From: Greg Kroah-Hartman Date: Sun, 13 Aug 2017 22:18:45 +0000 (-0700) Subject: 4.12-stable patches X-Git-Tag: v3.18.66~11 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d0e70e04261c54d3164cf1614d478daa3761a6a0;p=thirdparty%2Fkernel%2Fstable-queue.git 4.12-stable patches added patches: block-make-blk_mq_delay_kick_requeue_list-rerun-the-queue-at-a-quiet-time.patch drm-bridge-tc358767-fix-probe-without-attached-output-node.patch drm-etnaviv-fix-off-by-one-error-in-reloc-checking.patch drm-i915-fix-out-of-bounds-array-access-in-bdw_load_gamma_lut.patch firmware-avoid-invalid-fallback-aborts-by-using-killable-wait.patch firmware-fix-batched-requests-send-wake-up-on-failure-on-direct-lookups.patch firmware-fix-batched-requests-wake-all-waiters.patch fuse-initialize-the-flock-flag-in-fuse_file-on-allocation.patch i2c-designware-some-broken-dstds-use-1mihz-instead-of-1mhz.patch iio-accel-bmc150-always-restore-device-to-normal-mode-after-suspend-resume.patch iio-accel-st_accel-add-spi-3wire-support.patch iio-adc-revert-axp288-drop-bogus-axp288_adc_ts_pin_ctrl-register-modifications.patch iio-aspeed-adc-wait-for-initial-sequence.patch iio-light-tsl2563-use-correct-event-code.patch iio-pressure-st_pressure_core-disable-multiread-by-default-for-lps22hb.patch iscsi-target-fix-iscsi_np-reset-hung-task-during-parallel-delete.patch iscsi-target-fix-memory-leak-in-iscsit_setup_text_cmd.patch mmc-mmc-correct-the-logic-for-setting-hs400es-signal-voltage.patch mtd-nand-atmel-fix-dt-backward-compatibility-in-pmecc.c.patch mtd-nand-declare-tbers-tr-and-tprog-as-u64-to-avoid-integer-overflow.patch mtd-nand-fix-timing-setup-for-nands-that-do-not-support-set-features.patch nand-fix-wrong-default-oob-layout-for-small-pages-using-soft-ecc.patch nfs-flexfiles-fix-leak-of-nfs4_ff_ds_version-arrays.patch pinctrl-armada-37xx-fix-number-of-pin-in-south-bridge.patch staging-comedi-comedi_fops-do-not-call-blocking-ops-when-task_running.patch staging-iio-resolver-ad2s1210-fix-negative-iio_angl_vel-read.patch target-fix-node_acl-demo-mode-uncached-dynamic-shutdown-regression.patch uas-add-us_fl_ignore_residue-for-initio-corporation-inic-3069.patch usb-check-for-dropped-connection-before-switching-to-full-speed.patch usb-core-unlink-urbs-from-the-tail-of-the-endpoint-s-urb_list.patch usb-gadget-udc-renesas_usb3-fix-usb_gadget_giveback_request-calling.patch usb-hcd-mark-secondary-hcd-as-dead-if-the-primary-one-died.patch usb-musb-fix-tx-fifo-flush-handling-again.patch usb-quirks-add-no-lpm-quirk-for-moshi-usb-to-ethernet-adapter.patch usb-renesas_usbhs-fix-ugctrl2-value-for-r-car-gen3.patch usb-serial-cp210x-add-support-for-qivicon-usb-zigbee-dongle.patch usb-serial-option-add-d-link-dwm-222-device-id.patch usb-serial-pl2303-add-new-aten-device-id.patch usb-storage-fix-deadlock-involving-host-lock-and-scsi_done.patch usb-xhci-add-quirk-for-certain-failing-hp-keyboard-on-reset-after-resume.patch xfs-fix-leak-of-discard-bio.patch xtensa-don-t-limit-csum_partial-export-by-config_net.patch xtensa-fix-cache-aliasing-handling-code-for-wt-cache.patch xtensa-mm-cache-add-missing-export_symbols.patch --- diff --git a/queue-4.12/block-make-blk_mq_delay_kick_requeue_list-rerun-the-queue-at-a-quiet-time.patch b/queue-4.12/block-make-blk_mq_delay_kick_requeue_list-rerun-the-queue-at-a-quiet-time.patch new file mode 100644 index 00000000000..0d5415939ea --- /dev/null +++ b/queue-4.12/block-make-blk_mq_delay_kick_requeue_list-rerun-the-queue-at-a-quiet-time.patch @@ -0,0 +1,39 @@ +From d4acf3650c7c968f46ad932b9a25d1cc24cf4998 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Wed, 9 Aug 2017 11:28:06 -0700 +Subject: block: Make blk_mq_delay_kick_requeue_list() rerun the queue at a quiet time + +From: Bart Van Assche + +commit d4acf3650c7c968f46ad932b9a25d1cc24cf4998 upstream. + +The blk_mq_delay_kick_requeue_list() function is used by the device +mapper and only by the device mapper to rerun the queue and requeue +list after a delay. This function is called once per request that +gets requeued. Modify this function such that the queue is run once +per path change event instead of once per request that is requeued. + +Fixes: commit 2849450ad39d ("blk-mq: introduce blk_mq_delay_kick_requeue_list()") +Signed-off-by: Bart Van Assche +Cc: Mike Snitzer +Cc: Laurence Oberman +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-mq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -620,8 +620,8 @@ EXPORT_SYMBOL(blk_mq_kick_requeue_list); + void blk_mq_delay_kick_requeue_list(struct request_queue *q, + unsigned long msecs) + { +- kblockd_schedule_delayed_work(&q->requeue_work, +- msecs_to_jiffies(msecs)); ++ kblockd_mod_delayed_work_on(WORK_CPU_UNBOUND, &q->requeue_work, ++ msecs_to_jiffies(msecs)); + } + EXPORT_SYMBOL(blk_mq_delay_kick_requeue_list); + diff --git a/queue-4.12/drm-bridge-tc358767-fix-probe-without-attached-output-node.patch b/queue-4.12/drm-bridge-tc358767-fix-probe-without-attached-output-node.patch new file mode 100644 index 00000000000..1843ec25317 --- /dev/null +++ b/queue-4.12/drm-bridge-tc358767-fix-probe-without-attached-output-node.patch @@ -0,0 +1,36 @@ +From d630213f2a47933e1037909273a20023ba3e598d Mon Sep 17 00:00:00 2001 +From: Lucas Stach +Date: Mon, 10 Jul 2017 14:41:25 +0200 +Subject: drm/bridge: tc358767: fix probe without attached output node + +From: Lucas Stach + +commit d630213f2a47933e1037909273a20023ba3e598d upstream. + +The output node of the TC358767 is only used if another bridge is chained +behind it. Panels attached to the TC358767 can be detected using the usual +DP AUX probing. This restores the old behavior of ignoring the output if +no endpoint is found. + +Fixes: ebc944613567 (drm: convert drivers to use drm_of_find_panel_or_bridge) +Acked-by: Andrey Gusakov +Signed-off-by: Lucas Stach +Signed-off-by: Archit Taneja +Link: https://patchwork.freedesktop.org/patch/msgid/20170710124125.9019-1-l.stach@pengutronix.de +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/bridge/tc358767.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/bridge/tc358767.c ++++ b/drivers/gpu/drm/bridge/tc358767.c +@@ -1255,7 +1255,7 @@ static int tc_probe(struct i2c_client *c + + /* port@2 is the output port */ + ret = drm_of_find_panel_or_bridge(dev->of_node, 2, 0, &tc->panel, NULL); +- if (ret) ++ if (ret && ret != -ENODEV) + return ret; + + /* Shut down GPIO is optional */ diff --git a/queue-4.12/drm-etnaviv-fix-off-by-one-error-in-reloc-checking.patch b/queue-4.12/drm-etnaviv-fix-off-by-one-error-in-reloc-checking.patch new file mode 100644 index 00000000000..aa3ecc7e9a3 --- /dev/null +++ b/queue-4.12/drm-etnaviv-fix-off-by-one-error-in-reloc-checking.patch @@ -0,0 +1,35 @@ +From d6f756e09f01ea7a0efbbcef269a1e384a35d824 Mon Sep 17 00:00:00 2001 +From: "Wladimir J. van der Laan" +Date: Tue, 25 Jul 2017 14:33:36 +0200 +Subject: drm/etnaviv: Fix off-by-one error in reloc checking + +From: Wladimir J. van der Laan + +commit d6f756e09f01ea7a0efbbcef269a1e384a35d824 upstream. + +A relocation pointing to the last four bytes of a buffer can +legitimately happen in the case of small vertex buffers. + +Signed-off-by: Wladimir J. van der Laan +Reviewed-by: Philipp Zabel +Reviewed-by: Christian Gmeiner +Signed-off-by: Lucas Stach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c +@@ -270,8 +270,8 @@ static int submit_reloc(struct etnaviv_g + if (ret) + return ret; + +- if (r->reloc_offset >= bo->obj->base.size - sizeof(*ptr)) { +- DRM_ERROR("relocation %u outside object", i); ++ if (r->reloc_offset > bo->obj->base.size - sizeof(*ptr)) { ++ DRM_ERROR("relocation %u outside object\n", i); + return -EINVAL; + } + diff --git a/queue-4.12/drm-i915-fix-out-of-bounds-array-access-in-bdw_load_gamma_lut.patch b/queue-4.12/drm-i915-fix-out-of-bounds-array-access-in-bdw_load_gamma_lut.patch new file mode 100644 index 00000000000..31d1547ab12 --- /dev/null +++ b/queue-4.12/drm-i915-fix-out-of-bounds-array-access-in-bdw_load_gamma_lut.patch @@ -0,0 +1,115 @@ +From 5279fc7724ae3a82c9cfe5b09c1fb07ff0e41056 Mon Sep 17 00:00:00 2001 +From: Maarten Lankhorst +Date: Mon, 24 Jul 2017 11:14:31 +0200 +Subject: drm/i915: Fix out-of-bounds array access in bdw_load_gamma_lut + +From: Maarten Lankhorst + +commit 5279fc7724ae3a82c9cfe5b09c1fb07ff0e41056 upstream. + +bdw_load_gamma_lut is writing beyond the array to the maximum value. +The intend of the function is to clamp values > 1 to 1, so write +the intended color to the max register. + +This fixes the following KASAN warning: + +[ 197.020857] [IGT] kms_pipe_color: executing +[ 197.063434] [IGT] kms_pipe_color: starting subtest ctm-0-25-pipe0 +[ 197.078989] ================================================================== +[ 197.079127] BUG: KASAN: slab-out-of-bounds in bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915] +[ 197.079188] Read of size 2 at addr ffff8800d38db150 by task kms_pipe_color/1839 +[ 197.079208] CPU: 2 PID: 1839 Comm: kms_pipe_color Tainted: G U 4.13.0-rc1-patser+ #5211 +[ 197.079215] Hardware name: NUC5i7RYB, BIOS RYBDWi35.86A.0246.2015.0309.1355 03/09/2015 +[ 197.079220] Call Trace: +[ 197.079230] dump_stack+0x68/0x9e +[ 197.079239] print_address_description+0x6f/0x250 +[ 197.079251] kasan_report+0x216/0x370 +[ 197.079374] ? bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915] +[ 197.079451] ? gen8_write16+0x4e0/0x4e0 [i915] +[ 197.079460] __asan_report_load2_noabort+0x14/0x20 +[ 197.079535] bdw_load_gamma_lut.isra.2+0x3b9/0x570 [i915] +[ 197.079612] broadwell_load_luts+0x1df/0x550 [i915] +[ 197.079690] intel_color_load_luts+0x7b/0x80 [i915] +[ 197.079764] intel_begin_crtc_commit+0x138/0x760 [i915] +[ 197.079783] drm_atomic_helper_commit_planes_on_crtc+0x1a3/0x820 [drm_kms_helper] +[ 197.079859] ? intel_pre_plane_update+0x571/0x580 [i915] +[ 197.079937] intel_update_crtc+0x238/0x330 [i915] +[ 197.080016] intel_update_crtcs+0x10f/0x210 [i915] +[ 197.080092] intel_atomic_commit_tail+0x1552/0x3340 [i915] +[ 197.080101] ? _raw_spin_unlock+0x3c/0x40 +[ 197.080110] ? __queue_work+0xb40/0xbf0 +[ 197.080188] ? skl_update_crtcs+0xc00/0xc00 [i915] +[ 197.080195] ? trace_hardirqs_on+0xd/0x10 +[ 197.080269] ? intel_atomic_commit_ready+0x128/0x13c [i915] +[ 197.080329] ? __i915_sw_fence_complete+0x5b8/0x6d0 [i915] +[ 197.080336] ? debug_object_activate+0x39e/0x580 +[ 197.080397] ? i915_sw_fence_await+0x30/0x30 [i915] +[ 197.080409] ? __might_sleep+0x15b/0x180 +[ 197.080483] intel_atomic_commit+0x944/0xa70 [i915] +[ 197.080490] ? refcount_dec_and_test+0x11/0x20 +[ 197.080567] ? intel_atomic_commit_tail+0x3340/0x3340 [i915] +[ 197.080597] ? drm_atomic_crtc_set_property+0x303/0x580 [drm] +[ 197.080674] ? intel_atomic_commit_tail+0x3340/0x3340 [i915] +[ 197.080704] drm_atomic_commit+0xd7/0xe0 [drm] +[ 197.080722] drm_atomic_helper_crtc_set_property+0xec/0x130 [drm_kms_helper] +[ 197.080749] drm_mode_crtc_set_obj_prop+0x7d/0xb0 [drm] +[ 197.080775] drm_mode_obj_set_property_ioctl+0x50b/0x5d0 [drm] +[ 197.080783] ? __might_fault+0x104/0x180 +[ 197.080809] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm] +[ 197.080838] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm] +[ 197.080861] drm_ioctl_kernel+0x154/0x1a0 [drm] +[ 197.080885] drm_ioctl+0x624/0x8f0 [drm] +[ 197.080910] ? drm_mode_obj_find_prop_id+0x160/0x160 [drm] +[ 197.080934] ? drm_getunique+0x210/0x210 [drm] +[ 197.080943] ? __handle_mm_fault+0x1bd0/0x1ce0 +[ 197.080949] ? lock_downgrade+0x610/0x610 +[ 197.080957] ? __lru_cache_add+0x15a/0x180 +[ 197.080967] do_vfs_ioctl+0xd92/0xe40 +[ 197.080975] ? ioctl_preallocate+0x1b0/0x1b0 +[ 197.080982] ? selinux_capable+0x20/0x20 +[ 197.080991] ? __do_page_fault+0x7b7/0x9a0 +[ 197.080997] ? lock_downgrade+0x5bb/0x610 +[ 197.081007] ? security_file_ioctl+0x57/0x90 +[ 197.081016] SyS_ioctl+0x4e/0x80 +[ 197.081024] entry_SYSCALL_64_fastpath+0x18/0xad +[ 197.081030] RIP: 0033:0x7f61f287a987 +[ 197.081035] RSP: 002b:00007fff7d44d188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 +[ 197.081043] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f61f287a987 +[ 197.081048] RDX: 00007fff7d44d1c0 RSI: 00000000c01864ba RDI: 0000000000000003 +[ 197.081053] RBP: 00007f61f2b3eb00 R08: 0000000000000059 R09: 0000000000000000 +[ 197.081058] R10: 0000002ea5c4a290 R11: 0000000000000246 R12: 00007f61f2b3eb58 +[ 197.081063] R13: 0000000000001010 R14: 00007f61f2b3eb58 R15: 0000000000002702 + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101659 +Signed-off-by: Maarten Lankhorst +Reported-by: Martin Peres +Cc: Martin Peres +Fixes: 82cf435b3134 ("drm/i915: Implement color management on bdw/skl/bxt/kbl") +Cc: Shashank Sharma +Cc: Kiran S Kumar +Cc: Kausal Malladi +Cc: Lionel Landwerlin +Cc: Matt Roper +Cc: Daniel Vetter +Cc: Jani Nikula +Cc: intel-gfx@lists.freedesktop.org +Link: https://patchwork.freedesktop.org/patch/msgid/20170724091431.24251-1-maarten.lankhorst@linux.intel.com +Reviewed-by: Lionel Landwerlin +(cherry picked from commit 09a92bc8773b4314e02b478e003fe5936ce85adb) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_color.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/i915/intel_color.c ++++ b/drivers/gpu/drm/i915/intel_color.c +@@ -398,6 +398,7 @@ static void bdw_load_gamma_lut(struct dr + } + + /* Program the max register to clamp values > 1.0. */ ++ i = lut_size - 1; + I915_WRITE(PREC_PAL_GC_MAX(pipe, 0), + drm_color_lut_extract(lut[i].red, 16)); + I915_WRITE(PREC_PAL_GC_MAX(pipe, 1), diff --git a/queue-4.12/firmware-avoid-invalid-fallback-aborts-by-using-killable-wait.patch b/queue-4.12/firmware-avoid-invalid-fallback-aborts-by-using-killable-wait.patch new file mode 100644 index 00000000000..ecb567021a3 --- /dev/null +++ b/queue-4.12/firmware-avoid-invalid-fallback-aborts-by-using-killable-wait.patch @@ -0,0 +1,85 @@ +From 260d9f2fc5655a2552701cdd0b909c4466732f19 Mon Sep 17 00:00:00 2001 +From: "Luis R. Rodriguez" +Date: Thu, 20 Jul 2017 13:13:11 -0700 +Subject: firmware: avoid invalid fallback aborts by using killable wait + +From: Luis R. Rodriguez + +commit 260d9f2fc5655a2552701cdd0b909c4466732f19 upstream. + +Commit 0cb64249ca500 ("firmware_loader: abort request if wait_for_completion +is interrupted") added via 4.0 added support to abort the fallback mechanism +when a signal was detected and wait_for_completion_interruptible() returned +-ERESTARTSYS -- for instance when a user hits CTRL-C. The abort was overly +*too* effective. + +When a child process terminates (successful or not) the signal SIGCHLD can +be sent to the parent process which ran the child in the background and +later triggered a sync request for firmware through a sysfs interface which +relies on the fallback mechanism. This signal in turn can be recieved by the +interruptible wait we constructed on firmware_class and detects it as an +abort *before* userspace could get a chance to write the firmware. Upon +failure -EAGAIN is returned, so userspace is also kept in the dark about +exactly what happened. + +We can reproduce the issue with the fw_fallback.sh selftest: + +Before this patch: +$ sudo tools/testing/selftests/firmware/fw_fallback.sh +... +tools/testing/selftests/firmware/fw_fallback.sh: error - sync firmware request cancelled due to SIGCHLD + +After this patch: +$ sudo tools/testing/selftests/firmware/fw_fallback.sh +... +tools/testing/selftests/firmware/fw_fallback.sh: SIGCHLD on sync ignored as expected + +Fix this by making the wait killable -- only killable by SIGKILL (kill -9). +We loose the ability to allow userspace to cancel a write with CTRL-C +(SIGINT), however its been decided the compromise to require SIGKILL is +worth the gains. + +Chances of this issue occuring are low due to the number of drivers upstream +exclusively relying on the fallback mechanism for firmware (2 drivers), +however this is observed in the field with custom drivers with sysfs +triggers to load firmware. Only distributions relying on the fallback +mechanism are impacted as well. An example reported issue was on Android, +as follows: + +1) Android init (pid=1) fork()s (say pid=42) [this child process is totally + unrelated to firmware loading, it could be sleep 2; for all we care ] +2) Android init (pid=1) does a write() on a (driver custom) sysfs file which + ends up calling request_firmware() kernel side +3) The firmware loading fallback mechanism is used, the request is sent to + userspace and pid 1 waits in the kernel on wait_* +4) before firmware loading completes pid 42 dies (for any reason, even + normal termination) +5) Kernel delivers SIGCHLD to pid=1 to tell it a child has died, which + causes -ERESTARTSYS to be returned from wait_* +6) The kernel's wait aborts and return -EAGAIN for the + request_firmware() caller. + +Fixes: 0cb64249ca500 ("firmware_loader: abort request if wait_for_completion is interrupted") +Suggested-by: "Eric W. Biederman" +Suggested-by: Dmitry Torokhov +Tested-by: Martin Fuzzey +Reported-by: Martin Fuzzey +Signed-off-by: Luis R. Rodriguez +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/firmware_class.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/base/firmware_class.c ++++ b/drivers/base/firmware_class.c +@@ -130,8 +130,7 @@ static int __fw_state_wait_common(struct + { + long ret; + +- ret = wait_for_completion_interruptible_timeout(&fw_st->completion, +- timeout); ++ ret = wait_for_completion_killable_timeout(&fw_st->completion, timeout); + if (ret != 0 && fw_st->status == FW_STATUS_ABORTED) + return -ENOENT; + if (!ret) diff --git a/queue-4.12/firmware-fix-batched-requests-send-wake-up-on-failure-on-direct-lookups.patch b/queue-4.12/firmware-fix-batched-requests-send-wake-up-on-failure-on-direct-lookups.patch new file mode 100644 index 00000000000..73c0cca9c2a --- /dev/null +++ b/queue-4.12/firmware-fix-batched-requests-send-wake-up-on-failure-on-direct-lookups.patch @@ -0,0 +1,206 @@ +From 90d41e74a9c36a84e2efbd2a5b8d79299feee6fa Mon Sep 17 00:00:00 2001 +From: "Luis R. Rodriguez" +Date: Thu, 20 Jul 2017 13:13:10 -0700 +Subject: firmware: fix batched requests - send wake up on failure on direct lookups + +From: Luis R. Rodriguez + +commit 90d41e74a9c36a84e2efbd2a5b8d79299feee6fa upstream. + +Fix batched requests from waiting forever on failure. + +The firmware API batched requests feature has been broken since the API call +request_firmware_direct() was introduced on commit bba3a87e982ad ("firmware: +Introduce request_firmware_direct()"), added on v3.14 *iff* the firmware +being requested was not present in *certain kernel builds* [0]. + +When no firmware is found the worker which goes on to finish never informs +waiters queued up of this, so any batched request will stall in what seems +to be forever (MAX_SCHEDULE_TIMEOUT). Sadly, a reboot will also stall, as +the reboot notifier was only designed to kill custom fallback workers. The +issue seems to the user as a type of soft lockup, what *actually* happens +underneath the hood is a wait call which never completes as we failed to +issue a completion on error. + +For device drivers with optional firmware schemes (ie, Intel iwlwifi, or +Netronome -- even though it uses request_firmware() and not +request_firmware_direct()), this could mean that when you boot a system with +multiple cards the firmware will seem to never load on the system, or that +the card is just not responsive even the driver initialization. Due to +differences in scheduling possible this should not always trigger -- +one would need to to ensure that multiple requests are in place at the +right time for this to work, also release_firmware() must not be called +prior to any other incoming request. The complexity may not be worth +supporting batched requests in the future given the wait mechanism is +only used also for the fallback mechanism. We'll keep it for now and +just fix it. + +Its reported that at least with the Intel WiFi cards on one system this +issue was creeping up 50% of the boots [0]. + +Before this commit batched requests testing revealed: +============================================================================ +CONFIG_FW_LOADER_USER_HELPER_FALLBACK=n +CONFIG_FW_LOADER_USER_HELPER=y + +Most common Linux distribution setup. + +API-type no-firmware-found firmware-found +---------------------------------------------------------------------- +request_firmware() FAIL OK +request_firmware_direct() FAIL OK +request_firmware_nowait(uevent=true) FAIL OK +request_firmware_nowait(uevent=false) FAIL OK +============================================================================ +CONFIG_FW_LOADER_USER_HELPER_FALLBACK=n +CONFIG_FW_LOADER_USER_HELPER=n + +Only possible if CONFIG_DELL_RBU=n and CONFIG_LEDS_LP55XX_COMMON=n, rare. + +API-type no-firmware-found firmware-found +---------------------------------------------------------------------- +request_firmware() FAIL OK +request_firmware_direct() FAIL OK +request_firmware_nowait(uevent=true) FAIL OK +request_firmware_nowait(uevent=false) FAIL OK +============================================================================ +CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y +CONFIG_FW_LOADER_USER_HELPER=y + +Google Android setup. + +API-type no-firmware-found firmware-found +---------------------------------------------------------------------- +request_firmware() OK OK +request_firmware_direct() FAIL OK +request_firmware_nowait(uevent=true) OK OK +request_firmware_nowait(uevent=false) OK OK +============================================================================ + +Ater this commit batched testing results: +============================================================================ +CONFIG_FW_LOADER_USER_HELPER_FALLBACK=n +CONFIG_FW_LOADER_USER_HELPER=y + +Most common Linux distribution setup. + +API-type no-firmware-found firmware-found +---------------------------------------------------------------------- +request_firmware() OK OK +request_firmware_direct() OK OK +request_firmware_nowait(uevent=true) OK OK +request_firmware_nowait(uevent=false) OK OK +============================================================================ +CONFIG_FW_LOADER_USER_HELPER_FALLBACK=n +CONFIG_FW_LOADER_USER_HELPER=n + +Only possible if CONFIG_DELL_RBU=n and CONFIG_LEDS_LP55XX_COMMON=n, rare. + +API-type no-firmware-found firmware-found +---------------------------------------------------------------------- +request_firmware() OK OK +request_firmware_direct() OK OK +request_firmware_nowait(uevent=true) OK OK +request_firmware_nowait(uevent=false) OK OK +============================================================================ +CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y +CONFIG_FW_LOADER_USER_HELPER=y + +Google Android setup. + +API-type no-firmware-found firmware-found +---------------------------------------------------------------------- +request_firmware() OK OK +request_firmware_direct() OK OK +request_firmware_nowait(uevent=true) OK OK +request_firmware_nowait(uevent=false) OK OK +============================================================================ + +[0] https://bugzilla.kernel.org/show_bug.cgi?id=195477 + +Fixes: bba3a87e982ad ("firmware: Introduce request_firmware_direct()" +Reported-by: Nicolas +Reported-by: John Ewalt +Reported-by: Jakub Kicinski +Signed-off-by: Luis R. Rodriguez +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/firmware_class.c | 38 ++++++++++++++++++++++++++++++-------- + 1 file changed, 30 insertions(+), 8 deletions(-) + +--- a/drivers/base/firmware_class.c ++++ b/drivers/base/firmware_class.c +@@ -153,28 +153,27 @@ static void __fw_state_set(struct fw_sta + __fw_state_set(fw_st, FW_STATUS_LOADING) + #define fw_state_done(fw_st) \ + __fw_state_set(fw_st, FW_STATUS_DONE) ++#define fw_state_aborted(fw_st) \ ++ __fw_state_set(fw_st, FW_STATUS_ABORTED) + #define fw_state_wait(fw_st) \ + __fw_state_wait_common(fw_st, MAX_SCHEDULE_TIMEOUT) + +-#ifndef CONFIG_FW_LOADER_USER_HELPER +- +-#define fw_state_is_aborted(fw_st) false +- +-#else /* CONFIG_FW_LOADER_USER_HELPER */ +- + static int __fw_state_check(struct fw_state *fw_st, enum fw_status status) + { + return fw_st->status == status; + } + ++#define fw_state_is_aborted(fw_st) \ ++ __fw_state_check(fw_st, FW_STATUS_ABORTED) ++ ++#ifdef CONFIG_FW_LOADER_USER_HELPER ++ + #define fw_state_aborted(fw_st) \ + __fw_state_set(fw_st, FW_STATUS_ABORTED) + #define fw_state_is_done(fw_st) \ + __fw_state_check(fw_st, FW_STATUS_DONE) + #define fw_state_is_loading(fw_st) \ + __fw_state_check(fw_st, FW_STATUS_LOADING) +-#define fw_state_is_aborted(fw_st) \ +- __fw_state_check(fw_st, FW_STATUS_ABORTED) + #define fw_state_wait_timeout(fw_st, timeout) \ + __fw_state_wait_common(fw_st, timeout) + +@@ -1161,6 +1160,28 @@ static int assign_firmware_buf(struct fi + return 0; + } + ++/* ++ * Batched requests need only one wake, we need to do this step last due to the ++ * fallback mechanism. The buf is protected with kref_get(), and it won't be ++ * released until the last user calls release_firmware(). ++ * ++ * Failed batched requests are possible as well, in such cases we just share ++ * the struct firmware_buf and won't release it until all requests are woken ++ * and have gone through this same path. ++ */ ++static void fw_abort_batch_reqs(struct firmware *fw) ++{ ++ struct firmware_buf *buf; ++ ++ /* Loaded directly? */ ++ if (!fw || !fw->priv) ++ return; ++ ++ buf = fw->priv; ++ if (!fw_state_is_aborted(&buf->fw_st)) ++ fw_state_aborted(&buf->fw_st); ++} ++ + /* called from request_firmware() and request_firmware_work_func() */ + static int + _request_firmware(const struct firmware **firmware_p, const char *name, +@@ -1222,6 +1243,7 @@ _request_firmware(const struct firmware + + out: + if (ret < 0) { ++ fw_abort_batch_reqs(fw); + release_firmware(fw); + fw = NULL; + } diff --git a/queue-4.12/firmware-fix-batched-requests-wake-all-waiters.patch b/queue-4.12/firmware-fix-batched-requests-wake-all-waiters.patch new file mode 100644 index 00000000000..8cd000d9fc7 --- /dev/null +++ b/queue-4.12/firmware-fix-batched-requests-wake-all-waiters.patch @@ -0,0 +1,198 @@ +From e44565f62a72064e686f7a852137595ec94d78f2 Mon Sep 17 00:00:00 2001 +From: "Luis R. Rodriguez" +Date: Thu, 20 Jul 2017 13:13:09 -0700 +Subject: firmware: fix batched requests - wake all waiters + +From: Luis R. Rodriguez + +commit e44565f62a72064e686f7a852137595ec94d78f2 upstream. + +The firmware cache mechanism serves two purposes, the secondary purpose is +not well documented nor understood. This fixes a regression with the +secondary purpose of the firmware cache mechanism: batched requests on +successful lookups. Without this fix *any* time a batched request is +triggered, secondary requests for which the batched request mechanism +was designed for will seem to last forver and seem to never return. +This issue is present for all kernel builds possible, and a hard reset +is required. + +The firmware cache is used for: + +1) Addressing races with file lookups during the suspend/resume cycle + by keeping firmware in memory during the suspend/resume cycle + +2) Batched requests for the same file rely only on work from the first file + lookup, which keeps the firmware in memory until the last + release_firmware() is called + +Batched requests *only* take effect if secondary requests come in prior to +the first user calling release_firmware(). The devres name used for the +internal firmware cache is used as a hint other pending requests are +ongoing, the firmware buffer data is kept in memory until the last user of +the buffer calls release_firmware(), therefore serializing requests and +delaying the release until all requests are done. + +Batched requests wait for a wakup or signal so we can rely on the first file +fetch to write to the pending secondary requests. Commit 5b029624948d +("firmware: do not use fw_lock for fw_state protection") ported the firmware +API to use swait, and in doing so failed to convert complete_all() to +swake_up_all() -- it used swake_up(), loosing the ability for *some* batched +requests to take effect. + +We *could* fix this by just using swake_up_all() *but* swait is now known +to be very special use case, so its best to just move away from it. So we +just go back to using completions as before commit 5b029624948d ("firmware: +do not use fw_lock for fw_state protection") given this was using +complete_all(). + +Without this fix it has been reported plugging in two Intel 6260 Wifi cards +on a system will end up enumerating the two devices only 50% of the time +[0]. The ported swake_up() should have actually handled the case with two +devices, however, *if more than two cards are used* the swake_up() would +not have sufficed. This change is only part of the required fixes for +batched requests. Another fix is provided in the next patch. + +This particular change should fix the cases where more than three requests +with the same firmware name is used, otherwise batched requests will wait +for MAX_SCHEDULE_TIMEOUT and just timeout eventually. + +Below is a summary of tests triggering batched requests on different +kernel builds. + +Before this patch: +============================================================================ +CONFIG_FW_LOADER_USER_HELPER_FALLBACK=n +CONFIG_FW_LOADER_USER_HELPER=y + +Most common Linux distribution setup. + +API-type no-firmware-found firmware-found +---------------------------------------------------------------------- +request_firmware() FAIL FAIL +request_firmware_direct() FAIL FAIL +request_firmware_nowait(uevent=true) FAIL FAIL +request_firmware_nowait(uevent=false) FAIL FAIL +============================================================================ +CONFIG_FW_LOADER_USER_HELPER_FALLBACK=n +CONFIG_FW_LOADER_USER_HELPER=n + +Only possible if CONFIG_DELL_RBU=n and CONFIG_LEDS_LP55XX_COMMON=n, rare. + +API-type no-firmware-found firmware-found +---------------------------------------------------------------------- +request_firmware() FAIL FAIL +request_firmware_direct() FAIL FAIL +request_firmware_nowait(uevent=true) FAIL FAIL +request_firmware_nowait(uevent=false) FAIL FAIL +============================================================================ +CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y +CONFIG_FW_LOADER_USER_HELPER=y + +Google Android setup. + +API-type no-firmware-found firmware-found +---------------------------------------------------------------------- +request_firmware() FAIL FAIL +request_firmware_direct() FAIL FAIL +request_firmware_nowait(uevent=true) FAIL FAIL +request_firmware_nowait(uevent=false) FAIL FAIL +============================================================================ + +After this patch: +============================================================================ +CONFIG_FW_LOADER_USER_HELPER_FALLBACK=n +CONFIG_FW_LOADER_USER_HELPER=y + +Most common Linux distribution setup. + +API-type no-firmware-found firmware-found +---------------------------------------------------------------------- +request_firmware() FAIL OK +request_firmware_direct() FAIL OK +request_firmware_nowait(uevent=true) FAIL OK +request_firmware_nowait(uevent=false) FAIL OK +============================================================================ +CONFIG_FW_LOADER_USER_HELPER_FALLBACK=n +CONFIG_FW_LOADER_USER_HELPER=n + +Only possible if CONFIG_DELL_RBU=n and CONFIG_LEDS_LP55XX_COMMON=n, rare. + +API-type no-firmware-found firmware-found +---------------------------------------------------------------------- +request_firmware() FAIL OK +request_firmware_direct() FAIL OK +request_firmware_nowait(uevent=true) FAIL OK +request_firmware_nowait(uevent=false) FAIL OK +============================================================================ +CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y +CONFIG_FW_LOADER_USER_HELPER=y + +Google Android setup. + +API-type no-firmware-found firmware-found +---------------------------------------------------------------------- +request_firmware() OK OK +request_firmware_direct() FAIL OK +request_firmware_nowait(uevent=true) OK OK +request_firmware_nowait(uevent=false) OK OK +============================================================================ + +[0] https://bugzilla.kernel.org/show_bug.cgi?id=195477 + +Cc: Ming Lei +Fixes: 5b029624948d ("firmware: do not use fw_lock for fw_state protection") +Reported-by: Jakub Kicinski +Signed-off-by: Luis R. Rodriguez +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/firmware_class.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +--- a/drivers/base/firmware_class.c ++++ b/drivers/base/firmware_class.c +@@ -30,7 +30,6 @@ + #include + #include + #include +-#include + + #include + +@@ -112,13 +111,13 @@ static inline long firmware_loading_time + * state of the firmware loading. + */ + struct fw_state { +- struct swait_queue_head wq; ++ struct completion completion; + enum fw_status status; + }; + + static void fw_state_init(struct fw_state *fw_st) + { +- init_swait_queue_head(&fw_st->wq); ++ init_completion(&fw_st->completion); + fw_st->status = FW_STATUS_UNKNOWN; + } + +@@ -131,9 +130,8 @@ static int __fw_state_wait_common(struct + { + long ret; + +- ret = swait_event_interruptible_timeout(fw_st->wq, +- __fw_state_is_done(READ_ONCE(fw_st->status)), +- timeout); ++ ret = wait_for_completion_interruptible_timeout(&fw_st->completion, ++ timeout); + if (ret != 0 && fw_st->status == FW_STATUS_ABORTED) + return -ENOENT; + if (!ret) +@@ -148,7 +146,7 @@ static void __fw_state_set(struct fw_sta + WRITE_ONCE(fw_st->status, status); + + if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED) +- swake_up(&fw_st->wq); ++ complete_all(&fw_st->completion); + } + + #define fw_state_start(fw_st) \ diff --git a/queue-4.12/fuse-initialize-the-flock-flag-in-fuse_file-on-allocation.patch b/queue-4.12/fuse-initialize-the-flock-flag-in-fuse_file-on-allocation.patch new file mode 100644 index 00000000000..52813cb393b --- /dev/null +++ b/queue-4.12/fuse-initialize-the-flock-flag-in-fuse_file-on-allocation.patch @@ -0,0 +1,38 @@ +From 68227c03cba84a24faf8a7277d2b1a03c8959c2c Mon Sep 17 00:00:00 2001 +From: Mateusz Jurczyk +Date: Wed, 7 Jun 2017 12:26:49 +0200 +Subject: fuse: initialize the flock flag in fuse_file on allocation + +From: Mateusz Jurczyk + +commit 68227c03cba84a24faf8a7277d2b1a03c8959c2c upstream. + +Before the patch, the flock flag could remain uninitialized for the +lifespan of the fuse_file allocation. Unless set to true in +fuse_file_flock(), it would remain in an indeterminate state until read in +an if statement in fuse_release_common(). This could consequently lead to +taking an unexpected branch in the code. + +The bug was discovered by a runtime instrumentation designed to detect use +of uninitialized memory in the kernel. + +Signed-off-by: Mateusz Jurczyk +Fixes: 37fb3a30b462 ("fuse: fix flock") +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -46,7 +46,7 @@ struct fuse_file *fuse_file_alloc(struct + { + struct fuse_file *ff; + +- ff = kmalloc(sizeof(struct fuse_file), GFP_KERNEL); ++ ff = kzalloc(sizeof(struct fuse_file), GFP_KERNEL); + if (unlikely(!ff)) + return NULL; + diff --git a/queue-4.12/i2c-designware-some-broken-dstds-use-1mihz-instead-of-1mhz.patch b/queue-4.12/i2c-designware-some-broken-dstds-use-1mihz-instead-of-1mhz.patch new file mode 100644 index 00000000000..91659b23c64 --- /dev/null +++ b/queue-4.12/i2c-designware-some-broken-dstds-use-1mihz-instead-of-1mhz.patch @@ -0,0 +1,36 @@ +From 682c6c2188f39d13548ccdc89c9888fbcb547889 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 13 Jul 2017 15:45:02 +0200 +Subject: i2c: designware: Some broken DSTDs use 1MiHz instead of 1MHz + +From: Hans de Goede + +commit 682c6c2188f39d13548ccdc89c9888fbcb547889 upstream. + +At least the Acer Iconia Tab8 / aka W1-810 uses 1MiHz instead of +1MHz for one of its busses, fix this up to 1MHz instead of failing +the probe of that bus. + +This fixes the accelerometer on the Acer Iconia Tab8 not working. + +Signed-off-by: Hans de Goede +Reviewed-by: Andy Shevchenko +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-designware-platdrv.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -254,6 +254,9 @@ static int dw_i2c_plat_probe(struct plat + } + + acpi_speed = i2c_acpi_find_bus_speed(&pdev->dev); ++ /* Some broken DSTDs use 1MiHz instead of 1MHz */ ++ if (acpi_speed == 1048576) ++ acpi_speed = 1000000; + /* + * Find bus speed from the "clock-frequency" device property, ACPI + * or by using fast mode if neither is set. diff --git a/queue-4.12/iio-accel-bmc150-always-restore-device-to-normal-mode-after-suspend-resume.patch b/queue-4.12/iio-accel-bmc150-always-restore-device-to-normal-mode-after-suspend-resume.patch new file mode 100644 index 00000000000..d62a4f398ff --- /dev/null +++ b/queue-4.12/iio-accel-bmc150-always-restore-device-to-normal-mode-after-suspend-resume.patch @@ -0,0 +1,60 @@ +From e59e18989c68a8d7941005f81ad6abc4ca682de0 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 13 Jul 2017 15:13:41 +0200 +Subject: iio: accel: bmc150: Always restore device to normal mode after suspend-resume + +From: Hans de Goede + +commit e59e18989c68a8d7941005f81ad6abc4ca682de0 upstream. + +After probe we would put the device in normal mode, after a runtime +suspend-resume we would put it back in normal mode. But for a regular +suspend-resume we would only put it back in normal mode if triggers +or events have been requested. This is not consistent and breaks +reading raw values after a suspend-resume. + +This commit changes the regular resume path to also unconditionally put +the device back in normal mode, fixing reading of raw values not working +after a regular suspend-resume cycle. + +Signed-off-by: Hans de Goede +Reviewed-by: Srinivas Pandruvada +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/accel/bmc150-accel-core.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +--- a/drivers/iio/accel/bmc150-accel-core.c ++++ b/drivers/iio/accel/bmc150-accel-core.c +@@ -193,7 +193,6 @@ struct bmc150_accel_data { + struct regmap *regmap; + int irq; + struct bmc150_accel_interrupt interrupts[BMC150_ACCEL_INTERRUPTS]; +- atomic_t active_intr; + struct bmc150_accel_trigger triggers[BMC150_ACCEL_TRIGGERS]; + struct mutex mutex; + u8 fifo_mode, watermark; +@@ -493,11 +492,6 @@ static int bmc150_accel_set_interrupt(st + goto out_fix_power_state; + } + +- if (state) +- atomic_inc(&data->active_intr); +- else +- atomic_dec(&data->active_intr); +- + return 0; + + out_fix_power_state: +@@ -1710,8 +1704,7 @@ static int bmc150_accel_resume(struct de + struct bmc150_accel_data *data = iio_priv(indio_dev); + + mutex_lock(&data->mutex); +- if (atomic_read(&data->active_intr)) +- bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0); ++ bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0); + bmc150_accel_fifo_set_mode(data); + mutex_unlock(&data->mutex); + diff --git a/queue-4.12/iio-accel-st_accel-add-spi-3wire-support.patch b/queue-4.12/iio-accel-st_accel-add-spi-3wire-support.patch new file mode 100644 index 00000000000..1aeb27de5c0 --- /dev/null +++ b/queue-4.12/iio-accel-st_accel-add-spi-3wire-support.patch @@ -0,0 +1,211 @@ +From a7b8829d242b1a58107e9c02b09e93aec446d55c Mon Sep 17 00:00:00 2001 +From: Lorenzo Bianconi +Date: Wed, 5 Jul 2017 20:30:01 +0200 +Subject: iio: accel: st_accel: add SPI-3wire support + +From: Lorenzo Bianconi + +commit a7b8829d242b1a58107e9c02b09e93aec446d55c upstream. + +Add SPI Serial Interface Mode (SIM) register information +in st_sensor_settings look up table to support devices +(like LSM303AGR accel sensor) that allow just SPI-3wire +communication mode. SIM mode has to be configured before any +other operation since it is not enabled by default and the driver +is not able to read without that configuration + +Whilst a fairly substantial patch, the actual logic is simple and it +is better to have the generic fix than a band aid. + +Fixes: ddc05fa28606 (iio: st-accel: add support for lsm303agr accel) +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/accel/st_accel_core.c | 32 ++++++++++++++++++++++++ + drivers/iio/common/st_sensors/st_sensors_core.c | 29 +++++++++++++++++++++ + include/linux/iio/common/st_sensors.h | 7 +++++ + include/linux/platform_data/st_sensors_pdata.h | 2 + + 4 files changed, 70 insertions(+) + +--- a/drivers/iio/accel/st_accel_core.c ++++ b/drivers/iio/accel/st_accel_core.c +@@ -166,6 +166,10 @@ static const struct st_sensor_settings s + .mask_ihl = 0x02, + .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR, + }, ++ .sim = { ++ .addr = 0x23, ++ .value = BIT(0), ++ }, + .multi_read_bit = true, + .bootime = 2, + }, +@@ -234,6 +238,10 @@ static const struct st_sensor_settings s + .mask_od = 0x40, + .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR, + }, ++ .sim = { ++ .addr = 0x23, ++ .value = BIT(0), ++ }, + .multi_read_bit = true, + .bootime = 2, + }, +@@ -316,6 +324,10 @@ static const struct st_sensor_settings s + .en_mask = 0x08, + }, + }, ++ .sim = { ++ .addr = 0x24, ++ .value = BIT(0), ++ }, + .multi_read_bit = false, + .bootime = 2, + }, +@@ -379,6 +391,10 @@ static const struct st_sensor_settings s + .mask_int1 = 0x04, + .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR, + }, ++ .sim = { ++ .addr = 0x21, ++ .value = BIT(1), ++ }, + .multi_read_bit = true, + .bootime = 2, /* guess */ + }, +@@ -437,6 +453,10 @@ static const struct st_sensor_settings s + .mask_od = 0x40, + .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR, + }, ++ .sim = { ++ .addr = 0x21, ++ .value = BIT(7), ++ }, + .multi_read_bit = false, + .bootime = 2, /* guess */ + }, +@@ -499,6 +519,10 @@ static const struct st_sensor_settings s + .addr_ihl = 0x22, + .mask_ihl = 0x80, + }, ++ .sim = { ++ .addr = 0x23, ++ .value = BIT(0), ++ }, + .multi_read_bit = true, + .bootime = 2, + }, +@@ -547,6 +571,10 @@ static const struct st_sensor_settings s + .mask_int1 = 0x04, + .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR, + }, ++ .sim = { ++ .addr = 0x21, ++ .value = BIT(1), ++ }, + .multi_read_bit = false, + .bootime = 2, + }, +@@ -614,6 +642,10 @@ static const struct st_sensor_settings s + .mask_ihl = 0x02, + .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR, + }, ++ .sim = { ++ .addr = 0x23, ++ .value = BIT(0), ++ }, + .multi_read_bit = true, + .bootime = 2, + }, +--- a/drivers/iio/common/st_sensors/st_sensors_core.c ++++ b/drivers/iio/common/st_sensors/st_sensors_core.c +@@ -550,6 +550,31 @@ out: + } + EXPORT_SYMBOL(st_sensors_read_info_raw); + ++static int st_sensors_init_interface_mode(struct iio_dev *indio_dev, ++ const struct st_sensor_settings *sensor_settings) ++{ ++ struct st_sensor_data *sdata = iio_priv(indio_dev); ++ struct device_node *np = sdata->dev->of_node; ++ struct st_sensors_platform_data *pdata; ++ ++ pdata = (struct st_sensors_platform_data *)sdata->dev->platform_data; ++ if (((np && of_property_read_bool(np, "spi-3wire")) || ++ (pdata && pdata->spi_3wire)) && sensor_settings->sim.addr) { ++ int err; ++ ++ err = sdata->tf->write_byte(&sdata->tb, sdata->dev, ++ sensor_settings->sim.addr, ++ sensor_settings->sim.value); ++ if (err < 0) { ++ dev_err(&indio_dev->dev, ++ "failed to init interface mode\n"); ++ return err; ++ } ++ } ++ ++ return 0; ++} ++ + int st_sensors_check_device_support(struct iio_dev *indio_dev, + int num_sensors_list, + const struct st_sensor_settings *sensor_settings) +@@ -574,6 +599,10 @@ int st_sensors_check_device_support(stru + return -ENODEV; + } + ++ err = st_sensors_init_interface_mode(indio_dev, &sensor_settings[i]); ++ if (err < 0) ++ return err; ++ + if (sensor_settings[i].wai_addr) { + err = sdata->tf->read_byte(&sdata->tb, sdata->dev, + sensor_settings[i].wai_addr, &wai); +--- a/include/linux/iio/common/st_sensors.h ++++ b/include/linux/iio/common/st_sensors.h +@@ -105,6 +105,11 @@ struct st_sensor_fullscale { + struct st_sensor_fullscale_avl fs_avl[ST_SENSORS_FULLSCALE_AVL_MAX]; + }; + ++struct st_sensor_sim { ++ u8 addr; ++ u8 value; ++}; ++ + /** + * struct st_sensor_bdu - ST sensor device block data update + * @addr: address of the register. +@@ -197,6 +202,7 @@ struct st_sensor_transfer_function { + * @bdu: Block data update register. + * @das: Data Alignment Selection register. + * @drdy_irq: Data ready register of the sensor. ++ * @sim: SPI serial interface mode register of the sensor. + * @multi_read_bit: Use or not particular bit for [I2C/SPI] multi-read. + * @bootime: samples to discard when sensor passing from power-down to power-up. + */ +@@ -213,6 +219,7 @@ struct st_sensor_settings { + struct st_sensor_bdu bdu; + struct st_sensor_das das; + struct st_sensor_data_ready_irq drdy_irq; ++ struct st_sensor_sim sim; + bool multi_read_bit; + unsigned int bootime; + }; +--- a/include/linux/platform_data/st_sensors_pdata.h ++++ b/include/linux/platform_data/st_sensors_pdata.h +@@ -17,10 +17,12 @@ + * Available only for accelerometer and pressure sensors. + * Accelerometer DRDY on LSM330 available only on pin 1 (see datasheet). + * @open_drain: set the interrupt line to be open drain if possible. ++ * @spi_3wire: enable spi-3wire mode. + */ + struct st_sensors_platform_data { + u8 drdy_int_pin; + bool open_drain; ++ bool spi_3wire; + }; + + #endif /* ST_SENSORS_PDATA_H */ diff --git a/queue-4.12/iio-adc-revert-axp288-drop-bogus-axp288_adc_ts_pin_ctrl-register-modifications.patch b/queue-4.12/iio-adc-revert-axp288-drop-bogus-axp288_adc_ts_pin_ctrl-register-modifications.patch new file mode 100644 index 00000000000..1bcfa536f41 --- /dev/null +++ b/queue-4.12/iio-adc-revert-axp288-drop-bogus-axp288_adc_ts_pin_ctrl-register-modifications.patch @@ -0,0 +1,100 @@ +From 631b010abc5b57009c6a8328f51492665f6ef310 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Fri, 30 Jun 2017 19:42:54 +0200 +Subject: iio: adc: Revert "axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications" + +From: Hans de Goede + +commit 631b010abc5b57009c6a8328f51492665f6ef310 upstream. + +Inheriting the ADC BIAS current settings from the BIOS instead of +hardcoding then causes the AXP288 to disable charging (I think it +mis-detects an overheated battery) on at least one model tablet. + +So lets go back to hard coding the values, this reverts +commit fa2849e9649b ("iio: adc: axp288: Drop bogus +AXP288_ADC_TS_PIN_CTRL register modifications"), fixing charging not +working on the model tablet in question. + +The exact cause is not fully understood, hence the revert to a known working +state. + +Reported-by: Umberto Ixxo +Signed-off-by: Hans de Goede +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/axp288_adc.c | 32 +++++++++++++++++++++++++++++++- + 1 file changed, 31 insertions(+), 1 deletion(-) + +--- a/drivers/iio/adc/axp288_adc.c ++++ b/drivers/iio/adc/axp288_adc.c +@@ -28,6 +28,8 @@ + #include + + #define AXP288_ADC_EN_MASK 0xF1 ++#define AXP288_ADC_TS_PIN_GPADC 0xF2 ++#define AXP288_ADC_TS_PIN_ON 0xF3 + + enum axp288_adc_id { + AXP288_ADC_TS, +@@ -121,6 +123,16 @@ static int axp288_adc_read_channel(int * + return IIO_VAL_INT; + } + ++static int axp288_adc_set_ts(struct regmap *regmap, unsigned int mode, ++ unsigned long address) ++{ ++ /* channels other than GPADC do not need to switch TS pin */ ++ if (address != AXP288_GP_ADC_H) ++ return 0; ++ ++ return regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, mode); ++} ++ + static int axp288_adc_read_raw(struct iio_dev *indio_dev, + struct iio_chan_spec const *chan, + int *val, int *val2, long mask) +@@ -131,7 +143,16 @@ static int axp288_adc_read_raw(struct ii + mutex_lock(&indio_dev->mlock); + switch (mask) { + case IIO_CHAN_INFO_RAW: ++ if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_GPADC, ++ chan->address)) { ++ dev_err(&indio_dev->dev, "GPADC mode\n"); ++ ret = -EINVAL; ++ break; ++ } + ret = axp288_adc_read_channel(val, chan->address, info->regmap); ++ if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_ON, ++ chan->address)) ++ dev_err(&indio_dev->dev, "TS pin restore\n"); + break; + default: + ret = -EINVAL; +@@ -141,6 +162,15 @@ static int axp288_adc_read_raw(struct ii + return ret; + } + ++static int axp288_adc_set_state(struct regmap *regmap) ++{ ++ /* ADC should be always enabled for internal FG to function */ ++ if (regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON)) ++ return -EIO; ++ ++ return regmap_write(regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK); ++} ++ + static const struct iio_info axp288_adc_iio_info = { + .read_raw = &axp288_adc_read_raw, + .driver_module = THIS_MODULE, +@@ -169,7 +199,7 @@ static int axp288_adc_probe(struct platf + * Set ADC to enabled state at all time, including system suspend. + * otherwise internal fuel gauge functionality may be affected. + */ +- ret = regmap_write(info->regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK); ++ ret = axp288_adc_set_state(axp20x->regmap); + if (ret) { + dev_err(&pdev->dev, "unable to enable ADC device\n"); + return ret; diff --git a/queue-4.12/iio-aspeed-adc-wait-for-initial-sequence.patch b/queue-4.12/iio-aspeed-adc-wait-for-initial-sequence.patch new file mode 100644 index 00000000000..8b058a94801 --- /dev/null +++ b/queue-4.12/iio-aspeed-adc-wait-for-initial-sequence.patch @@ -0,0 +1,92 @@ +From 737cc2a593782df6846b3cab7e0f64384f58364a Mon Sep 17 00:00:00 2001 +From: Mykola Kostenok +Date: Mon, 17 Jul 2017 12:00:35 +0300 +Subject: iio: aspeed-adc: wait for initial sequence. + +From: Mykola Kostenok + +commit 737cc2a593782df6846b3cab7e0f64384f58364a upstream. + +This patch enables adc engine at initialization time and waits +for the initial sequence completion before enabling adc channels. + +Without this code adc channels are not functional and shows +zeros for all connected channels. + +Tested on mellanox msn platform. + +v1 -> v2: +Pointed by Rick Altherr: + - Wait init sequence code enabled by bool +from OF match table. + +Signed-off-by: Mykola Kostenok +Reviewed-by: Rick Altherr +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/aspeed_adc.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +--- a/drivers/iio/adc/aspeed_adc.c ++++ b/drivers/iio/adc/aspeed_adc.c +@@ -22,6 +22,7 @@ + + #include + #include ++#include + + #define ASPEED_RESOLUTION_BITS 10 + #define ASPEED_CLOCKS_PER_SAMPLE 12 +@@ -38,11 +39,17 @@ + + #define ASPEED_ENGINE_ENABLE BIT(0) + ++#define ASPEED_ADC_CTRL_INIT_RDY BIT(8) ++ ++#define ASPEED_ADC_INIT_POLLING_TIME 500 ++#define ASPEED_ADC_INIT_TIMEOUT 500000 ++ + struct aspeed_adc_model_data { + const char *model_name; + unsigned int min_sampling_rate; // Hz + unsigned int max_sampling_rate; // Hz + unsigned int vref_voltage; // mV ++ bool wait_init_sequence; + }; + + struct aspeed_adc_data { +@@ -211,6 +218,24 @@ static int aspeed_adc_probe(struct platf + goto scaler_error; + } + ++ model_data = of_device_get_match_data(&pdev->dev); ++ ++ if (model_data->wait_init_sequence) { ++ /* Enable engine in normal mode. */ ++ writel(ASPEED_OPERATION_MODE_NORMAL | ASPEED_ENGINE_ENABLE, ++ data->base + ASPEED_REG_ENGINE_CONTROL); ++ ++ /* Wait for initial sequence complete. */ ++ ret = readl_poll_timeout(data->base + ASPEED_REG_ENGINE_CONTROL, ++ adc_engine_control_reg_val, ++ adc_engine_control_reg_val & ++ ASPEED_ADC_CTRL_INIT_RDY, ++ ASPEED_ADC_INIT_POLLING_TIME, ++ ASPEED_ADC_INIT_TIMEOUT); ++ if (ret) ++ goto scaler_error; ++ } ++ + /* Start all channels in normal mode. */ + clk_prepare_enable(data->clk_scaler->clk); + adc_engine_control_reg_val = GENMASK(31, 16) | +@@ -270,6 +295,7 @@ static const struct aspeed_adc_model_dat + .vref_voltage = 1800, // mV + .min_sampling_rate = 1, + .max_sampling_rate = 1000000, ++ .wait_init_sequence = true, + }; + + static const struct of_device_id aspeed_adc_matches[] = { diff --git a/queue-4.12/iio-light-tsl2563-use-correct-event-code.patch b/queue-4.12/iio-light-tsl2563-use-correct-event-code.patch new file mode 100644 index 00000000000..424e8c38b0f --- /dev/null +++ b/queue-4.12/iio-light-tsl2563-use-correct-event-code.patch @@ -0,0 +1,39 @@ +From a3507e48d3f99a93a3056a34a5365f310434570f Mon Sep 17 00:00:00 2001 +From: Akinobu Mita +Date: Wed, 21 Jun 2017 01:46:37 +0900 +Subject: iio: light: tsl2563: use correct event code + +From: Akinobu Mita + +commit a3507e48d3f99a93a3056a34a5365f310434570f upstream. + +The TSL2563 driver provides three iio channels, two of which are raw ADC +channels (channel 0 and channel 1) in the device and the remaining one +is calculated by the two. The ADC channel 0 only supports programmable +interrupt with threshold settings and this driver supports the event but +the generated event code does not contain the corresponding iio channel +type. + +This is going to change userspace ABI. Hopefully fixing this to be +what it should always have been won't break any userspace code. + +Cc: Jonathan Cameron +Signed-off-by: Akinobu Mita +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/light/tsl2563.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/light/tsl2563.c ++++ b/drivers/iio/light/tsl2563.c +@@ -626,7 +626,7 @@ static irqreturn_t tsl2563_event_handler + struct tsl2563_chip *chip = iio_priv(dev_info); + + iio_push_event(dev_info, +- IIO_UNMOD_EVENT_CODE(IIO_LIGHT, ++ IIO_UNMOD_EVENT_CODE(IIO_INTENSITY, + 0, + IIO_EV_TYPE_THRESH, + IIO_EV_DIR_EITHER), diff --git a/queue-4.12/iio-pressure-st_pressure_core-disable-multiread-by-default-for-lps22hb.patch b/queue-4.12/iio-pressure-st_pressure_core-disable-multiread-by-default-for-lps22hb.patch new file mode 100644 index 00000000000..ae853265854 --- /dev/null +++ b/queue-4.12/iio-pressure-st_pressure_core-disable-multiread-by-default-for-lps22hb.patch @@ -0,0 +1,34 @@ +From add6e6ab3ee0e237822e0951476d3df039b49ec8 Mon Sep 17 00:00:00 2001 +From: Lorenzo Bianconi +Date: Thu, 22 Jun 2017 19:46:43 +0200 +Subject: iio: pressure: st_pressure_core: disable multiread by default for LPS22HB + +From: Lorenzo Bianconi + +commit add6e6ab3ee0e237822e0951476d3df039b49ec8 upstream. + +Set multiread variable to false for LPS22HB pressure sensor since +it is already enabled in CTRL_REG2. Previous configuration does not +cause any issue in I2C communication since SUB Msb has no meaning +whereas it breaks register address in SPI communication + +Fixes: e039e2f5b4da (iio:st_pressure:initial lps22hb sensor support) +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/pressure/st_pressure_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/pressure/st_pressure_core.c ++++ b/drivers/iio/pressure/st_pressure_core.c +@@ -456,7 +456,7 @@ static const struct st_sensor_settings s + .mask_od = 0x40, + .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR, + }, +- .multi_read_bit = true, ++ .multi_read_bit = false, + .bootime = 2, + }, + }; diff --git a/queue-4.12/iscsi-target-fix-iscsi_np-reset-hung-task-during-parallel-delete.patch b/queue-4.12/iscsi-target-fix-iscsi_np-reset-hung-task-during-parallel-delete.patch new file mode 100644 index 00000000000..f77594f1069 --- /dev/null +++ b/queue-4.12/iscsi-target-fix-iscsi_np-reset-hung-task-during-parallel-delete.patch @@ -0,0 +1,111 @@ +From 978d13d60c34818a41fc35962602bdfa5c03f214 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Fri, 4 Aug 2017 23:59:31 -0700 +Subject: iscsi-target: Fix iscsi_np reset hung task during parallel delete + +From: Nicholas Bellinger + +commit 978d13d60c34818a41fc35962602bdfa5c03f214 upstream. + +This patch fixes a bug associated with iscsit_reset_np_thread() +that can occur during parallel configfs rmdir of a single iscsi_np +used across multiple iscsi-target instances, that would result in +hung task(s) similar to below where configfs rmdir process context +was blocked indefinately waiting for iscsi_np->np_restart_comp +to finish: + +[ 6726.112076] INFO: task dcp_proxy_node_:15550 blocked for more than 120 seconds. +[ 6726.119440] Tainted: G W O 4.1.26-3321 #2 +[ 6726.125045] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 6726.132927] dcp_proxy_node_ D ffff8803f202bc88 0 15550 1 0x00000000 +[ 6726.140058] ffff8803f202bc88 ffff88085c64d960 ffff88083b3b1ad0 ffff88087fffeb08 +[ 6726.147593] ffff8803f202c000 7fffffffffffffff ffff88083f459c28 ffff88083b3b1ad0 +[ 6726.155132] ffff88035373c100 ffff8803f202bca8 ffffffff8168ced2 ffff8803f202bcb8 +[ 6726.162667] Call Trace: +[ 6726.165150] [] schedule+0x32/0x80 +[ 6726.170156] [] schedule_timeout+0x214/0x290 +[ 6726.176030] [] ? __send_signal+0x52/0x4a0 +[ 6726.181728] [] wait_for_completion+0x96/0x100 +[ 6726.187774] [] ? wake_up_state+0x10/0x10 +[ 6726.193395] [] iscsit_reset_np_thread+0x62/0xe0 [iscsi_target_mod] +[ 6726.201278] [] iscsit_tpg_disable_portal_group+0x96/0x190 [iscsi_target_mod] +[ 6726.210033] [] lio_target_tpg_store_enable+0x4f/0xc0 [iscsi_target_mod] +[ 6726.218351] [] configfs_write_file+0xaa/0x110 +[ 6726.224392] [] vfs_write+0xa4/0x1b0 +[ 6726.229576] [] SyS_write+0x41/0xb0 +[ 6726.234659] [] system_call_fastpath+0x12/0x71 + +It would happen because each iscsit_reset_np_thread() sets state +to ISCSI_NP_THREAD_RESET, sends SIGINT, and then blocks waiting +for completion on iscsi_np->np_restart_comp. + +However, if iscsi_np was active processing a login request and +more than a single iscsit_reset_np_thread() caller to the same +iscsi_np was blocked on iscsi_np->np_restart_comp, iscsi_np +kthread process context in __iscsi_target_login_thread() would +flush pending signals and only perform a single completion of +np->np_restart_comp before going back to sleep within transport +specific iscsit_transport->iscsi_accept_np code. + +To address this bug, add a iscsi_np->np_reset_count and update +__iscsi_target_login_thread() to keep completing np->np_restart_comp +until ->np_reset_count has reached zero. + +Reported-by: Gary Guo +Tested-by: Gary Guo +Cc: Mike Christie +Cc: Hannes Reinecke +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target.c | 1 + + drivers/target/iscsi/iscsi_target_login.c | 7 +++++-- + include/target/iscsi/iscsi_target_core.h | 1 + + 3 files changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -418,6 +418,7 @@ int iscsit_reset_np_thread( + return 0; + } + np->np_thread_state = ISCSI_NP_THREAD_RESET; ++ atomic_inc(&np->np_reset_count); + + if (np->np_thread) { + spin_unlock_bh(&np->np_thread_lock); +--- a/drivers/target/iscsi/iscsi_target_login.c ++++ b/drivers/target/iscsi/iscsi_target_login.c +@@ -1237,9 +1237,11 @@ static int __iscsi_target_login_thread(s + flush_signals(current); + + spin_lock_bh(&np->np_thread_lock); +- if (np->np_thread_state == ISCSI_NP_THREAD_RESET) { ++ if (atomic_dec_if_positive(&np->np_reset_count) >= 0) { + np->np_thread_state = ISCSI_NP_THREAD_ACTIVE; ++ spin_unlock_bh(&np->np_thread_lock); + complete(&np->np_restart_comp); ++ return 1; + } else if (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN) { + spin_unlock_bh(&np->np_thread_lock); + goto exit; +@@ -1272,7 +1274,8 @@ static int __iscsi_target_login_thread(s + goto exit; + } else if (rc < 0) { + spin_lock_bh(&np->np_thread_lock); +- if (np->np_thread_state == ISCSI_NP_THREAD_RESET) { ++ if (atomic_dec_if_positive(&np->np_reset_count) >= 0) { ++ np->np_thread_state = ISCSI_NP_THREAD_ACTIVE; + spin_unlock_bh(&np->np_thread_lock); + complete(&np->np_restart_comp); + iscsit_put_transport(conn->conn_transport); +--- a/include/target/iscsi/iscsi_target_core.h ++++ b/include/target/iscsi/iscsi_target_core.h +@@ -787,6 +787,7 @@ struct iscsi_np { + int np_sock_type; + enum np_thread_state_table np_thread_state; + bool enabled; ++ atomic_t np_reset_count; + enum iscsi_timer_flags_table np_login_timer_flags; + u32 np_exports; + enum np_flags_table np_flags; diff --git a/queue-4.12/iscsi-target-fix-memory-leak-in-iscsit_setup_text_cmd.patch b/queue-4.12/iscsi-target-fix-memory-leak-in-iscsit_setup_text_cmd.patch new file mode 100644 index 00000000000..be574b2334e --- /dev/null +++ b/queue-4.12/iscsi-target-fix-memory-leak-in-iscsit_setup_text_cmd.patch @@ -0,0 +1,43 @@ +From ea8dc5b4cd2195ee582cae28afa4164c6dea1738 Mon Sep 17 00:00:00 2001 +From: Varun Prakash +Date: Sun, 23 Jul 2017 20:03:33 +0530 +Subject: iscsi-target: fix memory leak in iscsit_setup_text_cmd() + +From: Varun Prakash + +commit ea8dc5b4cd2195ee582cae28afa4164c6dea1738 upstream. + +On receiving text request iscsi-target allocates buffer for +payload in iscsit_handle_text_cmd() and assigns buffer pointer +to cmd->text_in_ptr, this buffer is currently freed in +iscsit_release_cmd(), if iscsi-target sets 'C' bit in text +response then it will receive another text request from the +initiator with ttt != 0xffffffff in this case iscsi-target +will find cmd using itt and call iscsit_setup_text_cmd() +which will set cmd->text_in_ptr to NULL without freeing +previously allocated buffer. + +This patch fixes this issue by calling kfree(cmd->text_in_ptr) +in iscsit_setup_text_cmd() before assigning NULL to it. + +For the first text request cmd->text_in_ptr is NULL as +cmd is memset to 0 in iscsit_allocate_cmd(). + +Signed-off-by: Varun Prakash +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -2173,6 +2173,7 @@ iscsit_setup_text_cmd(struct iscsi_conn + cmd->cmd_sn = be32_to_cpu(hdr->cmdsn); + cmd->exp_stat_sn = be32_to_cpu(hdr->exp_statsn); + cmd->data_direction = DMA_NONE; ++ kfree(cmd->text_in_ptr); + cmd->text_in_ptr = NULL; + + return 0; diff --git a/queue-4.12/mmc-mmc-correct-the-logic-for-setting-hs400es-signal-voltage.patch b/queue-4.12/mmc-mmc-correct-the-logic-for-setting-hs400es-signal-voltage.patch new file mode 100644 index 00000000000..0bcd92e5bea --- /dev/null +++ b/queue-4.12/mmc-mmc-correct-the-logic-for-setting-hs400es-signal-voltage.patch @@ -0,0 +1,34 @@ +From 92ddd95919466de5d34f3cb43635da9a7f9ab814 Mon Sep 17 00:00:00 2001 +From: Haibo Chen +Date: Tue, 8 Aug 2017 18:54:01 +0800 +Subject: mmc: mmc: correct the logic for setting HS400ES signal voltage + +From: Haibo Chen + +commit 92ddd95919466de5d34f3cb43635da9a7f9ab814 upstream. + +Change the default err value to -EINVAL, make sure the card only +has type EXT_CSD_CARD_TYPE_HS400_1_8V also do the signal voltage +setting when select hs400es mode. + +Fixes: commit 1720d3545b77 ("mmc: core: switch to 1V8 or 1V2 for hs400es mode") +Signed-off-by: Haibo Chen +Reviewed-by: Shawn Lin +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/core/mmc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/core/mmc.c ++++ b/drivers/mmc/core/mmc.c +@@ -1288,7 +1288,7 @@ out_err: + static int mmc_select_hs400es(struct mmc_card *card) + { + struct mmc_host *host = card->host; +- int err = 0; ++ int err = -EINVAL; + u8 val; + + if (!(host->caps & MMC_CAP_8_BIT_DATA)) { diff --git a/queue-4.12/mtd-nand-atmel-fix-dt-backward-compatibility-in-pmecc.c.patch b/queue-4.12/mtd-nand-atmel-fix-dt-backward-compatibility-in-pmecc.c.patch new file mode 100644 index 00000000000..5e4530767d6 --- /dev/null +++ b/queue-4.12/mtd-nand-atmel-fix-dt-backward-compatibility-in-pmecc.c.patch @@ -0,0 +1,62 @@ +From 3aa0907675a38498d8f2d343e94207ad28a117cf Mon Sep 17 00:00:00 2001 +From: Boris Brezillon +Date: Mon, 17 Jul 2017 20:20:08 +0200 +Subject: mtd: nand: atmel: Fix DT backward compatibility in pmecc.c + +From: Boris Brezillon + +commit 3aa0907675a38498d8f2d343e94207ad28a117cf upstream. + +PMECC caps extraction from old DT bindings is broken, thus leading to +erroneous EL registers offset, which in turn make HW ECC unusable on +sama5d2 when old bindings are in use. + +Passing the NAND dev node instead of the NFC node to of_match_node() +solves the problem. + +Signed-off-by: Boris Brezillon +Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") +Tested-by: Romain Izard +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/nand/atmel/pmecc.c | 21 ++++++--------------- + 1 file changed, 6 insertions(+), 15 deletions(-) + +--- a/drivers/mtd/nand/atmel/pmecc.c ++++ b/drivers/mtd/nand/atmel/pmecc.c +@@ -945,6 +945,7 @@ struct atmel_pmecc *devm_atmel_pmecc_get + */ + struct platform_device *pdev = to_platform_device(userdev); + const struct atmel_pmecc_caps *caps; ++ const struct of_device_id *match; + + /* No PMECC engine available. */ + if (!of_property_read_bool(userdev->of_node, +@@ -953,21 +954,11 @@ struct atmel_pmecc *devm_atmel_pmecc_get + + caps = &at91sam9g45_caps; + +- /* +- * Try to find the NFC subnode and extract the associated caps +- * from there. +- */ +- np = of_find_compatible_node(userdev->of_node, NULL, +- "atmel,sama5d3-nfc"); +- if (np) { +- const struct of_device_id *match; +- +- match = of_match_node(atmel_pmecc_legacy_match, np); +- if (match && match->data) +- caps = match->data; +- +- of_node_put(np); +- } ++ /* Find the caps associated to the NAND dev node. */ ++ match = of_match_node(atmel_pmecc_legacy_match, ++ userdev->of_node); ++ if (match && match->data) ++ caps = match->data; + + pmecc = atmel_pmecc_create(pdev, caps, 1, 2); + } diff --git a/queue-4.12/mtd-nand-declare-tbers-tr-and-tprog-as-u64-to-avoid-integer-overflow.patch b/queue-4.12/mtd-nand-declare-tbers-tr-and-tprog-as-u64-to-avoid-integer-overflow.patch new file mode 100644 index 00000000000..8755fbfaa63 --- /dev/null +++ b/queue-4.12/mtd-nand-declare-tbers-tr-and-tprog-as-u64-to-avoid-integer-overflow.patch @@ -0,0 +1,56 @@ +From 6d29231000bbe0fb9e4893a9c68151ffdd3b5469 Mon Sep 17 00:00:00 2001 +From: Boris Brezillon +Date: Mon, 31 Jul 2017 10:31:27 +0200 +Subject: mtd: nand: Declare tBERS, tR and tPROG as u64 to avoid integer overflow + +From: Boris Brezillon + +commit 6d29231000bbe0fb9e4893a9c68151ffdd3b5469 upstream. + +All timings in nand_sdr_timings are expressed in picoseconds but some +of them may not fit in an u32. + +Signed-off-by: Boris Brezillon +Fixes: 204e7ecd47e2 ("mtd: nand: Add a few more timings to nand_sdr_timings") +Reported-by: Alexander Dahl +Reviewed-by: Alexander Dahl +Tested-by: Alexander Dahl +Signed-off-by: Boris Brezillon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/nand/nand_timings.c | 6 +++--- + include/linux/mtd/nand.h | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/mtd/nand/nand_timings.c ++++ b/drivers/mtd/nand/nand_timings.c +@@ -311,9 +311,9 @@ int onfi_init_data_interface(struct nand + struct nand_sdr_timings *timings = &iface->timings.sdr; + + /* microseconds -> picoseconds */ +- timings->tPROG_max = 1000000UL * le16_to_cpu(params->t_prog); +- timings->tBERS_max = 1000000UL * le16_to_cpu(params->t_bers); +- timings->tR_max = 1000000UL * le16_to_cpu(params->t_r); ++ timings->tPROG_max = 1000000ULL * le16_to_cpu(params->t_prog); ++ timings->tBERS_max = 1000000ULL * le16_to_cpu(params->t_bers); ++ timings->tR_max = 1000000ULL * le16_to_cpu(params->t_r); + + /* nanoseconds -> picoseconds */ + timings->tCCS_min = 1000UL * le16_to_cpu(params->t_ccs); +--- a/include/linux/mtd/nand.h ++++ b/include/linux/mtd/nand.h +@@ -638,10 +638,10 @@ struct nand_buffers { + * @tWW_min: WP# transition to WE# low + */ + struct nand_sdr_timings { +- u32 tBERS_max; ++ u64 tBERS_max; + u32 tCCS_min; +- u32 tPROG_max; +- u32 tR_max; ++ u64 tPROG_max; ++ u64 tR_max; + u32 tALH_min; + u32 tADL_min; + u32 tALS_min; diff --git a/queue-4.12/mtd-nand-fix-timing-setup-for-nands-that-do-not-support-set-features.patch b/queue-4.12/mtd-nand-fix-timing-setup-for-nands-that-do-not-support-set-features.patch new file mode 100644 index 00000000000..3fc29e5ee08 --- /dev/null +++ b/queue-4.12/mtd-nand-fix-timing-setup-for-nands-that-do-not-support-set-features.patch @@ -0,0 +1,40 @@ +From a11bf5ed951f8900d244d09eb03a888b59c7fc82 Mon Sep 17 00:00:00 2001 +From: Boris Brezillon +Date: Mon, 31 Jul 2017 10:29:56 +0200 +Subject: mtd: nand: Fix timing setup for NANDs that do not support SET FEATURES + +From: Boris Brezillon + +commit a11bf5ed951f8900d244d09eb03a888b59c7fc82 upstream. + +Some ONFI NANDs do not support the SET/GET FEATURES commands, which, +according to the spec, is perfectly valid. + +On these NANDs we can't set a specific timing mode using the "timing +mode" feature, and we should assume the NAND does not require any setup +to enter a specific timing mode. + +Signed-off-by: Boris Brezillon +Fixes: d8e725dd8311 ("mtd: nand: automate NAND timings selection") +Reported-by: Alexander Dahl +Tested-by: Alexander Dahl +Signed-off-by: Boris Brezillon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/nand/nand_base.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/mtd/nand/nand_base.c ++++ b/drivers/mtd/nand/nand_base.c +@@ -1102,7 +1102,9 @@ static int nand_setup_data_interface(str + * Ensure the timing mode has been changed on the chip side + * before changing timings on the controller side. + */ +- if (chip->onfi_version) { ++ if (chip->onfi_version && ++ (le16_to_cpu(chip->onfi_params.opt_cmd) & ++ ONFI_OPT_CMD_SET_GET_FEATURES)) { + u8 tmode_param[ONFI_SUBFEATURE_PARAM_LEN] = { + chip->onfi_timing_mode_default, + }; diff --git a/queue-4.12/nand-fix-wrong-default-oob-layout-for-small-pages-using-soft-ecc.patch b/queue-4.12/nand-fix-wrong-default-oob-layout-for-small-pages-using-soft-ecc.patch new file mode 100644 index 00000000000..d3c3c1b1007 --- /dev/null +++ b/queue-4.12/nand-fix-wrong-default-oob-layout-for-small-pages-using-soft-ecc.patch @@ -0,0 +1,67 @@ +From f7f8c1756e9a5f1258a7cc6b663f8451b724900f Mon Sep 17 00:00:00 2001 +From: Miquel Raynal +Date: Wed, 5 Jul 2017 08:51:09 +0200 +Subject: nand: fix wrong default oob layout for small pages using soft ecc + +From: Miquel Raynal + +commit f7f8c1756e9a5f1258a7cc6b663f8451b724900f upstream. + +When using soft ecc, if no ooblayout is given, the core automatically +uses one of the nand_ooblayout_{sp,lp}*() functions to determine the +layout inside the out of band data. + +Until kernel version 4.6, struct nand_ecclayout was used for that +purpose. During the migration from 4.6 to 4.7, an error shown up in the +small page layout, in the case oob section is only 8 bytes long. + +The layout was using three bytes (0, 1, 2) for ecc, two bytes (3, 4) +as free bytes, one byte (5) for bad block marker and finally +two bytes (6, 7) as free bytes, as shown there: + +[linux-4.6] drivers/mtd/nand/nand_base.c:52 +static struct nand_ecclayout nand_oob_8 = { + .eccbytes = 3, + .eccpos = {0, 1, 2}, + .oobfree = { + {.offset = 3, + .length = 2}, + {.offset = 6, + .length = 2} } +}; + +This fixes the current implementation which is incoherent. It +references bit 3 at the same time as an ecc byte and a free byte. + +Furthermore, it is clear with the previous implementation that there +is only one ecc section with 8 bytes oob sections. We shall return +-ERANGE in the nand_ooblayout_ecc_sp() function when asked for the +second section. + +Signed-off-by: Miquel Raynal +Fixes: 41b207a70d3a ("mtd: nand: implement the default mtd_ooblayout_ops") +Signed-off-by: Boris Brezillon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/nand/nand_base.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/mtd/nand/nand_base.c ++++ b/drivers/mtd/nand/nand_base.c +@@ -65,8 +65,14 @@ static int nand_ooblayout_ecc_sp(struct + + if (!section) { + oobregion->offset = 0; +- oobregion->length = 4; ++ if (mtd->oobsize == 16) ++ oobregion->length = 4; ++ else ++ oobregion->length = 3; + } else { ++ if (mtd->oobsize == 8) ++ return -ERANGE; ++ + oobregion->offset = 6; + oobregion->length = ecc->total - 4; + } diff --git a/queue-4.12/nfs-flexfiles-fix-leak-of-nfs4_ff_ds_version-arrays.patch b/queue-4.12/nfs-flexfiles-fix-leak-of-nfs4_ff_ds_version-arrays.patch new file mode 100644 index 00000000000..15f4bbd2bfe --- /dev/null +++ b/queue-4.12/nfs-flexfiles-fix-leak-of-nfs4_ff_ds_version-arrays.patch @@ -0,0 +1,30 @@ +From 1feb26162bee7b2f110facfec71b5c7bdbc7d14d Mon Sep 17 00:00:00 2001 +From: Weston Andros Adamson +Date: Tue, 1 Aug 2017 16:25:01 -0400 +Subject: nfs/flexfiles: fix leak of nfs4_ff_ds_version arrays + +From: Weston Andros Adamson + +commit 1feb26162bee7b2f110facfec71b5c7bdbc7d14d upstream. + +The client was freeing the nfs4_ff_layout_ds, but not the contained +nfs4_ff_ds_version array. + +Signed-off-by: Weston Andros Adamson +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/flexfilelayout/flexfilelayoutdev.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c ++++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c +@@ -32,6 +32,7 @@ void nfs4_ff_layout_free_deviceid(struct + { + nfs4_print_deviceid(&mirror_ds->id_node.deviceid); + nfs4_pnfs_ds_put(mirror_ds->ds); ++ kfree(mirror_ds->ds_versions); + kfree_rcu(mirror_ds, id_node.rcu); + } + diff --git a/queue-4.12/pinctrl-armada-37xx-fix-number-of-pin-in-south-bridge.patch b/queue-4.12/pinctrl-armada-37xx-fix-number-of-pin-in-south-bridge.patch new file mode 100644 index 00000000000..03300c7d0f0 --- /dev/null +++ b/queue-4.12/pinctrl-armada-37xx-fix-number-of-pin-in-south-bridge.patch @@ -0,0 +1,82 @@ +From 6b67c3906cd74d88da4f6717b4b294bd52fce56a Mon Sep 17 00:00:00 2001 +From: Gregory CLEMENT +Date: Tue, 1 Aug 2017 17:57:20 +0200 +Subject: pinctrl: armada-37xx: Fix number of pin in south bridge + +From: Gregory CLEMENT + +commit 6b67c3906cd74d88da4f6717b4b294bd52fce56a upstream. + +On the south bridge we have pin from to 29, so it gives 30 pins (and not +29). + +Without this patch the kernel complain with the following traces: +cat /sys/kernel/debug/pinctrl/d0018800.pinctrl/pingroups +[ 154.530205] armada-37xx-pinctrl d0018800.pinctrl: failed to get pin(29) name +[ 154.537567] ------------[ cut here ]------------ +[ 154.542348] WARNING: CPU: 1 PID: 1347 at /home/gclement/open/kernel/marvell-mainline-linux/drivers/pinctrl/core.c:1610 pinctrl_groups_show+0x15c/0x1a0 +[ 154.555918] Modules linked in: +[ 154.558890] CPU: 1 PID: 1347 Comm: cat Tainted: G W 4.13.0-rc1-00001-g19e1b9fa219d #525 +[ 154.568316] Hardware name: Marvell Armada 3720 Development Board DB-88F3720-DDR3 (DT) +[ 154.576311] task: ffff80001d32d100 task.stack: ffff80001bdc0000 +[ 154.583048] PC is at pinctrl_groups_show+0x15c/0x1a0 +[ 154.587816] LR is at pinctrl_groups_show+0x148/0x1a0 +[ 154.592847] pc : [] lr : [] pstate: 00000145 +[ 154.600840] sp : ffff80001bdc3c80 +[ 154.604255] x29: ffff80001bdc3c80 x28: 00000000f7750000 +[ 154.609825] x27: ffff80001d05d198 x26: 0000000000000009 +[ 154.615224] x25: ffff0000089ead20 x24: 0000000000000002 +[ 154.620705] x23: ffff000008c8e1d0 x22: ffff80001be55700 +[ 154.626187] x21: ffff80001d05d100 x20: 0000000000000005 +[ 154.631667] x19: 0000000000000006 x18: 0000000000000010 +[ 154.637238] x17: 0000000000000000 x16: ffff0000081fc4b8 +[ 154.642726] x15: 0000000000000006 x14: ffff0000899e537f +[ 154.648214] x13: ffff0000099e538d x12: 206f742064656c69 +[ 154.653613] x11: 6166203a6c727463 x10: 0000000005f5e0ff +[ 154.659094] x9 : ffff80001bdc38c0 x8 : 286e697020746567 +[ 154.664576] x7 : ffff000008551870 x6 : 000000000000011b +[ 154.670146] x5 : 0000000000000000 x4 : 0000000000000000 +[ 154.675544] x3 : 0000000000000000 x2 : 0000000000000000 +[ 154.681025] x1 : ffff000008c8e1d0 x0 : ffff80001be55700 +[ 154.686507] Call trace: +[ 154.688668] Exception stack(0xffff80001bdc3ab0 to 0xffff80001bdc3be0) +[ 154.695224] 3aa0: 0000000000000006 0001000000000000 +[ 154.703310] 3ac0: ffff80001bdc3c80 ffff0000083e3adc ffff80001bdc3bb0 00000000ffffffd8 +[ 154.711304] 3ae0: 4554535953425553 6f6674616c703d4d 4349564544006d72 6674616c702b3d45 +[ 154.719478] 3b00: 313030643a6d726f 6e69702e30303838 ffff80006c727463 ffff0000089635d8 +[ 154.727562] 3b20: ffff80001d1ca0cb ffff000008af0fa4 ffff80001bdc3b40 ffff000008c8e1dc +[ 154.735648] 3b40: ffff80001bdc3bc0 ffff000008223174 ffff80001be55700 ffff000008c8e1d0 +[ 154.743731] 3b60: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +[ 154.752354] 3b80: 000000000000011b ffff000008551870 286e697020746567 ffff80001bdc38c0 +[ 154.760446] 3ba0: 0000000005f5e0ff 6166203a6c727463 206f742064656c69 ffff0000099e538d +[ 154.767910] 3bc0: ffff0000899e537f 0000000000000006 ffff0000081fc4b8 0000000000000000 +[ 154.776085] [] pinctrl_groups_show+0x15c/0x1a0 +[ 154.782823] [] seq_read+0x184/0x460 +[ 154.787505] [] full_proxy_read+0x60/0xa8 +[ 154.793431] [] __vfs_read+0x1c/0x110 +[ 154.799001] [] vfs_read+0x84/0x140 +[ 154.803860] [] SyS_read+0x44/0xa0 +[ 154.808983] [] el0_svc_naked+0x24/0x28 +[ 154.814459] ---[ end trace 4cbb00a92d616b95 ]--- + +Fixes: 87466ccd9401 ("pinctrl: armada-37xx: Add pin controller support +for Armada 37xx") +Signed-off-by: Gregory CLEMENT +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c +@@ -176,7 +176,7 @@ const struct armada_37xx_pin_data armada + }; + + const struct armada_37xx_pin_data armada_37xx_pin_sb = { +- .nr_pins = 29, ++ .nr_pins = 30, + .name = "GPIO2", + .groups = armada_37xx_sb_groups, + .ngroups = ARRAY_SIZE(armada_37xx_sb_groups), diff --git a/queue-4.12/series b/queue-4.12/series index 257dcd53558..191ce228d7a 100644 --- a/queue-4.12/series +++ b/queue-4.12/series @@ -1,3 +1,47 @@ mm-ratelimit-pfns-busy-info-message.patch mm-fix-list-corruptions-on-shmem-shrinklist.patch futex-remove-unnecessary-warning-from-get_futex_key.patch +xtensa-fix-cache-aliasing-handling-code-for-wt-cache.patch +xtensa-mm-cache-add-missing-export_symbols.patch +xtensa-don-t-limit-csum_partial-export-by-config_net.patch +xfs-fix-leak-of-discard-bio.patch +pinctrl-armada-37xx-fix-number-of-pin-in-south-bridge.patch +mtd-nand-atmel-fix-dt-backward-compatibility-in-pmecc.c.patch +mtd-nand-fix-timing-setup-for-nands-that-do-not-support-set-features.patch +mtd-nand-declare-tbers-tr-and-tprog-as-u64-to-avoid-integer-overflow.patch +iscsi-target-fix-memory-leak-in-iscsit_setup_text_cmd.patch +iscsi-target-fix-iscsi_np-reset-hung-task-during-parallel-delete.patch +usb-storage-fix-deadlock-involving-host-lock-and-scsi_done.patch +target-fix-node_acl-demo-mode-uncached-dynamic-shutdown-regression.patch +fuse-initialize-the-flock-flag-in-fuse_file-on-allocation.patch +i2c-designware-some-broken-dstds-use-1mihz-instead-of-1mhz.patch +nand-fix-wrong-default-oob-layout-for-small-pages-using-soft-ecc.patch +mmc-mmc-correct-the-logic-for-setting-hs400es-signal-voltage.patch +nfs-flexfiles-fix-leak-of-nfs4_ff_ds_version-arrays.patch +drm-bridge-tc358767-fix-probe-without-attached-output-node.patch +drm-etnaviv-fix-off-by-one-error-in-reloc-checking.patch +drm-i915-fix-out-of-bounds-array-access-in-bdw_load_gamma_lut.patch +usb-serial-option-add-d-link-dwm-222-device-id.patch +usb-serial-cp210x-add-support-for-qivicon-usb-zigbee-dongle.patch +usb-serial-pl2303-add-new-aten-device-id.patch +usb-musb-fix-tx-fifo-flush-handling-again.patch +usb-hcd-mark-secondary-hcd-as-dead-if-the-primary-one-died.patch +staging-iio-resolver-ad2s1210-fix-negative-iio_angl_vel-read.patch +iio-aspeed-adc-wait-for-initial-sequence.patch +iio-accel-st_accel-add-spi-3wire-support.patch +iio-accel-bmc150-always-restore-device-to-normal-mode-after-suspend-resume.patch +iio-pressure-st_pressure_core-disable-multiread-by-default-for-lps22hb.patch +iio-light-tsl2563-use-correct-event-code.patch +iio-adc-revert-axp288-drop-bogus-axp288_adc_ts_pin_ctrl-register-modifications.patch +staging-comedi-comedi_fops-do-not-call-blocking-ops-when-task_running.patch +uas-add-us_fl_ignore_residue-for-initio-corporation-inic-3069.patch +firmware-fix-batched-requests-wake-all-waiters.patch +firmware-fix-batched-requests-send-wake-up-on-failure-on-direct-lookups.patch +firmware-avoid-invalid-fallback-aborts-by-using-killable-wait.patch +block-make-blk_mq_delay_kick_requeue_list-rerun-the-queue-at-a-quiet-time.patch +usb-gadget-udc-renesas_usb3-fix-usb_gadget_giveback_request-calling.patch +usb-renesas_usbhs-fix-ugctrl2-value-for-r-car-gen3.patch +usb-check-for-dropped-connection-before-switching-to-full-speed.patch +usb-core-unlink-urbs-from-the-tail-of-the-endpoint-s-urb_list.patch +usb-quirks-add-no-lpm-quirk-for-moshi-usb-to-ethernet-adapter.patch +usb-xhci-add-quirk-for-certain-failing-hp-keyboard-on-reset-after-resume.patch diff --git a/queue-4.12/staging-comedi-comedi_fops-do-not-call-blocking-ops-when-task_running.patch b/queue-4.12/staging-comedi-comedi_fops-do-not-call-blocking-ops-when-task_running.patch new file mode 100644 index 00000000000..668f934c9ce --- /dev/null +++ b/queue-4.12/staging-comedi-comedi_fops-do-not-call-blocking-ops-when-task_running.patch @@ -0,0 +1,43 @@ +From cef988642cdac44e910a27cb6e8166c96f86a0df Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Fri, 28 Jul 2017 16:22:31 +0100 +Subject: staging: comedi: comedi_fops: do not call blocking ops when !TASK_RUNNING + +From: Ian Abbott + +commit cef988642cdac44e910a27cb6e8166c96f86a0df upstream. + +Comedi's read and write file operation handlers (`comedi_read()` and +`comedi_write()`) currently call `copy_to_user()` or `copy_from_user()` +whilst in the `TASK_INTERRUPTIBLE` state, which falls foul of the +`might_fault()` checks when enabled. Fix it by setting the current task +state back to `TASK_RUNNING` a bit earlier before calling these +functions. + +Reported-by: Piotr Gregor +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/comedi_fops.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/staging/comedi/comedi_fops.c ++++ b/drivers/staging/comedi/comedi_fops.c +@@ -2396,6 +2396,7 @@ static ssize_t comedi_write(struct file + continue; + } + ++ set_current_state(TASK_RUNNING); + wp = async->buf_write_ptr; + n1 = min(n, async->prealloc_bufsz - wp); + n2 = n - n1; +@@ -2528,6 +2529,8 @@ static ssize_t comedi_read(struct file * + } + continue; + } ++ ++ set_current_state(TASK_RUNNING); + rp = async->buf_read_ptr; + n1 = min(n, async->prealloc_bufsz - rp); + n2 = n - n1; diff --git a/queue-4.12/staging-iio-resolver-ad2s1210-fix-negative-iio_angl_vel-read.patch b/queue-4.12/staging-iio-resolver-ad2s1210-fix-negative-iio_angl_vel-read.patch new file mode 100644 index 00000000000..8fc0526691b --- /dev/null +++ b/queue-4.12/staging-iio-resolver-ad2s1210-fix-negative-iio_angl_vel-read.patch @@ -0,0 +1,38 @@ +From 105967ad68d2eb1a041bc041f9cf96af2a653b65 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Fri, 14 Jul 2017 11:31:03 +0200 +Subject: staging:iio:resolver:ad2s1210 fix negative IIO_ANGL_VEL read + +From: Arnd Bergmann + +commit 105967ad68d2eb1a041bc041f9cf96af2a653b65 upstream. + +gcc-7 points out an older regression: + +drivers/staging/iio/resolver/ad2s1210.c: In function 'ad2s1210_read_raw': +drivers/staging/iio/resolver/ad2s1210.c:515:42: error: '<<' in boolean context, did you mean '<' ? [-Werror=int-in-bool-context] + +The original code had 'unsigned short' here, but incorrectly got +converted to 'bool'. This reverts the regression and uses a normal +type instead. + +Fixes: 29148543c521 ("staging:iio:resolver:ad2s1210 minimal chan spec conversion.") +Signed-off-by: Arnd Bergmann +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/iio/resolver/ad2s1210.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/iio/resolver/ad2s1210.c ++++ b/drivers/staging/iio/resolver/ad2s1210.c +@@ -472,7 +472,7 @@ static int ad2s1210_read_raw(struct iio_ + long m) + { + struct ad2s1210_state *st = iio_priv(indio_dev); +- bool negative; ++ u16 negative; + int ret = 0; + u16 pos; + s16 vel; diff --git a/queue-4.12/target-fix-node_acl-demo-mode-uncached-dynamic-shutdown-regression.patch b/queue-4.12/target-fix-node_acl-demo-mode-uncached-dynamic-shutdown-regression.patch new file mode 100644 index 00000000000..0de3e214ce7 --- /dev/null +++ b/queue-4.12/target-fix-node_acl-demo-mode-uncached-dynamic-shutdown-regression.patch @@ -0,0 +1,116 @@ +From 6f48655facfd7f7ccfe6d252ac0fe319ab02e4dd Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Sun, 6 Aug 2017 16:10:03 -0700 +Subject: target: Fix node_acl demo-mode + uncached dynamic shutdown regression + +From: Nicholas Bellinger + +commit 6f48655facfd7f7ccfe6d252ac0fe319ab02e4dd upstream. + +This patch fixes a generate_node_acls = 1 + cache_dynamic_acls = 0 +regression, that was introduced by + + commit 01d4d673558985d9a118e1e05026633c3e2ade9b + Author: Nicholas Bellinger + Date: Wed Dec 7 12:55:54 2016 -0800 + +which originally had the proper list_del_init() usage, but was +dropped during list review as it was thought unnecessary by HCH. + +However, list_del_init() usage is required during the special +generate_node_acls = 1 + cache_dynamic_acls = 0 case when +transport_free_session() does a list_del(&se_nacl->acl_list), +followed by target_complete_nacl() doing the same thing. + +This was manifesting as a general protection fault as reported +by Justin: + +kernel: general protection fault: 0000 [#1] SMP +kernel: Modules linked in: +kernel: CPU: 0 PID: 11047 Comm: iscsi_ttx Not tainted 4.13.0-rc2.x86_64.1+ #20 +kernel: Hardware name: Intel Corporation S5500BC/S5500BC, BIOS S5500.86B.01.00.0064.050520141428 05/05/2014 +kernel: task: ffff88026939e800 task.stack: ffffc90007884000 +kernel: RIP: 0010:target_put_nacl+0x49/0xb0 +kernel: RSP: 0018:ffffc90007887d70 EFLAGS: 00010246 +kernel: RAX: dead000000000200 RBX: ffff8802556ca000 RCX: 0000000000000000 +kernel: RDX: dead000000000100 RSI: 0000000000000246 RDI: ffff8802556ce028 +kernel: RBP: ffffc90007887d88 R08: 0000000000000001 R09: 0000000000000000 +kernel: R10: ffffc90007887df8 R11: ffffea0009986900 R12: ffff8802556ce020 +kernel: R13: ffff8802556ce028 R14: ffff8802556ce028 R15: ffffffff88d85540 +kernel: FS: 0000000000000000(0000) GS:ffff88027fc00000(0000) knlGS:0000000000000000 +kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +kernel: CR2: 00007fffe36f5f94 CR3: 0000000009209000 CR4: 00000000003406f0 +kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +kernel: DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +kernel: Call Trace: +kernel: transport_free_session+0x67/0x140 +kernel: transport_deregister_session+0x7a/0xc0 +kernel: iscsit_close_session+0x92/0x210 +kernel: iscsit_close_connection+0x5f9/0x840 +kernel: iscsit_take_action_for_connection_exit+0xfe/0x110 +kernel: iscsi_target_tx_thread+0x140/0x1e0 +kernel: ? wait_woken+0x90/0x90 +kernel: kthread+0x124/0x160 +kernel: ? iscsit_thread_get_cpumask+0x90/0x90 +kernel: ? kthread_create_on_node+0x40/0x40 +kernel: ret_from_fork+0x22/0x30 +kernel: Code: 00 48 89 fb 4c 8b a7 48 01 00 00 74 68 4d 8d 6c 24 08 4c +89 ef e8 e8 28 43 00 48 8b 93 20 04 00 00 48 8b 83 28 04 00 00 4c 89 +ef <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 83 20 +kernel: RIP: target_put_nacl+0x49/0xb0 RSP: ffffc90007887d70 +kernel: ---[ end trace f12821adbfd46fed ]--- + +To address this, go ahead and use proper list_del_list() for all +cases of se_nacl->acl_list deletion. + +Reported-by: Justin Maggard +Tested-by: Justin Maggard +Cc: Justin Maggard +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_tpg.c | 4 ++-- + drivers/target/target_core_transport.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/target/target_core_tpg.c ++++ b/drivers/target/target_core_tpg.c +@@ -364,7 +364,7 @@ void core_tpg_del_initiator_node_acl(str + mutex_lock(&tpg->acl_node_mutex); + if (acl->dynamic_node_acl) + acl->dynamic_node_acl = 0; +- list_del(&acl->acl_list); ++ list_del_init(&acl->acl_list); + mutex_unlock(&tpg->acl_node_mutex); + + target_shutdown_sessions(acl); +@@ -548,7 +548,7 @@ int core_tpg_deregister(struct se_portal + * in transport_deregister_session(). + */ + list_for_each_entry_safe(nacl, nacl_tmp, &node_list, acl_list) { +- list_del(&nacl->acl_list); ++ list_del_init(&nacl->acl_list); + + core_tpg_wait_for_nacl_pr_ref(nacl); + core_free_device_list_for_node(nacl, se_tpg); +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -466,7 +466,7 @@ static void target_complete_nacl(struct + } + + mutex_lock(&se_tpg->acl_node_mutex); +- list_del(&nacl->acl_list); ++ list_del_init(&nacl->acl_list); + mutex_unlock(&se_tpg->acl_node_mutex); + + core_tpg_wait_for_nacl_pr_ref(nacl); +@@ -538,7 +538,7 @@ void transport_free_session(struct se_se + spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags); + + if (se_nacl->dynamic_stop) +- list_del(&se_nacl->acl_list); ++ list_del_init(&se_nacl->acl_list); + } + mutex_unlock(&se_tpg->acl_node_mutex); + diff --git a/queue-4.12/uas-add-us_fl_ignore_residue-for-initio-corporation-inic-3069.patch b/queue-4.12/uas-add-us_fl_ignore_residue-for-initio-corporation-inic-3069.patch new file mode 100644 index 00000000000..6d4eae138e4 --- /dev/null +++ b/queue-4.12/uas-add-us_fl_ignore_residue-for-initio-corporation-inic-3069.patch @@ -0,0 +1,41 @@ +From 89f23d51defcb94a5026d4b5da13faf4e1150a6f Mon Sep 17 00:00:00 2001 +From: Alan Swanson +Date: Wed, 26 Jul 2017 12:03:33 +0100 +Subject: uas: Add US_FL_IGNORE_RESIDUE for Initio Corporation INIC-3069 + +From: Alan Swanson + +commit 89f23d51defcb94a5026d4b5da13faf4e1150a6f upstream. + +Similar to commit d595259fbb7a ("usb-storage: Add ignore-residue quirk for +Initio INIC-3619") for INIC-3169 in unusual_devs.h but INIC-3069 already +present in unusual_uas.h. Both in same controller IC family. + +Issue is that MakeMKV fails during key exchange with installed bluray drive +with following error: + +002004:0000 Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED' +occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0' + +Signed-off-by: Alan Swanson +Acked-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_uas.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -124,9 +124,9 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x99 + /* Reported-by: Benjamin Tissoires */ + UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999, + "Initio Corporation", +- "", ++ "INIC-3069", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, +- US_FL_NO_ATA_1X), ++ US_FL_NO_ATA_1X | US_FL_IGNORE_RESIDUE), + + /* Reported-by: Tom Arild Naess */ + UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999, diff --git a/queue-4.12/usb-check-for-dropped-connection-before-switching-to-full-speed.patch b/queue-4.12/usb-check-for-dropped-connection-before-switching-to-full-speed.patch new file mode 100644 index 00000000000..edbfd9742d2 --- /dev/null +++ b/queue-4.12/usb-check-for-dropped-connection-before-switching-to-full-speed.patch @@ -0,0 +1,65 @@ +From 94c43b9897abf4ea366ed4dba027494e080c7050 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 1 Aug 2017 10:41:56 -0400 +Subject: USB: Check for dropped connection before switching to full speed + +From: Alan Stern + +commit 94c43b9897abf4ea366ed4dba027494e080c7050 upstream. + +Some buggy USB disk adapters disconnect and reconnect multiple times +during the enumeration procedure. This may lead to a device +connecting at full speed instead of high speed, because when the USB +stack sees that a device isn't able to enumerate at high speed, it +tries to hand the connection over to a full-speed companion +controller. + +The logic for doing this is careful to check that the device is still +connected. But this check is inadequate if the device disconnects and +reconnects before the check is done. The symptom is that a device +works, but much more slowly than it is capable of operating. + +The situation was made worse recently by commit 22547c4cc4fe ("usb: +hub: Wait for connection to be reestablished after port reset"), which +increases the delay following a reset before a disconnect is +recognized, thus giving the device more time to reconnect. + +This patch makes the check more robust. If the device was +disconnected at any time during enumeration, we will now skip the +full-speed handover. + +Signed-off-by: Alan Stern +Reported-and-tested-by: Zdenek Kabelac +Reviewed-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -4730,7 +4730,8 @@ hub_power_remaining(struct usb_hub *hub) + static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, + u16 portchange) + { +- int status, i; ++ int status = -ENODEV; ++ int i; + unsigned unit_load; + struct usb_device *hdev = hub->hdev; + struct usb_hcd *hcd = bus_to_hcd(hdev->bus); +@@ -4934,9 +4935,10 @@ loop: + + done: + hub_port_disable(hub, port1, 1); +- if (hcd->driver->relinquish_port && !hub->hdev->parent) +- hcd->driver->relinquish_port(hcd, port1); +- ++ if (hcd->driver->relinquish_port && !hub->hdev->parent) { ++ if (status != -ENOTCONN && status != -ENODEV) ++ hcd->driver->relinquish_port(hcd, port1); ++ } + } + + /* Handle physical or logical connection change events. diff --git a/queue-4.12/usb-core-unlink-urbs-from-the-tail-of-the-endpoint-s-urb_list.patch b/queue-4.12/usb-core-unlink-urbs-from-the-tail-of-the-endpoint-s-urb_list.patch new file mode 100644 index 00000000000..7763f6d96ea --- /dev/null +++ b/queue-4.12/usb-core-unlink-urbs-from-the-tail-of-the-endpoint-s-urb_list.patch @@ -0,0 +1,41 @@ +From 2eac13624364db5b5e1666ae0bb3a4d36bc56b6e Mon Sep 17 00:00:00 2001 +From: Bin Liu +Date: Tue, 25 Jul 2017 09:31:33 -0500 +Subject: usb: core: unlink urbs from the tail of the endpoint's urb_list + +From: Bin Liu + +commit 2eac13624364db5b5e1666ae0bb3a4d36bc56b6e upstream. + +While unlink an urb, if the urb has been programmed in the controller, +the controller driver might do some hw related actions to tear down the +urb. + +Currently usb_hcd_flush_endpoint() passes each urb from the head of the +endpoint's urb_list to the controller driver, which could make the +controller driver think each urb has been programmed and take the +unnecessary actions for each urb. + +This patch changes the behavior in usb_hcd_flush_endpoint() to pass the +urbs from the tail of the list, to avoid any unnecessary actions in an +controller driver. + +Acked-by: Alan Stern +Signed-off-by: Bin Liu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -1878,7 +1878,7 @@ void usb_hcd_flush_endpoint(struct usb_d + /* No more submits can occur */ + spin_lock_irq(&hcd_urb_list_lock); + rescan: +- list_for_each_entry (urb, &ep->urb_list, urb_list) { ++ list_for_each_entry_reverse(urb, &ep->urb_list, urb_list) { + int is_in; + + if (urb->unlinked) diff --git a/queue-4.12/usb-gadget-udc-renesas_usb3-fix-usb_gadget_giveback_request-calling.patch b/queue-4.12/usb-gadget-udc-renesas_usb3-fix-usb_gadget_giveback_request-calling.patch new file mode 100644 index 00000000000..7157b7fa668 --- /dev/null +++ b/queue-4.12/usb-gadget-udc-renesas_usb3-fix-usb_gadget_giveback_request-calling.patch @@ -0,0 +1,67 @@ +From aca5b9ebd096039657417c321a9252c696b359c2 Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Wed, 2 Aug 2017 21:06:35 +0900 +Subject: usb: gadget: udc: renesas_usb3: Fix usb_gadget_giveback_request() calling + +From: Yoshihiro Shimoda + +commit aca5b9ebd096039657417c321a9252c696b359c2 upstream. + +According to the gadget.h, a "complete" function will always be called +with interrupts disabled. However, sometimes usb3_request_done() function +is called with interrupts enabled. So, this function should be held +by spin_lock_irqsave() to disable interruption. Also, this driver has +to call spin_unlock() to avoid spinlock recursion by this driver before +calling usb_gadget_giveback_request(). + +Reported-by: Kazuya Mizuguchi +Tested-by: Kazuya Mizuguchi +Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller") +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/renesas_usb3.c | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -758,21 +758,32 @@ static struct renesas_usb3_request *usb3 + return usb3_req; + } + +-static void usb3_request_done(struct renesas_usb3_ep *usb3_ep, +- struct renesas_usb3_request *usb3_req, int status) ++static void __usb3_request_done(struct renesas_usb3_ep *usb3_ep, ++ struct renesas_usb3_request *usb3_req, ++ int status) + { + struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep); +- unsigned long flags; + + dev_dbg(usb3_to_dev(usb3), "giveback: ep%2d, %u, %u, %d\n", + usb3_ep->num, usb3_req->req.length, usb3_req->req.actual, + status); + usb3_req->req.status = status; +- spin_lock_irqsave(&usb3->lock, flags); + usb3_ep->started = false; + list_del_init(&usb3_req->queue); +- spin_unlock_irqrestore(&usb3->lock, flags); ++ spin_unlock(&usb3->lock); + usb_gadget_giveback_request(&usb3_ep->ep, &usb3_req->req); ++ spin_lock(&usb3->lock); ++} ++ ++static void usb3_request_done(struct renesas_usb3_ep *usb3_ep, ++ struct renesas_usb3_request *usb3_req, int status) ++{ ++ struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep); ++ unsigned long flags; ++ ++ spin_lock_irqsave(&usb3->lock, flags); ++ __usb3_request_done(usb3_ep, usb3_req, status); ++ spin_unlock_irqrestore(&usb3->lock, flags); + } + + static void usb3_irq_epc_pipe0_status_end(struct renesas_usb3 *usb3) diff --git a/queue-4.12/usb-hcd-mark-secondary-hcd-as-dead-if-the-primary-one-died.patch b/queue-4.12/usb-hcd-mark-secondary-hcd-as-dead-if-the-primary-one-died.patch new file mode 100644 index 00000000000..fec4571a2f5 --- /dev/null +++ b/queue-4.12/usb-hcd-mark-secondary-hcd-as-dead-if-the-primary-one-died.patch @@ -0,0 +1,40 @@ +From cd5a6a4fdaba150089af2afc220eae0fef74878a Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Tue, 25 Jul 2017 23:58:50 +0200 +Subject: USB: hcd: Mark secondary HCD as dead if the primary one died + +From: Rafael J. Wysocki + +commit cd5a6a4fdaba150089af2afc220eae0fef74878a upstream. + +Make usb_hc_died() clear the HCD_FLAG_RH_RUNNING flag for the shared +HCD and set HCD_FLAG_DEAD for it, in analogy with what is done for +the primary one. + +Among other thigs, this prevents check_root_hub_suspended() from +returning -EBUSY for dead HCDs which helps to work around system +suspend issues in some situations. + +This actually fixes occasional suspend failures on one of my test +machines. + +Suggested-by: Alan Stern +Signed-off-by: Rafael J. Wysocki +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -2475,6 +2475,8 @@ void usb_hc_died (struct usb_hcd *hcd) + } + if (usb_hcd_is_primary_hcd(hcd) && hcd->shared_hcd) { + hcd = hcd->shared_hcd; ++ clear_bit(HCD_FLAG_RH_RUNNING, &hcd->flags); ++ set_bit(HCD_FLAG_DEAD, &hcd->flags); + if (hcd->rh_registered) { + clear_bit(HCD_FLAG_POLL_RH, &hcd->flags); + diff --git a/queue-4.12/usb-musb-fix-tx-fifo-flush-handling-again.patch b/queue-4.12/usb-musb-fix-tx-fifo-flush-handling-again.patch new file mode 100644 index 00000000000..5339929fcfe --- /dev/null +++ b/queue-4.12/usb-musb-fix-tx-fifo-flush-handling-again.patch @@ -0,0 +1,36 @@ +From 45d73860530a14c608f410b91c6c341777bfa85d Mon Sep 17 00:00:00 2001 +From: Bin Liu +Date: Tue, 25 Jul 2017 09:31:34 -0500 +Subject: usb: musb: fix tx fifo flush handling again + +From: Bin Liu + +commit 45d73860530a14c608f410b91c6c341777bfa85d upstream. + +commit 68fe05e2a451 ("usb: musb: fix tx fifo flush handling") drops the +1ms delay trying to solve the long disconnect time issue when +application queued many tx urbs. However, the 1ms delay is needed for +some use cases, for example, without the delay, reconnecting AR9271 WIFI +dongle no longer works if the connection is dropped from the AP. + +So let's add back the 1ms delay in musb_h_tx_flush_fifo(), and solve the +long disconnect time problem with a separate patch for +usb_hcd_flush_endpoint(). + +Signed-off-by: Bin Liu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_host.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/musb/musb_host.c ++++ b/drivers/usb/musb/musb_host.c +@@ -139,6 +139,7 @@ static void musb_h_tx_flush_fifo(struct + "Could not flush host TX%d fifo: csr: %04x\n", + ep->epnum, csr)) + return; ++ mdelay(1); + } + } + diff --git a/queue-4.12/usb-quirks-add-no-lpm-quirk-for-moshi-usb-to-ethernet-adapter.patch b/queue-4.12/usb-quirks-add-no-lpm-quirk-for-moshi-usb-to-ethernet-adapter.patch new file mode 100644 index 00000000000..0936ec81337 --- /dev/null +++ b/queue-4.12/usb-quirks-add-no-lpm-quirk-for-moshi-usb-to-ethernet-adapter.patch @@ -0,0 +1,37 @@ +From 7496cfe5431f21da5d27a8388c326397e3f0a5db Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Tue, 8 Aug 2017 17:51:27 +0800 +Subject: usb: quirks: Add no-lpm quirk for Moshi USB to Ethernet Adapter + +From: Kai-Heng Feng + +commit 7496cfe5431f21da5d27a8388c326397e3f0a5db upstream. + +Moshi USB to Ethernet Adapter internally uses a Genesys Logic hub to +connect to Realtek r8153. + +The Realtek r8153 ethernet does not work on the internal hub, no-lpm quirk +can make it work. + +Since another r8153 dongle at my hand does not have the issue, so add +the quirk to the Genesys Logic hub instead. + +Signed-off-by: Kai-Heng Feng +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -150,6 +150,9 @@ static const struct usb_device_id usb_qu + /* appletouch */ + { USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* Genesys Logic hub, internally used by Moshi USB to Ethernet Adapter */ ++ { USB_DEVICE(0x05e3, 0x0616), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* Avision AV600U */ + { USB_DEVICE(0x0638, 0x0a13), .driver_info = + USB_QUIRK_STRING_FETCH_255 }, diff --git a/queue-4.12/usb-renesas_usbhs-fix-ugctrl2-value-for-r-car-gen3.patch b/queue-4.12/usb-renesas_usbhs-fix-ugctrl2-value-for-r-car-gen3.patch new file mode 100644 index 00000000000..8cb9295bc26 --- /dev/null +++ b/queue-4.12/usb-renesas_usbhs-fix-ugctrl2-value-for-r-car-gen3.patch @@ -0,0 +1,54 @@ +From 2acecd58969897795cf015c9057ebd349a3fda8a Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Wed, 2 Aug 2017 13:21:45 +0900 +Subject: usb: renesas_usbhs: Fix UGCTRL2 value for R-Car Gen3 + +From: Yoshihiro Shimoda + +commit 2acecd58969897795cf015c9057ebd349a3fda8a upstream. + +The latest HW manual (Rev.0.55) shows us this UGCTRL2.VBUSSEL bit. +If the bit sets to 1, the VBUS drive is controlled by phy related +registers (called "UCOM Registers" on the manual). Since R-Car Gen3 +environment will control VBUS by phy-rcar-gen3-usb2 driver, +the UGCTRL2.VBUSSEL bit should be set to 1. So, this patch fixes +the register's value. Otherwise, even if the ID pin indicates to +peripheral, the R-Car will output USBn_PWEN to 1 when a host driver +is running. + +Fixes: de18757e272d ("usb: renesas_usbhs: add R-Car Gen3 power control" +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/renesas_usbhs/rcar3.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/usb/renesas_usbhs/rcar3.c ++++ b/drivers/usb/renesas_usbhs/rcar3.c +@@ -20,9 +20,13 @@ + /* Low Power Status register (LPSTS) */ + #define LPSTS_SUSPM 0x4000 + +-/* USB General control register 2 (UGCTRL2), bit[31:6] should be 0 */ ++/* ++ * USB General control register 2 (UGCTRL2) ++ * Remarks: bit[31:11] and bit[9:6] should be 0 ++ */ + #define UGCTRL2_RESERVED_3 0x00000001 /* bit[3:0] should be B'0001 */ + #define UGCTRL2_USB0SEL_OTG 0x00000030 ++#define UGCTRL2_VBUSSEL 0x00000400 + + static void usbhs_write32(struct usbhs_priv *priv, u32 reg, u32 data) + { +@@ -34,7 +38,8 @@ static int usbhs_rcar3_power_ctrl(struct + { + struct usbhs_priv *priv = usbhs_pdev_to_priv(pdev); + +- usbhs_write32(priv, UGCTRL2, UGCTRL2_RESERVED_3 | UGCTRL2_USB0SEL_OTG); ++ usbhs_write32(priv, UGCTRL2, UGCTRL2_RESERVED_3 | UGCTRL2_USB0SEL_OTG | ++ UGCTRL2_VBUSSEL); + + if (enable) { + usbhs_bset(priv, LPSTS, LPSTS_SUSPM, LPSTS_SUSPM); diff --git a/queue-4.12/usb-serial-cp210x-add-support-for-qivicon-usb-zigbee-dongle.patch b/queue-4.12/usb-serial-cp210x-add-support-for-qivicon-usb-zigbee-dongle.patch new file mode 100644 index 00000000000..15d75205b2e --- /dev/null +++ b/queue-4.12/usb-serial-cp210x-add-support-for-qivicon-usb-zigbee-dongle.patch @@ -0,0 +1,32 @@ +From 9585e340db9f6cc1c0928d82c3a23cc4460f0a3f Mon Sep 17 00:00:00 2001 +From: Stefan Triller +Date: Fri, 30 Jun 2017 14:44:03 +0200 +Subject: USB: serial: cp210x: add support for Qivicon USB ZigBee dongle + +From: Stefan Triller + +commit 9585e340db9f6cc1c0928d82c3a23cc4460f0a3f upstream. + +The German Telekom offers a ZigBee USB Stick under the brand name Qivicon +for their SmartHome Home Base in its 1. Generation. The productId is not +known by the according kernel module, this patch adds support for it. + +Signed-off-by: Stefan Triller +Reviewed-by: Frans Klaver +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -142,6 +142,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ + { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ + { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */ ++ { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ diff --git a/queue-4.12/usb-serial-option-add-d-link-dwm-222-device-id.patch b/queue-4.12/usb-serial-option-add-d-link-dwm-222-device-id.patch new file mode 100644 index 00000000000..a52e3d20529 --- /dev/null +++ b/queue-4.12/usb-serial-option-add-d-link-dwm-222-device-id.patch @@ -0,0 +1,30 @@ +From fd1b8668af59a11bb754a6c9b0051c6c5ce73b74 Mon Sep 17 00:00:00 2001 +From: Hector Martin +Date: Wed, 2 Aug 2017 00:45:06 +0900 +Subject: USB: serial: option: add D-Link DWM-222 device ID + +From: Hector Martin + +commit fd1b8668af59a11bb754a6c9b0051c6c5ce73b74 upstream. + +Add device id for D-Link DWM-222. + +Signed-off-by: Hector Martin +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2025,6 +2025,8 @@ static const struct usb_device_id option + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) }, /* D-Link DWM-158 */ + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */ + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */ ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ diff --git a/queue-4.12/usb-serial-pl2303-add-new-aten-device-id.patch b/queue-4.12/usb-serial-pl2303-add-new-aten-device-id.patch new file mode 100644 index 00000000000..76d3fe94e01 --- /dev/null +++ b/queue-4.12/usb-serial-pl2303-add-new-aten-device-id.patch @@ -0,0 +1,41 @@ +From 3b6bcd3d093c698d32e93d4da57679b8fbc5e01e Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Thu, 10 Aug 2017 11:54:12 -0700 +Subject: USB: serial: pl2303: add new ATEN device id + +From: Greg Kroah-Hartman + +commit 3b6bcd3d093c698d32e93d4da57679b8fbc5e01e upstream. + +This adds a new ATEN device id for a new pl2303-based device. + +Reported-by: Peter Kuo +Cc: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/pl2303.c | 2 ++ + drivers/usb/serial/pl2303.h | 1 + + 2 files changed, 3 insertions(+) + +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -52,6 +52,8 @@ static const struct usb_device_id id_tab + { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) }, + { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID), + .driver_info = PL2303_QUIRK_ENDPOINT_HACK }, ++ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_UC485), ++ .driver_info = PL2303_QUIRK_ENDPOINT_HACK }, + { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) }, + { USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) }, + { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) }, +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -27,6 +27,7 @@ + #define ATEN_VENDOR_ID 0x0557 + #define ATEN_VENDOR_ID2 0x0547 + #define ATEN_PRODUCT_ID 0x2008 ++#define ATEN_PRODUCT_UC485 0x2021 + #define ATEN_PRODUCT_ID2 0x2118 + + #define IODATA_VENDOR_ID 0x04bb diff --git a/queue-4.12/usb-storage-fix-deadlock-involving-host-lock-and-scsi_done.patch b/queue-4.12/usb-storage-fix-deadlock-involving-host-lock-and-scsi_done.patch new file mode 100644 index 00000000000..a2e51b6e698 --- /dev/null +++ b/queue-4.12/usb-storage-fix-deadlock-involving-host-lock-and-scsi_done.patch @@ -0,0 +1,85 @@ +From 8b52291a0743fc4db4a7495c846a6f31ee84d282 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 26 Jul 2017 11:49:19 -0400 +Subject: usb-storage: fix deadlock involving host lock and scsi_done + +From: Alan Stern + +commit 8b52291a0743fc4db4a7495c846a6f31ee84d282 upstream. + +Christoph Hellwig says that since version 4.12, the kernel switched to +using blk-mq by default. The old code used a softirq for handling +request completions, but blk-mq can handle completions in the caller's +context. This may cause a problem for usb-storage, because it invokes +the ->scsi_done callback while holding the host lock, and the +completion routine sometimes tries to acquire the same lock (when +running the error handler, for example). + +The consequence is that the existing code will sometimes deadlock upon +error completion of a SCSI command (with a lockdep warning). + +This is easy enough to fix, since usb-storage doesn't really need to +hold the host lock while the callback runs. It was simpler to write +it that way, but moving the call outside the locked region is pretty +easy and there's no downside. That's what this patch does. + +Signed-off-by: Alan Stern +Reported-and-tested-by: Arthur Marsh +CC: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/usb.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +--- a/drivers/usb/storage/usb.c ++++ b/drivers/usb/storage/usb.c +@@ -315,6 +315,7 @@ static int usb_stor_control_thread(void + { + struct us_data *us = (struct us_data *)__us; + struct Scsi_Host *host = us_to_host(us); ++ struct scsi_cmnd *srb; + + for (;;) { + usb_stor_dbg(us, "*** thread sleeping\n"); +@@ -330,6 +331,7 @@ static int usb_stor_control_thread(void + scsi_lock(host); + + /* When we are called with no command pending, we're done */ ++ srb = us->srb; + if (us->srb == NULL) { + scsi_unlock(host); + mutex_unlock(&us->dev_mutex); +@@ -398,14 +400,11 @@ static int usb_stor_control_thread(void + /* lock access to the state */ + scsi_lock(host); + +- /* indicate that the command is done */ +- if (us->srb->result != DID_ABORT << 16) { +- usb_stor_dbg(us, "scsi cmd done, result=0x%x\n", +- us->srb->result); +- us->srb->scsi_done(us->srb); +- } else { ++ /* was the command aborted? */ ++ if (us->srb->result == DID_ABORT << 16) { + SkipForAbort: + usb_stor_dbg(us, "scsi command aborted\n"); ++ srb = NULL; /* Don't call srb->scsi_done() */ + } + + /* +@@ -429,6 +428,13 @@ SkipForAbort: + + /* unlock the device pointers */ + mutex_unlock(&us->dev_mutex); ++ ++ /* now that the locks are released, notify the SCSI core */ ++ if (srb) { ++ usb_stor_dbg(us, "scsi cmd done, result=0x%x\n", ++ srb->result); ++ srb->scsi_done(srb); ++ } + } /* for (;;) */ + + /* Wait until we are told to stop */ diff --git a/queue-4.12/usb-xhci-add-quirk-for-certain-failing-hp-keyboard-on-reset-after-resume.patch b/queue-4.12/usb-xhci-add-quirk-for-certain-failing-hp-keyboard-on-reset-after-resume.patch new file mode 100644 index 00000000000..6d2896b82b3 --- /dev/null +++ b/queue-4.12/usb-xhci-add-quirk-for-certain-failing-hp-keyboard-on-reset-after-resume.patch @@ -0,0 +1,86 @@ +From e788787ef4f9c24aafefc480a8da5f92b914e5e6 Mon Sep 17 00:00:00 2001 +From: Sandeep Singh +Date: Fri, 4 Aug 2017 16:35:56 +0530 +Subject: usb:xhci:Add quirk for Certain failing HP keyboard on reset after resume + +From: Sandeep Singh + +commit e788787ef4f9c24aafefc480a8da5f92b914e5e6 upstream. + +Certain HP keyboards would keep inputting a character automatically which +is the wake-up key after S3 resume + +On some AMD platforms USB host fails to respond (by holding resume-K) to +USB device (an HP keyboard) resume request within 1ms (TURSM) and ensures +that resume is signaled for at least 20 ms (TDRSMDN), which is defined in +USB 2.0 spec. The result is that the keyboard is out of function. + +In SNPS USB design, the host responds to the resume request only after +system gets back to S0 and the host gets to functional after the internal +HW restore operation that is more than 1 second after the initial resume +request from the USB device. + +As a workaround for specific keyboard ID(HP Keyboards), applying port reset +after resume when the keyboard is plugged in. + +Signed-off-by: Sandeep Singh +Signed-off-by: Shyam Sundar S K +cc: Nehal Shah +Reviewed-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 1 + + drivers/usb/host/pci-quirks.c | 17 ++++++++++++----- + 2 files changed, 13 insertions(+), 5 deletions(-) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -252,6 +252,7 @@ static const struct usb_device_id usb_am + { USB_DEVICE(0x093a, 0x2500), .driver_info = USB_QUIRK_RESET_RESUME }, + { USB_DEVICE(0x093a, 0x2510), .driver_info = USB_QUIRK_RESET_RESUME }, + { USB_DEVICE(0x093a, 0x2521), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x03f0, 0x2b4a), .driver_info = USB_QUIRK_RESET_RESUME }, + + /* Logitech Optical Mouse M90/M100 */ + { USB_DEVICE(0x046d, 0xc05a), .driver_info = USB_QUIRK_RESET_RESUME }, +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -98,6 +98,7 @@ enum amd_chipset_gen { + AMD_CHIPSET_HUDSON2, + AMD_CHIPSET_BOLTON, + AMD_CHIPSET_YANGTZE, ++ AMD_CHIPSET_TAISHAN, + AMD_CHIPSET_UNKNOWN, + }; + +@@ -141,6 +142,11 @@ static int amd_chipset_sb_type_init(stru + pinfo->sb_type.gen = AMD_CHIPSET_SB700; + else if (rev >= 0x40 && rev <= 0x4f) + pinfo->sb_type.gen = AMD_CHIPSET_SB800; ++ } ++ pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD, ++ 0x145c, NULL); ++ if (pinfo->smbus_dev) { ++ pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN; + } else { + pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD, + PCI_DEVICE_ID_AMD_HUDSON2_SMBUS, NULL); +@@ -260,11 +266,12 @@ int usb_hcd_amd_remote_wakeup_quirk(stru + { + /* Make sure amd chipset type has already been initialized */ + usb_amd_find_chipset_info(); +- if (amd_chipset.sb_type.gen != AMD_CHIPSET_YANGTZE) +- return 0; +- +- dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n"); +- return 1; ++ if (amd_chipset.sb_type.gen == AMD_CHIPSET_YANGTZE || ++ amd_chipset.sb_type.gen == AMD_CHIPSET_TAISHAN) { ++ dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n"); ++ return 1; ++ } ++ return 0; + } + EXPORT_SYMBOL_GPL(usb_hcd_amd_remote_wakeup_quirk); + diff --git a/queue-4.12/xfs-fix-leak-of-discard-bio.patch b/queue-4.12/xfs-fix-leak-of-discard-bio.patch new file mode 100644 index 00000000000..8b245dbaf76 --- /dev/null +++ b/queue-4.12/xfs-fix-leak-of-discard-bio.patch @@ -0,0 +1,34 @@ +From ea7bd56fa309d10a41b1041827a63c0746c47554 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 2 Aug 2017 12:37:16 -0700 +Subject: xfs: Fix leak of discard bio + +From: Jan Kara + +commit ea7bd56fa309d10a41b1041827a63c0746c47554 upstream. + +The bio describing discard operation is allocated by +__blkdev_issue_discard() which returns us a reference to it. That +reference is never released and thus we leak this bio. Drop the bio +reference once it completes in xlog_discard_endio(). + +Fixes: 4560e78f40cb55bd2ea8f1ef4001c5baa88531c7 +Signed-off-by: Jan Kara +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/xfs_log_cil.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/xfs/xfs_log_cil.c ++++ b/fs/xfs/xfs_log_cil.c +@@ -519,6 +519,7 @@ xlog_discard_endio( + + INIT_WORK(&ctx->discard_endio_work, xlog_discard_endio_work); + queue_work(xfs_discard_wq, &ctx->discard_endio_work); ++ bio_put(bio); + } + + static void diff --git a/queue-4.12/xtensa-don-t-limit-csum_partial-export-by-config_net.patch b/queue-4.12/xtensa-don-t-limit-csum_partial-export-by-config_net.patch new file mode 100644 index 00000000000..0498bfaaf8e --- /dev/null +++ b/queue-4.12/xtensa-don-t-limit-csum_partial-export-by-config_net.patch @@ -0,0 +1,37 @@ +From 7f81e55c737a8fa82c71f290945d729a4902f8d2 Mon Sep 17 00:00:00 2001 +From: Max Filippov +Date: Tue, 1 Aug 2017 11:02:46 -0700 +Subject: xtensa: don't limit csum_partial export by CONFIG_NET + +From: Max Filippov + +commit 7f81e55c737a8fa82c71f290945d729a4902f8d2 upstream. + +csum_partial and csum_partial_copy_generic are defined unconditionally +and are available even when CONFIG_NET is disabled. They are used not +only by the network drivers, but also by scsi and media. +Don't limit these functions export by CONFIG_NET. + +Signed-off-by: Max Filippov +Signed-off-by: Greg Kroah-Hartman + +--- + arch/xtensa/kernel/xtensa_ksyms.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/arch/xtensa/kernel/xtensa_ksyms.c ++++ b/arch/xtensa/kernel/xtensa_ksyms.c +@@ -94,13 +94,11 @@ unsigned long __sync_fetch_and_or_4(unsi + } + EXPORT_SYMBOL(__sync_fetch_and_or_4); + +-#ifdef CONFIG_NET + /* + * Networking support + */ + EXPORT_SYMBOL(csum_partial); + EXPORT_SYMBOL(csum_partial_copy_generic); +-#endif /* CONFIG_NET */ + + /* + * Architecture-specific symbols diff --git a/queue-4.12/xtensa-fix-cache-aliasing-handling-code-for-wt-cache.patch b/queue-4.12/xtensa-fix-cache-aliasing-handling-code-for-wt-cache.patch new file mode 100644 index 00000000000..475b5a0b34a --- /dev/null +++ b/queue-4.12/xtensa-fix-cache-aliasing-handling-code-for-wt-cache.patch @@ -0,0 +1,74 @@ +From 6d0f581d1768d3eaba15776e7dd1fdfec10cfe36 Mon Sep 17 00:00:00 2001 +From: Max Filippov +Date: Fri, 28 Jul 2017 17:42:59 -0700 +Subject: xtensa: fix cache aliasing handling code for WT cache + +From: Max Filippov + +commit 6d0f581d1768d3eaba15776e7dd1fdfec10cfe36 upstream. + +Currently building kernel for xtensa core with aliasing WT cache fails +with the following messages: + + mm/memory.c:2152: undefined reference to `flush_dcache_page' + mm/memory.c:2332: undefined reference to `local_flush_cache_page' + mm/memory.c:1919: undefined reference to `local_flush_cache_range' + mm/memory.c:4179: undefined reference to `copy_to_user_page' + mm/memory.c:4183: undefined reference to `copy_from_user_page' + +This happens because implementation of these functions is only compiled +when data cache is WB, which looks wrong: even when data cache doesn't +need flushing it still needs invalidation. The functions like +__flush_[invalidate_]dcache_* are correctly defined for both WB and WT +caches (and even if they weren't that'd still be ok, just slower). + +Fix this by providing the same implementation of the above functions for +both WB and WT cache. + +Signed-off-by: Max Filippov +Signed-off-by: Greg Kroah-Hartman + +--- + arch/xtensa/mm/cache.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +--- a/arch/xtensa/mm/cache.c ++++ b/arch/xtensa/mm/cache.c +@@ -120,10 +120,6 @@ void copy_user_highpage(struct page *dst + preempt_enable(); + } + +-#endif /* DCACHE_WAY_SIZE > PAGE_SIZE */ +- +-#if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK +- + /* + * Any time the kernel writes to a user page cache page, or it is about to + * read from a page cache page this routine is called. +@@ -208,7 +204,7 @@ void local_flush_cache_page(struct vm_ar + __invalidate_icache_page_alias(virt, phys); + } + +-#endif ++#endif /* DCACHE_WAY_SIZE > PAGE_SIZE */ + + void + update_mmu_cache(struct vm_area_struct * vma, unsigned long addr, pte_t *ptep) +@@ -225,7 +221,7 @@ update_mmu_cache(struct vm_area_struct * + + flush_tlb_page(vma, addr); + +-#if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK ++#if (DCACHE_WAY_SIZE > PAGE_SIZE) + + if (!PageReserved(page) && test_bit(PG_arch_1, &page->flags)) { + unsigned long phys = page_to_phys(page); +@@ -256,7 +252,7 @@ update_mmu_cache(struct vm_area_struct * + * flush_dcache_page() on the page. + */ + +-#if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK ++#if (DCACHE_WAY_SIZE > PAGE_SIZE) + + void copy_to_user_page(struct vm_area_struct *vma, struct page *page, + unsigned long vaddr, void *dst, const void *src, diff --git a/queue-4.12/xtensa-mm-cache-add-missing-export_symbols.patch b/queue-4.12/xtensa-mm-cache-add-missing-export_symbols.patch new file mode 100644 index 00000000000..1f0a74ba195 --- /dev/null +++ b/queue-4.12/xtensa-mm-cache-add-missing-export_symbols.patch @@ -0,0 +1,63 @@ +From bc652eb6a0d5cffaea7dc8e8ad488aab2a1bf1ed Mon Sep 17 00:00:00 2001 +From: Max Filippov +Date: Tue, 1 Aug 2017 11:15:15 -0700 +Subject: xtensa: mm/cache: add missing EXPORT_SYMBOLs + +From: Max Filippov + +commit bc652eb6a0d5cffaea7dc8e8ad488aab2a1bf1ed upstream. + +Functions clear_user_highpage, copy_user_highpage, flush_dcache_page, +local_flush_cache_range and local_flush_cache_page may be used from +modules. Export them. + +Signed-off-by: Max Filippov +Signed-off-by: Greg Kroah-Hartman + +--- + arch/xtensa/mm/cache.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/arch/xtensa/mm/cache.c ++++ b/arch/xtensa/mm/cache.c +@@ -103,6 +103,7 @@ void clear_user_highpage(struct page *pa + clear_page_alias(kvaddr, paddr); + preempt_enable(); + } ++EXPORT_SYMBOL(clear_user_highpage); + + void copy_user_highpage(struct page *dst, struct page *src, + unsigned long vaddr, struct vm_area_struct *vma) +@@ -119,6 +120,7 @@ void copy_user_highpage(struct page *dst + copy_page_alias(dst_vaddr, src_vaddr, dst_paddr, src_paddr); + preempt_enable(); + } ++EXPORT_SYMBOL(copy_user_highpage); + + /* + * Any time the kernel writes to a user page cache page, or it is about to +@@ -172,7 +174,7 @@ void flush_dcache_page(struct page *page + + /* There shouldn't be an entry in the cache for this page anymore. */ + } +- ++EXPORT_SYMBOL(flush_dcache_page); + + /* + * For now, flush the whole cache. FIXME?? +@@ -184,6 +186,7 @@ void local_flush_cache_range(struct vm_a + __flush_invalidate_dcache_all(); + __invalidate_icache_all(); + } ++EXPORT_SYMBOL(local_flush_cache_range); + + /* + * Remove any entry in the cache for this page. +@@ -203,6 +206,7 @@ void local_flush_cache_page(struct vm_ar + __flush_invalidate_dcache_page_alias(virt, phys); + __invalidate_icache_page_alias(virt, phys); + } ++EXPORT_SYMBOL(local_flush_cache_page); + + #endif /* DCACHE_WAY_SIZE > PAGE_SIZE */ +