From: Greg Kroah-Hartman Date: Tue, 17 Jan 2017 16:12:08 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.9.5~7 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dc2861d1fc73bda09ee504fee488a46272c85b00;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: acpi-apei-fix-nmi-notification-handling.patch acpi-cppc-set-an-error-code-on-probe-error-path.patch blk-mq-always-schedule-hctx-next_cpu.patch block-cfq_cpd_alloc-should-use-gfp.patch block-change-extern-inline-to-static-inline.patch bq24190_charger-fix-pm-runtime-use-for-bq24190_battery_set_property.patch btrfs-fix-error-handling-when-run_delayed_extent_op-fails.patch btrfs-fix-locking-when-we-put-back-a-delayed-ref-that-s-too-new.patch bus-vexpress-config-fix-device-reference-leak.patch clearing-fifos-in-rs485-emulation-mode-causes-subsequent-transmits-to-break.patch cpufreq-powernv-disable-preemption-while-checking-cpu-throttling-state.patch dmaengine-omap-dma-fix-dynamic-lch_map-allocation.patch drm-amdgpu-drop-verde-dpm-quirks.patch drm-amdgpu-update-si-kicker-smc-firmware.patch drm-avoid-uninitialized-timestamp-use-in-wait_vblank.patch drm-clean-up-planes-in-atomic-commit-helper-failure-path.patch drm-i915-gen9-fix-pcode-polling-during-sagv-disabling.patch drm-i915-gen9-fix-pcode-polling-timeout-in-stable-backport.patch drm-i915-move-the-min_pixclk-handling-to-the-end-of-readout.patch drm-initialise-drm_mm.head_node.allocated.patch drm-panel-simple-check-against-num_timings-when-setting-preferred-for-timing.patch drm-radeon-drop-verde-dpm-quirks.patch drm-radeon-update-smc-firmware-selection-for-si.patch extcon-return-error-code-on-failure.patch i2c-mux-pca954x-fix-i2c-mux-selection-caching.patch i2c-piix4-avoid-race-conditions-with-imc.patch ibmvscsis-fix-srp_transfer_data-fail-return-code.patch iw_cxgb4-fix-error-return-code-in-c4iw_rdev_open.patch mm-fix-remote-numa-hits-statistics.patch net-af_iucv-don-t-use-paged-skbs-for-tx-on-hipersockets.patch net-mlx5-only-cancel-recovery-work-when-cleaning-up-device.patch nfs-fix-a-performance-regression-in-readdir.patch nfs-fix-typo-in-parameter-description.patch nfsv4.1-nfs4_fl_prepare_ds-must-be-careful-about-reporting-success.patch nvme-apply-delay_before_chk_rdy-quirk-at-probe-time-too.patch orinoco-use-shash-instead-of-ahash-for-mic-calculations.patch pinctrl-meson-fix-gpio-request-disabling-other-modes.patch pnfs-fix-race-in-pnfs_wait_on_layoutreturn.patch power-supply-bq27xxx_battery-fix-register-map-for-bq27510-and-bq27520.patch powercap-intel_rapl-fix-and-tidy-up-error-handling.patch powerpc-64-simplify-adaptation-to-new-isa-v3.00-hpte-format.patch powerpc-ibmebus-fix-device-reference-leaks-in-sysfs-interface.patch powerpc-ibmebus-fix-further-device-reference-leaks.patch powerpc-mm-correct-process-and-partition-table-max-size.patch powerpc-powernv-don-t-warn-on-pe-init-if-unfreeze-is-unsupported.patch regulators-helpers-fix-handling-of-bypass_val_on-in-get_bypass_regmap.patch remoteproc-qcom_wcnss-fix-circular-module-dependency.patch remoteproc-st-fix-error-return-code-in-st_rproc_probe.patch sysctl-drop-reference-added-by-grab_header-in-proc_sys_readdir.patch sysrq-attach-sysrq-handler-correctly-for-32-bit-kernel.patch tty-serial-atmel-rs485-half-duplex-w-dma-enable-rx-after-tx-is-done.patch tty-serial-atmel_serial-bug-stop-dma-from-transmitting-in-stop_tx.patch usb-serial-ch341-fix-modem-control-and-b0-handling.patch virtio_blk-avoid-dma-to-stack-for-the-sense-buffer.patch x86-cpu-fix-bootup-crashes-by-sanitizing-the-argument-of-the-clearcpuid-command-line-option.patch --- diff --git a/queue-4.9/acpi-apei-fix-nmi-notification-handling.patch b/queue-4.9/acpi-apei-fix-nmi-notification-handling.patch new file mode 100644 index 00000000000..9fa3ea460a6 --- /dev/null +++ b/queue-4.9/acpi-apei-fix-nmi-notification-handling.patch @@ -0,0 +1,81 @@ +From a545715d2dae8d071c5b06af947b07ffa846b288 Mon Sep 17 00:00:00 2001 +From: Prarit Bhargava +Date: Wed, 30 Nov 2016 08:19:39 -0500 +Subject: ACPI / APEI: Fix NMI notification handling + +From: Prarit Bhargava + +commit a545715d2dae8d071c5b06af947b07ffa846b288 upstream. + +When removing and adding cpu 0 on a system with GHES NMI the following stack +trace is seen when re-adding the cpu: + +WARNING: CPU: 0 PID: 0 at arch/x86/kernel/apic/apic.c:1349 setup_local_APIC+ +Modules linked in: nfsv3 rpcsec_gss_krb5 nfsv4 nfs fscache coretemp intel_ra +CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.9.0-rc6+ #2 +Call Trace: + dump_stack+0x63/0x8e + __warn+0xd1/0xf0 + warn_slowpath_null+0x1d/0x20 + setup_local_APIC+0x275/0x370 + apic_ap_setup+0xe/0x20 + start_secondary+0x48/0x180 + set_init_arg+0x55/0x55 + early_idt_handler_array+0x120/0x120 + x86_64_start_reservations+0x2a/0x2c + x86_64_start_kernel+0x13d/0x14c + +During the cpu bringup, wakeup_cpu_via_init_nmi() is called and issues an +NMI on CPU 0. The GHES NMI handler, ghes_notify_nmi() runs the +ghes_proc_irq_work work queue which ends up setting IRQ_WORK_VECTOR +(0xf6). The "faulty" IR line set at arch/x86/kernel/apic/apic.c:1349 is also +0xf6 (specifically APIC IRR for irqs 255 to 224 is 0x400000) which confirms +that something has set the IRQ_WORK_VECTOR line prior to the APIC being +initialized. + +Commit 2383844d4850 ("GHES: Elliminate double-loop in the NMI handler") +incorrectly modified the behavior such that the handler returns +NMI_HANDLED only if an error was processed, and incorrectly runs the ghes +work queue for every NMI. + +This patch modifies the ghes_proc_irq_work() to run as it did prior to +2383844d4850 ("GHES: Elliminate double-loop in the NMI handler") by +properly returning NMI_HANDLED and only calling the work queue if +NMI_HANDLED has been set. + +Fixes: 2383844d4850 (GHES: Elliminate double-loop in the NMI handler) +Signed-off-by: Prarit Bhargava +Reviewed-by: Borislav Petkov +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/apei/ghes.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -852,6 +852,8 @@ static int ghes_notify_nmi(unsigned int + if (ghes_read_estatus(ghes, 1)) { + ghes_clear_estatus(ghes); + continue; ++ } else { ++ ret = NMI_HANDLED; + } + + sev = ghes_severity(ghes->estatus->error_severity); +@@ -863,12 +865,11 @@ static int ghes_notify_nmi(unsigned int + + __process_error(ghes); + ghes_clear_estatus(ghes); +- +- ret = NMI_HANDLED; + } + + #ifdef CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG +- irq_work_queue(&ghes_proc_irq_work); ++ if (ret == NMI_HANDLED) ++ irq_work_queue(&ghes_proc_irq_work); + #endif + atomic_dec(&ghes_in_nmi); + return ret; diff --git a/queue-4.9/acpi-cppc-set-an-error-code-on-probe-error-path.patch b/queue-4.9/acpi-cppc-set-an-error-code-on-probe-error-path.patch new file mode 100644 index 00000000000..67704cdd962 --- /dev/null +++ b/queue-4.9/acpi-cppc-set-an-error-code-on-probe-error-path.patch @@ -0,0 +1,34 @@ +From 501634759d55a5b56967de6d9465acf02bbc3565 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 30 Nov 2016 22:22:54 +0300 +Subject: ACPI / CPPC: set an error code on probe error path + +From: Dan Carpenter + +commit 501634759d55a5b56967de6d9465acf02bbc3565 upstream. + +We should return -EINVAL (instead of 0) if get_cpu_device() fails. + +Fixes: 158c998ea44b (ACPI / CPPC: add sysfs support to compute delivered performance) +Signed-off-by: Dan Carpenter +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/cppc_acpi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -784,8 +784,10 @@ int acpi_cppc_processor_probe(struct acp + + /* Add per logical CPU nodes for reading its feedback counters. */ + cpu_dev = get_cpu_device(pr->id); +- if (!cpu_dev) ++ if (!cpu_dev) { ++ ret = -EINVAL; + goto out_free; ++ } + + ret = kobject_init_and_add(&cpc_ptr->kobj, &cppc_ktype, &cpu_dev->kobj, + "acpi_cppc"); diff --git a/queue-4.9/blk-mq-always-schedule-hctx-next_cpu.patch b/queue-4.9/blk-mq-always-schedule-hctx-next_cpu.patch new file mode 100644 index 00000000000..44198e7772c --- /dev/null +++ b/queue-4.9/blk-mq-always-schedule-hctx-next_cpu.patch @@ -0,0 +1,51 @@ +From c02ebfdddbafa9a6a0f52fbd715e6bfa229af9d3 Mon Sep 17 00:00:00 2001 +From: Gabriel Krisman Bertazi +Date: Wed, 28 Sep 2016 00:24:24 -0300 +Subject: blk-mq: Always schedule hctx->next_cpu + +From: Gabriel Krisman Bertazi + +commit c02ebfdddbafa9a6a0f52fbd715e6bfa229af9d3 upstream. + +Commit 0e87e58bf60e ("blk-mq: improve warning for running a queue on the +wrong CPU") attempts to avoid triggering the WARN_ON in +__blk_mq_run_hw_queue when the expected CPU is dead. Problem is, in the +last batch execution before round robin, blk_mq_hctx_next_cpu can +schedule a dead CPU and also update next_cpu to the next alive CPU in +the mask, which will trigger the WARN_ON despite the previous +workaround. + +The following patch fixes this scenario by always scheduling the value +in hctx->next_cpu. This changes the moment when we round-robin the CPU +running the hctx, but it really doesn't matter, since it still executes +BLK_MQ_CPU_WORK_BATCH times in a row before switching to another CPU. + +Fixes: 0e87e58bf60e ("blk-mq: improve warning for running a queue on the wrong CPU") +Signed-off-by: Gabriel Krisman Bertazi +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-mq.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -895,7 +895,7 @@ static int blk_mq_hctx_next_cpu(struct b + return WORK_CPU_UNBOUND; + + if (--hctx->next_cpu_batch <= 0) { +- int cpu = hctx->next_cpu, next_cpu; ++ int next_cpu; + + next_cpu = cpumask_next(hctx->next_cpu, hctx->cpumask); + if (next_cpu >= nr_cpu_ids) +@@ -903,8 +903,6 @@ static int blk_mq_hctx_next_cpu(struct b + + hctx->next_cpu = next_cpu; + hctx->next_cpu_batch = BLK_MQ_CPU_WORK_BATCH; +- +- return cpu; + } + + return hctx->next_cpu; diff --git a/queue-4.9/block-cfq_cpd_alloc-should-use-gfp.patch b/queue-4.9/block-cfq_cpd_alloc-should-use-gfp.patch new file mode 100644 index 00000000000..835cd92f0d2 --- /dev/null +++ b/queue-4.9/block-cfq_cpd_alloc-should-use-gfp.patch @@ -0,0 +1,35 @@ +From ebc4ff661fbe76781c6b16dfb7b754a5d5073f8e Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Thu, 10 Nov 2016 11:16:37 -0500 +Subject: block: cfq_cpd_alloc() should use @gfp + +From: Tejun Heo + +commit ebc4ff661fbe76781c6b16dfb7b754a5d5073f8e upstream. + +cfq_cpd_alloc() which is the cpd_alloc_fn implementation for cfq was +incorrectly hard coding GFP_KERNEL instead of using the mask specified +through the @gfp parameter. This currently doesn't cause any actual +issues because all current callers specify GFP_KERNEL. Fix it. + +Signed-off-by: Tejun Heo +Reported-by: Dan Carpenter +Fixes: e4a9bde9589f ("blkcg: replace blkcg_policy->cpd_size with ->cpd_alloc/free_fn() methods") +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/cfq-iosched.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/block/cfq-iosched.c ++++ b/block/cfq-iosched.c +@@ -1596,7 +1596,7 @@ static struct blkcg_policy_data *cfq_cpd + { + struct cfq_group_data *cgd; + +- cgd = kzalloc(sizeof(*cgd), GFP_KERNEL); ++ cgd = kzalloc(sizeof(*cgd), gfp); + if (!cgd) + return NULL; + return &cgd->cpd; diff --git a/queue-4.9/block-change-extern-inline-to-static-inline.patch b/queue-4.9/block-change-extern-inline-to-static-inline.patch new file mode 100644 index 00000000000..00210d32cb6 --- /dev/null +++ b/queue-4.9/block-change-extern-inline-to-static-inline.patch @@ -0,0 +1,45 @@ +From 9a05e7541c39680d28ecf91892338e074738d5fd Mon Sep 17 00:00:00 2001 +From: Tobias Klauser +Date: Fri, 18 Nov 2016 15:16:06 +0100 +Subject: block: Change extern inline to static inline + +From: Tobias Klauser + +commit 9a05e7541c39680d28ecf91892338e074738d5fd upstream. + +With compilers which follow the C99 standard (like modern versions of +gcc and clang), "extern inline" does the opposite thing from older +versions of gcc (emits code for an externally linkable version of the +inline function). + +"static inline" does the intended behavior in all cases instead. + +Description taken from commit 6d91857d4826 ("staging, rtl8192e, +LLVMLinux: Change extern inline to static inline"). + +This also fixes the following GCC warning when building with CONFIG_PM +disabled: + + ./include/linux/blkdev.h:1143:20: warning: no previous prototype for 'blk_set_runtime_active' [-Wmissing-prototypes] + +Fixes: d07ab6d11477 ("block: Add blk_set_runtime_active()") +Reviewed-by: Mika Westerberg +Signed-off-by: Tobias Klauser +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/blkdev.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -1057,7 +1057,7 @@ static inline int blk_pre_runtime_suspen + static inline void blk_post_runtime_suspend(struct request_queue *q, int err) {} + static inline void blk_pre_runtime_resume(struct request_queue *q) {} + static inline void blk_post_runtime_resume(struct request_queue *q, int err) {} +-extern inline void blk_set_runtime_active(struct request_queue *q) {} ++static inline void blk_set_runtime_active(struct request_queue *q) {} + #endif + + /* diff --git a/queue-4.9/bq24190_charger-fix-pm-runtime-use-for-bq24190_battery_set_property.patch b/queue-4.9/bq24190_charger-fix-pm-runtime-use-for-bq24190_battery_set_property.patch new file mode 100644 index 00000000000..4aa699f90d6 --- /dev/null +++ b/queue-4.9/bq24190_charger-fix-pm-runtime-use-for-bq24190_battery_set_property.patch @@ -0,0 +1,33 @@ +From 075eb5719d53e8bb4a406ad87e1de99319aa50f0 Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Mon, 14 Nov 2016 19:38:31 -0800 +Subject: bq24190_charger: Fix PM runtime use for bq24190_battery_set_property + +From: Tony Lindgren + +commit 075eb5719d53e8bb4a406ad87e1de99319aa50f0 upstream. + +There's a typo, it should do pm_runtime_get_sync, not put. + +Fixes: d7bf353fd0aa3 ("bq24190_charger: Add support for TI BQ24190 Battery Charger") +Cc: Mark A. Greer +Signed-off-by: Tony Lindgren +Reviewed-by: Mark Greer +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/power/supply/bq24190_charger.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/power/supply/bq24190_charger.c ++++ b/drivers/power/supply/bq24190_charger.c +@@ -1141,7 +1141,7 @@ static int bq24190_battery_set_property( + + dev_dbg(bdi->dev, "prop: %d\n", psp); + +- pm_runtime_put_sync(bdi->dev); ++ pm_runtime_get_sync(bdi->dev); + + switch (psp) { + case POWER_SUPPLY_PROP_ONLINE: diff --git a/queue-4.9/btrfs-fix-error-handling-when-run_delayed_extent_op-fails.patch b/queue-4.9/btrfs-fix-error-handling-when-run_delayed_extent_op-fails.patch new file mode 100644 index 00000000000..041b521da88 --- /dev/null +++ b/queue-4.9/btrfs-fix-error-handling-when-run_delayed_extent_op-fails.patch @@ -0,0 +1,38 @@ +From aa7c8da35d1905d80e840d075f07d26ec90144b5 Mon Sep 17 00:00:00 2001 +From: Jeff Mahoney +Date: Tue, 20 Dec 2016 13:28:27 -0500 +Subject: btrfs: fix error handling when run_delayed_extent_op fails + +From: Jeff Mahoney + +commit aa7c8da35d1905d80e840d075f07d26ec90144b5 upstream. + +In __btrfs_run_delayed_refs, the error path when run_delayed_extent_op +fails sets locked_ref->processing = 0 but doesn't re-increment +delayed_refs->num_heads_ready. As a result, we end up triggering +the WARN_ON in btrfs_select_ref_head. + +Fixes: d7df2c796d7 (Btrfs: attach delayed ref updates to delayed ref heads) +Reported-by: Jon Nelson +Signed-off-by: Jeff Mahoney +Reviewed-by: Liu Bo +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/extent-tree.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -2587,7 +2587,10 @@ static noinline int __btrfs_run_delayed_ + */ + if (must_insert_reserved) + locked_ref->must_insert_reserved = 1; ++ spin_lock(&delayed_refs->lock); + locked_ref->processing = 0; ++ delayed_refs->num_heads_ready++; ++ spin_unlock(&delayed_refs->lock); + btrfs_debug(fs_info, + "run_delayed_extent_op returned %d", + ret); diff --git a/queue-4.9/btrfs-fix-locking-when-we-put-back-a-delayed-ref-that-s-too-new.patch b/queue-4.9/btrfs-fix-locking-when-we-put-back-a-delayed-ref-that-s-too-new.patch new file mode 100644 index 00000000000..bcdbc746724 --- /dev/null +++ b/queue-4.9/btrfs-fix-locking-when-we-put-back-a-delayed-ref-that-s-too-new.patch @@ -0,0 +1,40 @@ +From d0280996437081dd12ed1e982ac8aeaa62835ec4 Mon Sep 17 00:00:00 2001 +From: Jeff Mahoney +Date: Tue, 20 Dec 2016 13:28:28 -0500 +Subject: btrfs: fix locking when we put back a delayed ref that's too new + +From: Jeff Mahoney + +commit d0280996437081dd12ed1e982ac8aeaa62835ec4 upstream. + +In __btrfs_run_delayed_refs, when we put back a delayed ref that's too +new, we have already dropped the lock on locked_ref when we set +->processing = 0. + +This patch keeps the lock to cover that assignment. + +Fixes: d7df2c796d7 (Btrfs: attach delayed ref updates to delayed ref heads) +Signed-off-by: Jeff Mahoney +Reviewed-by: Liu Bo +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/extent-tree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -2537,11 +2537,11 @@ static noinline int __btrfs_run_delayed_ + if (ref && ref->seq && + btrfs_check_delayed_seq(fs_info, delayed_refs, ref->seq)) { + spin_unlock(&locked_ref->lock); +- btrfs_delayed_ref_unlock(locked_ref); + spin_lock(&delayed_refs->lock); + locked_ref->processing = 0; + delayed_refs->num_heads_ready++; + spin_unlock(&delayed_refs->lock); ++ btrfs_delayed_ref_unlock(locked_ref); + locked_ref = NULL; + cond_resched(); + count++; diff --git a/queue-4.9/bus-vexpress-config-fix-device-reference-leak.patch b/queue-4.9/bus-vexpress-config-fix-device-reference-leak.patch new file mode 100644 index 00000000000..afbc85799bc --- /dev/null +++ b/queue-4.9/bus-vexpress-config-fix-device-reference-leak.patch @@ -0,0 +1,45 @@ +From c090959b9dd8c87703e275079aa4b4a824ba3f8e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 16 Nov 2016 17:31:30 +0000 +Subject: bus: vexpress-config: fix device reference leak + +From: Johan Hovold + +commit c090959b9dd8c87703e275079aa4b4a824ba3f8e upstream. + +Make sure to drop the reference to the parent device taken by +class_find_device() after populating the bus. + +Fixes: 3b9334ac835b ("mfd: vexpress: Convert custom func API to regmap") +Acked-by: Sudeep Holla +Signed-off-by: Johan Hovold +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bus/vexpress-config.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/bus/vexpress-config.c ++++ b/drivers/bus/vexpress-config.c +@@ -171,6 +171,7 @@ static int vexpress_config_populate(stru + { + struct device_node *bridge; + struct device *parent; ++ int ret; + + bridge = of_parse_phandle(node, "arm,vexpress,config-bridge", 0); + if (!bridge) +@@ -182,7 +183,11 @@ static int vexpress_config_populate(stru + if (WARN_ON(!parent)) + return -ENODEV; + +- return of_platform_populate(node, NULL, NULL, parent); ++ ret = of_platform_populate(node, NULL, NULL, parent); ++ ++ put_device(parent); ++ ++ return ret; + } + + static int __init vexpress_config_init(void) diff --git a/queue-4.9/clearing-fifos-in-rs485-emulation-mode-causes-subsequent-transmits-to-break.patch b/queue-4.9/clearing-fifos-in-rs485-emulation-mode-causes-subsequent-transmits-to-break.patch new file mode 100644 index 00000000000..631cc5b9b96 --- /dev/null +++ b/queue-4.9/clearing-fifos-in-rs485-emulation-mode-causes-subsequent-transmits-to-break.patch @@ -0,0 +1,44 @@ +From 2bed8a8e70729f996af92042d3ad0f11870acc1f Mon Sep 17 00:00:00 2001 +From: Daniel Jedrychowski +Date: Mon, 12 Dec 2016 09:18:28 +1100 +Subject: Clearing FIFOs in RS485 emulation mode causes subsequent transmits to break + +From: Daniel Jedrychowski + +commit 2bed8a8e70729f996af92042d3ad0f11870acc1f upstream. + +When in RS485 emulation mode, __do_stop_tx_rs485() calls +serial8250_clear_fifos(). This not only clears the FIFOs, but also sets +all bits in their control register (UART_FCR) to 0. + +One of the effects of this is the disabling of the FIFOs, which turns +them into single-byte holding registers. The rest of the driver doesn't +know this, which results in the lions share of characters passed into a +write call to be dropped. + +(I can supply logic analyzer screenshots if necessary) + +This fix replaces the serial8250_clear_fifos() call to +serial8250_clear_and_reinit_fifos() - this prevents the "dropped +characters" issue from manifesting again while retaining the requirement +of clearing the RX FIFO after transmission if the SER_RS485_RX_DURING_TX +flag is disabled. + +Signed-off-by: Daniel Jedrychowski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/8250/8250_port.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -1411,7 +1411,7 @@ static void __do_stop_tx_rs485(struct ua + * Enable previously disabled RX interrupts. + */ + if (!(p->port.rs485.flags & SER_RS485_RX_DURING_TX)) { +- serial8250_clear_fifos(p); ++ serial8250_clear_and_reinit_fifos(p); + + p->ier |= UART_IER_RLSI | UART_IER_RDI; + serial_port_out(&p->port, UART_IER, p->ier); diff --git a/queue-4.9/cpufreq-powernv-disable-preemption-while-checking-cpu-throttling-state.patch b/queue-4.9/cpufreq-powernv-disable-preemption-while-checking-cpu-throttling-state.patch new file mode 100644 index 00000000000..c9b7bd97801 --- /dev/null +++ b/queue-4.9/cpufreq-powernv-disable-preemption-while-checking-cpu-throttling-state.patch @@ -0,0 +1,59 @@ +From 8a10c06a20ec8097a68fd7a4a1c0e285095b4d2f Mon Sep 17 00:00:00 2001 +From: Denis Kirjanov +Date: Tue, 8 Nov 2016 05:39:28 -0500 +Subject: cpufreq: powernv: Disable preemption while checking CPU throttling state + +From: Denis Kirjanov + +commit 8a10c06a20ec8097a68fd7a4a1c0e285095b4d2f upstream. + +With preemption turned on we can read incorrect throttling state +while being switched to CPU on a different chip. + + BUG: using smp_processor_id() in preemptible [00000000] code: cat/7343 + caller is .powernv_cpufreq_throttle_check+0x2c/0x710 + CPU: 13 PID: 7343 Comm: cat Not tainted 4.8.0-rc5-dirty #1 + Call Trace: + [c0000007d25b75b0] [c000000000971378] .dump_stack+0xe4/0x150 (unreliable) + [c0000007d25b7640] [c0000000005162e4] .check_preemption_disabled+0x134/0x150 + [c0000007d25b76e0] [c0000000007b63ac] .powernv_cpufreq_throttle_check+0x2c/0x710 + [c0000007d25b7790] [c0000000007b6d18] .powernv_cpufreq_target_index+0x288/0x360 + [c0000007d25b7870] [c0000000007acee4] .__cpufreq_driver_target+0x394/0x8c0 + [c0000007d25b7920] [c0000000007b22ac] .cpufreq_set+0x7c/0xd0 + [c0000007d25b79b0] [c0000000007adf50] .store_scaling_setspeed+0x80/0xc0 + [c0000007d25b7a40] [c0000000007ae270] .store+0xa0/0x100 + [c0000007d25b7ae0] [c0000000003566e8] .sysfs_kf_write+0x88/0xb0 + [c0000007d25b7b70] [c0000000003553b8] .kernfs_fop_write+0x178/0x260 + [c0000007d25b7c10] [c0000000002ac3cc] .__vfs_write+0x3c/0x1c0 + [c0000007d25b7cf0] [c0000000002ad584] .vfs_write+0xc4/0x230 + [c0000007d25b7d90] [c0000000002aeef8] .SyS_write+0x58/0x100 + [c0000007d25b7e30] [c00000000000bfec] system_call+0x38/0xfc + +Fixes: 09a972d16209 (cpufreq: powernv: Report cpu frequency throttling) +Reviewed-by: Gautham R. Shenoy +Signed-off-by: Denis Kirjanov +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/powernv-cpufreq.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/cpufreq/powernv-cpufreq.c ++++ b/drivers/cpufreq/powernv-cpufreq.c +@@ -647,8 +647,14 @@ static int powernv_cpufreq_target_index( + if (unlikely(rebooting) && new_index != get_nominal_index()) + return 0; + +- if (!throttled) ++ if (!throttled) { ++ /* we don't want to be preempted while ++ * checking if the CPU frequency has been throttled ++ */ ++ preempt_disable(); + powernv_cpufreq_throttle_check(NULL); ++ preempt_enable(); ++ } + + cur_msec = jiffies_to_msecs(get_jiffies_64()); + diff --git a/queue-4.9/dmaengine-omap-dma-fix-dynamic-lch_map-allocation.patch b/queue-4.9/dmaengine-omap-dma-fix-dynamic-lch_map-allocation.patch new file mode 100644 index 00000000000..57843f953fe --- /dev/null +++ b/queue-4.9/dmaengine-omap-dma-fix-dynamic-lch_map-allocation.patch @@ -0,0 +1,82 @@ +From 836c3ce2566fb8c1754f8d7c9534cad9bc8a6879 Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Mon, 2 Jan 2017 12:07:37 +0200 +Subject: dmaengine: omap-dma: Fix dynamic lch_map allocation + +From: Peter Ujfalusi + +commit 836c3ce2566fb8c1754f8d7c9534cad9bc8a6879 upstream. + +The original patch did not done what it was supposed to be doing and even +worst it broke legacy boot (OMAP1). + +The lch_map size should be the number of available logical channels in sDMA +and the od->dma_requests should store the number of available DMA request +lines usable in sDMA. + +In legacy mode we do not have a way to get the DMA request count, in that +case we use OMAP_SDMA_REQUESTS (127), despite the fact that OMAP1510 have +only 31 DMA request line. + +Fixes: 2d1a9a946fae ("dmaengine: omap-dma: Dynamically allocate memory for lch_map") +Reported-by: Aaro Koskinen +Signed-off-by: Peter Ujfalusi +Tested-by: Aaro Koskinen +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/omap-dma.c | 30 +++++++++++++++++++++--------- + 1 file changed, 21 insertions(+), 9 deletions(-) + +--- a/drivers/dma/omap-dma.c ++++ b/drivers/dma/omap-dma.c +@@ -1339,6 +1339,7 @@ static int omap_dma_probe(struct platfor + struct omap_dmadev *od; + struct resource *res; + int rc, i, irq; ++ u32 lch_count; + + od = devm_kzalloc(&pdev->dev, sizeof(*od), GFP_KERNEL); + if (!od) +@@ -1381,20 +1382,31 @@ static int omap_dma_probe(struct platfor + spin_lock_init(&od->lock); + spin_lock_init(&od->irq_lock); + +- if (!pdev->dev.of_node) { +- od->dma_requests = od->plat->dma_attr->lch_count; +- if (unlikely(!od->dma_requests)) +- od->dma_requests = OMAP_SDMA_REQUESTS; +- } else if (of_property_read_u32(pdev->dev.of_node, "dma-requests", +- &od->dma_requests)) { ++ /* Number of DMA requests */ ++ od->dma_requests = OMAP_SDMA_REQUESTS; ++ if (pdev->dev.of_node && of_property_read_u32(pdev->dev.of_node, ++ "dma-requests", ++ &od->dma_requests)) { + dev_info(&pdev->dev, + "Missing dma-requests property, using %u.\n", + OMAP_SDMA_REQUESTS); +- od->dma_requests = OMAP_SDMA_REQUESTS; + } + +- od->lch_map = devm_kcalloc(&pdev->dev, od->dma_requests, +- sizeof(*od->lch_map), GFP_KERNEL); ++ /* Number of available logical channels */ ++ if (!pdev->dev.of_node) { ++ lch_count = od->plat->dma_attr->lch_count; ++ if (unlikely(!lch_count)) ++ lch_count = OMAP_SDMA_CHANNELS; ++ } else if (of_property_read_u32(pdev->dev.of_node, "dma-channels", ++ &lch_count)) { ++ dev_info(&pdev->dev, ++ "Missing dma-channels property, using %u.\n", ++ OMAP_SDMA_CHANNELS); ++ lch_count = OMAP_SDMA_CHANNELS; ++ } ++ ++ od->lch_map = devm_kcalloc(&pdev->dev, lch_count, sizeof(*od->lch_map), ++ GFP_KERNEL); + if (!od->lch_map) + return -ENOMEM; + diff --git a/queue-4.9/drm-amdgpu-drop-verde-dpm-quirks.patch b/queue-4.9/drm-amdgpu-drop-verde-dpm-quirks.patch new file mode 100644 index 00000000000..92df978cf46 --- /dev/null +++ b/queue-4.9/drm-amdgpu-drop-verde-dpm-quirks.patch @@ -0,0 +1,41 @@ +From 7192c54a68013f6058b1bb505645fcd07015191c Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 5 Jan 2017 13:02:37 -0500 +Subject: drm/amdgpu: drop verde dpm quirks + +From: Alex Deucher + +commit 7192c54a68013f6058b1bb505645fcd07015191c upstream. + +Port of radeon change to amdgpu. + +Acked-by: Edward O'Callaghan +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/si_dpm.c | 13 ------------- + 1 file changed, 13 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c ++++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c +@@ -3485,19 +3485,6 @@ static void si_apply_state_adjust_rules( + (adev->pdev->device == 0x6817) || + (adev->pdev->device == 0x6806)) + max_mclk = 120000; +- } else if (adev->asic_type == CHIP_VERDE) { +- if ((adev->pdev->revision == 0x81) || +- (adev->pdev->revision == 0x83) || +- (adev->pdev->revision == 0x87) || +- (adev->pdev->device == 0x6820) || +- (adev->pdev->device == 0x6821) || +- (adev->pdev->device == 0x6822) || +- (adev->pdev->device == 0x6823) || +- (adev->pdev->device == 0x682A) || +- (adev->pdev->device == 0x682B)) { +- max_sclk = 75000; +- max_mclk = 80000; +- } + } else if (adev->asic_type == CHIP_OLAND) { + if ((adev->pdev->revision == 0xC7) || + (adev->pdev->revision == 0x80) || diff --git a/queue-4.9/drm-amdgpu-update-si-kicker-smc-firmware.patch b/queue-4.9/drm-amdgpu-update-si-kicker-smc-firmware.patch new file mode 100644 index 00000000000..1c0805f4e6e --- /dev/null +++ b/queue-4.9/drm-amdgpu-update-si-kicker-smc-firmware.patch @@ -0,0 +1,110 @@ +From 5165484b02f2cbedb5bf3a41ff5e8ae16069016c Mon Sep 17 00:00:00 2001 +From: Flora Cui +Date: Thu, 15 Dec 2016 13:43:59 +0800 +Subject: drm/amdgpu: update si kicker smc firmware + +From: Flora Cui + +commit 5165484b02f2cbedb5bf3a41ff5e8ae16069016c upstream. + +Use the appropriate smc firmware for each chip revision. +Using the wrong one can cause stability issues. + +Acked-by: Edward O'Callaghan +Signed-off-by: Flora Cui +Reviewed-by: Junwei Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/si_dpm.c | 57 +++++++++++++++++------------------- + 1 file changed, 28 insertions(+), 29 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c ++++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c +@@ -56,7 +56,6 @@ + #define BIOS_SCRATCH_4 0x5cd + + MODULE_FIRMWARE("radeon/tahiti_smc.bin"); +-MODULE_FIRMWARE("radeon/tahiti_k_smc.bin"); + MODULE_FIRMWARE("radeon/pitcairn_smc.bin"); + MODULE_FIRMWARE("radeon/pitcairn_k_smc.bin"); + MODULE_FIRMWARE("radeon/verde_smc.bin"); +@@ -7685,49 +7684,49 @@ static int si_dpm_init_microcode(struct + chip_name = "tahiti"; + break; + case CHIP_PITCAIRN: +- if ((adev->pdev->revision == 0x81) || +- (adev->pdev->device == 0x6810) || +- (adev->pdev->device == 0x6811) || +- (adev->pdev->device == 0x6816) || +- (adev->pdev->device == 0x6817) || +- (adev->pdev->device == 0x6806)) ++ if ((adev->pdev->revision == 0x81) && ++ ((adev->pdev->device == 0x6810) || ++ (adev->pdev->device == 0x6811))) + chip_name = "pitcairn_k"; + else + chip_name = "pitcairn"; + break; + case CHIP_VERDE: +- if ((adev->pdev->revision == 0x81) || +- (adev->pdev->revision == 0x83) || +- (adev->pdev->revision == 0x87) || +- (adev->pdev->device == 0x6820) || +- (adev->pdev->device == 0x6821) || +- (adev->pdev->device == 0x6822) || +- (adev->pdev->device == 0x6823) || +- (adev->pdev->device == 0x682A) || +- (adev->pdev->device == 0x682B)) ++ if (((adev->pdev->device == 0x6820) && ++ ((adev->pdev->revision == 0x81) || ++ (adev->pdev->revision == 0x83))) || ++ ((adev->pdev->device == 0x6821) && ++ ((adev->pdev->revision == 0x83) || ++ (adev->pdev->revision == 0x87))) || ++ ((adev->pdev->revision == 0x87) && ++ ((adev->pdev->device == 0x6823) || ++ (adev->pdev->device == 0x682b)))) + chip_name = "verde_k"; + else + chip_name = "verde"; + break; + case CHIP_OLAND: +- if ((adev->pdev->revision == 0xC7) || +- (adev->pdev->revision == 0x80) || +- (adev->pdev->revision == 0x81) || +- (adev->pdev->revision == 0x83) || +- (adev->pdev->revision == 0x87) || +- (adev->pdev->device == 0x6604) || +- (adev->pdev->device == 0x6605)) ++ if (((adev->pdev->revision == 0x81) && ++ ((adev->pdev->device == 0x6600) || ++ (adev->pdev->device == 0x6604) || ++ (adev->pdev->device == 0x6605) || ++ (adev->pdev->device == 0x6610))) || ++ ((adev->pdev->revision == 0x83) && ++ (adev->pdev->device == 0x6610))) + chip_name = "oland_k"; + else + chip_name = "oland"; + break; + case CHIP_HAINAN: +- if ((adev->pdev->revision == 0x81) || +- (adev->pdev->revision == 0x83) || +- (adev->pdev->revision == 0xC3) || +- (adev->pdev->device == 0x6664) || +- (adev->pdev->device == 0x6665) || +- (adev->pdev->device == 0x6667)) ++ if (((adev->pdev->revision == 0x81) && ++ (adev->pdev->device == 0x6660)) || ++ ((adev->pdev->revision == 0x83) && ++ ((adev->pdev->device == 0x6660) || ++ (adev->pdev->device == 0x6663) || ++ (adev->pdev->device == 0x6665) || ++ (adev->pdev->device == 0x6667))) || ++ ((adev->pdev->revision == 0xc3) && ++ (adev->pdev->device == 0x6665))) + chip_name = "hainan_k"; + else + chip_name = "hainan"; diff --git a/queue-4.9/drm-avoid-uninitialized-timestamp-use-in-wait_vblank.patch b/queue-4.9/drm-avoid-uninitialized-timestamp-use-in-wait_vblank.patch new file mode 100644 index 00000000000..5a2823b7164 --- /dev/null +++ b/queue-4.9/drm-avoid-uninitialized-timestamp-use-in-wait_vblank.patch @@ -0,0 +1,49 @@ +From cff52e5fc4cfc978b7df898dc14a0492c7ef0ae8 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Tue, 18 Oct 2016 00:13:39 +0200 +Subject: drm: avoid uninitialized timestamp use in wait_vblank + +From: Arnd Bergmann + +commit cff52e5fc4cfc978b7df898dc14a0492c7ef0ae8 upstream. + +gcc warns about the timestamp in drm_wait_vblank being possibly +used without an initialization: + +drivers/gpu/drm/drm_irq.c: In function 'drm_crtc_send_vblank_event': +drivers/gpu/drm/drm_irq.c:992:24: error: 'now.tv_usec' may be used uninitialized in this function [-Werror=maybe-uninitialized] +drivers/gpu/drm/drm_irq.c:1069:17: note: 'now.tv_usec' was declared here +drivers/gpu/drm/drm_irq.c:991:23: error: 'now.tv_sec' may be used uninitialized in this function [-Werror=maybe-uninitialized] + +This can happen if drm_vblank_count_and_time() returns 0 in its +error path. To sanitize the error case, I'm changing that function +to return a zero timestamp when it fails. + +Fixes: e6ae8687a87b ("drm: idiot-proof vblank") +Reviewed-by: David Herrmann +Cc: Rob Clark +Cc: Daniel Vetter +Signed-off-by: Arnd Bergmann +Reviewed-by: Mario Kleiner +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/20161017221355.1861551-6-arnd@arndb.de +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_irq.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_irq.c ++++ b/drivers/gpu/drm/drm_irq.c +@@ -952,8 +952,10 @@ static u32 drm_vblank_count_and_time(str + u32 vblank_count; + unsigned int seq; + +- if (WARN_ON(pipe >= dev->num_crtcs)) ++ if (WARN_ON(pipe >= dev->num_crtcs)) { ++ *vblanktime = (struct timeval) { 0 }; + return 0; ++ } + + do { + seq = read_seqbegin(&vblank->seqlock); diff --git a/queue-4.9/drm-clean-up-planes-in-atomic-commit-helper-failure-path.patch b/queue-4.9/drm-clean-up-planes-in-atomic-commit-helper-failure-path.patch new file mode 100644 index 00000000000..0b491e4b119 --- /dev/null +++ b/queue-4.9/drm-clean-up-planes-in-atomic-commit-helper-failure-path.patch @@ -0,0 +1,36 @@ +From aebe55c2d4b998741c0847ace1b4af47d73c763b Mon Sep 17 00:00:00 2001 +From: Laurent Pinchart +Date: Tue, 3 Jan 2017 01:14:27 +0200 +Subject: drm: Clean up planes in atomic commit helper failure path + +From: Laurent Pinchart + +commit aebe55c2d4b998741c0847ace1b4af47d73c763b upstream. + +If waiting for fences fails for blocking commits, planes must be cleaned +up before returning. + +Fixes: f6ce410a59a4 ("drm/fence: allow fence waiting to be interrupted by userspace") +Signed-off-by: Laurent Pinchart +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/20170102231427.7192-1-laurent.pinchart@ideasonboard.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_atomic_helper.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_atomic_helper.c ++++ b/drivers/gpu/drm/drm_atomic_helper.c +@@ -1253,8 +1253,10 @@ int drm_atomic_helper_commit(struct drm_ + + if (!nonblock) { + ret = drm_atomic_helper_wait_for_fences(dev, state, true); +- if (ret) ++ if (ret) { ++ drm_atomic_helper_cleanup_planes(dev, state); + return ret; ++ } + } + + /* diff --git a/queue-4.9/drm-i915-gen9-fix-pcode-polling-during-sagv-disabling.patch b/queue-4.9/drm-i915-gen9-fix-pcode-polling-during-sagv-disabling.patch new file mode 100644 index 00000000000..2fceb6a742d --- /dev/null +++ b/queue-4.9/drm-i915-gen9-fix-pcode-polling-during-sagv-disabling.patch @@ -0,0 +1,101 @@ +From dccf82ad1775f2b9c36ec85e25e39d88c7e86818 Mon Sep 17 00:00:00 2001 +From: Imre Deak +Date: Mon, 5 Dec 2016 18:27:38 +0200 +Subject: drm/i915/gen9: Fix PCODE polling during SAGV disabling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Imre Deak + +commit dccf82ad1775f2b9c36ec85e25e39d88c7e86818 upstream. + +According to the previous patch, it's possible atm that we call +intel_do_sagv_disable() only once during the 1ms period and time out if +that call fails. As opposed to this the spec says that we need to keep +retrying this request for a 1ms duration, so let's do this similarly to +the CDCLK change notification request. + +v4-5: +- Rebased on the reply_mask, reply change. +v6: +- Remove w/s change. (Lyude) +- Rebased on the timeout_base argument change. + +Cc: Lyude +Cc: Ville Syrjälä +Cc: Chris Wilson +Fixes: 656d1b89e5ff ("drm/i915/skl: Add support for the SAGV, fix underrun hangs") +Signed-off-by: Imre Deak +Reviewed-by: Lyude (v4) +Link: http://patchwork.freedesktop.org/patch/msgid/1480955258-26311-2-git-send-email-imre.deak@intel.com +(cherry picked from commit b3b8e99984a4eace91bc097e8f8cec71441cae16) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_pm.c | 34 +++++++++------------------------- + 1 file changed, 9 insertions(+), 25 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -2955,24 +2955,10 @@ intel_enable_sagv(struct drm_i915_privat + return 0; + } + +-static int +-intel_do_sagv_disable(struct drm_i915_private *dev_priv) +-{ +- int ret; +- uint32_t temp = GEN9_SAGV_DISABLE; +- +- ret = sandybridge_pcode_read(dev_priv, GEN9_PCODE_SAGV_CONTROL, +- &temp); +- if (ret) +- return ret; +- else +- return temp & GEN9_SAGV_IS_DISABLED; +-} +- + int + intel_disable_sagv(struct drm_i915_private *dev_priv) + { +- int ret, result; ++ int ret; + + if (!intel_has_sagv(dev_priv)) + return 0; +@@ -2984,25 +2970,23 @@ intel_disable_sagv(struct drm_i915_priva + mutex_lock(&dev_priv->rps.hw_lock); + + /* bspec says to keep retrying for at least 1 ms */ +- ret = wait_for(result = intel_do_sagv_disable(dev_priv), 1); ++ ret = skl_pcode_request(dev_priv, GEN9_PCODE_SAGV_CONTROL, ++ GEN9_SAGV_DISABLE, ++ GEN9_SAGV_IS_DISABLED, GEN9_SAGV_IS_DISABLED, ++ 1); + mutex_unlock(&dev_priv->rps.hw_lock); + +- if (ret == -ETIMEDOUT) { +- DRM_ERROR("Request to disable SAGV timed out\n"); +- return -ETIMEDOUT; +- } +- + /* + * Some skl systems, pre-release machines in particular, + * don't actually have an SAGV. + */ +- if (IS_SKYLAKE(dev_priv) && result == -ENXIO) { ++ if (IS_SKYLAKE(dev_priv) && ret == -ENXIO) { + DRM_DEBUG_DRIVER("No SAGV found on system, ignoring\n"); + dev_priv->sagv_status = I915_SAGV_NOT_CONTROLLED; + return 0; +- } else if (result < 0) { +- DRM_ERROR("Failed to disable the SAGV\n"); +- return result; ++ } else if (ret < 0) { ++ DRM_ERROR("Failed to disable the SAGV (%d)\n", ret); ++ return ret; + } + + dev_priv->sagv_status = I915_SAGV_DISABLED; diff --git a/queue-4.9/drm-i915-gen9-fix-pcode-polling-timeout-in-stable-backport.patch b/queue-4.9/drm-i915-gen9-fix-pcode-polling-timeout-in-stable-backport.patch new file mode 100644 index 00000000000..704b65bebae --- /dev/null +++ b/queue-4.9/drm-i915-gen9-fix-pcode-polling-timeout-in-stable-backport.patch @@ -0,0 +1,42 @@ +From imre.deak@intel.com Tue Jan 17 16:22:12 2017 +From: Imre Deak +Date: Mon, 16 Jan 2017 18:59:46 +0200 +Subject: drm/i915/gen9: Fix PCODE polling timeout in stable backport +To: Thomas Backlund +Cc: gregkh@linuxfoundation.org, arthur.j.runyan@intel.com, chris@chris-wilson.co.uk, jani.nikula@intel.com, stable@vger.kernel.org, ville.syrjala@linux.intel.com, stable-commits@vger.kernel.org +Message-ID: <20170116165946.GB4514@ideak-desk.fi.intel.com> +Content-Disposition: inline + +From: Imre Deak + +The backport of +2c7d0602c - "Fix PCODE polling during CDCLK change notification" +to the 4.9 stable tree used an incorrect timeout value. Fix this up +so the backport matches the upstream commit. + +Reported-by: Thomas Backlund +Signed-off-by: Imre Deak +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/intel_pm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -8015,14 +8015,14 @@ int skl_pcode_request(struct drm_i915_pr + * worst case) _and_ PCODE was busy for some reason even after a + * (queued) request and @timeout_base_ms delay. As a workaround retry + * the poll with preemption disabled to maximize the number of +- * requests. Increase the timeout from @timeout_base_ms to 50ms to ++ * requests. Increase the timeout from @timeout_base_ms to 10ms to + * account for interrupts that could reduce the number of these + * requests. + */ + DRM_DEBUG_KMS("PCODE timeout, retrying with preemption disabled\n"); + WARN_ON_ONCE(timeout_base_ms > 3); + preempt_disable(); +- ret = wait_for_atomic(COND, 50); ++ ret = wait_for_atomic(COND, 10); + preempt_enable(); + + out: diff --git a/queue-4.9/drm-i915-move-the-min_pixclk-handling-to-the-end-of-readout.patch b/queue-4.9/drm-i915-move-the-min_pixclk-handling-to-the-end-of-readout.patch new file mode 100644 index 00000000000..320a80df3c1 --- /dev/null +++ b/queue-4.9/drm-i915-move-the-min_pixclk-handling-to-the-end-of-readout.patch @@ -0,0 +1,102 @@ +From 00b2b7288299a8c73c0c37b531a075ba5c849e67 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Tue, 20 Dec 2016 17:39:02 +0200 +Subject: drm/i915: Move the min_pixclk[] handling to the end of readout +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 00b2b7288299a8c73c0c37b531a075ba5c849e67 upstream. + +Trying to determine the pixel rate of the pipe can't be done until we +know the clock, which means it can't be done until the encoder +.get_config() hooks have been called. So let's move the min_pixclk[] +stuff to the end of intel_modeset_readout_hw_state() when we actually +have gathered all the required infromation. + +Cc: Maarten Lankhorst +Cc: Mika Kahola +Cc: Ander Conselvan de Oliveira +Fixes: 565602d7501a ("drm/i915: Do not acquire crtc state to check clock during modeset, v4.") +Signed-off-by: Ville Syrjälä +Link: http://patchwork.freedesktop.org/patch/msgid/20161220153902.15621-1-ville.syrjala@linux.intel.com +Reviewed-by: Ander Conselvan de Oliveira +Reviewed-by: Maarten Lankhorst +(cherry picked from commit aca1ebf491518910df156f3dab6a66306bb52e28) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_display.c | 32 ++++++++++++++++---------------- + 1 file changed, 16 insertions(+), 16 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -16749,7 +16749,6 @@ static void intel_modeset_readout_hw_sta + + for_each_intel_crtc(dev, crtc) { + struct intel_crtc_state *crtc_state = crtc->config; +- int pixclk = 0; + + __drm_atomic_helper_crtc_destroy_state(&crtc_state->base); + memset(crtc_state, 0, sizeof(*crtc_state)); +@@ -16761,23 +16760,9 @@ static void intel_modeset_readout_hw_sta + crtc->base.enabled = crtc_state->base.enable; + crtc->active = crtc_state->base.active; + +- if (crtc_state->base.active) { ++ if (crtc_state->base.active) + dev_priv->active_crtcs |= 1 << crtc->pipe; + +- if (INTEL_GEN(dev_priv) >= 9 || IS_BROADWELL(dev_priv)) +- pixclk = ilk_pipe_pixel_rate(crtc_state); +- else if (IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv)) +- pixclk = crtc_state->base.adjusted_mode.crtc_clock; +- else +- WARN_ON(dev_priv->display.modeset_calc_cdclk); +- +- /* pixel rate mustn't exceed 95% of cdclk with IPS on BDW */ +- if (IS_BROADWELL(dev_priv) && crtc_state->ips_enabled) +- pixclk = DIV_ROUND_UP(pixclk * 100, 95); +- } +- +- dev_priv->min_pixclk[crtc->pipe] = pixclk; +- + readout_plane_state(crtc); + + DRM_DEBUG_KMS("[CRTC:%d:%s] hw state readout: %s\n", +@@ -16851,6 +16836,8 @@ static void intel_modeset_readout_hw_sta + } + + for_each_intel_crtc(dev, crtc) { ++ int pixclk = 0; ++ + crtc->base.hwmode = crtc->config->base.adjusted_mode; + + memset(&crtc->base.mode, 0, sizeof(crtc->base.mode)); +@@ -16878,10 +16865,23 @@ static void intel_modeset_readout_hw_sta + */ + crtc->base.state->mode.private_flags = I915_MODE_FLAG_INHERITED; + ++ if (INTEL_GEN(dev_priv) >= 9 || IS_BROADWELL(dev_priv)) ++ pixclk = ilk_pipe_pixel_rate(crtc->config); ++ else if (IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv)) ++ pixclk = crtc->config->base.adjusted_mode.crtc_clock; ++ else ++ WARN_ON(dev_priv->display.modeset_calc_cdclk); ++ ++ /* pixel rate mustn't exceed 95% of cdclk with IPS on BDW */ ++ if (IS_BROADWELL(dev_priv) && crtc->config->ips_enabled) ++ pixclk = DIV_ROUND_UP(pixclk * 100, 95); ++ + drm_calc_timestamping_constants(&crtc->base, &crtc->base.hwmode); + update_scanline_offset(crtc); + } + ++ dev_priv->min_pixclk[crtc->pipe] = pixclk; ++ + intel_pipe_config_sanity_check(dev_priv, crtc->config); + } + } diff --git a/queue-4.9/drm-initialise-drm_mm.head_node.allocated.patch b/queue-4.9/drm-initialise-drm_mm.head_node.allocated.patch new file mode 100644 index 00000000000..9c08476d6ce --- /dev/null +++ b/queue-4.9/drm-initialise-drm_mm.head_node.allocated.patch @@ -0,0 +1,92 @@ +From cc98e6ce6abe1c0103cbd7aff1ee586622a9361e Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Wed, 30 Nov 2016 20:51:26 +0000 +Subject: drm: Initialise drm_mm.head_node.allocated + +From: Chris Wilson + +commit cc98e6ce6abe1c0103cbd7aff1ee586622a9361e upstream. + +commit 202b52b7fbf7 ("drm: Track drm_mm nodes with an interval tree") +introduced a requirement that the special drm_mm.head_node was +initialised and marked as not being allocated. It is a very special node +that has no side but has a hole that represents the drm_mm address +space, and holds the list of nodes. Since it is not a real node, it is +not part of the node rbtree and we detect this as it being unallocated. +This presumed that drm_mm_init() was initialising it to zero. It happens +that i915 kzallocs its objects and so it was accidentally setting it, +but for generic use we cannot make that assumption. + +[ 22.981519] general protection fault: 0000 [#1] SMP +[ 22.981521] Modules linked in: test_drm_mm(+) ctr ccm arc4 rt2800usb rt2x00usb rt2800lib rt2x00lib crc_ccitt mac80211 cmac rfcomm bnep snd_hda_codec_realtek snd_hda_codec_hdmi snd_hda_codec_generic snd_hda_intel dcdbas snd_hda_codec x86_pkg_temp_thermal intel_powerclamp btusb snd_hda_core coretemp crct10dif_pclmul cfg80211 btrtl btbcm btintel bluetooth crc32_pclmul ghash_clmulni_intel aesni_intel snd_pcm i2c_hid aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd snd_timer hid_multitouch snd joydev serio_raw lpc_ich mfd_core i2c_designware_platform i2c_designware_core 8250_dw binfmt_misc soundcore acpi_pad nls_iso8859_1 usbhid hid psmouse ahci libahci [last unloaded: test_drm_mm] +[ 22.981544] CPU: 1 PID: 2088 Comm: drm_mm Tainted: G W 4.9.0-rc7+ #234 +[ 22.981545] Hardware name: Dell Inc. XPS 13 9343/0310JH, BIOS A07 11/11/2015 +[ 22.981546] task: ffff88020c971cc0 task.stack: ffffc90001728000 +[ 22.981547] RIP: 0010:[] [] drm_mm_interval_tree_add_node+0xa0/0xd0 +[ 22.981551] RSP: 0018:ffffc9000172ba98 EFLAGS: 00010202 +[ 22.981552] RAX: 0f0000c69cf63d80 RBX: ffff88020be00000 RCX: ffff88020be00000 +[ 22.981553] RDX: 0000000000000fff RSI: ffffc9000172bc48 RDI: ffffffff810ac4df +[ 22.981553] RBP: ffffc9000172bb08 R08: ffffc9000172bc70 R09: 0000000000000fff +[ 22.981554] R10: ffffffff810ac4d7 R11: 4dc04d8b4cffffe5 R12: 0000000000001000 +[ 22.981555] R13: ffffc9000172bbd0 R14: ffffc9000172bbe0 R15: 0000000002000000 +[ 22.981556] FS: 00007f80c9fab740(0000) GS:ffff88021f480000(0000) knlGS:0000000000000000 +[ 22.981557] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 22.981558] CR2: 00007f80c9fd5000 CR3: 000000020c191000 CR4: 00000000003406e0 +[ 22.981559] Stack: +[ 22.981560] ffffffff81405d09 ffff88020be00000 ffffc9000172bbe0 000000000172bb08 +[ 22.981562] ffffffffffffffff 0000000000000000 0000000000000000 0000000000000000 +[ 22.981563] 0000000002000000 0000000002000000 ffffffffa02f3000 ffff88020be00000 +[ 22.981565] Call Trace: +[ 22.981568] [] ? drm_mm_insert_node_generic+0x229/0x310 +[ 22.981570] [] ? 0xffffffffa02f3000 +[ 22.981572] [] __subtest_insert_range.constprop.7+0xd1/0x5b0 [test_drm_mm] +[ 22.981575] [] ? default_wake_function+0x12/0x20 +[ 22.981576] [] ? __wake_up_common+0x55/0x90 +[ 22.981578] [] ? sched_clock_cpu+0x72/0xa0 +[ 22.981581] [] ? irq_work_queue+0xd/0x80 +[ 22.981582] [] ? wake_up_klogd+0x34/0x40 +[ 22.981584] [] ? console_unlock+0x4cd/0x530 +[ 22.981585] [] ? vprintk_emit+0x2d7/0x490 +[ 22.981587] [] ? vprintk_default+0x1f/0x30 +[ 22.981589] [] ? printk+0x4d/0x4f +[ 22.981590] [] ? 0xffffffffa02f3000 +[ 22.981592] [] subtest_insert_range+0x15/0x80 [test_drm_mm] +[ 22.981594] [] test_drm_mm_init+0x88/0x1000 [test_drm_mm] +[ 22.981597] [] do_one_initcall+0x3d/0x150 +[ 22.981600] [] ? kfree+0x13f/0x180 +[ 22.981602] [] do_init_module+0x60/0x1f1 +[ 22.981606] [] load_module+0x2228/0x2790 +[ 22.981608] [] ? __symbol_put+0x40/0x40 +[ 22.981612] [] ? kernel_read+0x41/0x60 +[ 22.981614] [] SYSC_finit_module+0x96/0xd0 +[ 22.981617] [] SyS_finit_module+0xe/0x10 +[ 22.981620] [] entry_SYSCALL_64_fastpath+0x17/0x98 +[ 22.981622] Code: c7 41 30 00 00 00 00 48 89 e5 48 89 3a 48 c7 c2 20 4e 40 81 e8 b2 a1 f0 ff 5d c3 48 8d 56 78 45 31 d2 48 89 d6 eb 25 48 8b 51 58 <48> 39 50 38 73 04 48 89 50 38 4c 8b 58 28 4c 39 59 48 48 8d 50 +[ 22.981651] RIP [] drm_mm_interval_tree_add_node+0xa0/0xd0 +[ 22.981655] RSP + +Testcase: igt/drm_mm +Fixes: 202b52b7fbf7 ("drm: Track drm_mm nodes with an interval tree") +Signed-off-by: Chris Wilson +Cc: David Herrmann +Cc: dri-devel@lists.freedesktop.org +Cc: Daniel Vetter +Cc: # v4.9-rc1+ +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/20161130205126.31106-1-chris@chris-wilson.co.uk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_mm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/drm_mm.c ++++ b/drivers/gpu/drm/drm_mm.c +@@ -839,6 +839,7 @@ void drm_mm_init(struct drm_mm * mm, u64 + + /* Clever trick to avoid a special case in the free hole tracking. */ + INIT_LIST_HEAD(&mm->head_node.node_list); ++ mm->head_node.allocated = 0; + mm->head_node.hole_follows = 1; + mm->head_node.scanned_block = 0; + mm->head_node.scanned_prev_free = 0; diff --git a/queue-4.9/drm-panel-simple-check-against-num_timings-when-setting-preferred-for-timing.patch b/queue-4.9/drm-panel-simple-check-against-num_timings-when-setting-preferred-for-timing.patch new file mode 100644 index 00000000000..2ab2e869b8a --- /dev/null +++ b/queue-4.9/drm-panel-simple-check-against-num_timings-when-setting-preferred-for-timing.patch @@ -0,0 +1,32 @@ +From 230c5b44233ff0543c0b5ccf4ff9400057010fbe Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Mon, 24 Oct 2016 21:21:15 +0800 +Subject: drm/panel: simple: Check against num_timings when setting preferred for timing + +From: Chen-Yu Tsai + +commit 230c5b44233ff0543c0b5ccf4ff9400057010fbe upstream. + +In the loop on .timings, we should check .num_timings to see if it's the +only mode specified, not .num_modes, which should be used with .modes. + +Fixes: cda553725c92 ("drm/panel: simple: Set appropriate mode type") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/panel/panel-simple.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -120,7 +120,7 @@ static int panel_simple_get_fixed_modes( + + mode->type |= DRM_MODE_TYPE_DRIVER; + +- if (panel->desc->num_modes == 1) ++ if (panel->desc->num_timings == 1) + mode->type |= DRM_MODE_TYPE_PREFERRED; + + drm_mode_probed_add(connector, mode); diff --git a/queue-4.9/drm-radeon-drop-verde-dpm-quirks.patch b/queue-4.9/drm-radeon-drop-verde-dpm-quirks.patch new file mode 100644 index 00000000000..ea736b2a1b4 --- /dev/null +++ b/queue-4.9/drm-radeon-drop-verde-dpm-quirks.patch @@ -0,0 +1,44 @@ +From 8a08403bcb39f5d0e733bcf59a8a74f16b538f6e Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 5 Jan 2017 12:39:01 -0500 +Subject: drm/radeon: drop verde dpm quirks + +From: Alex Deucher + +commit 8a08403bcb39f5d0e733bcf59a8a74f16b538f6e upstream. + +fixes: +https://bugs.freedesktop.org/show_bug.cgi?id=98897 +https://bugs.launchpad.net/bugs/1651981 + +Acked-by: Edward O'Callaghan +Signed-off-by: Alex Deucher +Cc: Adrian Fiergolski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/si_dpm.c | 13 ------------- + 1 file changed, 13 deletions(-) + +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -3008,19 +3008,6 @@ static void si_apply_state_adjust_rules( + (rdev->pdev->device == 0x6817) || + (rdev->pdev->device == 0x6806)) + max_mclk = 120000; +- } else if (rdev->family == CHIP_VERDE) { +- if ((rdev->pdev->revision == 0x81) || +- (rdev->pdev->revision == 0x83) || +- (rdev->pdev->revision == 0x87) || +- (rdev->pdev->device == 0x6820) || +- (rdev->pdev->device == 0x6821) || +- (rdev->pdev->device == 0x6822) || +- (rdev->pdev->device == 0x6823) || +- (rdev->pdev->device == 0x682A) || +- (rdev->pdev->device == 0x682B)) { +- max_sclk = 75000; +- max_mclk = 80000; +- } + } else if (rdev->family == CHIP_OLAND) { + if ((rdev->pdev->revision == 0xC7) || + (rdev->pdev->revision == 0x80) || diff --git a/queue-4.9/drm-radeon-update-smc-firmware-selection-for-si.patch b/queue-4.9/drm-radeon-update-smc-firmware-selection-for-si.patch new file mode 100644 index 00000000000..ad115ef0561 --- /dev/null +++ b/queue-4.9/drm-radeon-update-smc-firmware-selection-for-si.patch @@ -0,0 +1,124 @@ +From 6458bd4dfd9414cba5804eb9907fe2a824278c34 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 5 Jan 2017 12:15:52 -0500 +Subject: drm/radeon: update smc firmware selection for SI + +From: Alex Deucher + +commit 6458bd4dfd9414cba5804eb9907fe2a824278c34 upstream. + +Use the appropriate smc firmware for each chip revision. +Using the wrong one can cause stability issues. + +Acked-by: Edward O'Callaghan +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/si.c | 60 ++++++++++++++++++++------------------------ + 1 file changed, 28 insertions(+), 32 deletions(-) + +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -50,7 +50,6 @@ MODULE_FIRMWARE("radeon/tahiti_ce.bin"); + MODULE_FIRMWARE("radeon/tahiti_mc.bin"); + MODULE_FIRMWARE("radeon/tahiti_rlc.bin"); + MODULE_FIRMWARE("radeon/tahiti_smc.bin"); +-MODULE_FIRMWARE("radeon/tahiti_k_smc.bin"); + + MODULE_FIRMWARE("radeon/PITCAIRN_pfp.bin"); + MODULE_FIRMWARE("radeon/PITCAIRN_me.bin"); +@@ -1657,9 +1656,6 @@ static int si_init_microcode(struct rade + switch (rdev->family) { + case CHIP_TAHITI: + chip_name = "TAHITI"; +- /* XXX: figure out which Tahitis need the new ucode */ +- if (0) +- new_smc = true; + new_chip_name = "tahiti"; + pfp_req_size = SI_PFP_UCODE_SIZE * 4; + me_req_size = SI_PM4_UCODE_SIZE * 4; +@@ -1671,12 +1667,9 @@ static int si_init_microcode(struct rade + break; + case CHIP_PITCAIRN: + chip_name = "PITCAIRN"; +- if ((rdev->pdev->revision == 0x81) || +- (rdev->pdev->device == 0x6810) || +- (rdev->pdev->device == 0x6811) || +- (rdev->pdev->device == 0x6816) || +- (rdev->pdev->device == 0x6817) || +- (rdev->pdev->device == 0x6806)) ++ if ((rdev->pdev->revision == 0x81) && ++ ((rdev->pdev->device == 0x6810) || ++ (rdev->pdev->device == 0x6811))) + new_smc = true; + new_chip_name = "pitcairn"; + pfp_req_size = SI_PFP_UCODE_SIZE * 4; +@@ -1689,15 +1682,15 @@ static int si_init_microcode(struct rade + break; + case CHIP_VERDE: + chip_name = "VERDE"; +- if ((rdev->pdev->revision == 0x81) || +- (rdev->pdev->revision == 0x83) || +- (rdev->pdev->revision == 0x87) || +- (rdev->pdev->device == 0x6820) || +- (rdev->pdev->device == 0x6821) || +- (rdev->pdev->device == 0x6822) || +- (rdev->pdev->device == 0x6823) || +- (rdev->pdev->device == 0x682A) || +- (rdev->pdev->device == 0x682B)) ++ if (((rdev->pdev->device == 0x6820) && ++ ((rdev->pdev->revision == 0x81) || ++ (rdev->pdev->revision == 0x83))) || ++ ((rdev->pdev->device == 0x6821) && ++ ((rdev->pdev->revision == 0x83) || ++ (rdev->pdev->revision == 0x87))) || ++ ((rdev->pdev->revision == 0x87) && ++ ((rdev->pdev->device == 0x6823) || ++ (rdev->pdev->device == 0x682b)))) + new_smc = true; + new_chip_name = "verde"; + pfp_req_size = SI_PFP_UCODE_SIZE * 4; +@@ -1710,13 +1703,13 @@ static int si_init_microcode(struct rade + break; + case CHIP_OLAND: + chip_name = "OLAND"; +- if ((rdev->pdev->revision == 0xC7) || +- (rdev->pdev->revision == 0x80) || +- (rdev->pdev->revision == 0x81) || +- (rdev->pdev->revision == 0x83) || +- (rdev->pdev->revision == 0x87) || +- (rdev->pdev->device == 0x6604) || +- (rdev->pdev->device == 0x6605)) ++ if (((rdev->pdev->revision == 0x81) && ++ ((rdev->pdev->device == 0x6600) || ++ (rdev->pdev->device == 0x6604) || ++ (rdev->pdev->device == 0x6605) || ++ (rdev->pdev->device == 0x6610))) || ++ ((rdev->pdev->revision == 0x83) && ++ (rdev->pdev->device == 0x6610))) + new_smc = true; + new_chip_name = "oland"; + pfp_req_size = SI_PFP_UCODE_SIZE * 4; +@@ -1728,12 +1721,15 @@ static int si_init_microcode(struct rade + break; + case CHIP_HAINAN: + chip_name = "HAINAN"; +- if ((rdev->pdev->revision == 0x81) || +- (rdev->pdev->revision == 0x83) || +- (rdev->pdev->revision == 0xC3) || +- (rdev->pdev->device == 0x6664) || +- (rdev->pdev->device == 0x6665) || +- (rdev->pdev->device == 0x6667)) ++ if (((rdev->pdev->revision == 0x81) && ++ (rdev->pdev->device == 0x6660)) || ++ ((rdev->pdev->revision == 0x83) && ++ ((rdev->pdev->device == 0x6660) || ++ (rdev->pdev->device == 0x6663) || ++ (rdev->pdev->device == 0x6665) || ++ (rdev->pdev->device == 0x6667))) || ++ ((rdev->pdev->revision == 0xc3) && ++ (rdev->pdev->device == 0x6665))) + new_smc = true; + new_chip_name = "hainan"; + pfp_req_size = SI_PFP_UCODE_SIZE * 4; diff --git a/queue-4.9/extcon-return-error-code-on-failure.patch b/queue-4.9/extcon-return-error-code-on-failure.patch new file mode 100644 index 00000000000..1046730ccef --- /dev/null +++ b/queue-4.9/extcon-return-error-code-on-failure.patch @@ -0,0 +1,37 @@ +From 5b11ebedd6a8bb4271b796e498cd15c0fe1133b6 Mon Sep 17 00:00:00 2001 +From: Pan Bian +Date: Sat, 3 Dec 2016 16:56:49 +0800 +Subject: extcon: return error code on failure + +From: Pan Bian + +commit 5b11ebedd6a8bb4271b796e498cd15c0fe1133b6 upstream. + +Function get_zeroed_page() returns a NULL pointer if there is no enough +memory. In function extcon_sync(), it returns 0 if the call to +get_zeroed_page() fails. The return value 0 indicates success in the +context, which is incosistent with the execution status. This patch +fixes the bug by returning -ENOMEM. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188611 + +Signed-off-by: Pan Bian +Fixes: a580982f0836e +Acked-by: Chanwoo Choi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/extcon/extcon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/extcon/extcon.c ++++ b/drivers/extcon/extcon.c +@@ -453,7 +453,7 @@ int extcon_sync(struct extcon_dev *edev, + dev_err(&edev->dev, "out of memory in extcon_set_state\n"); + kobject_uevent(&edev->dev.kobj, KOBJ_CHANGE); + +- return 0; ++ return -ENOMEM; + } + + length = name_show(&edev->dev, NULL, prop_buf); diff --git a/queue-4.9/i2c-mux-pca954x-fix-i2c-mux-selection-caching.patch b/queue-4.9/i2c-mux-pca954x-fix-i2c-mux-selection-caching.patch new file mode 100644 index 00000000000..b8809afb774 --- /dev/null +++ b/queue-4.9/i2c-mux-pca954x-fix-i2c-mux-selection-caching.patch @@ -0,0 +1,52 @@ +From 7f638c1cb0a1112dbe0b682a42db30521646686b Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Sat, 17 Dec 2016 12:10:56 +0000 +Subject: i2c: mux: pca954x: fix i2c mux selection caching + +From: Russell King + +commit 7f638c1cb0a1112dbe0b682a42db30521646686b upstream. + +smbus functions return -ve on error, 0 on success. However, +__i2c_transfer() have a different return signature - -ve on error, or +number of buffers transferred (which may be zero or greater.) + +The upshot of this is that the sense of the test is reversed when using +the mux on a bus supporting the master_xfer method: we cache the value +and never retry if we fail to transfer any buffers, but if we succeed, +we clear the cached value. + +Fix this by making pca954x_reg_write() return a negative error code for +all failure cases. + +Fixes: 463e8f845cbf ("i2c: mux: pca954x: retry updating the mux selection on failure") +Acked-by: Peter Rosin +Signed-off-by: Russell King +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/muxes/i2c-mux-pca954x.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/i2c/muxes/i2c-mux-pca954x.c ++++ b/drivers/i2c/muxes/i2c-mux-pca954x.c +@@ -151,6 +151,9 @@ static int pca954x_reg_write(struct i2c_ + buf[0] = val; + msg.buf = buf; + ret = __i2c_transfer(adap, &msg, 1); ++ ++ if (ret >= 0 && ret != 1) ++ ret = -EREMOTEIO; + } else { + union i2c_smbus_data data; + ret = adap->algo->smbus_xfer(adap, client->addr, +@@ -179,7 +182,7 @@ static int pca954x_select_chan(struct i2 + /* Only select the channel if its different from the last channel */ + if (data->last_chan != regval) { + ret = pca954x_reg_write(muxc->parent, client, regval); +- data->last_chan = ret ? 0 : regval; ++ data->last_chan = ret < 0 ? 0 : regval; + } + + return ret; diff --git a/queue-4.9/i2c-piix4-avoid-race-conditions-with-imc.patch b/queue-4.9/i2c-piix4-avoid-race-conditions-with-imc.patch new file mode 100644 index 00000000000..02ad9c80219 --- /dev/null +++ b/queue-4.9/i2c-piix4-avoid-race-conditions-with-imc.patch @@ -0,0 +1,71 @@ +From 701dc207bf551d9fe6defa36e84a911e880398c3 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Wed, 11 Jan 2017 10:11:44 +0100 +Subject: i2c: piix4: Avoid race conditions with IMC + +From: Ricardo Ribalda Delgado + +commit 701dc207bf551d9fe6defa36e84a911e880398c3 upstream. + +On AMD's SB800 and upwards, the SMBus is shared with the Integrated +Micro Controller (IMC). + +The platform provides a hardware semaphore to avoid race conditions +among them. (Check page 288 of the SB800-Series Southbridges Register +Reference Guide http://support.amd.com/TechDocs/45482.pdf) + +Without this patch, many access to the SMBus end with an invalid +transaction or even with the bus stalled. + +Reported-by: Alexandre Desnoyers +Signed-off-by: Ricardo Ribalda Delgado +Reviewed-by: Andy Shevchenko : +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-piix4.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +--- a/drivers/i2c/busses/i2c-piix4.c ++++ b/drivers/i2c/busses/i2c-piix4.c +@@ -585,10 +585,29 @@ static s32 piix4_access_sb800(struct i2c + u8 command, int size, union i2c_smbus_data *data) + { + struct i2c_piix4_adapdata *adapdata = i2c_get_adapdata(adap); ++ unsigned short piix4_smba = adapdata->smba; ++ int retries = MAX_TIMEOUT; ++ int smbslvcnt; + u8 smba_en_lo; + u8 port; + int retval; + ++ /* Request the SMBUS semaphore, avoid conflicts with the IMC */ ++ smbslvcnt = inb_p(SMBSLVCNT); ++ do { ++ outb_p(smbslvcnt | 0x10, SMBSLVCNT); ++ ++ /* Check the semaphore status */ ++ smbslvcnt = inb_p(SMBSLVCNT); ++ if (smbslvcnt & 0x10) ++ break; ++ ++ usleep_range(1000, 2000); ++ } while (--retries); ++ /* SMBus is still owned by the IMC, we give up */ ++ if (!retries) ++ return -EBUSY; ++ + mutex_lock(&piix4_mutex_sb800); + + outb_p(piix4_port_sel_sb800, SB800_PIIX4_SMB_IDX); +@@ -606,6 +625,9 @@ static s32 piix4_access_sb800(struct i2c + + mutex_unlock(&piix4_mutex_sb800); + ++ /* Release the semaphore */ ++ outb_p(smbslvcnt | 0x20, SMBSLVCNT); ++ + return retval; + } + diff --git a/queue-4.9/ibmvscsis-fix-srp_transfer_data-fail-return-code.patch b/queue-4.9/ibmvscsis-fix-srp_transfer_data-fail-return-code.patch new file mode 100644 index 00000000000..6f50825de67 --- /dev/null +++ b/queue-4.9/ibmvscsis-fix-srp_transfer_data-fail-return-code.patch @@ -0,0 +1,36 @@ +From 7c9d8d0c41b3e24473ac7648a7fc2d644ccf08ff Mon Sep 17 00:00:00 2001 +From: "Bryant G. Ly" +Date: Mon, 9 Jan 2017 10:21:20 -0600 +Subject: ibmvscsis: Fix srp_transfer_data fail return code + +From: Bryant G. Ly + +commit 7c9d8d0c41b3e24473ac7648a7fc2d644ccf08ff upstream. + +If srp_transfer_data fails within ibmvscsis_write_pending, then +the most likely scenario is that the client timed out the op and +removed the TCE mapping. Thus it will loop forever retrying the +op that is pretty much guaranteed to fail forever. A better return +code would be EIO instead of EAGAIN. + +Reported-by: Steven Royer +Tested-by: Steven Royer +Signed-off-by: Bryant G. Ly +Signed-off-by: Bart Van Assche +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c ++++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c +@@ -3702,7 +3702,7 @@ static int ibmvscsis_write_pending(struc + 1, 1); + if (rc) { + pr_err("srp_transfer_data() failed: %d\n", rc); +- return -EAGAIN; ++ return -EIO; + } + /* + * We now tell TCM to add this WRITE CDB directly into the TCM storage diff --git a/queue-4.9/iw_cxgb4-fix-error-return-code-in-c4iw_rdev_open.patch b/queue-4.9/iw_cxgb4-fix-error-return-code-in-c4iw_rdev_open.patch new file mode 100644 index 00000000000..ef65559d10f --- /dev/null +++ b/queue-4.9/iw_cxgb4-fix-error-return-code-in-c4iw_rdev_open.patch @@ -0,0 +1,36 @@ +From 15f7e3c21b76598bc6e5816d2577ce843b2b963f Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Sat, 17 Sep 2016 00:41:37 +0000 +Subject: iw_cxgb4: Fix error return code in c4iw_rdev_open() + +From: Wei Yongjun + +commit 15f7e3c21b76598bc6e5816d2577ce843b2b963f upstream. + +Fix to return error code -ENOMEM from the __get_free_page() error +handling case instead of 0, as done elsewhere in this function. + +Fixes: 05eb23893c2c ("cxgb4/iw_cxgb4: Doorbell Drop Avoidance Bug Fixes") +Signed-off-by: Wei Yongjun +Acked-by: Steve Wise +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/cxgb4/device.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/cxgb4/device.c ++++ b/drivers/infiniband/hw/cxgb4/device.c +@@ -828,8 +828,10 @@ static int c4iw_rdev_open(struct c4iw_rd + } + rdev->status_page = (struct t4_dev_status_page *) + __get_free_page(GFP_KERNEL); +- if (!rdev->status_page) ++ if (!rdev->status_page) { ++ err = -ENOMEM; + goto destroy_ocqp_pool; ++ } + rdev->status_page->qp_start = rdev->lldi.vr->qp.start; + rdev->status_page->qp_size = rdev->lldi.vr->qp.size; + rdev->status_page->cq_start = rdev->lldi.vr->cq.start; diff --git a/queue-4.9/mm-fix-remote-numa-hits-statistics.patch b/queue-4.9/mm-fix-remote-numa-hits-statistics.patch new file mode 100644 index 00000000000..36360317f22 --- /dev/null +++ b/queue-4.9/mm-fix-remote-numa-hits-statistics.patch @@ -0,0 +1,81 @@ +From 2df26639e708a88dcc22171949da638a9998f3bc Mon Sep 17 00:00:00 2001 +From: Michal Hocko +Date: Tue, 10 Jan 2017 16:57:39 -0800 +Subject: mm: fix remote numa hits statistics + +From: Michal Hocko + +commit 2df26639e708a88dcc22171949da638a9998f3bc upstream. + +Jia He has noticed that commit b9f00e147f27 ("mm, page_alloc: reduce +branches in zone_statistics") has an unintentional side effect that +remote node allocation requests are accounted as NUMA_MISS rathat than +NUMA_HIT and NUMA_OTHER if such a request doesn't use __GFP_OTHER_NODE. + +There are many of these potentially because the flag is used very rarely +while we have many users of __alloc_pages_node. + +Fix this by simply ignoring __GFP_OTHER_NODE (it can be removed in a +follow up patch) and treat all allocations that were satisfied from the +preferred zone's node as NUMA_HITS because this is the same node we +requested the allocation from in most cases. If this is not the local +node then we just account it as NUMA_OTHER rather than NUMA_LOCAL. + +One downsize would be that an allocation request for a node which is +outside of the mempolicy nodemask would be reported as a hit which is a +bit weird but that was the case before b9f00e147f27 already. + +Fixes: b9f00e147f27 ("mm, page_alloc: reduce branches in zone_statistics") +Link: http://lkml.kernel.org/r/20170102153057.9451-2-mhocko@kernel.org +Signed-off-by: Michal Hocko +Reported-by: Jia He +Reviewed-by: Vlastimil Babka # with cbmc[1] superpowers +Acked-by: Mel Gorman +Cc: Johannes Weiner +Cc: Joonsoo Kim +Cc: Taku Izumi +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/page_alloc.c | 15 ++++----------- + 1 file changed, 4 insertions(+), 11 deletions(-) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -2556,30 +2556,23 @@ int __isolate_free_page(struct page *pag + * Update NUMA hit/miss statistics + * + * Must be called with interrupts disabled. +- * +- * When __GFP_OTHER_NODE is set assume the node of the preferred +- * zone is the local node. This is useful for daemons who allocate +- * memory on behalf of other processes. + */ + static inline void zone_statistics(struct zone *preferred_zone, struct zone *z, + gfp_t flags) + { + #ifdef CONFIG_NUMA +- int local_nid = numa_node_id(); + enum zone_stat_item local_stat = NUMA_LOCAL; + +- if (unlikely(flags & __GFP_OTHER_NODE)) { ++ if (z->node != numa_node_id()) + local_stat = NUMA_OTHER; +- local_nid = preferred_zone->node; +- } + +- if (z->node == local_nid) { ++ if (z->node == preferred_zone->node) + __inc_zone_state(z, NUMA_HIT); +- __inc_zone_state(z, local_stat); +- } else { ++ else { + __inc_zone_state(z, NUMA_MISS); + __inc_zone_state(preferred_zone, NUMA_FOREIGN); + } ++ __inc_zone_state(z, local_stat); + #endif + } + diff --git a/queue-4.9/net-af_iucv-don-t-use-paged-skbs-for-tx-on-hipersockets.patch b/queue-4.9/net-af_iucv-don-t-use-paged-skbs-for-tx-on-hipersockets.patch new file mode 100644 index 00000000000..af5937898fc --- /dev/null +++ b/queue-4.9/net-af_iucv-don-t-use-paged-skbs-for-tx-on-hipersockets.patch @@ -0,0 +1,74 @@ +From dc5367bcc556e97555fc94a32cd1aadbebdff47e Mon Sep 17 00:00:00 2001 +From: Julian Wiedmann +Date: Tue, 10 Jan 2017 17:10:34 +0100 +Subject: net/af_iucv: don't use paged skbs for TX on HiperSockets + +From: Julian Wiedmann + +commit dc5367bcc556e97555fc94a32cd1aadbebdff47e upstream. + +With commit e53743994e21 +("af_iucv: use paged SKBs for big outbound messages"), +we transmit paged skbs for both of AF_IUCV's transport modes +(IUCV or HiperSockets). +The qeth driver for Layer 3 HiperSockets currently doesn't +support NETIF_F_SG, so these skbs would just be linearized again +by the stack. +Avoid that overhead by using paged skbs only for IUCV transport. + +cc stable, since this also circumvents a significant skb leak when +sending large messages (where the skb then needs to be linearized). + +Signed-off-by: Julian Wiedmann +Signed-off-by: Ursula Braun +Fixes: e53743994e21 ("af_iucv: use paged SKBs for big outbound messages") +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/iucv/af_iucv.c | 25 ++++++++++++++----------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +--- a/net/iucv/af_iucv.c ++++ b/net/iucv/af_iucv.c +@@ -1036,7 +1036,8 @@ static int iucv_sock_sendmsg(struct sock + { + struct sock *sk = sock->sk; + struct iucv_sock *iucv = iucv_sk(sk); +- size_t headroom, linear; ++ size_t headroom = 0; ++ size_t linear; + struct sk_buff *skb; + struct iucv_message txmsg = {0}; + struct cmsghdr *cmsg; +@@ -1114,18 +1115,20 @@ static int iucv_sock_sendmsg(struct sock + * this is fine for SOCK_SEQPACKET (unless we want to support + * segmented records using the MSG_EOR flag), but + * for SOCK_STREAM we might want to improve it in future */ +- headroom = (iucv->transport == AF_IUCV_TRANS_HIPER) +- ? sizeof(struct af_iucv_trans_hdr) + ETH_HLEN : 0; +- if (headroom + len < PAGE_SIZE) { ++ if (iucv->transport == AF_IUCV_TRANS_HIPER) { ++ headroom = sizeof(struct af_iucv_trans_hdr) + ETH_HLEN; + linear = len; + } else { +- /* In nonlinear "classic" iucv skb, +- * reserve space for iucv_array +- */ +- if (iucv->transport != AF_IUCV_TRANS_HIPER) +- headroom += sizeof(struct iucv_array) * +- (MAX_SKB_FRAGS + 1); +- linear = PAGE_SIZE - headroom; ++ if (len < PAGE_SIZE) { ++ linear = len; ++ } else { ++ /* In nonlinear "classic" iucv skb, ++ * reserve space for iucv_array ++ */ ++ headroom = sizeof(struct iucv_array) * ++ (MAX_SKB_FRAGS + 1); ++ linear = PAGE_SIZE - headroom; ++ } + } + skb = sock_alloc_send_pskb(sk, headroom + linear, len - linear, + noblock, &err, 0); diff --git a/queue-4.9/net-mlx5-only-cancel-recovery-work-when-cleaning-up-device.patch b/queue-4.9/net-mlx5-only-cancel-recovery-work-when-cleaning-up-device.patch new file mode 100644 index 00000000000..565235c3007 --- /dev/null +++ b/queue-4.9/net-mlx5-only-cancel-recovery-work-when-cleaning-up-device.patch @@ -0,0 +1,50 @@ +From 5e44fca5047054f1762813751626b5245e0da022 Mon Sep 17 00:00:00 2001 +From: Daniel Jurgens +Date: Tue, 10 Jan 2017 22:33:39 +0200 +Subject: net/mlx5: Only cancel recovery work when cleaning up device + +From: Daniel Jurgens + +commit 5e44fca5047054f1762813751626b5245e0da022 upstream. + +Do not attempt to drain the health workqueue when unloading the device in +the recovery flow, this can cause a deadlock when the recovery work +tries to cancel itself with sync. + +Because the work is no longer unconditionally canceled when unloading, it +must be explicitly canceled in the AER flow. + +fixes: 689a248df83b ("net/mlx5: Cancel recovery work in remove flow") +Signed-off-by: Daniel Jurgens +Signed-off-by: Saeed Mahameed +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -1158,7 +1158,8 @@ static int mlx5_unload_one(struct mlx5_c + { + int err = 0; + +- mlx5_drain_health_wq(dev); ++ if (cleanup) ++ mlx5_drain_health_wq(dev); + + mutex_lock(&dev->intf_state_mutex); + if (test_bit(MLX5_INTERFACE_STATE_DOWN, &dev->intf_state)) { +@@ -1320,9 +1321,10 @@ static pci_ers_result_t mlx5_pci_err_det + + mlx5_enter_error_state(dev); + mlx5_unload_one(dev, priv, false); +- /* In case of kernel call save the pci state */ ++ /* In case of kernel call save the pci state and drain the health wq */ + if (state) { + pci_save_state(pdev); ++ mlx5_drain_health_wq(dev); + mlx5_pci_disable_device(dev); + } + diff --git a/queue-4.9/nfs-fix-a-performance-regression-in-readdir.patch b/queue-4.9/nfs-fix-a-performance-regression-in-readdir.patch new file mode 100644 index 00000000000..4e6b3c5b443 --- /dev/null +++ b/queue-4.9/nfs-fix-a-performance-regression-in-readdir.patch @@ -0,0 +1,72 @@ +From 79f687a3de9e3ba2518b4ea33f38ca6cbe9133eb Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Sat, 19 Nov 2016 10:54:55 -0500 +Subject: NFS: Fix a performance regression in readdir + +From: Trond Myklebust + +commit 79f687a3de9e3ba2518b4ea33f38ca6cbe9133eb upstream. + +Ben Coddington reports that commit 311324ad1713, by adding the function +nfs_dir_mapping_need_revalidate() that checks page cache validity on +each call to nfs_readdir() causes a performance regression when +the directory is being modified. + +If the directory is changing while we're iterating through the directory, +POSIX does not require us to invalidate the page cache unless the user +calls rewinddir(). However, we still do want to ensure that we use +readdirplus in order to avoid a load of stat() calls when the user +is doing an 'ls -l' workload. + +The fix should be to invalidate the page cache immediately when we're +setting the NFS_INO_ADVISE_RDPLUS bit. + +Reported-by: Benjamin Coddington +Fixes: 311324ad1713 ("NFS: Be more aggressive in using readdirplus...") +Reviewed-by: Benjamin Coddington +Tested-by: Benjamin Coddington +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/dir.c | 15 ++------------- + 1 file changed, 2 insertions(+), 13 deletions(-) + +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -477,7 +477,7 @@ void nfs_force_use_readdirplus(struct in + { + if (!list_empty(&NFS_I(dir)->open_files)) { + nfs_advise_use_readdirplus(dir); +- nfs_zap_mapping(dir, dir->i_mapping); ++ invalidate_mapping_pages(dir->i_mapping, 0, -1); + } + } + +@@ -886,17 +886,6 @@ int uncached_readdir(nfs_readdir_descrip + goto out; + } + +-static bool nfs_dir_mapping_need_revalidate(struct inode *dir) +-{ +- struct nfs_inode *nfsi = NFS_I(dir); +- +- if (nfs_attribute_cache_expired(dir)) +- return true; +- if (nfsi->cache_validity & NFS_INO_INVALID_DATA) +- return true; +- return false; +-} +- + /* The file offset position represents the dirent entry number. A + last cookie cache takes care of the common case of reading the + whole directory. +@@ -928,7 +917,7 @@ static int nfs_readdir(struct file *file + desc->decode = NFS_PROTO(inode)->decode_dirent; + desc->plus = nfs_use_readdirplus(inode, ctx) ? 1 : 0; + +- if (ctx->pos == 0 || nfs_dir_mapping_need_revalidate(inode)) ++ if (ctx->pos == 0 || nfs_attribute_cache_expired(inode)) + res = nfs_revalidate_mapping(inode, file->f_mapping); + if (res < 0) + goto out; diff --git a/queue-4.9/nfs-fix-typo-in-parameter-description.patch b/queue-4.9/nfs-fix-typo-in-parameter-description.patch new file mode 100644 index 00000000000..4bb5921ab32 --- /dev/null +++ b/queue-4.9/nfs-fix-typo-in-parameter-description.patch @@ -0,0 +1,32 @@ +From f36ab161bebe464d33b998294eff29b17a9c8918 Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Fri, 28 Oct 2016 14:37:02 +0000 +Subject: NFS: fix typo in parameter description + +From: Wei Yongjun + +commit f36ab161bebe464d33b998294eff29b17a9c8918 upstream. + +Fix typo in parameter description. + +Fixes: 5405fc44c337 ("NFSv4.x: Add kernel parameter to control the +callback server") +Signed-off-by: Wei Yongjun +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -2904,7 +2904,7 @@ module_param(max_session_slots, ushort, + MODULE_PARM_DESC(max_session_slots, "Maximum number of outstanding NFSv4.1 " + "requests the client will negotiate"); + module_param(max_session_cb_slots, ushort, 0644); +-MODULE_PARM_DESC(max_session_slots, "Maximum number of parallel NFSv4.1 " ++MODULE_PARM_DESC(max_session_cb_slots, "Maximum number of parallel NFSv4.1 " + "callbacks the client will process for a given server"); + module_param(send_implementation_id, ushort, 0644); + MODULE_PARM_DESC(send_implementation_id, diff --git a/queue-4.9/nfsv4.1-nfs4_fl_prepare_ds-must-be-careful-about-reporting-success.patch b/queue-4.9/nfsv4.1-nfs4_fl_prepare_ds-must-be-careful-about-reporting-success.patch new file mode 100644 index 00000000000..cca4dde87b7 --- /dev/null +++ b/queue-4.9/nfsv4.1-nfs4_fl_prepare_ds-must-be-careful-about-reporting-success.patch @@ -0,0 +1,42 @@ +From cfd278c280f997cf2fe4662e0acab0fe465f637b Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Mon, 19 Dec 2016 11:19:31 +1100 +Subject: NFSv4.1: nfs4_fl_prepare_ds must be careful about reporting success. + +From: NeilBrown + +commit cfd278c280f997cf2fe4662e0acab0fe465f637b upstream. + +Various places assume that if nfs4_fl_prepare_ds() turns a non-NULL 'ds', +then ds->ds_clp will also be non-NULL. + +This is not necessasrily true in the case when the process received a fatal signal +while nfs4_pnfs_ds_connect is waiting in nfs4_wait_ds_connect(). +In that case ->ds_clp may not be set, and the devid may not recently have been marked +unavailable. + +So add a test for ds_clp == NULL and return NULL in that case. + +Fixes: c23266d532b4 ("NFS4.1 Fix data server connection race") +Signed-off-by: NeilBrown +Acked-by: Olga Kornievskaia +Acked-by: Adamson, Andy +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/filelayout/filelayoutdev.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/nfs/filelayout/filelayoutdev.c ++++ b/fs/nfs/filelayout/filelayoutdev.c +@@ -283,7 +283,8 @@ nfs4_fl_prepare_ds(struct pnfs_layout_se + s->nfs_client->cl_rpcclient->cl_auth->au_flavor); + + out_test_devid: +- if (filelayout_test_devid_unavailable(devid)) ++ if (ret->ds_clp == NULL || ++ filelayout_test_devid_unavailable(devid)) + ret = NULL; + out: + return ret; diff --git a/queue-4.9/nvme-apply-delay_before_chk_rdy-quirk-at-probe-time-too.patch b/queue-4.9/nvme-apply-delay_before_chk_rdy-quirk-at-probe-time-too.patch new file mode 100644 index 00000000000..abf65038c57 --- /dev/null +++ b/queue-4.9/nvme-apply-delay_before_chk_rdy-quirk-at-probe-time-too.patch @@ -0,0 +1,60 @@ +From b5a10c5f7532b7473776da87e67f8301bbc32693 Mon Sep 17 00:00:00 2001 +From: "Guilherme G. Piccoli" +Date: Wed, 28 Dec 2016 22:13:15 -0200 +Subject: nvme: apply DELAY_BEFORE_CHK_RDY quirk at probe time too + +From: Guilherme G. Piccoli + +commit b5a10c5f7532b7473776da87e67f8301bbc32693 upstream. + +Commit 54adc01055b7 ("nvme/quirk: Add a delay before checking for adapter +readiness") introduced a quirk to adapters that cannot read the bit +NVME_CSTS_RDY right after register NVME_REG_CC is set; these adapters +need a delay or else the action of reading the bit NVME_CSTS_RDY could +somehow corrupt adapter's registers state and it never recovers. + +When this quirk was added, we checked ctrl->tagset in order to avoid +quirking in probe time, supposing we would never require such delay +during probe. Well, it was too optimistic; we in fact need this quirk +at probe time in some cases, like after a kexec. + +In some experiments, after abnormal shutdown of machine (aka power cord +unplug), we booted into our bootloader in Power, which is a Linux kernel, +and kexec'ed into another distro. If this kexec is too quick, we end up +reaching the probe of NVMe adapter in that distro when adapter is in +bad state (not fully initialized on our bootloader). What happens next +is that nvme_wait_ready() is unable to complete, except if the quirk is +enabled. + +So, this patch removes the original ctrl->tagset verification in order +to enable the quirk even on probe time. + +Fixes: 54adc01055b7 ("nvme/quirk: Add a delay before checking for adapter readiness") +Reported-by: Andrew Byrne +Reported-by: Jaime A. H. Gomez +Reported-by: Zachary D. Myers +Signed-off-by: Guilherme G. Piccoli +Acked-by: Jeffrey Lien +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/nvme/host/core.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1122,12 +1122,7 @@ int nvme_disable_ctrl(struct nvme_ctrl * + if (ret) + return ret; + +- /* Checking for ctrl->tagset is a trick to avoid sleeping on module +- * load, since we only need the quirk on reset_controller. Notice +- * that the HGST device needs this delay only in firmware activation +- * procedure; unfortunately we have no (easy) way to verify this. +- */ +- if ((ctrl->quirks & NVME_QUIRK_DELAY_BEFORE_CHK_RDY) && ctrl->tagset) ++ if (ctrl->quirks & NVME_QUIRK_DELAY_BEFORE_CHK_RDY) + msleep(NVME_QUIRK_DELAY_AMOUNT); + + return nvme_wait_ready(ctrl, cap, false); diff --git a/queue-4.9/orinoco-use-shash-instead-of-ahash-for-mic-calculations.patch b/queue-4.9/orinoco-use-shash-instead-of-ahash-for-mic-calculations.patch new file mode 100644 index 00000000000..b1c9bfbd989 --- /dev/null +++ b/queue-4.9/orinoco-use-shash-instead-of-ahash-for-mic-calculations.patch @@ -0,0 +1,143 @@ +From 570b90fa230b8021f51a67fab2245fe8df6fe37d Mon Sep 17 00:00:00 2001 +From: Andrew Lutomirski +Date: Mon, 12 Dec 2016 12:55:55 -0800 +Subject: orinoco: Use shash instead of ahash for MIC calculations + +From: Andrew Lutomirski + +commit 570b90fa230b8021f51a67fab2245fe8df6fe37d upstream. + +Eric Biggers pointed out that the orinoco driver pointed scatterlists +at the stack. + +Fix it by switching from ahash to shash. The result should be +simpler, faster, and more correct. + +kvalo: cherry picked from commit 1fef293b8a9850cfa124a53c1d8878d355010403 as I +accidentally applied this patch to wireless-drivers-next when I was supposed to +apply this wireless-drivers + +Reported-by: Eric Biggers +Signed-off-by: Andy Lutomirski +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intersil/orinoco/mic.c | 44 ++++++++++++++---------- + drivers/net/wireless/intersil/orinoco/mic.h | 3 + + drivers/net/wireless/intersil/orinoco/orinoco.h | 4 +- + 3 files changed, 30 insertions(+), 21 deletions(-) + +--- a/drivers/net/wireless/intersil/orinoco/mic.c ++++ b/drivers/net/wireless/intersil/orinoco/mic.c +@@ -16,7 +16,7 @@ + /********************************************************************/ + int orinoco_mic_init(struct orinoco_private *priv) + { +- priv->tx_tfm_mic = crypto_alloc_ahash("michael_mic", 0, ++ priv->tx_tfm_mic = crypto_alloc_shash("michael_mic", 0, + CRYPTO_ALG_ASYNC); + if (IS_ERR(priv->tx_tfm_mic)) { + printk(KERN_DEBUG "orinoco_mic_init: could not allocate " +@@ -25,7 +25,7 @@ int orinoco_mic_init(struct orinoco_priv + return -ENOMEM; + } + +- priv->rx_tfm_mic = crypto_alloc_ahash("michael_mic", 0, ++ priv->rx_tfm_mic = crypto_alloc_shash("michael_mic", 0, + CRYPTO_ALG_ASYNC); + if (IS_ERR(priv->rx_tfm_mic)) { + printk(KERN_DEBUG "orinoco_mic_init: could not allocate " +@@ -40,17 +40,16 @@ int orinoco_mic_init(struct orinoco_priv + void orinoco_mic_free(struct orinoco_private *priv) + { + if (priv->tx_tfm_mic) +- crypto_free_ahash(priv->tx_tfm_mic); ++ crypto_free_shash(priv->tx_tfm_mic); + if (priv->rx_tfm_mic) +- crypto_free_ahash(priv->rx_tfm_mic); ++ crypto_free_shash(priv->rx_tfm_mic); + } + +-int orinoco_mic(struct crypto_ahash *tfm_michael, u8 *key, ++int orinoco_mic(struct crypto_shash *tfm_michael, u8 *key, + u8 *da, u8 *sa, u8 priority, + u8 *data, size_t data_len, u8 *mic) + { +- AHASH_REQUEST_ON_STACK(req, tfm_michael); +- struct scatterlist sg[2]; ++ SHASH_DESC_ON_STACK(desc, tfm_michael); + u8 hdr[ETH_HLEN + 2]; /* size of header + padding */ + int err; + +@@ -67,18 +66,27 @@ int orinoco_mic(struct crypto_ahash *tfm + hdr[ETH_ALEN * 2 + 2] = 0; + hdr[ETH_ALEN * 2 + 3] = 0; + +- /* Use scatter gather to MIC header and data in one go */ +- sg_init_table(sg, 2); +- sg_set_buf(&sg[0], hdr, sizeof(hdr)); +- sg_set_buf(&sg[1], data, data_len); ++ desc->tfm = tfm_michael; ++ desc->flags = 0; + +- if (crypto_ahash_setkey(tfm_michael, key, MIC_KEYLEN)) +- return -1; ++ err = crypto_shash_setkey(tfm_michael, key, MIC_KEYLEN); ++ if (err) ++ return err; ++ ++ err = crypto_shash_init(desc); ++ if (err) ++ return err; ++ ++ err = crypto_shash_update(desc, hdr, sizeof(hdr)); ++ if (err) ++ return err; ++ ++ err = crypto_shash_update(desc, data, data_len); ++ if (err) ++ return err; ++ ++ err = crypto_shash_final(desc, mic); ++ shash_desc_zero(desc); + +- ahash_request_set_tfm(req, tfm_michael); +- ahash_request_set_callback(req, 0, NULL, NULL); +- ahash_request_set_crypt(req, sg, mic, data_len + sizeof(hdr)); +- err = crypto_ahash_digest(req); +- ahash_request_zero(req); + return err; + } +--- a/drivers/net/wireless/intersil/orinoco/mic.h ++++ b/drivers/net/wireless/intersil/orinoco/mic.h +@@ -6,6 +6,7 @@ + #define _ORINOCO_MIC_H_ + + #include ++#include + + #define MICHAEL_MIC_LEN 8 + +@@ -15,7 +16,7 @@ struct crypto_ahash; + + int orinoco_mic_init(struct orinoco_private *priv); + void orinoco_mic_free(struct orinoco_private *priv); +-int orinoco_mic(struct crypto_ahash *tfm_michael, u8 *key, ++int orinoco_mic(struct crypto_shash *tfm_michael, u8 *key, + u8 *da, u8 *sa, u8 priority, + u8 *data, size_t data_len, u8 *mic); + +--- a/drivers/net/wireless/intersil/orinoco/orinoco.h ++++ b/drivers/net/wireless/intersil/orinoco/orinoco.h +@@ -152,8 +152,8 @@ struct orinoco_private { + u8 *wpa_ie; + int wpa_ie_len; + +- struct crypto_ahash *rx_tfm_mic; +- struct crypto_ahash *tx_tfm_mic; ++ struct crypto_shash *rx_tfm_mic; ++ struct crypto_shash *tx_tfm_mic; + + unsigned int wpa_enabled:1; + unsigned int tkip_cm_active:1; diff --git a/queue-4.9/pinctrl-meson-fix-gpio-request-disabling-other-modes.patch b/queue-4.9/pinctrl-meson-fix-gpio-request-disabling-other-modes.patch new file mode 100644 index 00000000000..0630a4b54a2 --- /dev/null +++ b/queue-4.9/pinctrl-meson-fix-gpio-request-disabling-other-modes.patch @@ -0,0 +1,37 @@ +From f24d311f92b516a8aadef5056424ccabb4068e7b Mon Sep 17 00:00:00 2001 +From: Neil Armstrong +Date: Tue, 6 Dec 2016 15:08:16 +0100 +Subject: pinctrl: meson: fix gpio request disabling other modes + +From: Neil Armstrong + +commit f24d311f92b516a8aadef5056424ccabb4068e7b upstream. + +The pinctrl_gpio_request is called with the "full" gpio number, already +containing the base, then meson_pmx_request_gpio is then called with the +final pin number. +Remove the base addition when calling meson_pmx_disable_other_groups. + +Fixes: 6ac730951104 ("pinctrl: add driver for Amlogic Meson SoCs") +CC: Beniamino Galvani +Signed-off-by: Neil Armstrong +Acked-by: Kevin Hilman +Acked-by: Beniamino Galvani +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/meson/pinctrl-meson.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pinctrl/meson/pinctrl-meson.c ++++ b/drivers/pinctrl/meson/pinctrl-meson.c +@@ -212,7 +212,7 @@ static int meson_pmx_request_gpio(struct + { + struct meson_pinctrl *pc = pinctrl_dev_get_drvdata(pcdev); + +- meson_pmx_disable_other_groups(pc, range->pin_base + offset, -1); ++ meson_pmx_disable_other_groups(pc, offset, -1); + + return 0; + } diff --git a/queue-4.9/pnfs-fix-race-in-pnfs_wait_on_layoutreturn.patch b/queue-4.9/pnfs-fix-race-in-pnfs_wait_on_layoutreturn.patch new file mode 100644 index 00000000000..561d73eeeb9 --- /dev/null +++ b/queue-4.9/pnfs-fix-race-in-pnfs_wait_on_layoutreturn.patch @@ -0,0 +1,39 @@ +From ee284e35d8c71bf5d4d807eaff6f67a17134b359 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Fri, 18 Nov 2016 15:21:30 -0500 +Subject: pNFS: Fix race in pnfs_wait_on_layoutreturn + +From: Trond Myklebust + +commit ee284e35d8c71bf5d4d807eaff6f67a17134b359 upstream. + +We must put the task to sleep while holding the inode->i_lock in order +to ensure atomicity with the test for NFS_LAYOUT_RETURN. + +Fixes: 500d701f336b ("NFS41: make close wait for layoutreturn") +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/pnfs.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -1257,13 +1257,11 @@ bool pnfs_wait_on_layoutreturn(struct in + * i_lock */ + spin_lock(&ino->i_lock); + lo = nfsi->layout; +- if (lo && test_bit(NFS_LAYOUT_RETURN, &lo->plh_flags)) ++ if (lo && test_bit(NFS_LAYOUT_RETURN, &lo->plh_flags)) { ++ rpc_sleep_on(&NFS_SERVER(ino)->roc_rpcwaitq, task, NULL); + sleep = true; ++ } + spin_unlock(&ino->i_lock); +- +- if (sleep) +- rpc_sleep_on(&NFS_SERVER(ino)->roc_rpcwaitq, task, NULL); +- + return sleep; + } + diff --git a/queue-4.9/power-supply-bq27xxx_battery-fix-register-map-for-bq27510-and-bq27520.patch b/queue-4.9/power-supply-bq27xxx_battery-fix-register-map-for-bq27510-and-bq27520.patch new file mode 100644 index 00000000000..48e1e6080d1 --- /dev/null +++ b/queue-4.9/power-supply-bq27xxx_battery-fix-register-map-for-bq27510-and-bq27520.patch @@ -0,0 +1,120 @@ +From 3bee9ea1de687925d116670f036599cbed8b66b0 Mon Sep 17 00:00:00 2001 +From: "Andrew F. Davis" +Date: Fri, 4 Nov 2016 13:33:13 -0500 +Subject: power: supply: bq27xxx_battery: Fix register map for BQ27510 and BQ27520 + +From: Andrew F. Davis + +commit 3bee9ea1de687925d116670f036599cbed8b66b0 upstream. + +The BQ27510 and BQ27520 use a slightly different register map than the +BQ27500, add a new type enum and add these gauges to it. + +Fixes: d74534c27775 ("power: bq27xxx_battery: Add support for additional bq27xxx family devices") +Based-on-patch-by: Kenneth R. Crudup +Signed-off-by: Andrew F. Davis +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/power/supply/bq27xxx_battery.c | 41 ++++++++++++++++++++++++++++- + drivers/power/supply/bq27xxx_battery_i2c.c | 4 +- + include/linux/power/bq27xxx_battery.h | 3 +- + 3 files changed, 44 insertions(+), 4 deletions(-) + +--- a/drivers/power/supply/bq27xxx_battery.c ++++ b/drivers/power/supply/bq27xxx_battery.c +@@ -164,6 +164,25 @@ static u8 bq27xxx_regs[][BQ27XXX_REG_MAX + [BQ27XXX_REG_DCAP] = 0x3c, + [BQ27XXX_REG_AP] = INVALID_REG_ADDR, + }, ++ [BQ27510] = { ++ [BQ27XXX_REG_CTRL] = 0x00, ++ [BQ27XXX_REG_TEMP] = 0x06, ++ [BQ27XXX_REG_INT_TEMP] = 0x28, ++ [BQ27XXX_REG_VOLT] = 0x08, ++ [BQ27XXX_REG_AI] = 0x14, ++ [BQ27XXX_REG_FLAGS] = 0x0a, ++ [BQ27XXX_REG_TTE] = 0x16, ++ [BQ27XXX_REG_TTF] = INVALID_REG_ADDR, ++ [BQ27XXX_REG_TTES] = 0x1a, ++ [BQ27XXX_REG_TTECP] = INVALID_REG_ADDR, ++ [BQ27XXX_REG_NAC] = 0x0c, ++ [BQ27XXX_REG_FCC] = 0x12, ++ [BQ27XXX_REG_CYCT] = 0x1e, ++ [BQ27XXX_REG_AE] = INVALID_REG_ADDR, ++ [BQ27XXX_REG_SOC] = 0x20, ++ [BQ27XXX_REG_DCAP] = 0x2e, ++ [BQ27XXX_REG_AP] = INVALID_REG_ADDR, ++ }, + [BQ27530] = { + [BQ27XXX_REG_CTRL] = 0x00, + [BQ27XXX_REG_TEMP] = 0x06, +@@ -302,6 +321,24 @@ static enum power_supply_property bq2750 + POWER_SUPPLY_PROP_MANUFACTURER, + }; + ++static enum power_supply_property bq27510_battery_props[] = { ++ POWER_SUPPLY_PROP_STATUS, ++ POWER_SUPPLY_PROP_PRESENT, ++ POWER_SUPPLY_PROP_VOLTAGE_NOW, ++ POWER_SUPPLY_PROP_CURRENT_NOW, ++ POWER_SUPPLY_PROP_CAPACITY, ++ POWER_SUPPLY_PROP_CAPACITY_LEVEL, ++ POWER_SUPPLY_PROP_TEMP, ++ POWER_SUPPLY_PROP_TIME_TO_EMPTY_NOW, ++ POWER_SUPPLY_PROP_TECHNOLOGY, ++ POWER_SUPPLY_PROP_CHARGE_FULL, ++ POWER_SUPPLY_PROP_CHARGE_NOW, ++ POWER_SUPPLY_PROP_CHARGE_FULL_DESIGN, ++ POWER_SUPPLY_PROP_CYCLE_COUNT, ++ POWER_SUPPLY_PROP_HEALTH, ++ POWER_SUPPLY_PROP_MANUFACTURER, ++}; ++ + static enum power_supply_property bq27530_battery_props[] = { + POWER_SUPPLY_PROP_STATUS, + POWER_SUPPLY_PROP_PRESENT, +@@ -385,6 +422,7 @@ static struct { + BQ27XXX_PROP(BQ27000, bq27000_battery_props), + BQ27XXX_PROP(BQ27010, bq27010_battery_props), + BQ27XXX_PROP(BQ27500, bq27500_battery_props), ++ BQ27XXX_PROP(BQ27510, bq27510_battery_props), + BQ27XXX_PROP(BQ27530, bq27530_battery_props), + BQ27XXX_PROP(BQ27541, bq27541_battery_props), + BQ27XXX_PROP(BQ27545, bq27545_battery_props), +@@ -635,7 +673,8 @@ static int bq27xxx_battery_read_pwr_avg( + */ + static bool bq27xxx_battery_overtemp(struct bq27xxx_device_info *di, u16 flags) + { +- if (di->chip == BQ27500 || di->chip == BQ27541 || di->chip == BQ27545) ++ if (di->chip == BQ27500 || di->chip == BQ27510 || ++ di->chip == BQ27541 || di->chip == BQ27545) + return flags & (BQ27XXX_FLAG_OTC | BQ27XXX_FLAG_OTD); + if (di->chip == BQ27530 || di->chip == BQ27421) + return flags & BQ27XXX_FLAG_OT; +--- a/drivers/power/supply/bq27xxx_battery_i2c.c ++++ b/drivers/power/supply/bq27xxx_battery_i2c.c +@@ -149,8 +149,8 @@ static const struct i2c_device_id bq27xx + { "bq27200", BQ27000 }, + { "bq27210", BQ27010 }, + { "bq27500", BQ27500 }, +- { "bq27510", BQ27500 }, +- { "bq27520", BQ27500 }, ++ { "bq27510", BQ27510 }, ++ { "bq27520", BQ27510 }, + { "bq27530", BQ27530 }, + { "bq27531", BQ27530 }, + { "bq27541", BQ27541 }, +--- a/include/linux/power/bq27xxx_battery.h ++++ b/include/linux/power/bq27xxx_battery.h +@@ -4,7 +4,8 @@ + enum bq27xxx_chip { + BQ27000 = 1, /* bq27000, bq27200 */ + BQ27010, /* bq27010, bq27210 */ +- BQ27500, /* bq27500, bq27510, bq27520 */ ++ BQ27500, /* bq27500 */ ++ BQ27510, /* bq27510, bq27520 */ + BQ27530, /* bq27530, bq27531 */ + BQ27541, /* bq27541, bq27542, bq27546, bq27742 */ + BQ27545, /* bq27545 */ diff --git a/queue-4.9/powercap-intel_rapl-fix-and-tidy-up-error-handling.patch b/queue-4.9/powercap-intel_rapl-fix-and-tidy-up-error-handling.patch new file mode 100644 index 00000000000..e547e7cf76e --- /dev/null +++ b/queue-4.9/powercap-intel_rapl-fix-and-tidy-up-error-handling.patch @@ -0,0 +1,118 @@ +From cb43f81b8489dcb87555e16c17453f0a9fa690f2 Mon Sep 17 00:00:00 2001 +From: Jacob Pan +Date: Mon, 28 Nov 2016 13:53:11 -0800 +Subject: powercap/intel_rapl: fix and tidy up error handling + +From: Jacob Pan + +commit cb43f81b8489dcb87555e16c17453f0a9fa690f2 upstream. + +Commit e1399ba20eee ("powercap / RAPL: handle missing MSRs") added +contraint_to_pl() function to return index into an array. But it +can potentially return -EINVAL if powercap layer sends an out of +range constraint ID. This patch adds sanity check. + +Unnecessary RAPL domain pointer check is removed since it must be +initialized before calling rapl_unit_xlate(). + +Fixes: e1399ba20eee ("powercap / RAPL: handle missing MSRs") +Reported-by: Odzioba, Lukasz +Reported-by: Koss, Marcin +Signed-off-by: Jacob Pan +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/powercap/intel_rapl.c | 25 ++++++++++++++++++++++++- + 1 file changed, 24 insertions(+), 1 deletion(-) + +--- a/drivers/powercap/intel_rapl.c ++++ b/drivers/powercap/intel_rapl.c +@@ -442,6 +442,7 @@ static int contraint_to_pl(struct rapl_d + return i; + } + } ++ pr_err("Cannot find matching power limit for constraint %d\n", cid); + + return -EINVAL; + } +@@ -457,6 +458,10 @@ static int set_power_limit(struct powerc + get_online_cpus(); + rd = power_zone_to_rapl_domain(power_zone); + id = contraint_to_pl(rd, cid); ++ if (id < 0) { ++ ret = id; ++ goto set_exit; ++ } + + rp = rd->rp; + +@@ -496,6 +501,11 @@ static int get_current_power_limit(struc + get_online_cpus(); + rd = power_zone_to_rapl_domain(power_zone); + id = contraint_to_pl(rd, cid); ++ if (id < 0) { ++ ret = id; ++ goto get_exit; ++ } ++ + switch (rd->rpl[id].prim_id) { + case PL1_ENABLE: + prim = POWER_LIMIT1; +@@ -512,6 +522,7 @@ static int get_current_power_limit(struc + else + *data = val; + ++get_exit: + put_online_cpus(); + + return ret; +@@ -527,6 +538,10 @@ static int set_time_window(struct powerc + get_online_cpus(); + rd = power_zone_to_rapl_domain(power_zone); + id = contraint_to_pl(rd, cid); ++ if (id < 0) { ++ ret = id; ++ goto set_time_exit; ++ } + + switch (rd->rpl[id].prim_id) { + case PL1_ENABLE: +@@ -538,6 +553,8 @@ static int set_time_window(struct powerc + default: + ret = -EINVAL; + } ++ ++set_time_exit: + put_online_cpus(); + return ret; + } +@@ -552,6 +569,10 @@ static int get_time_window(struct powerc + get_online_cpus(); + rd = power_zone_to_rapl_domain(power_zone); + id = contraint_to_pl(rd, cid); ++ if (id < 0) { ++ ret = id; ++ goto get_time_exit; ++ } + + switch (rd->rpl[id].prim_id) { + case PL1_ENABLE: +@@ -566,6 +587,8 @@ static int get_time_window(struct powerc + } + if (!ret) + *data = val; ++ ++get_time_exit: + put_online_cpus(); + + return ret; +@@ -707,7 +730,7 @@ static u64 rapl_unit_xlate(struct rapl_d + case ENERGY_UNIT: + scale = ENERGY_UNIT_SCALE; + /* per domain unit takes precedence */ +- if (rd && rd->domain_energy_unit) ++ if (rd->domain_energy_unit) + units = rd->domain_energy_unit; + else + units = rp->energy_unit; diff --git a/queue-4.9/powerpc-64-simplify-adaptation-to-new-isa-v3.00-hpte-format.patch b/queue-4.9/powerpc-64-simplify-adaptation-to-new-isa-v3.00-hpte-format.patch new file mode 100644 index 00000000000..ed477212efc --- /dev/null +++ b/queue-4.9/powerpc-64-simplify-adaptation-to-new-isa-v3.00-hpte-format.patch @@ -0,0 +1,253 @@ +From 6b243fcfb5f1e16bcf732e6f86a63f8af5b59a9f Mon Sep 17 00:00:00 2001 +From: Paul Mackerras +Date: Fri, 11 Nov 2016 16:55:03 +1100 +Subject: powerpc/64: Simplify adaptation to new ISA v3.00 HPTE format + +From: Paul Mackerras + +commit 6b243fcfb5f1e16bcf732e6f86a63f8af5b59a9f upstream. + +This changes the way that we support the new ISA v3.00 HPTE format. +Instead of adapting everything that uses HPTE values to handle either +the old format or the new format, depending on which CPU we are on, +we now convert explicitly between old and new formats if necessary +in the low-level routines that actually access HPTEs in memory. +This limits the amount of code that needs to know about the new +format and makes the conversions explicit. This is OK because the +old format contains all the information that is in the new format. + +This also fixes operation under a hypervisor, because the H_ENTER +hypercall (and other hypercalls that deal with HPTEs) will continue +to require the HPTE value to be supplied in the old format. At +present the kernel will not boot in HPT mode on POWER9 under a +hypervisor. + +This fixes and partially reverts commit 50de596de8be +("powerpc/mm/hash: Add support for Power9 Hash", 2016-04-29). + +Fixes: 50de596de8be ("powerpc/mm/hash: Add support for Power9 Hash") +Signed-off-by: Paul Mackerras +Reviewed-by: Aneesh Kumar K.V +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/include/asm/book3s/64/mmu-hash.h | 47 +++++++++++++++++++++----- + arch/powerpc/mm/hash_native_64.c | 30 +++++++++++++--- + arch/powerpc/platforms/ps3/htab.c | 2 - + arch/powerpc/platforms/pseries/lpar.c | 2 - + 4 files changed, 65 insertions(+), 16 deletions(-) + +--- a/arch/powerpc/include/asm/book3s/64/mmu-hash.h ++++ b/arch/powerpc/include/asm/book3s/64/mmu-hash.h +@@ -70,7 +70,9 @@ + + #define HPTE_V_SSIZE_SHIFT 62 + #define HPTE_V_AVPN_SHIFT 7 ++#define HPTE_V_COMMON_BITS ASM_CONST(0x000fffffffffffff) + #define HPTE_V_AVPN ASM_CONST(0x3fffffffffffff80) ++#define HPTE_V_AVPN_3_0 ASM_CONST(0x000fffffffffff80) + #define HPTE_V_AVPN_VAL(x) (((x) & HPTE_V_AVPN) >> HPTE_V_AVPN_SHIFT) + #define HPTE_V_COMPARE(x,y) (!(((x) ^ (y)) & 0xffffffffffffff80UL)) + #define HPTE_V_BOLTED ASM_CONST(0x0000000000000010) +@@ -80,14 +82,16 @@ + #define HPTE_V_VALID ASM_CONST(0x0000000000000001) + + /* +- * ISA 3.0 have a different HPTE format. ++ * ISA 3.0 has a different HPTE format. + */ + #define HPTE_R_3_0_SSIZE_SHIFT 58 ++#define HPTE_R_3_0_SSIZE_MASK (3ull << HPTE_R_3_0_SSIZE_SHIFT) + #define HPTE_R_PP0 ASM_CONST(0x8000000000000000) + #define HPTE_R_TS ASM_CONST(0x4000000000000000) + #define HPTE_R_KEY_HI ASM_CONST(0x3000000000000000) + #define HPTE_R_RPN_SHIFT 12 + #define HPTE_R_RPN ASM_CONST(0x0ffffffffffff000) ++#define HPTE_R_RPN_3_0 ASM_CONST(0x01fffffffffff000) + #define HPTE_R_PP ASM_CONST(0x0000000000000003) + #define HPTE_R_PPP ASM_CONST(0x8000000000000003) + #define HPTE_R_N ASM_CONST(0x0000000000000004) +@@ -316,12 +320,43 @@ static inline unsigned long hpte_encode_ + */ + v = (vpn >> (23 - VPN_SHIFT)) & ~(mmu_psize_defs[psize].avpnm); + v <<= HPTE_V_AVPN_SHIFT; +- if (!cpu_has_feature(CPU_FTR_ARCH_300)) +- v |= ((unsigned long) ssize) << HPTE_V_SSIZE_SHIFT; ++ v |= ((unsigned long) ssize) << HPTE_V_SSIZE_SHIFT; + return v; + } + + /* ++ * ISA v3.0 defines a new HPTE format, which differs from the old ++ * format in having smaller AVPN and ARPN fields, and the B field ++ * in the second dword instead of the first. ++ */ ++static inline unsigned long hpte_old_to_new_v(unsigned long v) ++{ ++ /* trim AVPN, drop B */ ++ return v & HPTE_V_COMMON_BITS; ++} ++ ++static inline unsigned long hpte_old_to_new_r(unsigned long v, unsigned long r) ++{ ++ /* move B field from 1st to 2nd dword, trim ARPN */ ++ return (r & ~HPTE_R_3_0_SSIZE_MASK) | ++ (((v) >> HPTE_V_SSIZE_SHIFT) << HPTE_R_3_0_SSIZE_SHIFT); ++} ++ ++static inline unsigned long hpte_new_to_old_v(unsigned long v, unsigned long r) ++{ ++ /* insert B field */ ++ return (v & HPTE_V_COMMON_BITS) | ++ ((r & HPTE_R_3_0_SSIZE_MASK) << ++ (HPTE_V_SSIZE_SHIFT - HPTE_R_3_0_SSIZE_SHIFT)); ++} ++ ++static inline unsigned long hpte_new_to_old_r(unsigned long r) ++{ ++ /* clear out B field */ ++ return r & ~HPTE_R_3_0_SSIZE_MASK; ++} ++ ++/* + * This function sets the AVPN and L fields of the HPTE appropriately + * using the base page size and actual page size. + */ +@@ -341,12 +376,8 @@ static inline unsigned long hpte_encode_ + * aligned for the requested page size + */ + static inline unsigned long hpte_encode_r(unsigned long pa, int base_psize, +- int actual_psize, int ssize) ++ int actual_psize) + { +- +- if (cpu_has_feature(CPU_FTR_ARCH_300)) +- pa |= ((unsigned long) ssize) << HPTE_R_3_0_SSIZE_SHIFT; +- + /* A 4K page needs no special encoding */ + if (actual_psize == MMU_PAGE_4K) + return pa & HPTE_R_RPN; +--- a/arch/powerpc/mm/hash_native_64.c ++++ b/arch/powerpc/mm/hash_native_64.c +@@ -221,13 +221,18 @@ static long native_hpte_insert(unsigned + return -1; + + hpte_v = hpte_encode_v(vpn, psize, apsize, ssize) | vflags | HPTE_V_VALID; +- hpte_r = hpte_encode_r(pa, psize, apsize, ssize) | rflags; ++ hpte_r = hpte_encode_r(pa, psize, apsize) | rflags; + + if (!(vflags & HPTE_V_BOLTED)) { + DBG_LOW(" i=%x hpte_v=%016lx, hpte_r=%016lx\n", + i, hpte_v, hpte_r); + } + ++ if (cpu_has_feature(CPU_FTR_ARCH_300)) { ++ hpte_r = hpte_old_to_new_r(hpte_v, hpte_r); ++ hpte_v = hpte_old_to_new_v(hpte_v); ++ } ++ + hptep->r = cpu_to_be64(hpte_r); + /* Guarantee the second dword is visible before the valid bit */ + eieio(); +@@ -295,6 +300,8 @@ static long native_hpte_updatepp(unsigne + vpn, want_v & HPTE_V_AVPN, slot, newpp); + + hpte_v = be64_to_cpu(hptep->v); ++ if (cpu_has_feature(CPU_FTR_ARCH_300)) ++ hpte_v = hpte_new_to_old_v(hpte_v, be64_to_cpu(hptep->r)); + /* + * We need to invalidate the TLB always because hpte_remove doesn't do + * a tlb invalidate. If a hash bucket gets full, we "evict" a more/less +@@ -309,6 +316,8 @@ static long native_hpte_updatepp(unsigne + native_lock_hpte(hptep); + /* recheck with locks held */ + hpte_v = be64_to_cpu(hptep->v); ++ if (cpu_has_feature(CPU_FTR_ARCH_300)) ++ hpte_v = hpte_new_to_old_v(hpte_v, be64_to_cpu(hptep->r)); + if (unlikely(!HPTE_V_COMPARE(hpte_v, want_v) || + !(hpte_v & HPTE_V_VALID))) { + ret = -1; +@@ -350,6 +359,8 @@ static long native_hpte_find(unsigned lo + for (i = 0; i < HPTES_PER_GROUP; i++) { + hptep = htab_address + slot; + hpte_v = be64_to_cpu(hptep->v); ++ if (cpu_has_feature(CPU_FTR_ARCH_300)) ++ hpte_v = hpte_new_to_old_v(hpte_v, be64_to_cpu(hptep->r)); + + if (HPTE_V_COMPARE(hpte_v, want_v) && (hpte_v & HPTE_V_VALID)) + /* HPTE matches */ +@@ -409,6 +420,8 @@ static void native_hpte_invalidate(unsig + want_v = hpte_encode_avpn(vpn, bpsize, ssize); + native_lock_hpte(hptep); + hpte_v = be64_to_cpu(hptep->v); ++ if (cpu_has_feature(CPU_FTR_ARCH_300)) ++ hpte_v = hpte_new_to_old_v(hpte_v, be64_to_cpu(hptep->r)); + + /* + * We need to invalidate the TLB always because hpte_remove doesn't do +@@ -467,6 +480,8 @@ static void native_hugepage_invalidate(u + want_v = hpte_encode_avpn(vpn, psize, ssize); + native_lock_hpte(hptep); + hpte_v = be64_to_cpu(hptep->v); ++ if (cpu_has_feature(CPU_FTR_ARCH_300)) ++ hpte_v = hpte_new_to_old_v(hpte_v, be64_to_cpu(hptep->r)); + + /* Even if we miss, we need to invalidate the TLB */ + if (!HPTE_V_COMPARE(hpte_v, want_v) || !(hpte_v & HPTE_V_VALID)) +@@ -504,6 +519,10 @@ static void hpte_decode(struct hash_pte + /* Look at the 8 bit LP value */ + unsigned int lp = (hpte_r >> LP_SHIFT) & ((1 << LP_BITS) - 1); + ++ if (cpu_has_feature(CPU_FTR_ARCH_300)) { ++ hpte_v = hpte_new_to_old_v(hpte_v, hpte_r); ++ hpte_r = hpte_new_to_old_r(hpte_r); ++ } + if (!(hpte_v & HPTE_V_LARGE)) { + size = MMU_PAGE_4K; + a_size = MMU_PAGE_4K; +@@ -512,11 +531,7 @@ static void hpte_decode(struct hash_pte + a_size = hpte_page_sizes[lp] >> 4; + } + /* This works for all page sizes, and for 256M and 1T segments */ +- if (cpu_has_feature(CPU_FTR_ARCH_300)) +- *ssize = hpte_r >> HPTE_R_3_0_SSIZE_SHIFT; +- else +- *ssize = hpte_v >> HPTE_V_SSIZE_SHIFT; +- ++ *ssize = hpte_v >> HPTE_V_SSIZE_SHIFT; + shift = mmu_psize_defs[size].shift; + + avpn = (HPTE_V_AVPN_VAL(hpte_v) & ~mmu_psize_defs[size].avpnm); +@@ -639,6 +654,9 @@ static void native_flush_hash_range(unsi + want_v = hpte_encode_avpn(vpn, psize, ssize); + native_lock_hpte(hptep); + hpte_v = be64_to_cpu(hptep->v); ++ if (cpu_has_feature(CPU_FTR_ARCH_300)) ++ hpte_v = hpte_new_to_old_v(hpte_v, ++ be64_to_cpu(hptep->r)); + if (!HPTE_V_COMPARE(hpte_v, want_v) || + !(hpte_v & HPTE_V_VALID)) + native_unlock_hpte(hptep); +--- a/arch/powerpc/platforms/ps3/htab.c ++++ b/arch/powerpc/platforms/ps3/htab.c +@@ -63,7 +63,7 @@ static long ps3_hpte_insert(unsigned lon + vflags &= ~HPTE_V_SECONDARY; + + hpte_v = hpte_encode_v(vpn, psize, apsize, ssize) | vflags | HPTE_V_VALID; +- hpte_r = hpte_encode_r(ps3_mm_phys_to_lpar(pa), psize, apsize, ssize) | rflags; ++ hpte_r = hpte_encode_r(ps3_mm_phys_to_lpar(pa), psize, apsize) | rflags; + + spin_lock_irqsave(&ps3_htab_lock, flags); + +--- a/arch/powerpc/platforms/pseries/lpar.c ++++ b/arch/powerpc/platforms/pseries/lpar.c +@@ -145,7 +145,7 @@ static long pSeries_lpar_hpte_insert(uns + hpte_group, vpn, pa, rflags, vflags, psize); + + hpte_v = hpte_encode_v(vpn, psize, apsize, ssize) | vflags | HPTE_V_VALID; +- hpte_r = hpte_encode_r(pa, psize, apsize, ssize) | rflags; ++ hpte_r = hpte_encode_r(pa, psize, apsize) | rflags; + + if (!(vflags & HPTE_V_BOLTED)) + pr_devel(" hpte_v=%016lx, hpte_r=%016lx\n", hpte_v, hpte_r); diff --git a/queue-4.9/powerpc-ibmebus-fix-device-reference-leaks-in-sysfs-interface.patch b/queue-4.9/powerpc-ibmebus-fix-device-reference-leaks-in-sysfs-interface.patch new file mode 100644 index 00000000000..38e755f0f58 --- /dev/null +++ b/queue-4.9/powerpc-ibmebus-fix-device-reference-leaks-in-sysfs-interface.patch @@ -0,0 +1,53 @@ +From fe0f3168169f7c34c29b0cf0c489f126a7f29643 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 1 Nov 2016 16:26:00 +0100 +Subject: powerpc/ibmebus: Fix device reference leaks in sysfs interface + +From: Johan Hovold + +commit fe0f3168169f7c34c29b0cf0c489f126a7f29643 upstream. + +Make sure to drop any reference taken by bus_find_device() in the sysfs +callbacks that are used to create and destroy devices based on +device-tree entries. + +Fixes: 6bccf755ff53 ("[POWERPC] ibmebus: dynamic addition/removal of adapters, some code cleanup") +Signed-off-by: Johan Hovold +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/ibmebus.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/arch/powerpc/kernel/ibmebus.c ++++ b/arch/powerpc/kernel/ibmebus.c +@@ -266,6 +266,7 @@ static ssize_t ibmebus_store_probe(struc + const char *buf, size_t count) + { + struct device_node *dn = NULL; ++ struct device *dev; + char *path; + ssize_t rc = 0; + +@@ -273,8 +274,10 @@ static ssize_t ibmebus_store_probe(struc + if (!path) + return -ENOMEM; + +- if (bus_find_device(&ibmebus_bus_type, NULL, path, +- ibmebus_match_path)) { ++ dev = bus_find_device(&ibmebus_bus_type, NULL, path, ++ ibmebus_match_path); ++ if (dev) { ++ put_device(dev); + printk(KERN_WARNING "%s: %s has already been probed\n", + __func__, path); + rc = -EEXIST; +@@ -311,6 +314,7 @@ static ssize_t ibmebus_store_remove(stru + if ((dev = bus_find_device(&ibmebus_bus_type, NULL, path, + ibmebus_match_path))) { + of_device_unregister(to_platform_device(dev)); ++ put_device(dev); + + kfree(path); + return count; diff --git a/queue-4.9/powerpc-ibmebus-fix-further-device-reference-leaks.patch b/queue-4.9/powerpc-ibmebus-fix-further-device-reference-leaks.patch new file mode 100644 index 00000000000..c6a472b9ac5 --- /dev/null +++ b/queue-4.9/powerpc-ibmebus-fix-further-device-reference-leaks.patch @@ -0,0 +1,46 @@ +From 815a7141c4d1b11610dccb7fcbb38633759824f2 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 1 Nov 2016 16:26:01 +0100 +Subject: powerpc/ibmebus: Fix further device reference leaks + +From: Johan Hovold + +commit 815a7141c4d1b11610dccb7fcbb38633759824f2 upstream. + +Make sure to drop any reference taken by bus_find_device() when creating +devices during init and driver registration. + +Fixes: 55347cc9962f ("[POWERPC] ibmebus: Add device creation and bus probing based on of_device") +Signed-off-by: Johan Hovold +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/ibmebus.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/arch/powerpc/kernel/ibmebus.c ++++ b/arch/powerpc/kernel/ibmebus.c +@@ -180,6 +180,7 @@ static int ibmebus_create_device(struct + static int ibmebus_create_devices(const struct of_device_id *matches) + { + struct device_node *root, *child; ++ struct device *dev; + int ret = 0; + + root = of_find_node_by_path("/"); +@@ -188,9 +189,12 @@ static int ibmebus_create_devices(const + if (!of_match_node(matches, child)) + continue; + +- if (bus_find_device(&ibmebus_bus_type, NULL, child, +- ibmebus_match_node)) ++ dev = bus_find_device(&ibmebus_bus_type, NULL, child, ++ ibmebus_match_node); ++ if (dev) { ++ put_device(dev); + continue; ++ } + + ret = ibmebus_create_device(child); + if (ret) { diff --git a/queue-4.9/powerpc-mm-correct-process-and-partition-table-max-size.patch b/queue-4.9/powerpc-mm-correct-process-and-partition-table-max-size.patch new file mode 100644 index 00000000000..c89f526de7d --- /dev/null +++ b/queue-4.9/powerpc-mm-correct-process-and-partition-table-max-size.patch @@ -0,0 +1,52 @@ +From 555c16328ae6d75a90e234eac9b51998d68f185b Mon Sep 17 00:00:00 2001 +From: Suraj Jitindar Singh +Date: Wed, 9 Nov 2016 16:36:33 +1100 +Subject: powerpc/mm: Correct process and partition table max size + +From: Suraj Jitindar Singh + +commit 555c16328ae6d75a90e234eac9b51998d68f185b upstream. + +Version 3.00 of the ISA states that the PATS (partition table size) field +of the PTCR (partition table control register) and the PRTS (process table +size) field of the partition table entry must both be less than or equal +to 24. However the actual size of the partition and process tables is equal +to 2 to the power of 12 plus the PATS and PRTS fields, respectively. This +means that the max allowable size of each of these tables is 2^36 or 64GB +for both. + +Thus when checking the size shift for each we should be checking for values +of greater than 36 instead of the current check for shifts larger than 24 +and 23. + +Fixes: 2bfd65e45e877fb5704730244da67c748d28a1b8 +Signed-off-by: Suraj Jitindar Singh +Reviewed-by: Balbir Singh +Reviewed-by: Aneesh Kumar K.V +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/mm/pgtable-radix.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/powerpc/mm/pgtable-radix.c ++++ b/arch/powerpc/mm/pgtable-radix.c +@@ -159,7 +159,7 @@ redo: + * Allocate Partition table and process table for the + * host. + */ +- BUILD_BUG_ON_MSG((PRTB_SIZE_SHIFT > 23), "Process table size too large."); ++ BUILD_BUG_ON_MSG((PRTB_SIZE_SHIFT > 36), "Process table size too large."); + process_tb = early_alloc_pgtable(1UL << PRTB_SIZE_SHIFT); + /* + * Fill in the process table. +@@ -181,7 +181,7 @@ static void __init radix_init_partition_ + + rts_field = radix__get_tree_size(); + +- BUILD_BUG_ON_MSG((PATB_SIZE_SHIFT > 24), "Partition table size too large."); ++ BUILD_BUG_ON_MSG((PATB_SIZE_SHIFT > 36), "Partition table size too large."); + partition_tb = early_alloc_pgtable(1UL << PATB_SIZE_SHIFT); + partition_tb->patb0 = cpu_to_be64(rts_field | __pa(init_mm.pgd) | + RADIX_PGD_INDEX_SIZE | PATB_HR); diff --git a/queue-4.9/powerpc-powernv-don-t-warn-on-pe-init-if-unfreeze-is-unsupported.patch b/queue-4.9/powerpc-powernv-don-t-warn-on-pe-init-if-unfreeze-is-unsupported.patch new file mode 100644 index 00000000000..e057c7b69f5 --- /dev/null +++ b/queue-4.9/powerpc-powernv-don-t-warn-on-pe-init-if-unfreeze-is-unsupported.patch @@ -0,0 +1,41 @@ +From d4791db527bf397c84c9956c3ece9692ed5322ac Mon Sep 17 00:00:00 2001 +From: Russell Currey +Date: Wed, 16 Nov 2016 12:12:26 +1100 +Subject: powerpc/powernv: Don't warn on PE init if unfreeze is unsupported + +From: Russell Currey + +commit d4791db527bf397c84c9956c3ece9692ed5322ac upstream. + +Whenever a PE is initialised in powernv, opal_pci_eeh_freeze_clear() is +called. This is to remove any existing freeze, and has no negative side +effects if the PE is already in an unfrozen state. On PHB backends that +don't support this operation and return OPAL_UNSUPPORTED, this creates a +scary and misleading warning message. + +Skip the warning message on init if OPAL_UNSUPPORTED is returned. + +As far as I'm aware, this currently only affects NPUs. + +Fixes: 313483d ("powerpc/powernv: Unfreeze PE on allocation") +Signed-off-by: Russell Currey +Acked-by: Gavin Shan +Reviewed-by: Andrew Donnellan +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/platforms/powernv/pci-ioda.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/platforms/powernv/pci-ioda.c ++++ b/arch/powerpc/platforms/powernv/pci-ioda.c +@@ -145,7 +145,7 @@ static struct pnv_ioda_pe *pnv_ioda_init + */ + rc = opal_pci_eeh_freeze_clear(phb->opal_id, pe_no, + OPAL_EEH_ACTION_CLEAR_FREEZE_ALL); +- if (rc != OPAL_SUCCESS) ++ if (rc != OPAL_SUCCESS && rc != OPAL_UNSUPPORTED) + pr_warn("%s: Error %lld unfreezing PHB#%d-PE#%d\n", + __func__, rc, phb->hose->global_number, pe_no); + diff --git a/queue-4.9/regulators-helpers-fix-handling-of-bypass_val_on-in-get_bypass_regmap.patch b/queue-4.9/regulators-helpers-fix-handling-of-bypass_val_on-in-get_bypass_regmap.patch new file mode 100644 index 00000000000..5c97e1d8851 --- /dev/null +++ b/queue-4.9/regulators-helpers-fix-handling-of-bypass_val_on-in-get_bypass_regmap.patch @@ -0,0 +1,47 @@ +From 85b037442e3f0e84296ab1010fd6b057eee18496 Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Thu, 10 Nov 2016 10:45:18 +0000 +Subject: regulators: helpers: Fix handling of bypass_val_on in get_bypass_regmap + +From: Charles Keepax + +commit 85b037442e3f0e84296ab1010fd6b057eee18496 upstream. + +The handling of bypass_val_on that was added in +regulator_get_bypass_regmap is done unconditionally however +several drivers don't define a value for bypass_val_on. This +results in those drivers reporting bypass being enabled when +it is not. In regulator_set_bypass_regmap we use bypass_mask +if bypass_val_on is zero. This patch adds similar handling in +regulator_get_bypass_regmap. + +Fixes: commit dd1a571daee7 ("regulator: helpers: Ensure bypass register field matches ON value") +Signed-off-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/helpers.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/regulator/helpers.c ++++ b/drivers/regulator/helpers.c +@@ -454,13 +454,17 @@ EXPORT_SYMBOL_GPL(regulator_set_bypass_r + int regulator_get_bypass_regmap(struct regulator_dev *rdev, bool *enable) + { + unsigned int val; ++ unsigned int val_on = rdev->desc->bypass_val_on; + int ret; + + ret = regmap_read(rdev->regmap, rdev->desc->bypass_reg, &val); + if (ret != 0) + return ret; + +- *enable = (val & rdev->desc->bypass_mask) == rdev->desc->bypass_val_on; ++ if (!val_on) ++ val_on = rdev->desc->bypass_mask; ++ ++ *enable = (val & rdev->desc->bypass_mask) == val_on; + + return 0; + } diff --git a/queue-4.9/remoteproc-qcom_wcnss-fix-circular-module-dependency.patch b/queue-4.9/remoteproc-qcom_wcnss-fix-circular-module-dependency.patch new file mode 100644 index 00000000000..f2936bd49b4 --- /dev/null +++ b/queue-4.9/remoteproc-qcom_wcnss-fix-circular-module-dependency.patch @@ -0,0 +1,152 @@ +From 6de1a507c46bf22ed97043495b9ab96e4d5c213b Mon Sep 17 00:00:00 2001 +From: Bjorn Andersson +Date: Thu, 3 Nov 2016 19:37:25 -0700 +Subject: remoteproc: qcom_wcnss: Fix circular module dependency +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bjorn Andersson + +commit 6de1a507c46bf22ed97043495b9ab96e4d5c213b upstream. + +The tie between the main WCNSS driver and the IRIS driver causes a +circular dependency between the two modules. Neither part makes sense to +have on their own so lets merge them into one module. + +For the sake of picking up the clock and regulator resources described +in the iris of_node we need an associated struct device. But, to keep +the size of the patch down we continue to represent the IRIS part as its +own platform_driver, within the same module, rather than setting up a +dummy device. + +Fixes: aed361adca9f ("remoteproc: qcom: Introduce WCNSS peripheral image loader") +Reported-by: Andreas Färber +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/remoteproc/Kconfig | 5 ----- + drivers/remoteproc/Makefile | 5 +++-- + drivers/remoteproc/qcom_wcnss.c | 25 +++++++++++++++++++++++-- + drivers/remoteproc/qcom_wcnss.h | 2 ++ + drivers/remoteproc/qcom_wcnss_iris.c | 8 +------- + 5 files changed, 29 insertions(+), 16 deletions(-) + +--- a/drivers/remoteproc/Kconfig ++++ b/drivers/remoteproc/Kconfig +@@ -91,17 +91,12 @@ config QCOM_Q6V5_PIL + Say y here to support the Qualcomm Peripherial Image Loader for the + Hexagon V5 based remote processors. + +-config QCOM_WCNSS_IRIS +- tristate +- depends on OF && ARCH_QCOM +- + config QCOM_WCNSS_PIL + tristate "Qualcomm WCNSS Peripheral Image Loader" + depends on OF && ARCH_QCOM + depends on QCOM_SMEM + select QCOM_MDT_LOADER + select QCOM_SCM +- select QCOM_WCNSS_IRIS + select REMOTEPROC + help + Say y here to support the Peripheral Image Loader for the Qualcomm +--- a/drivers/remoteproc/Makefile ++++ b/drivers/remoteproc/Makefile +@@ -13,6 +13,7 @@ obj-$(CONFIG_WKUP_M3_RPROC) += wkup_m3_ + obj-$(CONFIG_DA8XX_REMOTEPROC) += da8xx_remoteproc.o + obj-$(CONFIG_QCOM_MDT_LOADER) += qcom_mdt_loader.o + obj-$(CONFIG_QCOM_Q6V5_PIL) += qcom_q6v5_pil.o +-obj-$(CONFIG_QCOM_WCNSS_IRIS) += qcom_wcnss_iris.o +-obj-$(CONFIG_QCOM_WCNSS_PIL) += qcom_wcnss.o ++obj-$(CONFIG_QCOM_WCNSS_PIL) += qcom_wcnss_pil.o ++qcom_wcnss_pil-y += qcom_wcnss.o ++qcom_wcnss_pil-y += qcom_wcnss_iris.o + obj-$(CONFIG_ST_REMOTEPROC) += st_remoteproc.o +--- a/drivers/remoteproc/qcom_wcnss.c ++++ b/drivers/remoteproc/qcom_wcnss.c +@@ -143,7 +143,6 @@ void qcom_wcnss_assign_iris(struct qcom_ + + mutex_unlock(&wcnss->iris_lock); + } +-EXPORT_SYMBOL_GPL(qcom_wcnss_assign_iris); + + static int wcnss_load(struct rproc *rproc, const struct firmware *fw) + { +@@ -619,6 +618,28 @@ static struct platform_driver wcnss_driv + }, + }; + +-module_platform_driver(wcnss_driver); ++static int __init wcnss_init(void) ++{ ++ int ret; ++ ++ ret = platform_driver_register(&wcnss_driver); ++ if (ret) ++ return ret; ++ ++ ret = platform_driver_register(&qcom_iris_driver); ++ if (ret) ++ platform_driver_unregister(&wcnss_driver); ++ ++ return ret; ++} ++module_init(wcnss_init); ++ ++static void __exit wcnss_exit(void) ++{ ++ platform_driver_unregister(&qcom_iris_driver); ++ platform_driver_unregister(&wcnss_driver); ++} ++module_exit(wcnss_exit); ++ + MODULE_DESCRIPTION("Qualcomm Peripherial Image Loader for Wireless Subsystem"); + MODULE_LICENSE("GPL v2"); +--- a/drivers/remoteproc/qcom_wcnss.h ++++ b/drivers/remoteproc/qcom_wcnss.h +@@ -4,6 +4,8 @@ + struct qcom_iris; + struct qcom_wcnss; + ++extern struct platform_driver qcom_iris_driver; ++ + struct wcnss_vreg_info { + const char * const name; + int min_voltage; +--- a/drivers/remoteproc/qcom_wcnss_iris.c ++++ b/drivers/remoteproc/qcom_wcnss_iris.c +@@ -94,14 +94,12 @@ disable_regulators: + + return ret; + } +-EXPORT_SYMBOL_GPL(qcom_iris_enable); + + void qcom_iris_disable(struct qcom_iris *iris) + { + clk_disable_unprepare(iris->xo_clk); + regulator_bulk_disable(iris->num_vregs, iris->vregs); + } +-EXPORT_SYMBOL_GPL(qcom_iris_disable); + + static int qcom_iris_probe(struct platform_device *pdev) + { +@@ -174,7 +172,7 @@ static const struct of_device_id iris_of + {} + }; + +-static struct platform_driver wcnss_driver = { ++struct platform_driver qcom_iris_driver = { + .probe = qcom_iris_probe, + .remove = qcom_iris_remove, + .driver = { +@@ -182,7 +180,3 @@ static struct platform_driver wcnss_driv + .of_match_table = iris_of_match, + }, + }; +- +-module_platform_driver(wcnss_driver); +-MODULE_DESCRIPTION("Qualcomm Wireless Subsystem Iris driver"); +-MODULE_LICENSE("GPL v2"); diff --git a/queue-4.9/remoteproc-st-fix-error-return-code-in-st_rproc_probe.patch b/queue-4.9/remoteproc-st-fix-error-return-code-in-st_rproc_probe.patch new file mode 100644 index 00000000000..78b0b05f7a8 --- /dev/null +++ b/queue-4.9/remoteproc-st-fix-error-return-code-in-st_rproc_probe.patch @@ -0,0 +1,35 @@ +From 1d701d3dd8caf6660ff33c3c23a115b4649c5cdb Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Mon, 17 Oct 2016 16:23:35 +0000 +Subject: remoteproc: st: Fix error return code in st_rproc_probe() + +From: Wei Yongjun + +commit 1d701d3dd8caf6660ff33c3c23a115b4649c5cdb upstream. + +Fix to return a negative error code from the st_rproc_state() error +handling case instead of 0, as done elsewhere in this function. + +Fixes: 63edb0310a5c ("remoteproc: Supply controller driver for ST's Remote Processors") +Signed-off-by: Wei Yongjun +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/remoteproc/st_remoteproc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/remoteproc/st_remoteproc.c ++++ b/drivers/remoteproc/st_remoteproc.c +@@ -245,8 +245,10 @@ static int st_rproc_probe(struct platfor + goto free_rproc; + + enabled = st_rproc_state(pdev); +- if (enabled < 0) ++ if (enabled < 0) { ++ ret = enabled; + goto free_rproc; ++ } + + if (enabled) { + atomic_inc(&rproc->power); diff --git a/queue-4.9/series b/queue-4.9/series index c548996f2d0..2be7936f342 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -59,3 +59,58 @@ vme-fix-wrong-pointer-utilization-in-ca91cx42_slave_get.patch pid-fix-lockdep-deadlock-warning-due-to-ucount_lock.patch mnt-protect-the-mountpoint-hashtable-with-mount_lock.patch drivers-char-mem-fix-thinkos-in-kmem-address-checks.patch +dmaengine-omap-dma-fix-dynamic-lch_map-allocation.patch +virtio_blk-avoid-dma-to-stack-for-the-sense-buffer.patch +tty-serial-atmel-rs485-half-duplex-w-dma-enable-rx-after-tx-is-done.patch +tty-serial-atmel_serial-bug-stop-dma-from-transmitting-in-stop_tx.patch +ibmvscsis-fix-srp_transfer_data-fail-return-code.patch +orinoco-use-shash-instead-of-ahash-for-mic-calculations.patch +sysrq-attach-sysrq-handler-correctly-for-32-bit-kernel.patch +extcon-return-error-code-on-failure.patch +clearing-fifos-in-rs485-emulation-mode-causes-subsequent-transmits-to-break.patch +sysctl-drop-reference-added-by-grab_header-in-proc_sys_readdir.patch +net-af_iucv-don-t-use-paged-skbs-for-tx-on-hipersockets.patch +drm-i915-gen9-fix-pcode-polling-timeout-in-stable-backport.patch +drm-clean-up-planes-in-atomic-commit-helper-failure-path.patch +drm-radeon-update-smc-firmware-selection-for-si.patch +drm-radeon-drop-verde-dpm-quirks.patch +drm-amdgpu-update-si-kicker-smc-firmware.patch +drm-amdgpu-drop-verde-dpm-quirks.patch +usb-serial-ch341-fix-modem-control-and-b0-handling.patch +net-mlx5-only-cancel-recovery-work-when-cleaning-up-device.patch +i2c-piix4-avoid-race-conditions-with-imc.patch +x86-cpu-fix-bootup-crashes-by-sanitizing-the-argument-of-the-clearcpuid-command-line-option.patch +nvme-apply-delay_before_chk_rdy-quirk-at-probe-time-too.patch +btrfs-fix-locking-when-we-put-back-a-delayed-ref-that-s-too-new.patch +btrfs-fix-error-handling-when-run_delayed_extent_op-fails.patch +mm-fix-remote-numa-hits-statistics.patch +pinctrl-meson-fix-gpio-request-disabling-other-modes.patch +nfs-fix-typo-in-parameter-description.patch +pnfs-fix-race-in-pnfs_wait_on_layoutreturn.patch +nfs-fix-a-performance-regression-in-readdir.patch +nfsv4.1-nfs4_fl_prepare_ds-must-be-careful-about-reporting-success.patch +i2c-mux-pca954x-fix-i2c-mux-selection-caching.patch +drm-i915-gen9-fix-pcode-polling-during-sagv-disabling.patch +drm-avoid-uninitialized-timestamp-use-in-wait_vblank.patch +drm-panel-simple-check-against-num_timings-when-setting-preferred-for-timing.patch +drm-i915-move-the-min_pixclk-handling-to-the-end-of-readout.patch +drm-initialise-drm_mm.head_node.allocated.patch +remoteproc-qcom_wcnss-fix-circular-module-dependency.patch +remoteproc-st-fix-error-return-code-in-st_rproc_probe.patch +powerpc-64-simplify-adaptation-to-new-isa-v3.00-hpte-format.patch +cpufreq-powernv-disable-preemption-while-checking-cpu-throttling-state.patch +regulators-helpers-fix-handling-of-bypass_val_on-in-get_bypass_regmap.patch +acpi-cppc-set-an-error-code-on-probe-error-path.patch +block-change-extern-inline-to-static-inline.patch +block-cfq_cpd_alloc-should-use-gfp.patch +acpi-apei-fix-nmi-notification-handling.patch +powercap-intel_rapl-fix-and-tidy-up-error-handling.patch +iw_cxgb4-fix-error-return-code-in-c4iw_rdev_open.patch +bq24190_charger-fix-pm-runtime-use-for-bq24190_battery_set_property.patch +power-supply-bq27xxx_battery-fix-register-map-for-bq27510-and-bq27520.patch +blk-mq-always-schedule-hctx-next_cpu.patch +bus-vexpress-config-fix-device-reference-leak.patch +powerpc-mm-correct-process-and-partition-table-max-size.patch +powerpc-ibmebus-fix-further-device-reference-leaks.patch +powerpc-ibmebus-fix-device-reference-leaks-in-sysfs-interface.patch +powerpc-powernv-don-t-warn-on-pe-init-if-unfreeze-is-unsupported.patch diff --git a/queue-4.9/sysctl-drop-reference-added-by-grab_header-in-proc_sys_readdir.patch b/queue-4.9/sysctl-drop-reference-added-by-grab_header-in-proc_sys_readdir.patch new file mode 100644 index 00000000000..39db534e461 --- /dev/null +++ b/queue-4.9/sysctl-drop-reference-added-by-grab_header-in-proc_sys_readdir.patch @@ -0,0 +1,87 @@ +From 93362fa47fe98b62e4a34ab408c4a418432e7939 Mon Sep 17 00:00:00 2001 +From: Zhou Chengming +Date: Fri, 6 Jan 2017 09:32:32 +0800 +Subject: sysctl: Drop reference added by grab_header in proc_sys_readdir + +From: Zhou Chengming + +commit 93362fa47fe98b62e4a34ab408c4a418432e7939 upstream. + +Fixes CVE-2016-9191, proc_sys_readdir doesn't drop reference +added by grab_header when return from !dir_emit_dots path. +It can cause any path called unregister_sysctl_table will +wait forever. + +The calltrace of CVE-2016-9191: + +[ 5535.960522] Call Trace: +[ 5535.963265] [] schedule+0x3f/0xa0 +[ 5535.968817] [] schedule_timeout+0x3db/0x6f0 +[ 5535.975346] [] ? wait_for_completion+0x45/0x130 +[ 5535.982256] [] wait_for_completion+0xc3/0x130 +[ 5535.988972] [] ? wake_up_q+0x80/0x80 +[ 5535.994804] [] drop_sysctl_table+0xc4/0xe0 +[ 5536.001227] [] drop_sysctl_table+0x77/0xe0 +[ 5536.007648] [] unregister_sysctl_table+0x4d/0xa0 +[ 5536.014654] [] unregister_sysctl_table+0x7f/0xa0 +[ 5536.021657] [] unregister_sched_domain_sysctl+0x15/0x40 +[ 5536.029344] [] partition_sched_domains+0x44/0x450 +[ 5536.036447] [] ? __mutex_unlock_slowpath+0x111/0x1f0 +[ 5536.043844] [] rebuild_sched_domains_locked+0x64/0xb0 +[ 5536.051336] [] update_flag+0x11d/0x210 +[ 5536.057373] [] ? mutex_lock_nested+0x2df/0x450 +[ 5536.064186] [] ? cpuset_css_offline+0x1b/0x60 +[ 5536.070899] [] ? trace_hardirqs_on+0xd/0x10 +[ 5536.077420] [] ? mutex_lock_nested+0x2df/0x450 +[ 5536.084234] [] ? css_killed_work_fn+0x25/0x220 +[ 5536.091049] [] cpuset_css_offline+0x35/0x60 +[ 5536.097571] [] css_killed_work_fn+0x5c/0x220 +[ 5536.104207] [] process_one_work+0x1df/0x710 +[ 5536.110736] [] ? process_one_work+0x160/0x710 +[ 5536.117461] [] worker_thread+0x12b/0x4a0 +[ 5536.123697] [] ? process_one_work+0x710/0x710 +[ 5536.130426] [] kthread+0xfe/0x120 +[ 5536.135991] [] ret_from_fork+0x1f/0x40 +[ 5536.142041] [] ? kthread_create_on_node+0x230/0x230 + +One cgroup maintainer mentioned that "cgroup is trying to offline +a cpuset css, which takes place under cgroup_mutex. The offlining +ends up trying to drain active usages of a sysctl table which apprently +is not happening." +The real reason is that proc_sys_readdir doesn't drop reference added +by grab_header when return from !dir_emit_dots path. So this cpuset +offline path will wait here forever. + +See here for details: http://www.openwall.com/lists/oss-security/2016/11/04/13 + +Fixes: f0c3b5093add ("[readdir] convert procfs") +Reported-by: CAI Qian +Tested-by: Yang Shukui +Signed-off-by: Zhou Chengming +Acked-by: Al Viro +Signed-off-by: Eric W. Biederman +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/proc_sysctl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/proc/proc_sysctl.c ++++ b/fs/proc/proc_sysctl.c +@@ -709,7 +709,7 @@ static int proc_sys_readdir(struct file + ctl_dir = container_of(head, struct ctl_dir, header); + + if (!dir_emit_dots(file, ctx)) +- return 0; ++ goto out; + + pos = 2; + +@@ -719,6 +719,7 @@ static int proc_sys_readdir(struct file + break; + } + } ++out: + sysctl_head_finish(head); + return 0; + } diff --git a/queue-4.9/sysrq-attach-sysrq-handler-correctly-for-32-bit-kernel.patch b/queue-4.9/sysrq-attach-sysrq-handler-correctly-for-32-bit-kernel.patch new file mode 100644 index 00000000000..fa686b477e1 --- /dev/null +++ b/queue-4.9/sysrq-attach-sysrq-handler-correctly-for-32-bit-kernel.patch @@ -0,0 +1,43 @@ +From 802c03881f29844af0252b6e22be5d2f65f93fd0 Mon Sep 17 00:00:00 2001 +From: Akinobu Mita +Date: Fri, 6 Jan 2017 02:14:16 +0900 +Subject: sysrq: attach sysrq handler correctly for 32-bit kernel + +From: Akinobu Mita + +commit 802c03881f29844af0252b6e22be5d2f65f93fd0 upstream. + +The sysrq input handler should be attached to the input device which has +a left alt key. + +On 32-bit kernels, some input devices which has a left alt key cannot +attach sysrq handler. Because the keybit bitmap in struct input_device_id +for sysrq is not correctly initialized. KEY_LEFTALT is 56 which is +greater than BITS_PER_LONG on 32-bit kernels. + +I found this problem when using a matrix keypad device which defines +a KEY_LEFTALT (56) but doesn't have a KEY_O (24 == 56%32). + +Cc: Jiri Slaby +Signed-off-by: Akinobu Mita +Acked-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/sysrq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/tty/sysrq.c ++++ b/drivers/tty/sysrq.c +@@ -946,8 +946,8 @@ static const struct input_device_id sysr + { + .flags = INPUT_DEVICE_ID_MATCH_EVBIT | + INPUT_DEVICE_ID_MATCH_KEYBIT, +- .evbit = { BIT_MASK(EV_KEY) }, +- .keybit = { BIT_MASK(KEY_LEFTALT) }, ++ .evbit = { [BIT_WORD(EV_KEY)] = BIT_MASK(EV_KEY) }, ++ .keybit = { [BIT_WORD(KEY_LEFTALT)] = BIT_MASK(KEY_LEFTALT) }, + }, + { }, + }; diff --git a/queue-4.9/tty-serial-atmel-rs485-half-duplex-w-dma-enable-rx-after-tx-is-done.patch b/queue-4.9/tty-serial-atmel-rs485-half-duplex-w-dma-enable-rx-after-tx-is-done.patch new file mode 100644 index 00000000000..6ae61c3e252 --- /dev/null +++ b/queue-4.9/tty-serial-atmel-rs485-half-duplex-w-dma-enable-rx-after-tx-is-done.patch @@ -0,0 +1,65 @@ +From b389f173aaa1204d6dc1f299082a162eb0491545 Mon Sep 17 00:00:00 2001 +From: Richard Genoud +Date: Tue, 6 Dec 2016 13:05:33 +0100 +Subject: tty/serial: atmel: RS485 half duplex w/DMA: enable RX after TX is done + +From: Richard Genoud + +commit b389f173aaa1204d6dc1f299082a162eb0491545 upstream. + +When using RS485 in half duplex, RX should be enabled when TX is +finished, and stopped when TX starts. + +Before commit 0058f0871efe7b01c6 ("tty/serial: atmel: fix RS485 half +duplex with DMA"), RX was not disabled in atmel_start_tx() if the DMA +was used. So, collisions could happened. + +But disabling RX in atmel_start_tx() uncovered another bug: +RX was enabled again in the wrong place (in atmel_tx_dma) instead of +being enabled when TX is finished (in atmel_complete_tx_dma), so the +transmission simply stopped. + +This bug was not triggered before commit 0058f0871efe7b01c6 +("tty/serial: atmel: fix RS485 half duplex with DMA") because RX was +never disabled before. + +Moving atmel_start_rx() in atmel_complete_tx_dma() corrects the problem. + +Reported-by: Gil Weber +Fixes: 0058f0871efe7b01c6 +Tested-by: Gil Weber +Signed-off-by: Richard Genoud +Acked-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/atmel_serial.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -798,6 +798,11 @@ static void atmel_complete_tx_dma(void * + */ + if (!uart_circ_empty(xmit)) + atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx); ++ else if ((port->rs485.flags & SER_RS485_ENABLED) && ++ !(port->rs485.flags & SER_RS485_RX_DURING_TX)) { ++ /* DMA done, stop TX, start RX for RS485 */ ++ atmel_start_rx(port); ++ } + + spin_unlock_irqrestore(&port->lock, flags); + } +@@ -900,12 +905,6 @@ static void atmel_tx_dma(struct uart_por + desc->callback = atmel_complete_tx_dma; + desc->callback_param = atmel_port; + atmel_port->cookie_tx = dmaengine_submit(desc); +- +- } else { +- if (port->rs485.flags & SER_RS485_ENABLED) { +- /* DMA done, stop TX, start RX for RS485 */ +- atmel_start_rx(port); +- } + } + + if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) diff --git a/queue-4.9/tty-serial-atmel_serial-bug-stop-dma-from-transmitting-in-stop_tx.patch b/queue-4.9/tty-serial-atmel_serial-bug-stop-dma-from-transmitting-in-stop_tx.patch new file mode 100644 index 00000000000..2bcb570d8c1 --- /dev/null +++ b/queue-4.9/tty-serial-atmel_serial-bug-stop-dma-from-transmitting-in-stop_tx.patch @@ -0,0 +1,54 @@ +From 89d8232411a85b9a6b12fd5da4d07d8a138a8e0c Mon Sep 17 00:00:00 2001 +From: Richard Genoud +Date: Tue, 13 Dec 2016 17:27:56 +0100 +Subject: tty/serial: atmel_serial: BUG: stop DMA from transmitting in stop_tx + +From: Richard Genoud + +commit 89d8232411a85b9a6b12fd5da4d07d8a138a8e0c upstream. + +If we don't disable the transmitter in atmel_stop_tx, the DMA buffer +continues to send data until it is emptied. +This cause problems with the flow control (CTS is asserted and data are +still sent). + +So, disabling the transmitter in atmel_stop_tx is a sane thing to do. + +Tested on at91sam9g35-cm(DMA) +Tested for regressions on sama5d2-xplained(Fifo) and at91sam9g20ek(PDC) + +Signed-off-by: Richard Genoud +Acked-by: Nicolas Ferre +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/atmel_serial.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -481,6 +481,14 @@ static void atmel_stop_tx(struct uart_po + /* disable PDC transmit */ + atmel_uart_writel(port, ATMEL_PDC_PTCR, ATMEL_PDC_TXTDIS); + } ++ ++ /* ++ * Disable the transmitter. ++ * This is mandatory when DMA is used, otherwise the DMA buffer ++ * is fully transmitted. ++ */ ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_TXDIS); ++ + /* Disable interrupts */ + atmel_uart_writel(port, ATMEL_US_IDR, atmel_port->tx_done_mask); + +@@ -513,6 +521,9 @@ static void atmel_start_tx(struct uart_p + + /* Enable interrupts */ + atmel_uart_writel(port, ATMEL_US_IER, atmel_port->tx_done_mask); ++ ++ /* re-enable the transmitter */ ++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_TXEN); + } + + /* diff --git a/queue-4.9/usb-serial-ch341-fix-modem-control-and-b0-handling.patch b/queue-4.9/usb-serial-ch341-fix-modem-control-and-b0-handling.patch new file mode 100644 index 00000000000..5f0066b1417 --- /dev/null +++ b/queue-4.9/usb-serial-ch341-fix-modem-control-and-b0-handling.patch @@ -0,0 +1,60 @@ +From 030ee7ae52a46a2be52ccc8242c4a330aba8d38e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 6 Jan 2017 19:15:12 +0100 +Subject: USB: serial: ch341: fix modem-control and B0 handling + +From: Johan Hovold + +commit 030ee7ae52a46a2be52ccc8242c4a330aba8d38e upstream. + +The modem-control signals are managed by the tty-layer during open and +should not be asserted prematurely when set_termios is called from +driver open. + +Also make sure that the signals are asserted only when changing speed +from B0. + +Fixes: 664d5df92e88 ("USB: usb-serial ch341: support for DTR/RTS/CTS") +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ch341.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/usb/serial/ch341.c ++++ b/drivers/usb/serial/ch341.c +@@ -362,24 +362,24 @@ static void ch341_set_termios(struct tty + baud_rate = tty_get_baud_rate(tty); + + if (baud_rate) { +- spin_lock_irqsave(&priv->lock, flags); +- priv->line_control |= (CH341_BIT_DTR | CH341_BIT_RTS); +- spin_unlock_irqrestore(&priv->lock, flags); + priv->baud_rate = baud_rate; + ch341_set_baudrate(port->serial->dev, priv); +- } else { +- spin_lock_irqsave(&priv->lock, flags); +- priv->line_control &= ~(CH341_BIT_DTR | CH341_BIT_RTS); +- spin_unlock_irqrestore(&priv->lock, flags); + } + +- ch341_set_handshake(port->serial->dev, priv->line_control); +- + /* Unimplemented: + * (cflag & CSIZE) : data bits [5, 8] + * (cflag & PARENB) : parity {NONE, EVEN, ODD} + * (cflag & CSTOPB) : stop bits [1, 2] + */ ++ ++ spin_lock_irqsave(&priv->lock, flags); ++ if (C_BAUD(tty) == B0) ++ priv->line_control &= ~(CH341_BIT_DTR | CH341_BIT_RTS); ++ else if (old_termios && (old_termios->c_cflag & CBAUD) == B0) ++ priv->line_control |= (CH341_BIT_DTR | CH341_BIT_RTS); ++ spin_unlock_irqrestore(&priv->lock, flags); ++ ++ ch341_set_handshake(port->serial->dev, priv->line_control); + } + + static void ch341_break_ctl(struct tty_struct *tty, int break_state) diff --git a/queue-4.9/virtio_blk-avoid-dma-to-stack-for-the-sense-buffer.patch b/queue-4.9/virtio_blk-avoid-dma-to-stack-for-the-sense-buffer.patch new file mode 100644 index 00000000000..4629a907b78 --- /dev/null +++ b/queue-4.9/virtio_blk-avoid-dma-to-stack-for-the-sense-buffer.patch @@ -0,0 +1,44 @@ +From a14d749fcebe97ddf6af6db3d1f6ece85c9ddcb9 Mon Sep 17 00:00:00 2001 +From: Christoph Hellwig +Date: Mon, 9 Jan 2017 08:56:23 -0700 +Subject: virtio_blk: avoid DMA to stack for the sense buffer + +From: Christoph Hellwig + +commit a14d749fcebe97ddf6af6db3d1f6ece85c9ddcb9 upstream. + +Most users of BLOCK_PC requests allocate the sense buffer on the stack, +so to avoid DMA to the stack copy them to a field in the heap allocated +virtblk_req structure. Without that any attempt at SCSI passthrough I/O, +including the SG_IO ioctl from userspace will crash the kernel. Note that +this includes running tools like hdparm even when the host does not have +SCSI passthrough enabled. + +Signed-off-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/virtio_blk.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -56,6 +56,7 @@ struct virtblk_req { + struct virtio_blk_outhdr out_hdr; + struct virtio_scsi_inhdr in_hdr; + u8 status; ++ u8 sense[SCSI_SENSE_BUFFERSIZE]; + struct scatterlist sg[]; + }; + +@@ -102,7 +103,8 @@ static int __virtblk_add_req(struct virt + } + + if (type == cpu_to_virtio32(vq->vdev, VIRTIO_BLK_T_SCSI_CMD)) { +- sg_init_one(&sense, vbr->req->sense, SCSI_SENSE_BUFFERSIZE); ++ memcpy(vbr->sense, vbr->req->sense, SCSI_SENSE_BUFFERSIZE); ++ sg_init_one(&sense, vbr->sense, SCSI_SENSE_BUFFERSIZE); + sgs[num_out + num_in++] = &sense; + sg_init_one(&inhdr, &vbr->in_hdr, sizeof(vbr->in_hdr)); + sgs[num_out + num_in++] = &inhdr; diff --git a/queue-4.9/x86-cpu-fix-bootup-crashes-by-sanitizing-the-argument-of-the-clearcpuid-command-line-option.patch b/queue-4.9/x86-cpu-fix-bootup-crashes-by-sanitizing-the-argument-of-the-clearcpuid-command-line-option.patch new file mode 100644 index 00000000000..f9cd258702f --- /dev/null +++ b/queue-4.9/x86-cpu-fix-bootup-crashes-by-sanitizing-the-argument-of-the-clearcpuid-command-line-option.patch @@ -0,0 +1,49 @@ +From dd853fd216d1485ed3045ff772079cc8689a9a4a Mon Sep 17 00:00:00 2001 +From: Lukasz Odzioba +Date: Wed, 28 Dec 2016 14:55:40 +0100 +Subject: x86/cpu: Fix bootup crashes by sanitizing the argument of the 'clearcpuid=' command-line option + +From: Lukasz Odzioba + +commit dd853fd216d1485ed3045ff772079cc8689a9a4a upstream. + +A negative number can be specified in the cmdline which will be used as +setup_clear_cpu_cap() argument. With that we can clear/set some bit in +memory predceeding boot_cpu_data/cpu_caps_cleared which may cause kernel +to misbehave. This patch adds lower bound check to setup_disablecpuid(). + +Boris Petkov reproduced a crash: + + [ 1.234575] BUG: unable to handle kernel paging request at ffffffff858bd540 + [ 1.236535] IP: memcpy_erms+0x6/0x10 + +Signed-off-by: Lukasz Odzioba +Acked-by: Borislav Petkov +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: andi.kleen@intel.com +Cc: bp@alien8.de +Cc: dave.hansen@linux.intel.com +Cc: luto@kernel.org +Cc: slaoub@gmail.com +Fixes: ac72e7888a61 ("x86: add generic clearcpuid=... option") +Link: http://lkml.kernel.org/r/1482933340-11857-1-git-send-email-lukasz.odzioba@intel.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -1275,7 +1275,7 @@ static __init int setup_disablecpuid(cha + { + int bit; + +- if (get_option(&arg, &bit) && bit < NCAPINTS*32) ++ if (get_option(&arg, &bit) && bit >= 0 && bit < NCAPINTS * 32) + setup_clear_cpu_cap(bit); + else + return 0;