(vsp1); ++ ++ /* ++ * When used as part of a display pipeline, the VSP is stopped and ++ * restarted explicitly by the DU. ++ */ ++ if (!vsp1->drm) ++ vsp1_pipelines_resume(vsp1); + + return 0; + } diff --git a/queue-4.9/mips-bpf-fix-multiple-problems-in-jit-skb-access-helpers.patch b/queue-4.9/mips-bpf-fix-multiple-problems-in-jit-skb-access-helpers.patch new file mode 100644 index 00000000000..f972fe4c084 --- /dev/null +++ b/queue-4.9/mips-bpf-fix-multiple-problems-in-jit-skb-access-helpers.patch @@ -0,0 +1,87 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: David Daney +Date: Tue, 14 Mar 2017 14:21:44 -0700 +Subject: MIPS: BPF: Fix multiple problems in JIT skb access helpers. + +From: David Daney + + +[ Upstream commit a81507c79f4ae9a0f9fb1054b59b62a090620dd9 ] + +o Socket data is unsigned, so use unsigned accessors instructions. + + o Fix path result pointer generation arithmetic. + + o Fix half-word byte swapping code for unsigned semantics. + +Signed-off-by: David Daney +Cc: James Hogan +Cc: Alexei Starovoitov +Cc: Steven J. Hill +Cc: linux-mips@linux-mips.org +Cc: netdev@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Patchwork: https://patchwork.linux-mips.org/patch/15747/ +Signed-off-by: Ralf Baechle +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/net/bpf_jit_asm.S | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +--- a/arch/mips/net/bpf_jit_asm.S ++++ b/arch/mips/net/bpf_jit_asm.S +@@ -90,18 +90,14 @@ FEXPORT(sk_load_half_positive) + is_offset_in_header(2, half) + /* Offset within header boundaries */ + PTR_ADDU t1, $r_skb_data, offset +- .set reorder +- lh $r_A, 0(t1) +- .set noreorder ++ lhu $r_A, 0(t1) + #ifdef CONFIG_CPU_LITTLE_ENDIAN + # if defined(__mips_isa_rev) && (__mips_isa_rev >= 2) +- wsbh t0, $r_A +- seh $r_A, t0 ++ wsbh $r_A, $r_A + # else +- sll t0, $r_A, 24 +- andi t1, $r_A, 0xff00 +- sra t0, t0, 16 +- srl t1, t1, 8 ++ sll t0, $r_A, 8 ++ srl t1, $r_A, 8 ++ andi t0, t0, 0xff00 + or $r_A, t0, t1 + # endif + #endif +@@ -115,7 +111,7 @@ FEXPORT(sk_load_byte_positive) + is_offset_in_header(1, byte) + /* Offset within header boundaries */ + PTR_ADDU t1, $r_skb_data, offset +- lb $r_A, 0(t1) ++ lbu $r_A, 0(t1) + jr $r_ra + move $r_ret, zero + END(sk_load_byte) +@@ -139,6 +135,11 @@ FEXPORT(sk_load_byte_positive) + * (void *to) is returned in r_s0 + * + */ ++#ifdef CONFIG_CPU_LITTLE_ENDIAN ++#define DS_OFFSET(SIZE) (4 * SZREG) ++#else ++#define DS_OFFSET(SIZE) ((4 * SZREG) + (4 - SIZE)) ++#endif + #define bpf_slow_path_common(SIZE) \ + /* Quick check. Are we within reasonable boundaries? */ \ + LONG_ADDIU $r_s1, $r_skb_len, -SIZE; \ +@@ -150,7 +151,7 @@ FEXPORT(sk_load_byte_positive) + PTR_LA t0, skb_copy_bits; \ + PTR_S $r_ra, (5 * SZREG)($r_sp); \ + /* Assign low slot to a2 */ \ +- move a2, $r_sp; \ ++ PTR_ADDIU a2, $r_sp, DS_OFFSET(SIZE); \ + jalr t0; \ + /* Reset our destination slot (DS but it's ok) */ \ + INT_S zero, (4 * SZREG)($r_sp); \ diff --git a/queue-4.9/mips-bpf-quit-clobbering-callee-saved-registers-in-jit-code.patch b/queue-4.9/mips-bpf-quit-clobbering-callee-saved-registers-in-jit-code.patch new file mode 100644 index 00000000000..6c7c072ad9b --- /dev/null +++ b/queue-4.9/mips-bpf-quit-clobbering-callee-saved-registers-in-jit-code.patch @@ -0,0 +1,71 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: David Daney +Date: Tue, 14 Mar 2017 14:21:43 -0700 +Subject: MIPS: BPF: Quit clobbering callee saved registers in JIT code. + +From: David Daney + + +[ Upstream commit 1ef0910cfd681f0bd0b81f8809935b2006e9cfb9 ] + +If bpf_needs_clear_a() returns true, only actually clear it if it is +ever used. If it is not used, we don't save and restore it, so the +clearing has the nasty side effect of clobbering caller state. + +Also, don't emit stack pointer adjustment instructions if the +adjustment amount is zero. + +Signed-off-by: David Daney +Cc: James Hogan +Cc: Alexei Starovoitov +Cc: Steven J. Hill +Cc: linux-mips@linux-mips.org +Cc: netdev@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Patchwork: https://patchwork.linux-mips.org/patch/15745/ +Signed-off-by: Ralf Baechle +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/net/bpf_jit.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +--- a/arch/mips/net/bpf_jit.c ++++ b/arch/mips/net/bpf_jit.c +@@ -526,7 +526,8 @@ static void save_bpf_jit_regs(struct jit + u32 sflags, tmp_flags; + + /* Adjust the stack pointer */ +- emit_stack_offset(-align_sp(offset), ctx); ++ if (offset) ++ emit_stack_offset(-align_sp(offset), ctx); + + tmp_flags = sflags = ctx->flags >> SEEN_SREG_SFT; + /* sflags is essentially a bitmap */ +@@ -578,7 +579,8 @@ static void restore_bpf_jit_regs(struct + emit_load_stack_reg(r_ra, r_sp, real_off, ctx); + + /* Restore the sp and discard the scrach memory */ +- emit_stack_offset(align_sp(offset), ctx); ++ if (offset) ++ emit_stack_offset(align_sp(offset), ctx); + } + + static unsigned int get_stack_depth(struct jit_ctx *ctx) +@@ -625,8 +627,14 @@ static void build_prologue(struct jit_ct + if (ctx->flags & SEEN_X) + emit_jit_reg_move(r_X, r_zero, ctx); + +- /* Do not leak kernel data to userspace */ +- if (bpf_needs_clear_a(&ctx->skf->insns[0])) ++ /* ++ * Do not leak kernel data to userspace, we only need to clear ++ * r_A if it is ever used. In fact if it is never used, we ++ * will not save/restore it, so clearing it in this case would ++ * corrupt the state of the caller. ++ */ ++ if (bpf_needs_clear_a(&ctx->skf->insns[0]) && ++ (ctx->flags & SEEN_A)) + emit_jit_reg_move(r_A, r_zero, ctx); + } + diff --git a/queue-4.9/mips-r2-on-r6-emu-clear-bltzall-and-bgezall-debugfs-counters.patch b/queue-4.9/mips-r2-on-r6-emu-clear-bltzall-and-bgezall-debugfs-counters.patch new file mode 100644 index 00000000000..57a4011d37d --- /dev/null +++ b/queue-4.9/mips-r2-on-r6-emu-clear-bltzall-and-bgezall-debugfs-counters.patch @@ -0,0 +1,49 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Aleksandar Markovic +Date: Mon, 13 Mar 2017 16:36:36 +0100 +Subject: MIPS: r2-on-r6-emu: Clear BLTZALL and BGEZALL debugfs counters + +From: Aleksandar Markovic + + +[ Upstream commit 411dac79cc2ed80f7e348ccc23eb4d8b0ba9f6d5 ] + +Add missing clearing of BLTZALL and BGEZALL emulation counters in +function mipsr2_stats_clear_show(). + +Previously, it was not possible to reset BLTZALL and BGEZALL +emulation counters - their value remained the same even after +explicit request via debugfs. As far as other related counters +are concerned, they all seem to be properly cleared. + +This change affects debugfs operation only, core R2 emulation +functionality is not affected. + +Signed-off-by: Aleksandar Markovic +Reviewed-by: Paul Burton +Cc: james.hogan@imgtec.com +Cc: leonid.yegoshin@imgtec.com +Cc: douglas.leung@imgtec.com +Cc: petar.jovanovic@imgtec.com +Cc: miodrag.dinic@imgtec.com +Cc: goran.ferenc@imgtec.com +Cc: linux-mips@linux-mips.org +Patchwork: https://patchwork.linux-mips.org/patch/15517/ +Signed-off-by: Ralf Baechle +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/kernel/mips-r2-to-r6-emul.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/mips/kernel/mips-r2-to-r6-emul.c ++++ b/arch/mips/kernel/mips-r2-to-r6-emul.c +@@ -2339,6 +2339,8 @@ static int mipsr2_stats_clear_show(struc + __this_cpu_write((mipsr2bremustats).bgezl, 0); + __this_cpu_write((mipsr2bremustats).bltzll, 0); + __this_cpu_write((mipsr2bremustats).bgezll, 0); ++ __this_cpu_write((mipsr2bremustats).bltzall, 0); ++ __this_cpu_write((mipsr2bremustats).bgezall, 0); + __this_cpu_write((mipsr2bremustats).bltzal, 0); + __this_cpu_write((mipsr2bremustats).bgezal, 0); + __this_cpu_write((mipsr2bremustats).beql, 0); diff --git a/queue-4.9/mips-r2-on-r6-emu-fix-blezl-and-bgtzl-identification.patch b/queue-4.9/mips-r2-on-r6-emu-fix-blezl-and-bgtzl-identification.patch new file mode 100644 index 00000000000..bbc01282f51 --- /dev/null +++ b/queue-4.9/mips-r2-on-r6-emu-fix-blezl-and-bgtzl-identification.patch @@ -0,0 +1,72 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Leonid Yegoshin +Date: Mon, 13 Mar 2017 16:36:35 +0100 +Subject: MIPS: r2-on-r6-emu: Fix BLEZL and BGTZL identification + +From: Leonid Yegoshin + + +[ Upstream commit 5bba7aa4958e271c3ffceb70d47d3206524cf489 ] + +Fix the problem of inaccurate identification of instructions BLEZL and +BGTZL in R2 emulation code by making sure all necessary encoding +specifications are met. + +Previously, certain R6 instructions could be identified as BLEZL or +BGTZL. R2 emulation routine didn't take into account that both BLEZL +and BGTZL instructions require their rt field (bits 20 to 16 of +instruction encoding) to be 0, and that, at same time, if the value in +that field is not 0, the encoding may represent a legitimate MIPS R6 +instruction. + +This means that a problem could occur after emulation optimization, +when emulation routine tried to pipeline emulation, picked up a next +candidate, and subsequently misrecognized an R6 instruction as BLEZL +or BGTZL. + +It should be said that for single pass strategy, the problem does not +happen because CPU doesn't trap on branch-compacts which share opcode +space with BLEZL/BGTZL (but have rt field != 0, of course). + +Signed-off-by: Leonid Yegoshin +Signed-off-by: Miodrag Dinic +Signed-off-by: Aleksandar Markovic +Reported-by: Douglas Leung +Reviewed-by: Paul Burton +Cc: james.hogan@imgtec.com +Cc: petar.jovanovic@imgtec.com +Cc: goran.ferenc@imgtec.com +Cc: linux-mips@linux-mips.org +Patchwork: https://patchwork.linux-mips.org/patch/15456/ +Signed-off-by: Ralf Baechle +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/kernel/mips-r2-to-r6-emul.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/arch/mips/kernel/mips-r2-to-r6-emul.c ++++ b/arch/mips/kernel/mips-r2-to-r6-emul.c +@@ -1096,10 +1096,20 @@ repeat: + } + break; + +- case beql_op: +- case bnel_op: + case blezl_op: + case bgtzl_op: ++ /* ++ * For BLEZL and BGTZL, rt field must be set to 0. If this ++ * is not the case, this may be an encoding of a MIPS R6 ++ * instruction, so return to CPU execution if this occurs ++ */ ++ if (MIPSInst_RT(inst)) { ++ err = SIGILL; ++ break; ++ } ++ /* fall through */ ++ case beql_op: ++ case bnel_op: + if (delay_slot(regs)) { + err = SIGILL; + break; diff --git a/queue-4.9/mm-fix-false-positive-vm_bug_on-in-page_cache_-get-add-_speculative.patch b/queue-4.9/mm-fix-false-positive-vm_bug_on-in-page_cache_-get-add-_speculative.patch new file mode 100644 index 00000000000..5d5cad368ce --- /dev/null +++ b/queue-4.9/mm-fix-false-positive-vm_bug_on-in-page_cache_-get-add-_speculative.patch @@ -0,0 +1,74 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: "Kirill A. Shutemov" +Date: Fri, 24 Mar 2017 14:13:05 +0300 +Subject: mm: Fix false-positive VM_BUG_ON() in page_cache_{get,add}_speculative() + +From: "Kirill A. Shutemov" + + +[ Upstream commit 591a3d7c09fa08baff48ad86c2347dbd28a52753 ] + +0day testing by Fengguang Wu triggered this crash while running Trinity: + + kernel BUG at include/linux/pagemap.h:151! + ... + CPU: 0 PID: 458 Comm: trinity-c0 Not tainted 4.11.0-rc2-00251-g2947ba0 #1 + ... + Call Trace: + __get_user_pages_fast() + get_user_pages_fast() + get_futex_key() + futex_requeue() + do_futex() + SyS_futex() + do_syscall_64() + entry_SYSCALL64_slow_path() + +It' VM_BUG_ON() due to false-negative in_atomic(). We call +page_cache_get_speculative() with disabled local interrupts. +It should be atomic enough. + +So let's check for disabled interrupts in the VM_BUG_ON() condition +too, to resolve this. + +( This got triggered by the conversion of the x86 GUP code to the + generic GUP code. ) + +Reported-by: Fengguang Wu +Signed-off-by: Kirill A. Shutemov +Cc: Andrew Morton +Cc: Aneesh Kumar K.V +Cc: Kirill A. Shutemov +Cc: LKP +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: linux-mm@kvack.org +Link: http://lkml.kernel.org/r/20170324114709.pcytvyb3d6ajux33@black.fi.intel.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/pagemap.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/linux/pagemap.h ++++ b/include/linux/pagemap.h +@@ -148,7 +148,7 @@ static inline int page_cache_get_specula + + #ifdef CONFIG_TINY_RCU + # ifdef CONFIG_PREEMPT_COUNT +- VM_BUG_ON(!in_atomic()); ++ VM_BUG_ON(!in_atomic() && !irqs_disabled()); + # endif + /* + * Preempt must be disabled here - we rely on rcu_read_lock doing +@@ -186,7 +186,7 @@ static inline int page_cache_add_specula + + #if !defined(CONFIG_SMP) && defined(CONFIG_TREE_RCU) + # ifdef CONFIG_PREEMPT_COUNT +- VM_BUG_ON(!in_atomic()); ++ VM_BUG_ON(!in_atomic() && !irqs_disabled()); + # endif + VM_BUG_ON_PAGE(page_count(page) == 0, page); + page_ref_add(page, count); diff --git a/queue-4.9/mtd-nand-fix-interpretation-of-nand_cmd_none-in-nand_command.patch b/queue-4.9/mtd-nand-fix-interpretation-of-nand_cmd_none-in-nand_command.patch new file mode 100644 index 00000000000..a3fa398981c --- /dev/null +++ b/queue-4.9/mtd-nand-fix-interpretation-of-nand_cmd_none-in-nand_command.patch @@ -0,0 +1,70 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Miquel Raynal +Date: Wed, 8 Nov 2017 17:00:27 +0100 +Subject: mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]() + +From: Miquel Raynal + + +[ Upstream commit df467899da0b71465760b4e35127bce837244eee ] + +Some drivers (like nand_hynix.c) call ->cmdfunc() with NAND_CMD_NONE +and a column address and expect the controller to only send address +cycles. Right now, the default ->cmdfunc() implementations provided by +the core do not filter out the command cycle in this case and forwards +the request to the controller driver through the ->cmd_ctrl() method. +The thing is, NAND controller drivers can get this wrong and send a +command cycle with a NAND_CMD_NONE opcode and since NAND_CMD_NONE is +-1, and the command field is usually casted to an u8, we end up sending +the 0xFF command which is actually a RESET operation. + +Add conditions in nand_command[_lp]() functions to sending the initial +command cycle when command == NAND_CMD_NONE. + +Signed-off-by: Miquel Raynal +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/nand_base.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/nand/nand_base.c ++++ b/drivers/mtd/nand/nand_base.c +@@ -715,7 +715,8 @@ static void nand_command(struct mtd_info + chip->cmd_ctrl(mtd, readcmd, ctrl); + ctrl &= ~NAND_CTRL_CHANGE; + } +- chip->cmd_ctrl(mtd, command, ctrl); ++ if (command != NAND_CMD_NONE) ++ chip->cmd_ctrl(mtd, command, ctrl); + + /* Address cycle, when necessary */ + ctrl = NAND_CTRL_ALE | NAND_CTRL_CHANGE; +@@ -744,6 +745,7 @@ static void nand_command(struct mtd_info + */ + switch (command) { + ++ case NAND_CMD_NONE: + case NAND_CMD_PAGEPROG: + case NAND_CMD_ERASE1: + case NAND_CMD_ERASE2: +@@ -806,7 +808,9 @@ static void nand_command_lp(struct mtd_i + } + + /* Command latch cycle */ +- chip->cmd_ctrl(mtd, command, NAND_NCE | NAND_CLE | NAND_CTRL_CHANGE); ++ if (command != NAND_CMD_NONE) ++ chip->cmd_ctrl(mtd, command, ++ NAND_NCE | NAND_CLE | NAND_CTRL_CHANGE); + + if (column != -1 || page_addr != -1) { + int ctrl = NAND_CTRL_CHANGE | NAND_NCE | NAND_ALE; +@@ -842,6 +846,7 @@ static void nand_command_lp(struct mtd_i + */ + switch (command) { + ++ case NAND_CMD_NONE: + case NAND_CMD_CACHEDPROG: + case NAND_CMD_PAGEPROG: + case NAND_CMD_ERASE1: diff --git a/queue-4.9/mtd-nand-ifc-update-bufnum-mask-for-ver-2.0.0.patch b/queue-4.9/mtd-nand-ifc-update-bufnum-mask-for-ver-2.0.0.patch new file mode 100644 index 00000000000..947059154ea --- /dev/null +++ b/queue-4.9/mtd-nand-ifc-update-bufnum-mask-for-ver-2.0.0.patch @@ -0,0 +1,40 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Jagdish Gediya +Date: Thu, 23 Nov 2017 17:04:31 +0530 +Subject: mtd: nand: ifc: update bufnum mask for ver >= 2.0.0 + +From: Jagdish Gediya + + +[ Upstream commit bccb06c353af3764ca86d9da47652458e6c2eb41 ] + +Bufnum mask is used to calculate page position in the internal SRAM. + +As IFC version 2.0.0 has 16KB of internal SRAM as compared to older +versions which had 8KB. Hence bufnum mask needs to be updated. + +Signed-off-by: Jagdish Gediya +Signed-off-by: Prabhakar Kushwaha +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/fsl_ifc_nand.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/mtd/nand/fsl_ifc_nand.c ++++ b/drivers/mtd/nand/fsl_ifc_nand.c +@@ -907,6 +907,13 @@ static int fsl_ifc_chip_init(struct fsl_ + if (ctrl->version == FSL_IFC_VERSION_1_1_0) + fsl_ifc_sram_init(priv); + ++ /* ++ * As IFC version 2.0.0 has 16KB of internal SRAM as compared to older ++ * versions which had 8KB. Hence bufnum mask needs to be updated. ++ */ ++ if (ctrl->version >= FSL_IFC_VERSION_2_0_0) ++ priv->bufnum_mask = (priv->bufnum_mask * 2) + 1; ++ + return 0; + } + diff --git a/queue-4.9/mwifiex-cfg80211-do-not-change-virtual-interface-during-scan-processing.patch b/queue-4.9/mwifiex-cfg80211-do-not-change-virtual-interface-during-scan-processing.patch new file mode 100644 index 00000000000..9fc378f6a05 --- /dev/null +++ b/queue-4.9/mwifiex-cfg80211-do-not-change-virtual-interface-during-scan-processing.patch @@ -0,0 +1,47 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Limin Zhu +Date: Thu, 30 Nov 2017 14:22:34 +0800 +Subject: mwifiex: cfg80211: do not change virtual interface during scan processing + +From: Limin Zhu + + +[ Upstream commit c61cfe49f0f0f0d1f8b56d0b045838d597e8c3a3 ] + +(1) Change virtual interface operation in cfg80211 process reset and +reinitilize private data structure. +(2) Scan result event processed in main process will dereference private +data structure concurrently, ocassionly crash the kernel. + +The cornel case could be trigger by below steps: +(1) wpa_cli mlan0 scan +(2) ./hostapd mlan0.conf + +Cfg80211 asynchronous scan procedure is not all the time operated +under rtnl lock, here we add the protect to serialize the cfg80211 +scan and change_virtual interface operation. + +Signed-off-by: Limin Zhu +Signed-off-by: Xinming Hu +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/mwifiex/cfg80211.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -1109,6 +1109,12 @@ mwifiex_cfg80211_change_virtual_intf(str + struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev); + enum nl80211_iftype curr_iftype = dev->ieee80211_ptr->iftype; + ++ if (priv->scan_request) { ++ mwifiex_dbg(priv->adapter, ERROR, ++ "change virtual interface: scan in process\n"); ++ return -EBUSY; ++ } ++ + switch (curr_iftype) { + case NL80211_IFTYPE_ADHOC: + switch (type) { diff --git a/queue-4.9/mwifiex-fix-invalid-port-issue.patch b/queue-4.9/mwifiex-fix-invalid-port-issue.patch new file mode 100644 index 00000000000..3626b87980f --- /dev/null +++ b/queue-4.9/mwifiex-fix-invalid-port-issue.patch @@ -0,0 +1,43 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Ganapathi Bhat +Date: Tue, 4 Apr 2017 10:16:28 +0530 +Subject: mwifiex: Fix invalid port issue + +From: Ganapathi Bhat + + +[ Upstream commit ecd7eb7c2bcf99f6c23d68ad56ce15949da848a1 ] + +We have to use start port, for TX/RX of single packet, +instead of current aggregating port. This will fix SDIO +CMD53(TX/RX) returning -ETIMEDOUT and halting the data path. + +Fixes: 0cb52aac4d19 ("mwifiex: do not set multiport flag for tx/rx single packet") +Signed-off-by: Ganapathi Bhat +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/mwifiex/sdio.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/marvell/mwifiex/sdio.c ++++ b/drivers/net/wireless/marvell/mwifiex/sdio.c +@@ -1458,7 +1458,7 @@ static int mwifiex_sdio_card_to_host_mp_ + } + + if (card->mpa_rx.pkt_cnt == 1) +- mport = adapter->ioport + port; ++ mport = adapter->ioport + card->mpa_rx.start_port; + + if (mwifiex_read_data_sync(adapter, card->mpa_rx.buf, + card->mpa_rx.buf_len, mport, 1)) +@@ -1891,7 +1891,7 @@ static int mwifiex_host_to_card_mp_aggr( + } + + if (card->mpa_tx.pkt_cnt == 1) +- mport = adapter->ioport + port; ++ mport = adapter->ioport + card->mpa_tx.start_port; + + ret = mwifiex_write_data_to_card(adapter, card->mpa_tx.buf, + card->mpa_tx.buf_len, mport); diff --git a/queue-4.9/net-8021q-create-device-with-all-possible-features-in-wanted_features.patch b/queue-4.9/net-8021q-create-device-with-all-possible-features-in-wanted_features.patch new file mode 100644 index 00000000000..ac8a9cfef9f --- /dev/null +++ b/queue-4.9/net-8021q-create-device-with-all-possible-features-in-wanted_features.patch @@ -0,0 +1,102 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Andrey Vagin +Date: Wed, 15 Mar 2017 17:41:14 -0700 +Subject: net/8021q: create device with all possible features in wanted_features + +From: Andrey Vagin + + +[ Upstream commit 88997e4208aea117627898e5f6f9801cf3cd42d2 ] + +wanted_features is a set of features which have to be enabled if a +hardware allows that. + +Currently when a vlan device is created, its wanted_features is set to +current features of its base device. + +The problem is that the base device can get new features and they are +not propagated to vlan-s of this device. + +If we look at bonding devices, they doesn't have this problem and this +patch suggests to fix this issue by the same way how it works for bonding +devices. + +We meet this problem, when we try to create a vlan device over a bonding +device. When a system are booting, real devices require time to be +initialized, so bonding devices created without slaves, then vlan +devices are created and only then ethernet devices are added to the +bonding device. As a result we have vlan devices with disabled +scatter-gather. + +* create a bonding device + $ ip link add bond0 type bond + $ ethtool -k bond0 | grep scatter + scatter-gather: off + tx-scatter-gather: off [requested on] + tx-scatter-gather-fraglist: off [requested on] + +* create a vlan device + $ ip link add link bond0 name bond0.10 type vlan id 10 + $ ethtool -k bond0.10 | grep scatter + scatter-gather: off + tx-scatter-gather: off + tx-scatter-gather-fraglist: off + +* Add a slave device to bond0 + $ ip link set dev eth0 master bond0 + +And now we can see that the bond0 device has got the scatter-gather +feature, but the bond0.10 hasn't got it. +[root@laptop linux-task-diag]# ethtool -k bond0 | grep scatter +scatter-gather: on + tx-scatter-gather: on + tx-scatter-gather-fraglist: on +[root@laptop linux-task-diag]# ethtool -k bond0.10 | grep scatter +scatter-gather: off + tx-scatter-gather: off + tx-scatter-gather-fraglist: off + +With this patch the vlan device will get all new features from the +bonding device. + +Here is a call trace how features which are set in this patch reach +dev->wanted_features. + +register_netdevice + vlan_dev_init + ... + dev->hw_features = NETIF_F_HW_CSUM | NETIF_F_SG | + NETIF_F_FRAGLIST | NETIF_F_GSO_SOFTWARE | + NETIF_F_HIGHDMA | NETIF_F_SCTP_CRC | + NETIF_F_ALL_FCOE; + + dev->features |= dev->hw_features; + ... + dev->wanted_features = dev->features & dev->hw_features; + __netdev_update_features(dev); + vlan_dev_fix_features + ... + +Cc: Alexey Kuznetsov +Cc: Patrick McHardy +Cc: "David S. Miller" +Signed-off-by: Andrei Vagin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/8021q/vlan_dev.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/net/8021q/vlan_dev.c ++++ b/net/8021q/vlan_dev.c +@@ -562,8 +562,7 @@ static int vlan_dev_init(struct net_devi + NETIF_F_HIGHDMA | NETIF_F_SCTP_CRC | + NETIF_F_ALL_FCOE; + +- dev->features |= real_dev->vlan_features | NETIF_F_LLTX | +- NETIF_F_GSO_SOFTWARE; ++ dev->features |= dev->hw_features | NETIF_F_LLTX; + dev->gso_max_size = real_dev->gso_max_size; + dev->gso_max_segs = real_dev->gso_max_segs; + if (dev->features & NETIF_F_VLAN_FEATURES) diff --git a/queue-4.9/net-ethernet-bgmac-allow-mac-address-to-be-specified-in-dtb.patch b/queue-4.9/net-ethernet-bgmac-allow-mac-address-to-be-specified-in-dtb.patch new file mode 100644 index 00000000000..2c7493f6351 --- /dev/null +++ b/queue-4.9/net-ethernet-bgmac-allow-mac-address-to-be-specified-in-dtb.patch @@ -0,0 +1,87 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Steve Lin +Date: Thu, 16 Mar 2017 11:48:58 -0400 +Subject: net: ethernet: bgmac: Allow MAC address to be specified in DTB + +From: Steve Lin + + +[ Upstream commit 2f771399a3a2c371c140ff33544a583c6fbc5fd9 ] + +Allows the BCMA version of the bgmac driver to obtain MAC address +from the device tree. If no MAC address is specified there, then +the previous behavior (obtaining MAC address from SPROM) is +used. + +Signed-off-by: Steve Lin +Reviewed-by: Florian Fainelli +Acked-by: Jon Mason +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bgmac-bcma.c | 39 +++++++++++++++++------------ + 1 file changed, 23 insertions(+), 16 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bgmac-bcma.c ++++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + #include "bgmac.h" + + static inline bool bgmac_is_bcm4707_family(struct bcma_device *core) +@@ -96,7 +97,7 @@ static int bgmac_probe(struct bcma_devic + struct ssb_sprom *sprom = &core->bus->sprom; + struct mii_bus *mii_bus; + struct bgmac *bgmac; +- u8 *mac; ++ const u8 *mac = NULL; + int err; + + bgmac = kzalloc(sizeof(*bgmac), GFP_KERNEL); +@@ -110,21 +111,27 @@ static int bgmac_probe(struct bcma_devic + + bcma_set_drvdata(core, bgmac); + +- switch (core->core_unit) { +- case 0: +- mac = sprom->et0mac; +- break; +- case 1: +- mac = sprom->et1mac; +- break; +- case 2: +- mac = sprom->et2mac; +- break; +- default: +- dev_err(bgmac->dev, "Unsupported core_unit %d\n", +- core->core_unit); +- err = -ENOTSUPP; +- goto err; ++ if (bgmac->dev->of_node) ++ mac = of_get_mac_address(bgmac->dev->of_node); ++ ++ /* If no MAC address assigned via device tree, check SPROM */ ++ if (!mac) { ++ switch (core->core_unit) { ++ case 0: ++ mac = sprom->et0mac; ++ break; ++ case 1: ++ mac = sprom->et1mac; ++ break; ++ case 2: ++ mac = sprom->et2mac; ++ break; ++ default: ++ dev_err(bgmac->dev, "Unsupported core_unit %d\n", ++ core->core_unit); ++ err = -ENOTSUPP; ++ goto err; ++ } + } + + ether_addr_copy(bgmac->mac_addr, mac); diff --git a/queue-4.9/net-faraday-add-missing-include-of-of.h.patch b/queue-4.9/net-faraday-add-missing-include-of-of.h.patch new file mode 100644 index 00000000000..05c14756b6d --- /dev/null +++ b/queue-4.9/net-faraday-add-missing-include-of-of.h.patch @@ -0,0 +1,33 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Andrew Lunn +Date: Sun, 2 Apr 2017 20:20:47 +0200 +Subject: net/faraday: Add missing include of of.h + +From: Andrew Lunn + + +[ Upstream commit d39004ab136ebb6949a7dda9d24376f3d6209295 ] + +Breaking the include loop netdevice.h, dsa.h, devlink.h broke this +driver, it depends on includes brought in by these headers. Adding +linux/of.h fixes it. + +Fixes: ed0e39e97d34 ("net: break include loop netdevice.h, dsa.h, devlink.h") +Signed-off-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/faraday/ftgmac100.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/faraday/ftgmac100.c ++++ b/drivers/net/ethernet/faraday/ftgmac100.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + #include diff --git a/queue-4.9/net-fec-add-phy-reset-gpios-probe_defer-check.patch b/queue-4.9/net-fec-add-phy-reset-gpios-probe_defer-check.patch new file mode 100644 index 00000000000..76906f38827 --- /dev/null +++ b/queue-4.9/net-fec-add-phy-reset-gpios-probe_defer-check.patch @@ -0,0 +1,114 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Fugang Duan +Date: Tue, 11 Apr 2017 19:13:06 +0800 +Subject: net: fec: add phy-reset-gpios PROBE_DEFER check + +From: Fugang Duan + + +[ Upstream commit 9269e5560b261eb9ee157497890dc0948db76cf8 ] + +Many boards use i2c/spi expander gpio as phy-reset-gpios and these +gpios maybe registered after fec port, driver should check the return +value of .of_get_named_gpio(). + +Signed-off-by: Fugang Duan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/fec_main.c | 26 ++++++++++++++++++-------- + 1 file changed, 18 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3209,7 +3209,7 @@ static int fec_enet_init(struct net_devi + } + + #ifdef CONFIG_OF +-static void fec_reset_phy(struct platform_device *pdev) ++static int fec_reset_phy(struct platform_device *pdev) + { + int err, phy_reset; + bool active_high = false; +@@ -3217,7 +3217,7 @@ static void fec_reset_phy(struct platfor + struct device_node *np = pdev->dev.of_node; + + if (!np) +- return; ++ return 0; + + of_property_read_u32(np, "phy-reset-duration", &msec); + /* A sane reset duration should not be longer than 1s */ +@@ -3225,8 +3225,10 @@ static void fec_reset_phy(struct platfor + msec = 1; + + phy_reset = of_get_named_gpio(np, "phy-reset-gpios", 0); +- if (!gpio_is_valid(phy_reset)) +- return; ++ if (phy_reset == -EPROBE_DEFER) ++ return phy_reset; ++ else if (!gpio_is_valid(phy_reset)) ++ return 0; + + active_high = of_property_read_bool(np, "phy-reset-active-high"); + +@@ -3235,7 +3237,7 @@ static void fec_reset_phy(struct platfor + "phy-reset"); + if (err) { + dev_err(&pdev->dev, "failed to get phy-reset-gpios: %d\n", err); +- return; ++ return err; + } + + if (msec > 20) +@@ -3244,14 +3246,17 @@ static void fec_reset_phy(struct platfor + usleep_range(msec * 1000, msec * 1000 + 1000); + + gpio_set_value_cansleep(phy_reset, !active_high); ++ ++ return 0; + } + #else /* CONFIG_OF */ +-static void fec_reset_phy(struct platform_device *pdev) ++static int fec_reset_phy(struct platform_device *pdev) + { + /* + * In case of platform probe, the reset has been done + * by machine code. + */ ++ return 0; + } + #endif /* CONFIG_OF */ + +@@ -3422,6 +3427,7 @@ fec_probe(struct platform_device *pdev) + if (ret) { + dev_err(&pdev->dev, + "Failed to enable phy regulator: %d\n", ret); ++ clk_disable_unprepare(fep->clk_ipg); + goto failed_regulator; + } + } else { +@@ -3434,7 +3440,9 @@ fec_probe(struct platform_device *pdev) + pm_runtime_set_active(&pdev->dev); + pm_runtime_enable(&pdev->dev); + +- fec_reset_phy(pdev); ++ ret = fec_reset_phy(pdev); ++ if (ret) ++ goto failed_reset; + + if (fep->bufdesc_ex) + fec_ptp_init(pdev); +@@ -3495,8 +3503,10 @@ failed_init: + fec_ptp_stop(pdev); + if (fep->reg_phy) + regulator_disable(fep->reg_phy); ++failed_reset: ++ pm_runtime_put(&pdev->dev); ++ pm_runtime_disable(&pdev->dev); + failed_regulator: +- clk_disable_unprepare(fep->clk_ipg); + failed_clk_ipg: + fec_enet_clk_enable(ndev, false); + failed_clk: diff --git a/queue-4.9/net-hns-correct-hns-rss-key-set-function.patch b/queue-4.9/net-hns-correct-hns-rss-key-set-function.patch new file mode 100644 index 00000000000..ae460b82f80 --- /dev/null +++ b/queue-4.9/net-hns-correct-hns-rss-key-set-function.patch @@ -0,0 +1,95 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: lipeng +Date: Sat, 1 Apr 2017 12:03:39 +0100 +Subject: net: hns: Correct HNS RSS key set function + +From: lipeng + + +[ Upstream commit 64ec10dc2ab8ef5bc6e76b1d4bc8203c08a6da1e ] + +This patch fixes below ethtool configuration error: + +localhost:~ # ethtool -X eth0 hkey XX:XX:XX... +Cannot set Rx flow hash configuration: Operation not supported + +Signed-off-by: lipeng +Reviewed-by: Yisen Zhuang +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 27 +++++++++++++--------- + drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 9 +++---- + 2 files changed, 20 insertions(+), 16 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c +@@ -773,8 +773,9 @@ static int hns_ae_get_rss(struct hnae_ha + memcpy(key, ppe_cb->rss_key, HNS_PPEV2_RSS_KEY_SIZE); + + /* update the current hash->queue mappings from the shadow RSS table */ +- memcpy(indir, ppe_cb->rss_indir_table, +- HNS_PPEV2_RSS_IND_TBL_SIZE * sizeof(*indir)); ++ if (indir) ++ memcpy(indir, ppe_cb->rss_indir_table, ++ HNS_PPEV2_RSS_IND_TBL_SIZE * sizeof(*indir)); + + return 0; + } +@@ -785,15 +786,19 @@ static int hns_ae_set_rss(struct hnae_ha + struct hns_ppe_cb *ppe_cb = hns_get_ppe_cb(handle); + + /* set the RSS Hash Key if specififed by the user */ +- if (key) +- hns_ppe_set_rss_key(ppe_cb, (u32 *)key); +- +- /* update the shadow RSS table with user specified qids */ +- memcpy(ppe_cb->rss_indir_table, indir, +- HNS_PPEV2_RSS_IND_TBL_SIZE * sizeof(*indir)); +- +- /* now update the hardware */ +- hns_ppe_set_indir_table(ppe_cb, ppe_cb->rss_indir_table); ++ if (key) { ++ memcpy(ppe_cb->rss_key, key, HNS_PPEV2_RSS_KEY_SIZE); ++ hns_ppe_set_rss_key(ppe_cb, ppe_cb->rss_key); ++ } ++ ++ if (indir) { ++ /* update the shadow RSS table with user specified qids */ ++ memcpy(ppe_cb->rss_indir_table, indir, ++ HNS_PPEV2_RSS_IND_TBL_SIZE * sizeof(*indir)); ++ ++ /* now update the hardware */ ++ hns_ppe_set_indir_table(ppe_cb, ppe_cb->rss_indir_table); ++ } + + return 0; + } +--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +@@ -1243,6 +1243,7 @@ hns_set_rss(struct net_device *netdev, c + { + struct hns_nic_priv *priv = netdev_priv(netdev); + struct hnae_ae_ops *ops; ++ int ret; + + if (AE_IS_VER1(priv->enet_ver)) { + netdev_err(netdev, +@@ -1252,12 +1253,10 @@ hns_set_rss(struct net_device *netdev, c + + ops = priv->ae_handle->dev->ops; + +- /* currently hfunc can only be Toeplitz hash */ +- if (key || +- (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP)) ++ if (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP) { ++ netdev_err(netdev, "Invalid hfunc!\n"); + return -EOPNOTSUPP; +- if (!indir) +- return 0; ++ } + + return ops->set_rss(priv->ae_handle, indir, key, hfunc); + } diff --git a/queue-4.9/net-ieee802154-adf7242-fix-bug-if-defined-debug.patch b/queue-4.9/net-ieee802154-adf7242-fix-bug-if-defined-debug.patch new file mode 100644 index 00000000000..11d6cae21ca --- /dev/null +++ b/queue-4.9/net-ieee802154-adf7242-fix-bug-if-defined-debug.patch @@ -0,0 +1,41 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Michael Hennerich +Date: Tue, 28 Nov 2017 13:53:12 +0100 +Subject: net: ieee802154: adf7242: Fix bug if defined DEBUG + +From: Michael Hennerich + + +[ Upstream commit 388b3b2b03701f3b3c10975c272892d7f78080df ] + +This fixes undefined reference to struct adf7242_local *lp in +case DEBUG is defined. + +Signed-off-by: Michael Hennerich +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ieee802154/adf7242.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ieee802154/adf7242.c ++++ b/drivers/net/ieee802154/adf7242.c +@@ -888,7 +888,7 @@ static struct ieee802154_ops adf7242_ops + .set_cca_ed_level = adf7242_set_cca_ed_level, + }; + +-static void adf7242_debug(u8 irq1) ++static void adf7242_debug(struct adf7242_local *lp, u8 irq1) + { + #ifdef DEBUG + u8 stat; +@@ -932,7 +932,7 @@ static irqreturn_t adf7242_isr(int irq, + dev_err(&lp->spi->dev, "%s :ERROR IRQ1 = 0x%X\n", + __func__, irq1); + +- adf7242_debug(irq1); ++ adf7242_debug(lp, irq1); + + xmit = test_bit(FLAG_XMIT, &lp->flags); + diff --git a/queue-4.9/net-mvpp2-set-dma-mask-and-coherent-dma-mask-on-ppv2.2.patch b/queue-4.9/net-mvpp2-set-dma-mask-and-coherent-dma-mask-on-ppv2.2.patch new file mode 100644 index 00000000000..2cc99193c98 --- /dev/null +++ b/queue-4.9/net-mvpp2-set-dma-mask-and-coherent-dma-mask-on-ppv2.2.patch @@ -0,0 +1,48 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Thomas Petazzoni +Date: Tue, 7 Mar 2017 16:53:19 +0100 +Subject: net: mvpp2: set dma mask and coherent dma mask on PPv2.2 + +From: Thomas Petazzoni + + +[ Upstream commit 2067e0a13cfe0b1bdca7b91bc5e4f2740b07d478 ] + +On PPv2.2, the streaming mappings can be anywhere in the first 40 bits +of the physical address space. However, for the coherent mappings, we +still need them to be in the first 32 bits of the address space, +because all BM pools share a single register to store the high 32 bits +of the BM pool address, which means all BM pools must be allocated in +the same 4GB memory area. + +Signed-off-by: Thomas Petazzoni +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/mvpp2.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/net/ethernet/marvell/mvpp2.c ++++ b/drivers/net/ethernet/marvell/mvpp2.c +@@ -6420,6 +6420,20 @@ static int mvpp2_probe(struct platform_d + /* Get system's tclk rate */ + priv->tclk = clk_get_rate(priv->pp_clk); + ++ if (priv->hw_version == MVPP22) { ++ err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(40)); ++ if (err) ++ goto err_mg_clk; ++ /* Sadly, the BM pools all share the same register to ++ * store the high 32 bits of their address. So they ++ * must all have the same high 32 bits, which forces ++ * us to restrict coherent memory to DMA_BIT_MASK(32). ++ */ ++ err = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); ++ if (err) ++ goto err_mg_clk; ++ } ++ + /* Initialize network controller */ + err = mvpp2_init(pdev, priv); + if (err < 0) { diff --git a/queue-4.9/net-thunderx-set-max-queue-count-taking-xdp_tx-into-account.patch b/queue-4.9/net-thunderx-set-max-queue-count-taking-xdp_tx-into-account.patch new file mode 100644 index 00000000000..ff32fa1bfce --- /dev/null +++ b/queue-4.9/net-thunderx-set-max-queue-count-taking-xdp_tx-into-account.patch @@ -0,0 +1,38 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Sunil Goutham +Date: Fri, 24 Nov 2017 15:04:03 +0300 +Subject: net: thunderx: Set max queue count taking XDP_TX into account + +From: Sunil Goutham + + +[ Upstream commit 87de083857aa269fb171ef0b39696b2888361c58 ] + +on T81 there are only 4 cores, hence setting max queue count to 4 +would leave nothing for XDP_TX. This patch fixes this by doubling +max queue count in above scenarios. + +Signed-off-by: Sunil Goutham +Signed-off-by: cjacob +Signed-off-by: Aleksey Makarov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/cavium/thunder/nicvf_main.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c ++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c +@@ -1576,6 +1576,11 @@ static int nicvf_probe(struct pci_dev *p + nic->pdev = pdev; + nic->pnicvf = nic; + nic->max_queues = qcount; ++ /* If no of CPUs are too low, there won't be any queues left ++ * for XDP_TX, hence double it. ++ */ ++ if (!nic->t88) ++ nic->max_queues *= 2; + + /* MAP VF's configuration registers */ + nic->reg_base = pcim_iomap(pdev, PCI_CFG_REG_BAR_NUM, 0); diff --git a/queue-4.9/net-xfrm-allow-clearing-socket-xfrm-policies.patch b/queue-4.9/net-xfrm-allow-clearing-socket-xfrm-policies.patch new file mode 100644 index 00000000000..5cd91fc756a --- /dev/null +++ b/queue-4.9/net-xfrm-allow-clearing-socket-xfrm-policies.patch @@ -0,0 +1,68 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Lorenzo Colitti +Date: Mon, 20 Nov 2017 19:26:02 +0900 +Subject: net: xfrm: allow clearing socket xfrm policies. + +From: Lorenzo Colitti + + +[ Upstream commit be8f8284cd897af2482d4e54fbc2bdfc15557259 ] + +Currently it is possible to add or update socket policies, but +not clear them. Therefore, once a socket policy has been applied, +the socket cannot be used for unencrypted traffic. + +This patch allows (privileged) users to clear socket policies by +passing in a NULL pointer and zero length argument to the +{IP,IPV6}_{IPSEC,XFRM}_POLICY setsockopts. This results in both +the incoming and outgoing policies being cleared. + +The simple approach taken in this patch cannot clear socket +policies in only one direction. If desired this could be added +in the future, for example by continuing to pass in a length of +zero (which currently is guaranteed to return EMSGSIZE) and +making the policy be a pointer to an integer that contains one +of the XFRM_POLICY_{IN,OUT} enum values. + +An alternative would have been to interpret the length as a +signed integer and use XFRM_POLICY_IN (i.e., 0) to clear the +input policy and -XFRM_POLICY_OUT (i.e., -1) to clear the output +policy. + +Tested: https://android-review.googlesource.com/539816 +Signed-off-by: Lorenzo Colitti +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/xfrm/xfrm_policy.c | 2 +- + net/xfrm/xfrm_state.c | 7 +++++++ + 2 files changed, 8 insertions(+), 1 deletion(-) + +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -1346,7 +1346,7 @@ EXPORT_SYMBOL(xfrm_policy_delete); + + int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol) + { +- struct net *net = xp_net(pol); ++ struct net *net = sock_net(sk); + struct xfrm_policy *old_pol; + + #ifdef CONFIG_XFRM_SUB_POLICY +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -1883,6 +1883,13 @@ int xfrm_user_policy(struct sock *sk, in + struct xfrm_mgr *km; + struct xfrm_policy *pol = NULL; + ++ if (!optval && !optlen) { ++ xfrm_sk_policy_insert(sk, XFRM_POLICY_IN, NULL); ++ xfrm_sk_policy_insert(sk, XFRM_POLICY_OUT, NULL); ++ __sk_dst_reset(sk); ++ return 0; ++ } ++ + if (optlen <= 0 || optlen > PAGE_SIZE) + return -EMSGSIZE; + diff --git a/queue-4.9/netem-apply-correct-delay-when-rate-throttling.patch b/queue-4.9/netem-apply-correct-delay-when-rate-throttling.patch new file mode 100644 index 00000000000..d285bd1424c --- /dev/null +++ b/queue-4.9/netem-apply-correct-delay-when-rate-throttling.patch @@ -0,0 +1,110 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Nik Unger +Date: Mon, 13 Mar 2017 10:16:58 -0700 +Subject: netem: apply correct delay when rate throttling + +From: Nik Unger + + +[ Upstream commit 5080f39e8c72e01cf37e8359023e7018e2a4901e ] + +I recently reported on the netem list that iperf network benchmarks +show unexpected results when a bandwidth throttling rate has been +configured for netem. Specifically: + +1) The measured link bandwidth *increases* when a higher delay is added +2) The measured link bandwidth appears higher than the specified limit +3) The measured link bandwidth for the same very slow settings varies significantly across + machines + +The issue can be reproduced by using tc to configure netem with a +512kbit rate and various (none, 1us, 50ms, 100ms, 200ms) delays on a +veth pair between network namespaces, and then using iperf (or any +other network benchmarking tool) to test throughput. Complete detailed +instructions are in the original email chain here: +https://lists.linuxfoundation.org/pipermail/netem/2017-February/001672.html + +There appear to be two underlying bugs causing these effects: + +- The first issue causes long delays when the rate is slow and no + delay is configured (e.g., "rate 512kbit"). This is because SKBs are + not orphaned when no delay is configured, so orphaning does not + occur until *after* the rate-induced delay has been applied. For + this reason, adding a tiny delay (e.g., "rate 512kbit delay 1us") + dramatically increases the measured bandwidth. + +- The second issue is that rate-induced delays are not correctly + applied, allowing SKB delays to occur in parallel. The indended + approach is to compute the delay for an SKB and to add this delay to + the end of the current queue. However, the code does not detect + existing SKBs in the queue due to improperly testing sch->q.qlen, + which is nonzero even when packets exist only in the + rbtree. Consequently, new SKBs do not wait for the current queue to + empty. When packet delays vary significantly (e.g., if packet sizes + are different), then this also causes unintended reordering. + +I modified the code to expect a delay (and orphan the SKB) when a rate +is configured. I also added some defensive tests that correctly find +the latest scheduled delivery time, even if it is (unexpectedly) for a +packet in sch->q. I have tested these changes on the latest kernel +(4.11.0-rc1+) and the iperf / ping test results are as expected. + +Signed-off-by: Nik Unger +Signed-off-by: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_netem.c | 26 ++++++++++++++++++-------- + 1 file changed, 18 insertions(+), 8 deletions(-) + +--- a/net/sched/sch_netem.c ++++ b/net/sched/sch_netem.c +@@ -462,7 +462,7 @@ static int netem_enqueue(struct sk_buff + /* If a delay is expected, orphan the skb. (orphaning usually takes + * place at TX completion time, so _before_ the link transit delay) + */ +- if (q->latency || q->jitter) ++ if (q->latency || q->jitter || q->rate) + skb_orphan_partial(skb); + + /* +@@ -530,21 +530,31 @@ static int netem_enqueue(struct sk_buff + now = psched_get_time(); + + if (q->rate) { +- struct sk_buff *last; ++ struct netem_skb_cb *last = NULL; ++ ++ if (sch->q.tail) ++ last = netem_skb_cb(sch->q.tail); ++ if (q->t_root.rb_node) { ++ struct sk_buff *t_skb; ++ struct netem_skb_cb *t_last; ++ ++ t_skb = netem_rb_to_skb(rb_last(&q->t_root)); ++ t_last = netem_skb_cb(t_skb); ++ if (!last || ++ t_last->time_to_send > last->time_to_send) { ++ last = t_last; ++ } ++ } + +- if (sch->q.qlen) +- last = sch->q.tail; +- else +- last = netem_rb_to_skb(rb_last(&q->t_root)); + if (last) { + /* + * Last packet in queue is reference point (now), + * calculate this time bonus and subtract + * from delay. + */ +- delay -= netem_skb_cb(last)->time_to_send - now; ++ delay -= last->time_to_send - now; + delay = max_t(psched_tdiff_t, 0, delay); +- now = netem_skb_cb(last)->time_to_send; ++ now = last->time_to_send; + } + + delay += packet_len_2_sched_time(qdisc_pkt_len(skb), q); diff --git a/queue-4.9/nfc-nfcmrvl-double-free-on-error-path.patch b/queue-4.9/nfc-nfcmrvl-double-free-on-error-path.patch new file mode 100644 index 00000000000..aa115db0a83 --- /dev/null +++ b/queue-4.9/nfc-nfcmrvl-double-free-on-error-path.patch @@ -0,0 +1,37 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Dan Carpenter +Date: Wed, 8 Mar 2017 08:22:37 +0300 +Subject: NFC: nfcmrvl: double free on error path + +From: Dan Carpenter + + +[ Upstream commit ca42fb9e52d155547e6cf18cf26bce3e1a6af4ea ] + +The nci_spi_send() function calls kfree_skb(skb) on both error and +success so this extra kfree_skb() is a double free. + +Fixes: caf6e49bf6d0 ("NFC: nfcmrvl: add spi driver") +Signed-off-by: Dan Carpenter +Signed-off-by: Samuel Ortiz +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nfc/nfcmrvl/spi.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/nfc/nfcmrvl/spi.c ++++ b/drivers/nfc/nfcmrvl/spi.c +@@ -96,10 +96,9 @@ static int nfcmrvl_spi_nci_send(struct n + /* Send the SPI packet */ + err = nci_spi_send(drv_data->nci_spi, &drv_data->handshake_completion, + skb); +- if (err != 0) { ++ if (err) + nfc_err(priv->dev, "spi_send failed %d", err); +- kfree_skb(skb); +- } ++ + return err; + } + diff --git a/queue-4.9/nfc-nfcmrvl-include-unaligned.h-instead-of-access_ok.h.patch b/queue-4.9/nfc-nfcmrvl-include-unaligned.h-instead-of-access_ok.h.patch new file mode 100644 index 00000000000..e0772a1baa3 --- /dev/null +++ b/queue-4.9/nfc-nfcmrvl-include-unaligned.h-instead-of-access_ok.h.patch @@ -0,0 +1,52 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Tobias Klauser +Date: Wed, 26 Oct 2016 11:00:12 +0200 +Subject: NFC: nfcmrvl: Include unaligned.h instead of access_ok.h + +From: Tobias Klauser + + +[ Upstream commit d916d923724d59cde99ee588f15eec59dd863bbd ] + +Including linux/unaligned/access_ok.h causes the allmodconfig build on +ia64 (and maybe others) to fail with the following warnings: + +include/linux/unaligned/access_ok.h:7:19: error: redefinition of 'get_unaligned_le16' +include/linux/unaligned/access_ok.h:12:19: error: redefinition of 'get_unaligned_le32' +include/linux/unaligned/access_ok.h:17:19: error: redefinition of 'get_unaligned_le64' +include/linux/unaligned/access_ok.h:22:19: error: redefinition of 'get_unaligned_be16' +include/linux/unaligned/access_ok.h:27:19: error: redefinition of 'get_unaligned_be32' +include/linux/unaligned/access_ok.h:32:19: error: redefinition of 'get_unaligned_be64' +include/linux/unaligned/access_ok.h:37:20: error: redefinition of 'put_unaligned_le16' +include/linux/unaligned/access_ok.h:42:20: error: redefinition of 'put_unaligned_le32' +include/linux/unaligned/access_ok.h:42:20: error: redefinition of 'put_unaligned_le64' +include/linux/unaligned/access_ok.h:42:20: error: redefinition of 'put_unaligned_be16' +include/linux/unaligned/access_ok.h:42:20: error: redefinition of 'put_unaligned_be32' +include/linux/unaligned/access_ok.h:42:20: error: redefinition of 'put_unaligned_be64' + +Fix these by including asm/unaligned.h instead and leave it up to the +architecture to decide how to implement unaligned accesses. + +Fixes: 3194c6870158 ("NFC: nfcmrvl: add firmware download support") +Reported-by: kbuild test robot +Link: https://lkml.org/lkml/2016/10/22/247 +Cc: Vincent Cuissard +Signed-off-by: Tobias Klauser +Signed-off-by: Samuel Ortiz +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nfc/nfcmrvl/fw_dnld.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/nfc/nfcmrvl/fw_dnld.c ++++ b/drivers/nfc/nfcmrvl/fw_dnld.c +@@ -17,7 +17,7 @@ + */ + + #include +-#include ++#include + #include + #include + #include diff --git a/queue-4.9/nfc-pn533-change-order-of-free_irq-and-dev-unregistration.patch b/queue-4.9/nfc-pn533-change-order-of-free_irq-and-dev-unregistration.patch new file mode 100644 index 00000000000..ccf8bb51e12 --- /dev/null +++ b/queue-4.9/nfc-pn533-change-order-of-free_irq-and-dev-unregistration.patch @@ -0,0 +1,37 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Andrey Rusalin +Date: Wed, 28 Dec 2016 20:10:57 +0300 +Subject: NFC: pn533: change order of free_irq and dev unregistration + +From: Andrey Rusalin + + +[ Upstream commit 068a496c4525c638ffab56449d905b88ef97fe32 ] + +Change order of free_irq and dev unregistration. +It fixes situation when device already unregistered and +an interrupt happens and nobody can handle it. + +Signed-off-by: Andrey Rusalin +Signed-off-by: Samuel Ortiz +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nfc/pn533/i2c.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/nfc/pn533/i2c.c ++++ b/drivers/nfc/pn533/i2c.c +@@ -242,10 +242,10 @@ static int pn533_i2c_remove(struct i2c_c + + dev_dbg(&client->dev, "%s\n", __func__); + +- pn533_unregister_device(phy->priv); +- + free_irq(client->irq, phy); + ++ pn533_unregister_device(phy->priv); ++ + return 0; + } + diff --git a/queue-4.9/of-fix-of_device_get_modalias-returned-length-when-truncating-buffers.patch b/queue-4.9/of-fix-of_device_get_modalias-returned-length-when-truncating-buffers.patch new file mode 100644 index 00000000000..2a422763a0d --- /dev/null +++ b/queue-4.9/of-fix-of_device_get_modalias-returned-length-when-truncating-buffers.patch @@ -0,0 +1,37 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Rob Herring +Date: Mon, 16 Jan 2017 14:28:39 -0600 +Subject: of: fix of_device_get_modalias returned length when truncating buffers + +From: Rob Herring + + +[ Upstream commit bcf54d5385abaea9c8026aae6f4eeb348671a52d ] + +If the length of the modalias is greater than the buffer size, then the +modalias is truncated. However the untruncated length is returned which +will cause an error. Fix this to return the truncated length. If an error +in the case was desired, then then we should just return -ENOMEM. + +The reality is no device will ever have 4KB of compatible strings to hit +this case. + +Signed-off-by: Rob Herring +Cc: Frank Rowand +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/of/device.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/of/device.c ++++ b/drivers/of/device.c +@@ -223,7 +223,7 @@ ssize_t of_device_get_modalias(struct de + str[i] = '_'; + } + +- return tsize; ++ return repend; + } + EXPORT_SYMBOL_GPL(of_device_get_modalias); + diff --git a/queue-4.9/omapfb-dss-handle-return-errors-in-dss_init_ports.patch b/queue-4.9/omapfb-dss-handle-return-errors-in-dss_init_ports.patch new file mode 100644 index 00000000000..b9298980a73 --- /dev/null +++ b/queue-4.9/omapfb-dss-handle-return-errors-in-dss_init_ports.patch @@ -0,0 +1,70 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Arvind Yadav +Date: Mon, 20 Mar 2017 18:30:59 +0100 +Subject: omapfb: dss: Handle return errors in dss_init_ports() + +From: Arvind Yadav + + +[ Upstream commit 0348aaa34412e24ebe622a2b1b013e68d6ae5412 ] + +dss_init_ports() is not handling return errors from dpi_init_port() and +sdi_init_port(). It is also always returning 0 currently which results in +part of error handling code in dss_bind() being unused. + +Fix dss_init_ports() to handle return errors from dpi_init_port() and +sdi_init_port(). + +Signed-off-by: Arvind Yadav +Cc: tomi.valkeinen@ti.com +[b.zolnierkie: fail early on errors, minor fixups] +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/omap2/omapfb/dss/dss.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/drivers/video/fbdev/omap2/omapfb/dss/dss.c ++++ b/drivers/video/fbdev/omap2/omapfb/dss/dss.c +@@ -941,11 +941,13 @@ static int dss_init_features(struct plat + return 0; + } + ++static void dss_uninit_ports(struct platform_device *pdev); ++ + static int dss_init_ports(struct platform_device *pdev) + { + struct device_node *parent = pdev->dev.of_node; + struct device_node *port; +- int r; ++ int r, ret = 0; + + if (parent == NULL) + return 0; +@@ -972,17 +974,21 @@ static int dss_init_ports(struct platfor + + switch (port_type) { + case OMAP_DISPLAY_TYPE_DPI: +- dpi_init_port(pdev, port); ++ ret = dpi_init_port(pdev, port); + break; + case OMAP_DISPLAY_TYPE_SDI: +- sdi_init_port(pdev, port); ++ ret = sdi_init_port(pdev, port); + break; + default: + break; + } +- } while ((port = omapdss_of_get_next_port(parent, port)) != NULL); ++ } while (!ret && ++ (port = omapdss_of_get_next_port(parent, port)) != NULL); + +- return 0; ++ if (ret) ++ dss_uninit_ports(pdev); ++ ++ return ret; + } + + static void dss_uninit_ports(struct platform_device *pdev) diff --git a/queue-4.9/pci-apply-cavium-acs-quirk-only-to-cn81xx-cn83xx-cn88xx-devices.patch b/queue-4.9/pci-apply-cavium-acs-quirk-only-to-cn81xx-cn83xx-cn88xx-devices.patch new file mode 100644 index 00000000000..30fbde9a075 --- /dev/null +++ b/queue-4.9/pci-apply-cavium-acs-quirk-only-to-cn81xx-cn83xx-cn88xx-devices.patch @@ -0,0 +1,36 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Manish Jaggi +Date: Thu, 30 Mar 2017 18:47:14 -0500 +Subject: PCI: Apply Cavium ACS quirk only to CN81xx/CN83xx/CN88xx devices + +From: Manish Jaggi + + +[ Upstream commit b77d537d00d08fcf0bf641cd3491dd7df0ad1475 ] + +Only apply the Cavium ACS quirk to devices with ID in the range +0xa000-0xa0ff. These are the on-chip PCI devices for CN81xx/CN83xx/CN88xx. + +Fixes: b404bcfbf035 ("PCI: Add ACS quirk for all Cavium devices") +Reported-by: Alex Williamson +Signed-off-by: Manish Jaggi +Acked-by: David Daney +Acked-by: Alex Williamson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4104,6 +4104,9 @@ static int pci_quirk_cavium_acs(struct p + */ + acs_flags &= ~(PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_SV | PCI_ACS_UF); + ++ if (!((dev->device >= 0xa000) && (dev->device <= 0xa0ff))) ++ return -ENOTTY; ++ + return acs_flags ? 0 : 1; + } + diff --git a/queue-4.9/pci-hv-lock-pci-bus-on-device-eject.patch b/queue-4.9/pci-hv-lock-pci-bus-on-device-eject.patch new file mode 100644 index 00000000000..8e1a978e786 --- /dev/null +++ b/queue-4.9/pci-hv-lock-pci-bus-on-device-eject.patch @@ -0,0 +1,55 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Long Li +Date: Thu, 23 Mar 2017 14:58:32 -0700 +Subject: PCI: hv: Lock PCI bus on device eject + +From: Long Li + + +[ Upstream commit 414428c5da1c71986727c2fa5cdf1ed071e398d7 ] + +A PCI_EJECT message can arrive at the same time we are calling +pci_scan_child_bus() in the workqueue for the previous PCI_BUS_RELATIONS +message or in create_root_hv_pci_bus(). In this case we could potentially +modify the bus from multiple places. + +Properly lock the bus access. + +Thanks Dexuan Cui for pointing out the race condition +in create_root_hv_pci_bus(). + +Reported-by: Xiaofeng Wang +Signed-off-by: Long Li +Signed-off-by: Bjorn Helgaas +Acked-by: K. Y. Srinivasan +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/host/pci-hyperv.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/pci/host/pci-hyperv.c ++++ b/drivers/pci/host/pci-hyperv.c +@@ -1206,9 +1206,11 @@ static int create_root_hv_pci_bus(struct + hbus->pci_bus->msi = &hbus->msi_chip; + hbus->pci_bus->msi->dev = &hbus->hdev->device; + ++ pci_lock_rescan_remove(); + pci_scan_child_bus(hbus->pci_bus); + pci_bus_assign_resources(hbus->pci_bus); + pci_bus_add_devices(hbus->pci_bus); ++ pci_unlock_rescan_remove(); + hbus->state = hv_pcibus_installed; + return 0; + } +@@ -1597,8 +1599,10 @@ static void hv_eject_device_work(struct + pdev = pci_get_domain_bus_and_slot(hpdev->hbus->sysdata.domain, 0, + wslot); + if (pdev) { ++ pci_lock_rescan_remove(); + pci_stop_and_remove_bus_device(pdev); + pci_dev_put(pdev); ++ pci_unlock_rescan_remove(); + } + + memset(&ctxt, 0, sizeof(ctxt)); diff --git a/queue-4.9/pci-hv-properly-handle-pci-bus-remove.patch b/queue-4.9/pci-hv-properly-handle-pci-bus-remove.patch new file mode 100644 index 00000000000..a2ac0e9fb01 --- /dev/null +++ b/queue-4.9/pci-hv-properly-handle-pci-bus-remove.patch @@ -0,0 +1,82 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Long Li +Date: Thu, 23 Mar 2017 14:58:10 -0700 +Subject: PCI: hv: Properly handle PCI bus remove + +From: Long Li + + +[ Upstream commit d3a78d8bf759d8848339dcc367c4c1678b57a08b ] + +hv_pci_devices_present() is called in hv_pci_remove() when we remove a PCI +device from the host, e.g., by disabling SR-IOV on a device. In +hv_pci_remove(), the bus is already removed before the call, so we don't +need to rescan the bus in the workqueue scheduled from +hv_pci_devices_present(). + +By introducing bus state hv_pcibus_removed, we can avoid this situation. + +Reported-by: Xiaofeng Wang +Signed-off-by: Long Li +Signed-off-by: Bjorn Helgaas +Acked-by: K. Y. Srinivasan +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/host/pci-hyperv.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +--- a/drivers/pci/host/pci-hyperv.c ++++ b/drivers/pci/host/pci-hyperv.c +@@ -351,6 +351,7 @@ enum hv_pcibus_state { + hv_pcibus_init = 0, + hv_pcibus_probed, + hv_pcibus_installed, ++ hv_pcibus_removed, + hv_pcibus_maximum + }; + +@@ -1489,13 +1490,24 @@ static void pci_devices_present_work(str + put_pcichild(hpdev, hv_pcidev_ref_initial); + } + +- /* Tell the core to rescan bus because there may have been changes. */ +- if (hbus->state == hv_pcibus_installed) { ++ switch(hbus->state) { ++ case hv_pcibus_installed: ++ /* ++ * Tell the core to rescan bus ++ * because there may have been changes. ++ */ + pci_lock_rescan_remove(); + pci_scan_child_bus(hbus->pci_bus); + pci_unlock_rescan_remove(); +- } else { ++ break; ++ ++ case hv_pcibus_init: ++ case hv_pcibus_probed: + survey_child_resources(hbus); ++ break; ++ ++ default: ++ break; + } + + up(&hbus->enum_sem); +@@ -2170,6 +2182,7 @@ static int hv_pci_probe(struct hv_device + hbus = kzalloc(sizeof(*hbus), GFP_KERNEL); + if (!hbus) + return -ENOMEM; ++ hbus->state = hv_pcibus_init; + + /* + * The PCI bus "domain" is what is called "segment" in ACPI and +@@ -2312,6 +2325,7 @@ static int hv_pci_remove(struct hv_devic + pci_stop_root_bus(hbus->pci_bus); + pci_remove_root_bus(hbus->pci_bus); + pci_unlock_rescan_remove(); ++ hbus->state = hv_pcibus_removed; + } + + ret = hv_send_resources_released(hdev); diff --git a/queue-4.9/pci-msi-stop-disabling-msi-msi-x-in-pci_device_shutdown.patch b/queue-4.9/pci-msi-stop-disabling-msi-msi-x-in-pci_device_shutdown.patch new file mode 100644 index 00000000000..5bb844d782a --- /dev/null +++ b/queue-4.9/pci-msi-stop-disabling-msi-msi-x-in-pci_device_shutdown.patch @@ -0,0 +1,69 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Prarit Bhargava +Date: Thu, 26 Jan 2017 14:07:47 -0500 +Subject: PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown() + +From: Prarit Bhargava + + +[ Upstream commit fda78d7a0ead144f4b2cdb582dcba47911f4952c ] + +The pci_bus_type .shutdown method, pci_device_shutdown(), is called from +device_shutdown() in the kernel restart and shutdown paths. + +Previously, pci_device_shutdown() called pci_msi_shutdown() and +pci_msix_shutdown(). This disables MSI and MSI-X, which causes the device +to fall back to raising interrupts via INTx. But the driver is still bound +to the device, it doesn't know about this change, and it likely doesn't +have an INTx handler, so these INTx interrupts cause "nobody cared" +warnings like this: + + irq 16: nobody cared (try booting with the "irqpoll" option) + CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.8.2-1.el7_UNSUPPORTED.x86_64 #1 + Hardware name: Hewlett-Packard HP Z820 Workstation/158B, BIOS J63 v03.90 06/ + ... + +The MSI disabling code was added by d52877c7b1af ("pci/irq: let +pci_device_shutdown to call pci_msi_shutdown v2") because a driver left MSI +enabled and kdump failed because the kexeced kernel wasn't prepared to +receive the MSI interrupts. + +Subsequent commits 1851617cd2da ("PCI/MSI: Disable MSI at enumeration even +if kernel doesn't support MSI") and e80e7edc55ba ("PCI/MSI: Initialize MSI +capability for all architectures") changed the kexeced kernel to disable +all MSIs itself so it no longer depends on the crashed kernel to clean up +after itself. + +Stop disabling MSI/MSI-X in pci_device_shutdown(). This resolves the +"nobody cared" unhandled IRQ issue above. It also allows PCI serial +devices, which may rely on the MSI interrupts, to continue outputting +messages during reboot/shutdown. + +[bhelgaas: changelog, drop pci_msi_shutdown() and pci_msix_shutdown() calls +altogether] +Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=187351 +Signed-off-by: Prarit Bhargava +Signed-off-by: Bjorn Helgaas +CC: Alex Williamson +CC: David Arcari +CC: Myron Stowe +CC: Lukas Wunner +CC: Keith Busch +CC: Mika Westerberg +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/pci-driver.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -463,8 +463,6 @@ static void pci_device_shutdown(struct d + + if (drv && drv->shutdown) + drv->shutdown(pci_dev); +- pci_msi_shutdown(pci_dev); +- pci_msix_shutdown(pci_dev); + + /* + * If this is a kexec reboot, turn off Bus Master bit on the diff --git a/queue-4.9/perf-annotate-fix-a-bug-following-symbolic-link-of-a-build-id-file.patch b/queue-4.9/perf-annotate-fix-a-bug-following-symbolic-link-of-a-build-id-file.patch new file mode 100644 index 00000000000..98241fb6e1d --- /dev/null +++ b/queue-4.9/perf-annotate-fix-a-bug-following-symbolic-link-of-a-build-id-file.patch @@ -0,0 +1,73 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Taeung Song +Date: Mon, 27 Mar 2017 16:10:36 +0900 +Subject: perf annotate: Fix a bug following symbolic link of a build-id file + +From: Taeung Song + + +[ Upstream commit 6ebd2547dd24daf95a21b2bc59931de8502afcc3 ] + +It is wrong way to read link name from a build-id file. Because a +build-id file is not anymore a symbolic link but build-id directory of +it is symbolic link, so fix it. + +For example, if build-id file name gotten from +dso__build_id_filename() is as below, + + /root/.debug/.build-id/4f/75c7d197c951659d1c1b8b5fd49bcdf8f3f8b1/elf + +To correctly read link name of build-id, use the build-id dir path that +is a symbolic link, instead of the above build-id file name like below. + + /root/.debug/.build-id/4f/75c7d197c951659d1c1b8b5fd49bcdf8f3f8b1 + +Signed-off-by: Taeung Song +Cc: Jiri Olsa +Cc: Masami Hiramatsu +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Wang Nan +Link: http://lkml.kernel.org/r/1490598638-13947-2-git-send-email-treeze.taeung@gmail.com +Fixes: 01412261d994 ("perf buildid-cache: Use path/to/bin/buildid/elf instead of path/to/bin/buildid") +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/annotate.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/tools/perf/util/annotate.c ++++ b/tools/perf/util/annotate.c +@@ -1250,6 +1250,7 @@ static int dso__disassemble_filename(str + { + char linkname[PATH_MAX]; + char *build_id_filename; ++ char *build_id_path = NULL; + + if (dso->symtab_type == DSO_BINARY_TYPE__KALLSYMS && + !dso__is_kcore(dso)) +@@ -1265,8 +1266,14 @@ static int dso__disassemble_filename(str + goto fallback; + } + ++ build_id_path = strdup(filename); ++ if (!build_id_path) ++ return -1; ++ ++ dirname(build_id_path); ++ + if (dso__is_kcore(dso) || +- readlink(filename, linkname, sizeof(linkname)) < 0 || ++ readlink(build_id_path, linkname, sizeof(linkname)) < 0 || + strstr(linkname, DSO__NAME_KALLSYMS) || + access(filename, R_OK)) { + fallback: +@@ -1278,6 +1285,7 @@ fallback: + __symbol__join_symfs(filename, filename_size, dso->long_name); + } + ++ free(build_id_path); + return 0; + } + diff --git a/queue-4.9/perf-buildid-do-not-assume-that-readlink-returns-a-null-terminated-string.patch b/queue-4.9/perf-buildid-do-not-assume-that-readlink-returns-a-null-terminated-string.patch new file mode 100644 index 00000000000..7a98aa47033 --- /dev/null +++ b/queue-4.9/perf-buildid-do-not-assume-that-readlink-returns-a-null-terminated-string.patch @@ -0,0 +1,66 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Tommi Rantala +Date: Wed, 22 Mar 2017 15:06:20 +0200 +Subject: perf buildid: Do not assume that readlink() returns a null terminated string + +From: Tommi Rantala + + +[ Upstream commit 5a2342111c68e623e27ee7ea3d0492d8dad6bda0 ] + +Valgrind was complaining: + + $ valgrind ./perf list >/dev/null + ==11643== Memcheck, a memory error detector + ==11643== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al. + ==11643== Using Valgrind-3.12.0 and LibVEX; rerun with -h for copyright info + ==11643== Command: ./perf list + ==11643== + ==11643== Conditional jump or move depends on uninitialised value(s) + ==11643== at 0x4C30620: rindex (vg_replace_strmem.c:199) + ==11643== by 0x49DAA9: build_id_cache__origname (build-id.c:198) + ==11643== by 0x49E1C7: build_id_cache__valid_id (build-id.c:222) + ==11643== by 0x49E1C7: build_id_cache__list_all (build-id.c:507) + ==11643== by 0x4B9C8F: print_sdt_events (parse-events.c:2067) + ==11643== by 0x4BB0B3: print_events (parse-events.c:2313) + ==11643== by 0x439501: cmd_list (builtin-list.c:53) + ==11643== by 0x497150: run_builtin (perf.c:359) + ==11643== by 0x428CE0: handle_internal_command (perf.c:421) + ==11643== by 0x428CE0: run_argv (perf.c:467) + ==11643== by 0x428CE0: main (perf.c:614) + [...] + +Additionally, a zero length result from readlink() is not very interesting. + +Signed-off-by: Tommi Rantala +Cc: Alexander Shishkin +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/20170322130624.21881-3-tommi.t.rantala@nokia.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/build-id.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/tools/perf/util/build-id.c ++++ b/tools/perf/util/build-id.c +@@ -182,13 +182,17 @@ char *build_id_cache__origname(const cha + char buf[PATH_MAX]; + char *ret = NULL, *p; + size_t offs = 5; /* == strlen("../..") */ ++ ssize_t len; + + linkname = build_id_cache__linkname(sbuild_id, NULL, 0); + if (!linkname) + return NULL; + +- if (readlink(linkname, buf, PATH_MAX) < 0) ++ len = readlink(linkname, buf, sizeof(buf) - 1); ++ if (len <= 0) + goto out; ++ buf[len] = '\0'; ++ + /* The link should be "../../" */ + p = strrchr(buf, '/'); /* Cut off the "/" */ + if (p && (p > buf + offs)) { diff --git a/queue-4.9/perf-evsel-return-exact-sub-event-which-failed-with-eperm-for-wildcards.patch b/queue-4.9/perf-evsel-return-exact-sub-event-which-failed-with-eperm-for-wildcards.patch new file mode 100644 index 00000000000..81c9040b7de --- /dev/null +++ b/queue-4.9/perf-evsel-return-exact-sub-event-which-failed-with-eperm-for-wildcards.patch @@ -0,0 +1,179 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Jin Yao +Date: Fri, 7 Apr 2017 20:08:52 +0800 +Subject: perf evsel: Return exact sub event which failed with EPERM for wildcards + +From: Jin Yao + + +[ Upstream commit 32ccb130f5325abc81b32b1a538390f46e4860f6 ] + +The kernel has a special check for a specific irq_vectors trace event. + +TRACE_EVENT_PERF_PERM(irq_work_exit, + is_sampling_event(p_event) ? -EPERM : 0); + +The perf-record fails for this irq_vectors event when it is present, +like when using a wildcard: + + root@skl:/tmp# perf record -a -e irq_vectors:* sleep 2 + Error: + You may not have permission to collect system-wide stats. + + Consider tweaking /proc/sys/kernel/perf_event_paranoid, + which controls use of the performance events system by + unprivileged users (without CAP_SYS_ADMIN). + + The current value is 2: + + -1: Allow use of (almost) all events by all users + >= 0: Disallow raw tracepoint access by users without CAP_IOC_LOCK + >= 1: Disallow CPU event access by users without CAP_SYS_ADMIN + >= 2: Disallow kernel profiling by users without CAP_SYS_ADMIN + + To make this setting permanent, edit /etc/sysctl.conf too, e.g.: + + kernel.perf_event_paranoid = -1 + +This patch prints out the exact sub event that failed with EPERM for +wildcards to help in understanding what went wrong when this event is +present: + +After the patch: + + root@skl:/tmp# perf record -a -e irq_vectors:* sleep 2 + Error: + No permission to enable irq_vectors:irq_work_exit event. + + You may not have permission to collect system-wide stats. + ...... + +Committer notes: + +So we have a lot of irq_vectors events: + + [root@jouet ~]# perf list irq_vectors:* + + List of pre-defined events (to be used in -e): + + irq_vectors:call_function_entry [Tracepoint event] + irq_vectors:call_function_exit [Tracepoint event] + irq_vectors:call_function_single_entry [Tracepoint event] + irq_vectors:call_function_single_exit [Tracepoint event] + irq_vectors:deferred_error_apic_entry [Tracepoint event] + irq_vectors:deferred_error_apic_exit [Tracepoint event] + irq_vectors:error_apic_entry [Tracepoint event] + irq_vectors:error_apic_exit [Tracepoint event] + irq_vectors:irq_work_entry [Tracepoint event] + irq_vectors:irq_work_exit [Tracepoint event] + irq_vectors:local_timer_entry [Tracepoint event] + irq_vectors:local_timer_exit [Tracepoint event] + irq_vectors:reschedule_entry [Tracepoint event] + irq_vectors:reschedule_exit [Tracepoint event] + irq_vectors:spurious_apic_entry [Tracepoint event] + irq_vectors:spurious_apic_exit [Tracepoint event] + irq_vectors:thermal_apic_entry [Tracepoint event] + irq_vectors:thermal_apic_exit [Tracepoint event] + irq_vectors:threshold_apic_entry [Tracepoint event] + irq_vectors:threshold_apic_exit [Tracepoint event] + irq_vectors:x86_platform_ipi_entry [Tracepoint event] + irq_vectors:x86_platform_ipi_exit [Tracepoint event] + # + +And some may be sampled: + + [root@jouet ~]# perf record -e irq_vectors:local* sleep 20s + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.020 MB perf.data (2 samples) ] + [root@jouet ~]# perf report -D | egrep 'stats:|events:' + Aggregated stats: + TOTAL events: 155 + MMAP events: 144 + COMM events: 2 + EXIT events: 1 + SAMPLE events: 2 + MMAP2 events: 4 + FINISHED_ROUND events: 1 + TIME_CONV events: 1 + irq_vectors:local_timer_entry stats: + TOTAL events: 1 + SAMPLE events: 1 + irq_vectors:local_timer_exit stats: + TOTAL events: 1 + SAMPLE events: 1 + [root@jouet ~]# + +But, as shown in the tracepoint definition at the start of this message, +some, like "irq_vectors:irq_work_exit", may not be sampled, just counted, +i.e. if we try to sample, as when using 'perf record', we get an error: + + [root@jouet ~]# perf record -e irq_vectors:irq_work_exit + Error: + You may not have permission to collect system-wide stats. + + Consider tweaking /proc/sys/kernel/perf_event_paranoid, + + +The error message is misleading, this patch will help in pointing out +what is the event causing such an error, but the error message needs +improvement, i.e. we need to figure out a way to check if a tracepoint +is counting only, like this one, when all we can do is to count it with +'perf stat', at most printing the delta using interval printing, as in: + + [root@jouet ~]# perf stat -I 5000 -e irq_vectors:irq_work_* + # time counts unit events + 5.000168871 0 irq_vectors:irq_work_entry + 5.000168871 0 irq_vectors:irq_work_exit + 10.000676730 0 irq_vectors:irq_work_entry + 10.000676730 0 irq_vectors:irq_work_exit + 15.001122415 0 irq_vectors:irq_work_entry + 15.001122415 0 irq_vectors:irq_work_exit + 20.001298051 0 irq_vectors:irq_work_entry + 20.001298051 0 irq_vectors:irq_work_exit + 25.001485020 1 irq_vectors:irq_work_entry + 25.001485020 1 irq_vectors:irq_work_exit + 30.001658706 0 irq_vectors:irq_work_entry + 30.001658706 0 irq_vectors:irq_work_exit + ^C 32.045711878 0 irq_vectors:irq_work_entry + 32.045711878 0 irq_vectors:irq_work_exit + + [root@jouet ~]# + +But at least, when we use a wildcard, this patch helps a bit. + +Signed-off-by: Yao Jin +Tested-by: Arnaldo Carvalho de Melo +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/1491566932-503-1-git-send-email-yao.jin@linux.intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/evsel.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -2400,11 +2400,17 @@ int perf_evsel__open_strerror(struct per + int err, char *msg, size_t size) + { + char sbuf[STRERR_BUFSIZE]; ++ int printed = 0; + + switch (err) { + case EPERM: + case EACCES: +- return scnprintf(msg, size, ++ if (err == EPERM) ++ printed = scnprintf(msg, size, ++ "No permission to enable %s event.\n\n", ++ perf_evsel__name(evsel)); ++ ++ return scnprintf(msg + printed, size - printed, + "You may not have permission to collect %sstats.\n\n" + "Consider tweaking /proc/sys/kernel/perf_event_paranoid,\n" + "which controls use of the performance events system by\n" diff --git a/queue-4.9/perf-inject-copy-events-when-reordering-events-in-pipe-mode.patch b/queue-4.9/perf-inject-copy-events-when-reordering-events-in-pipe-mode.patch new file mode 100644 index 00000000000..d08e1940177 --- /dev/null +++ b/queue-4.9/perf-inject-copy-events-when-reordering-events-in-pipe-mode.patch @@ -0,0 +1,101 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: David Carrillo-Cisneros +Date: Mon, 10 Apr 2017 13:14:27 -0700 +Subject: perf inject: Copy events when reordering events in pipe mode + +From: David Carrillo-Cisneros + + +[ Upstream commit 1e0d4f0200e4dbdfc38d818f329d8a0955f7c6f5 ] + +__perf_session__process_pipe_events reuses the same memory buffer to +process all events in the pipe. + +When reordering is needed (e.g. -b option), events are not immediately +flushed, but kept around until reordering is possible, causing +memory corruption. + +The problem is usually observed by a "Unknown sample error" output. It +can easily be reproduced by: + + perf record -o - noploop | perf inject -b > output + +Committer testing: + +Before: + + $ perf record -o - stress -t 2 -c 2 | perf inject -b > /dev/null + stress: info: [8297] dispatching hogs: 2 cpu, 0 io, 0 vm, 0 hdd + stress: info: [8297] successful run completed in 2s + [ perf record: Woken up 3 times to write data ] + [ perf record: Captured and wrote 0.000 MB - ] + Warning: + Found 1 unknown events! + + Is this an older tool processing a perf.data file generated by a more recent tool? + + If that is not the case, consider reporting to linux-kernel@vger.kernel.org. + + $ + +After: + + $ perf record -o - stress -t 2 -c 2 | perf inject -b > /dev/null + stress: info: [9027] dispatching hogs: 2 cpu, 0 io, 0 vm, 0 hdd + stress: info: [9027] successful run completed in 2s + [ perf record: Woken up 3 times to write data ] + [ perf record: Captured and wrote 0.000 MB - ] + no symbols found in /usr/bin/stress, maybe install a debug package? + no symbols found in /usr/bin/stress, maybe install a debug package? + $ + +Signed-off-by: David Carrillo-Cisneros +Tested-by: Arnaldo Carvalho de Melo +Acked-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: He Kuang +Cc: Masami Hiramatsu +Cc: Paul Turner +Cc: Peter Zijlstra +Cc: Simon Que +Cc: Stephane Eranian +Cc: Wang Nan +Link: http://lkml.kernel.org/r/20170410201432.24807-3-davidcc@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/ordered-events.c | 3 ++- + tools/perf/util/session.c | 1 + + 2 files changed, 3 insertions(+), 1 deletion(-) + +--- a/tools/perf/util/ordered-events.c ++++ b/tools/perf/util/ordered-events.c +@@ -79,7 +79,7 @@ static union perf_event *dup_event(struc + + static void free_dup_event(struct ordered_events *oe, union perf_event *event) + { +- if (oe->copy_on_queue) { ++ if (event && oe->copy_on_queue) { + oe->cur_alloc_size -= event->header.size; + free(event); + } +@@ -150,6 +150,7 @@ void ordered_events__delete(struct order + list_move(&event->list, &oe->cache); + oe->nr_events--; + free_dup_event(oe, event->event); ++ event->event = NULL; + } + + int ordered_events__queue(struct ordered_events *oe, union perf_event *event, +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -1628,6 +1628,7 @@ static int __perf_session__process_pipe_ + buf = malloc(cur_size); + if (!buf) + return -errno; ++ ordered_events__set_copy_on_queue(oe, true); + more: + event = buf; + err = readn(fd, event, sizeof(struct perf_event_header)); diff --git a/queue-4.9/perf-probe-fix-concat_probe_trace_events.patch b/queue-4.9/perf-probe-fix-concat_probe_trace_events.patch new file mode 100644 index 00000000000..a3be46fecc1 --- /dev/null +++ b/queue-4.9/perf-probe-fix-concat_probe_trace_events.patch @@ -0,0 +1,39 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Ravi Bangoria +Date: Wed, 8 Mar 2017 12:29:07 +0530 +Subject: perf probe: Fix concat_probe_trace_events + +From: Ravi Bangoria + + +[ Upstream commit f0a30dca5f84fe8048271799b56677ac2279de66 ] + +'*ntevs' contains number of elements present in 'tevs' array. If there +are no elements in array, 'tevs2' can be directly assigned to 'tevs' +without allocating more space. So the condition should be '*ntevs == 0' +not 'ntevs == 0'. + +Signed-off-by: Ravi Bangoria +Acked-by: Masami Hiramatsu +Cc: Alexander Shishkin +Cc: Peter Zijlstra +Fixes: 42bba263eb58 ("perf probe: Allow wildcard for cached events") +Link: http://lkml.kernel.org/r/20170308065908.4128-1-ravi.bangoria@linux.vnet.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/probe-event.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/util/probe-event.c ++++ b/tools/perf/util/probe-event.c +@@ -3060,7 +3060,7 @@ concat_probe_trace_events(struct probe_t + struct probe_trace_event *new_tevs; + int ret = 0; + +- if (ntevs == 0) { ++ if (*ntevs == 0) { + *tevs = *tevs2; + *ntevs = ntevs2; + *tevs2 = NULL; diff --git a/queue-4.9/perf-probe-return-errno-when-not-hitting-any-event.patch b/queue-4.9/perf-probe-return-errno-when-not-hitting-any-event.patch new file mode 100644 index 00000000000..438cf3dc24d --- /dev/null +++ b/queue-4.9/perf-probe-return-errno-when-not-hitting-any-event.patch @@ -0,0 +1,59 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Kefeng Wang +Date: Fri, 17 Mar 2017 16:16:32 +0800 +Subject: perf probe: Return errno when not hitting any event + +From: Kefeng Wang + + +[ Upstream commit 70946723eeb859466f026274b29c6196e39149c4 ] + +On old perf, when using 'perf probe -d' to delete an inexistent event, +it returns errno, eg, + + -bash-4.3# perf probe -d xxx || echo $? + Info: Event "*:xxx" does not exist. + Error: Failed to delete events. + 255 + +But now perf_del_probe_events() will always set ret = 0, different from +previous del_perf_probe_events(). After this, it returns errno again, +eg, + + -bash-4.3# ./perf probe -d xxx || echo $? + "xxx" does not hit any event. + Error: Failed to delete events. + 254 + +And it is more appropriate to return -ENOENT instead of -EPERM. + +Signed-off-by: Kefeng Wang +Acked-by: Masami Hiramatsu +Cc: Hanjun Guo +Cc: Jiri Olsa +Cc: Peter Zijlstra +Cc: Wang Nan +Fixes: dddc7ee32fa1 ("perf probe: Fix an error when deleting probes successfully") +Link: http://lkml.kernel.org/r/1489738592-61011-1-git-send-email-wangkefeng.wang@huawei.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/builtin-probe.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/tools/perf/builtin-probe.c ++++ b/tools/perf/builtin-probe.c +@@ -442,9 +442,9 @@ static int perf_del_probe_events(struct + } + + if (ret == -ENOENT && ret2 == -ENOENT) +- pr_debug("\"%s\" does not hit any event.\n", str); +- /* Note that this is silently ignored */ +- ret = 0; ++ pr_warning("\"%s\" does not hit any event.\n", str); ++ else ++ ret = 0; + + error: + if (kfd >= 0) diff --git a/queue-4.9/perf-session-don-t-rely-on-evlist-in-pipe-mode.patch b/queue-4.9/perf-session-don-t-rely-on-evlist-in-pipe-mode.patch new file mode 100644 index 00000000000..40854ab5d99 --- /dev/null +++ b/queue-4.9/perf-session-don-t-rely-on-evlist-in-pipe-mode.patch @@ -0,0 +1,66 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: David Carrillo-Cisneros +Date: Mon, 10 Apr 2017 13:14:30 -0700 +Subject: perf session: Don't rely on evlist in pipe mode + +From: David Carrillo-Cisneros + + +[ Upstream commit 0973ad97c187e06aece61f685b9c3b2d93290a73 ] + +Session sets a number parameters that rely on evlist. These parameters +are not used in pipe-mode and should not be set, since evlist is +unavailable. Fix that. + +Signed-off-by: David Carrillo-Cisneros +Acked-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: He Kuang +Cc: Masami Hiramatsu +Cc: Paul Turner +Cc: Peter Zijlstra +Cc: Simon Que +Cc: Stephane Eranian +Cc: Wang Nan +Link: http://lkml.kernel.org/r/20170410201432.24807-6-davidcc@google.com +[ Check if file != NULL in perf_session__new(), like when used by builtin-top.c ] +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/session.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -139,8 +139,14 @@ struct perf_session *perf_session__new(s + if (perf_session__open(session) < 0) + goto out_close; + +- perf_session__set_id_hdr_size(session); +- perf_session__set_comm_exec(session); ++ /* ++ * set session attributes that are present in perf.data ++ * but not in pipe-mode. ++ */ ++ if (!file->is_pipe) { ++ perf_session__set_id_hdr_size(session); ++ perf_session__set_comm_exec(session); ++ } + } + } else { + session->machines.host.env = &perf_env; +@@ -155,7 +161,11 @@ struct perf_session *perf_session__new(s + pr_warning("Cannot read kernel map\n"); + } + +- if (tool && tool->ordering_requires_timestamps && ++ /* ++ * In pipe-mode, evlist is empty until PERF_RECORD_HEADER_ATTR is ++ * processed, so perf_evlist__sample_id_all is not meaningful here. ++ */ ++ if ((!file || !file->is_pipe) && tool && tool->ordering_requires_timestamps && + tool->ordered_events && !perf_evlist__sample_id_all(session->evlist)) { + dump_printf("WARNING: No sample_id_all support, falling back to unordered processing\n"); + tool->ordered_events = false; diff --git a/queue-4.9/perf-sort-fix-segfault-with-basic-block-cycles-sort-dimension.patch b/queue-4.9/perf-sort-fix-segfault-with-basic-block-cycles-sort-dimension.patch new file mode 100644 index 00000000000..3c9a50ba41c --- /dev/null +++ b/queue-4.9/perf-sort-fix-segfault-with-basic-block-cycles-sort-dimension.patch @@ -0,0 +1,52 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Changbin Du +Date: Mon, 13 Mar 2017 16:31:48 +0800 +Subject: perf sort: Fix segfault with basic block 'cycles' sort dimension + +From: Changbin Du + + +[ Upstream commit 4b0b3aa6a2756e6115fdf275c521e4552a7082f3 ] + +Skip the sample which doesn't have branch_info to avoid segmentation +fault: + +The fault can be reproduced by: + + perf record -a + perf report -F cycles + +Signed-off-by: Changbin Du +Tested-by: Arnaldo Carvalho de Melo +Cc: Andi Kleen +Cc: Peter Zijlstra +Fixes: 0e332f033a82 ("perf tools: Add support for cycles, weight branch_info field") +Link: http://lkml.kernel.org/r/20170313083148.23568-1-changbin.du@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/sort.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/tools/perf/util/sort.c ++++ b/tools/perf/util/sort.c +@@ -846,6 +846,9 @@ static int hist_entry__mispredict_snprin + static int64_t + sort__cycles_cmp(struct hist_entry *left, struct hist_entry *right) + { ++ if (!left->branch_info || !right->branch_info) ++ return cmp_null(left->branch_info, right->branch_info); ++ + return left->branch_info->flags.cycles - + right->branch_info->flags.cycles; + } +@@ -853,6 +856,8 @@ sort__cycles_cmp(struct hist_entry *left + static int hist_entry__cycles_snprintf(struct hist_entry *he, char *bf, + size_t size, unsigned int width) + { ++ if (!he->branch_info) ++ return scnprintf(bf, size, "%-.*s", width, "N/A"); + if (he->branch_info->flags.cycles == 0) + return repsep_snprintf(bf, size, "%-*s", width, "-"); + return repsep_snprintf(bf, size, "%-*hd", width, diff --git a/queue-4.9/perf-stat-fix-bug-in-handling-events-in-error-state.patch b/queue-4.9/perf-stat-fix-bug-in-handling-events-in-error-state.patch new file mode 100644 index 00000000000..1b841192786 --- /dev/null +++ b/queue-4.9/perf-stat-fix-bug-in-handling-events-in-error-state.patch @@ -0,0 +1,95 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Stephane Eranian +Date: Wed, 12 Apr 2017 11:23:01 -0700 +Subject: perf stat: Fix bug in handling events in error state + +From: Stephane Eranian + + +[ Upstream commit db49a71798a38f3ddf3f3462703328dca39b1ac7 ] + +(This is a patch has been sitting in the Intel CQM/CMT driver series for + a while, despite not depend on it. Sending it now independently since + the series is being discarded.) + +When an event is in error state, read() returns 0 instead of sizeof() +buffer. In certain modes, such as interval printing, ignoring the 0 +return value may cause bogus count deltas to be computed and thus +invalid results printed. + +This patch fixes this problem by modifying read_counters() to mark the +event as not scaled (scaled = -1) to force the printout routine to show +. + +Signed-off-by: Stephane Eranian +Reviewed-by: David Carrillo-Cisneros +Acked-by: Jiri Olsa +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Mathieu Poirier +Cc: Paul Turner +Cc: Peter Zijlstra +Cc: Wang Nan +Link: http://lkml.kernel.org/r/20170412182301.44406-1-davidcc@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/builtin-stat.c | 12 +++++++++--- + tools/perf/util/evsel.c | 4 ++-- + 2 files changed, 11 insertions(+), 5 deletions(-) + +--- a/tools/perf/builtin-stat.c ++++ b/tools/perf/builtin-stat.c +@@ -311,8 +311,12 @@ static int read_counter(struct perf_evse + struct perf_counts_values *count; + + count = perf_counts(counter->counts, cpu, thread); +- if (perf_evsel__read(counter, cpu, thread, count)) ++ if (perf_evsel__read(counter, cpu, thread, count)) { ++ counter->counts->scaled = -1; ++ perf_counts(counter->counts, cpu, thread)->ena = 0; ++ perf_counts(counter->counts, cpu, thread)->run = 0; + return -1; ++ } + + if (STAT_RECORD) { + if (perf_evsel__write_stat_event(counter, cpu, thread, count)) { +@@ -337,12 +341,14 @@ static int read_counter(struct perf_evse + static void read_counters(void) + { + struct perf_evsel *counter; ++ int ret; + + evlist__for_each_entry(evsel_list, counter) { +- if (read_counter(counter)) ++ ret = read_counter(counter); ++ if (ret) + pr_debug("failed to read counter %s\n", counter->name); + +- if (perf_stat_process_counter(&stat_config, counter)) ++ if (ret == 0 && perf_stat_process_counter(&stat_config, counter)) + pr_warning("failed to process counter %s\n", counter->name); + } + } +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -1221,7 +1221,7 @@ int perf_evsel__read(struct perf_evsel * + if (FD(evsel, cpu, thread) < 0) + return -EINVAL; + +- if (readn(FD(evsel, cpu, thread), count, sizeof(*count)) < 0) ++ if (readn(FD(evsel, cpu, thread), count, sizeof(*count)) <= 0) + return -errno; + + return 0; +@@ -1239,7 +1239,7 @@ int __perf_evsel__read_on_cpu(struct per + if (evsel->counts == NULL && perf_evsel__alloc_counts(evsel, cpu + 1, thread + 1) < 0) + return -ENOMEM; + +- if (readn(FD(evsel, cpu, thread), &count, nv * sizeof(u64)) < 0) ++ if (readn(FD(evsel, cpu, thread), &count, nv * sizeof(u64)) <= 0) + return -errno; + + perf_evsel__compute_deltas(evsel, cpu, thread, &count); diff --git a/queue-4.9/perf-stat-issue-a-hw-watchdog-disable-hint.patch b/queue-4.9/perf-stat-issue-a-hw-watchdog-disable-hint.patch new file mode 100644 index 00000000000..9fda238e1d7 --- /dev/null +++ b/queue-4.9/perf-stat-issue-a-hw-watchdog-disable-hint.patch @@ -0,0 +1,114 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Borislav Petkov +Date: Tue, 7 Feb 2017 01:40:05 +0100 +Subject: perf stat: Issue a HW watchdog disable hint + +From: Borislav Petkov + + +[ Upstream commit 02d492e5dcb72c004d213756eb87c9d62a6d76a7 ] + +When using perf stat on an AMD F15h system with the default hw events +attributes, some of the events don't get counted: + + Performance counter stats for 'sleep 1': + + 0.749208 task-clock (msec) # 0.001 CPUs utilized + 1 context-switches # 0.001 M/sec + 0 cpu-migrations # 0.000 K/sec + 54 page-faults # 0.072 M/sec + 1,122,815 cycles # 1.499 GHz + 286,740 stalled-cycles-frontend # 25.54% frontend cycles idle + stalled-cycles-backend (0.00%) + ^^^^^^^^^^^^ + instructions (0.00%) + ^^^^^^^^^^^^ + branches (0.00%) + branch-misses (0.00%) + + 1.001550070 seconds time elapsed + +The reason is that we have the HW watchdog consuming one PMU counter and +when perf tries to schedule 6 events on 6 counters and some of those +counters are constrained to only a specific subset of PMCs by the +hardware, the event scheduling fails. + +So issue a hint to disable the HW watchdog around a perf stat session. + +Committer note: + +Testing it... + + # perf stat -d usleep 1 + + Performance counter stats for 'usleep 1': + + 1.180203 task-clock (msec) # 0.490 CPUs utilized + 1 context-switches # 0.847 K/sec + 0 cpu-migrations # 0.000 K/sec + 54 page-faults # 0.046 M/sec + 184,754 cycles # 0.157 GHz + 714,553 instructions # 3.87 insn per cycle + 154,661 branches # 131.046 M/sec + 7,247 branch-misses # 4.69% of all branches + 219,984 L1-dcache-loads # 186.395 M/sec + 17,600 L1-dcache-load-misses # 8.00% of all L1-dcache hits (90.16%) + LLC-loads (0.00%) + LLC-load-misses (0.00%) + + 0.002406823 seconds time elapsed + + Some events weren't counted. Try disabling the NMI watchdog: + echo 0 > /proc/sys/kernel/nmi_watchdog + perf stat ... + echo 1 > /proc/sys/kernel/nmi_watchdog + # + +Signed-off-by: Borislav Petkov +Acked-by: Ingo Molnar +Tested-by: Arnaldo Carvalho de Melo +Cc: Peter Zijlstra +Cc: Robert Richter +Cc: Vince Weaver +Link: http://lkml.kernel.org/r/20170211183218.ijnvb5f7ciyuunx4@pd.tnic +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/builtin-stat.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/tools/perf/builtin-stat.c ++++ b/tools/perf/builtin-stat.c +@@ -146,6 +146,7 @@ static aggr_get_id_t aggr_get_id; + static bool append_file; + static const char *output_name; + static int output_fd; ++static int print_free_counters_hint; + + struct perf_stat { + bool record; +@@ -1109,6 +1110,9 @@ static void printout(int id, int nr, str + counter->supported ? CNTR_NOT_COUNTED : CNTR_NOT_SUPPORTED, + csv_sep); + ++ if (counter->supported) ++ print_free_counters_hint = 1; ++ + fprintf(stat_config.output, "%-*s%s", + csv_output ? 0 : unit_width, + counter->unit, csv_sep); +@@ -1477,6 +1481,13 @@ static void print_footer(void) + avg_stats(&walltime_nsecs_stats)); + } + fprintf(output, "\n\n"); ++ ++ if (print_free_counters_hint) ++ fprintf(output, ++"Some events weren't counted. Try disabling the NMI watchdog:\n" ++" echo 0 > /proc/sys/kernel/nmi_watchdog\n" ++" perf stat ...\n" ++" echo 1 > /proc/sys/kernel/nmi_watchdog\n"); + } + + static void print_counters(struct timespec *ts, int argc, const char **argv) diff --git a/queue-4.9/perf-tools-make-perf_event__synthesize_mmap_events-scale.patch b/queue-4.9/perf-tools-make-perf_event__synthesize_mmap_events-scale.patch new file mode 100644 index 00000000000..3fd9dfabe4e --- /dev/null +++ b/queue-4.9/perf-tools-make-perf_event__synthesize_mmap_events-scale.patch @@ -0,0 +1,62 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Stephane Eranian +Date: Wed, 15 Mar 2017 10:17:13 -0700 +Subject: perf tools: Make perf_event__synthesize_mmap_events() scale + +From: Stephane Eranian + + +[ Upstream commit 88b897a30c525c2eee6e7f16e1e8d0f18830845e ] + +This patch significantly improves the execution time of +perf_event__synthesize_mmap_events() when running perf record on systems +where processes have lots of threads. + +It just happens that cat /proc/pid/maps support uses a O(N^2) algorithm to +generate each map line in the maps file. If you have 1000 threads, then you +have necessarily 1000 stacks. For each vma, you need to check if it +corresponds to a thread's stack. With a large number of threads, this can take +a very long time. I have seen latencies >> 10mn. + +As of today, perf does not use the fact that a mapping is a stack, therefore we +can work around the issue by using /proc/pid/tasks/pid/maps. This entry does +not try to map a vma to stack and is thus much faster with no loss of +functonality. + +The proc-map-timeout logic is kept in case users still want some upper limit. + +In V2, we fix the file path from /proc/pid/tasks/pid/maps to actual +/proc/pid/task/pid/maps, tasks -> task. Thanks Arnaldo for catching this. + +Committer note: + +This problem seems to have been elliminated in the kernel since commit : +b18cb64ead40 ("fs/proc: Stop trying to report thread stacks"). + +Signed-off-by: Stephane Eranian +Acked-by: Jiri Olsa +Cc: Andy Lutomirski +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/20170315135059.GC2177@redhat.com +Link: http://lkml.kernel.org/r/1489598233-25586-1-git-send-email-eranian@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/event.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/tools/perf/util/event.c ++++ b/tools/perf/util/event.c +@@ -255,8 +255,8 @@ int perf_event__synthesize_mmap_events(s + if (machine__is_default_guest(machine)) + return 0; + +- snprintf(filename, sizeof(filename), "%s/proc/%d/maps", +- machine->root_dir, pid); ++ snprintf(filename, sizeof(filename), "%s/proc/%d/task/%d/maps", ++ machine->root_dir, pid, pid); + + fp = fopen(filename, "r"); + if (fp == NULL) { diff --git a/queue-4.9/perf-trace-handle-unpaired-raw_syscalls-sys_exit-event.patch b/queue-4.9/perf-trace-handle-unpaired-raw_syscalls-sys_exit-event.patch new file mode 100644 index 00000000000..86eb1339eff --- /dev/null +++ b/queue-4.9/perf-trace-handle-unpaired-raw_syscalls-sys_exit-event.patch @@ -0,0 +1,166 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Arnaldo Carvalho de Melo +Date: Wed, 29 Mar 2017 16:37:51 -0300 +Subject: perf trace: Handle unpaired raw_syscalls:sys_exit event + +From: Arnaldo Carvalho de Melo + + +[ Upstream commit fd2b2975149f5f7099693027cece81b16842964a ] + +Which may happen when we start a tracing session and a thread is waiting +for something like "poll" to return, in which case we better print "?" +both for the syscall entry timestamp and for the duration. + +E.g.: + +Tracing existing mutt session: + + # perf trace -p `pidof mutt` + ? ( ? ): mutt/17135 ... [continued]: poll()) = 1 + 0.027 ( 0.013 ms): mutt/17135 read(buf: 0x7ffcb3c42cef, count: 1) = 1 + 0.047 ( 0.008 ms): mutt/17135 poll(ufds: 0x7ffcb3c42c50, nfds: 1, timeout_msecs: 1000) = 1 + 0.059 ( 0.008 ms): mutt/17135 read(buf: 0x7ffcb3c42cef, count: 1) = 1 + + +Before it would print a large number because we'd do: + + ttrace->entry_time - trace->base_time + +And entry_time would be 0, while base_time would be the timestamp for +the first event 'perf trace' reads, oops. + +Cc: Adrian Hunter +Cc: David Ahern +Cc: Jiri Olsa +Cc: Luis Claudio Gonçalves +Cc: Namhyung Kim +Cc: Wang Nan +Link: http://lkml.kernel.org/n/tip-wbcb93ofva2qdjd5ltn5eeqq@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/builtin-trace.c | 43 ++++++++++++++++++++++++++++++++++--------- + 1 file changed, 34 insertions(+), 9 deletions(-) + +--- a/tools/perf/builtin-trace.c ++++ b/tools/perf/builtin-trace.c +@@ -822,12 +822,21 @@ struct syscall { + void **arg_parm; + }; + +-static size_t fprintf_duration(unsigned long t, FILE *fp) ++/* ++ * We need to have this 'calculated' boolean because in some cases we really ++ * don't know what is the duration of a syscall, for instance, when we start ++ * a session and some threads are waiting for a syscall to finish, say 'poll', ++ * in which case all we can do is to print "( ? ) for duration and for the ++ * start timestamp. ++ */ ++static size_t fprintf_duration(unsigned long t, bool calculated, FILE *fp) + { + double duration = (double)t / NSEC_PER_MSEC; + size_t printed = fprintf(fp, "("); + +- if (duration >= 1.0) ++ if (!calculated) ++ printed += fprintf(fp, " ? "); ++ else if (duration >= 1.0) + printed += color_fprintf(fp, PERF_COLOR_RED, "%6.3f ms", duration); + else if (duration >= 0.01) + printed += color_fprintf(fp, PERF_COLOR_YELLOW, "%6.3f ms", duration); +@@ -1030,13 +1039,27 @@ static bool trace__filter_duration(struc + return t < (trace->duration_filter * NSEC_PER_MSEC); + } + +-static size_t trace__fprintf_tstamp(struct trace *trace, u64 tstamp, FILE *fp) ++static size_t __trace__fprintf_tstamp(struct trace *trace, u64 tstamp, FILE *fp) + { + double ts = (double)(tstamp - trace->base_time) / NSEC_PER_MSEC; + + return fprintf(fp, "%10.3f ", ts); + } + ++/* ++ * We're handling tstamp=0 as an undefined tstamp, i.e. like when we are ++ * using ttrace->entry_time for a thread that receives a sys_exit without ++ * first having received a sys_enter ("poll" issued before tracing session ++ * starts, lost sys_enter exit due to ring buffer overflow). ++ */ ++static size_t trace__fprintf_tstamp(struct trace *trace, u64 tstamp, FILE *fp) ++{ ++ if (tstamp > 0) ++ return __trace__fprintf_tstamp(trace, tstamp, fp); ++ ++ return fprintf(fp, " ? "); ++} ++ + static bool done = false; + static bool interrupted = false; + +@@ -1047,10 +1070,10 @@ static void sig_handler(int sig) + } + + static size_t trace__fprintf_entry_head(struct trace *trace, struct thread *thread, +- u64 duration, u64 tstamp, FILE *fp) ++ u64 duration, bool duration_calculated, u64 tstamp, FILE *fp) + { + size_t printed = trace__fprintf_tstamp(trace, tstamp, fp); +- printed += fprintf_duration(duration, fp); ++ printed += fprintf_duration(duration, duration_calculated, fp); + + if (trace->multiple_threads) { + if (trace->show_comm) +@@ -1452,7 +1475,7 @@ static int trace__printf_interrupted_ent + + duration = sample->time - ttrace->entry_time; + +- printed = trace__fprintf_entry_head(trace, trace->current, duration, ttrace->entry_time, trace->output); ++ printed = trace__fprintf_entry_head(trace, trace->current, duration, true, ttrace->entry_time, trace->output); + printed += fprintf(trace->output, "%-70s) ...\n", ttrace->entry_str); + ttrace->entry_pending = false; + +@@ -1499,7 +1522,7 @@ static int trace__sys_enter(struct trace + + if (sc->is_exit) { + if (!(trace->duration_filter || trace->summary_only || trace->min_stack)) { +- trace__fprintf_entry_head(trace, thread, 1, ttrace->entry_time, trace->output); ++ trace__fprintf_entry_head(trace, thread, 0, false, ttrace->entry_time, trace->output); + fprintf(trace->output, "%-70s)\n", ttrace->entry_str); + } + } else { +@@ -1547,6 +1570,7 @@ static int trace__sys_exit(struct trace + { + long ret; + u64 duration = 0; ++ bool duration_calculated = false; + struct thread *thread; + int id = perf_evsel__sc_tp_uint(evsel, id, sample), err = -1, callchain_ret = 0; + struct syscall *sc = trace__syscall_info(trace, evsel, id); +@@ -1577,6 +1601,7 @@ static int trace__sys_exit(struct trace + duration = sample->time - ttrace->entry_time; + if (trace__filter_duration(trace, duration)) + goto out; ++ duration_calculated = true; + } else if (trace->duration_filter) + goto out; + +@@ -1592,7 +1617,7 @@ static int trace__sys_exit(struct trace + if (trace->summary_only) + goto out; + +- trace__fprintf_entry_head(trace, thread, duration, ttrace->entry_time, trace->output); ++ trace__fprintf_entry_head(trace, thread, duration, duration_calculated, ttrace->entry_time, trace->output); + + if (ttrace->entry_pending) { + fprintf(trace->output, "%-70s", ttrace->entry_str); +@@ -1855,7 +1880,7 @@ static int trace__pgfault(struct trace * + thread__find_addr_location(thread, sample->cpumode, MAP__FUNCTION, + sample->ip, &al); + +- trace__fprintf_entry_head(trace, thread, 0, sample->time, trace->output); ++ trace__fprintf_entry_head(trace, thread, 0, true, sample->time, trace->output); + + fprintf(trace->output, "%sfault [", + evsel->attr.config == PERF_COUNT_SW_PAGE_FAULTS_MAJ ? diff --git a/queue-4.9/power-supply-ab8500_charger-bail-out-in-case-of-error-in-ab8500_charger_init_hw_registers.patch b/queue-4.9/power-supply-ab8500_charger-bail-out-in-case-of-error-in-ab8500_charger_init_hw_registers.patch new file mode 100644 index 00000000000..bf3a8d52194 --- /dev/null +++ b/queue-4.9/power-supply-ab8500_charger-bail-out-in-case-of-error-in-ab8500_charger_init_hw_registers.patch @@ -0,0 +1,45 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Christophe JAILLET +Date: Wed, 22 Nov 2017 21:31:20 +0100 +Subject: power: supply: ab8500_charger: Bail out in case of error in 'ab8500_charger_init_hw_registers()' + +From: Christophe JAILLET + + +[ Upstream commit 09edcb647542487864e23aa8d2ef26be3e08978a ] + +If an error occurs when we enable the backup battery charging, we should +go through the error handling path directly. + +Before commit db43e6c473b5 ("ab8500-bm: Add usb power path support") this +was the case, but this commit has added some code between the last test and +the 'out' label. +So, in case of error, this added code is executed and the error may be +silently ignored. + +Fix it by adding the missing 'goto out', as done in all other error +handling paths. + +Fixes: db43e6c473b5 ("ab8500-bm: Add usb power path support") +Signed-off-by: Christophe JAILLET +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/power/supply/ab8500_charger.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/power/supply/ab8500_charger.c ++++ b/drivers/power/supply/ab8500_charger.c +@@ -3221,8 +3221,10 @@ static int ab8500_charger_init_hw_regist + ret = abx500_mask_and_set_register_interruptible(di->dev, + AB8500_RTC, AB8500_RTC_CTRL_REG, + RTC_BUP_CH_ENA, RTC_BUP_CH_ENA); +- if (ret < 0) ++ if (ret < 0) { + dev_err(di->dev, "%s mask and set failed\n", __func__); ++ goto out; ++ } + + if (is_ab8540(di->parent)) { + ret = abx500_mask_and_set_register_interruptible(di->dev, diff --git a/queue-4.9/power-supply-ab8500_charger-fix-an-error-handling-path.patch b/queue-4.9/power-supply-ab8500_charger-fix-an-error-handling-path.patch new file mode 100644 index 00000000000..2f39e1c398c --- /dev/null +++ b/queue-4.9/power-supply-ab8500_charger-fix-an-error-handling-path.patch @@ -0,0 +1,35 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Christophe JAILLET +Date: Wed, 22 Nov 2017 21:27:31 +0100 +Subject: power: supply: ab8500_charger: Fix an error handling path + +From: Christophe JAILLET + + +[ Upstream commit bf59fddde1c3eab89eb8dca8f3d3dc097887d2bb ] + +'ret' is know to be 0 at this point, because it has not been updated by the +the previous call to 'abx500_mask_and_set_register_interruptible()'. + +Fix it by updating 'ret' before checking if an error occurred. + +Fixes: 84edbeeab67c ("ab8500-charger: AB8500 charger driver") +Signed-off-by: Christophe JAILLET +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/power/supply/ab8500_charger.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/power/supply/ab8500_charger.c ++++ b/drivers/power/supply/ab8500_charger.c +@@ -3218,7 +3218,7 @@ static int ab8500_charger_init_hw_regist + } + + /* Enable backup battery charging */ +- abx500_mask_and_set_register_interruptible(di->dev, ++ ret = abx500_mask_and_set_register_interruptible(di->dev, + AB8500_RTC, AB8500_RTC_CTRL_REG, + RTC_BUP_CH_ENA, RTC_BUP_CH_ENA); + if (ret < 0) diff --git a/queue-4.9/powerpc-avoid-taking-a-data-miss-on-every-userspace-instruction-miss.patch b/queue-4.9/powerpc-avoid-taking-a-data-miss-on-every-userspace-instruction-miss.patch new file mode 100644 index 00000000000..28ddb3b8c29 --- /dev/null +++ b/queue-4.9/powerpc-avoid-taking-a-data-miss-on-every-userspace-instruction-miss.patch @@ -0,0 +1,62 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Anton Blanchard +Date: Mon, 3 Apr 2017 16:41:02 +1000 +Subject: powerpc: Avoid taking a data miss on every userspace instruction miss + +From: Anton Blanchard + + +[ Upstream commit a7a9dcd882a67b68568868b988289fce5ffd8419 ] + +Early on in do_page_fault() we call store_updates_sp(), regardless of +the type of exception. For an instruction miss this doesn't make +sense, because we only use this information to detect if a data miss +is the result of a stack expansion instruction or not. + +Worse still, it results in a data miss within every userspace +instruction miss handler, because we try and load the very instruction +we are about to install a pte for! + +A simple exec microbenchmark runs 6% faster on POWER8 with this fix: + + #include + #include + #include + +int main(int argc, char *argv[]) +{ + unsigned long left = atol(argv[1]); + char leftstr[16]; + + if (left-- == 0) + return 0; + + sprintf(leftstr, "%ld", left); + execlp(argv[0], argv[0], leftstr, NULL); + perror("exec failed\n"); + + return 0; +} + +Pass the number of iterations on the command line (eg 10000) and time +how long it takes to execute. + +Signed-off-by: Anton Blanchard +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/mm/fault.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/mm/fault.c ++++ b/arch/powerpc/mm/fault.c +@@ -294,7 +294,7 @@ int do_page_fault(struct pt_regs *regs, + * can result in fault, which will cause a deadlock when called with + * mmap_sem held + */ +- if (user_mode(regs)) ++ if (!is_exec && user_mode(regs)) + store_update_sp = store_updates_sp(regs); + + if (user_mode(regs)) diff --git a/queue-4.9/powerpc-mm-hugetlb-filter-out-hugepage-size-not-supported-by-page-table-layout.patch b/queue-4.9/powerpc-mm-hugetlb-filter-out-hugepage-size-not-supported-by-page-table-layout.patch new file mode 100644 index 00000000000..d8cdee2e424 --- /dev/null +++ b/queue-4.9/powerpc-mm-hugetlb-filter-out-hugepage-size-not-supported-by-page-table-layout.patch @@ -0,0 +1,64 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: "Aneesh Kumar K.V" +Date: Tue, 21 Mar 2017 22:59:56 +0530 +Subject: powerpc/mm/hugetlb: Filter out hugepage size not supported by page table layout + +From: "Aneesh Kumar K.V" + + +[ Upstream commit a525108cf1cc14651602d678da38fa627a76a724 ] + +Without this if firmware reports 1MB page size support we will crash +trying to use 1MB as hugetlb page size. + +echo 300 > /sys/kernel/mm/hugepages/hugepages-1024kB/nr_hugepages + +kernel BUG at ./arch/powerpc/include/asm/hugetlb.h:19! +..... +.... +[c0000000e2c27b30] c00000000029dae8 .hugetlb_fault+0x638/0xda0 +[c0000000e2c27c30] c00000000026fb64 .handle_mm_fault+0x844/0x1d70 +[c0000000e2c27d70] c00000000004805c .do_page_fault+0x3dc/0x7c0 +[c0000000e2c27e30] c00000000000ac98 handle_page_fault+0x10/0x30 + +With fix, we don't enable 1MB as hugepage size. + +bash-4.2# cd /sys/kernel/mm/hugepages/ +bash-4.2# ls +hugepages-16384kB hugepages-16777216kB + +Signed-off-by: Aneesh Kumar K.V +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/mm/hugetlbpage.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +--- a/arch/powerpc/mm/hugetlbpage.c ++++ b/arch/powerpc/mm/hugetlbpage.c +@@ -765,6 +765,24 @@ static int __init add_huge_page_size(uns + if ((mmu_psize = shift_to_mmu_psize(shift)) < 0) + return -EINVAL; + ++#ifdef CONFIG_PPC_BOOK3S_64 ++ /* ++ * We need to make sure that for different page sizes reported by ++ * firmware we only add hugetlb support for page sizes that can be ++ * supported by linux page table layout. ++ * For now we have ++ * Radix: 2M ++ * Hash: 16M and 16G ++ */ ++ if (radix_enabled()) { ++ if (mmu_psize != MMU_PAGE_2M) ++ return -EINVAL; ++ } else { ++ if (mmu_psize != MMU_PAGE_16M && mmu_psize != MMU_PAGE_16G) ++ return -EINVAL; ++ } ++#endif ++ + BUG_ON(mmu_psize_defs[mmu_psize].shift != shift); + + /* Return if huge page size has already been setup */ diff --git a/queue-4.9/powerpc-modules-don-t-try-to-restore-r2-after-a-sibling-call.patch b/queue-4.9/powerpc-modules-don-t-try-to-restore-r2-after-a-sibling-call.patch new file mode 100644 index 00000000000..42396fa9505 --- /dev/null +++ b/queue-4.9/powerpc-modules-don-t-try-to-restore-r2-after-a-sibling-call.patch @@ -0,0 +1,82 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Josh Poimboeuf +Date: Thu, 16 Nov 2017 11:45:37 -0600 +Subject: powerpc/modules: Don't try to restore r2 after a sibling call + +From: Josh Poimboeuf + + +[ Upstream commit b9eab08d012fa093947b230f9a87257c27fb829b ] + +When attempting to load a livepatch module, I got the following error: + + module_64: patch_module: Expect noop after relocate, got 3c820000 + +The error was triggered by the following code in +unregister_netdevice_queue(): + + 14c: 00 00 00 48 b 14c + 14c: R_PPC64_REL24 net_set_todo + 150: 00 00 82 3c addis r4,r2,0 + +GCC didn't insert a nop after the branch to net_set_todo() because it's +a sibling call, so it never returns. The nop isn't needed after the +branch in that case. + +Signed-off-by: Josh Poimboeuf +Acked-by: Naveen N. Rao +Reviewed-and-tested-by: Kamalesh Babulal +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/include/asm/code-patching.h | 1 + + arch/powerpc/kernel/module_64.c | 12 +++++++++++- + arch/powerpc/lib/code-patching.c | 5 +++++ + 3 files changed, 17 insertions(+), 1 deletion(-) + +--- a/arch/powerpc/include/asm/code-patching.h ++++ b/arch/powerpc/include/asm/code-patching.h +@@ -30,6 +30,7 @@ int patch_branch(unsigned int *addr, uns + int patch_instruction(unsigned int *addr, unsigned int instr); + + int instr_is_relative_branch(unsigned int instr); ++int instr_is_relative_link_branch(unsigned int instr); + int instr_is_branch_to_addr(const unsigned int *instr, unsigned long addr); + unsigned long branch_target(const unsigned int *instr); + unsigned int translate_branch(const unsigned int *dest, +--- a/arch/powerpc/kernel/module_64.c ++++ b/arch/powerpc/kernel/module_64.c +@@ -494,7 +494,17 @@ static bool is_early_mcount_callsite(u32 + restore r2. */ + static int restore_r2(u32 *instruction, struct module *me) + { +- if (is_early_mcount_callsite(instruction - 1)) ++ u32 *prev_insn = instruction - 1; ++ ++ if (is_early_mcount_callsite(prev_insn)) ++ return 1; ++ ++ /* ++ * Make sure the branch isn't a sibling call. Sibling calls aren't ++ * "link" branches and they don't return, so they don't need the r2 ++ * restore afterwards. ++ */ ++ if (!instr_is_relative_link_branch(*prev_insn)) + return 1; + + if (*instruction != PPC_INST_NOP) { +--- a/arch/powerpc/lib/code-patching.c ++++ b/arch/powerpc/lib/code-patching.c +@@ -95,6 +95,11 @@ int instr_is_relative_branch(unsigned in + return instr_is_branch_iform(instr) || instr_is_branch_bform(instr); + } + ++int instr_is_relative_link_branch(unsigned int instr) ++{ ++ return instr_is_relative_branch(instr) && (instr & BRANCH_SET_LINK); ++} ++ + static unsigned long branch_iform_target(const unsigned int *instr) + { + signed long imm; diff --git a/queue-4.9/powerpc-nohash-fix-use-of-mmu_has_feature-in-setup_initial_memory_limit.patch b/queue-4.9/powerpc-nohash-fix-use-of-mmu_has_feature-in-setup_initial_memory_limit.patch new file mode 100644 index 00000000000..3c337addb85 --- /dev/null +++ b/queue-4.9/powerpc-nohash-fix-use-of-mmu_has_feature-in-setup_initial_memory_limit.patch @@ -0,0 +1,48 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Michael Ellerman +Date: Mon, 3 Apr 2017 12:05:55 +1000 +Subject: powerpc/nohash: Fix use of mmu_has_feature() in setup_initial_memory_limit() + +From: Michael Ellerman + + +[ Upstream commit 4868e3508d1934d28961f940ed6b9f1e347ab52c ] + +setup_initial_memory_limit() is called from early_init_devtree(), which +runs prior to feature patching. If the kernel is built with CONFIG_JUMP_LABEL=y +and CONFIG_JUMP_LABEL_FEATURE_CHECKS=y then we will potentially get the +wrong value. + +If we also have CONFIG_JUMP_LABEL_FEATURE_CHECK_DEBUG=y we get a warning +and backtrace: + + Warning! mmu_has_feature() used prior to jump label init! + CPU: 0 PID: 0 Comm: swapper Not tainted 4.11.0-rc4-gccN-next-20170331-g6af2434 #1 + Call Trace: + [c000000000fc3d50] [c000000000a26c30] .dump_stack+0xa8/0xe8 (unreliable) + [c000000000fc3de0] [c00000000002e6b8] .setup_initial_memory_limit+0xa4/0x104 + [c000000000fc3e60] [c000000000d5c23c] .early_init_devtree+0xd0/0x2f8 + [c000000000fc3f00] [c000000000d5d3b0] .early_setup+0x90/0x11c + [c000000000fc3f90] [c000000000000520] start_here_multiplatform+0x68/0x80 + +Fix it by using early_mmu_has_feature(). + +Fixes: c12e6f24d413 ("powerpc: Add option to use jump label for mmu_has_feature()") +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/mm/tlb_nohash.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/mm/tlb_nohash.c ++++ b/arch/powerpc/mm/tlb_nohash.c +@@ -751,7 +751,7 @@ void setup_initial_memory_limit(phys_add + * avoid going over total available memory just in case... + */ + #ifdef CONFIG_PPC_FSL_BOOK3E +- if (mmu_has_feature(MMU_FTR_TYPE_FSL_E)) { ++ if (early_mmu_has_feature(MMU_FTR_TYPE_FSL_E)) { + unsigned long linear_sz; + unsigned int num_cams; + diff --git a/queue-4.9/powerpc-xmon-fix-an-unexpected-xmon-on-off-state-change.patch b/queue-4.9/powerpc-xmon-fix-an-unexpected-xmon-on-off-state-change.patch new file mode 100644 index 00000000000..e808b23690d --- /dev/null +++ b/queue-4.9/powerpc-xmon-fix-an-unexpected-xmon-on-off-state-change.patch @@ -0,0 +1,86 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Pan Xinhui +Date: Wed, 22 Mar 2017 16:27:49 -0300 +Subject: powerpc/xmon: Fix an unexpected xmon on/off state change + +From: Pan Xinhui + + +[ Upstream commit 3b5bf42b81d56085fd58692b5117f69aa77fdff7 ] + +Once xmon is triggered by sysrq-x, it is enabled always afterwards even +if it is disabled during boot. This will cause a system reset interrupt +fail to dump. So keep xmon in its original state after exit. + +We have several ways to set xmon on or off. +1) by a build config CONFIG_XMON_DEFAULT. +2) by a boot cmdline with xmon or xmon=early or xmon=on to enable xmon +and xmon=off to disable xmon. This value will override that in step 1. +3) by a debugfs interface, as proposed in this patchset. +And this value can override those in step 1 and 2. + +Signed-off-by: Pan Xinhui +Signed-off-by: Guilherme G. Piccoli +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/xmon/xmon.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +--- a/arch/powerpc/xmon/xmon.c ++++ b/arch/powerpc/xmon/xmon.c +@@ -74,6 +74,7 @@ static int xmon_gate; + #endif /* CONFIG_SMP */ + + static unsigned long in_xmon __read_mostly = 0; ++static int xmon_on = IS_ENABLED(CONFIG_XMON_DEFAULT); + + static unsigned long adrs; + static int size = 1; +@@ -3244,6 +3245,8 @@ static void sysrq_handle_xmon(int key) + /* ensure xmon is enabled */ + xmon_init(1); + debugger(get_irq_regs()); ++ if (!xmon_on) ++ xmon_init(0); + } + + static struct sysrq_key_op sysrq_xmon_op = { +@@ -3260,7 +3263,7 @@ static int __init setup_xmon_sysrq(void) + __initcall(setup_xmon_sysrq); + #endif /* CONFIG_MAGIC_SYSRQ */ + +-static int __initdata xmon_early, xmon_off; ++static int __initdata xmon_early; + + static int __init early_parse_xmon(char *p) + { +@@ -3268,10 +3271,12 @@ static int __init early_parse_xmon(char + /* just "xmon" is equivalent to "xmon=early" */ + xmon_init(1); + xmon_early = 1; +- } else if (strncmp(p, "on", 2) == 0) ++ xmon_on = 1; ++ } else if (strncmp(p, "on", 2) == 0) { + xmon_init(1); +- else if (strncmp(p, "off", 3) == 0) +- xmon_off = 1; ++ xmon_on = 1; ++ } else if (strncmp(p, "off", 3) == 0) ++ xmon_on = 0; + else if (strncmp(p, "nobt", 4) == 0) + xmon_no_auto_backtrace = 1; + else +@@ -3283,10 +3288,8 @@ early_param("xmon", early_parse_xmon); + + void __init xmon_setup(void) + { +-#ifdef CONFIG_XMON_DEFAULT +- if (!xmon_off) ++ if (xmon_on) + xmon_init(1); +-#endif + if (xmon_early) + debugger(NULL); + } diff --git a/queue-4.9/printk-correctly-handle-preemption-in-console_unlock.patch b/queue-4.9/printk-correctly-handle-preemption-in-console_unlock.patch new file mode 100644 index 00000000000..4e0f2ac2510 --- /dev/null +++ b/queue-4.9/printk-correctly-handle-preemption-in-console_unlock.patch @@ -0,0 +1,90 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Petr Mladek +Date: Fri, 24 Mar 2017 17:14:05 +0100 +Subject: printk: Correctly handle preemption in console_unlock() + +From: Petr Mladek + + +[ Upstream commit 257ab443118bffc7fdcef38f49cf59be68a3e362 ] + +Some console drivers code calls console_conditional_schedule() +that looks at @console_may_schedule. The value must be cleared +when the drivers are called from console_unlock() with +interrupts disabled. But rescheduling is fine when the same +code is called, for example, from tty operations where the +console semaphore is taken via console_lock(). + +This is why @console_may_schedule is cleared before calling console +drivers. The original value is stored to decide if we could sleep +between lines. + +Now, @console_may_schedule is not cleared when we call +console_trylock() and jump back to the "again" goto label. +This has become a problem, since the commit 6b97a20d3a7909daa066 +("printk: set may_schedule for some of console_trylock() callers"). +@console_may_schedule might get enabled now. + +There is also the opposite problem. console_lock() can be called +only from preemptive context. It can always enable scheduling in +the console code. But console_trylock() is not able to detect it +when CONFIG_PREEMPT_COUNT is disabled. Therefore we should use the +original @console_may_schedule value after re-acquiring +the console semaphore in console_unlock(). + +This patch solves both problems by moving the "again" goto label. + +Alternative solution was to clear and restore the value around +call_console_drivers(). Then console_conditional_schedule() could +be used also inside console_unlock(). But there was a potential race +with console_flush_on_panic() as reported by Sergey Senozhatsky. +That function should be called only where there is only one CPU +and with interrupts disabled. But better be on the safe side +because stopping CPUs might fail. + +Fixes: 6b97a20d3a7909 ("printk: set may_schedule for some of console_trylock() callers") +Link: http://lkml.kernel.org/r/1490372045-22288-1-git-send-email-pmladek@suse.com +Suggested-by: Tetsuo Handa +Cc: Steven Rostedt +Cc: Peter Zijlstra +Cc: Andrew Morton +Cc: Greg Kroah-Hartman +Cc: Jiri Slaby +Cc: linux-fbdev@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Reviewed-by: Sergey Senozhatsky +Signed-off-by: Petr Mladek +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/printk/printk.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/kernel/printk/printk.c ++++ b/kernel/printk/printk.c +@@ -2342,7 +2342,7 @@ void console_unlock(void) + } + + /* +- * Console drivers are called under logbuf_lock, so ++ * Console drivers are called with interrupts disabled, so + * @console_may_schedule should be cleared before; however, we may + * end up dumping a lot of lines, for example, if called from + * console registration path, and should invoke cond_resched() +@@ -2350,11 +2350,15 @@ void console_unlock(void) + * scheduling stall on a slow console leading to RCU stall and + * softlockup warnings which exacerbate the issue with more + * messages practically incapacitating the system. ++ * ++ * console_trylock() is not able to detect the preemptive ++ * context reliably. Therefore the value must be stored before ++ * and cleared after the the "again" goto label. + */ + do_cond_resched = console_may_schedule; ++again: + console_may_schedule = 0; + +-again: + /* + * We released the console_sem lock, so we need to recheck if + * cpu is online and (if not) is there at least one CON_ANYTIME diff --git a/queue-4.9/pwm-stmpe-fix-wrong-register-offset-for-hwpwm-2-case.patch b/queue-4.9/pwm-stmpe-fix-wrong-register-offset-for-hwpwm-2-case.patch new file mode 100644 index 00000000000..c83a4b990e3 --- /dev/null +++ b/queue-4.9/pwm-stmpe-fix-wrong-register-offset-for-hwpwm-2-case.patch @@ -0,0 +1,33 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Axel Lin +Date: Tue, 7 Nov 2017 13:18:53 +0800 +Subject: pwm: stmpe: Fix wrong register offset for hwpwm=2 case + +From: Axel Lin + + +[ Upstream commit 8472b529e113e0863ea064fdee51bf73c3f86fd6 ] + +Fix trivial copy/paste bug. + +Signed-off-by: Axel Lin +Reviewed-by: Linus Walleij +Fixes: ef1f09eca74a ("pwm: Add a driver for the STMPE PWM") +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pwm/pwm-stmpe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pwm/pwm-stmpe.c ++++ b/drivers/pwm/pwm-stmpe.c +@@ -145,7 +145,7 @@ static int stmpe_24xx_pwm_config(struct + break; + + case 2: +- offset = STMPE24XX_PWMIC1; ++ offset = STMPE24XX_PWMIC2; + break; + + default: diff --git a/queue-4.9/pwm-tegra-increase-precision-in-pwm-rate-calculation.patch b/queue-4.9/pwm-tegra-increase-precision-in-pwm-rate-calculation.patch new file mode 100644 index 00000000000..a2a780ae1ba --- /dev/null +++ b/queue-4.9/pwm-tegra-increase-precision-in-pwm-rate-calculation.patch @@ -0,0 +1,82 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Laxman Dewangan +Date: Fri, 7 Apr 2017 15:04:00 +0530 +Subject: pwm: tegra: Increase precision in PWM rate calculation + +From: Laxman Dewangan + + +[ Upstream commit 250b76f43f57d578ebff5e7211eb2c73aa5cd6ca ] + +The rate of the PWM calculated as follows: + + hz = NSEC_PER_SEC / period_ns; + rate = (rate + (hz / 2)) / hz; + +This has the precision loss in lower PWM rate. + +Change this to have more precision as: + + hz = DIV_ROUND_CLOSEST_ULL(NSEC_PER_SEC * 100, period_ns); + rate = DIV_ROUND_CLOSEST(rate * 100, hz) + +Example: + +1. period_ns = 16672000, PWM clock rate is 200 KHz. + + Based on old formula + hz = NSEC_PER_SEC / period_ns + = 1000000000ul/16672000 + = 59 (59.98) + rate = (200K + 59/2)/59 = 3390 + + Based on new method: + hz = 5998 + rate = DIV_ROUND_CLOSE(200000*100, 5998) = 3334 + + If we measure the PWM signal rate, we will get more accurate + period with rate value of 3334 instead of 3390. + +2. period_ns = 16803898, PWM clock rate is 200 KHz. + + Based on old formula: + hz = 59, rate = 3390 + + Based on new formula: + hz = 5951, rate = 3360 + + The PWM signal rate of 3360 is more near to requested period + than 3333. + +Signed-off-by: Laxman Dewangan +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pwm/pwm-tegra.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/pwm/pwm-tegra.c ++++ b/drivers/pwm/pwm-tegra.c +@@ -76,6 +76,7 @@ static int tegra_pwm_config(struct pwm_c + struct tegra_pwm_chip *pc = to_tegra_pwm_chip(chip); + unsigned long long c = duty_ns; + unsigned long rate, hz; ++ unsigned long long ns100 = NSEC_PER_SEC; + u32 val = 0; + int err; + +@@ -95,9 +96,11 @@ static int tegra_pwm_config(struct pwm_c + * cycles at the PWM clock rate will take period_ns nanoseconds. + */ + rate = clk_get_rate(pc->clk) >> PWM_DUTY_WIDTH; +- hz = NSEC_PER_SEC / period_ns; + +- rate = (rate + (hz / 2)) / hz; ++ /* Consider precision in PWM_SCALE_WIDTH rate calculation */ ++ ns100 *= 100; ++ hz = DIV_ROUND_CLOSEST_ULL(ns100, period_ns); ++ rate = DIV_ROUND_CLOSEST(rate * 100, hz); + + /* + * Since the actual PWM divider is the register's frequency divider diff --git a/queue-4.9/qed-always-publish-vf-link-from-leading-hwfn.patch b/queue-4.9/qed-always-publish-vf-link-from-leading-hwfn.patch new file mode 100644 index 00000000000..90ae9b3e8b1 --- /dev/null +++ b/queue-4.9/qed-always-publish-vf-link-from-leading-hwfn.patch @@ -0,0 +1,54 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: "Mintz, Yuval" +Date: Sun, 19 Mar 2017 13:08:20 +0200 +Subject: qed: Always publish VF link from leading hwfn + +From: "Mintz, Yuval" + + +[ Upstream commit e50728effe1126eae39445ba144078b1305b7047 ] + +The link information exists only on the leading hwfn, +but some of its derivatives [e.g., min/max rate] need to +be configured for each hwfn. +When re-basing the VF link view, use the leading hwfn +information as basis for all existing hwfns to allow +said configurations to stick. + +Signed-off-by: Yuval Mintz +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qed/qed_sriov.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +@@ -3573,6 +3573,7 @@ static int qed_get_vf_config(struct qed_ + + void qed_inform_vf_link_state(struct qed_hwfn *hwfn) + { ++ struct qed_hwfn *lead_hwfn = QED_LEADING_HWFN(hwfn->cdev); + struct qed_mcp_link_capabilities caps; + struct qed_mcp_link_params params; + struct qed_mcp_link_state link; +@@ -3589,9 +3590,15 @@ void qed_inform_vf_link_state(struct qed + if (!vf_info) + continue; + +- memcpy(¶ms, qed_mcp_get_link_params(hwfn), sizeof(params)); +- memcpy(&link, qed_mcp_get_link_state(hwfn), sizeof(link)); +- memcpy(&caps, qed_mcp_get_link_capabilities(hwfn), ++ /* Only hwfn0 is actually interested in the link speed. ++ * But since only it would receive an MFW indication of link, ++ * need to take configuration from it - otherwise things like ++ * rate limiting for hwfn1 VF would not work. ++ */ ++ memcpy(¶ms, qed_mcp_get_link_params(lead_hwfn), ++ sizeof(params)); ++ memcpy(&link, qed_mcp_get_link_state(lead_hwfn), sizeof(link)); ++ memcpy(&caps, qed_mcp_get_link_capabilities(lead_hwfn), + sizeof(caps)); + + /* Modify link according to the VF's configured link state */ diff --git a/queue-4.9/qed-correct-msi-x-for-storage.patch b/queue-4.9/qed-correct-msi-x-for-storage.patch new file mode 100644 index 00000000000..4192a946c89 --- /dev/null +++ b/queue-4.9/qed-correct-msi-x-for-storage.patch @@ -0,0 +1,40 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: "Mintz, Yuval" +Date: Wed, 5 Apr 2017 21:20:11 +0300 +Subject: qed: Correct MSI-x for storage + +From: "Mintz, Yuval" + + +[ Upstream commit 2f78227874754b1e10cd348fd6e7693b0dabb3f6 ] + +When qedr is enabled, qed would try dividing the msi-x vectors between +L2 and RoCE, starting with L2 and providing it with sufficient vectors +for its queues. + +Problem is qed would also do that for storage partitions, and as those +don't need queues it would lead qed to award those partitions with 0 +msi-x vectors, causing them to believe theye're using INTa and +preventing them from operating. + +Fixes: 51ff17251c9c ("qed: Add support for RoCE hw init") +Signed-off-by: Yuval Mintz +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qed/qed_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/qlogic/qed/qed_main.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c +@@ -711,7 +711,8 @@ static int qed_slowpath_setup_int(struct + cdev->int_params.fp_msix_cnt = cdev->int_params.out.num_vectors - + cdev->num_hwfns; + +- if (!IS_ENABLED(CONFIG_QED_RDMA)) ++ if (!IS_ENABLED(CONFIG_QED_RDMA) || ++ QED_LEADING_HWFN(cdev)->hw_info.personality != QED_PCI_ETH_ROCE) + return 0; + + for_each_hwfn(cdev, i) diff --git a/queue-4.9/qed-fix-tm-block-ilt-allocation.patch b/queue-4.9/qed-fix-tm-block-ilt-allocation.patch new file mode 100644 index 00000000000..7517490b59b --- /dev/null +++ b/queue-4.9/qed-fix-tm-block-ilt-allocation.patch @@ -0,0 +1,87 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Michal Kalderon +Date: Mon, 3 Apr 2017 12:21:10 +0300 +Subject: qed: Fix TM block ILT allocation + +From: Michal Kalderon + + +[ Upstream commit 44531ba45dbf3c23cc7ae0934ec9b33ef340ac56 ] + +When configuring the HW timers block we should set the number of CIDs +up until the last CID that require timers, instead of only those CIDs +whose protocol needs timers support. + +Today, the protocols that require HW timers' support have their CIDs +before any other protocol, but that would change in future [when we +add iWARP support]. + +Signed-off-by: Michal Kalderon +Signed-off-by: Yuval Mintz +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qed/qed_cxt.c | 32 +++++++++++++++++++++++------- + 1 file changed, 25 insertions(+), 7 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c +@@ -271,16 +271,34 @@ struct qed_tm_iids { + u32 per_vf_tids; + }; + +-static void qed_cxt_tm_iids(struct qed_cxt_mngr *p_mngr, ++static void qed_cxt_tm_iids(struct qed_hwfn *p_hwfn, ++ struct qed_cxt_mngr *p_mngr, + struct qed_tm_iids *iids) + { +- u32 i, j; +- +- for (i = 0; i < MAX_CONN_TYPES; i++) { ++ bool tm_vf_required = false; ++ bool tm_required = false; ++ int i, j; ++ ++ /* Timers is a special case -> we don't count how many cids require ++ * timers but what's the max cid that will be used by the timer block. ++ * therefore we traverse in reverse order, and once we hit a protocol ++ * that requires the timers memory, we'll sum all the protocols up ++ * to that one. ++ */ ++ for (i = MAX_CONN_TYPES - 1; i >= 0; i--) { + struct qed_conn_type_cfg *p_cfg = &p_mngr->conn_cfg[i]; + +- if (tm_cid_proto(i)) { ++ if (tm_cid_proto(i) || tm_required) { ++ if (p_cfg->cid_count) ++ tm_required = true; ++ + iids->pf_cids += p_cfg->cid_count; ++ } ++ ++ if (tm_cid_proto(i) || tm_vf_required) { ++ if (p_cfg->cids_per_vf) ++ tm_vf_required = true; ++ + iids->per_vf_cids += p_cfg->cids_per_vf; + } + } +@@ -696,7 +714,7 @@ int qed_cxt_cfg_ilt_compute(struct qed_h + + /* TM PF */ + p_cli = &p_mngr->clients[ILT_CLI_TM]; +- qed_cxt_tm_iids(p_mngr, &tm_iids); ++ qed_cxt_tm_iids(p_hwfn, p_mngr, &tm_iids); + total = tm_iids.pf_cids + tm_iids.pf_tids_total; + if (total) { + p_blk = &p_cli->pf_blks[0]; +@@ -1591,7 +1609,7 @@ static void qed_tm_init_pf(struct qed_hw + u8 i; + + memset(&tm_iids, 0, sizeof(tm_iids)); +- qed_cxt_tm_iids(p_mngr, &tm_iids); ++ qed_cxt_tm_iids(p_hwfn, p_mngr, &tm_iids); + + /* @@@TBD No pre-scan for now */ + diff --git a/queue-4.9/rcutorture-configinit-fix-build-directory-error-message.patch b/queue-4.9/rcutorture-configinit-fix-build-directory-error-message.patch new file mode 100644 index 00000000000..0698a35e3f8 --- /dev/null +++ b/queue-4.9/rcutorture-configinit-fix-build-directory-error-message.patch @@ -0,0 +1,37 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: SeongJae Park +Date: Fri, 3 Nov 2017 19:17:20 +0900 +Subject: rcutorture/configinit: Fix build directory error message + +From: SeongJae Park + + +[ Upstream commit 2adfa4210f8f35cdfb4e08318cc06b99752964c2 ] + +The 'configinit.sh' script checks the format of optional argument for the +build directory, printing an error message if the format is not valid. +However, the error message uses the wrong variable, indicating an empty +string even though the user entered a non-empty (but erroneous) string. +This commit fixes the script to use the correct variable. + +Fixes: c87b9c601ac8 ("rcutorture: Add KVM-based test framework") + +Signed-off-by: SeongJae Park +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/rcutorture/bin/configinit.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/testing/selftests/rcutorture/bin/configinit.sh ++++ b/tools/testing/selftests/rcutorture/bin/configinit.sh +@@ -51,7 +51,7 @@ then + mkdir $builddir + fi + else +- echo Bad build directory: \"$builddir\" ++ echo Bad build directory: \"$buildloc\" + exit 2 + fi + fi diff --git a/queue-4.9/regulator-core-limit-propagation-of-parent-voltage-count-and-list.patch b/queue-4.9/regulator-core-limit-propagation-of-parent-voltage-count-and-list.patch new file mode 100644 index 00000000000..bdf2fcf4b62 --- /dev/null +++ b/queue-4.9/regulator-core-limit-propagation-of-parent-voltage-count-and-list.patch @@ -0,0 +1,76 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Matthias Kaehlcke +Date: Mon, 27 Mar 2017 16:54:12 -0700 +Subject: regulator: core: Limit propagation of parent voltage count and list + +From: Matthias Kaehlcke + + +[ Upstream commit fd086045559d90cd7854818b4c60a7119eda6231 ] + +Commit 26988efe11b1 ("regulator: core: Allow to get voltage count and +list from parent") introduces the propagation of the parent voltage +count and list for regulators that don't provide this information +themselves. The goal is to support simple switch regulators, however as +a side effect normal continuous regulators can leak details of their +supplies and provide consumers with inconsistent information. + +Limit the propagation of the voltage count and list to switch +regulators. + +Fixes: 26988efe11b1 ("regulator: core: Allow to get voltage count and + list from parent") +Signed-off-by: Matthias Kaehlcke +Reviewed-by: Javier Martinez Canillas +Tested-by: Javier Martinez Canillas +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/core.c | 9 +++++++-- + include/linux/regulator/driver.h | 2 ++ + 2 files changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -2465,7 +2465,7 @@ static int _regulator_list_voltage(struc + ret = ops->list_voltage(rdev, selector); + if (lock) + mutex_unlock(&rdev->mutex); +- } else if (rdev->supply) { ++ } else if (rdev->is_switch && rdev->supply) { + ret = _regulator_list_voltage(rdev->supply, selector, lock); + } else { + return -EINVAL; +@@ -2523,7 +2523,7 @@ int regulator_count_voltages(struct regu + if (rdev->desc->n_voltages) + return rdev->desc->n_voltages; + +- if (!rdev->supply) ++ if (!rdev->is_switch || !rdev->supply) + return -EINVAL; + + return regulator_count_voltages(rdev->supply); +@@ -4049,6 +4049,11 @@ regulator_register(const struct regulato + mutex_unlock(®ulator_list_mutex); + } + ++ if (!rdev->desc->ops->get_voltage && ++ !rdev->desc->ops->list_voltage && ++ !rdev->desc->fixed_uV) ++ rdev->is_switch = true; ++ + ret = device_register(&rdev->dev); + if (ret != 0) { + put_device(&rdev->dev); +--- a/include/linux/regulator/driver.h ++++ b/include/linux/regulator/driver.h +@@ -425,6 +425,8 @@ struct regulator_dev { + struct regulator_enable_gpio *ena_pin; + unsigned int ena_gpio_state:1; + ++ unsigned int is_switch:1; ++ + /* time when this regulator was disabled last time */ + unsigned long last_off_jiffy; + }; diff --git a/queue-4.9/regulator-isl9305-fix-array-size.patch b/queue-4.9/regulator-isl9305-fix-array-size.patch new file mode 100644 index 00000000000..ca198885385 --- /dev/null +++ b/queue-4.9/regulator-isl9305-fix-array-size.patch @@ -0,0 +1,39 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: "Vincent Stehlé" +Date: Sun, 9 Apr 2017 22:05:05 +0200 +Subject: regulator: isl9305: fix array size + +From: "Vincent Stehlé" + + +[ Upstream commit 0c08aaf873174c95e674cf21ffcd041c589d2e5b ] + +ISL9305_MAX_REGULATOR is the last index used to access the init_data[] +array, so we need to add one to this last index to obtain the necessary +array size. + +This fixes the following smatch error: + + drivers/regulator/isl9305.c:160 isl9305_i2c_probe() error: buffer overflow 'pdata->init_data' 3 <= 3 + +Fixes: dec38b5ce6a9edb4 ("regulator: isl9305: Add Intersil ISL9305/H driver") +Signed-off-by: Vincent Stehlé +Cc: Mark Brown +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/platform_data/isl9305.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/platform_data/isl9305.h ++++ b/include/linux/platform_data/isl9305.h +@@ -24,7 +24,7 @@ + struct regulator_init_data; + + struct isl9305_pdata { +- struct regulator_init_data *init_data[ISL9305_MAX_REGULATOR]; ++ struct regulator_init_data *init_data[ISL9305_MAX_REGULATOR + 1]; + }; + + #endif diff --git a/queue-4.9/reiserfs-make-cancel_old_flush-reliable.patch b/queue-4.9/reiserfs-make-cancel_old_flush-reliable.patch new file mode 100644 index 00000000000..d0b9d315381 --- /dev/null +++ b/queue-4.9/reiserfs-make-cancel_old_flush-reliable.patch @@ -0,0 +1,112 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Jan Kara +Date: Wed, 5 Apr 2017 14:09:48 +0200 +Subject: reiserfs: Make cancel_old_flush() reliable + +From: Jan Kara + + +[ Upstream commit 71b0576bdb862e964a82c73327cdd1a249c53e67 ] + +Currently canceling of delayed work that flushes old data using +cancel_old_flush() does not prevent work from being requeued. Thus +in theory new work can be queued after cancel_old_flush() from +reiserfs_freeze() has run. This will become larger problem once +flush_old_commits() can requeue the work itself. + +Fix the problem by recording in sbi->work_queue that flushing work is +canceled and should not be requeued. + +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/reiserfs/journal.c | 2 +- + fs/reiserfs/reiserfs.h | 1 + + fs/reiserfs/super.c | 21 +++++++++++++++------ + 3 files changed, 17 insertions(+), 7 deletions(-) + +--- a/fs/reiserfs/journal.c ++++ b/fs/reiserfs/journal.c +@@ -1959,7 +1959,7 @@ static int do_journal_release(struct rei + * will be requeued because superblock is being shutdown and doesn't + * have MS_ACTIVE set. + */ +- cancel_delayed_work_sync(&REISERFS_SB(sb)->old_work); ++ reiserfs_cancel_old_flush(sb); + /* wait for all commits to finish */ + cancel_delayed_work_sync(&SB_JOURNAL(sb)->j_work); + +--- a/fs/reiserfs/reiserfs.h ++++ b/fs/reiserfs/reiserfs.h +@@ -2948,6 +2948,7 @@ int reiserfs_allocate_list_bitmaps(struc + struct reiserfs_list_bitmap *, unsigned int); + + void reiserfs_schedule_old_flush(struct super_block *s); ++void reiserfs_cancel_old_flush(struct super_block *s); + void add_save_link(struct reiserfs_transaction_handle *th, + struct inode *inode, int truncate); + int remove_save_link(struct inode *inode, int truncate); +--- a/fs/reiserfs/super.c ++++ b/fs/reiserfs/super.c +@@ -90,7 +90,9 @@ static void flush_old_commits(struct wor + s = sbi->s_journal->j_work_sb; + + spin_lock(&sbi->old_work_lock); +- sbi->work_queued = 0; ++ /* Avoid clobbering the cancel state... */ ++ if (sbi->work_queued == 1) ++ sbi->work_queued = 0; + spin_unlock(&sbi->old_work_lock); + + reiserfs_sync_fs(s, 1); +@@ -117,21 +119,22 @@ void reiserfs_schedule_old_flush(struct + spin_unlock(&sbi->old_work_lock); + } + +-static void cancel_old_flush(struct super_block *s) ++void reiserfs_cancel_old_flush(struct super_block *s) + { + struct reiserfs_sb_info *sbi = REISERFS_SB(s); + +- cancel_delayed_work_sync(&REISERFS_SB(s)->old_work); + spin_lock(&sbi->old_work_lock); +- sbi->work_queued = 0; ++ /* Make sure no new flushes will be queued */ ++ sbi->work_queued = 2; + spin_unlock(&sbi->old_work_lock); ++ cancel_delayed_work_sync(&REISERFS_SB(s)->old_work); + } + + static int reiserfs_freeze(struct super_block *s) + { + struct reiserfs_transaction_handle th; + +- cancel_old_flush(s); ++ reiserfs_cancel_old_flush(s); + + reiserfs_write_lock(s); + if (!(s->s_flags & MS_RDONLY)) { +@@ -152,7 +155,13 @@ static int reiserfs_freeze(struct super_ + + static int reiserfs_unfreeze(struct super_block *s) + { ++ struct reiserfs_sb_info *sbi = REISERFS_SB(s); ++ + reiserfs_allow_writes(s); ++ spin_lock(&sbi->old_work_lock); ++ /* Allow old_work to run again */ ++ sbi->work_queued = 0; ++ spin_unlock(&sbi->old_work_lock); + return 0; + } + +@@ -2194,7 +2203,7 @@ error_unlocked: + if (sbi->commit_wq) + destroy_workqueue(sbi->commit_wq); + +- cancel_delayed_work_sync(&REISERFS_SB(s)->old_work); ++ reiserfs_cancel_old_flush(s); + + reiserfs_free_bitmap_cache(s); + if (SB_BUFFER_WITH_SB(s)) diff --git a/queue-4.9/rtmutex-fix-pi-chain-order-integrity.patch b/queue-4.9/rtmutex-fix-pi-chain-order-integrity.patch new file mode 100644 index 00000000000..509bca328a3 --- /dev/null +++ b/queue-4.9/rtmutex-fix-pi-chain-order-integrity.patch @@ -0,0 +1,127 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Peter Zijlstra +Date: Thu, 23 Mar 2017 15:56:13 +0100 +Subject: rtmutex: Fix PI chain order integrity + +From: Peter Zijlstra + + +[ Upstream commit e0aad5b44ff5d28ac1d6ae70cdf84ca228e889dc ] + +rt_mutex_waiter::prio is a copy of task_struct::prio which is updated +during the PI chain walk, such that the PI chain order isn't messed up +by (asynchronous) task state updates. + +Currently rt_mutex_waiter_less() uses task state for deadline tasks; +this is broken, since the task state can, as said above, change +asynchronously, causing the RB tree order to change without actual +tree update -> FAIL. + +Fix this by also copying the deadline into the rt_mutex_waiter state +and updating it along with its prio field. + +Ideally we would also force PI chain updates whenever DL tasks update +their deadline parameter, but for first approximation this is less +broken than it was. + +Signed-off-by: Peter Zijlstra (Intel) +Cc: juri.lelli@arm.com +Cc: bigeasy@linutronix.de +Cc: xlpang@redhat.com +Cc: rostedt@goodmis.org +Cc: mathieu.desnoyers@efficios.com +Cc: jdesfossez@efficios.com +Cc: bristot@redhat.com +Link: http://lkml.kernel.org/r/20170323150216.403992539@infradead.org +Signed-off-by: Thomas Gleixner +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/locking/rtmutex.c | 29 +++++++++++++++++++++++++++-- + kernel/locking/rtmutex_common.h | 1 + + 2 files changed, 28 insertions(+), 2 deletions(-) + +--- a/kernel/locking/rtmutex.c ++++ b/kernel/locking/rtmutex.c +@@ -236,8 +236,7 @@ rt_mutex_waiter_less(struct rt_mutex_wai + * then right waiter has a dl_prio() too. + */ + if (dl_prio(left->prio)) +- return dl_time_before(left->task->dl.deadline, +- right->task->dl.deadline); ++ return dl_time_before(left->deadline, right->deadline); + + return 0; + } +@@ -704,7 +703,26 @@ static int rt_mutex_adjust_prio_chain(st + + /* [7] Requeue the waiter in the lock waiter tree. */ + rt_mutex_dequeue(lock, waiter); ++ ++ /* ++ * Update the waiter prio fields now that we're dequeued. ++ * ++ * These values can have changed through either: ++ * ++ * sys_sched_set_scheduler() / sys_sched_setattr() ++ * ++ * or ++ * ++ * DL CBS enforcement advancing the effective deadline. ++ * ++ * Even though pi_waiters also uses these fields, and that tree is only ++ * updated in [11], we can do this here, since we hold [L], which ++ * serializes all pi_waiters access and rb_erase() does not care about ++ * the values of the node being removed. ++ */ + waiter->prio = task->prio; ++ waiter->deadline = task->dl.deadline; ++ + rt_mutex_enqueue(lock, waiter); + + /* [8] Release the task */ +@@ -831,6 +849,8 @@ static int rt_mutex_adjust_prio_chain(st + static int try_to_take_rt_mutex(struct rt_mutex *lock, struct task_struct *task, + struct rt_mutex_waiter *waiter) + { ++ lockdep_assert_held(&lock->wait_lock); ++ + /* + * Before testing whether we can acquire @lock, we set the + * RT_MUTEX_HAS_WAITERS bit in @lock->owner. This forces all +@@ -958,6 +978,8 @@ static int task_blocks_on_rt_mutex(struc + struct rt_mutex *next_lock; + int chain_walk = 0, res; + ++ lockdep_assert_held(&lock->wait_lock); ++ + /* + * Early deadlock detection. We really don't want the task to + * enqueue on itself just to untangle the mess later. It's not +@@ -975,6 +997,7 @@ static int task_blocks_on_rt_mutex(struc + waiter->task = task; + waiter->lock = lock; + waiter->prio = task->prio; ++ waiter->deadline = task->dl.deadline; + + /* Get the top priority waiter on the lock */ + if (rt_mutex_has_waiters(lock)) +@@ -1080,6 +1103,8 @@ static void remove_waiter(struct rt_mute + struct task_struct *owner = rt_mutex_owner(lock); + struct rt_mutex *next_lock; + ++ lockdep_assert_held(&lock->wait_lock); ++ + raw_spin_lock(¤t->pi_lock); + rt_mutex_dequeue(lock, waiter); + current->pi_blocked_on = NULL; +--- a/kernel/locking/rtmutex_common.h ++++ b/kernel/locking/rtmutex_common.h +@@ -33,6 +33,7 @@ struct rt_mutex_waiter { + struct rt_mutex *deadlock_lock; + #endif + int prio; ++ u64 deadline; + }; + + /* diff --git a/queue-4.9/s390-topology-fix-typo-in-early-topology-code.patch b/queue-4.9/s390-topology-fix-typo-in-early-topology-code.patch new file mode 100644 index 00000000000..dd13e8b7be7 --- /dev/null +++ b/queue-4.9/s390-topology-fix-typo-in-early-topology-code.patch @@ -0,0 +1,34 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Heiko Carstens +Date: Mon, 13 Mar 2017 13:36:10 +0100 +Subject: s390/topology: fix typo in early topology code + +From: Heiko Carstens + + +[ Upstream commit 4fd4dd8bffb112d1e6549e0ff09e9fa3c8cc2b96 ] + +Use MACHINE_FLAG_TOPOLOGY instead of MACHINE_HAS_TOPOLOGY when +clearing the bit that indicates if the machine provides topology +information (and if it should be used). Currently works anyway. + +Fixes: 68cc795d1933 ("s390/topology: make "topology=off" parameter work") +Signed-off-by: Heiko Carstens +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/kernel/early.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/kernel/early.c ++++ b/arch/s390/kernel/early.c +@@ -372,7 +372,7 @@ static int __init topology_setup(char *s + + rc = kstrtobool(str, &enabled); + if (!rc && !enabled) +- S390_lowcore.machine_flags &= ~MACHINE_HAS_TOPOLOGY; ++ S390_lowcore.machine_flags &= ~MACHINE_FLAG_TOPOLOGY; + return rc; + } + early_param("topology", topology_setup); diff --git a/queue-4.9/sched-act_csum-don-t-mangle-tcp-and-udp-gso-packets.patch b/queue-4.9/sched-act_csum-don-t-mangle-tcp-and-udp-gso-packets.patch new file mode 100644 index 00000000000..93776c9c63b --- /dev/null +++ b/queue-4.9/sched-act_csum-don-t-mangle-tcp-and-udp-gso-packets.patch @@ -0,0 +1,80 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Davide Caratti +Date: Thu, 23 Mar 2017 10:39:40 +0100 +Subject: sched: act_csum: don't mangle TCP and UDP GSO packets + +From: Davide Caratti + + +[ Upstream commit add641e7dee31b36aee83412c29e39dd1f5e0c9c ] + +after act_csum computes the checksum on skbs carrying GSO TCP/UDP packets, +subsequent segmentation fails because skb_needs_check(skb, true) returns +true. Because of that, skb_warn_bad_offload() is invoked and the following +message is displayed: + +WARNING: CPU: 3 PID: 28 at net/core/dev.c:2553 skb_warn_bad_offload+0xf0/0xfd +<...> + + [] skb_warn_bad_offload+0xf0/0xfd + [] __skb_gso_segment+0xec/0x110 + [] validate_xmit_skb+0x12d/0x2b0 + [] validate_xmit_skb_list+0x42/0x70 + [] sch_direct_xmit+0xd0/0x1b0 + [] __qdisc_run+0x120/0x270 + [] __dev_queue_xmit+0x23d/0x690 + [] dev_queue_xmit+0x10/0x20 + +Since GSO is able to compute checksum on individual segments of such skbs, +we can simply skip mangling the packet. + +Signed-off-by: Davide Caratti +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/act_csum.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/net/sched/act_csum.c ++++ b/net/sched/act_csum.c +@@ -180,6 +180,9 @@ static int tcf_csum_ipv4_tcp(struct sk_b + struct tcphdr *tcph; + const struct iphdr *iph; + ++ if (skb_is_gso(skb) && skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4) ++ return 1; ++ + tcph = tcf_csum_skb_nextlayer(skb, ihl, ipl, sizeof(*tcph)); + if (tcph == NULL) + return 0; +@@ -201,6 +204,9 @@ static int tcf_csum_ipv6_tcp(struct sk_b + struct tcphdr *tcph; + const struct ipv6hdr *ip6h; + ++ if (skb_is_gso(skb) && skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) ++ return 1; ++ + tcph = tcf_csum_skb_nextlayer(skb, ihl, ipl, sizeof(*tcph)); + if (tcph == NULL) + return 0; +@@ -224,6 +230,9 @@ static int tcf_csum_ipv4_udp(struct sk_b + const struct iphdr *iph; + u16 ul; + ++ if (skb_is_gso(skb) && skb_shinfo(skb)->gso_type & SKB_GSO_UDP) ++ return 1; ++ + /* + * Support both UDP and UDPLITE checksum algorithms, Don't use + * udph->len to get the real length without any protocol check, +@@ -277,6 +286,9 @@ static int tcf_csum_ipv6_udp(struct sk_b + const struct ipv6hdr *ip6h; + u16 ul; + ++ if (skb_is_gso(skb) && skb_shinfo(skb)->gso_type & SKB_GSO_UDP) ++ return 1; ++ + /* + * Support both UDP and UDPLITE checksum algorithms, Don't use + * udph->len to get the real length without any protocol check, diff --git a/queue-4.9/sched-stop-resched_cpu-from-sending-ipis-to-offline-cpus.patch b/queue-4.9/sched-stop-resched_cpu-from-sending-ipis-to-offline-cpus.patch new file mode 100644 index 00000000000..d63dcec1e91 --- /dev/null +++ b/queue-4.9/sched-stop-resched_cpu-from-sending-ipis-to-offline-cpus.patch @@ -0,0 +1,73 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: "Paul E. McKenney" +Date: Fri, 13 Oct 2017 16:24:28 -0700 +Subject: sched: Stop resched_cpu() from sending IPIs to offline CPUs + +From: "Paul E. McKenney" + + +[ Upstream commit a0982dfa03efca6c239c52cabebcea4afb93ea6b ] + +The rcutorture test suite occasionally provokes a splat due to invoking +resched_cpu() on an offline CPU: + +WARNING: CPU: 2 PID: 8 at /home/paulmck/public_git/linux-rcu/arch/x86/kernel/smp.c:128 native_smp_send_reschedule+0x37/0x40 +Modules linked in: +CPU: 2 PID: 8 Comm: rcu_preempt Not tainted 4.14.0-rc4+ #1 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 +task: ffff902ede9daf00 task.stack: ffff96c50010c000 +RIP: 0010:native_smp_send_reschedule+0x37/0x40 +RSP: 0018:ffff96c50010fdb8 EFLAGS: 00010096 +RAX: 000000000000002e RBX: ffff902edaab4680 RCX: 0000000000000003 +RDX: 0000000080000003 RSI: 0000000000000000 RDI: 00000000ffffffff +RBP: ffff96c50010fdb8 R08: 0000000000000000 R09: 0000000000000001 +R10: 0000000000000000 R11: 00000000299f36ae R12: 0000000000000001 +R13: ffffffff9de64240 R14: 0000000000000001 R15: ffffffff9de64240 +FS: 0000000000000000(0000) GS:ffff902edfc80000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00000000f7d4c642 CR3: 000000001e0e2000 CR4: 00000000000006e0 +Call Trace: + resched_curr+0x8f/0x1c0 + resched_cpu+0x2c/0x40 + rcu_implicit_dynticks_qs+0x152/0x220 + force_qs_rnp+0x147/0x1d0 + ? sync_rcu_exp_select_cpus+0x450/0x450 + rcu_gp_kthread+0x5a9/0x950 + kthread+0x142/0x180 + ? force_qs_rnp+0x1d0/0x1d0 + ? kthread_create_on_node+0x40/0x40 + ret_from_fork+0x27/0x40 +Code: 14 01 0f 92 c0 84 c0 74 14 48 8b 05 14 4f f4 00 be fd 00 00 00 ff 90 a0 00 00 00 5d c3 89 fe 48 c7 c7 38 89 ca 9d e8 e5 56 08 00 <0f> ff 5d c3 0f 1f 44 00 00 8b 05 52 9e 37 02 85 c0 75 38 55 48 +---[ end trace 26df9e5df4bba4ac ]--- + +This splat cannot be generated by expedited grace periods because they +always invoke resched_cpu() on the current CPU, which is good because +expedited grace periods require that resched_cpu() unconditionally +succeed. However, other parts of RCU can tolerate resched_cpu() acting +as a no-op, at least as long as it doesn't happen too often. + +This commit therefore makes resched_cpu() invoke resched_curr() only if +the CPU is either online or is the current CPU. + +Signed-off-by: Paul E. McKenney +Cc: Ingo Molnar +Cc: Peter Zijlstra + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/sched/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -508,7 +508,8 @@ void resched_cpu(int cpu) + unsigned long flags; + + raw_spin_lock_irqsave(&rq->lock, flags); +- resched_curr(rq); ++ if (cpu_online(cpu) || cpu == smp_processor_id()) ++ resched_curr(rq); + raw_spin_unlock_irqrestore(&rq->lock, flags); + } + diff --git a/queue-4.9/sched-stop-switched_to_rt-from-sending-ipis-to-offline-cpus.patch b/queue-4.9/sched-stop-switched_to_rt-from-sending-ipis-to-offline-cpus.patch new file mode 100644 index 00000000000..6f1163415d1 --- /dev/null +++ b/queue-4.9/sched-stop-switched_to_rt-from-sending-ipis-to-offline-cpus.patch @@ -0,0 +1,76 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: "Paul E. McKenney" +Date: Fri, 13 Oct 2017 17:00:18 -0700 +Subject: sched: Stop switched_to_rt() from sending IPIs to offline CPUs + +From: "Paul E. McKenney" + + +[ Upstream commit 2fe2582649aa2355f79acddb86bd4d6c5363eb63 ] + +The rcutorture test suite occasionally provokes a splat due to invoking +rt_mutex_lock() which needs to boost the priority of a task currently +sitting on a runqueue that belongs to an offline CPU: + +WARNING: CPU: 0 PID: 12 at /home/paulmck/public_git/linux-rcu/arch/x86/kernel/smp.c:128 native_smp_send_reschedule+0x37/0x40 +Modules linked in: +CPU: 0 PID: 12 Comm: rcub/7 Not tainted 4.14.0-rc4+ #1 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 +task: ffff9ed3de5f8cc0 task.stack: ffffbbf80012c000 +RIP: 0010:native_smp_send_reschedule+0x37/0x40 +RSP: 0018:ffffbbf80012fd10 EFLAGS: 00010082 +RAX: 000000000000002f RBX: ffff9ed3dd9cb300 RCX: 0000000000000004 +RDX: 0000000080000004 RSI: 0000000000000086 RDI: 00000000ffffffff +RBP: ffffbbf80012fd10 R08: 000000000009da7a R09: 0000000000007b9d +R10: 0000000000000001 R11: ffffffffbb57c2cd R12: 000000000000000d +R13: ffff9ed3de5f8cc0 R14: 0000000000000061 R15: ffff9ed3ded59200 +FS: 0000000000000000(0000) GS:ffff9ed3dea00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00000000080686f0 CR3: 000000001b9e0000 CR4: 00000000000006f0 +Call Trace: + resched_curr+0x61/0xd0 + switched_to_rt+0x8f/0xa0 + rt_mutex_setprio+0x25c/0x410 + task_blocks_on_rt_mutex+0x1b3/0x1f0 + rt_mutex_slowlock+0xa9/0x1e0 + rt_mutex_lock+0x29/0x30 + rcu_boost_kthread+0x127/0x3c0 + kthread+0x104/0x140 + ? rcu_report_unblock_qs_rnp+0x90/0x90 + ? kthread_create_on_node+0x40/0x40 + ret_from_fork+0x22/0x30 +Code: f0 00 0f 92 c0 84 c0 74 14 48 8b 05 34 74 c5 00 be fd 00 00 00 ff 90 a0 00 00 00 5d c3 89 fe 48 c7 c7 a0 c6 fc b9 e8 d5 b5 06 00 <0f> ff 5d c3 0f 1f 44 00 00 8b 05 a2 d1 13 02 85 c0 75 38 55 48 + +But the target task's priority has already been adjusted, so the only +purpose of switched_to_rt() invoking resched_curr() is to wake up the +CPU running some task that needs to be preempted by the boosted task. +But the CPU is offline, which presumably means that the task must be +migrated to some other CPU, and that this other CPU will undertake any +needed preemption at the time of migration. Because the runqueue lock +is held when resched_curr() is invoked, we know that the boosted task +cannot go anywhere, so it is not necessary to invoke resched_curr() +in this particular case. + +This commit therefore makes switched_to_rt() refrain from invoking +resched_curr() when the target CPU is offline. + +Signed-off-by: Paul E. McKenney +Cc: Ingo Molnar +Cc: Peter Zijlstra +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/sched/rt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -2206,7 +2206,7 @@ static void switched_to_rt(struct rq *rq + if (tsk_nr_cpus_allowed(p) > 1 && rq->rt.overloaded) + queue_push_tasks(rq); + #endif /* CONFIG_SMP */ +- if (p->prio < rq->curr->prio) ++ if (p->prio < rq->curr->prio && cpu_online(cpu_of(rq))) + resched_curr(rq); + } + } diff --git a/queue-4.9/scsi-be2iscsi-check-tag-in-beiscsi_mccq_compl_wait.patch b/queue-4.9/scsi-be2iscsi-check-tag-in-beiscsi_mccq_compl_wait.patch new file mode 100644 index 00000000000..b51d35a2d78 --- /dev/null +++ b/queue-4.9/scsi-be2iscsi-check-tag-in-beiscsi_mccq_compl_wait.patch @@ -0,0 +1,80 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Jitendra Bhivare +Date: Fri, 24 Mar 2017 14:11:40 +0530 +Subject: scsi: be2iscsi: Check tag in beiscsi_mccq_compl_wait + +From: Jitendra Bhivare + + +[ Upstream commit eb419229be58dc6d4a3a814116a265908e088c39 ] + +scsi host12: BS_1377 : mgmt_invalidate_connection Failed for cid=256 +BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 +IP: [] __list_add+0xf/0xc0 +PGD 0 +Oops: 0000 [#1] SMP +Modules linked in: +... +CPU: 9 PID: 1542 Comm: iscsid Tainted: G ------------ T 3.10.0-514.el7.x86_64 #1 +Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 09/12/2016 +task: ffff88076f310fb0 ti: ffff88076bba8000 task.ti: ffff88076bba8000 +RIP: 0010:[] [] __list_add+0xf/0xc0 +RSP: 0018:ffff88076bbab8e8 EFLAGS: 00010046 +RAX: 0000000000000246 RBX: ffff88076bbab990 RCX: 0000000000000000 +RDX: 0000000000000000 RSI: ffff880468badf58 RDI: ffff88076bbab990 +RBP: ffff88076bbab900 R08: 0000000000000246 R09: 00000000000020de +R10: 0000000000000000 R11: ffff88076bbab5be R12: 0000000000000000 +R13: ffff880468badf58 R14: 000000000001adb0 R15: ffff88076f310fb0 +FS: 00007f377124a880(0000) GS:ffff88046fa40000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000000008 CR3: 0000000771318000 CR4: 00000000001407e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 +Stack: +ffff88076bbab990 ffff880468badf50 0000000000000001 ffff88076bbab938 +ffffffff810b128b 0000000000000246 00000000cf9b7040 ffff880468bac7a0 +0000000000000000 ffff880468bac7a0 ffff88076bbab9d0 ffffffffa05a6ea3 + +Call Trace: +[] prepare_to_wait+0x7b/0x90 +[] beiscsi_mccq_compl_wait+0x153/0x330 [be2iscsi] +[] ? wake_up_atomic_t+0x30/0x30 +[] beiscsi_ep_disconnect+0x91/0x2d0 [be2iscsi] +[] iscsi_if_ep_disconnect.isra.14+0x5a/0x70 [scsi_transport_iscsi] +[] iscsi_if_recv_msg+0x113b/0x14a0 [scsi_transport_iscsi] +[] ? __kmalloc_node_track_caller+0x58/0x290 +[] iscsi_if_rx+0x8e/0x1f0 [scsi_transport_iscsi] +[] netlink_unicast+0xed/0x1b0 +[] netlink_sendmsg+0x31e/0x690 +[] ? netlink_rcv_wake+0x44/0x60 +[] ? netlink_recvmsg+0x1e3/0x450 + +beiscsi_mccq_compl_wait gets called even when MCC tag allocation failed +for mgmt_invalidate_connection. mcc_wait is not initialized for tag 0 +so causes crash in prepare_to_wait. + +Signed-off-by: Jitendra Bhivare +Reviewed-by: Tomas Henzl +Reviewed-by: Chris Leech +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/be2iscsi/be_cmds.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/scsi/be2iscsi/be_cmds.c ++++ b/drivers/scsi/be2iscsi/be_cmds.c +@@ -246,6 +246,12 @@ int beiscsi_mccq_compl_wait(struct beisc + { + int rc = 0; + ++ if (!tag || tag > MAX_MCC_CMD) { ++ __beiscsi_log(phba, KERN_ERR, ++ "BC_%d : invalid tag %u\n", tag); ++ return -EINVAL; ++ } ++ + if (beiscsi_hba_in_error(phba)) { + clear_bit(MCC_TAG_STATE_RUNNING, + &phba->ctrl.ptag_state[tag].tag_state); diff --git a/queue-4.9/scsi-core-scsi_get_device_flags_keyed-always-return-device-flags.patch b/queue-4.9/scsi-core-scsi_get_device_flags_keyed-always-return-device-flags.patch new file mode 100644 index 00000000000..96316cc7b5e --- /dev/null +++ b/queue-4.9/scsi-core-scsi_get_device_flags_keyed-always-return-device-flags.patch @@ -0,0 +1,50 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Bart Van Assche +Date: Mon, 4 Dec 2017 10:36:31 -0800 +Subject: scsi: core: scsi_get_device_flags_keyed(): Always return device flags + +From: Bart Van Assche + + +[ Upstream commit a44c9d36509c83cf64f33b93f6ab2e63822c01eb ] + +Since scsi_get_device_flags_keyed() callers do not check whether or not +the returned value is an error code, change that function such that it +returns a flags value even if the 'key' argument is invalid. Note: +since commit 28a0bc4120d3 ("scsi: sd: Implement blacklist option for +WRITE SAME w/ UNMAP") bit 31 is a valid device information flag so +checking whether bit 31 is set in the return value is not sufficient to +tell the difference between an error code and a flags value. + +Signed-off-by: Bart Van Assche +Cc: Christoph Hellwig +Cc: Hannes Reinecke +Cc: Johannes Thumshirn +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/scsi_devinfo.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -596,17 +596,12 @@ int scsi_get_device_flags_keyed(struct s + int key) + { + struct scsi_dev_info_list *devinfo; +- int err; + + devinfo = scsi_dev_info_list_find(vendor, model, key); + if (!IS_ERR(devinfo)) + return devinfo->flags; + +- err = PTR_ERR(devinfo); +- if (err != -ENOENT) +- return err; +- +- /* nothing found, return nothing */ ++ /* key or device not found: return nothing */ + if (key != SCSI_DEVINFO_GLOBAL) + return 0; + diff --git a/queue-4.9/scsi-devinfo-apply-to-hp-xp-the-same-flags-as-hitachi-vsp.patch b/queue-4.9/scsi-devinfo-apply-to-hp-xp-the-same-flags-as-hitachi-vsp.patch new file mode 100644 index 00000000000..aabf74c2418 --- /dev/null +++ b/queue-4.9/scsi-devinfo-apply-to-hp-xp-the-same-flags-as-hitachi-vsp.patch @@ -0,0 +1,45 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Xose Vazquez Perez +Date: Fri, 17 Nov 2017 21:31:36 +0100 +Subject: scsi: devinfo: apply to HP XP the same flags as Hitachi VSP + +From: Xose Vazquez Perez + + +[ Upstream commit b369a0471503130cfc74f9f62071db97f48948c3 ] + +Commit 56f3d383f37b ("scsi: scsi_devinfo: Add TRY_VPD_PAGES to HITACHI +OPEN-V blacklist entry") modified some Hitachi entries: + + HITACHI is always supporting VPD pages, even though it's claiming to + support SCSI Revision 3 only. + +The same should have been done also for HP-rebranded. + +[mkp: checkpatch and tweaked commit message] + +Cc: Hannes Reinecke +Cc: Takahiro Yasui +Cc: Matthias Rudolph +Cc: Martin K. Petersen +Cc: James E.J. Bottomley +Cc: SCSI ML +Signed-off-by: Xose Vazquez Perez +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/scsi_devinfo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -180,7 +180,7 @@ static struct { + {"HITACHI", "6586-", "*", BLIST_SPARSELUN | BLIST_LARGELUN}, + {"HITACHI", "6588-", "*", BLIST_SPARSELUN | BLIST_LARGELUN}, + {"HP", "A6189A", NULL, BLIST_SPARSELUN | BLIST_LARGELUN}, /* HP VA7400 */ +- {"HP", "OPEN-", "*", BLIST_REPORTLUN2}, /* HP XP Arrays */ ++ {"HP", "OPEN-", "*", BLIST_REPORTLUN2 | BLIST_TRY_VPD_PAGES}, /* HP XP Arrays */ + {"HP", "NetRAID-4M", NULL, BLIST_FORCELUN}, + {"HP", "HSV100", NULL, BLIST_REPORTLUN2 | BLIST_NOSTARTONADD}, + {"HP", "C1557A", NULL, BLIST_FORCELUN}, diff --git a/queue-4.9/scsi-dh-add-new-rdac-devices.patch b/queue-4.9/scsi-dh-add-new-rdac-devices.patch new file mode 100644 index 00000000000..4dd20095bf7 --- /dev/null +++ b/queue-4.9/scsi-dh-add-new-rdac-devices.patch @@ -0,0 +1,51 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Xose Vazquez Perez +Date: Fri, 17 Nov 2017 22:05:13 +0100 +Subject: scsi: dh: add new rdac devices + +From: Xose Vazquez Perez + + +[ Upstream commit 4b3aec2bbbce1c35f50e7475a9fd78d24b9ea4ea ] + +Add IBM 3542 and 3552, arrays: FAStT200 and FAStT500. + +Add full STK OPENstorage family, arrays: 9176, D173, D178, D210, D220, +D240 and D280. + +Add STK BladeCtlr family, arrays: B210, B220, B240 and B280. + +These changes were done in multipath-tools time ago. + +Cc: NetApp RDAC team +Cc: Hannes Reinecke +Cc: Christophe Varoqui +Cc: Martin K. Petersen +Cc: James E.J. Bottomley +Cc: SCSI ML +Cc: device-mapper development +Signed-off-by: Xose Vazquez Perez +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/scsi_dh.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/scsi_dh.c ++++ b/drivers/scsi/scsi_dh.c +@@ -56,10 +56,13 @@ static const struct scsi_dh_blist scsi_d + {"IBM", "1815", "rdac", }, + {"IBM", "1818", "rdac", }, + {"IBM", "3526", "rdac", }, ++ {"IBM", "3542", "rdac", }, ++ {"IBM", "3552", "rdac", }, + {"SGI", "TP9", "rdac", }, + {"SGI", "IS", "rdac", }, +- {"STK", "OPENstorage D280", "rdac", }, ++ {"STK", "OPENstorage", "rdac", }, + {"STK", "FLEXLINE 380", "rdac", }, ++ {"STK", "BladeCtlr", "rdac", }, + {"SUN", "CSM", "rdac", }, + {"SUN", "LCSM100", "rdac", }, + {"SUN", "STK6580_6780", "rdac", }, diff --git a/queue-4.9/scsi-fnic-fix-for-number-of-active-ios-in-fnicstats-becoming-negative.patch b/queue-4.9/scsi-fnic-fix-for-number-of-active-ios-in-fnicstats-becoming-negative.patch new file mode 100644 index 00000000000..589fc19e186 --- /dev/null +++ b/queue-4.9/scsi-fnic-fix-for-number-of-active-ios-in-fnicstats-becoming-negative.patch @@ -0,0 +1,61 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Satish Kharat +Date: Tue, 28 Feb 2017 16:14:56 -0800 +Subject: scsi: fnic: Fix for "Number of Active IOs" in fnicstats becoming negative + +From: Satish Kharat + + +[ Upstream commit 7ef539c88d7d394410d547c9f082d477093a2a22 ] + +Fixing the IO stats update (Active IOs and IO completion) to prevent +"Number of Active IOs" from becoming negative in the fnistats output. + +Signed-off-by: Satish Kharat +Signed-off-by: Sesidhar Baddela +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/fnic/fnic_scsi.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/scsi/fnic/fnic_scsi.c ++++ b/drivers/scsi/fnic/fnic_scsi.c +@@ -1127,12 +1127,6 @@ static void fnic_fcpio_itmf_cmpl_handler + else + CMD_ABTS_STATUS(sc) = hdr_status; + +- atomic64_dec(&fnic_stats->io_stats.active_ios); +- if (atomic64_read(&fnic->io_cmpl_skip)) +- atomic64_dec(&fnic->io_cmpl_skip); +- else +- atomic64_inc(&fnic_stats->io_stats.io_completions); +- + if (!(CMD_FLAGS(sc) & (FNIC_IO_ABORTED | FNIC_IO_DONE))) + atomic64_inc(&misc_stats->no_icmnd_itmf_cmpls); + +@@ -1173,6 +1167,11 @@ static void fnic_fcpio_itmf_cmpl_handler + (((u64)CMD_FLAGS(sc) << 32) | + CMD_STATE(sc))); + sc->scsi_done(sc); ++ atomic64_dec(&fnic_stats->io_stats.active_ios); ++ if (atomic64_read(&fnic->io_cmpl_skip)) ++ atomic64_dec(&fnic->io_cmpl_skip); ++ else ++ atomic64_inc(&fnic_stats->io_stats.io_completions); + } + } + +@@ -1962,6 +1961,11 @@ int fnic_abort_cmd(struct scsi_cmnd *sc) + /* Call SCSI completion function to complete the IO */ + sc->result = (DID_ABORT << 16); + sc->scsi_done(sc); ++ atomic64_dec(&fnic_stats->io_stats.active_ios); ++ if (atomic64_read(&fnic->io_cmpl_skip)) ++ atomic64_dec(&fnic->io_cmpl_skip); ++ else ++ atomic64_inc(&fnic_stats->io_stats.io_completions); + } + + fnic_abort_cmd_end: diff --git a/queue-4.9/scsi-ipr-fix-missed-eh-wakeup.patch b/queue-4.9/scsi-ipr-fix-missed-eh-wakeup.patch new file mode 100644 index 00000000000..7e76e11a413 --- /dev/null +++ b/queue-4.9/scsi-ipr-fix-missed-eh-wakeup.patch @@ -0,0 +1,76 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Brian King +Date: Wed, 15 Mar 2017 16:58:36 -0500 +Subject: scsi: ipr: Fix missed EH wakeup + +From: Brian King + + +[ Upstream commit 66a0d59cdd12546ddf01d229de28b07ccf6d637f ] + +Following a command abort or device reset, ipr's EH handlers wait for +the commands getting aborted to get sent back from the adapter prior to +returning from the EH handler. This fixes up some cases where the +completion handler was not getting called, which would have resulted in +the EH thread waiting until it timed out, greatly extending EH time. + +Signed-off-by: Brian King +Reviewed-by: Wendy Xiong +Tested-by: Wendy Xiong +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/ipr.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/ipr.c ++++ b/drivers/scsi/ipr.c +@@ -836,8 +836,10 @@ static void ipr_sata_eh_done(struct ipr_ + + qc->err_mask |= AC_ERR_OTHER; + sata_port->ioasa.status |= ATA_BUSY; +- list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + ata_qc_complete(qc); ++ if (ipr_cmd->eh_comp) ++ complete(ipr_cmd->eh_comp); ++ list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + } + + /** +@@ -5947,8 +5949,10 @@ static void ipr_erp_done(struct ipr_cmnd + res->in_erp = 0; + } + scsi_dma_unmap(ipr_cmd->scsi_cmd); +- list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + scsi_cmd->scsi_done(scsi_cmd); ++ if (ipr_cmd->eh_comp) ++ complete(ipr_cmd->eh_comp); ++ list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + } + + /** +@@ -6338,8 +6342,10 @@ static void ipr_erp_start(struct ipr_ioa + } + + scsi_dma_unmap(ipr_cmd->scsi_cmd); +- list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + scsi_cmd->scsi_done(scsi_cmd); ++ if (ipr_cmd->eh_comp) ++ complete(ipr_cmd->eh_comp); ++ list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + } + + /** +@@ -6365,8 +6371,10 @@ static void ipr_scsi_done(struct ipr_cmn + scsi_dma_unmap(scsi_cmd); + + spin_lock_irqsave(ipr_cmd->hrrq->lock, lock_flags); +- list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + scsi_cmd->scsi_done(scsi_cmd); ++ if (ipr_cmd->eh_comp) ++ complete(ipr_cmd->eh_comp); ++ list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); + spin_unlock_irqrestore(ipr_cmd->hrrq->lock, lock_flags); + } else { + spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags); diff --git a/queue-4.9/scsi-ses-don-t-ask-for-diagnostic-pages-repeatedly-during-probe.patch b/queue-4.9/scsi-ses-don-t-ask-for-diagnostic-pages-repeatedly-during-probe.patch new file mode 100644 index 00000000000..a4531fda4b9 --- /dev/null +++ b/queue-4.9/scsi-ses-don-t-ask-for-diagnostic-pages-repeatedly-during-probe.patch @@ -0,0 +1,81 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Li Dongyang +Date: Tue, 14 Nov 2017 10:48:04 +1100 +Subject: scsi: ses: don't ask for diagnostic pages repeatedly during probe + +From: Li Dongyang + + +[ Upstream commit 9c0a50022b8ac7e863e6ec8342fa476fe5d1d75c ] + +We are testing if there is a match with the ses device in a loop by +calling ses_match_to_enclosure(), which will issue scsi receive +diagnostics commands to the ses device for every device on the same +host. On one of our boxes with 840 disks, it takes a long time to load +the driver: + +[root@g1b-oss06 ~]# time modprobe ses + +real 40m48.247s +user 0m0.001s +sys 0m0.196s + +With the patch: + +[root@g1b-oss06 ~]# time modprobe ses + +real 0m17.915s +user 0m0.008s +sys 0m0.053s + +Note that we still need to refresh page 10 when we see a new disk to +create the link. + +Signed-off-by: Li Dongyang +Tested-by: Jason Ozolins +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/ses.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -578,13 +578,16 @@ static void ses_enclosure_data_process(s + } + + static void ses_match_to_enclosure(struct enclosure_device *edev, +- struct scsi_device *sdev) ++ struct scsi_device *sdev, ++ int refresh) + { ++ struct scsi_device *edev_sdev = to_scsi_device(edev->edev.parent); + struct efd efd = { + .addr = 0, + }; + +- ses_enclosure_data_process(edev, to_scsi_device(edev->edev.parent), 0); ++ if (refresh) ++ ses_enclosure_data_process(edev, edev_sdev, 0); + + if (scsi_is_sas_rphy(sdev->sdev_target->dev.parent)) + efd.addr = sas_get_address(sdev); +@@ -615,7 +618,7 @@ static int ses_intf_add(struct device *c + struct enclosure_device *prev = NULL; + + while ((edev = enclosure_find(&sdev->host->shost_gendev, prev)) != NULL) { +- ses_match_to_enclosure(edev, sdev); ++ ses_match_to_enclosure(edev, sdev, 1); + prev = edev; + } + return -ENODEV; +@@ -727,7 +730,7 @@ static int ses_intf_add(struct device *c + shost_for_each_device(tmp_sdev, sdev->host) { + if (tmp_sdev->lun != 0 || scsi_device_enclosure(tmp_sdev)) + continue; +- ses_match_to_enclosure(edev, tmp_sdev); ++ ses_match_to_enclosure(edev, tmp_sdev, 0); + } + + return 0; diff --git a/queue-4.9/scsi-ses-don-t-get-power-status-of-ses-device-slot-on-probe.patch b/queue-4.9/scsi-ses-don-t-get-power-status-of-ses-device-slot-on-probe.patch new file mode 100644 index 00000000000..5b7a56a90ea --- /dev/null +++ b/queue-4.9/scsi-ses-don-t-get-power-status-of-ses-device-slot-on-probe.patch @@ -0,0 +1,117 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Mauricio Faria de Oliveira +Date: Wed, 5 Apr 2017 12:18:19 -0300 +Subject: scsi: ses: don't get power status of SES device slot on probe + +From: Mauricio Faria de Oliveira + + +[ Upstream commit 75106523f39751390b5789b36ee1d213b3af1945 ] + +The commit 08024885a2a3 ("ses: Add power_status to SES device slot") +introduced the 'power_status' attribute to enclosure components and +the associated callbacks. + +There are 2 callbacks available to get the power status of a device: +1) ses_get_power_status() for 'struct enclosure_component_callbacks' +2) get_component_power_status() for the sysfs device attribute +(these are available for kernel-space and user-space, respectively.) + +However, despite both methods being available to get power status +on demand, that commit also introduced a call to get power status +in ses_enclosure_data_process(). + +This dramatically increased the total probe time for SCSI devices +on larger configurations, because ses_enclosure_data_process() is +called several times during the SCSI devices probe and loops over +the component devices (but that is another problem, another patch). + +That results in a tremendous continuous hammering of SCSI Receive +Diagnostics commands to the enclosure-services device, which does +delay the total probe time for the SCSI devices __significantly__: + + Originally, ~34 minutes on a system attached to ~170 disks: + + [ 9214.490703] mpt3sas version 13.100.00.00 loaded + ... + [11256.580231] scsi 17:0:177:0: qdepth(16), tagged(1), simple(0), + ordered(0), scsi_level(6), cmd_que(1) + + With this patch, it decreased to ~2.5 minutes -- a 13.6x faster + + [ 1002.992533] mpt3sas version 13.100.00.00 loaded + ... + [ 1151.978831] scsi 11:0:177:0: qdepth(16), tagged(1), simple(0), + ordered(0), scsi_level(6), cmd_que(1) + +Back to the commit discussion.. on the ses_get_power_status() call +introduced in ses_enclosure_data_process(): impact of removing it. + +That may possibly be in place to initialize the power status value +on device probe. However, those 2 functions available to retrieve +that value _do_ automatically refresh/update it. So the potential +benefit would be a direct access of the 'power_status' field which +does not use the callbacks... + +But the only reader of 'struct enclosure_component::power_status' +is the get_component_power_status() callback for sysfs attribute, +and it _does_ check for and call the .get_power_status callback, +(which indeed is defined and implemented by that commit), so the +power status value is, again, automatically updated. + +So, the remaining potential for a direct/non-callback access to +the power_status attribute would be out-of-tree modules -- well, +for those, if they are for whatever reason interested in values +that are set during device probe and not up-to-date by the time +they need it.. well, that would be curious. + +Well, to handle that more properly, set the initial power state +value to '-1' (i.e., uninitialized) instead of '1' (power 'on'), +and check for it in that callback which may do an direct access +to the field value _if_ a callback function is not defined. + +Signed-off-by: Mauricio Faria de Oliveira +Fixes: 08024885a2a3 ("ses: Add power_status to SES device slot") +Reviewed-by: Dan Williams +Reviewed-by: Song Liu +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/enclosure.c | 7 ++++++- + drivers/scsi/ses.c | 1 - + 2 files changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/misc/enclosure.c ++++ b/drivers/misc/enclosure.c +@@ -148,7 +148,7 @@ enclosure_register(struct device *dev, c + for (i = 0; i < components; i++) { + edev->component[i].number = -1; + edev->component[i].slot = -1; +- edev->component[i].power_status = 1; ++ edev->component[i].power_status = -1; + } + + mutex_lock(&container_list_lock); +@@ -600,6 +600,11 @@ static ssize_t get_component_power_statu + + if (edev->cb->get_power_status) + edev->cb->get_power_status(edev, ecomp); ++ ++ /* If still uninitialized, the callback failed or does not exist. */ ++ if (ecomp->power_status == -1) ++ return (edev->cb->get_power_status) ? -EIO : -ENOTTY; ++ + return snprintf(buf, 40, "%s\n", ecomp->power_status ? "on" : "off"); + } + +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -548,7 +548,6 @@ static void ses_enclosure_data_process(s + ecomp = &edev->component[components++]; + + if (!IS_ERR(ecomp)) { +- ses_get_power_status(edev, ecomp); + if (addl_desc_ptr) + ses_process_descriptor( + ecomp, diff --git a/queue-4.9/scsi-sg-check-for-valid-direction-before-starting-the-request.patch b/queue-4.9/scsi-sg-check-for-valid-direction-before-starting-the-request.patch new file mode 100644 index 00000000000..20156be5db5 --- /dev/null +++ b/queue-4.9/scsi-sg-check-for-valid-direction-before-starting-the-request.patch @@ -0,0 +1,98 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Johannes Thumshirn +Date: Fri, 7 Apr 2017 09:34:15 +0200 +Subject: scsi: sg: check for valid direction before starting the request + +From: Johannes Thumshirn + + +[ Upstream commit 28676d869bbb5257b5f14c0c95ad3af3a7019dd5 ] + +Check for a valid direction before starting the request, otherwise we +risk running into an assertion in the scsi midlayer checking for valid +requests. + +[mkp: fixed typo] + +Signed-off-by: Johannes Thumshirn +Link: http://www.spinics.net/lists/linux-scsi/msg104400.html +Reported-by: Dmitry Vyukov +Signed-off-by: Hannes Reinecke +Tested-by: Johannes Thumshirn +Reviewed-by: Christoph Hellwig +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/sg.c | 46 ++++++++++++++++++++++++++++++++++------------ + 1 file changed, 34 insertions(+), 12 deletions(-) + +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -663,18 +663,14 @@ sg_write(struct file *filp, const char _ + * is a non-zero input_size, so emit a warning. + */ + if (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV) { +- static char cmd[TASK_COMM_LEN]; +- if (strcmp(current->comm, cmd)) { +- printk_ratelimited(KERN_WARNING +- "sg_write: data in/out %d/%d bytes " +- "for SCSI command 0x%x-- guessing " +- "data in;\n program %s not setting " +- "count and/or reply_len properly\n", +- old_hdr.reply_len - (int)SZ_SG_HEADER, +- input_size, (unsigned int) cmnd[0], +- current->comm); +- strcpy(cmd, current->comm); +- } ++ printk_ratelimited(KERN_WARNING ++ "sg_write: data in/out %d/%d bytes " ++ "for SCSI command 0x%x-- guessing " ++ "data in;\n program %s not setting " ++ "count and/or reply_len properly\n", ++ old_hdr.reply_len - (int)SZ_SG_HEADER, ++ input_size, (unsigned int) cmnd[0], ++ current->comm); + } + k = sg_common_write(sfp, srp, cmnd, sfp->timeout, blocking); + return (k < 0) ? k : count; +@@ -753,6 +749,29 @@ sg_new_write(Sg_fd *sfp, struct file *fi + return count; + } + ++static bool sg_is_valid_dxfer(sg_io_hdr_t *hp) ++{ ++ switch (hp->dxfer_direction) { ++ case SG_DXFER_NONE: ++ if (hp->dxferp || hp->dxfer_len > 0) ++ return false; ++ return true; ++ case SG_DXFER_TO_DEV: ++ case SG_DXFER_FROM_DEV: ++ case SG_DXFER_TO_FROM_DEV: ++ if (!hp->dxferp || hp->dxfer_len == 0) ++ return false; ++ return true; ++ case SG_DXFER_UNKNOWN: ++ if ((!hp->dxferp && hp->dxfer_len) || ++ (hp->dxferp && hp->dxfer_len == 0)) ++ return false; ++ return true; ++ default: ++ return false; ++ } ++} ++ + static int + sg_common_write(Sg_fd * sfp, Sg_request * srp, + unsigned char *cmnd, int timeout, int blocking) +@@ -773,6 +792,9 @@ sg_common_write(Sg_fd * sfp, Sg_request + "sg_common_write: scsi opcode=0x%02x, cmd_size=%d\n", + (int) cmnd[0], (int) hp->cmd_len)); + ++ if (!sg_is_valid_dxfer(hp)) ++ return -EINVAL; ++ + k = sg_start_req(srp, cmnd); + if (k) { + SCSI_LOG_TIMEOUT(1, sg_printk(KERN_INFO, sfp->parentdp, diff --git a/queue-4.9/scsi-sg-close-race-condition-in-sg_remove_sfp_usercontext.patch b/queue-4.9/scsi-sg-close-race-condition-in-sg_remove_sfp_usercontext.patch new file mode 100644 index 00000000000..7952ac65e0d --- /dev/null +++ b/queue-4.9/scsi-sg-close-race-condition-in-sg_remove_sfp_usercontext.patch @@ -0,0 +1,94 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Hannes Reinecke +Date: Fri, 7 Apr 2017 09:34:17 +0200 +Subject: scsi: sg: close race condition in sg_remove_sfp_usercontext() + +From: Hannes Reinecke + + +[ Upstream commit 97d27b0dd015e980ade63fda111fd1353276e28b ] + +sg_remove_sfp_usercontext() is clearing any sg requests, but needs to +take 'rq_list_lock' when modifying the list. + +Reported-by: Christoph Hellwig +Signed-off-by: Hannes Reinecke +Reviewed-by: Johannes Thumshirn +Tested-by: Johannes Thumshirn +Reviewed-by: Christoph Hellwig +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/sg.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -524,6 +524,7 @@ sg_read(struct file *filp, char __user * + } else + count = (old_hdr->result == 0) ? 0 : -EIO; + sg_finish_rem_req(srp); ++ sg_remove_request(sfp, srp); + retval = count; + free_old_hdr: + kfree(old_hdr); +@@ -564,6 +565,7 @@ sg_new_read(Sg_fd * sfp, char __user *bu + } + err_out: + err2 = sg_finish_rem_req(srp); ++ sg_remove_request(sfp, srp); + return err ? : err2 ? : count; + } + +@@ -800,6 +802,7 @@ sg_common_write(Sg_fd * sfp, Sg_request + SCSI_LOG_TIMEOUT(1, sg_printk(KERN_INFO, sfp->parentdp, + "sg_common_write: start_req err=%d\n", k)); + sg_finish_rem_req(srp); ++ sg_remove_request(sfp, srp); + return k; /* probably out of space --> ENOMEM */ + } + if (atomic_read(&sdp->detaching)) { +@@ -812,6 +815,7 @@ sg_common_write(Sg_fd * sfp, Sg_request + } + + sg_finish_rem_req(srp); ++ sg_remove_request(sfp, srp); + return -ENODEV; + } + +@@ -1302,6 +1306,7 @@ sg_rq_end_io_usercontext(struct work_str + struct sg_fd *sfp = srp->parentfp; + + sg_finish_rem_req(srp); ++ sg_remove_request(sfp, srp); + kref_put(&sfp->f_ref, sg_remove_sfp); + } + +@@ -1846,8 +1851,6 @@ sg_finish_rem_req(Sg_request *srp) + else + sg_remove_scat(sfp, req_schp); + +- sg_remove_request(sfp, srp); +- + return ret; + } + +@@ -2194,12 +2197,17 @@ sg_remove_sfp_usercontext(struct work_st + struct sg_fd *sfp = container_of(work, struct sg_fd, ew.work); + struct sg_device *sdp = sfp->parentdp; + Sg_request *srp; ++ unsigned long iflags; + + /* Cleanup any responses which were never read(). */ ++ write_lock_irqsave(&sfp->rq_list_lock, iflags); + while (!list_empty(&sfp->rq_list)) { + srp = list_first_entry(&sfp->rq_list, Sg_request, entry); + sg_finish_rem_req(srp); ++ list_del(&srp->entry); ++ srp->parentfp = NULL; + } ++ write_unlock_irqrestore(&sfp->rq_list_lock, iflags); + + if (sfp->reserve.bufflen > 0) { + SCSI_LOG_TIMEOUT(6, sg_printk(KERN_INFO, sdp, diff --git a/queue-4.9/selinux-check-for-address-length-in-selinux_socket_bind.patch b/queue-4.9/selinux-check-for-address-length-in-selinux_socket_bind.patch new file mode 100644 index 00000000000..5d2a99def26 --- /dev/null +++ b/queue-4.9/selinux-check-for-address-length-in-selinux_socket_bind.patch @@ -0,0 +1,106 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Alexander Potapenko +Date: Mon, 6 Mar 2017 19:46:14 +0100 +Subject: selinux: check for address length in selinux_socket_bind() + +From: Alexander Potapenko + + +[ Upstream commit e2f586bd83177d22072b275edd4b8b872daba924 ] + +KMSAN (KernelMemorySanitizer, a new error detection tool) reports use of +uninitialized memory in selinux_socket_bind(): + +================================================================== +BUG: KMSAN: use of unitialized memory +inter: 0 +CPU: 3 PID: 1074 Comm: packet2 Tainted: G B 4.8.0-rc6+ #1916 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 + 0000000000000000 ffff8800882ffb08 ffffffff825759c8 ffff8800882ffa48 + ffffffff818bf551 ffffffff85bab870 0000000000000092 ffffffff85bab550 + 0000000000000000 0000000000000092 00000000bb0009bb 0000000000000002 +Call Trace: + [< inline >] __dump_stack lib/dump_stack.c:15 + [] dump_stack+0x238/0x290 lib/dump_stack.c:51 + [] kmsan_report+0x276/0x2e0 mm/kmsan/kmsan.c:1008 + [] __msan_warning+0x5b/0xb0 mm/kmsan/kmsan_instr.c:424 + [] selinux_socket_bind+0xf41/0x1080 security/selinux/hooks.c:4288 + [] security_socket_bind+0x1ec/0x240 security/security.c:1240 + [] SYSC_bind+0x358/0x5f0 net/socket.c:1366 + [] SyS_bind+0x82/0xa0 net/socket.c:1356 + [] do_syscall_64+0x58/0x70 arch/x86/entry/common.c:292 + [] entry_SYSCALL64_slow_path+0x25/0x25 arch/x86/entry/entry_64.o:? +chained origin: 00000000ba6009bb + [] save_stack_trace+0x27/0x50 arch/x86/kernel/stacktrace.c:67 + [< inline >] kmsan_save_stack_with_flags mm/kmsan/kmsan.c:322 + [< inline >] kmsan_save_stack mm/kmsan/kmsan.c:337 + [] kmsan_internal_chain_origin+0x118/0x1e0 mm/kmsan/kmsan.c:530 + [] __msan_set_alloca_origin4+0xc3/0x130 mm/kmsan/kmsan_instr.c:380 + [] SYSC_bind+0x129/0x5f0 net/socket.c:1356 + [] SyS_bind+0x82/0xa0 net/socket.c:1356 + [] do_syscall_64+0x58/0x70 arch/x86/entry/common.c:292 + [] return_from_SYSCALL_64+0x0/0x6a arch/x86/entry/entry_64.o:? +origin description: ----address@SYSC_bind (origin=00000000b8c00900) +================================================================== + +(the line numbers are relative to 4.8-rc6, but the bug persists upstream) + +, when I run the following program as root: + +======================================================= + #include + #include + #include + + int main(int argc, char *argv[]) { + struct sockaddr addr; + int size = 0; + if (argc > 1) { + size = atoi(argv[1]); + } + memset(&addr, 0, sizeof(addr)); + int fd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP); + bind(fd, &addr, size); + return 0; + } +======================================================= + +(for different values of |size| other error reports are printed). + +This happens because bind() unconditionally copies |size| bytes of +|addr| to the kernel, leaving the rest uninitialized. Then +security_socket_bind() reads the IP address bytes, including the +uninitialized ones, to determine the port, or e.g. pass them further to +sel_netnode_find(), which uses them to calculate a hash. + +Signed-off-by: Alexander Potapenko +Acked-by: Eric Dumazet +[PM: fixed some whitespace damage] +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + security/selinux/hooks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -4328,10 +4328,18 @@ static int selinux_socket_bind(struct so + u32 sid, node_perm; + + if (family == PF_INET) { ++ if (addrlen < sizeof(struct sockaddr_in)) { ++ err = -EINVAL; ++ goto out; ++ } + addr4 = (struct sockaddr_in *)address; + snum = ntohs(addr4->sin_port); + addrp = (char *)&addr4->sin_addr.s_addr; + } else { ++ if (addrlen < SIN6_LEN_RFC2133) { ++ err = -EINVAL; ++ goto out; ++ } + addr6 = (struct sockaddr_in6 *)address; + snum = ntohs(addr6->sin6_port); + addrp = (char *)&addr6->sin6_addr.s6_addr; diff --git a/queue-4.9/serial-imx-setup-dcedte-early-and-ensure-dcd-and-ri-irqs-to-be-off.patch b/queue-4.9/serial-imx-setup-dcedte-early-and-ensure-dcd-and-ri-irqs-to-be-off.patch new file mode 100644 index 00000000000..aee62a72db0 --- /dev/null +++ b/queue-4.9/serial-imx-setup-dcedte-early-and-ensure-dcd-and-ri-irqs-to-be-off.patch @@ -0,0 +1,93 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: "Uwe Kleine-König" +Date: Tue, 4 Apr 2017 11:18:51 +0200 +Subject: serial: imx: setup DCEDTE early and ensure DCD and RI irqs to be off + +From: "Uwe Kleine-König" + + +[ Upstream commit e61c38d85b7392e033ee03bca46f1d6006156175 ] + +If the UART is operated in DTE mode and UCR3_DCD or UCR3_RI are 1 (which +is the reset default) and the opposite side pulls the respective line to +its active level the irq triggers after it is requested in .probe. + +These irqs were already disabled in .startup but this might be too late. + +Also setup of the UFCR_DCEDTE bit (currently done in .set_termios) is +done very late which is critical as it also controls direction of some +pins. + +So setup UFCR_DCEDTE earlier (in .probe) and also disable the broken +irqs in DTE mode there before requesting irqs. + +Acked-by: Lucas Stach +Signed-off-by: Uwe Kleine-König +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/imx.c | 36 +++++++++++++++++++++++------------- + 1 file changed, 23 insertions(+), 13 deletions(-) + +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -1316,19 +1316,10 @@ static int imx_startup(struct uart_port + if (!is_imx1_uart(sport)) { + temp = readl(sport->port.membase + UCR3); + +- /* +- * The effect of RI and DCD differs depending on the UFCR_DCEDTE +- * bit. In DCE mode they control the outputs, in DTE mode they +- * enable the respective irqs. At least the DCD irq cannot be +- * cleared on i.MX25 at least, so it's not usable and must be +- * disabled. I don't have test hardware to check if RI has the +- * same problem but I consider this likely so it's disabled for +- * now, too. +- */ +- temp |= IMX21_UCR3_RXDMUXSEL | UCR3_ADNIMP | +- UCR3_DTRDEN | UCR3_RI | UCR3_DCD; ++ temp |= UCR3_DTRDEN | UCR3_RI | UCR3_DCD; + + if (sport->dte_mode) ++ /* disable broken interrupts */ + temp &= ~(UCR3_RI | UCR3_DCD); + + writel(temp, sport->port.membase + UCR3); +@@ -1583,8 +1574,6 @@ imx_set_termios(struct uart_port *port, + + ufcr = readl(sport->port.membase + UFCR); + ufcr = (ufcr & (~UFCR_RFDIV)) | UFCR_RFDIV_REG(div); +- if (sport->dte_mode) +- ufcr |= UFCR_DCEDTE; + writel(ufcr, sport->port.membase + UFCR); + + writel(num, sport->port.membase + UBIR); +@@ -2149,6 +2138,27 @@ static int serial_imx_probe(struct platf + UCR1_TXMPTYEN | UCR1_RTSDEN); + writel_relaxed(reg, sport->port.membase + UCR1); + ++ if (!is_imx1_uart(sport) && sport->dte_mode) { ++ /* ++ * The DCEDTE bit changes the direction of DSR, DCD, DTR and RI ++ * and influences if UCR3_RI and UCR3_DCD changes the level of RI ++ * and DCD (when they are outputs) or enables the respective ++ * irqs. So set this bit early, i.e. before requesting irqs. ++ */ ++ writel(UFCR_DCEDTE, sport->port.membase + UFCR); ++ ++ /* ++ * Disable UCR3_RI and UCR3_DCD irqs. They are also not ++ * enabled later because they cannot be cleared ++ * (confirmed on i.MX25) which makes them unusable. ++ */ ++ writel(IMX21_UCR3_RXDMUXSEL | UCR3_ADNIMP | UCR3_DSR, ++ sport->port.membase + UCR3); ++ ++ } else { ++ writel(0, sport->port.membase + UFCR); ++ } ++ + clk_disable_unprepare(sport->clk_ipg); + + /* diff --git a/queue-4.9/series b/queue-4.9/series index 24be1264b5c..1bd94ef9a81 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -1 +1,210 @@ blkcg-fix-double-free-of-new_blkg-in-blkcg_init_queue.patch +input-tsc2007-check-for-presence-and-power-down-tsc2007-during-probe.patch +perf-stat-issue-a-hw-watchdog-disable-hint.patch +staging-speakup-replace-bug_on-with-warn_on.patch +staging-wilc1000-add-check-for-kmalloc-allocation-failure.patch +hid-reject-input-outside-logical-range-only-if-null-state-is-set.patch +drm-qxl-don-t-alloc-fbdev-if-emulation-is-not-supported.patch +arm-dts-r8a7791-remove-unit-address-and-reg-from-integrated-cache.patch +arm-dts-r8a7792-remove-unit-address-and-reg-from-integrated-cache.patch +arm-dts-r8a7793-remove-unit-address-and-reg-from-integrated-cache.patch +arm-dts-r8a7794-remove-unit-address-and-reg-from-integrated-cache.patch +arm64-dts-r8a7796-remove-unit-address-and-reg-from-integrated-cache.patch +drm-sun4i-fix-up-error-path-cleanup-for-master-bind-function.patch +drm-sun4i-set-drm_crtc.port-to-the-underlying-tcon-s-output-port-node.patch +ath10k-fix-a-warning-during-channel-switch-with-multiple-vaps.patch +drm-sun4i-fix-tcon-clock-and-regmap-initialization-sequence.patch +net-mvpp2-set-dma-mask-and-coherent-dma-mask-on-ppv2.2.patch +pci-msi-stop-disabling-msi-msi-x-in-pci_device_shutdown.patch +selinux-check-for-address-length-in-selinux_socket_bind.patch +x86-mm-make-mmap-map_32bit-work-correctly.patch +perf-sort-fix-segfault-with-basic-block-cycles-sort-dimension.patch +x86-mce-handle-broadcasted-mce-gracefully-with-kexec.patch +eventpoll.h-fix-epoll-event-masks.patch +i40e-acquire-nvm-lock-before-reads-on-all-devices.patch +i40e-fix-ethtool-to-get-eeprom-data-from-x722-interface.patch +perf-tools-make-perf_event__synthesize_mmap_events-scale.patch +arm-brcmstb-enable-zone_dma-for-non-64-bit-capable-peripherals.patch +drivers-net-xgene-fix-hardware-checksum-setting.patch +drivers-net-phy-xgene-fix-mdio-write.patch +drivers-net-xgene-fix-wrong-logical-operation.patch +drivers-net-xgene-fix-rx-checksum-validation-logic.patch +drm-defer-disabling-the-vblank-irq-until-the-next-interrupt-for-instant-off.patch +ath10k-disallow-dfs-simulation-if-dfs-channel-is-not-enabled.patch +ath10k-fix-fetching-channel-during-potential-radar-detection.patch +usb-misc-lvs-fix-race-condition-in-disconnect-handling.patch +arm-bcm2835-enable-missing-cma-settings-for-vc4-driver.patch +net-ethernet-bgmac-allow-mac-address-to-be-specified-in-dtb.patch +netem-apply-correct-delay-when-rate-throttling.patch +x86-mce-init-some-cpu-features-early.patch +omapfb-dss-handle-return-errors-in-dss_init_ports.patch +perf-probe-fix-concat_probe_trace_events.patch +perf-probe-return-errno-when-not-hitting-any-event.patch +hid-clamp-input-to-logical-range-if-no-null-state.patch +net-8021q-create-device-with-all-possible-features-in-wanted_features.patch +arm-dts-adjust-moxart-irq-controller-and-flags.patch +qed-always-publish-vf-link-from-leading-hwfn.patch +s390-topology-fix-typo-in-early-topology-code.patch +zd1211rw-fix-null-deref-at-probe.patch +batman-adv-handle-race-condition-for-claims-between-gateways.patch +of-fix-of_device_get_modalias-returned-length-when-truncating-buffers.patch +solo6x10-release-vb2-buffers-in-solo_stop_streaming.patch +x86-boot-32-defer-resyncing-initial_page_table-until-per-cpu-is-set-up.patch +scsi-fnic-fix-for-number-of-active-ios-in-fnicstats-becoming-negative.patch +scsi-ipr-fix-missed-eh-wakeup.patch +media-i2c-soc_camera-fix-ov6650-sensor-getting-wrong-clock.patch +timers-sched_clock-update-timeout-for-clock-wrap.patch +sysrq-reset-the-watchdog-timers-while-displaying-high-resolution-timers.patch +input-qt1070-add-of-device-id-table.patch +sched-act_csum-don-t-mangle-tcp-and-udp-gso-packets.patch +pci-hv-properly-handle-pci-bus-remove.patch +pci-hv-lock-pci-bus-on-device-eject.patch +asoc-rcar-ssi-don-t-set-ssicr.ckdv-000-with-ssiwsr.cont.patch +spi-omap2-mcspi-poll-omap2_mcspi_chstat_rxs-for-pio-transfer.patch +tcp-sysctl-fix-a-race-to-avoid-unexpected-0-window-from-space.patch +dmaengine-imx-sdma-add-1ms-delay-to-ensure-sdma-channel-is-stopped.patch +usb-dwc3-make-sure-ux_exit_px-is-cleared.patch +arm-dts-bcm2835-add-index-to-the-ethernet-alias.patch +perf-annotate-fix-a-bug-following-symbolic-link-of-a-build-id-file.patch +perf-buildid-do-not-assume-that-readlink-returns-a-null-terminated-string.patch +i40e-i40evf-fix-use-after-free-in-rx-cleanup-path.patch +powerpc-xmon-fix-an-unexpected-xmon-on-off-state-change.patch +scsi-be2iscsi-check-tag-in-beiscsi_mccq_compl_wait.patch +driver-adm1275-set-the-m-b-and-r-coefficients-correctly-for-power.patch +bonding-make-speed-duplex-setting-consistent-with-link-state.patch +mm-fix-false-positive-vm_bug_on-in-page_cache_-get-add-_speculative.patch +alsa-firewire-lib-add-a-quirk-of-packet-without-valid-eoh-in-cip-format.patch +arm-dts-r8a7794-correct-clock-of-du1.patch +arm-dts-silk-correct-clock-of-du1.patch +blk-throttle-make-sure-expire-time-isn-t-too-big.patch +arm-dra7-hwmod_data-prevent-wait_target_disable-error-for-usb_otg_ss.patch +regulator-core-limit-propagation-of-parent-voltage-count-and-list.patch +perf-trace-handle-unpaired-raw_syscalls-sys_exit-event.patch +f2fs-relax-node-version-check-for-victim-data-in-gc.patch +drm-ttm-never-add-bo-that-failed-to-validate-to-the-lru-list.patch +bonding-refine-bond_fold_stats-wrap-detection.patch +pci-apply-cavium-acs-quirk-only-to-cn81xx-cn83xx-cn88xx-devices.patch +powerpc-mm-hugetlb-filter-out-hugepage-size-not-supported-by-page-table-layout.patch +braille-console-fix-value-returned-by-_braille_console_setup.patch +drm-vmwgfx-fixes-to-vmwgfx_fb.patch +vxlan-vxlan-dev-should-inherit-lowerdev-s-gso_max_size.patch +nfc-nfcmrvl-include-unaligned.h-instead-of-access_ok.h.patch +nfc-nfcmrvl-double-free-on-error-path.patch +nfc-pn533-change-order-of-free_irq-and-dev-unregistration.patch +arm-dts-r7s72100-fix-ethernet-clock-parent.patch +arm-dts-r8a7790-correct-parent-of-ssi-clocks.patch +arm-dts-r8a7791-correct-parent-of-ssi-clocks.patch +arm-dts-r8a7793-correct-parent-of-ssi-clocks.patch +powerpc-avoid-taking-a-data-miss-on-every-userspace-instruction-miss.patch +net-hns-correct-hns-rss-key-set-function.patch +net-faraday-add-missing-include-of-of.h.patch +qed-fix-tm-block-ilt-allocation.patch +rtmutex-fix-pi-chain-order-integrity.patch +printk-correctly-handle-preemption-in-console_unlock.patch +soc-tegra-fix-link-errors-with-pmc-disabled.patch +drm-rcar-du-handle-event-when-disabling-crtcs.patch +arm-dts-koelsch-correct-clock-frequency-of-x2-du-clock-input.patch +clk-sunxi-ng-a33-add-offset-and-minimum-value-for-ddr1-pll-n-factor.patch +reiserfs-make-cancel_old_flush-reliable.patch +asoc-rt5677-add-of-device-id-table.patch +ib-hfi1-check-for-qsfp-presence-before-attempting-reads.patch +alsa-firewire-digi00x-add-support-for-console-models-of-digi00x-series.patch +alsa-firewire-digi00x-handle-all-midi-messages-on-streaming-packets.patch +fm10k-correctly-check-if-interface-is-removed.patch +edac-altera-fix-peripheral-warnings-for-cyclone5.patch +scsi-ses-don-t-get-power-status-of-ses-device-slot-on-probe.patch +qed-correct-msi-x-for-storage.patch +apparmor-make-path_max-parameter-readonly.patch +iommu-iova-fix-underflow-bug-in-__alloc_and_insert_iova_range.patch +kvm-svm-setup-mcg_cap-on-amd-properly.patch +kvm-nvmx-disallow-userspace-injected-exceptions-in-guest-mode.patch +video-arm-clcd-fix-dma-allocation-size.patch +drm-radeon-fail-fb-creation-from-imported-dma-bufs.patch +drm-amdgpu-fail-fb-creation-from-imported-dma-bufs.-v2.patch +drm-rockchip-vop-enable-pm-domain-before-vop_initial.patch +i40e-only-register-client-on-iwarp-capable-devices.patch +coresight-fixes-coresight-dt-parse-to-get-correct-output-port-id.patch +lkdtm-turn-off-kcov-for-lkdtm_rodata_do_nothing.patch +tty-amba-pl011-fix-spurious-tx-interrupts.patch +serial-imx-setup-dcedte-early-and-ensure-dcd-and-ri-irqs-to-be-off.patch +mips-bpf-quit-clobbering-callee-saved-registers-in-jit-code.patch +mips-bpf-fix-multiple-problems-in-jit-skb-access-helpers.patch +mips-r2-on-r6-emu-fix-blezl-and-bgtzl-identification.patch +mips-r2-on-r6-emu-clear-bltzall-and-bgezall-debugfs-counters.patch +v4l-vsp1-prevent-multiple-streamon-race-commencing-pipeline-early.patch +v4l-vsp1-register-pipe-with-output-wpf.patch +regulator-isl9305-fix-array-size.patch +md-raid6-fix-anomily-when-recovering-a-single-device-in-raid6.patch +md.c-didn-t-unlock-the-mddev-before-return-einval-in-array_size_store.patch +powerpc-nohash-fix-use-of-mmu_has_feature-in-setup_initial_memory_limit.patch +usb-dwc2-make-sure-we-disconnect-the-gadget-state.patch +usb-gadget-dummy_hcd-fix-wrong-power-status-bit-clear-reset-in-dummy_hub_control.patch +perf-evsel-return-exact-sub-event-which-failed-with-eperm-for-wildcards.patch +iwlwifi-mvm-fix-rx-skb-header-size-and-align-it-properly.patch +drivers-perf-arm_pmu-handle-no-platform_device.patch +perf-inject-copy-events-when-reordering-events-in-pipe-mode.patch +net-fec-add-phy-reset-gpios-probe_defer-check.patch +perf-session-don-t-rely-on-evlist-in-pipe-mode.patch +vfio-powerpc-spapr_tce-enforce-iommu-type-compatibility-check.patch +vfio-spapr_tce-check-kzalloc-return-when-preregistering-memory.patch +scsi-sg-check-for-valid-direction-before-starting-the-request.patch +scsi-sg-close-race-condition-in-sg_remove_sfp_usercontext.patch +alsa-hda-add-geminilake-id-to-skl_plus.patch +kprobes-x86-fix-kprobe-booster-not-to-boost-far-call-instructions.patch +kprobes-x86-set-kprobes-pages-read-only.patch +pwm-tegra-increase-precision-in-pwm-rate-calculation.patch +clk-qcom-msm8996-fix-the-vfe1-powerdomain-name.patch +bluetooth-avoid-bt_accept_unlink-double-unlinking.patch +bluetooth-6lowpan-fix-delay-work-init-in-add_peer_chan.patch +mac80211_hwsim-use-per-interface-power-level.patch +ath10k-fix-compile-time-sanity-check-for-ce4-buffer-size.patch +wil6210-fix-protection-against-connections-during-reset.patch +wil6210-fix-memory-access-violation-in-wil_memcpy_from-toio_32.patch +perf-stat-fix-bug-in-handling-events-in-error-state.patch +mwifiex-fix-invalid-port-issue.patch +drm-edid-set-eld-connector-type-in-drm_edid_to_eld.patch +video-hdmi-allow-empty-hdmi-infoframes.patch +hid-elo-clear-btn_left-mapping.patch +iwlwifi-mvm-rs-don-t-override-the-rate-history-in-the-search-cycle.patch +clk-meson-gxbb-fix-wrong-clock-for-saradc-sana.patch +arm-dts-exynos-correct-trats2-panel-reset-line.patch +sched-stop-switched_to_rt-from-sending-ipis-to-offline-cpus.patch +sched-stop-resched_cpu-from-sending-ipis-to-offline-cpus.patch +test_firmware-fix-setting-old-custom-fw-path-back-on-exit.patch +net-ieee802154-adf7242-fix-bug-if-defined-debug.patch +net-xfrm-allow-clearing-socket-xfrm-policies.patch +mtd-nand-fix-interpretation-of-nand_cmd_none-in-nand_command.patch +net-thunderx-set-max-queue-count-taking-xdp_tx-into-account.patch +arm-dts-am335x-pepper-fix-the-audio-codec-s-reset-pin.patch +arm-dts-omap3-n900-fix-the-audio-codec-s-reset-pin.patch +mtd-nand-ifc-update-bufnum-mask-for-ver-2.0.0.patch +userns-don-t-fail-follow_automount-based-on-s_user_ns.patch +leds-pm8058-silence-pointer-to-integer-size-warning.patch +power-supply-ab8500_charger-fix-an-error-handling-path.patch +power-supply-ab8500_charger-bail-out-in-case-of-error-in-ab8500_charger_init_hw_registers.patch +ath10k-update-tdls-teardown-state-to-target.patch +dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch +scsi-ses-don-t-ask-for-diagnostic-pages-repeatedly-during-probe.patch +pwm-stmpe-fix-wrong-register-offset-for-hwpwm-2-case.patch +clk-qcom-msm8916-fix-mnd_width-for-codec_digcodec.patch +mwifiex-cfg80211-do-not-change-virtual-interface-during-scan-processing.patch +ath10k-fix-invalid-sts_cap_offset_mask.patch +tools-usbip-fixes-build-with-musl-libc-toolchain.patch +spi-sun6i-disable-unprepare-clocks-on-remove.patch +bnxt_en-don-t-print-link-speed-1-no-longer-supported-messages.patch +scsi-core-scsi_get_device_flags_keyed-always-return-device-flags.patch +scsi-devinfo-apply-to-hp-xp-the-same-flags-as-hitachi-vsp.patch +scsi-dh-add-new-rdac-devices.patch +media-vsp1-prevent-suspending-and-resuming-drm-pipelines.patch +media-cpia2-fix-a-couple-off-by-one-bugs.patch +veth-set-peer-gso-values.patch +drm-amdkfd-fix-memory-leaks-in-kfd-topology.patch +powerpc-modules-don-t-try-to-restore-r2-after-a-sibling-call.patch +agp-intel-flush-all-chipset-writes-after-updating-the-ggtt.patch +mac80211_hwsim-enforce-ps_manual_poll-to-be-set-after-ps_enabled.patch +mac80211-remove-bug-when-interface-type-is-invalid.patch +asoc-nuc900-fix-a-loop-timeout-test.patch +ipvlan-add-l2-check-for-packets-arriving-via-virtual-devices.patch +rcutorture-configinit-fix-build-directory-error-message.patch +locking-locktorture-fix-num-reader-writer-corner-cases.patch +ima-relax-requiring-a-file-signature-for-new-files-with-zero-length.patch diff --git a/queue-4.9/soc-tegra-fix-link-errors-with-pmc-disabled.patch b/queue-4.9/soc-tegra-fix-link-errors-with-pmc-disabled.patch new file mode 100644 index 00000000000..41787beb247 --- /dev/null +++ b/queue-4.9/soc-tegra-fix-link-errors-with-pmc-disabled.patch @@ -0,0 +1,95 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Arnd Bergmann +Date: Mon, 20 Mar 2017 10:13:06 +0100 +Subject: soc/tegra: Fix link errors with PMC disabled + +From: Arnd Bergmann + + +[ Upstream commit bd737038d555468198495230f4233b9ba92e774c ] + +With the new Tegra186 PMC driver merged, anything that relies on the previous +PMC driver fails to link when that is disabled: + +arch/arm/mach-tegra/pm.o: In function `tegra_pm_set': +pm.c:(.text.tegra_pm_set+0x3c): undefined reference to `tegra_pmc_enter_suspend_mode' +arch/arm/mach-tegra/pm.o: In function `tegra_suspend_enter': +pm.c:(.text.tegra_suspend_enter+0x4): undefined reference to `tegra_pmc_get_suspend_mode' +arch/arm/mach-tegra/pm.o: In function `tegra_init_suspend': +pm.c:(.init.text+0x1c): undefined reference to `tegra_pmc_get_suspend_mode' +pm.c:(.init.text+0x74): undefined reference to `tegra_pmc_set_suspend_mode' + +ERROR: tegra_powergate_sequence_power_up [drivers/ata/ahci_tegra.ko] undefined! +ERROR: tegra_powergate_power_off [drivers/ata/ahci_tegra.ko] undefined! + +Making the definition depend on the presence of the driver makes it build +again, though that might not be the correct fix. + +Reported-by: Krzysztof Kozlowski +Fixes: 854014236290 ("soc/tegra: Implement Tegra186 PMC support") +Signed-off-by: Arnd Bergmann +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/soc/tegra/pmc.h | 29 +++++++++++++++++++++-------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +--- a/include/soc/tegra/pmc.h ++++ b/include/soc/tegra/pmc.h +@@ -26,12 +26,6 @@ + struct clk; + struct reset_control; + +-#ifdef CONFIG_PM_SLEEP +-enum tegra_suspend_mode tegra_pmc_get_suspend_mode(void); +-void tegra_pmc_set_suspend_mode(enum tegra_suspend_mode mode); +-void tegra_pmc_enter_suspend_mode(enum tegra_suspend_mode mode); +-#endif /* CONFIG_PM_SLEEP */ +- + #ifdef CONFIG_SMP + bool tegra_pmc_cpu_is_powered(unsigned int cpuid); + int tegra_pmc_cpu_power_on(unsigned int cpuid); +@@ -108,7 +102,7 @@ int tegra_pmc_cpu_remove_clamping(unsign + #define TEGRA_IO_RAIL_LVDS 57 + #define TEGRA_IO_RAIL_SYS_DDC 58 + +-#ifdef CONFIG_ARCH_TEGRA ++#ifdef CONFIG_SOC_TEGRA_PMC + int tegra_powergate_is_powered(unsigned int id); + int tegra_powergate_power_on(unsigned int id); + int tegra_powergate_power_off(unsigned int id); +@@ -120,6 +114,11 @@ int tegra_powergate_sequence_power_up(un + + int tegra_io_rail_power_on(unsigned int id); + int tegra_io_rail_power_off(unsigned int id); ++ ++enum tegra_suspend_mode tegra_pmc_get_suspend_mode(void); ++void tegra_pmc_set_suspend_mode(enum tegra_suspend_mode mode); ++void tegra_pmc_enter_suspend_mode(enum tegra_suspend_mode mode); ++ + #else + static inline int tegra_powergate_is_powered(unsigned int id) + { +@@ -157,6 +156,20 @@ static inline int tegra_io_rail_power_of + { + return -ENOSYS; + } +-#endif /* CONFIG_ARCH_TEGRA */ ++ ++static inline enum tegra_suspend_mode tegra_pmc_get_suspend_mode(void) ++{ ++ return TEGRA_SUSPEND_NONE; ++} ++ ++static inline void tegra_pmc_set_suspend_mode(enum tegra_suspend_mode mode) ++{ ++} ++ ++static inline void tegra_pmc_enter_suspend_mode(enum tegra_suspend_mode mode) ++{ ++} ++ ++#endif /* CONFIG_SOC_TEGRA_PMC */ + + #endif /* __SOC_TEGRA_PMC_H__ */ diff --git a/queue-4.9/solo6x10-release-vb2-buffers-in-solo_stop_streaming.patch b/queue-4.9/solo6x10-release-vb2-buffers-in-solo_stop_streaming.patch new file mode 100644 index 00000000000..e17cab28d2e --- /dev/null +++ b/queue-4.9/solo6x10-release-vb2-buffers-in-solo_stop_streaming.patch @@ -0,0 +1,80 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Anton Sviridenko +Date: Thu, 9 Mar 2017 10:46:18 -0300 +Subject: [media] solo6x10: release vb2 buffers in solo_stop_streaming() + +From: Anton Sviridenko + + +[ Upstream commit 6e4c8480bd2eb95309ad3c875e11d2cad98f9188 ] + +Fixes warning that appears in dmesg after closing V4L2 userspace +application that plays video from the display device +(first device from V4L2 device nodes provided by solo, usually /dev/video0 +when no other V4L2 devices are present). Encoder device nodes are not +affected. Can be reproduced by starting and closing + +ffplay -f video4linux2 /dev/video0 + +[ 8130.281251] ------------[ cut here ]------------ +[ 8130.281256] WARNING: CPU: 1 PID: 20414 at drivers/media/v4l2-core/videobuf2-core.c:1651 __vb2_queue_cancel+0x14b/0x230 +[ 8130.281257] Modules linked in: ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat solo6x10 x86_pkg_temp_thermal vboxpci(O) vboxnetadp(O) vboxnetflt(O) vboxdrv(O) +[ 8130.281264] CPU: 1 PID: 20414 Comm: ffplay Tainted: G O 4.10.0-gentoo #1 +[ 8130.281264] Hardware name: ASUS All Series/B85M-E, BIOS 2301 03/30/2015 +[ 8130.281265] Call Trace: +[ 8130.281267] dump_stack+0x4f/0x72 +[ 8130.281270] __warn+0xc7/0xf0 +[ 8130.281271] warn_slowpath_null+0x18/0x20 +[ 8130.281272] __vb2_queue_cancel+0x14b/0x230 +[ 8130.281273] vb2_core_streamoff+0x23/0x90 +[ 8130.281275] vb2_streamoff+0x24/0x50 +[ 8130.281276] vb2_ioctl_streamoff+0x3d/0x50 +[ 8130.281278] v4l_streamoff+0x15/0x20 +[ 8130.281279] __video_do_ioctl+0x25e/0x2f0 +[ 8130.281280] video_usercopy+0x279/0x520 +[ 8130.281282] ? v4l_enum_fmt+0x1330/0x1330 +[ 8130.281285] ? unmap_region+0xdf/0x110 +[ 8130.281285] video_ioctl2+0x10/0x20 +[ 8130.281286] v4l2_ioctl+0xce/0xe0 +[ 8130.281289] do_vfs_ioctl+0x8b/0x5b0 +[ 8130.281290] ? __fget+0x72/0xa0 +[ 8130.281291] SyS_ioctl+0x74/0x80 +[ 8130.281294] entry_SYSCALL_64_fastpath+0x13/0x94 +[ 8130.281295] RIP: 0033:0x7ff86fee6b27 +[ 8130.281296] RSP: 002b:00007ffe467f6a08 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 +[ 8130.281297] RAX: ffffffffffffffda RBX: 00000000d1a4d788 RCX: 00007ff86fee6b27 +[ 8130.281297] RDX: 00007ffe467f6a14 RSI: 0000000040045613 RDI: 0000000000000006 +[ 8130.281298] RBP: 000000000373f8d0 R08: 00000000ffffffff R09: 00007ff860001140 +[ 8130.281298] R10: 0000000000000243 R11: 0000000000000246 R12: 0000000000000000 +[ 8130.281299] R13: 00000000000000a0 R14: 00007ffe467f6530 R15: 0000000001f32228 +[ 8130.281300] ---[ end trace 00695dc96be646e7 ]--- + +Signed-off-by: Anton Sviridenko +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/solo6x10/solo6x10-v4l2.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/media/pci/solo6x10/solo6x10-v4l2.c ++++ b/drivers/media/pci/solo6x10/solo6x10-v4l2.c +@@ -341,6 +341,17 @@ static void solo_stop_streaming(struct v + struct solo_dev *solo_dev = vb2_get_drv_priv(q); + + solo_stop_thread(solo_dev); ++ ++ spin_lock(&solo_dev->slock); ++ while (!list_empty(&solo_dev->vidq_active)) { ++ struct solo_vb2_buf *buf = list_entry( ++ solo_dev->vidq_active.next, ++ struct solo_vb2_buf, list); ++ ++ list_del(&buf->list); ++ vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); ++ } ++ spin_unlock(&solo_dev->slock); + INIT_LIST_HEAD(&solo_dev->vidq_active); + } + diff --git a/queue-4.9/spi-omap2-mcspi-poll-omap2_mcspi_chstat_rxs-for-pio-transfer.patch b/queue-4.9/spi-omap2-mcspi-poll-omap2_mcspi_chstat_rxs-for-pio-transfer.patch new file mode 100644 index 00000000000..a4bec3af4c9 --- /dev/null +++ b/queue-4.9/spi-omap2-mcspi-poll-omap2_mcspi_chstat_rxs-for-pio-transfer.patch @@ -0,0 +1,60 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Akinobu Mita +Date: Wed, 22 Mar 2017 09:18:26 +0900 +Subject: spi: omap2-mcspi: poll OMAP2_MCSPI_CHSTAT_RXS for PIO transfer + +From: Akinobu Mita + + +[ Upstream commit 812613591cb652344186c4cd912304ed02138566 ] + +When running the spi-loopback-test with slower clock rate like 10 KHz, +the test for 251 bytes transfer was failed. This failure triggered an +spi-omap2-mcspi's error message "DMA RX last word empty". + +This message means that PIO for reading the remaining bytes due to the +DMA transfer length reduction is failed. This problem can be fixed by +polling OMAP2_MCSPI_CHSTAT_RXS bit in channel status register to wait +until the receive buffer register is filled. + +Cc: Mark Brown +Signed-off-by: Akinobu Mita +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-omap2-mcspi.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/spi/spi-omap2-mcspi.c ++++ b/drivers/spi/spi-omap2-mcspi.c +@@ -454,6 +454,8 @@ omap2_mcspi_rx_dma(struct spi_device *sp + int elements = 0; + int word_len, element_count; + struct omap2_mcspi_cs *cs = spi->controller_state; ++ void __iomem *chstat_reg = cs->base + OMAP2_MCSPI_CHSTAT0; ++ + mcspi = spi_master_get_devdata(spi->master); + mcspi_dma = &mcspi->dma_channels[spi->chip_select]; + count = xfer->len; +@@ -549,8 +551,8 @@ omap2_mcspi_rx_dma(struct spi_device *sp + if (l & OMAP2_MCSPI_CHCONF_TURBO) { + elements--; + +- if (likely(mcspi_read_cs_reg(spi, OMAP2_MCSPI_CHSTAT0) +- & OMAP2_MCSPI_CHSTAT_RXS)) { ++ if (!mcspi_wait_for_reg_bit(chstat_reg, ++ OMAP2_MCSPI_CHSTAT_RXS)) { + u32 w; + + w = mcspi_read_cs_reg(spi, OMAP2_MCSPI_RX0); +@@ -568,8 +570,7 @@ omap2_mcspi_rx_dma(struct spi_device *sp + return count; + } + } +- if (likely(mcspi_read_cs_reg(spi, OMAP2_MCSPI_CHSTAT0) +- & OMAP2_MCSPI_CHSTAT_RXS)) { ++ if (!mcspi_wait_for_reg_bit(chstat_reg, OMAP2_MCSPI_CHSTAT_RXS)) { + u32 w; + + w = mcspi_read_cs_reg(spi, OMAP2_MCSPI_RX0); diff --git a/queue-4.9/spi-sun6i-disable-unprepare-clocks-on-remove.patch b/queue-4.9/spi-sun6i-disable-unprepare-clocks-on-remove.patch new file mode 100644 index 00000000000..fbcafdbfae8 --- /dev/null +++ b/queue-4.9/spi-sun6i-disable-unprepare-clocks-on-remove.patch @@ -0,0 +1,39 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Tobias Jordan +Date: Thu, 7 Dec 2017 15:04:53 +0100 +Subject: spi: sun6i: disable/unprepare clocks on remove + +From: Tobias Jordan + + +[ Upstream commit 2d9bbd02c54094ceffa555143b0d68cd06504d63 ] + +sun6i_spi_probe() uses sun6i_spi_runtime_resume() to prepare/enable +clocks, so sun6i_spi_remove() should use sun6i_spi_runtime_suspend() to +disable/unprepare them if we're not suspended. +Replacing pm_runtime_disable() by pm_runtime_force_suspend() will ensure +that sun6i_spi_runtime_suspend() is called if needed. + +Found by Linux Driver Verification project (linuxtesting.org). + +Fixes: 3558fe900e8af (spi: sunxi: Add Allwinner A31 SPI controller driver) +Signed-off-by: Tobias Jordan +Acked-by: Maxime Ripard +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-sun6i.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/spi/spi-sun6i.c ++++ b/drivers/spi/spi-sun6i.c +@@ -464,7 +464,7 @@ err_free_master: + + static int sun6i_spi_remove(struct platform_device *pdev) + { +- pm_runtime_disable(&pdev->dev); ++ pm_runtime_force_suspend(&pdev->dev); + + return 0; + } diff --git a/queue-4.9/staging-speakup-replace-bug_on-with-warn_on.patch b/queue-4.9/staging-speakup-replace-bug_on-with-warn_on.patch new file mode 100644 index 00000000000..8250ccdd26d --- /dev/null +++ b/queue-4.9/staging-speakup-replace-bug_on-with-warn_on.patch @@ -0,0 +1,49 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Varsha Rao +Date: Sat, 25 Feb 2017 17:53:58 +0530 +Subject: staging: speakup: Replace BUG_ON() with WARN_ON(). + +From: Varsha Rao + + +[ Upstream commit d351c2db5420bb17dcd2d9aac7ddb5f64c6d04b3 ] + +BUG_ON() is replaced with WARN_ON() and EINVAL is returned, when +WARN_ON() is true. This fixes the following checkpatch issue: + +Avoid crashing the kernel - try using WARN_ON & recovery code rather +than BUG() or BUG_ON(). + +Signed-off-by: Varsha Rao +Reviewed-by: Samuel Thibault +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/speakup/kobjects.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/staging/speakup/kobjects.c ++++ b/drivers/staging/speakup/kobjects.c +@@ -834,7 +834,9 @@ static ssize_t message_show(struct kobje + struct msg_group_t *group = spk_find_msg_group(attr->attr.name); + unsigned long flags; + +- BUG_ON(!group); ++ if (WARN_ON(!group)) ++ return -EINVAL; ++ + spin_lock_irqsave(&speakup_info.spinlock, flags); + retval = message_show_helper(buf, group->start, group->end); + spin_unlock_irqrestore(&speakup_info.spinlock, flags); +@@ -846,7 +848,9 @@ static ssize_t message_store(struct kobj + { + struct msg_group_t *group = spk_find_msg_group(attr->attr.name); + +- BUG_ON(!group); ++ if (WARN_ON(!group)) ++ return -EINVAL; ++ + return message_store_helper(buf, count, group); + } + diff --git a/queue-4.9/staging-wilc1000-add-check-for-kmalloc-allocation-failure.patch b/queue-4.9/staging-wilc1000-add-check-for-kmalloc-allocation-failure.patch new file mode 100644 index 00000000000..0212f36cffd --- /dev/null +++ b/queue-4.9/staging-wilc1000-add-check-for-kmalloc-allocation-failure.patch @@ -0,0 +1,34 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Colin Ian King +Date: Tue, 28 Feb 2017 11:47:33 +0000 +Subject: staging: wilc1000: add check for kmalloc allocation failure. + +From: Colin Ian King + + +[ Upstream commit 6cc0c259d034c6ab48f4e12f505213988e73d380 ] + +Add a sanity check that wid.val has been allocated, fixes a null +pointer deference on stamac when calling ether_add_copy. + +Detected by CoverityScan, CID#1369537 ("Dereference null return value") + +Signed-off-by: Colin Ian King +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/wilc1000/host_interface.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/staging/wilc1000/host_interface.c ++++ b/drivers/staging/wilc1000/host_interface.c +@@ -1930,6 +1930,8 @@ static s32 Handle_Get_InActiveTime(struc + wid.type = WID_STR; + wid.size = ETH_ALEN; + wid.val = kmalloc(wid.size, GFP_KERNEL); ++ if (!wid.val) ++ return -ENOMEM; + + stamac = wid.val; + memcpy(stamac, strHostIfStaInactiveT->mac, ETH_ALEN); diff --git a/queue-4.9/sysrq-reset-the-watchdog-timers-while-displaying-high-resolution-timers.patch b/queue-4.9/sysrq-reset-the-watchdog-timers-while-displaying-high-resolution-timers.patch new file mode 100644 index 00000000000..f51b64be9c6 --- /dev/null +++ b/queue-4.9/sysrq-reset-the-watchdog-timers-while-displaying-high-resolution-timers.patch @@ -0,0 +1,71 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Tom Hromatka +Date: Wed, 4 Jan 2017 15:28:04 -0700 +Subject: sysrq: Reset the watchdog timers while displaying high-resolution timers + +From: Tom Hromatka + + +[ Upstream commit 0107042768658fea9f5f5a9c00b1c90f5dab6a06 ] + +On systems with a large number of CPUs, running sysrq- can cause +watchdog timeouts. There are two slow sections of code in the sysrq- +path in timer_list.c. + +1. print_active_timers() - This function is called by print_cpu() and + contains a slow goto loop. On a machine with hundreds of CPUs, this + loop took approximately 100ms for the first CPU in a NUMA node. + (Subsequent CPUs in the same node ran much quicker.) The total time + to print all of the CPUs is ultimately long enough to trigger the + soft lockup watchdog. + +2. print_tickdevice() - This function outputs a large amount of textual + information. This function also took approximately 100ms per CPU. + +Since sysrq- is not a performance critical path, there should be no +harm in touching the nmi watchdog in both slow sections above. Touching +it in just one location was insufficient on systems with hundreds of +CPUs as occasional timeouts were still observed during testing. + +This issue was observed on an Oracle T7 machine with 128 CPUs, but I +anticipate it may affect other systems with similarly large numbers of +CPUs. + +Signed-off-by: Tom Hromatka +Reviewed-by: Rob Gardner +Signed-off-by: John Stultz +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/time/timer_list.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/kernel/time/timer_list.c ++++ b/kernel/time/timer_list.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + + #include + +@@ -96,6 +97,9 @@ print_active_timers(struct seq_file *m, + + next_one: + i = 0; ++ ++ touch_nmi_watchdog(); ++ + raw_spin_lock_irqsave(&base->cpu_base->lock, flags); + + curr = timerqueue_getnext(&base->active); +@@ -207,6 +211,8 @@ print_tickdevice(struct seq_file *m, str + { + struct clock_event_device *dev = td->evtdev; + ++ touch_nmi_watchdog(); ++ + SEQ_printf(m, "Tick Device: mode: %d\n", td->mode); + if (cpu < 0) + SEQ_printf(m, "Broadcast device\n"); diff --git a/queue-4.9/tcp-sysctl-fix-a-race-to-avoid-unexpected-0-window-from-space.patch b/queue-4.9/tcp-sysctl-fix-a-race-to-avoid-unexpected-0-window-from-space.patch new file mode 100644 index 00000000000..99012b60aab --- /dev/null +++ b/queue-4.9/tcp-sysctl-fix-a-race-to-avoid-unexpected-0-window-from-space.patch @@ -0,0 +1,47 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Gao Feng +Date: Fri, 24 Mar 2017 07:05:12 +0800 +Subject: tcp: sysctl: Fix a race to avoid unexpected 0 window from space + +From: Gao Feng + + +[ Upstream commit c48367427a39ea0b85c7cf018fe4256627abfd9e ] + +Because sysctl_tcp_adv_win_scale could be changed any time, so there +is one race in tcp_win_from_space. +For example, +1.sysctl_tcp_adv_win_scale<=0 (sysctl_tcp_adv_win_scale is negative now) +2.space>>(-sysctl_tcp_adv_win_scale) (sysctl_tcp_adv_win_scale is postive now) + +As a result, tcp_win_from_space returns 0. It is unexpected. + +Certainly if the compiler put the sysctl_tcp_adv_win_scale into one +register firstly, then use the register directly, it would be ok. +But we could not depend on the compiler behavior. + +Signed-off-by: Gao Feng +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/net/tcp.h | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1265,9 +1265,11 @@ void tcp_select_initial_window(int __spa + + static inline int tcp_win_from_space(int space) + { +- return sysctl_tcp_adv_win_scale<=0 ? +- (space>>(-sysctl_tcp_adv_win_scale)) : +- space - (space>>sysctl_tcp_adv_win_scale); ++ int tcp_adv_win_scale = sysctl_tcp_adv_win_scale; ++ ++ return tcp_adv_win_scale <= 0 ? ++ (space>>(-tcp_adv_win_scale)) : ++ space - (space>>tcp_adv_win_scale); + } + + /* Note: caller must be prepared to deal with negative returns */ diff --git a/queue-4.9/test_firmware-fix-setting-old-custom-fw-path-back-on-exit.patch b/queue-4.9/test_firmware-fix-setting-old-custom-fw-path-back-on-exit.patch new file mode 100644 index 00000000000..58be58ba7f4 --- /dev/null +++ b/queue-4.9/test_firmware-fix-setting-old-custom-fw-path-back-on-exit.patch @@ -0,0 +1,48 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: "Luis R. Rodriguez" +Date: Mon, 20 Nov 2017 09:45:35 -0800 +Subject: test_firmware: fix setting old custom fw path back on exit + +From: "Luis R. Rodriguez" + + +[ Upstream commit 65c79230576873b312c3599479c1e42355c9f349 ] + +The file /sys/module/firmware_class/parameters/path can be used +to set a custom firmware path. The fw_filesystem.sh script creates +a temporary directory to add a test firmware file to be used during +testing, in order for this to work it uses the custom path syfs file +and it was supposed to reset back the file on execution exit. The +script failed to do this due to a typo, it was using OLD_PATH instead +of OLD_FWPATH, since its inception since v3.17. + +Its not as easy to just keep the old setting, it turns out that +resetting an empty setting won't actually do what we want, we need +to check if it was empty and set an empty space. + +Without this we end up having the temporary path always set after +we run these tests. + +Fixes: 0a8adf58475 ("test: add firmware_class loader test") +Signed-off-by: Luis R. Rodriguez +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/firmware/fw_filesystem.sh | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/tools/testing/selftests/firmware/fw_filesystem.sh ++++ b/tools/testing/selftests/firmware/fw_filesystem.sh +@@ -28,7 +28,10 @@ test_finish() + if [ "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then + echo "$OLD_TIMEOUT" >/sys/class/firmware/timeout + fi +- echo -n "$OLD_PATH" >/sys/module/firmware_class/parameters/path ++ if [ "$OLD_FWPATH" = "" ]; then ++ OLD_FWPATH=" " ++ fi ++ echo -n "$OLD_FWPATH" >/sys/module/firmware_class/parameters/path + rm -f "$FW" + rmdir "$FWPATH" + } diff --git a/queue-4.9/timers-sched_clock-update-timeout-for-clock-wrap.patch b/queue-4.9/timers-sched_clock-update-timeout-for-clock-wrap.patch new file mode 100644 index 00000000000..557adeed086 --- /dev/null +++ b/queue-4.9/timers-sched_clock-update-timeout-for-clock-wrap.patch @@ -0,0 +1,41 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: David Engraf +Date: Fri, 17 Feb 2017 08:51:03 +0100 +Subject: timers, sched_clock: Update timeout for clock wrap + +From: David Engraf + + +[ Upstream commit 1b8955bc5ac575009835e371ae55e7f3af2197a9 ] + +The scheduler clock framework may not use the correct timeout for the clock +wrap. This happens when a new clock driver calls sched_clock_register() +after the kernel called sched_clock_postinit(). In this case the clock wrap +timeout is too long thus sched_clock_poll() is called too late and the clock +already wrapped. + +On my ARM system the scheduler was no longer scheduling any other task than +the idle task because the sched_clock() wrapped. + +Signed-off-by: David Engraf +Signed-off-by: John Stultz +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/time/sched_clock.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/kernel/time/sched_clock.c ++++ b/kernel/time/sched_clock.c +@@ -205,6 +205,11 @@ sched_clock_register(u64 (*read)(void), + + update_clock_read_data(&rd); + ++ if (sched_clock_timer.function != NULL) { ++ /* update timeout for clock wrap */ ++ hrtimer_start(&sched_clock_timer, cd.wrap_kt, HRTIMER_MODE_REL); ++ } ++ + r = rate; + if (r >= 4000000) { + r /= 1000000; diff --git a/queue-4.9/tools-usbip-fixes-build-with-musl-libc-toolchain.patch b/queue-4.9/tools-usbip-fixes-build-with-musl-libc-toolchain.patch new file mode 100644 index 00000000000..8c182ce2836 --- /dev/null +++ b/queue-4.9/tools-usbip-fixes-build-with-musl-libc-toolchain.patch @@ -0,0 +1,45 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Julien BOIBESSOT +Date: Tue, 5 Dec 2017 18:48:14 +0100 +Subject: tools/usbip: fixes build with musl libc toolchain + +From: Julien BOIBESSOT + + +[ Upstream commit 77be4c878c72e411ad22af96b6f81dd45c26450a ] + +Indeed musl doesn't define old SIGCLD signal name but only new one SIGCHLD. +SIGCHLD is the new POSIX name for that signal so it doesn't change +anything on other libcs. + +This fixes this kind of build error: + +usbipd.c: In function ‘set_signal’: +usbipd.c:459:12: error: 'SIGCLD' undeclared (first use in this function) + sigaction(SIGCLD, &act, NULL); + ^~~~~~ +usbipd.c:459:12: note: each undeclared identifier is reported only once + for each function it appears in +Makefile:407: recipe for target 'usbipd.o' failed +make[3]: *** [usbipd.o] Error 1 + +Signed-off-by: Julien BOIBESSOT +Acked-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/usb/usbip/src/usbipd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/usb/usbip/src/usbipd.c ++++ b/tools/usb/usbip/src/usbipd.c +@@ -463,7 +463,7 @@ static void set_signal(void) + sigaction(SIGTERM, &act, NULL); + sigaction(SIGINT, &act, NULL); + act.sa_handler = SIG_IGN; +- sigaction(SIGCLD, &act, NULL); ++ sigaction(SIGCHLD, &act, NULL); + } + + static const char *pid_file; diff --git a/queue-4.9/tty-amba-pl011-fix-spurious-tx-interrupts.patch b/queue-4.9/tty-amba-pl011-fix-spurious-tx-interrupts.patch new file mode 100644 index 00000000000..1c5a70bc9f9 --- /dev/null +++ b/queue-4.9/tty-amba-pl011-fix-spurious-tx-interrupts.patch @@ -0,0 +1,115 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Jayachandran C +Date: Sat, 1 Apr 2017 19:42:09 +0000 +Subject: tty: amba-pl011: Fix spurious TX interrupts + +From: Jayachandran C + + +[ Upstream commit 7d05587c9e0e4611650bb403812e2d492c178a9f ] + +On SMP systems, we see a lot of spurious TX interrupts when a +program generates a steady stream of output to the pl011 UART. + +The problem can be easily seen when one CPU generates the output +while another CPU handles the pl011 interrupts, and the rate of +output is low enough not to fill the TX FIFO. The problem seems +to be: + + -- CPU a -- -- CPU b -- + (take port lock) + pl011_start_tx + pl011_start_tx_pio + enable TXIM in REG_IMSC -> causes uart tx intr (pl011_int) + pl011_tx_chars pl011_int + ...tx chars, all done... (wait for port lock) + pl011_stop_tx . + disable TXIM . + (release port lock) -> (take port lock) + check for TXIM, not enabled + (release port lock) + return IRQ_NONE + +Enabling the TXIM in pl011_start_tx_pio() causes the interrupt +to be generated and delivered to CPU b, even though pl011_tx_chars() +is able to complete the TX and then disable the tx interrupt. + +Fix this by enabling TXIM only after pl011_tx_chars, if it is needed. +pl011_tx_chars will return a boolean indicating whether the TX +interrupts have to be enabled. + +Debugged-by: Vijaya Kumar +Signed-off-by: Jayachandran C +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/amba-pl011.c | 23 ++++++++++++++--------- + 1 file changed, 14 insertions(+), 9 deletions(-) + +--- a/drivers/tty/serial/amba-pl011.c ++++ b/drivers/tty/serial/amba-pl011.c +@@ -1302,14 +1302,15 @@ static void pl011_stop_tx(struct uart_po + pl011_dma_tx_stop(uap); + } + +-static void pl011_tx_chars(struct uart_amba_port *uap, bool from_irq); ++static bool pl011_tx_chars(struct uart_amba_port *uap, bool from_irq); + + /* Start TX with programmed I/O only (no DMA) */ + static void pl011_start_tx_pio(struct uart_amba_port *uap) + { +- uap->im |= UART011_TXIM; +- pl011_write(uap->im, uap, REG_IMSC); +- pl011_tx_chars(uap, false); ++ if (pl011_tx_chars(uap, false)) { ++ uap->im |= UART011_TXIM; ++ pl011_write(uap->im, uap, REG_IMSC); ++ } + } + + static void pl011_start_tx(struct uart_port *port) +@@ -1389,25 +1390,26 @@ static bool pl011_tx_char(struct uart_am + return true; + } + +-static void pl011_tx_chars(struct uart_amba_port *uap, bool from_irq) ++/* Returns true if tx interrupts have to be (kept) enabled */ ++static bool pl011_tx_chars(struct uart_amba_port *uap, bool from_irq) + { + struct circ_buf *xmit = &uap->port.state->xmit; + int count = uap->fifosize >> 1; + + if (uap->port.x_char) { + if (!pl011_tx_char(uap, uap->port.x_char, from_irq)) +- return; ++ return true; + uap->port.x_char = 0; + --count; + } + if (uart_circ_empty(xmit) || uart_tx_stopped(&uap->port)) { + pl011_stop_tx(&uap->port); +- return; ++ return false; + } + + /* If we are using DMA mode, try to send some characters. */ + if (pl011_dma_tx_irq(uap)) +- return; ++ return true; + + do { + if (likely(from_irq) && count-- == 0) +@@ -1422,8 +1424,11 @@ static void pl011_tx_chars(struct uart_a + if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) + uart_write_wakeup(&uap->port); + +- if (uart_circ_empty(xmit)) ++ if (uart_circ_empty(xmit)) { + pl011_stop_tx(&uap->port); ++ return false; ++ } ++ return true; + } + + static void pl011_modem_status(struct uart_amba_port *uap) diff --git a/queue-4.9/usb-dwc2-make-sure-we-disconnect-the-gadget-state.patch b/queue-4.9/usb-dwc2-make-sure-we-disconnect-the-gadget-state.patch new file mode 100644 index 00000000000..04690a7e729 --- /dev/null +++ b/queue-4.9/usb-dwc2-make-sure-we-disconnect-the-gadget-state.patch @@ -0,0 +1,56 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: John Stultz +Date: Mon, 13 Feb 2017 20:08:08 -0800 +Subject: usb: dwc2: Make sure we disconnect the gadget state + +From: John Stultz + + +[ Upstream commit dad3f793f20fbb5c0c342f0f5a0bdf69a4d76089 ] + +I had seen some odd behavior with HiKey's usb-gadget interface +that I finally seemed to have chased down. Basically every other +time I plugged in the OTG port, the gadget interface would +properly initialize. The other times, I'd get a big WARN_ON +in dwc2_hsotg_init_fifo() about the fifo_map not being clear. + +Ends up if we don't disconnect the gadget state, the fifo-map +doesn't get cleared properly, which causes WARN_ON messages and +also results in the device not properly being setup as a gadget +every other time the OTG port is connected. + +So this patch adds a call to dwc2_hsotg_disconnect() in the +reset path so the state is properly cleared. + +With it, the gadget interface initializes properly on every +plug in. + +Cc: Wei Xu +Cc: Guodong Xu +Cc: Amit Pundir +Cc: Rob Herring +Cc: John Youn +Cc: Douglas Anderson +Cc: Chen Yu +Cc: Felipe Balbi +Cc: Greg Kroah-Hartman +Cc: linux-usb@vger.kernel.org +Acked-by: John Youn +Signed-off-by: John Stultz +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/hcd.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -3220,6 +3220,7 @@ static void dwc2_conn_id_status_change(s + dwc2_core_init(hsotg, false); + dwc2_enable_global_interrupts(hsotg); + spin_lock_irqsave(&hsotg->lock, flags); ++ dwc2_hsotg_disconnect(hsotg); + dwc2_hsotg_core_init_disconnected(hsotg, false); + spin_unlock_irqrestore(&hsotg->lock, flags); + dwc2_hsotg_core_connect(hsotg); diff --git a/queue-4.9/usb-dwc3-make-sure-ux_exit_px-is-cleared.patch b/queue-4.9/usb-dwc3-make-sure-ux_exit_px-is-cleared.patch new file mode 100644 index 00000000000..7c4158922d3 --- /dev/null +++ b/queue-4.9/usb-dwc3-make-sure-ux_exit_px-is-cleared.patch @@ -0,0 +1,49 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Felipe Balbi +Date: Wed, 3 Aug 2016 14:16:15 +0300 +Subject: usb: dwc3: make sure UX_EXIT_PX is cleared + +From: Felipe Balbi + + +[ Upstream commit 1966b8657d058ecb95031809b607bf3fd1e01c10 ] + +This bit is only supposed to be used with known +buggy PHYs, however some platforms might erroneously +set it. In order to avoid it, let's make sure this +bit is always cleared. If some PHY needs this, we +will need to add a quirk flag. + +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 6 ++++++ + drivers/usb/dwc3/core.h | 1 + + 2 files changed, 7 insertions(+) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -464,6 +464,12 @@ static int dwc3_phy_setup(struct dwc3 *d + reg = dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0)); + + /* ++ * Make sure UX_EXIT_PX is cleared as that causes issues with some ++ * PHYs. Also, this bit is not supposed to be used in normal operation. ++ */ ++ reg &= ~DWC3_GUSB3PIPECTL_UX_EXIT_PX; ++ ++ /* + * Above 1.94a, it is recommended to set DWC3_GUSB3PIPECTL_SUSPHY + * to '0' during coreConsultant configuration. So default value + * will be '0' when the core is reset. Application needs to set it +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -223,6 +223,7 @@ + #define DWC3_GUSB3PIPECTL_PHYSOFTRST (1 << 31) + #define DWC3_GUSB3PIPECTL_U2SSINP3OK (1 << 29) + #define DWC3_GUSB3PIPECTL_DISRXDETINP3 (1 << 28) ++#define DWC3_GUSB3PIPECTL_UX_EXIT_PX (1 << 27) + #define DWC3_GUSB3PIPECTL_REQP1P2P3 (1 << 24) + #define DWC3_GUSB3PIPECTL_DEP1P2P3(n) ((n) << 19) + #define DWC3_GUSB3PIPECTL_DEP1P2P3_MASK DWC3_GUSB3PIPECTL_DEP1P2P3(7) diff --git a/queue-4.9/usb-gadget-dummy_hcd-fix-wrong-power-status-bit-clear-reset-in-dummy_hub_control.patch b/queue-4.9/usb-gadget-dummy_hcd-fix-wrong-power-status-bit-clear-reset-in-dummy_hub_control.patch new file mode 100644 index 00000000000..a166eb0d525 --- /dev/null +++ b/queue-4.9/usb-gadget-dummy_hcd-fix-wrong-power-status-bit-clear-reset-in-dummy_hub_control.patch @@ -0,0 +1,67 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Yuyang Du +Date: Fri, 24 Mar 2017 04:06:11 +0800 +Subject: usb: gadget: dummy_hcd: Fix wrong power status bit clear/reset in dummy_hub_control() + +From: Yuyang Du + + +[ Upstream commit 9f20dfb44d03745d0d3cef2ffb3abf8d8024fa61 ] + +This fixes the commit: 1cd8fd2887e1 ("usb: gadget: dummy_hcd: add +SuperSpeed support"). + +In the case of ClearPortFeature and USB_PORT_FEAT_POWER, simply clear +the right bit regardless of what the wValue is. + +Acked-by: Alan Stern +Signed-off-by: Yuyang Du +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/dummy_hcd.c | 20 ++++++++------------ + 1 file changed, 8 insertions(+), 12 deletions(-) + +--- a/drivers/usb/gadget/udc/dummy_hcd.c ++++ b/drivers/usb/gadget/udc/dummy_hcd.c +@@ -2103,16 +2103,13 @@ static int dummy_hub_control( + } + break; + case USB_PORT_FEAT_POWER: +- if (hcd->speed == HCD_USB3) { +- if (dum_hcd->port_status & USB_PORT_STAT_POWER) +- dev_dbg(dummy_dev(dum_hcd), +- "power-off\n"); +- } else +- if (dum_hcd->port_status & +- USB_SS_PORT_STAT_POWER) +- dev_dbg(dummy_dev(dum_hcd), +- "power-off\n"); +- /* FALLS THROUGH */ ++ dev_dbg(dummy_dev(dum_hcd), "power-off\n"); ++ if (hcd->speed == HCD_USB3) ++ dum_hcd->port_status &= ~USB_SS_PORT_STAT_POWER; ++ else ++ dum_hcd->port_status &= ~USB_PORT_STAT_POWER; ++ set_link_state(dum_hcd); ++ break; + default: + dum_hcd->port_status &= ~(1 << wValue); + set_link_state(dum_hcd); +@@ -2283,14 +2280,13 @@ static int dummy_hub_control( + if ((dum_hcd->port_status & + USB_SS_PORT_STAT_POWER) != 0) { + dum_hcd->port_status |= (1 << wValue); +- set_link_state(dum_hcd); + } + } else + if ((dum_hcd->port_status & + USB_PORT_STAT_POWER) != 0) { + dum_hcd->port_status |= (1 << wValue); +- set_link_state(dum_hcd); + } ++ set_link_state(dum_hcd); + } + break; + case GetPortErrorCount: diff --git a/queue-4.9/usb-misc-lvs-fix-race-condition-in-disconnect-handling.patch b/queue-4.9/usb-misc-lvs-fix-race-condition-in-disconnect-handling.patch new file mode 100644 index 00000000000..2504a1747c9 --- /dev/null +++ b/queue-4.9/usb-misc-lvs-fix-race-condition-in-disconnect-handling.patch @@ -0,0 +1,34 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Oliver Neukum +Date: Tue, 14 Mar 2017 12:05:07 +0100 +Subject: usb: misc: lvs: fix race condition in disconnect handling + +From: Oliver Neukum + + +[ Upstream commit c4ba329cabca7c839ab48fb58b5bcc2582951a48 ] + +There is a small window during which the an URB may +remain active after disconnect has returned. If in that case +already freed memory may be accessed and executed. + +The fix is to poison the URB befotre the work is flushed. + +Signed-off-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/misc/lvstest.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/misc/lvstest.c ++++ b/drivers/usb/misc/lvstest.c +@@ -433,6 +433,7 @@ static void lvs_rh_disconnect(struct usb + struct lvs_rh *lvs = usb_get_intfdata(intf); + + sysfs_remove_group(&intf->dev.kobj, &lvs_attr_group); ++ usb_poison_urb(lvs->urb); /* used in scheduled work */ + flush_work(&lvs->rh_work); + usb_free_urb(lvs->urb); + } diff --git a/queue-4.9/userns-don-t-fail-follow_automount-based-on-s_user_ns.patch b/queue-4.9/userns-don-t-fail-follow_automount-based-on-s_user_ns.patch new file mode 100644 index 00000000000..cfe99e5149a --- /dev/null +++ b/queue-4.9/userns-don-t-fail-follow_automount-based-on-s_user_ns.patch @@ -0,0 +1,51 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: "Eric W. Biederman" +Date: Wed, 29 Nov 2017 17:29:20 -0600 +Subject: userns: Don't fail follow_automount based on s_user_ns + +From: "Eric W. Biederman" + + +[ Upstream commit bbc3e471011417598e598707486f5d8814ec9c01 ] + +When vfs_submount was added the test to limit automounts from +filesystems that with s_user_ns != &init_user_ns accidentially left +in follow_automount. The test was never about any security concerns +and was always about how do we implement this for filesystems whose +s_user_ns != &init_user_ns. + +At the moment this check makes no difference as there are no +filesystems that both set FS_USERNS_MOUNT and implement d_automount. + +Remove this check now while I am thinking about it so there will not +be odd booby traps for someone who does want to make this combination +work. + +vfs_submount still needs improvements to allow this combination to work, +and vfs_submount contains a check that presents a warning. + +The autofs4 filesystem could be modified to set FS_USERNS_MOUNT and it would +need not work on this code path, as userspace performs the mounts. + +Fixes: 93faccbbfa95 ("fs: Better permission checking for submounts") +Fixes: aeaa4a79ff6a ("fs: Call d_automount with the filesystems creds") +Acked-by: Ian Kent +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/namei.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -1121,9 +1121,6 @@ static int follow_automount(struct path + path->dentry->d_inode) + return -EISDIR; + +- if (path->dentry->d_sb->s_user_ns != &init_user_ns) +- return -EACCES; +- + nd->total_link_count++; + if (nd->total_link_count >= 40) + return -ELOOP; diff --git a/queue-4.9/v4l-vsp1-prevent-multiple-streamon-race-commencing-pipeline-early.patch b/queue-4.9/v4l-vsp1-prevent-multiple-streamon-race-commencing-pipeline-early.patch new file mode 100644 index 00000000000..7aab174aa95 --- /dev/null +++ b/queue-4.9/v4l-vsp1-prevent-multiple-streamon-race-commencing-pipeline-early.patch @@ -0,0 +1,73 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Kieran Bingham +Date: Fri, 6 Jan 2017 10:15:28 -0200 +Subject: [media] v4l: vsp1: Prevent multiple streamon race commencing pipeline early + +From: Kieran Bingham + + +[ Upstream commit 4461c84b52b4a952c657505ef7e4e06b016783df ] + +With multiple inputs through the BRU it is feasible for the streams to +race each other at stream-on. + +Multiple VIDIOC_STREAMON calls racing each other could have process +N-1 skipping over the pipeline setup section and then start the pipeline +early, if videobuf2 has already enqueued buffers to the driver for +process N but not called the .start_streaming() operation yet + +In the case of the video pipelines, this +can present two serious issues. + + 1) A null-dereference if the pipe->dl is committed at the same time as + the vsp1_video_setup_pipeline() is processing + + 2) A hardware hang, where a display list is committed without having + called vsp1_video_setup_pipeline() first + +Repair this issue, by ensuring that only the stream which configures the +pipeline is able to start it. + +Signed-off-by: Kieran Bingham +Reviewed-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/vsp1/vsp1_video.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/drivers/media/platform/vsp1/vsp1_video.c ++++ b/drivers/media/platform/vsp1/vsp1_video.c +@@ -792,6 +792,7 @@ static int vsp1_video_start_streaming(st + { + struct vsp1_video *video = vb2_get_drv_priv(vq); + struct vsp1_pipeline *pipe = video->rwpf->pipe; ++ bool start_pipeline = false; + unsigned long flags; + int ret; + +@@ -802,11 +803,23 @@ static int vsp1_video_start_streaming(st + mutex_unlock(&pipe->lock); + return ret; + } ++ ++ start_pipeline = true; + } + + pipe->stream_count++; + mutex_unlock(&pipe->lock); + ++ /* ++ * vsp1_pipeline_ready() is not sufficient to establish that all streams ++ * are prepared and the pipeline is configured, as multiple streams ++ * can race through streamon with buffers already queued; Therefore we ++ * don't even attempt to start the pipeline until the last stream has ++ * called through here. ++ */ ++ if (!start_pipeline) ++ return 0; ++ + spin_lock_irqsave(&pipe->irqlock, flags); + if (vsp1_pipeline_ready(pipe)) + vsp1_video_pipeline_run(pipe); diff --git a/queue-4.9/v4l-vsp1-register-pipe-with-output-wpf.patch b/queue-4.9/v4l-vsp1-register-pipe-with-output-wpf.patch new file mode 100644 index 00000000000..69ff0f42c38 --- /dev/null +++ b/queue-4.9/v4l-vsp1-register-pipe-with-output-wpf.patch @@ -0,0 +1,40 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Kieran Bingham +Date: Mon, 27 Feb 2017 10:40:34 -0300 +Subject: [media] v4l: vsp1: Register pipe with output WPF + +From: Kieran Bingham + + +[ Upstream commit 1531a208ed861e4bd287444f9466ffcf98383de2 ] + +The DRM object does not register the pipe with the WPF object. This is +used internally throughout the driver as a means of accessing the pipe. +As such this breaks operations which require access to the pipe from WPF +interrupts. + +Register the pipe inside the WPF object after it has been declared as +the output. + +Fixes: ff7e97c94d9f ("[media] v4l: vsp1: Store pipeline pointer in rwpf") + +Signed-off-by: Kieran Bingham +Reviewed-by: Laurent Pinchart +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/vsp1/vsp1_drm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/platform/vsp1/vsp1_drm.c ++++ b/drivers/media/platform/vsp1/vsp1_drm.c +@@ -596,6 +596,7 @@ int vsp1_drm_init(struct vsp1_device *vs + pipe->bru = &vsp1->bru->entity; + pipe->lif = &vsp1->lif->entity; + pipe->output = vsp1->wpf[0]; ++ pipe->output->pipe = pipe; + + return 0; + } diff --git a/queue-4.9/veth-set-peer-gso-values.patch b/queue-4.9/veth-set-peer-gso-values.patch new file mode 100644 index 00000000000..e551fe6aadf --- /dev/null +++ b/queue-4.9/veth-set-peer-gso-values.patch @@ -0,0 +1,39 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Stephen Hemminger +Date: Thu, 7 Dec 2017 15:40:20 -0800 +Subject: veth: set peer GSO values + +From: Stephen Hemminger + + +[ Upstream commit 72d24955b44a4039db54a1c252b5031969eeaac3 ] + +When new veth is created, and GSO values have been configured +on one device, clone those values to the peer. + +For example: + # ip link add dev vm1 gso_max_size 65530 type veth peer name vm2 + +This should create vm1 <--> vm2 with both having GSO maximum +size set to 65530. + +Signed-off-by: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/veth.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -425,6 +425,9 @@ static int veth_newlink(struct net *src_ + if (ifmp && (dev->ifindex != 0)) + peer->ifindex = ifmp->ifi_index; + ++ peer->gso_max_size = dev->gso_max_size; ++ peer->gso_max_segs = dev->gso_max_segs; ++ + err = register_netdevice(peer); + put_net(net); + net = NULL; diff --git a/queue-4.9/vfio-powerpc-spapr_tce-enforce-iommu-type-compatibility-check.patch b/queue-4.9/vfio-powerpc-spapr_tce-enforce-iommu-type-compatibility-check.patch new file mode 100644 index 00000000000..fd97d1cbd71 --- /dev/null +++ b/queue-4.9/vfio-powerpc-spapr_tce-enforce-iommu-type-compatibility-check.patch @@ -0,0 +1,54 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Alexey Kardashevskiy +Date: Fri, 24 Mar 2017 17:44:06 +1100 +Subject: vfio/powerpc/spapr_tce: Enforce IOMMU type compatibility check + +From: Alexey Kardashevskiy + + +[ Upstream commit 1282ba7fc28dbc66c3f0e4aaafaaa228361d1ae5 ] + +The existing SPAPR TCE driver advertises both VFIO_SPAPR_TCE_IOMMU and +VFIO_SPAPR_TCE_v2_IOMMU types to the userspace and the userspace usually +picks the v2. + +Normally the userspace would create a container, attach an IOMMU group +to it and only then set the IOMMU type (which would normally be v2). + +However a specific IOMMU group may not support v2, in other words +it may not implement set_window/unset_window/take_ownership/ +release_ownership and such a group should not be attached to +a v2 container. + +This adds extra checks that a new group can do what the selected IOMMU +type suggests. The userspace can then test the return value from +ioctl(VFIO_SET_IOMMU, VFIO_SPAPR_TCE_v2_IOMMU) and try +VFIO_SPAPR_TCE_IOMMU. + +Signed-off-by: Alexey Kardashevskiy +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/vfio/vfio_iommu_spapr_tce.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/vfio/vfio_iommu_spapr_tce.c ++++ b/drivers/vfio/vfio_iommu_spapr_tce.c +@@ -1332,8 +1332,16 @@ static int tce_iommu_attach_group(void * + + if (!table_group->ops || !table_group->ops->take_ownership || + !table_group->ops->release_ownership) { ++ if (container->v2) { ++ ret = -EPERM; ++ goto unlock_exit; ++ } + ret = tce_iommu_take_ownership(container, table_group); + } else { ++ if (!container->v2) { ++ ret = -EPERM; ++ goto unlock_exit; ++ } + ret = tce_iommu_take_ownership_ddw(container, table_group); + if (!tce_groups_attached(container) && !container->tables[0]) + container->def_window_pending = true; diff --git a/queue-4.9/vfio-spapr_tce-check-kzalloc-return-when-preregistering-memory.patch b/queue-4.9/vfio-spapr_tce-check-kzalloc-return-when-preregistering-memory.patch new file mode 100644 index 00000000000..9d25396b67d --- /dev/null +++ b/queue-4.9/vfio-spapr_tce-check-kzalloc-return-when-preregistering-memory.patch @@ -0,0 +1,36 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Alexey Kardashevskiy +Date: Mon, 27 Mar 2017 14:23:40 +1100 +Subject: vfio/spapr_tce: Check kzalloc() return when preregistering memory + +From: Alexey Kardashevskiy + + +[ Upstream commit 3393af24b665cb0aea7353b05e522b03ab1e7d73 ] + +This adds missing checking for kzalloc() return value. + +Fixes: 4b6fad7097f8 ("powerpc/mm/iommu, vfio/spapr: Put pages on VFIO container shutdown") +Signed-off-by: Alexey Kardashevskiy +Reviewed-by: David Gibson +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/vfio/vfio_iommu_spapr_tce.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/vfio/vfio_iommu_spapr_tce.c ++++ b/drivers/vfio/vfio_iommu_spapr_tce.c +@@ -195,6 +195,11 @@ static long tce_iommu_register_pages(str + return ret; + + tcemem = kzalloc(sizeof(*tcemem), GFP_KERNEL); ++ if (!tcemem) { ++ mm_iommu_put(container->mm, mem); ++ return -ENOMEM; ++ } ++ + tcemem->mem = mem; + list_add(&tcemem->next, &container->prereg_list); + diff --git a/queue-4.9/video-arm-clcd-fix-dma-allocation-size.patch b/queue-4.9/video-arm-clcd-fix-dma-allocation-size.patch new file mode 100644 index 00000000000..594fb84daab --- /dev/null +++ b/queue-4.9/video-arm-clcd-fix-dma-allocation-size.patch @@ -0,0 +1,46 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Liam Beguin +Date: Fri, 7 Apr 2017 17:03:24 +0200 +Subject: video: ARM CLCD: fix dma allocation size + +From: Liam Beguin + + +[ Upstream commit 9a1c779e6b06855e41099caa6f15b3b584dfa88c ] + +This patch forces the frambuffer size to be aligned on kernel pages. + +During the board startup, the splash screed did appear; +the "ts_test" program or our application were not able to start. + +The following error message was reported: +error: failed to map framebuffer device to memory. +LinuxFB: driver cannot connect + +The issue was discovered, on the LPC32xx platform, during the migration +of the LCD definition from the board file to the device tree. + +Signed-off-by: Liam Beguin +Signed-off-by: Sylvain Lemieux +Cc: Vladimir Zapolskiy +Cc: Russell King +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/amba-clcd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/video/fbdev/amba-clcd.c ++++ b/drivers/video/fbdev/amba-clcd.c +@@ -892,8 +892,8 @@ static int clcdfb_of_dma_setup(struct cl + if (err) + return err; + +- framesize = fb->panel->mode.xres * fb->panel->mode.yres * +- fb->panel->bpp / 8; ++ framesize = PAGE_ALIGN(fb->panel->mode.xres * fb->panel->mode.yres * ++ fb->panel->bpp / 8); + fb->fb.screen_base = dma_alloc_coherent(&fb->dev->dev, framesize, + &dma, GFP_KERNEL); + if (!fb->fb.screen_base) diff --git a/queue-4.9/video-hdmi-allow-empty-hdmi-infoframes.patch b/queue-4.9/video-hdmi-allow-empty-hdmi-infoframes.patch new file mode 100644 index 00000000000..79c7ee227d2 --- /dev/null +++ b/queue-4.9/video-hdmi-allow-empty-hdmi-infoframes.patch @@ -0,0 +1,135 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: "Ville Syrjälä" +Date: Mon, 13 Nov 2017 19:04:18 +0200 +Subject: video/hdmi: Allow "empty" HDMI infoframes + +From: "Ville Syrjälä" + + +[ Upstream commit 593f4b19a094c4426bd1e1e3cbab87a48bd13c71 ] + +HDMI 2.0 Appendix F suggest that we should keep sending the infoframe +when switching from 3D to 2D mode, even if the infoframe isn't strictly +necessary (ie. not needed to transmit the VIC or stereo information). +This is a workaround against some sinks that fail to realize that they +should switch from 3D to 2D mode when the source stop transmitting +the infoframe. + +v2: Handle unpack() as well + Pull the length calculation into a helper + +Cc: Shashank Sharma +Cc: Andrzej Hajda +Cc: Thierry Reding +Cc: Hans Verkuil +Cc: linux-media@vger.kernel.org +Reviewed-by: Andrzej Hajda #v1 +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20171113170427.4150-2-ville.syrjala@linux.intel.com +Reviewed-by: Shashank Sharma +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/hdmi.c | 51 +++++++++++++++++++++++++++++++-------------------- + 1 file changed, 31 insertions(+), 20 deletions(-) + +--- a/drivers/video/hdmi.c ++++ b/drivers/video/hdmi.c +@@ -321,6 +321,17 @@ int hdmi_vendor_infoframe_init(struct hd + } + EXPORT_SYMBOL(hdmi_vendor_infoframe_init); + ++static int hdmi_vendor_infoframe_length(const struct hdmi_vendor_infoframe *frame) ++{ ++ /* for side by side (half) we also need to provide 3D_Ext_Data */ ++ if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) ++ return 6; ++ else if (frame->vic != 0 || frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID) ++ return 5; ++ else ++ return 4; ++} ++ + /** + * hdmi_vendor_infoframe_pack() - write a HDMI vendor infoframe to binary buffer + * @frame: HDMI infoframe +@@ -341,19 +352,11 @@ ssize_t hdmi_vendor_infoframe_pack(struc + u8 *ptr = buffer; + size_t length; + +- /* empty info frame */ +- if (frame->vic == 0 && frame->s3d_struct == HDMI_3D_STRUCTURE_INVALID) +- return -EINVAL; +- + /* only one of those can be supplied */ + if (frame->vic != 0 && frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID) + return -EINVAL; + +- /* for side by side (half) we also need to provide 3D_Ext_Data */ +- if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) +- frame->length = 6; +- else +- frame->length = 5; ++ frame->length = hdmi_vendor_infoframe_length(frame); + + length = HDMI_INFOFRAME_HEADER_SIZE + frame->length; + +@@ -372,14 +375,16 @@ ssize_t hdmi_vendor_infoframe_pack(struc + ptr[5] = 0x0c; + ptr[6] = 0x00; + +- if (frame->vic) { +- ptr[7] = 0x1 << 5; /* video format */ +- ptr[8] = frame->vic; +- } else { ++ if (frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID) { + ptr[7] = 0x2 << 5; /* video format */ + ptr[8] = (frame->s3d_struct & 0xf) << 4; + if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) + ptr[9] = (frame->s3d_ext_data & 0xf) << 4; ++ } else if (frame->vic) { ++ ptr[7] = 0x1 << 5; /* video format */ ++ ptr[8] = frame->vic; ++ } else { ++ ptr[7] = 0x0 << 5; /* video format */ + } + + hdmi_infoframe_set_checksum(buffer, length); +@@ -1161,7 +1166,7 @@ hdmi_vendor_any_infoframe_unpack(union h + + if (ptr[0] != HDMI_INFOFRAME_TYPE_VENDOR || + ptr[1] != 1 || +- (ptr[2] != 5 && ptr[2] != 6)) ++ (ptr[2] != 4 && ptr[2] != 5 && ptr[2] != 6)) + return -EINVAL; + + length = ptr[2]; +@@ -1189,16 +1194,22 @@ hdmi_vendor_any_infoframe_unpack(union h + + hvf->length = length; + +- if (hdmi_video_format == 0x1) { +- hvf->vic = ptr[4]; +- } else if (hdmi_video_format == 0x2) { ++ if (hdmi_video_format == 0x2) { ++ if (length != 5 && length != 6) ++ return -EINVAL; + hvf->s3d_struct = ptr[4] >> 4; + if (hvf->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) { +- if (length == 6) +- hvf->s3d_ext_data = ptr[5] >> 4; +- else ++ if (length != 6) + return -EINVAL; ++ hvf->s3d_ext_data = ptr[5] >> 4; + } ++ } else if (hdmi_video_format == 0x1) { ++ if (length != 5) ++ return -EINVAL; ++ hvf->vic = ptr[4]; ++ } else { ++ if (length != 4) ++ return -EINVAL; + } + + return 0; diff --git a/queue-4.9/vxlan-vxlan-dev-should-inherit-lowerdev-s-gso_max_size.patch b/queue-4.9/vxlan-vxlan-dev-should-inherit-lowerdev-s-gso_max_size.patch new file mode 100644 index 00000000000..1ecf3887a66 --- /dev/null +++ b/queue-4.9/vxlan-vxlan-dev-should-inherit-lowerdev-s-gso_max_size.patch @@ -0,0 +1,47 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Felix Manlunas +Date: Wed, 29 Mar 2017 17:56:43 -0700 +Subject: vxlan: vxlan dev should inherit lowerdev's gso_max_size + +From: Felix Manlunas + + +[ Upstream commit d6acfeb17d030bb3907e77c048b0e7783ad8e5a9 ] + +vxlan dev currently ignores lowerdev's gso_max_size, which adversely +affects TSO performance of liquidio if it's the lowerdev. Egress TCP +packets' skb->len often exceed liquidio's advertised gso_max_size. This +may happen on other NIC drivers. + +Fix it by assigning lowerdev's gso_max_size to that of vxlan dev. Might as +well do likewise for gso_max_segs. + +Single flow TSO throughput of liquidio as lowerdev (using iperf3): + + Before the patch: 139 Mbps + After the patch : 8.68 Gbps + Percent increase: 6,144 % + +Signed-off-by: Felix Manlunas +Signed-off-by: Satanand Burla +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/vxlan.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -2912,6 +2912,11 @@ static int vxlan_dev_configure(struct ne + return -EINVAL; + } + ++ if (lowerdev) { ++ dev->gso_max_size = lowerdev->gso_max_size; ++ dev->gso_max_segs = lowerdev->gso_max_segs; ++ } ++ + if (conf->mtu) { + err = __vxlan_change_mtu(dev, lowerdev, dst, conf->mtu, false); + if (err) diff --git a/queue-4.9/wil6210-fix-memory-access-violation-in-wil_memcpy_from-toio_32.patch b/queue-4.9/wil6210-fix-memory-access-violation-in-wil_memcpy_from-toio_32.patch new file mode 100644 index 00000000000..8b30fdc2bb1 --- /dev/null +++ b/queue-4.9/wil6210-fix-memory-access-violation-in-wil_memcpy_from-toio_32.patch @@ -0,0 +1,64 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Dedy Lansky +Date: Wed, 5 Apr 2017 14:58:11 +0300 +Subject: wil6210: fix memory access violation in wil_memcpy_from/toio_32 + +From: Dedy Lansky + + +[ Upstream commit 0f6edfe2bbbb59d161580cb4870fcc46f5490f85 ] + +In case count is not multiple of 4, there is a read access in +wil_memcpy_toio_32() from outside src buffer boundary. +In wil_memcpy_fromio_32(), in case count is not multiple of 4, there is +a write access to outside dst io memory boundary. + +Fix these issues with proper handling of the last 1 to 4 copied bytes. + +Signed-off-by: Dedy Lansky +Signed-off-by: Maya Erez +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/wil6210/main.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/ath/wil6210/main.c ++++ b/drivers/net/wireless/ath/wil6210/main.c +@@ -129,9 +129,15 @@ void wil_memcpy_fromio_32(void *dst, con + u32 *d = dst; + const volatile u32 __iomem *s = src; + +- /* size_t is unsigned, if (count%4 != 0) it will wrap */ +- for (count += 4; count > 4; count -= 4) ++ for (; count >= 4; count -= 4) + *d++ = __raw_readl(s++); ++ ++ if (unlikely(count)) { ++ /* count can be 1..3 */ ++ u32 tmp = __raw_readl(s); ++ ++ memcpy(d, &tmp, count); ++ } + } + + void wil_memcpy_fromio_halp_vote(struct wil6210_priv *wil, void *dst, +@@ -148,8 +154,16 @@ void wil_memcpy_toio_32(volatile void __ + volatile u32 __iomem *d = dst; + const u32 *s = src; + +- for (count += 4; count > 4; count -= 4) ++ for (; count >= 4; count -= 4) + __raw_writel(*s++, d++); ++ ++ if (unlikely(count)) { ++ /* count can be 1..3 */ ++ u32 tmp = 0; ++ ++ memcpy(&tmp, s, count); ++ __raw_writel(tmp, d); ++ } + } + + void wil_memcpy_toio_halp_vote(struct wil6210_priv *wil, diff --git a/queue-4.9/wil6210-fix-protection-against-connections-during-reset.patch b/queue-4.9/wil6210-fix-protection-against-connections-during-reset.patch new file mode 100644 index 00000000000..2f408aaac29 --- /dev/null +++ b/queue-4.9/wil6210-fix-protection-against-connections-during-reset.patch @@ -0,0 +1,61 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Hamad Kadmany +Date: Wed, 5 Apr 2017 14:58:08 +0300 +Subject: wil6210: fix protection against connections during reset + +From: Hamad Kadmany + + +[ Upstream commit b819447dfc4bd120c9d6cd8521252d544fce8fe7 ] + +Existing code that ignores connection events during +reset flow will never take effect since it locks the +same mutex taken by the reset flow. + +In addition, in case of unsolicited disconnect events ignore +those as well since device is about to get reset. + +Signed-off-by: Hamad Kadmany +Signed-off-by: Maya Erez +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/wil6210/wmi.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/ath/wil6210/wmi.c ++++ b/drivers/net/wireless/ath/wil6210/wmi.c +@@ -501,16 +501,16 @@ static void wmi_evt_connect(struct wil62 + assoc_resp_ielen = 0; + } + +- mutex_lock(&wil->mutex); + if (test_bit(wil_status_resetting, wil->status) || + !test_bit(wil_status_fwready, wil->status)) { + wil_err(wil, "status_resetting, cancel connect event, CID %d\n", + evt->cid); +- mutex_unlock(&wil->mutex); + /* no need for cleanup, wil_reset will do that */ + return; + } + ++ mutex_lock(&wil->mutex); ++ + if ((wdev->iftype == NL80211_IFTYPE_STATION) || + (wdev->iftype == NL80211_IFTYPE_P2P_CLIENT)) { + if (!test_bit(wil_status_fwconnecting, wil->status)) { +@@ -608,6 +608,13 @@ static void wmi_evt_disconnect(struct wi + + wil->sinfo_gen++; + ++ if (test_bit(wil_status_resetting, wil->status) || ++ !test_bit(wil_status_fwready, wil->status)) { ++ wil_err(wil, "status_resetting, cancel disconnect event\n"); ++ /* no need for cleanup, wil_reset will do that */ ++ return; ++ } ++ + mutex_lock(&wil->mutex); + wil6210_disconnect(wil, evt->bssid, reason_code, true); + mutex_unlock(&wil->mutex); diff --git a/queue-4.9/x86-boot-32-defer-resyncing-initial_page_table-until-per-cpu-is-set-up.patch b/queue-4.9/x86-boot-32-defer-resyncing-initial_page_table-until-per-cpu-is-set-up.patch new file mode 100644 index 00000000000..9b45b297c8c --- /dev/null +++ b/queue-4.9/x86-boot-32-defer-resyncing-initial_page_table-until-per-cpu-is-set-up.patch @@ -0,0 +1,96 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Andy Lutomirski +Date: Wed, 22 Mar 2017 14:32:32 -0700 +Subject: x86/boot/32: Defer resyncing initial_page_table until per-cpu is set up + +From: Andy Lutomirski + + +[ Upstream commit 23b2a4ddebdd17fad265b4bb77256c2e4ec37dee ] + +The x86 smpboot trampoline expects initial_page_table to have the +GDT mapped. If the GDT ends up in a virtually mapped per-cpu page, +then it won't be in the page tables at all until perc-pu areas are +set up. The result will be a triple fault the first time that the +CPU attempts to access the GDT after LGDT loads the perc-pu GDT. + +This appears to be an old bug, but somehow the GDT fixmap rework +is triggering it. This seems to have something to do with the +memory layout. + +Signed-off-by: Andy Lutomirski +Cc: Ard Biesheuvel +Cc: Boris Ostrovsky +Cc: Borislav Petkov +Cc: Brian Gerst +Cc: Denys Vlasenko +Cc: H. Peter Anvin +Cc: Josh Poimboeuf +Cc: Juergen Gross +Cc: Linus Torvalds +Cc: Matt Fleming +Cc: Peter Zijlstra +Cc: Thomas Garnier +Cc: Thomas Gleixner +Cc: linux-efi@vger.kernel.org +Link: http://lkml.kernel.org/r/a553264a5972c6a86f9b5caac237470a0c74a720.1490218061.git.luto@kernel.org +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/setup.c | 15 --------------- + arch/x86/kernel/setup_percpu.c | 21 +++++++++++++++++++++ + 2 files changed, 21 insertions(+), 15 deletions(-) + +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -1200,21 +1200,6 @@ void __init setup_arch(char **cmdline_p) + + kasan_init(); + +-#ifdef CONFIG_X86_32 +- /* sync back kernel address range */ +- clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY, +- swapper_pg_dir + KERNEL_PGD_BOUNDARY, +- KERNEL_PGD_PTRS); +- +- /* +- * sync back low identity map too. It is used for example +- * in the 32-bit EFI stub. +- */ +- clone_pgd_range(initial_page_table, +- swapper_pg_dir + KERNEL_PGD_BOUNDARY, +- min(KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY)); +-#endif +- + tboot_probe(); + + map_vsyscall(); +--- a/arch/x86/kernel/setup_percpu.c ++++ b/arch/x86/kernel/setup_percpu.c +@@ -287,4 +287,25 @@ void __init setup_per_cpu_areas(void) + + /* Setup cpu initialized, callin, callout masks */ + setup_cpu_local_masks(); ++ ++#ifdef CONFIG_X86_32 ++ /* ++ * Sync back kernel address range. We want to make sure that ++ * all kernel mappings, including percpu mappings, are available ++ * in the smpboot asm. We can't reliably pick up percpu ++ * mappings using vmalloc_fault(), because exception dispatch ++ * needs percpu data. ++ */ ++ clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY, ++ swapper_pg_dir + KERNEL_PGD_BOUNDARY, ++ KERNEL_PGD_PTRS); ++ ++ /* ++ * sync back low identity map too. It is used for example ++ * in the 32-bit EFI stub. ++ */ ++ clone_pgd_range(initial_page_table, ++ swapper_pg_dir + KERNEL_PGD_BOUNDARY, ++ min(KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY)); ++#endif + } diff --git a/queue-4.9/x86-mce-handle-broadcasted-mce-gracefully-with-kexec.patch b/queue-4.9/x86-mce-handle-broadcasted-mce-gracefully-with-kexec.patch new file mode 100644 index 00000000000..6fcb6c10766 --- /dev/null +++ b/queue-4.9/x86-mce-handle-broadcasted-mce-gracefully-with-kexec.patch @@ -0,0 +1,100 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Xunlei Pang +Date: Mon, 13 Mar 2017 10:50:19 +0100 +Subject: x86/mce: Handle broadcasted MCE gracefully with kexec + +From: Xunlei Pang + + +[ Upstream commit 5bc329503e8191c91c4c40836f062ef771d8ba83 ] + +When we are about to kexec a crash kernel and right then and there a +broadcasted MCE fires while we're still in the first kernel and while +the other CPUs remain in a holding pattern, the #MC handler of the +first kernel will timeout and then panic due to never completing MCE +synchronization. + +Handle this in a similar way as to when the CPUs are offlined when that +broadcasted MCE happens. + +[ Boris: rewrote commit message and comments. ] + +Suggested-by: Borislav Petkov +Signed-off-by: Xunlei Pang +Signed-off-by: Borislav Petkov +Acked-by: Tony Luck +Cc: Naoya Horiguchi +Cc: kexec@lists.infradead.org +Cc: linux-edac +Link: http://lkml.kernel.org/r/1487857012-9059-1-git-send-email-xlpang@redhat.com +Link: http://lkml.kernel.org/r/20170313095019.19351-1-bp@alien8.de +Signed-off-by: Thomas Gleixner +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/include/asm/reboot.h | 1 + + arch/x86/kernel/cpu/mcheck/mce.c | 18 ++++++++++++++++-- + arch/x86/kernel/reboot.c | 5 +++-- + 3 files changed, 20 insertions(+), 4 deletions(-) + +--- a/arch/x86/include/asm/reboot.h ++++ b/arch/x86/include/asm/reboot.h +@@ -15,6 +15,7 @@ struct machine_ops { + }; + + extern struct machine_ops machine_ops; ++extern int crashing_cpu; + + void native_machine_crash_shutdown(struct pt_regs *regs); + void native_machine_shutdown(void); +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -48,6 +48,7 @@ + #include + #include + #include ++#include + + #include "mce-internal.h" + +@@ -1081,9 +1082,22 @@ void do_machine_check(struct pt_regs *re + * on Intel. + */ + int lmce = 1; ++ int cpu = smp_processor_id(); + +- /* If this CPU is offline, just bail out. */ +- if (cpu_is_offline(smp_processor_id())) { ++ /* ++ * Cases where we avoid rendezvous handler timeout: ++ * 1) If this CPU is offline. ++ * ++ * 2) If crashing_cpu was set, e.g. we're entering kdump and we need to ++ * skip those CPUs which remain looping in the 1st kernel - see ++ * crash_nmi_callback(). ++ * ++ * Note: there still is a small window between kexec-ing and the new, ++ * kdump kernel establishing a new #MC handler where a broadcasted MCE ++ * might not get handled properly. ++ */ ++ if (cpu_is_offline(cpu) || ++ (crashing_cpu != -1 && crashing_cpu != cpu)) { + u64 mcgstatus; + + mcgstatus = mce_rdmsrl(MSR_IA32_MCG_STATUS); +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -769,10 +769,11 @@ void machine_crash_shutdown(struct pt_re + #endif + + ++/* This is the CPU performing the emergency shutdown work. */ ++int crashing_cpu = -1; ++ + #if defined(CONFIG_SMP) + +-/* This keeps a track of which one is crashing cpu. */ +-static int crashing_cpu; + static nmi_shootdown_cb shootdown_callback; + + static atomic_t waiting_for_crash_ipi; diff --git a/queue-4.9/x86-mce-init-some-cpu-features-early.patch b/queue-4.9/x86-mce-init-some-cpu-features-early.patch new file mode 100644 index 00000000000..31687dc7e14 --- /dev/null +++ b/queue-4.9/x86-mce-init-some-cpu-features-early.patch @@ -0,0 +1,95 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Yazen Ghannam +Date: Wed, 15 Mar 2017 12:30:55 -0500 +Subject: x86/mce: Init some CPU features early + +From: Yazen Ghannam + + +[ Upstream commit 5204bf17031b69fa5faa4dc80a9dc1e2446d74f9 ] + +When the MCA banks in __mcheck_cpu_init_generic() are polled for leftover +errors logged during boot or from the previous boot, its required to have +CPU features detected sufficiently so that the reading out and handling of +those early errors is done correctly. + +If those features are not available, the decoding may miss some information +and get incomplete errors logged. For example, on SMCA systems the MCA_IPID +and MCA_SYND registers are not logged and MCA_ADDR is not masked +appropriately. + +To cure that, do a subset of the basic feature detection early while the +rest happens in its usual place in __mcheck_cpu_init_vendor(). + +Signed-off-by: Yazen Ghannam +Cc: Tony Luck +Cc: linux-edac +Cc: x86-ml +Link: http://lkml.kernel.org/r/1489599055-20756-1-git-send-email-Yazen.Ghannam@amd.com +[ Massage commit message and simplify. ] +Signed-off-by: Borislav Petkov +Signed-off-by: Thomas Gleixner +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/cpu/mcheck/mce.c | 30 ++++++++++++++++++------------ + 1 file changed, 18 insertions(+), 12 deletions(-) + +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -1695,30 +1695,35 @@ static int __mcheck_cpu_ancient_init(str + return 0; + } + +-static void __mcheck_cpu_init_vendor(struct cpuinfo_x86 *c) ++/* ++ * Init basic CPU features needed for early decoding of MCEs. ++ */ ++static void __mcheck_cpu_init_early(struct cpuinfo_x86 *c) + { +- switch (c->x86_vendor) { +- case X86_VENDOR_INTEL: +- mce_intel_feature_init(c); +- mce_adjust_timer = cmci_intel_adjust_timer; +- break; +- +- case X86_VENDOR_AMD: { ++ if (c->x86_vendor == X86_VENDOR_AMD) { + mce_flags.overflow_recov = !!cpu_has(c, X86_FEATURE_OVERFLOW_RECOV); + mce_flags.succor = !!cpu_has(c, X86_FEATURE_SUCCOR); + mce_flags.smca = !!cpu_has(c, X86_FEATURE_SMCA); + +- /* +- * Install proper ops for Scalable MCA enabled processors +- */ + if (mce_flags.smca) { + msr_ops.ctl = smca_ctl_reg; + msr_ops.status = smca_status_reg; + msr_ops.addr = smca_addr_reg; + msr_ops.misc = smca_misc_reg; + } +- mce_amd_feature_init(c); ++ } ++} + ++static void __mcheck_cpu_init_vendor(struct cpuinfo_x86 *c) ++{ ++ switch (c->x86_vendor) { ++ case X86_VENDOR_INTEL: ++ mce_intel_feature_init(c); ++ mce_adjust_timer = cmci_intel_adjust_timer; ++ break; ++ ++ case X86_VENDOR_AMD: { ++ mce_amd_feature_init(c); + break; + } + +@@ -1804,6 +1809,7 @@ void mcheck_cpu_init(struct cpuinfo_x86 + + machine_check_vector = do_machine_check; + ++ __mcheck_cpu_init_early(c); + __mcheck_cpu_init_generic(); + __mcheck_cpu_init_vendor(c); + __mcheck_cpu_init_clear_banks(); diff --git a/queue-4.9/x86-mm-make-mmap-map_32bit-work-correctly.patch b/queue-4.9/x86-mm-make-mmap-map_32bit-work-correctly.patch new file mode 100644 index 00000000000..b5cf3bae6e0 --- /dev/null +++ b/queue-4.9/x86-mm-make-mmap-map_32bit-work-correctly.patch @@ -0,0 +1,64 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Dmitry Safonov +Date: Mon, 6 Mar 2017 17:17:20 +0300 +Subject: x86/mm: Make mmap(MAP_32BIT) work correctly + +From: Dmitry Safonov + + +[ Upstream commit 3e6ef9c80946f781fc25e8490c9875b1d2b61158 ] + +mmap(MAP_32BIT) is broken due to the dependency on the TIF_ADDR32 thread +flag. + +For 64bit applications MAP_32BIT will force legacy bottom-up allocations and +the 1GB address space restriction even if the application issued a compat +syscall, which should not be subject of these restrictions. + +For 32bit applications, which issue 64bit syscalls the newly introduced +mmap base separation into 64-bit and compat bases changed the behaviour +because now a 64-bit mapping is returned, but due to the TIF_ADDR32 +dependency MAP_32BIT is ignored. Before the separation a 32-bit mapping was +returned, so the MAP_32BIT handling was irrelevant. + +Replace the check for TIF_ADDR32 with a check for the compat syscall. That +solves both the 64-bit issuing a compat syscall and the 32-bit issuing a +64-bit syscall problems. + +[ tglx: Massaged changelog ] + +Signed-off-by: Dmitry Safonov +Cc: 0x7f454c46@gmail.com +Cc: linux-mm@kvack.org +Cc: Andy Lutomirski +Cc: Cyrill Gorcunov +Cc: Borislav Petkov +Cc: "Kirill A. Shutemov" +Link: http://lkml.kernel.org/r/20170306141721.9188-5-dsafonov@virtuozzo.com +Signed-off-by: Thomas Gleixner +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/sys_x86_64.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/sys_x86_64.c ++++ b/arch/x86/kernel/sys_x86_64.c +@@ -100,7 +100,7 @@ out: + static void find_start_end(unsigned long flags, unsigned long *begin, + unsigned long *end) + { +- if (!test_thread_flag(TIF_ADDR32) && (flags & MAP_32BIT)) { ++ if (!in_compat_syscall() && (flags & MAP_32BIT)) { + /* This is usually used needed to map code in small + model, so it needs to be in the first 31bit. Limit + it to that. This means we need to move the +@@ -175,7 +175,7 @@ arch_get_unmapped_area_topdown(struct fi + return addr; + + /* for MAP_32BIT mappings we force the legacy mmap base */ +- if (!test_thread_flag(TIF_ADDR32) && (flags & MAP_32BIT)) ++ if (!in_compat_syscall() && (flags & MAP_32BIT)) + goto bottomup; + + /* requesting a specific address */ diff --git a/queue-4.9/zd1211rw-fix-null-deref-at-probe.patch b/queue-4.9/zd1211rw-fix-null-deref-at-probe.patch new file mode 100644 index 00000000000..a9140faf63c --- /dev/null +++ b/queue-4.9/zd1211rw-fix-null-deref-at-probe.patch @@ -0,0 +1,36 @@ +From foo@baz Sun Mar 18 16:55:33 CET 2018 +From: Johan Hovold +Date: Mon, 13 Mar 2017 13:44:21 +0100 +Subject: zd1211rw: fix NULL-deref at probe + +From: Johan Hovold + + +[ Upstream commit ca260ece6a57dc7d751e0685f51fa2c55d851873 ] + +Make sure to check the number of endpoints to avoid dereferencing a +NULL-pointer or accessing memory beyond the endpoint array should a +malicious device lack the expected endpoints. + +Fixes: a1030e92c150 ("[PATCH] zd1211rw: Convert installer CDROM device into WLAN device") +Cc: Daniel Drake +Signed-off-by: Johan Hovold +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/zydas/zd1211rw/zd_usb.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/wireless/zydas/zd1211rw/zd_usb.c ++++ b/drivers/net/wireless/zydas/zd1211rw/zd_usb.c +@@ -1278,6 +1278,9 @@ static int eject_installer(struct usb_in + u8 bulk_out_ep; + int r; + ++ if (iface_desc->desc.bNumEndpoints < 2) ++ return -ENODEV; ++ + /* Find bulk out endpoint */ + for (r = 1; r >= 0; r--) { + endpoint = &iface_desc->endpoint[r].desc;