From: Sasha Levin Date: Mon, 18 Nov 2019 16:54:01 +0000 (-0500) Subject: fixes for 4.4 X-Git-Tag: v5.3.12~21^2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=eb0d0d9b54f28555187517c3b71b292fae4383e3;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.4 Signed-off-by: Sasha Levin --- diff --git a/queue-4.4/alsa-intel8x0m-register-irq-handler-after-register-i.patch b/queue-4.4/alsa-intel8x0m-register-irq-handler-after-register-i.patch new file mode 100644 index 00000000000..8629e5f05cf --- /dev/null +++ b/queue-4.4/alsa-intel8x0m-register-irq-handler-after-register-i.patch @@ -0,0 +1,66 @@ +From 98be15ce48b030b5941fffef6fa206a5f5487e4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Aug 2018 16:39:10 +0200 +Subject: ALSA: intel8x0m: Register irq handler after register initializations + +From: Takashi Iwai + +[ Upstream commit 7064f376d4a10686f51c879401a569bb4babf9c6 ] + +The interrupt handler has to be acquired after the other resource +initialization when allocated with IRQF_SHARED. Otherwise it's +triggered before the resource gets ready, and may lead to unpleasant +behavior. + +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/intel8x0m.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/sound/pci/intel8x0m.c b/sound/pci/intel8x0m.c +index 1bc98c867133d..2286dfd72ff7e 100644 +--- a/sound/pci/intel8x0m.c ++++ b/sound/pci/intel8x0m.c +@@ -1171,16 +1171,6 @@ static int snd_intel8x0m_create(struct snd_card *card, + } + + port_inited: +- if (request_irq(pci->irq, snd_intel8x0m_interrupt, IRQF_SHARED, +- KBUILD_MODNAME, chip)) { +- dev_err(card->dev, "unable to grab IRQ %d\n", pci->irq); +- snd_intel8x0m_free(chip); +- return -EBUSY; +- } +- chip->irq = pci->irq; +- pci_set_master(pci); +- synchronize_irq(chip->irq); +- + /* initialize offsets */ + chip->bdbars_count = 2; + tbl = intel_regs; +@@ -1224,11 +1214,21 @@ static int snd_intel8x0m_create(struct snd_card *card, + chip->int_sta_reg = ICH_REG_GLOB_STA; + chip->int_sta_mask = int_sta_masks; + ++ pci_set_master(pci); ++ + if ((err = snd_intel8x0m_chip_init(chip, 1)) < 0) { + snd_intel8x0m_free(chip); + return err; + } + ++ if (request_irq(pci->irq, snd_intel8x0m_interrupt, IRQF_SHARED, ++ KBUILD_MODNAME, chip)) { ++ dev_err(card->dev, "unable to grab IRQ %d\n", pci->irq); ++ snd_intel8x0m_free(chip); ++ return -EBUSY; ++ } ++ chip->irq = pci->irq; ++ + if ((err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops)) < 0) { + snd_intel8x0m_free(chip); + return err; +-- +2.20.1 + diff --git a/queue-4.4/alsa-pcm-signedness-bug-in-snd_pcm_plug_alloc.patch b/queue-4.4/alsa-pcm-signedness-bug-in-snd_pcm_plug_alloc.patch new file mode 100644 index 00000000000..4c7c997be7f --- /dev/null +++ b/queue-4.4/alsa-pcm-signedness-bug-in-snd_pcm_plug_alloc.patch @@ -0,0 +1,44 @@ +From c01f23f50268212405fda006ee131045bc4d5839 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Aug 2018 12:21:45 +0300 +Subject: ALSA: pcm: signedness bug in snd_pcm_plug_alloc() + +From: Dan Carpenter + +[ Upstream commit 6f128fa41f310e1f39ebcea9621d2905549ecf52 ] + +The "frames" variable is unsigned so the error handling doesn't work +properly. + +Signed-off-by: Dan Carpenter +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/oss/pcm_plugin.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c +index a84a1d3d23e56..c6888d76ca5e9 100644 +--- a/sound/core/oss/pcm_plugin.c ++++ b/sound/core/oss/pcm_plugin.c +@@ -111,7 +111,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames) + while (plugin->next) { + if (plugin->dst_frames) + frames = plugin->dst_frames(plugin, frames); +- if (snd_BUG_ON(frames <= 0)) ++ if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0)) + return -ENXIO; + plugin = plugin->next; + err = snd_pcm_plugin_alloc(plugin, frames); +@@ -123,7 +123,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames) + while (plugin->prev) { + if (plugin->src_frames) + frames = plugin->src_frames(plugin, frames); +- if (snd_BUG_ON(frames <= 0)) ++ if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0)) + return -ENXIO; + plugin = plugin->prev; + err = snd_pcm_plugin_alloc(plugin, frames); +-- +2.20.1 + diff --git a/queue-4.4/alsa-seq-do-error-checks-at-creating-system-ports.patch b/queue-4.4/alsa-seq-do-error-checks-at-creating-system-ports.patch new file mode 100644 index 00000000000..fe9aa0f05aa --- /dev/null +++ b/queue-4.4/alsa-seq-do-error-checks-at-creating-system-ports.patch @@ -0,0 +1,72 @@ +From 41ad24e06d54558148718c033bf6e6a0af9dda1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Aug 2018 12:49:43 +0200 +Subject: ALSA: seq: Do error checks at creating system ports + +From: Takashi Iwai + +[ Upstream commit b8e131542b47b81236ecf6768c923128e1f5db6e ] + +snd_seq_system_client_init() doesn't check the errors returned from +its port creations. Let's do it properly and handle the error paths. + +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/seq/seq_system.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +diff --git a/sound/core/seq/seq_system.c b/sound/core/seq/seq_system.c +index 8ce1d0b40dce1..ce1f1e4727ab1 100644 +--- a/sound/core/seq/seq_system.c ++++ b/sound/core/seq/seq_system.c +@@ -123,6 +123,7 @@ int __init snd_seq_system_client_init(void) + { + struct snd_seq_port_callback pcallbacks; + struct snd_seq_port_info *port; ++ int err; + + port = kzalloc(sizeof(*port), GFP_KERNEL); + if (!port) +@@ -144,7 +145,10 @@ int __init snd_seq_system_client_init(void) + port->flags = SNDRV_SEQ_PORT_FLG_GIVEN_PORT; + port->addr.client = sysclient; + port->addr.port = SNDRV_SEQ_PORT_SYSTEM_TIMER; +- snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT, port); ++ err = snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT, ++ port); ++ if (err < 0) ++ goto error_port; + + /* register announcement port */ + strcpy(port->name, "Announce"); +@@ -154,16 +158,24 @@ int __init snd_seq_system_client_init(void) + port->flags = SNDRV_SEQ_PORT_FLG_GIVEN_PORT; + port->addr.client = sysclient; + port->addr.port = SNDRV_SEQ_PORT_SYSTEM_ANNOUNCE; +- snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT, port); ++ err = snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT, ++ port); ++ if (err < 0) ++ goto error_port; + announce_port = port->addr.port; + + kfree(port); + return 0; ++ ++ error_port: ++ snd_seq_system_client_done(); ++ kfree(port); ++ return err; + } + + + /* unregister our internal client */ +-void __exit snd_seq_system_client_done(void) ++void snd_seq_system_client_done(void) + { + int oldsysclient = sysclient; + +-- +2.20.1 + diff --git a/queue-4.4/arm-dts-am335x-evm-fix-number-of-cpsw.patch b/queue-4.4/arm-dts-am335x-evm-fix-number-of-cpsw.patch new file mode 100644 index 00000000000..9a803f4033b --- /dev/null +++ b/queue-4.4/arm-dts-am335x-evm-fix-number-of-cpsw.patch @@ -0,0 +1,59 @@ +From c4d2cfa3662482383bb72883cc940651035561a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Sep 2018 17:33:40 -0500 +Subject: ARM: dts: am335x-evm: fix number of cpsw + +From: Grygorii Strashko + +[ Upstream commit dcbf6b18d81bcdc51390ca1b258c17e2e13b7d0c ] + +am335x-evm has only one CPSW external port physically wired, but DT defines +2 ext. ports. As result, PHY connection failure reported for the second +ext. port. + +Update DT to reflect am335x-evm board HW configuration, and, while here, +switch to use phy-handle instead of phy_id. + +Signed-off-by: Grygorii Strashko +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am335x-evm.dts | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts +index d9d00ab863a21..2b8614e406f03 100644 +--- a/arch/arm/boot/dts/am335x-evm.dts ++++ b/arch/arm/boot/dts/am335x-evm.dts +@@ -697,6 +697,7 @@ + pinctrl-0 = <&cpsw_default>; + pinctrl-1 = <&cpsw_sleep>; + status = "okay"; ++ slaves = <1>; + }; + + &davinci_mdio { +@@ -704,15 +705,14 @@ + pinctrl-0 = <&davinci_mdio_default>; + pinctrl-1 = <&davinci_mdio_sleep>; + status = "okay"; +-}; + +-&cpsw_emac0 { +- phy_id = <&davinci_mdio>, <0>; +- phy-mode = "rgmii-txid"; ++ ethphy0: ethernet-phy@0 { ++ reg = <0>; ++ }; + }; + +-&cpsw_emac1 { +- phy_id = <&davinci_mdio>, <1>; ++&cpsw_emac0 { ++ phy-handle = <ðphy0>; + phy-mode = "rgmii-txid"; + }; + +-- +2.20.1 + diff --git a/queue-4.4/arm-dts-at91-trivial-fix-usart1-definition-for-at91s.patch b/queue-4.4/arm-dts-at91-trivial-fix-usart1-definition-for-at91s.patch new file mode 100644 index 00000000000..ab7a4551c42 --- /dev/null +++ b/queue-4.4/arm-dts-at91-trivial-fix-usart1-definition-for-at91s.patch @@ -0,0 +1,35 @@ +From 8550d42583e44ce53b2b682261400dcd5bfe1273 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Aug 2018 11:42:01 +0200 +Subject: ARM: dts: at91/trivial: Fix USART1 definition for at91sam9g45 + +From: Jay Foster + +[ Upstream commit 10af10db8c76fa5b9bf1f52a895c1cb2c0ac24da ] + +Fix a typo. No functional change made by this patch. + +Signed-off-by: Jay Foster +Signed-off-by: Nicolas Ferre +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91sam9g45.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi +index af8b708ac312a..53a5a0e311e9d 100644 +--- a/arch/arm/boot/dts/at91sam9g45.dtsi ++++ b/arch/arm/boot/dts/at91sam9g45.dtsi +@@ -546,7 +546,7 @@ + }; + }; + +- uart1 { ++ usart1 { + pinctrl_usart1: usart1-0 { + atmel,pins = + +Date: Thu, 6 Sep 2018 17:41:35 +0200 +Subject: ARM: dts: exynos: Disable pull control for S5M8767 PMIC + +From: Marek Szyprowski + +[ Upstream commit ef2ecab9af5feae97c47b7f61cdd96f7f49b2c23 ] + +S5M8767 PMIC interrupt line on Exynos5250-based Arndale board has +external pull-up resistors, so disable any pull control for it in +in controller node. This fixes support for S5M8767 interrupts and +enables operation of wakeup from S5M8767 RTC alarm. + +Signed-off-by: Marek Szyprowski +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5250-arndale.dts | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/arch/arm/boot/dts/exynos5250-arndale.dts b/arch/arm/boot/dts/exynos5250-arndale.dts +index c000532c14446..b425b77f8fb65 100644 +--- a/arch/arm/boot/dts/exynos5250-arndale.dts ++++ b/arch/arm/boot/dts/exynos5250-arndale.dts +@@ -170,6 +170,8 @@ + reg = <0x66>; + interrupt-parent = <&gpx3>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&s5m8767_irq>; + + vinb1-supply = <&main_dc_reg>; + vinb2-supply = <&main_dc_reg>; +@@ -552,6 +554,13 @@ + cap-sd-highspeed; + }; + ++&pinctrl_0 { ++ s5m8767_irq: s5m8767-irq { ++ samsung,pins = "gpx3-2"; ++ samsung,pin-pud = ; ++ }; ++}; ++ + &rtc { + status = "okay"; + }; +-- +2.20.1 + diff --git a/queue-4.4/arm-dts-exynos-fix-sound-in-snow-rev5-chromebook.patch b/queue-4.4/arm-dts-exynos-fix-sound-in-snow-rev5-chromebook.patch new file mode 100644 index 00000000000..b7ca4e5073c --- /dev/null +++ b/queue-4.4/arm-dts-exynos-fix-sound-in-snow-rev5-chromebook.patch @@ -0,0 +1,57 @@ +From 5e023ca24c88151fae85ca7856d23a4b7dd3cac0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Aug 2018 12:55:32 +0200 +Subject: ARM: dts: exynos: Fix sound in Snow-rev5 Chromebook + +From: Marek Szyprowski + +[ Upstream commit 64858773d78e820003a94e5a7179d368213655d6 ] + +This patch adds missing properties to the CODEC and sound nodes, so the +audio will work also on Snow rev5 Chromebook. This patch is an extension +to the commit e9eefc3f8ce0 ("ARM: dts: exynos: Add missing clock and +DAI properties to the max98095 node in Snow Chromebook") +and commit 6ab569936d60 ("ARM: dts: exynos: Enable HDMI audio on Snow +Chromebook"). It has been reported that such changes work fine on the +rev5 board too. + +Signed-off-by: Marek Szyprowski +[krzk: Fixed typo in phandle to &max98090] +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5250-snow-rev5.dts | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/arch/arm/boot/dts/exynos5250-snow-rev5.dts b/arch/arm/boot/dts/exynos5250-snow-rev5.dts +index f811dc8006605..0d46f754070e4 100644 +--- a/arch/arm/boot/dts/exynos5250-snow-rev5.dts ++++ b/arch/arm/boot/dts/exynos5250-snow-rev5.dts +@@ -23,6 +23,14 @@ + + samsung,model = "Snow-I2S-MAX98090"; + samsung,audio-codec = <&max98090>; ++ ++ cpu { ++ sound-dai = <&i2s0 0>; ++ }; ++ ++ codec { ++ sound-dai = <&max98090 0>, <&hdmi>; ++ }; + }; + }; + +@@ -34,6 +42,9 @@ + interrupt-parent = <&gpx0>; + pinctrl-names = "default"; + pinctrl-0 = <&max98090_irq>; ++ clocks = <&pmu_system_controller 0>; ++ clock-names = "mclk"; ++ #sound-dai-cells = <1>; + }; + }; + +-- +2.20.1 + diff --git a/queue-4.4/arm-dts-omap3-gta04-give-spi_lcd-node-a-label-so-tha.patch b/queue-4.4/arm-dts-omap3-gta04-give-spi_lcd-node-a-label-so-tha.patch new file mode 100644 index 00000000000..ae8da3fddd4 --- /dev/null +++ b/queue-4.4/arm-dts-omap3-gta04-give-spi_lcd-node-a-label-so-tha.patch @@ -0,0 +1,36 @@ +From bb041fc62b9a168a0c2b245c6ee17e01d17c380a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jul 2018 09:11:06 +0200 +Subject: ARM: dts: omap3-gta04: give spi_lcd node a label so that we can + overwrite in other DTS files + +From: H. Nikolaus Schaller + +[ Upstream commit fa0d7dc355c890725b6178dab0cc11b194203afa ] + +needed for device variants based on GTA04 board but with +different display panel (driver). + +Signed-off-by: H. Nikolaus Schaller +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap3-gta04.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi +index e14d15e5abc89..9b9510e057f3f 100644 +--- a/arch/arm/boot/dts/omap3-gta04.dtsi ++++ b/arch/arm/boot/dts/omap3-gta04.dtsi +@@ -70,7 +70,7 @@ + #sound-dai-cells = <0>; + }; + +- spi_lcd { ++ spi_lcd: spi_lcd { + compatible = "spi-gpio"; + #address-cells = <0x1>; + #size-cells = <0x0>; +-- +2.20.1 + diff --git a/queue-4.4/arm-dts-omap3-gta04-keep-vpll2-always-on.patch b/queue-4.4/arm-dts-omap3-gta04-keep-vpll2-always-on.patch new file mode 100644 index 00000000000..98e1ef92be2 --- /dev/null +++ b/queue-4.4/arm-dts-omap3-gta04-keep-vpll2-always-on.patch @@ -0,0 +1,39 @@ +From 27f0704e9a816e8d3bf9ed66ac62e45b7cb294b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jul 2018 09:11:14 +0200 +Subject: ARM: dts: omap3-gta04: keep vpll2 always on + +From: H. Nikolaus Schaller + +[ Upstream commit 1ae00833e30c9b4af5cbfda65d75b1de12f74013 ] + +This is needed to make the display and venc work properly. +Compare to omap3-beagle.dts. + +Signed-off-by: H. Nikolaus Schaller +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap3-gta04.dtsi | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi +index 0ea793e365e45..acd0a9deb116b 100644 +--- a/arch/arm/boot/dts/omap3-gta04.dtsi ++++ b/arch/arm/boot/dts/omap3-gta04.dtsi +@@ -460,6 +460,12 @@ + regulator-max-microvolt = <3150000>; + }; + ++/* Needed to power the DPI pins */ ++ ++&vpll2 { ++ regulator-always-on; ++}; ++ + &dss { + pinctrl-names = "default"; + pinctrl-0 = < &dss_dpi_pins >; +-- +2.20.1 + diff --git a/queue-4.4/arm-dts-omap3-gta04-make-nand-partitions-compatible-.patch b/queue-4.4/arm-dts-omap3-gta04-make-nand-partitions-compatible-.patch new file mode 100644 index 00000000000..c72cf8b74db --- /dev/null +++ b/queue-4.4/arm-dts-omap3-gta04-make-nand-partitions-compatible-.patch @@ -0,0 +1,62 @@ +From 3cde2350c45f77f30540316763c520e0de859f5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jul 2018 09:11:12 +0200 +Subject: ARM: dts: omap3-gta04: make NAND partitions compatible with recent + U-Boot + +From: H. Nikolaus Schaller + +[ Upstream commit fa99c21ecb3cd4021a60d0e8bf880e78b5bd0729 ] + +Vendor defined U-Boot has changed the partition scheme a while ago: + +* kernel partition 6MB +* file system partition uses the remainder up to end of the NAND +* increased size of the environment partition (to get an OneNAND compatible base address) +* shrink the U-Boot partition + +Let's be compatible (e.g. Debian kernel built from upstream). + +Signed-off-by: H. Nikolaus Schaller +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap3-gta04.dtsi | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi +index 196b3f5158c90..0ea793e365e45 100644 +--- a/arch/arm/boot/dts/omap3-gta04.dtsi ++++ b/arch/arm/boot/dts/omap3-gta04.dtsi +@@ -523,22 +523,22 @@ + + bootloaders@80000 { + label = "U-Boot"; +- reg = <0x80000 0x1e0000>; ++ reg = <0x80000 0x1c0000>; + }; + +- bootloaders_env@260000 { ++ bootloaders_env@240000 { + label = "U-Boot Env"; +- reg = <0x260000 0x20000>; ++ reg = <0x240000 0x40000>; + }; + + kernel@280000 { + label = "Kernel"; +- reg = <0x280000 0x400000>; ++ reg = <0x280000 0x600000>; + }; + +- filesystem@680000 { ++ filesystem@880000 { + label = "File System"; +- reg = <0x680000 0xf980000>; ++ reg = <0x880000 0>; /* 0 = MTDPART_SIZ_FULL */ + }; + }; + }; +-- +2.20.1 + diff --git a/queue-4.4/arm-dts-omap3-gta04-tvout-enable-as-display1-alias.patch b/queue-4.4/arm-dts-omap3-gta04-tvout-enable-as-display1-alias.patch new file mode 100644 index 00000000000..a97005d99cf --- /dev/null +++ b/queue-4.4/arm-dts-omap3-gta04-tvout-enable-as-display1-alias.patch @@ -0,0 +1,35 @@ +From 34b5dbd70de06e784b6bf58e74226283b17bb4ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jul 2018 09:11:09 +0200 +Subject: ARM: dts: omap3-gta04: tvout: enable as display1 alias + +From: H. Nikolaus Schaller + +[ Upstream commit 8905592b6e50cec905e6c6035bbd36201a3bfac1 ] + +The omap dss susbystem takes the display aliases to find +out which displays exist. To enable tv-out we must define +an alias. + +Signed-off-by: H. Nikolaus Schaller +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap3-gta04.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi +index 9b9510e057f3f..196b3f5158c90 100644 +--- a/arch/arm/boot/dts/omap3-gta04.dtsi ++++ b/arch/arm/boot/dts/omap3-gta04.dtsi +@@ -28,6 +28,7 @@ + + aliases { + display0 = &lcd; ++ display1 = &tv0; + }; + + gpio-keys { +-- +2.20.1 + diff --git a/queue-4.4/arm-dts-pxa-fix-power-i2c-base-address.patch b/queue-4.4/arm-dts-pxa-fix-power-i2c-base-address.patch new file mode 100644 index 00000000000..c9dd91ffeba --- /dev/null +++ b/queue-4.4/arm-dts-pxa-fix-power-i2c-base-address.patch @@ -0,0 +1,34 @@ +From 9fe0761677362c513efb5810256e8483d0598ab0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Aug 2018 14:03:09 +0200 +Subject: ARM: dts: pxa: fix power i2c base address + +From: Marcel Ziswiler + +[ Upstream commit 8a1ecc01a473b75ab97be9b36f623e4551a6e9ae ] + +There is one too many zeroes in the Power I2C base address. Fix this. + +Signed-off-by: Marcel Ziswiler +Signed-off-by: Robert Jarzmik +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/pxa27x.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi +index 210192c38df3c..4448505e34d3b 100644 +--- a/arch/arm/boot/dts/pxa27x.dtsi ++++ b/arch/arm/boot/dts/pxa27x.dtsi +@@ -63,7 +63,7 @@ + clocks = <&clks CLK_PWM1>; + }; + +- pwri2c: i2c@40f000180 { ++ pwri2c: i2c@40f00180 { + compatible = "mrvl,pxa-i2c"; + reg = <0x40f00180 0x24>; + interrupts = <6>; +-- +2.20.1 + diff --git a/queue-4.4/arm-dts-socfpga-fix-i2c-bus-unit-address-error.patch b/queue-4.4/arm-dts-socfpga-fix-i2c-bus-unit-address-error.patch new file mode 100644 index 00000000000..8ce83e6b214 --- /dev/null +++ b/queue-4.4/arm-dts-socfpga-fix-i2c-bus-unit-address-error.patch @@ -0,0 +1,36 @@ +From d8bec08dff16c9e61313b20684b6f46212373fb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Sep 2018 23:52:49 -0500 +Subject: ARM: dts: socfpga: Fix I2C bus unit-address error + +From: Dinh Nguyen + +[ Upstream commit cbbc488ed85061a765cf370c3e41f383c1e0add6 ] + +dtc has new checks for I2C buses. Fix the warnings in unit-addresses. + +arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dtb: Warning (i2c_bus_reg): /soc/i2c@ffc04000/adxl345@0: I2C bus unit address format error, expected "53" + +Signed-off-by: Rob Herring +Signed-off-by: Dinh Nguyen +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts b/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts +index 555e9caf21e16..7b8e1c4215b51 100644 +--- a/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts ++++ b/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts +@@ -88,7 +88,7 @@ + status = "okay"; + speed-mode = <0>; + +- adxl345: adxl345@0 { ++ adxl345: adxl345@53 { + compatible = "adi,adxl345"; + reg = <0x53>; + +-- +2.20.1 + diff --git a/queue-4.4/arm-dts-ste-fix-spi-controller-node-names.patch b/queue-4.4/arm-dts-ste-fix-spi-controller-node-names.patch new file mode 100644 index 00000000000..09ff848e422 --- /dev/null +++ b/queue-4.4/arm-dts-ste-fix-spi-controller-node-names.patch @@ -0,0 +1,86 @@ +From b6b3c75bdc24d478e3fc20f9b276361f3727e414 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Sep 2018 13:12:34 -0500 +Subject: ARM: dts: ste: Fix SPI controller node names + +From: Rob Herring + +[ Upstream commit 2f967f9e9fa076affb711da1a8389b5d33814fc6 ] + +SPI controller nodes should be named 'spi' rather than 'ssp'. Fixing the +name enables dtc SPI bus checks. + +Signed-off-by: Rob Herring +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ste-dbx5x0.dtsi | 4 ++-- + arch/arm/boot/dts/ste-hrefprev60.dtsi | 2 +- + arch/arm/boot/dts/ste-snowball.dts | 2 +- + arch/arm/boot/dts/ste-u300.dts | 2 +- + 4 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi +index 86bd320057a38..b2b23ceb6d557 100644 +--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi ++++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi +@@ -894,7 +894,7 @@ + power-domains = <&pm_domains DOMAIN_VAPE>; + }; + +- ssp@80002000 { ++ spi@80002000 { + compatible = "arm,pl022", "arm,primecell"; + reg = <0x80002000 0x1000>; + interrupts = <0 14 IRQ_TYPE_LEVEL_HIGH>; +@@ -908,7 +908,7 @@ + power-domains = <&pm_domains DOMAIN_VAPE>; + }; + +- ssp@80003000 { ++ spi@80003000 { + compatible = "arm,pl022", "arm,primecell"; + reg = <0x80003000 0x1000>; + interrupts = <0 52 IRQ_TYPE_LEVEL_HIGH>; +diff --git a/arch/arm/boot/dts/ste-hrefprev60.dtsi b/arch/arm/boot/dts/ste-hrefprev60.dtsi +index b0278f4c486ce..55a6a1ac03370 100644 +--- a/arch/arm/boot/dts/ste-hrefprev60.dtsi ++++ b/arch/arm/boot/dts/ste-hrefprev60.dtsi +@@ -57,7 +57,7 @@ + }; + }; + +- ssp@80002000 { ++ spi@80002000 { + /* + * On the first generation boards, this SSP/SPI port was connected + * to the AB8500. +diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts +index e80e421638836..bb1b64d6ab5e8 100644 +--- a/arch/arm/boot/dts/ste-snowball.dts ++++ b/arch/arm/boot/dts/ste-snowball.dts +@@ -311,7 +311,7 @@ + pinctrl-1 = <&i2c3_sleep_mode>; + }; + +- ssp@80002000 { ++ spi@80002000 { + pinctrl-names = "default"; + pinctrl-0 = <&ssp0_snowball_mode>; + }; +diff --git a/arch/arm/boot/dts/ste-u300.dts b/arch/arm/boot/dts/ste-u300.dts +index 82a661677e97e..fb6ca7f864176 100644 +--- a/arch/arm/boot/dts/ste-u300.dts ++++ b/arch/arm/boot/dts/ste-u300.dts +@@ -451,7 +451,7 @@ + dma-names = "rx"; + }; + +- spi: ssp@c0006000 { ++ spi: spi@c0006000 { + compatible = "arm,pl022", "arm,primecell"; + reg = <0xc0006000 0x1000>; + interrupt-parent = <&vica>; +-- +2.20.1 + diff --git a/queue-4.4/arm-dts-tegra30-fix-xcvr-setup-use-fuses.patch b/queue-4.4/arm-dts-tegra30-fix-xcvr-setup-use-fuses.patch new file mode 100644 index 00000000000..39517c3eeaf --- /dev/null +++ b/queue-4.4/arm-dts-tegra30-fix-xcvr-setup-use-fuses.patch @@ -0,0 +1,52 @@ +From 3142fa9674593f94263758634760aaf62e5835d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Aug 2018 14:42:33 +0200 +Subject: ARM: dts: tegra30: fix xcvr-setup-use-fuses + +From: Marcel Ziswiler + +[ Upstream commit 564706f65cda3de52b09e51feb423a43940fe661 ] + +There was a dot instead of a comma. Fix this. + +Signed-off-by: Marcel Ziswiler +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/tegra30.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/tegra30.dtsi b/arch/arm/boot/dts/tegra30.dtsi +index 313e260529a31..e8f5a55c4b954 100644 +--- a/arch/arm/boot/dts/tegra30.dtsi ++++ b/arch/arm/boot/dts/tegra30.dtsi +@@ -823,7 +823,7 @@ + nvidia,elastic-limit = <16>; + nvidia,term-range-adj = <6>; + nvidia,xcvr-setup = <51>; +- nvidia.xcvr-setup-use-fuses; ++ nvidia,xcvr-setup-use-fuses; + nvidia,xcvr-lsfslew = <1>; + nvidia,xcvr-lsrslew = <1>; + nvidia,xcvr-hsslew = <32>; +@@ -860,7 +860,7 @@ + nvidia,elastic-limit = <16>; + nvidia,term-range-adj = <6>; + nvidia,xcvr-setup = <51>; +- nvidia.xcvr-setup-use-fuses; ++ nvidia,xcvr-setup-use-fuses; + nvidia,xcvr-lsfslew = <2>; + nvidia,xcvr-lsrslew = <2>; + nvidia,xcvr-hsslew = <32>; +@@ -896,7 +896,7 @@ + nvidia,elastic-limit = <16>; + nvidia,term-range-adj = <6>; + nvidia,xcvr-setup = <51>; +- nvidia.xcvr-setup-use-fuses; ++ nvidia,xcvr-setup-use-fuses; + nvidia,xcvr-lsfslew = <2>; + nvidia,xcvr-lsrslew = <2>; + nvidia,xcvr-hsslew = <32>; +-- +2.20.1 + diff --git a/queue-4.4/arm-dts-ux500-correct-scu-unit-address.patch b/queue-4.4/arm-dts-ux500-correct-scu-unit-address.patch new file mode 100644 index 00000000000..7e27db7bcc3 --- /dev/null +++ b/queue-4.4/arm-dts-ux500-correct-scu-unit-address.patch @@ -0,0 +1,35 @@ +From 995e9b2407c0e3bd2c6d33dfa7188d9489e421c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jun 2018 09:50:09 +0200 +Subject: ARM: dts: ux500: Correct SCU unit address + +From: Geert Uytterhoeven + +[ Upstream commit 2f217d24ecaec2012e628d21e244eef0608656a4 ] + +The unit address of the Cortex-A9 SCU device node contains one zero too +many. Remove it. + +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ste-dbx5x0.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi +index 50f5e9d092038..86bd320057a38 100644 +--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi ++++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi +@@ -186,7 +186,7 @@ + <0xa0410100 0x100>; + }; + +- scu@a04100000 { ++ scu@a0410000 { + compatible = "arm,cortex-a9-scu"; + reg = <0xa0410000 0x100>; + }; +-- +2.20.1 + diff --git a/queue-4.4/arm-dts-ux500-fix-lcda-clock-line-muxing.patch b/queue-4.4/arm-dts-ux500-fix-lcda-clock-line-muxing.patch new file mode 100644 index 00000000000..5fec841639d --- /dev/null +++ b/queue-4.4/arm-dts-ux500-fix-lcda-clock-line-muxing.patch @@ -0,0 +1,49 @@ +From 06463b0212c3b9d6451de2ac770f7de538ded305 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Jul 2018 10:30:03 +0200 +Subject: ARM: dts: ux500: Fix LCDA clock line muxing + +From: Linus Walleij + +[ Upstream commit ecde29569e3484e1d0a032bf4074449bce4d4a03 ] + +The "lcdaclk_b_1" group is muxed with the function "lcd" +but needs a separate entry to be muxed in with "lcda" +rather than "lcd". + +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ste-href-family-pinctrl.dtsi | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi b/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi +index 5c5cea232743d..1ec193b0c5065 100644 +--- a/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi ++++ b/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi +@@ -607,16 +607,20 @@ + + mcde { + lcd_default_mode: lcd_default { +- default_mux { ++ default_mux1 { + /* Mux in VSI0 and all the data lines */ + function = "lcd"; + groups = + "lcdvsi0_a_1", /* VSI0 for LCD */ + "lcd_d0_d7_a_1", /* Data lines */ + "lcd_d8_d11_a_1", /* TV-out */ +- "lcdaclk_b_1", /* Clock line for TV-out */ + "lcdvsi1_a_1"; /* VSI1 for HDMI */ + }; ++ default_mux2 { ++ function = "lcda"; ++ groups = ++ "lcdaclk_b_1"; /* Clock line for TV-out */ ++ }; + default_cfg1 { + pins = + "GPIO68_E1", /* VSI0 */ +-- +2.20.1 + diff --git a/queue-4.4/arm-imx6-register-pm_power_off-handler-if-fsl-pmic-s.patch b/queue-4.4/arm-imx6-register-pm_power_off-handler-if-fsl-pmic-s.patch new file mode 100644 index 00000000000..415508a4b40 --- /dev/null +++ b/queue-4.4/arm-imx6-register-pm_power_off-handler-if-fsl-pmic-s.patch @@ -0,0 +1,75 @@ +From 5ad1723cae3e0314047daed291e44bee0625cfe9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Aug 2018 12:34:21 +0200 +Subject: ARM: imx6: register pm_power_off handler if "fsl,pmic-stby-poweroff" + is set + +From: Oleksij Rempel + +[ Upstream commit 8148d2136002da2e2887caf6a07bbd9c033f14f3 ] + +One of the Freescale recommended sequences for power off with external +PMIC is the following: +... +3. SoC is programming PMIC for power off when standby is asserted. +4. In CCM STOP mode, Standby is asserted, PMIC gates SoC supplies. + +See: +http://www.nxp.com/assets/documents/data/en/reference-manuals/IMX6DQRM.pdf +page 5083 + +This patch implements step 4. of this sequence. + +Signed-off-by: Oleksij Rempel +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/mach-imx/pm-imx6.c | 25 +++++++++++++++++++++++++ + 1 file changed, 25 insertions(+) + +diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c +index a19d20f23e716..fff529c5f9b36 100644 +--- a/arch/arm/mach-imx/pm-imx6.c ++++ b/arch/arm/mach-imx/pm-imx6.c +@@ -602,6 +602,28 @@ static void __init imx6_pm_common_init(const struct imx6_pm_socdata + IMX6Q_GPR1_GINT); + } + ++static void imx6_pm_stby_poweroff(void) ++{ ++ imx6_set_lpm(STOP_POWER_OFF); ++ imx6q_suspend_finish(0); ++ ++ mdelay(1000); ++ ++ pr_emerg("Unable to poweroff system\n"); ++} ++ ++static int imx6_pm_stby_poweroff_probe(void) ++{ ++ if (pm_power_off) { ++ pr_warn("%s: pm_power_off already claimed %p %pf!\n", ++ __func__, pm_power_off, pm_power_off); ++ return -EBUSY; ++ } ++ ++ pm_power_off = imx6_pm_stby_poweroff; ++ return 0; ++} ++ + void __init imx6_pm_ccm_init(const char *ccm_compat) + { + struct device_node *np; +@@ -618,6 +640,9 @@ void __init imx6_pm_ccm_init(const char *ccm_compat) + val = readl_relaxed(ccm_base + CLPCR); + val &= ~BM_CLPCR_LPM; + writel_relaxed(val, ccm_base + CLPCR); ++ ++ if (of_property_read_bool(np, "fsl,pmic-stby-poweroff")) ++ imx6_pm_stby_poweroff_probe(); + } + + void __init imx6q_pm_init(void) +-- +2.20.1 + diff --git a/queue-4.4/arm-tegra-apalis_t30-fix-mmc1-cmd-pull-up.patch b/queue-4.4/arm-tegra-apalis_t30-fix-mmc1-cmd-pull-up.patch new file mode 100644 index 00000000000..c172c4efae0 --- /dev/null +++ b/queue-4.4/arm-tegra-apalis_t30-fix-mmc1-cmd-pull-up.patch @@ -0,0 +1,44 @@ +From c965a5f080919c5eec9923ef896ce66b09efa87f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Aug 2018 18:37:43 +0200 +Subject: ARM: tegra: apalis_t30: fix mmc1 cmd pull-up + +From: Marcel Ziswiler + +[ Upstream commit 1c997fe4becdc6fcbc06e23982ceb65621e6572a ] + +Fix MMC1 cmd pin pull-up causing issues on carrier boards without +external pull-up. + +Signed-off-by: Marcel Ziswiler +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/tegra30-apalis.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/tegra30-apalis.dtsi b/arch/arm/boot/dts/tegra30-apalis.dtsi +index bf361277fe105..9a8c20cd06885 100644 +--- a/arch/arm/boot/dts/tegra30-apalis.dtsi ++++ b/arch/arm/boot/dts/tegra30-apalis.dtsi +@@ -147,14 +147,14 @@ + + /* Apalis MMC1 */ + sdmmc3_clk_pa6 { +- nvidia,pins = "sdmmc3_clk_pa6", +- "sdmmc3_cmd_pa7"; ++ nvidia,pins = "sdmmc3_clk_pa6"; + nvidia,function = "sdmmc3"; + nvidia,pull = ; + nvidia,tristate = ; + }; + sdmmc3_dat0_pb7 { +- nvidia,pins = "sdmmc3_dat0_pb7", ++ nvidia,pins = "sdmmc3_cmd_pa7", ++ "sdmmc3_dat0_pb7", + "sdmmc3_dat1_pb6", + "sdmmc3_dat2_pb5", + "sdmmc3_dat3_pb4", +-- +2.20.1 + diff --git a/queue-4.4/arm64-dts-amd-fix-spi-bus-warnings.patch b/queue-4.4/arm64-dts-amd-fix-spi-bus-warnings.patch new file mode 100644 index 00000000000..b4de1fd64fa --- /dev/null +++ b/queue-4.4/arm64-dts-amd-fix-spi-bus-warnings.patch @@ -0,0 +1,50 @@ +From 738a08a1b37ce7a50d68c6e877080252315f822b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Sep 2018 13:12:40 -0500 +Subject: arm64: dts: amd: Fix SPI bus warnings + +From: Rob Herring + +[ Upstream commit e9f0878c4b2004ac19581274c1ae4c61ae3ca70e ] + +dtc has new checks for SPI buses. Fix the warnings in node names. + +arch/arm64/boot/dts/amd/amd-overdrive.dtb: Warning (spi_bus_bridge): /smb/ssp@e1030000: node name for SPI buses should be 'spi' +arch/arm64/boot/dts/amd/amd-overdrive-rev-b0.dtb: Warning (spi_bus_bridge): /smb/ssp@e1030000: node name for SPI buses should be 'spi' +arch/arm64/boot/dts/amd/amd-overdrive-rev-b1.dtb: Warning (spi_bus_bridge): /smb/ssp@e1030000: node name for SPI buses should be 'spi' + +Cc: Brijesh Singh +Cc: Suravee Suthikulpanit +Cc: Tom Lendacky +Signed-off-by: Rob Herring +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi b/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi +index 2874d92881fda..a3030c868be5f 100644 +--- a/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi ++++ b/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi +@@ -84,7 +84,7 @@ + clock-names = "uartclk", "apb_pclk"; + }; + +- spi0: ssp@e1020000 { ++ spi0: spi@e1020000 { + status = "disabled"; + compatible = "arm,pl022", "arm,primecell"; + #gpio-cells = <2>; +@@ -95,7 +95,7 @@ + clock-names = "apb_pclk"; + }; + +- spi1: ssp@e1030000 { ++ spi1: spi@e1030000 { + status = "disabled"; + compatible = "arm,pl022", "arm,primecell"; + #gpio-cells = <2>; +-- +2.20.1 + diff --git a/queue-4.4/asoc-dpcm-properly-initialise-hw-rate_max.patch b/queue-4.4/asoc-dpcm-properly-initialise-hw-rate_max.patch new file mode 100644 index 00000000000..41c13c25dc6 --- /dev/null +++ b/queue-4.4/asoc-dpcm-properly-initialise-hw-rate_max.patch @@ -0,0 +1,42 @@ +From ee2fac3f088f53331e94df47fadfe173a312d8f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Aug 2018 14:26:47 +0100 +Subject: ASoC: dpcm: Properly initialise hw->rate_max + +From: Charles Keepax + +[ Upstream commit e33ffbd9cd39da09831ce62c11025d830bf78d9e ] + +If the CPU DAI does not initialise rate_max, say if using +using KNOT or CONTINUOUS, then the rate_max field will be +initialised to 0. A value of zero in the rate_max field of +the hardware runtime will cause the sound card to support no +sample rates at all. Obviously this is not desired, just a +different mechanism is being used to apply the constraints. As +such update the setting of rate_max in dpcm_init_runtime_hw +to be consistent with the non-DPCM cases and set rate_max to +UINT_MAX if nothing is defined on the CPU DAI. + +Signed-off-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-pcm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index 1c0d44c86c018..78813057167d7 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -1541,7 +1541,7 @@ static void dpcm_init_runtime_hw(struct snd_pcm_runtime *runtime, + u64 formats) + { + runtime->hw.rate_min = stream->rate_min; +- runtime->hw.rate_max = stream->rate_max; ++ runtime->hw.rate_max = min_not_zero(stream->rate_max, UINT_MAX); + runtime->hw.channels_min = stream->channels_min; + runtime->hw.channels_max = stream->channels_max; + if (runtime->hw.formats) +-- +2.20.1 + diff --git a/queue-4.4/asoc-sgtl5000-avoid-division-by-zero-if-lo_vag-is-ze.patch b/queue-4.4/asoc-sgtl5000-avoid-division-by-zero-if-lo_vag-is-ze.patch new file mode 100644 index 00000000000..3c5a1dd8983 --- /dev/null +++ b/queue-4.4/asoc-sgtl5000-avoid-division-by-zero-if-lo_vag-is-ze.patch @@ -0,0 +1,38 @@ +From 9aeede88235c35e26e39052782256d45af333f7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Sep 2018 11:41:52 +0100 +Subject: ASoC: sgtl5000: avoid division by zero if lo_vag is zero + +From: Colin Ian King + +[ Upstream commit 9ab708aef61f5620113269a9d1bdb1543d1207d0 ] + +In the case where lo_vag <= SGTL5000_LINE_OUT_GND_BASE, lo_vag +is set to zero and later vol_quot is computed by dividing by +lo_vag causing a division by zero error. Fix this by avoiding +a zero division and set vol_quot to zero in this specific case +so that the lowest setting for i is correctly set. + +Signed-off-by: Colin Ian King +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/sgtl5000.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c +index 4808b70ec12cb..a3dd7030f629c 100644 +--- a/sound/soc/codecs/sgtl5000.c ++++ b/sound/soc/codecs/sgtl5000.c +@@ -1415,7 +1415,7 @@ static int sgtl5000_set_power_regs(struct snd_soc_codec *codec) + * Searching for a suitable index solving this formula: + * idx = 40 * log10(vag_val / lo_cagcntrl) + 15 + */ +- vol_quot = (vag * 100) / lo_vag; ++ vol_quot = lo_vag ? (vag * 100) / lo_vag : 0; + lo_vol = 0; + for (i = 0; i < ARRAY_SIZE(vol_quot_table); i++) { + if (vol_quot >= vol_quot_table[i]) +-- +2.20.1 + diff --git a/queue-4.4/ath10k-wmi-disable-softirq-s-while-calling-ieee80211.patch b/queue-4.4/ath10k-wmi-disable-softirq-s-while-calling-ieee80211.patch new file mode 100644 index 00000000000..f34b3726c0b --- /dev/null +++ b/queue-4.4/ath10k-wmi-disable-softirq-s-while-calling-ieee80211.patch @@ -0,0 +1,50 @@ +From 3d11007f7f38566175a6ac720ea9baaebcb59989 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Sep 2018 15:07:07 +0300 +Subject: ath10k: wmi: disable softirq's while calling ieee80211_rx + +From: Erik Stromdahl + +[ Upstream commit 37f62c0d5822f631b786b29a1b1069ab714d1a28 ] + +This is done in order not to trig the below warning in +ieee80211_rx_napi: + +WARN_ON_ONCE(softirq_count() == 0); + +ieee80211_rx_napi requires that softirq's are disabled during +execution. + +The High latency bus drivers (SDIO and USB) sometimes call the wmi +ep_rx_complete callback from non softirq context, resulting in a trigger +of the above warning. + +Calling ieee80211_rx_ni with softirq's already disabled (e.g., from +softirq context) should be safe as the local_bh_disable and +local_bh_enable functions (called from ieee80211_rx_ni) are fully +reentrant. + +Signed-off-by: Erik Stromdahl +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index b867875aa6e66..f7ce99f67b5c5 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -2294,7 +2294,8 @@ int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb) + status->freq, status->band, status->signal, + status->rate_idx); + +- ieee80211_rx(ar->hw, skb); ++ ieee80211_rx_ni(ar->hw, skb); ++ + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.4/bluetooth-l2cap-detect-if-remote-is-not-able-to-use-.patch b/queue-4.4/bluetooth-l2cap-detect-if-remote-is-not-able-to-use-.patch new file mode 100644 index 00000000000..aca37454667 --- /dev/null +++ b/queue-4.4/bluetooth-l2cap-detect-if-remote-is-not-able-to-use-.patch @@ -0,0 +1,44 @@ +From 1f26dc901af6c78d486ff3e7a52a636676e7ed45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Sep 2018 13:39:22 +0300 +Subject: Bluetooth: L2CAP: Detect if remote is not able to use the whole MPS + +From: Luiz Augusto von Dentz + +[ Upstream commit a5c3021bb62b970713550db3f7fd08aa70665d7e ] + +If the remote is not able to fully utilize the MPS choosen recalculate +the credits based on the actual amount it is sending that way it can +still send packets of MTU size without credits dropping to 0. + +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/l2cap_core.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index c25f1e4846cde..302c3bacb0247 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -6795,6 +6795,16 @@ static int l2cap_le_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb) + chan->sdu_len = sdu_len; + chan->sdu_last_frag = skb; + ++ /* Detect if remote is not able to use the selected MPS */ ++ if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) { ++ u16 mps_len = skb->len + L2CAP_SDULEN_SIZE; ++ ++ /* Adjust the number of credits */ ++ BT_DBG("chan->mps %u -> %u", chan->mps, mps_len); ++ chan->mps = mps_len; ++ l2cap_chan_le_send_credits(chan); ++ } ++ + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.4/bnx2x-ignore-bandwidth-attention-in-single-function-.patch b/queue-4.4/bnx2x-ignore-bandwidth-attention-in-single-function-.patch new file mode 100644 index 00000000000..12e47b4101e --- /dev/null +++ b/queue-4.4/bnx2x-ignore-bandwidth-attention-in-single-function-.patch @@ -0,0 +1,47 @@ +From 8df11694eb867aa0d4eff1a1f90146db59bb7119 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Sep 2018 11:22:51 -0700 +Subject: bnx2x: Ignore bandwidth attention in single function mode + +From: Shahed Shaikh + +[ Upstream commit 75a110a1783ef8324ffd763b24f4ac268253cbca ] + +This is a workaround for FW bug - +MFW generates bandwidth attention in single function mode, which +is only expected to be generated in multi function mode. +This undesired attention in SF mode results in incorrect HW +configuration and resulting into Tx timeout. + +Signed-off-by: Shahed Shaikh +Signed-off-by: Ariel Elior +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +index d450d8b3708cd..82960603da332 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -3532,6 +3532,16 @@ static void bnx2x_drv_info_iscsi_stat(struct bnx2x *bp) + */ + static void bnx2x_config_mf_bw(struct bnx2x *bp) + { ++ /* Workaround for MFW bug. ++ * MFW is not supposed to generate BW attention in ++ * single function mode. ++ */ ++ if (!IS_MF(bp)) { ++ DP(BNX2X_MSG_MCP, ++ "Ignoring MF BW config in single function mode\n"); ++ return; ++ } ++ + if (bp->link_vars.link_up) { + bnx2x_cmng_fns_init(bp, true, CMNG_FNS_MINMAX); + bnx2x_link_sync_notify(bp); +-- +2.20.1 + diff --git a/queue-4.4/cpufeature-avoid-warning-when-compiling-with-clang.patch b/queue-4.4/cpufeature-avoid-warning-when-compiling-with-clang.patch new file mode 100644 index 00000000000..a7df757ebd5 --- /dev/null +++ b/queue-4.4/cpufeature-avoid-warning-when-compiling-with-clang.patch @@ -0,0 +1,46 @@ +From 752a9d3be4915e07ba8b634e0225c6e98fdbcc01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Sep 2018 21:38:24 -0700 +Subject: cpufeature: avoid warning when compiling with clang + +From: Stefan Agner + +[ Upstream commit c785896b21dd8e156326ff660050b0074d3431df ] + +The table id (second) argument to MODULE_DEVICE_TABLE is often +referenced otherwise. This is not the case for CPU features. This +leads to warnings when building the kernel with Clang: + arch/arm/crypto/aes-ce-glue.c:450:1: warning: variable + 'cpu_feature_match_AES' is not needed and will not be emitted + [-Wunneeded-internal-declaration] + module_cpu_feature_match(AES, aes_init); + ^ + +Avoid warnings by using __maybe_unused, similar to commit 1f318a8bafcf +("modules: mark __inittest/__exittest as __maybe_unused"). + +Fixes: 67bad2fdb754 ("cpu: add generic support for CPU feature based module autoloading") +Signed-off-by: Stefan Agner +Acked-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + include/linux/cpufeature.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/cpufeature.h b/include/linux/cpufeature.h +index 986c06c88d814..84d3c81b59781 100644 +--- a/include/linux/cpufeature.h ++++ b/include/linux/cpufeature.h +@@ -45,7 +45,7 @@ + * 'asm/cpufeature.h' of your favorite architecture. + */ + #define module_cpu_feature_match(x, __initfunc) \ +-static struct cpu_feature const cpu_feature_match_ ## x[] = \ ++static struct cpu_feature const __maybe_unused cpu_feature_match_ ## x[] = \ + { { .feature = cpu_feature(x) }, { } }; \ + MODULE_DEVICE_TABLE(cpu, cpu_feature_match_ ## x); \ + \ +-- +2.20.1 + diff --git a/queue-4.4/cxgb4-fix-endianness-issue-in-t4_fwcache.patch b/queue-4.4/cxgb4-fix-endianness-issue-in-t4_fwcache.patch new file mode 100644 index 00000000000..ca4c557aa65 --- /dev/null +++ b/queue-4.4/cxgb4-fix-endianness-issue-in-t4_fwcache.patch @@ -0,0 +1,35 @@ +From bde5a210b147eaf001daba6423b948779e2c9bd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Sep 2018 14:36:27 +0530 +Subject: cxgb4: Fix endianness issue in t4_fwcache() + +From: Ganesh Goudar + +[ Upstream commit 0dc235afc59a226d951352b0adf4a89b532a9d13 ] + +Do not put host-endian 0 or 1 into big endian feild. + +Reported-by: Al Viro +Signed-off-by: Ganesh Goudar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +index de23f23b41de6..832ad1bd1f29b 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +@@ -3482,7 +3482,7 @@ int t4_fwcache(struct adapter *adap, enum fw_params_param_dev_fwcache op) + c.param[0].mnem = + cpu_to_be32(FW_PARAMS_MNEM_V(FW_PARAMS_MNEM_DEV) | + FW_PARAMS_PARAM_X_V(FW_PARAMS_PARAM_DEV_FWCACHE)); +- c.param[0].val = (__force __be32)op; ++ c.param[0].val = cpu_to_be32(op); + + return t4_wr_mbox(adap, adap->mbox, &c, sizeof(c), NULL); + } +-- +2.20.1 + diff --git a/queue-4.4/dmaengine-dma-jz4780-further-residue-status-fix.patch b/queue-4.4/dmaengine-dma-jz4780-further-residue-status-fix.patch new file mode 100644 index 00000000000..e7c8038a280 --- /dev/null +++ b/queue-4.4/dmaengine-dma-jz4780-further-residue-status-fix.patch @@ -0,0 +1,46 @@ +From 1da6285d52fda2b74930a1cc60efc53caed0c50f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Aug 2018 23:32:56 +0200 +Subject: dmaengine: dma-jz4780: Further residue status fix + +From: Daniel Silsby + +[ Upstream commit 83ef4fb7556b6a673f755da670cbacab7e2c7f1b ] + +Func jz4780_dma_desc_residue() expects the index to the next hw +descriptor as its last parameter. Caller func jz4780_dma_tx_status(), +however, applied modulus before passing it. When the current hw +descriptor was last in the list, the index passed became zero. + +The resulting excess of reported residue especially caused problems +with cyclic DMA transfer clients, i.e. ALSA AIC audio output, which +rely on this for determining current DMA location within buffer. + +Combined with the recent and related residue-reporting fixes, spurious +ALSA audio underruns on jz4770 hardware are now fixed. + +Signed-off-by: Daniel Silsby +Signed-off-by: Paul Cercueil +Tested-by: Mathieu Malaterre +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dma-jz4780.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c +index 8344b7c91fe35..1d01e3805f9c2 100644 +--- a/drivers/dma/dma-jz4780.c ++++ b/drivers/dma/dma-jz4780.c +@@ -576,7 +576,7 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan, + to_jz4780_dma_desc(vdesc), 0); + } else if (cookie == jzchan->desc->vdesc.tx.cookie) { + txstate->residue = jz4780_dma_desc_residue(jzchan, jzchan->desc, +- (jzchan->curr_hwdesc + 1) % jzchan->desc->count); ++ jzchan->curr_hwdesc + 1); + } else + txstate->residue = 0; + +-- +2.20.1 + diff --git a/queue-4.4/edac-raise-the-maximum-number-of-memory-controllers.patch b/queue-4.4/edac-raise-the-maximum-number-of-memory-controllers.patch new file mode 100644 index 00000000000..0ba238525a4 --- /dev/null +++ b/queue-4.4/edac-raise-the-maximum-number-of-memory-controllers.patch @@ -0,0 +1,63 @@ +From fe07163ff710224b32026fd2b859f816002aa970 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Sep 2018 09:34:49 -0500 +Subject: EDAC: Raise the maximum number of memory controllers + +From: Justin Ernst + +[ Upstream commit 6b58859419554fb824e09cfdd73151a195473cbc ] + +We observe an oops in the skx_edac module during boot: + + EDAC MC0: Giving out device to module skx_edac controller Skylake Socket#0 IMC#0 + EDAC MC1: Giving out device to module skx_edac controller Skylake Socket#0 IMC#1 + EDAC MC2: Giving out device to module skx_edac controller Skylake Socket#1 IMC#0 + ... + EDAC MC13: Giving out device to module skx_edac controller Skylake Socket#0 IMC#1 + EDAC MC14: Giving out device to module skx_edac controller Skylake Socket#1 IMC#0 + EDAC MC15: Giving out device to module skx_edac controller Skylake Socket#1 IMC#1 + Too many memory controllers: 16 + EDAC MC: Removed device 0 for skx_edac Skylake Socket#0 IMC#0 + +We observe there are two memory controllers per socket, with a limit +of 16. Raise the maximum number of memory controllers from 16 to 2 * +MAX_NUMNODES (1024). + +[ bp: This is just a band-aid fix until we've sorted out the whole issue + with the bus_type association and handling in EDAC and can get rid of + this arbitrary limit. ] + +Signed-off-by: Justin Ernst +Signed-off-by: Borislav Petkov +Acked-by: Russ Anderson +Cc: Mauro Carvalho Chehab +Cc: linux-edac@vger.kernel.org +Link: https://lkml.kernel.org/r/20180925143449.284634-1-justin.ernst@hpe.com +Signed-off-by: Sasha Levin +--- + include/linux/edac.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/linux/edac.h b/include/linux/edac.h +index 4fe67b853de04..9bb4f3311e137 100644 +--- a/include/linux/edac.h ++++ b/include/linux/edac.h +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + struct device; + +@@ -778,6 +779,6 @@ struct mem_ctl_info { + /* + * Maximum number of memory controllers in the coherent fabric. + */ +-#define EDAC_MAX_MCS 16 ++#define EDAC_MAX_MCS 2 * MAX_NUMNODES + + #endif +-- +2.20.1 + diff --git a/queue-4.4/fuse-use-read_once-on-congestion_threshold-and-max_b.patch b/queue-4.4/fuse-use-read_once-on-congestion_threshold-and-max_b.patch new file mode 100644 index 00000000000..bc53f126d95 --- /dev/null +++ b/queue-4.4/fuse-use-read_once-on-congestion_threshold-and-max_b.patch @@ -0,0 +1,45 @@ +From fc18f0bd740d91b6d68a58a157fbe572b0f60b60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Aug 2018 18:29:29 +0300 +Subject: fuse: use READ_ONCE on congestion_threshold and max_background + +From: Kirill Tkhai + +[ Upstream commit 2a23f2b8adbe4bd584f936f7ac17a99750eed9d7 ] + +Since they are of unsigned int type, it's allowed to read them +unlocked during reporting to userspace. Let's underline this fact +with READ_ONCE() macroses. + +Signed-off-by: Kirill Tkhai +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/fuse/control.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/fuse/control.c b/fs/fuse/control.c +index 89a4b231e79cb..bb56c6a58fa76 100644 +--- a/fs/fuse/control.c ++++ b/fs/fuse/control.c +@@ -107,7 +107,7 @@ static ssize_t fuse_conn_max_background_read(struct file *file, + if (!fc) + return 0; + +- val = fc->max_background; ++ val = READ_ONCE(fc->max_background); + fuse_conn_put(fc); + + return fuse_conn_limit_read(file, buf, len, ppos, val); +@@ -144,7 +144,7 @@ static ssize_t fuse_conn_congestion_threshold_read(struct file *file, + if (!fc) + return 0; + +- val = fc->congestion_threshold; ++ val = READ_ONCE(fc->congestion_threshold); + fuse_conn_put(fc); + + return fuse_conn_limit_read(file, buf, len, ppos, val); +-- +2.20.1 + diff --git a/queue-4.4/gfs2-don-t-set-gfs2_rdf_uptodate-when-the-lvb-is-upd.patch b/queue-4.4/gfs2-don-t-set-gfs2_rdf_uptodate-when-the-lvb-is-upd.patch new file mode 100644 index 00000000000..08d7b002d15 --- /dev/null +++ b/queue-4.4/gfs2-don-t-set-gfs2_rdf_uptodate-when-the-lvb-is-upd.patch @@ -0,0 +1,62 @@ +From fcb415e39eaa4b3d557f051000b62d397aae4a03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Aug 2018 10:32:13 -0500 +Subject: gfs2: Don't set GFS2_RDF_UPTODATE when the lvb is updated + +From: Bob Peterson + +[ Upstream commit 4f36cb36c9d14340bb200d2ad9117b03ce992cfe ] + +The GFS2_RDF_UPTODATE flag in the rgrp is used to determine when +a rgrp buffer is valid. It's cleared when the glock is invalidated, +signifying that the buffer data is now invalid. But before this +patch, function update_rgrp_lvb was setting the flag when it +determined it had a valid lvb. But that's an invalid assumption: +just because you have a valid lvb doesn't mean you have valid +buffers. After all, another node may have made the lvb valid, +and this node just fetched it from the glock via dlm. + +Consider this scenario: +1. The file system is mounted with RGRPLVB option. +2. In gfs2_inplace_reserve it locks the rgrp glock EX, but thanks + to GL_SKIP, it skips the gfs2_rgrp_bh_get. +3. Since loops == 0 and the allocation target (ap->target) is + bigger than the largest known chunk of blocks in the rgrp + (rs->rs_rbm.rgd->rd_extfail_pt) it skips that rgrp and bypasses + the call to gfs2_rgrp_bh_get there as well. +4. update_rgrp_lvb sees the lvb MAGIC number is valid, so bypasses + gfs2_rgrp_bh_get, but it still sets sets GFS2_RDF_UPTODATE due + to this invalid assumption. +5. The next time update_rgrp_lvb is called, it sees the bit is set + and just returns 0, assuming both the lvb and rgrp are both + uptodate. But since this is a smaller allocation, or space has + been freed by another node, thus adjusting the lvb values, + it decides to use the rgrp for allocations, with invalid rd_free + due to the fact it was never updated. + +This patch changes update_rgrp_lvb so it doesn't set the UPTODATE +flag anymore. That way, it has no choice but to fetch the latest +values. + +Signed-off-by: Bob Peterson +Signed-off-by: Sasha Levin +--- + fs/gfs2/rgrp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index 9c159e6ad1164..e632006a52df6 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -1228,7 +1228,7 @@ static int update_rgrp_lvb(struct gfs2_rgrpd *rgd) + rl_flags = be32_to_cpu(rgd->rd_rgl->rl_flags); + rl_flags &= ~GFS2_RDF_MASK; + rgd->rd_flags &= GFS2_RDF_MASK; +- rgd->rd_flags |= (rl_flags | GFS2_RDF_UPTODATE | GFS2_RDF_CHECK); ++ rgd->rd_flags |= (rl_flags | GFS2_RDF_CHECK); + if (rgd->rd_rgl->rl_unlinked == 0) + rgd->rd_flags &= ~GFS2_RDF_CHECK; + rgd->rd_free = be32_to_cpu(rgd->rd_rgl->rl_free); +-- +2.20.1 + diff --git a/queue-4.4/i40e-hold-the-rtnl-lock-on-clearing-interrupt-scheme.patch b/queue-4.4/i40e-hold-the-rtnl-lock-on-clearing-interrupt-scheme.patch new file mode 100644 index 00000000000..0acfda39b2e --- /dev/null +++ b/queue-4.4/i40e-hold-the-rtnl-lock-on-clearing-interrupt-scheme.patch @@ -0,0 +1,60 @@ +From 230fc545998b6ed59ac0b79734fdb7a0110b3f88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Aug 2018 10:16:03 -0700 +Subject: i40e: hold the rtnl lock on clearing interrupt scheme +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Patryk Małek + +[ Upstream commit 5cba17b14182696d6bb0ec83a1d087933f252241 ] + +Hold the rtnl lock when we're clearing interrupt scheme +in i40e_shutdown and in i40e_remove. + +Signed-off-by: Patryk Małek +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 22c43a776c6cd..756c4ea176554 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -10828,6 +10828,7 @@ static void i40e_remove(struct pci_dev *pdev) + mutex_destroy(&hw->aq.asq_mutex); + + /* Clear all dynamic memory lists of rings, q_vectors, and VSIs */ ++ rtnl_lock(); + i40e_clear_interrupt_scheme(pf); + for (i = 0; i < pf->num_alloc_vsi; i++) { + if (pf->vsi[i]) { +@@ -10836,6 +10837,7 @@ static void i40e_remove(struct pci_dev *pdev) + pf->vsi[i] = NULL; + } + } ++ rtnl_unlock(); + + for (i = 0; i < I40E_MAX_VEB; i++) { + kfree(pf->veb[i]); +@@ -10982,7 +10984,13 @@ static void i40e_shutdown(struct pci_dev *pdev) + wr32(hw, I40E_PFPM_WUFC, + (pf->wol_en ? I40E_PFPM_WUFC_MAG_MASK : 0)); + ++ /* Since we're going to destroy queues during the ++ * i40e_clear_interrupt_scheme() we should hold the RTNL lock for this ++ * whole section ++ */ ++ rtnl_lock(); + i40e_clear_interrupt_scheme(pf); ++ rtnl_unlock(); + + if (system_state == SYSTEM_POWER_OFF) { + pci_wake_from_d3(pdev, pf->wol_en); +-- +2.20.1 + diff --git a/queue-4.4/i40e-prevent-deleting-mac-address-from-vf-when-set-b.patch b/queue-4.4/i40e-prevent-deleting-mac-address-from-vf-when-set-b.patch new file mode 100644 index 00000000000..d3eedf9c7c6 --- /dev/null +++ b/queue-4.4/i40e-prevent-deleting-mac-address-from-vf-when-set-b.patch @@ -0,0 +1,48 @@ +From a10abe3a3fa05775a18d20a68906d3615009f15d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Aug 2018 10:16:09 -0700 +Subject: i40e: Prevent deleting MAC address from VF when set by PF +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Patryk Małek + +[ Upstream commit 5907cf6c5bbe78be2ed18b875b316c6028b20634 ] + +To prevent VF from deleting MAC address that was assigned by the +PF we need to check for that scenario when we try to delete a MAC +address from a VF. + +Signed-off-by: Patryk Małek +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index e116d9a99b8e9..cdb263875efb3 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -1677,6 +1677,16 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg, u16 msglen) + ret = I40E_ERR_INVALID_MAC_ADDR; + goto error_param; + } ++ ++ if (vf->pf_set_mac && ++ ether_addr_equal(al->list[i].addr, ++ vf->default_lan_addr.addr)) { ++ dev_err(&pf->pdev->dev, ++ "MAC addr %pM has been set by PF, cannot delete it for VF %d, reset VF to change MAC addr\n", ++ vf->default_lan_addr.addr, vf->vf_id); ++ ret = I40E_ERR_PARAM; ++ goto error_param; ++ } + } + vsi = pf->vsi[vf->lan_vsi_idx]; + +-- +2.20.1 + diff --git a/queue-4.4/i40e-use-correct-length-for-strncpy.patch b/queue-4.4/i40e-use-correct-length-for-strncpy.patch new file mode 100644 index 00000000000..91d9858aba2 --- /dev/null +++ b/queue-4.4/i40e-use-correct-length-for-strncpy.patch @@ -0,0 +1,38 @@ +From f71bdcb46fe76c4ef9d3ef52752b7cf31029239c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Aug 2018 08:12:30 -0700 +Subject: i40e: use correct length for strncpy + +From: Mitch Williams + +[ Upstream commit 7eb74ff891b4e94b8bac48f648a21e4b94ddee64 ] + +Caught by GCC 8. When we provide a length for strncpy, we should not +include the terminating null. So we must tell it one less than the size +of the destination buffer. + +Signed-off-by: Mitch Williams +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_ptp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ptp.c b/drivers/net/ethernet/intel/i40e/i40e_ptp.c +index 565ca7c835bc3..e22ebe460b131 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c +@@ -605,7 +605,8 @@ static long i40e_ptp_create_clock(struct i40e_pf *pf) + if (!IS_ERR_OR_NULL(pf->ptp_clock)) + return 0; + +- strncpy(pf->ptp_caps.name, i40e_driver_name, sizeof(pf->ptp_caps.name)); ++ strncpy(pf->ptp_caps.name, i40e_driver_name, ++ sizeof(pf->ptp_caps.name) - 1); + pf->ptp_caps.owner = THIS_MODULE; + pf->ptp_caps.max_adj = 999999999; + pf->ptp_caps.n_ext_ts = 0; +-- +2.20.1 + diff --git a/queue-4.4/iio-dac-mcp4922-fix-error-handling-in-mcp4922_write_.patch b/queue-4.4/iio-dac-mcp4922-fix-error-handling-in-mcp4922_write_.patch new file mode 100644 index 00000000000..9ab5ab65cbb --- /dev/null +++ b/queue-4.4/iio-dac-mcp4922-fix-error-handling-in-mcp4922_write_.patch @@ -0,0 +1,51 @@ +From 3524d7a86c060e4fb2ec8a0c059b943f060f796a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Aug 2018 22:24:40 +0200 +Subject: iio: dac: mcp4922: fix error handling in mcp4922_write_raw + +From: Marcus Folkesson + +[ Upstream commit 0833627fc3f757a0dca11e2a9c46c96335a900ee ] + +Do not try to write negative values and make sure that the write goes well. + +Signed-off-by: Marcus Folkesson +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/dac/mcp4922.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/iio/dac/mcp4922.c b/drivers/iio/dac/mcp4922.c +index 3854d201a5d6c..68dd0be1ac076 100644 +--- a/drivers/iio/dac/mcp4922.c ++++ b/drivers/iio/dac/mcp4922.c +@@ -94,17 +94,22 @@ static int mcp4922_write_raw(struct iio_dev *indio_dev, + long mask) + { + struct mcp4922_state *state = iio_priv(indio_dev); ++ int ret; + + if (val2 != 0) + return -EINVAL; + + switch (mask) { + case IIO_CHAN_INFO_RAW: +- if (val > GENMASK(chan->scan_type.realbits-1, 0)) ++ if (val < 0 || val > GENMASK(chan->scan_type.realbits - 1, 0)) + return -EINVAL; + val <<= chan->scan_type.shift; +- state->value[chan->channel] = val; +- return mcp4922_spi_write(state, chan->channel, val); ++ ++ ret = mcp4922_spi_write(state, chan->channel, val); ++ if (!ret) ++ state->value[chan->channel] = val; ++ return ret; ++ + default: + return -EINVAL; + } +-- +2.20.1 + diff --git a/queue-4.4/kernfs-fix-range-checks-in-kernfs_get_target_path.patch b/queue-4.4/kernfs-fix-range-checks-in-kernfs_get_target_path.patch new file mode 100644 index 00000000000..b6075dbc321 --- /dev/null +++ b/queue-4.4/kernfs-fix-range-checks-in-kernfs_get_target_path.patch @@ -0,0 +1,50 @@ +From 4cd69223246607663bc91f0c7a313f7618cfa0a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Jul 2018 17:52:47 +0000 +Subject: kernfs: Fix range checks in kernfs_get_target_path + +From: Bernd Edlinger + +[ Upstream commit a75e78f21f9ad4b810868c89dbbabcc3931591ca ] + +The terminating NUL byte is only there because the buffer is +allocated with kzalloc(PAGE_SIZE, GFP_KERNEL), but since the +range-check is off-by-one, and PAGE_SIZE==PATH_MAX, the +returned string may not be zero-terminated if it is exactly +PATH_MAX characters long. Furthermore also the initial loop +may theoretically exceed PATH_MAX and cause a fault. + +Signed-off-by: Bernd Edlinger +Acked-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + fs/kernfs/symlink.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/kernfs/symlink.c b/fs/kernfs/symlink.c +index b3b293e2c0990..0a379a86ff768 100644 +--- a/fs/kernfs/symlink.c ++++ b/fs/kernfs/symlink.c +@@ -63,6 +63,9 @@ static int kernfs_get_target_path(struct kernfs_node *parent, + if (base == kn) + break; + ++ if ((s - path) + 3 >= PATH_MAX) ++ return -ENAMETOOLONG; ++ + strcpy(s, "../"); + s += 3; + base = base->parent; +@@ -79,7 +82,7 @@ static int kernfs_get_target_path(struct kernfs_node *parent, + if (len < 2) + return -EINVAL; + len--; +- if ((s - path) + len > PATH_MAX) ++ if ((s - path) + len >= PATH_MAX) + return -ENAMETOOLONG; + + /* reverse fillup of target string from target to base */ +-- +2.20.1 + diff --git a/queue-4.4/kprobes-don-t-call-bug_on-if-there-is-a-kprobe-in-us.patch b/queue-4.4/kprobes-don-t-call-bug_on-if-there-is-a-kprobe-in-us.patch new file mode 100644 index 00000000000..f1c6a44dd7f --- /dev/null +++ b/queue-4.4/kprobes-don-t-call-bug_on-if-there-is-a-kprobe-in-us.patch @@ -0,0 +1,50 @@ +From 9a4272322cac2d1c54955a70111f24f07340070d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Sep 2018 19:21:09 +0900 +Subject: kprobes: Don't call BUG_ON() if there is a kprobe in use on free list + +From: Masami Hiramatsu + +[ Upstream commit cbdd96f5586151e48317d90a403941ec23f12660 ] + +Instead of calling BUG_ON(), if we find a kprobe in use on free kprobe +list, just remove it from the list and keep it on kprobe hash list +as same as other in-use kprobes. + +Signed-off-by: Masami Hiramatsu +Cc: Anil S Keshavamurthy +Cc: David S . Miller +Cc: Linus Torvalds +Cc: Naveen N . Rao +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: http://lkml.kernel.org/r/153666126882.21306.10738207224288507996.stgit@devbox +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/kprobes.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index fdde50d39a46d..f59f49bc2a5d5 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -514,8 +514,14 @@ static void do_free_cleaned_kprobes(void) + struct optimized_kprobe *op, *tmp; + + list_for_each_entry_safe(op, tmp, &freeing_list, list) { +- BUG_ON(!kprobe_unused(&op->kp)); + list_del_init(&op->list); ++ if (WARN_ON_ONCE(!kprobe_unused(&op->kp))) { ++ /* ++ * This must not happen, but if there is a kprobe ++ * still in use, keep it on kprobes hash list. ++ */ ++ continue; ++ } + free_aggr_kprobe(&op->kp); + } + } +-- +2.20.1 + diff --git a/queue-4.4/libfdt-ensure-int_max-is-defined-in-libfdt_env.h.patch b/queue-4.4/libfdt-ensure-int_max-is-defined-in-libfdt_env.h.patch new file mode 100644 index 00000000000..a3f2488bf5a --- /dev/null +++ b/queue-4.4/libfdt-ensure-int_max-is-defined-in-libfdt_env.h.patch @@ -0,0 +1,68 @@ +From ed27ce80397c6a3d1c5406ba5bf959a1220243d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Sep 2018 15:16:22 -0500 +Subject: libfdt: Ensure INT_MAX is defined in libfdt_env.h + +From: Rob Herring + +[ Upstream commit 53dd9dce6979bc54d64a3a09a2fb20187a025be7 ] + +The next update of libfdt has a new dependency on INT_MAX. Update the +instances of libfdt_env.h in the kernel to either include the necessary +header with the definition or define it locally. + +Cc: Russell King +Cc: Benjamin Herrenschmidt +Cc: Paul Mackerras +Cc: Michael Ellerman +Cc: linux-arm-kernel@lists.infradead.org +Cc: linuxppc-dev@lists.ozlabs.org +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + arch/arm/boot/compressed/libfdt_env.h | 2 ++ + arch/powerpc/boot/libfdt_env.h | 2 ++ + include/linux/libfdt_env.h | 1 + + 3 files changed, 5 insertions(+) + +diff --git a/arch/arm/boot/compressed/libfdt_env.h b/arch/arm/boot/compressed/libfdt_env.h +index 17ae0f3efac8e..005bf4ff1b4cb 100644 +--- a/arch/arm/boot/compressed/libfdt_env.h ++++ b/arch/arm/boot/compressed/libfdt_env.h +@@ -5,6 +5,8 @@ + #include + #include + ++#define INT_MAX ((int)(~0U>>1)) ++ + typedef __be16 fdt16_t; + typedef __be32 fdt32_t; + typedef __be64 fdt64_t; +diff --git a/arch/powerpc/boot/libfdt_env.h b/arch/powerpc/boot/libfdt_env.h +index 7e3789ea396b8..0b3db6322c793 100644 +--- a/arch/powerpc/boot/libfdt_env.h ++++ b/arch/powerpc/boot/libfdt_env.h +@@ -4,6 +4,8 @@ + #include + #include + ++#define INT_MAX ((int)(~0U>>1)) ++ + #include "of.h" + + typedef u32 uint32_t; +diff --git a/include/linux/libfdt_env.h b/include/linux/libfdt_env.h +index 2a663c6bb4285..8850e243c9406 100644 +--- a/include/linux/libfdt_env.h ++++ b/include/linux/libfdt_env.h +@@ -1,6 +1,7 @@ + #ifndef _LIBFDT_ENV_H + #define _LIBFDT_ENV_H + ++#include /* For INT_MAX */ + #include + + #include +-- +2.20.1 + diff --git a/queue-4.4/llc-avoid-blocking-in-llc_sap_close.patch b/queue-4.4/llc-avoid-blocking-in-llc_sap_close.patch new file mode 100644 index 00000000000..6a1f0cff1cd --- /dev/null +++ b/queue-4.4/llc-avoid-blocking-in-llc_sap_close.patch @@ -0,0 +1,54 @@ +From a032bdf250bea5ebcb51ffc9dee8e2cee64ddb5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Sep 2018 11:42:06 -0700 +Subject: llc: avoid blocking in llc_sap_close() + +From: Cong Wang + +[ Upstream commit 9708d2b5b7c648e8e0a40d11e8cea12f6277f33c ] + +llc_sap_close() is called by llc_sap_put() which +could be called in BH context in llc_rcv(). We can't +block in BH. + +There is no reason to block it here, kfree_rcu() should +be sufficient. + +Signed-off-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/llc.h | 1 + + net/llc/llc_core.c | 4 +--- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/include/net/llc.h b/include/net/llc.h +index 82d989995d18a..95e5ced4c1339 100644 +--- a/include/net/llc.h ++++ b/include/net/llc.h +@@ -66,6 +66,7 @@ struct llc_sap { + int sk_count; + struct hlist_nulls_head sk_laddr_hash[LLC_SK_LADDR_HASH_ENTRIES]; + struct hlist_head sk_dev_hash[LLC_SK_DEV_HASH_ENTRIES]; ++ struct rcu_head rcu; + }; + + static inline +diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c +index e896a2c53b120..f1e442a39db8d 100644 +--- a/net/llc/llc_core.c ++++ b/net/llc/llc_core.c +@@ -127,9 +127,7 @@ void llc_sap_close(struct llc_sap *sap) + list_del_rcu(&sap->node); + spin_unlock_bh(&llc_sap_list_lock); + +- synchronize_rcu(); +- +- kfree(sap); ++ kfree_rcu(sap, rcu); + } + + static struct packet_type llc_packet_type __read_mostly = { +-- +2.20.1 + diff --git a/queue-4.4/media-davinci-fix-implicit-enum-conversion-warning.patch b/queue-4.4/media-davinci-fix-implicit-enum-conversion-warning.patch new file mode 100644 index 00000000000..70dbaf1a4c3 --- /dev/null +++ b/queue-4.4/media-davinci-fix-implicit-enum-conversion-warning.patch @@ -0,0 +1,47 @@ +From 2e6d71f0244ec0cf079c71b8cfc06d542a351b21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Sep 2018 02:16:15 -0400 +Subject: media: davinci: Fix implicit enum conversion warning + +From: Nathan Chancellor + +[ Upstream commit 4158757395b300b6eb308fc20b96d1d231484413 ] + +Clang warns when one enumerated type is implicitly converted to another. + +drivers/media/platform/davinci/vpbe_display.c:524:24: warning: implicit +conversion from enumeration type 'enum osd_v_exp_ratio' to different +enumeration type 'enum osd_h_exp_ratio' [-Wenum-conversion] + layer_info->h_exp = V_EXP_6_OVER_5; + ~ ^~~~~~~~~~~~~~ +1 warning generated. + +This appears to be a copy and paste error judging from the couple of +lines directly above this statement and the way that height is handled +in the if block above this one. + +Reported-by: Nick Desaulniers +Signed-off-by: Nathan Chancellor +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/davinci/vpbe_display.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/davinci/vpbe_display.c b/drivers/media/platform/davinci/vpbe_display.c +index 6d91422c4e4c7..a9cd8c7a7b347 100644 +--- a/drivers/media/platform/davinci/vpbe_display.c ++++ b/drivers/media/platform/davinci/vpbe_display.c +@@ -520,7 +520,7 @@ vpbe_disp_calculate_scale_factor(struct vpbe_display *disp_dev, + else if (v_scale == 4) + layer_info->v_zoom = ZOOM_X4; + if (v_exp) +- layer_info->h_exp = V_EXP_6_OVER_5; ++ layer_info->v_exp = V_EXP_6_OVER_5; + } else { + /* no scaling, only cropping. Set display area to crop area */ + cfg->ysize = expected_ysize; +-- +2.20.1 + diff --git a/queue-4.4/media-fix-media-pci-meye-validate-offset-to-avoid-ar.patch b/queue-4.4/media-fix-media-pci-meye-validate-offset-to-avoid-ar.patch new file mode 100644 index 00000000000..8eadd4f2625 --- /dev/null +++ b/queue-4.4/media-fix-media-pci-meye-validate-offset-to-avoid-ar.patch @@ -0,0 +1,38 @@ +From c7d1999707b0aa207770b2503e3489ea4723bb03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jul 2018 08:15:53 -0400 +Subject: media: fix: media: pci: meye: validate offset to avoid arbitrary + access + +From: Lao Wei + +[ Upstream commit eac7230fdb4672c2cb56f6a01a1744f562c01f80 ] + +Motion eye video4linux driver for Sony Vaio PictureBook desn't validate user-controlled parameter +'vma->vm_pgoff', a malicious process might access all of kernel memory from user space by trying +pass different arbitrary address. +Discussion: http://www.openwall.com/lists/oss-security/2018/07/06/1 + +Signed-off-by: Lao Wei +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/meye/meye.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/pci/meye/meye.c b/drivers/media/pci/meye/meye.c +index ba887e8e1b171..a85c5199ccd30 100644 +--- a/drivers/media/pci/meye/meye.c ++++ b/drivers/media/pci/meye/meye.c +@@ -1469,7 +1469,7 @@ static int meye_mmap(struct file *file, struct vm_area_struct *vma) + unsigned long page, pos; + + mutex_lock(&meye.lock); +- if (size > gbuffers * gbufsize) { ++ if (size > gbuffers * gbufsize || offset > gbuffers * gbufsize - size) { + mutex_unlock(&meye.lock); + return -EINVAL; + } +-- +2.20.1 + diff --git a/queue-4.4/media-pci-ivtv-fix-a-sleep-in-atomic-context-bug-in-.patch b/queue-4.4/media-pci-ivtv-fix-a-sleep-in-atomic-context-bug-in-.patch new file mode 100644 index 00000000000..2ccc663a074 --- /dev/null +++ b/queue-4.4/media-pci-ivtv-fix-a-sleep-in-atomic-context-bug-in-.patch @@ -0,0 +1,54 @@ +From a0c2bff069e2bda90585044fb557a6598e041418 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Sep 2018 07:44:09 -0400 +Subject: media: pci: ivtv: Fix a sleep-in-atomic-context bug in + ivtv_yuv_init() + +From: Jia-Ju Bai + +[ Upstream commit 8d11eb847de7d89c2754988c944d51a4f63e219b ] + +The driver may sleep in a interrupt handler. + +The function call paths (from bottom to top) in Linux-4.16 are: + +[FUNC] kzalloc(GFP_KERNEL) +drivers/media/pci/ivtv/ivtv-yuv.c, 938: + kzalloc in ivtv_yuv_init +drivers/media/pci/ivtv/ivtv-yuv.c, 960: + ivtv_yuv_init in ivtv_yuv_next_free +drivers/media/pci/ivtv/ivtv-yuv.c, 1126: + ivtv_yuv_next_free in ivtv_yuv_setup_stream_frame +drivers/media/pci/ivtv/ivtv-irq.c, 827: + ivtv_yuv_setup_stream_frame in ivtv_irq_dec_data_req +drivers/media/pci/ivtv/ivtv-irq.c, 1013: + ivtv_irq_dec_data_req in ivtv_irq_handler + +To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC. + +This bug is found by my static analysis tool DSAC. + +Signed-off-by: Jia-Ju Bai +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/ivtv/ivtv-yuv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/pci/ivtv/ivtv-yuv.c b/drivers/media/pci/ivtv/ivtv-yuv.c +index 9cd995f418e0f..1d67407ffbf62 100644 +--- a/drivers/media/pci/ivtv/ivtv-yuv.c ++++ b/drivers/media/pci/ivtv/ivtv-yuv.c +@@ -936,7 +936,7 @@ static void ivtv_yuv_init(struct ivtv *itv) + } + + /* We need a buffer for blanking when Y plane is offset - non-fatal if we can't get one */ +- yi->blanking_ptr = kzalloc(720 * 16, GFP_KERNEL|__GFP_NOWARN); ++ yi->blanking_ptr = kzalloc(720 * 16, GFP_ATOMIC|__GFP_NOWARN); + if (yi->blanking_ptr) { + yi->blanking_dmaptr = pci_map_single(itv->pdev, yi->blanking_ptr, 720*16, PCI_DMA_TODEVICE); + } else { +-- +2.20.1 + diff --git a/queue-4.4/mips-bcm47xx-enable-usb-power-on-netgear-wndr3400v3.patch b/queue-4.4/mips-bcm47xx-enable-usb-power-on-netgear-wndr3400v3.patch new file mode 100644 index 00000000000..63b383a5fe1 --- /dev/null +++ b/queue-4.4/mips-bcm47xx-enable-usb-power-on-netgear-wndr3400v3.patch @@ -0,0 +1,58 @@ +From c08e1c3b41632b9fce02993a8a8cb5a905bb8d7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Aug 2018 22:20:23 +0300 +Subject: MIPS: BCM47XX: Enable USB power on Netgear WNDR3400v3 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tuomas Tynkkynen + +[ Upstream commit feef7918667b84f9d5653c501542dd8d84ae32af ] + +Setting GPIO 21 high seems to be required to enable power to USB ports +on the WNDR3400v3. As there is already similar code for WNR3500L, +make the existing USB power GPIO code generic and use that. + +Signed-off-by: Tuomas Tynkkynen +Acked-by: Hauke Mehrtens +Signed-off-by: Paul Burton +Patchwork: https://patchwork.linux-mips.org/patch/20259/ +Cc: Rafał Miłecki +Cc: linux-mips@linux-mips.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/mips/bcm47xx/workarounds.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/arch/mips/bcm47xx/workarounds.c b/arch/mips/bcm47xx/workarounds.c +index e81ce4623070e..06fb94370c7c9 100644 +--- a/arch/mips/bcm47xx/workarounds.c ++++ b/arch/mips/bcm47xx/workarounds.c +@@ -4,9 +4,8 @@ + #include + #include + +-static void __init bcm47xx_workarounds_netgear_wnr3500l(void) ++static void __init bcm47xx_workarounds_enable_usb_power(int usb_power) + { +- const int usb_power = 12; + int err; + + err = gpio_request_one(usb_power, GPIOF_OUT_INIT_HIGH, "usb_power"); +@@ -22,7 +21,10 @@ void __init bcm47xx_workarounds(void) + + switch (board) { + case BCM47XX_BOARD_NETGEAR_WNR3500L: +- bcm47xx_workarounds_netgear_wnr3500l(); ++ bcm47xx_workarounds_enable_usb_power(12); ++ break; ++ case BCM47XX_BOARD_NETGEAR_WNDR3400_V3: ++ bcm47xx_workarounds_enable_usb_power(21); + break; + default: + /* No workaround(s) needed */ +-- +2.20.1 + diff --git a/queue-4.4/mips-kexec-relax-memory-restriction.patch b/queue-4.4/mips-kexec-relax-memory-restriction.patch new file mode 100644 index 00000000000..c4ee6bd1396 --- /dev/null +++ b/queue-4.4/mips-kexec-relax-memory-restriction.patch @@ -0,0 +1,50 @@ +From d84847ce5160a76172eb4e83c46a268a35668c7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Sep 2018 14:49:23 -0700 +Subject: MIPS: kexec: Relax memory restriction + +From: Dengcheng Zhu + +[ Upstream commit a6da4d6fdf8bd512c98d3ac7f1d16bc4bb282919 ] + +We can rely on the system kernel and the dump capture kernel themselves in +memory usage. + +Being restrictive with 512MB limit may cause kexec tool failure on some +platforms. + +Tested-by: Rachel Mozes +Reported-by: Rachel Mozes +Signed-off-by: Dengcheng Zhu +Signed-off-by: Paul Burton +Patchwork: https://patchwork.linux-mips.org/patch/20568/ +Cc: pburton@wavecomp.com +Cc: ralf@linux-mips.org +Cc: linux-mips@linux-mips.org +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/kexec.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/mips/include/asm/kexec.h b/arch/mips/include/asm/kexec.h +index ee25ebbf2a288..b6a4d4aa548f5 100644 +--- a/arch/mips/include/asm/kexec.h ++++ b/arch/mips/include/asm/kexec.h +@@ -12,11 +12,11 @@ + #include + + /* Maximum physical address we can use pages from */ +-#define KEXEC_SOURCE_MEMORY_LIMIT (0x20000000) ++#define KEXEC_SOURCE_MEMORY_LIMIT (-1UL) + /* Maximum address we can reach in physical address mode */ +-#define KEXEC_DESTINATION_MEMORY_LIMIT (0x20000000) ++#define KEXEC_DESTINATION_MEMORY_LIMIT (-1UL) + /* Maximum address we can use for the control code buffer */ +-#define KEXEC_CONTROL_MEMORY_LIMIT (0x20000000) ++#define KEXEC_CONTROL_MEMORY_LIMIT (-1UL) + /* Reserve 3*4096 bytes for board-specific info */ + #define KEXEC_CONTROL_PAGE_SIZE (4096 + 3*4096) + +-- +2.20.1 + diff --git a/queue-4.4/mips-txx9-fix-iounmap-related-issue.patch b/queue-4.4/mips-txx9-fix-iounmap-related-issue.patch new file mode 100644 index 00000000000..010154a230e --- /dev/null +++ b/queue-4.4/mips-txx9-fix-iounmap-related-issue.patch @@ -0,0 +1,47 @@ +From 361a7654f4d03ed3c47c81a821ebec2395c5c04c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Sep 2018 12:19:19 +0800 +Subject: mips: txx9: fix iounmap related issue + +From: Ding Xiang + +[ Upstream commit c6e1241a82e6e74d1ae5cc34581dab2ffd6022d0 ] + +if device_register return error, iounmap should be called, also iounmap +need to call before put_device. + +Signed-off-by: Ding Xiang +Reviewed-by: Atsushi Nemoto +Signed-off-by: Paul Burton +Patchwork: https://patchwork.linux-mips.org/patch/20476/ +Cc: ralf@linux-mips.org +Cc: jhogan@kernel.org +Cc: linux-mips@linux-mips.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/mips/txx9/generic/setup.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/mips/txx9/generic/setup.c b/arch/mips/txx9/generic/setup.c +index 9d9962ab7d25c..7dc97e944d5aa 100644 +--- a/arch/mips/txx9/generic/setup.c ++++ b/arch/mips/txx9/generic/setup.c +@@ -961,12 +961,11 @@ void __init txx9_sramc_init(struct resource *r) + goto exit_put; + err = sysfs_create_bin_file(&dev->dev.kobj, &dev->bindata_attr); + if (err) { +- device_unregister(&dev->dev); + iounmap(dev->base); +- kfree(dev); ++ device_unregister(&dev->dev); + } + return; + exit_put: ++ iounmap(dev->base); + put_device(&dev->dev); +- return; + } +-- +2.20.1 + diff --git a/queue-4.4/misc-genwqe-should-return-proper-error-value.patch b/queue-4.4/misc-genwqe-should-return-proper-error-value.patch new file mode 100644 index 00000000000..ec4f43d5d65 --- /dev/null +++ b/queue-4.4/misc-genwqe-should-return-proper-error-value.patch @@ -0,0 +1,82 @@ +From 69df336bdb01feaea77d35e2a203c1db409d248c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Sep 2018 10:29:13 +0800 +Subject: misc: genwqe: should return proper error value. + +From: zhong jiang + +[ Upstream commit 02241995b004faa7d9ff628e97f24056190853f8 ] + +The function should return -EFAULT when copy_from_user fails. Even +though the caller does not distinguish them. but we should keep backward +compatibility. + +Signed-off-by: zhong jiang +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/genwqe/card_utils.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c +index d4c719683a8a8..d8961f35a9ec3 100644 +--- a/drivers/misc/genwqe/card_utils.c ++++ b/drivers/misc/genwqe/card_utils.c +@@ -298,7 +298,7 @@ static int genwqe_sgl_size(int num_pages) + int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, + void __user *user_addr, size_t user_size) + { +- int rc; ++ int ret = -ENOMEM; + struct pci_dev *pci_dev = cd->pci_dev; + + sgl->fpage_offs = offset_in_page((unsigned long)user_addr); +@@ -317,7 +317,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, + if (get_order(sgl->sgl_size) > MAX_ORDER) { + dev_err(&pci_dev->dev, + "[%s] err: too much memory requested!\n", __func__); +- return -ENOMEM; ++ return ret; + } + + sgl->sgl = __genwqe_alloc_consistent(cd, sgl->sgl_size, +@@ -325,7 +325,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, + if (sgl->sgl == NULL) { + dev_err(&pci_dev->dev, + "[%s] err: no memory available!\n", __func__); +- return -ENOMEM; ++ return ret; + } + + /* Only use buffering on incomplete pages */ +@@ -338,7 +338,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, + /* Sync with user memory */ + if (copy_from_user(sgl->fpage + sgl->fpage_offs, + user_addr, sgl->fpage_size)) { +- rc = -EFAULT; ++ ret = -EFAULT; + goto err_out; + } + } +@@ -351,7 +351,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, + /* Sync with user memory */ + if (copy_from_user(sgl->lpage, user_addr + user_size - + sgl->lpage_size, sgl->lpage_size)) { +- rc = -EFAULT; ++ ret = -EFAULT; + goto err_out2; + } + } +@@ -373,7 +373,8 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, + sgl->sgl = NULL; + sgl->sgl_dma_addr = 0; + sgl->sgl_size = 0; +- return -ENOMEM; ++ ++ return ret; + } + + int genwqe_setup_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl, +-- +2.20.1 + diff --git a/queue-4.4/misc-kgdbts-fix-restrict-error.patch b/queue-4.4/misc-kgdbts-fix-restrict-error.patch new file mode 100644 index 00000000000..791ee5fcb27 --- /dev/null +++ b/queue-4.4/misc-kgdbts-fix-restrict-error.patch @@ -0,0 +1,75 @@ +From e4d4d37ac84041937a1ab2df5b90902e64b6cffd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Sep 2018 10:44:03 -0700 +Subject: misc: kgdbts: Fix restrict error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Laura Abbott + +[ Upstream commit fa0218ef733e6f247a1a3986e3eb12460064ac77 ] + +kgdbts current fails when compiled with restrict: + +drivers/misc/kgdbts.c: In function ‘configure_kgdbts’: +drivers/misc/kgdbts.c:1070:2: error: ‘strcpy’ source argument is the same as destination [-Werror=restrict] + strcpy(config, opt); + ^~~~~~~~~~~~~~~~~~~ + +As the error says, config is being used in both the source and destination. +Refactor the code to avoid the extra copy and put the parsing closer to +the actual location. + +Signed-off-by: Laura Abbott +Acked-by: Daniel Thompson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/kgdbts.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c +index bb3a76ad80da2..fc8cb855c6e66 100644 +--- a/drivers/misc/kgdbts.c ++++ b/drivers/misc/kgdbts.c +@@ -979,6 +979,12 @@ static void kgdbts_run_tests(void) + int nmi_sleep = 0; + int i; + ++ verbose = 0; ++ if (strstr(config, "V1")) ++ verbose = 1; ++ if (strstr(config, "V2")) ++ verbose = 2; ++ + ptr = strchr(config, 'F'); + if (ptr) + fork_test = simple_strtol(ptr + 1, NULL, 10); +@@ -1062,13 +1068,6 @@ static int kgdbts_option_setup(char *opt) + return -ENOSPC; + } + strcpy(config, opt); +- +- verbose = 0; +- if (strstr(config, "V1")) +- verbose = 1; +- if (strstr(config, "V2")) +- verbose = 2; +- + return 0; + } + +@@ -1080,9 +1079,6 @@ static int configure_kgdbts(void) + + if (!strlen(config) || isspace(config[0])) + goto noconfig; +- err = kgdbts_option_setup(config); +- if (err) +- goto noconfig; + + final_ack = 0; + run_plant_and_detach_test(1); +-- +2.20.1 + diff --git a/queue-4.4/net-amd-fix-return-type-of-ndo_start_xmit-function.patch b/queue-4.4/net-amd-fix-return-type-of-ndo_start_xmit-function.patch new file mode 100644 index 00000000000..3cd771afae2 --- /dev/null +++ b/queue-4.4/net-amd-fix-return-type-of-ndo_start_xmit-function.patch @@ -0,0 +1,140 @@ +From 6ecfffc1d03d7f67424c199cd10f1363e7614d4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Sep 2018 18:50:17 +0800 +Subject: net: amd: fix return type of ndo_start_xmit function + +From: YueHaibing + +[ Upstream commit fe72352e37ae8478f4c97975a9831f0c50f22e73 ] + +The method ndo_start_xmit() is defined as returning an 'netdev_tx_t', +which is a typedef for an enum type, so make sure the implementation in +this driver has returns 'netdev_tx_t' value, and change the function +return type to netdev_tx_t. + +Found by coccinelle. + +Signed-off-by: YueHaibing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/am79c961a.c | 2 +- + drivers/net/ethernet/amd/atarilance.c | 6 ++++-- + drivers/net/ethernet/amd/declance.c | 2 +- + drivers/net/ethernet/amd/sun3lance.c | 6 ++++-- + drivers/net/ethernet/amd/sunlance.c | 2 +- + drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 4 ++-- + 6 files changed, 13 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/amd/am79c961a.c b/drivers/net/ethernet/amd/am79c961a.c +index 87e727b921dc0..1ad401fed4698 100644 +--- a/drivers/net/ethernet/amd/am79c961a.c ++++ b/drivers/net/ethernet/amd/am79c961a.c +@@ -440,7 +440,7 @@ static void am79c961_timeout(struct net_device *dev) + /* + * Transmit a packet + */ +-static int ++static netdev_tx_t + am79c961_sendpacket(struct sk_buff *skb, struct net_device *dev) + { + struct dev_priv *priv = netdev_priv(dev); +diff --git a/drivers/net/ethernet/amd/atarilance.c b/drivers/net/ethernet/amd/atarilance.c +index b10964e8cb546..a1dc65136d9fa 100644 +--- a/drivers/net/ethernet/amd/atarilance.c ++++ b/drivers/net/ethernet/amd/atarilance.c +@@ -339,7 +339,8 @@ static unsigned long lance_probe1( struct net_device *dev, struct lance_addr + *init_rec ); + static int lance_open( struct net_device *dev ); + static void lance_init_ring( struct net_device *dev ); +-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev ); ++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, ++ struct net_device *dev); + static irqreturn_t lance_interrupt( int irq, void *dev_id ); + static int lance_rx( struct net_device *dev ); + static int lance_close( struct net_device *dev ); +@@ -770,7 +771,8 @@ static void lance_tx_timeout (struct net_device *dev) + + /* XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX */ + +-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev ) ++static netdev_tx_t ++lance_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct lance_private *lp = netdev_priv(dev); + struct lance_ioreg *IO = lp->iobase; +diff --git a/drivers/net/ethernet/amd/declance.c b/drivers/net/ethernet/amd/declance.c +index b584b78237dfd..5e994f981feae 100644 +--- a/drivers/net/ethernet/amd/declance.c ++++ b/drivers/net/ethernet/amd/declance.c +@@ -893,7 +893,7 @@ static void lance_tx_timeout(struct net_device *dev) + netif_wake_queue(dev); + } + +-static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct lance_private *lp = netdev_priv(dev); + volatile struct lance_regs *ll = lp->ll; +diff --git a/drivers/net/ethernet/amd/sun3lance.c b/drivers/net/ethernet/amd/sun3lance.c +index 3d8c6b2cdea4c..09271665712da 100644 +--- a/drivers/net/ethernet/amd/sun3lance.c ++++ b/drivers/net/ethernet/amd/sun3lance.c +@@ -235,7 +235,8 @@ struct lance_private { + static int lance_probe( struct net_device *dev); + static int lance_open( struct net_device *dev ); + static void lance_init_ring( struct net_device *dev ); +-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev ); ++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, ++ struct net_device *dev); + static irqreturn_t lance_interrupt( int irq, void *dev_id); + static int lance_rx( struct net_device *dev ); + static int lance_close( struct net_device *dev ); +@@ -511,7 +512,8 @@ static void lance_init_ring( struct net_device *dev ) + } + + +-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev ) ++static netdev_tx_t ++lance_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct lance_private *lp = netdev_priv(dev); + int entry, len; +diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c +index 8914170fccfff..babb0a5fb8de4 100644 +--- a/drivers/net/ethernet/amd/sunlance.c ++++ b/drivers/net/ethernet/amd/sunlance.c +@@ -1106,7 +1106,7 @@ static void lance_tx_timeout(struct net_device *dev) + netif_wake_queue(dev); + } + +-static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct lance_private *lp = netdev_priv(dev); + int entry, skblen, len; +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +index 64034ff081a0c..23fc244eb8a4d 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +@@ -1390,7 +1390,7 @@ static int xgbe_close(struct net_device *netdev) + return 0; + } + +-static int xgbe_xmit(struct sk_buff *skb, struct net_device *netdev) ++static netdev_tx_t xgbe_xmit(struct sk_buff *skb, struct net_device *netdev) + { + struct xgbe_prv_data *pdata = netdev_priv(netdev); + struct xgbe_hw_if *hw_if = &pdata->hw_if; +@@ -1399,7 +1399,7 @@ static int xgbe_xmit(struct sk_buff *skb, struct net_device *netdev) + struct xgbe_ring *ring; + struct xgbe_packet_data *packet; + struct netdev_queue *txq; +- int ret; ++ netdev_tx_t ret; + + DBGPR("-->xgbe_xmit: skb->len = %d\n", skb->len); + +-- +2.20.1 + diff --git a/queue-4.4/net-broadcom-fix-return-type-of-ndo_start_xmit-funct.patch b/queue-4.4/net-broadcom-fix-return-type-of-ndo_start_xmit-funct.patch new file mode 100644 index 00000000000..a0cf1fc0d8b --- /dev/null +++ b/queue-4.4/net-broadcom-fix-return-type-of-ndo_start_xmit-funct.patch @@ -0,0 +1,69 @@ +From 456fdc14a250fc8008026ca95d4ad3e30bcb8aa4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Sep 2018 18:45:12 +0800 +Subject: net: broadcom: fix return type of ndo_start_xmit function + +From: YueHaibing + +[ Upstream commit 0c13b8d1aee87c35a2fbc1d85a1f766227cf54b5 ] + +The method ndo_start_xmit() is defined as returning an 'netdev_tx_t', +which is a typedef for an enum type, so make sure the implementation in +this driver has returns 'netdev_tx_t' value, and change the function +return type to netdev_tx_t. + +Found by coccinelle. + +Signed-off-by: YueHaibing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bcm63xx_enet.c | 5 +++-- + drivers/net/ethernet/broadcom/sb1250-mac.c | 4 ++-- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c +index ec5834087e4b4..c01ab06863b3d 100644 +--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c ++++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c +@@ -571,12 +571,13 @@ static irqreturn_t bcm_enet_isr_dma(int irq, void *dev_id) + /* + * tx request callback + */ +-static int bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t ++bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct bcm_enet_priv *priv; + struct bcm_enet_desc *desc; + u32 len_stat; +- int ret; ++ netdev_tx_t ret; + + priv = netdev_priv(dev); + +diff --git a/drivers/net/ethernet/broadcom/sb1250-mac.c b/drivers/net/ethernet/broadcom/sb1250-mac.c +index f557a2aaec231..73a7c8a504702 100644 +--- a/drivers/net/ethernet/broadcom/sb1250-mac.c ++++ b/drivers/net/ethernet/broadcom/sb1250-mac.c +@@ -300,7 +300,7 @@ static enum sbmac_state sbmac_set_channel_state(struct sbmac_softc *, + static void sbmac_promiscuous_mode(struct sbmac_softc *sc, int onoff); + static uint64_t sbmac_addr2reg(unsigned char *ptr); + static irqreturn_t sbmac_intr(int irq, void *dev_instance); +-static int sbmac_start_tx(struct sk_buff *skb, struct net_device *dev); ++static netdev_tx_t sbmac_start_tx(struct sk_buff *skb, struct net_device *dev); + static void sbmac_setmulti(struct sbmac_softc *sc); + static int sbmac_init(struct platform_device *pldev, long long base); + static int sbmac_set_speed(struct sbmac_softc *s, enum sbmac_speed speed); +@@ -2033,7 +2033,7 @@ static irqreturn_t sbmac_intr(int irq,void *dev_instance) + * Return value: + * nothing + ********************************************************************* */ +-static int sbmac_start_tx(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t sbmac_start_tx(struct sk_buff *skb, struct net_device *dev) + { + struct sbmac_softc *sc = netdev_priv(dev); + unsigned long flags; +-- +2.20.1 + diff --git a/queue-4.4/net-lan78xx-bail-out-if-lan78xx_get_endpoints-fails.patch b/queue-4.4/net-lan78xx-bail-out-if-lan78xx_get_endpoints-fails.patch new file mode 100644 index 00000000000..17b3c6a34d0 --- /dev/null +++ b/queue-4.4/net-lan78xx-bail-out-if-lan78xx_get_endpoints-fails.patch @@ -0,0 +1,40 @@ +From 64d66652e45fd1951fd1d5121305461b4e699b20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Sep 2018 19:29:09 +0200 +Subject: net: lan78xx: Bail out if lan78xx_get_endpoints fails + +From: Stefan Wahren + +[ Upstream commit fa8cd98c06407b5798b927cd7fd14d30f360ed02 ] + +We need to bail out if lan78xx_get_endpoints() fails, otherwise the +result is overwritten. + +Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet") +Signed-off-by: Stefan Wahren +Reviewed-by: Raghuram Chary Jallipalli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 45a6a7cae4bfc..fc922f8122801 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -2246,6 +2246,11 @@ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf) + int i; + + ret = lan78xx_get_endpoints(dev, intf); ++ if (ret) { ++ netdev_warn(dev->net, "lan78xx_get_endpoints failed: %d\n", ++ ret); ++ return ret; ++ } + + dev->data[0] = (unsigned long)kzalloc(sizeof(*pdata), GFP_KERNEL); + +-- +2.20.1 + diff --git a/queue-4.4/net-micrel-fix-return-type-of-ndo_start_xmit-functio.patch b/queue-4.4/net-micrel-fix-return-type-of-ndo_start_xmit-functio.patch new file mode 100644 index 00000000000..306cc98e2b1 --- /dev/null +++ b/queue-4.4/net-micrel-fix-return-type-of-ndo_start_xmit-functio.patch @@ -0,0 +1,56 @@ +From cf471ae8fc35d03ac3618a30ee4db529424d0cb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Sep 2018 10:42:15 +0800 +Subject: net: micrel: fix return type of ndo_start_xmit function + +From: YueHaibing + +[ Upstream commit 2b49117a5abee8478b0470cba46ac74f93b4a479 ] + +The method ndo_start_xmit() is defined as returning an 'netdev_tx_t', +which is a typedef for an enum type, so make sure the implementation in +this driver has returns 'netdev_tx_t' value, and change the function +return type to netdev_tx_t. + +Found by coccinelle. + +Signed-off-by: YueHaibing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/micrel/ks8695net.c | 2 +- + drivers/net/ethernet/micrel/ks8851_mll.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/micrel/ks8695net.c b/drivers/net/ethernet/micrel/ks8695net.c +index a8522d8af95d3..2126286b72e9b 100644 +--- a/drivers/net/ethernet/micrel/ks8695net.c ++++ b/drivers/net/ethernet/micrel/ks8695net.c +@@ -1156,7 +1156,7 @@ ks8695_timeout(struct net_device *ndev) + * sk_buff and adds it to the TX ring. It then kicks the TX DMA + * engine to ensure transmission begins. + */ +-static int ++static netdev_tx_t + ks8695_start_xmit(struct sk_buff *skb, struct net_device *ndev) + { + struct ks8695_priv *ksp = netdev_priv(ndev); +diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c +index 2fc5cd56c0a84..8dc1f0277117d 100644 +--- a/drivers/net/ethernet/micrel/ks8851_mll.c ++++ b/drivers/net/ethernet/micrel/ks8851_mll.c +@@ -1020,9 +1020,9 @@ static void ks_write_qmu(struct ks_net *ks, u8 *pdata, u16 len) + * spin_lock_irqsave is required because tx and rx should be mutual exclusive. + * So while tx is in-progress, prevent IRQ interrupt from happenning. + */ +-static int ks_start_xmit(struct sk_buff *skb, struct net_device *netdev) ++static netdev_tx_t ks_start_xmit(struct sk_buff *skb, struct net_device *netdev) + { +- int retv = NETDEV_TX_OK; ++ netdev_tx_t retv = NETDEV_TX_OK; + struct ks_net *ks = netdev_priv(netdev); + + disable_irq(netdev->irq); +-- +2.20.1 + diff --git a/queue-4.4/net-smsc-fix-return-type-of-ndo_start_xmit-function.patch b/queue-4.4/net-smsc-fix-return-type-of-ndo_start_xmit-function.patch new file mode 100644 index 00000000000..f349e44fda5 --- /dev/null +++ b/queue-4.4/net-smsc-fix-return-type-of-ndo_start_xmit-function.patch @@ -0,0 +1,70 @@ +From d7864f4a3e0dc031b875635841bb33c5f1b8c80c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Sep 2018 17:06:29 +0800 +Subject: net: smsc: fix return type of ndo_start_xmit function + +From: YueHaibing + +[ Upstream commit 6323d57f335ce1490d025cacc83fc10b07792130 ] + +The method ndo_start_xmit() is defined as returning an 'netdev_tx_t', +which is a typedef for an enum type, so make sure the implementation in +this driver has returns 'netdev_tx_t' value, and change the function +return type to netdev_tx_t. + +Found by coccinelle. + +Signed-off-by: YueHaibing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/smsc/smc911x.c | 3 ++- + drivers/net/ethernet/smsc/smc91x.c | 3 ++- + drivers/net/ethernet/smsc/smsc911x.c | 3 ++- + 3 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c +index bd64eb982e527..37fb6dfc10875 100644 +--- a/drivers/net/ethernet/smsc/smc911x.c ++++ b/drivers/net/ethernet/smsc/smc911x.c +@@ -511,7 +511,8 @@ static void smc911x_hardware_send_pkt(struct net_device *dev) + * now, or set the card to generates an interrupt when ready + * for the packet. + */ +-static int smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t ++smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct smc911x_local *lp = netdev_priv(dev); + unsigned int free; +diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c +index 23a0388100834..7405f537beca7 100644 +--- a/drivers/net/ethernet/smsc/smc91x.c ++++ b/drivers/net/ethernet/smsc/smc91x.c +@@ -637,7 +637,8 @@ done: if (!THROTTLE_TX_PKTS) + * now, or set the card to generates an interrupt when ready + * for the packet. + */ +-static int smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t ++smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct smc_local *lp = netdev_priv(dev); + void __iomem *ioaddr = lp->base; +diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c +index 219a99b7a631d..b62bf77a64f43 100644 +--- a/drivers/net/ethernet/smsc/smsc911x.c ++++ b/drivers/net/ethernet/smsc/smsc911x.c +@@ -1677,7 +1677,8 @@ static int smsc911x_stop(struct net_device *dev) + } + + /* Entry point for transmitting a packet */ +-static int smsc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t ++smsc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct smsc911x_data *pdata = netdev_priv(dev); + unsigned int freespace; +-- +2.20.1 + diff --git a/queue-4.4/net-toshiba-fix-return-type-of-ndo_start_xmit-functi.patch b/queue-4.4/net-toshiba-fix-return-type-of-ndo_start_xmit-functi.patch new file mode 100644 index 00000000000..b561ea93b88 --- /dev/null +++ b/queue-4.4/net-toshiba-fix-return-type-of-ndo_start_xmit-functi.patch @@ -0,0 +1,98 @@ +From 228a23ccf89315715ddc586a767c9b78805f6370 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Sep 2018 18:23:39 +0800 +Subject: net: toshiba: fix return type of ndo_start_xmit function + +From: YueHaibing + +[ Upstream commit bacade822524e02f662d88f784d2ae821a5546fb ] + +The method ndo_start_xmit() is defined as returning an 'netdev_tx_t', +which is a typedef for an enum type, so make sure the implementation in +this driver has returns 'netdev_tx_t' value, and change the function +return type to netdev_tx_t. + +Found by coccinelle. + +Signed-off-by: YueHaibing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/toshiba/ps3_gelic_net.c | 4 ++-- + drivers/net/ethernet/toshiba/ps3_gelic_net.h | 2 +- + drivers/net/ethernet/toshiba/spider_net.c | 4 ++-- + drivers/net/ethernet/toshiba/tc35815.c | 6 ++++-- + 4 files changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.c b/drivers/net/ethernet/toshiba/ps3_gelic_net.c +index 79f0ec4e51ace..964df98b54ea1 100644 +--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.c ++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.c +@@ -845,9 +845,9 @@ static int gelic_card_kick_txdma(struct gelic_card *card, + * @skb: packet to send out + * @netdev: interface device structure + * +- * returns 0 on success, <0 on failure ++ * returns NETDEV_TX_OK on success, NETDEV_TX_BUSY on failure + */ +-int gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev) ++netdev_tx_t gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev) + { + struct gelic_card *card = netdev_card(netdev); + struct gelic_descr *descr; +diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.h b/drivers/net/ethernet/toshiba/ps3_gelic_net.h +index 8505196be9f52..d123644bd720b 100644 +--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.h ++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.h +@@ -370,7 +370,7 @@ void gelic_card_up(struct gelic_card *card); + void gelic_card_down(struct gelic_card *card); + int gelic_net_open(struct net_device *netdev); + int gelic_net_stop(struct net_device *netdev); +-int gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev); ++netdev_tx_t gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev); + void gelic_net_set_multi(struct net_device *netdev); + void gelic_net_tx_timeout(struct net_device *netdev); + int gelic_net_change_mtu(struct net_device *netdev, int new_mtu); +diff --git a/drivers/net/ethernet/toshiba/spider_net.c b/drivers/net/ethernet/toshiba/spider_net.c +index 3c54a2cae5dfd..8e53211aedd82 100644 +--- a/drivers/net/ethernet/toshiba/spider_net.c ++++ b/drivers/net/ethernet/toshiba/spider_net.c +@@ -881,9 +881,9 @@ out: + * @skb: packet to send out + * @netdev: interface device structure + * +- * returns 0 on success, !0 on failure ++ * returns NETDEV_TX_OK on success, NETDEV_TX_BUSY on failure + */ +-static int ++static netdev_tx_t + spider_net_xmit(struct sk_buff *skb, struct net_device *netdev) + { + int cnt; +diff --git a/drivers/net/ethernet/toshiba/tc35815.c b/drivers/net/ethernet/toshiba/tc35815.c +index 868fb6306df02..3e33c165a4278 100644 +--- a/drivers/net/ethernet/toshiba/tc35815.c ++++ b/drivers/net/ethernet/toshiba/tc35815.c +@@ -475,7 +475,8 @@ static void free_rxbuf_skb(struct pci_dev *hwdev, struct sk_buff *skb, dma_addr_ + /* Index to functions, as function prototypes. */ + + static int tc35815_open(struct net_device *dev); +-static int tc35815_send_packet(struct sk_buff *skb, struct net_device *dev); ++static netdev_tx_t tc35815_send_packet(struct sk_buff *skb, ++ struct net_device *dev); + static irqreturn_t tc35815_interrupt(int irq, void *dev_id); + static int tc35815_rx(struct net_device *dev, int limit); + static int tc35815_poll(struct napi_struct *napi, int budget); +@@ -1279,7 +1280,8 @@ tc35815_open(struct net_device *dev) + * invariant will hold if you make sure that the netif_*_queue() + * calls are done at the proper times. + */ +-static int tc35815_send_packet(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t ++tc35815_send_packet(struct sk_buff *skb, struct net_device *dev) + { + struct tc35815_local *lp = netdev_priv(dev); + struct TxFD *txfd; +-- +2.20.1 + diff --git a/queue-4.4/net-xilinx-fix-return-type-of-ndo_start_xmit-functio.patch b/queue-4.4/net-xilinx-fix-return-type-of-ndo_start_xmit-functio.patch new file mode 100644 index 00000000000..89135689d3e --- /dev/null +++ b/queue-4.4/net-xilinx-fix-return-type-of-ndo_start_xmit-functio.patch @@ -0,0 +1,91 @@ +From 33f3e52e381c12b88aad42a7e236884f5b91e008 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Sep 2018 18:32:40 +0800 +Subject: net: xilinx: fix return type of ndo_start_xmit function + +From: YueHaibing + +[ Upstream commit 81255af8d9d5565004792c295dde49344df450ca ] + +The method ndo_start_xmit() is defined as returning an 'netdev_tx_t', +which is a typedef for an enum type, so make sure the implementation in +this driver has returns 'netdev_tx_t' value, and change the function +return type to netdev_tx_t. + +Found by coccinelle. + +Signed-off-by: YueHaibing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/xilinx/ll_temac_main.c | 3 ++- + drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 3 ++- + drivers/net/ethernet/xilinx/xilinx_emaclite.c | 9 +++++---- + 3 files changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c +index 5a1068df7038c..ed6a88cf3281c 100644 +--- a/drivers/net/ethernet/xilinx/ll_temac_main.c ++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c +@@ -673,7 +673,8 @@ static inline int temac_check_tx_bd_space(struct temac_local *lp, int num_frag) + return 0; + } + +-static int temac_start_xmit(struct sk_buff *skb, struct net_device *ndev) ++static netdev_tx_t ++temac_start_xmit(struct sk_buff *skb, struct net_device *ndev) + { + struct temac_local *lp = netdev_priv(ndev); + struct cdmac_bd *cur_p; +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +index f1e969128a4ee..7f1a57bb2ab10 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -656,7 +656,8 @@ static inline int axienet_check_tx_bd_space(struct axienet_local *lp, + * start the transmission. Additionally if checksum offloading is supported, + * it populates AXI Stream Control fields with appropriate values. + */ +-static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev) ++static netdev_tx_t ++axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev) + { + u32 ii; + u32 num_frag; +diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c +index 4cb8b85cbf2c2..909a008f99276 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c ++++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c +@@ -1008,9 +1008,10 @@ static int xemaclite_close(struct net_device *dev) + * deferred and the Tx queue is stopped so that the deferred socket buffer can + * be transmitted when the Emaclite device is free to transmit data. + * +- * Return: 0, always. ++ * Return: NETDEV_TX_OK, always. + */ +-static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev) ++static netdev_tx_t ++xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev) + { + struct net_local *lp = netdev_priv(dev); + struct sk_buff *new_skb; +@@ -1031,7 +1032,7 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev) + /* Take the time stamp now, since we can't do this in an ISR. */ + skb_tx_timestamp(new_skb); + spin_unlock_irqrestore(&lp->reset_lock, flags); +- return 0; ++ return NETDEV_TX_OK; + } + spin_unlock_irqrestore(&lp->reset_lock, flags); + +@@ -1040,7 +1041,7 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev) + dev->stats.tx_bytes += len; + dev_consume_skb_any(new_skb); + +- return 0; ++ return NETDEV_TX_OK; + } + + /** +-- +2.20.1 + diff --git a/queue-4.4/nvmem-core-return-error-code-instead-of-null-from-nv.patch b/queue-4.4/nvmem-core-return-error-code-instead-of-null-from-nv.patch new file mode 100644 index 00000000000..49c45bc9e8b --- /dev/null +++ b/queue-4.4/nvmem-core-return-error-code-instead-of-null-from-nv.patch @@ -0,0 +1,36 @@ +From eb138f835007a0619b4f143bed8b212b14701796 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Aug 2018 13:19:35 +0100 +Subject: nvmem: core: return error code instead of NULL from nvmem_device_get + +From: Srinivas Kandagatla + +[ Upstream commit ca6ac25cecf0e740d7cc8e03e0ebbf8acbeca3df ] + +nvmem_device_get() should return ERR_PTR() on error or valid pointer +on success, but one of the code path seems to return NULL, so fix it. + +Reported-by: Niklas Cassel +Signed-off-by: Srinivas Kandagatla +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/nvmem/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c +index 931cc33e46f02..5d6d1bb4f1106 100644 +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -457,7 +457,7 @@ static struct nvmem_device *nvmem_find(const char *name) + d = bus_find_device(&nvmem_bus_type, NULL, (void *)name, nvmem_match); + + if (!d) +- return NULL; ++ return ERR_PTR(-ENOENT); + + return to_nvmem_device(d); + } +-- +2.20.1 + diff --git a/queue-4.4/of-make-powermac-cache-node-search-conditional-on-co.patch b/queue-4.4/of-make-powermac-cache-node-search-conditional-on-co.patch new file mode 100644 index 00000000000..68fe6ba0443 --- /dev/null +++ b/queue-4.4/of-make-powermac-cache-node-search-conditional-on-co.patch @@ -0,0 +1,34 @@ +From b2ad3bfcd6dd92003842c1affb26260eccde31b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Aug 2018 09:50:09 -0500 +Subject: of: make PowerMac cache node search conditional on CONFIG_PPC_PMAC + +From: Rob Herring + +[ Upstream commit f6707fd6241e483f6fea2caae82d876e422bb11a ] + +Cache nodes under the cpu node(s) is PowerMac specific according to the +comment above, so make the code enforce that. + +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/of/base.c b/drivers/of/base.c +index c6e019208d171..27783223ca5cd 100644 +--- a/drivers/of/base.c ++++ b/drivers/of/base.c +@@ -2125,7 +2125,7 @@ struct device_node *of_find_next_cache_node(const struct device_node *np) + /* OF on pmac has nodes instead of properties named "l2-cache" + * beneath CPU nodes. + */ +- if (!strcmp(np->type, "cpu")) ++ if (IS_ENABLED(CONFIG_PPC_PMAC) && !strcmp(np->type, "cpu")) + for_each_child_of_node(np, child) + if (!strcmp(child->type, "cache")) + return child; +-- +2.20.1 + diff --git a/queue-4.4/pci-acpi-correct-error-message-for-aspm-disabling.patch b/queue-4.4/pci-acpi-correct-error-message-for-aspm-disabling.patch new file mode 100644 index 00000000000..6d3966be0cb --- /dev/null +++ b/queue-4.4/pci-acpi-correct-error-message-for-aspm-disabling.patch @@ -0,0 +1,43 @@ +From 0d3261c145d6373a12f04ca4a4cc89fa3e848269 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Aug 2018 04:32:11 +0000 +Subject: PCI/ACPI: Correct error message for ASPM disabling + +From: Sinan Kaya + +[ Upstream commit 1ad61b612b95980a4d970c52022aa01dfc0f6068 ] + +If _OSC execution fails today for platforms without an _OSC entry, code is +printing a misleading message saying disabling ASPM as follows: + + acpi PNP0A03:00: _OSC failed (AE_NOT_FOUND); disabling ASPM + +We need to ensure that platform supports ASPM to begin with. + +Reported-by: Michael Kelley +Signed-off-by: Sinan Kaya +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/acpi/pci_root.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c +index 3b0b4bd67b71b..4031ec8024cee 100644 +--- a/drivers/acpi/pci_root.c ++++ b/drivers/acpi/pci_root.c +@@ -454,8 +454,9 @@ static void negotiate_os_control(struct acpi_pci_root *root, int *no_aspm) + decode_osc_support(root, "OS supports", support); + status = acpi_pci_osc_support(root, support); + if (ACPI_FAILURE(status)) { +- dev_info(&device->dev, "_OSC failed (%s); disabling ASPM\n", +- acpi_format_exception(status)); ++ dev_info(&device->dev, "_OSC failed (%s)%s\n", ++ acpi_format_exception(status), ++ pcie_aspm_support_enabled() ? "; disabling ASPM" : ""); + *no_aspm = 1; + return; + } +-- +2.20.1 + diff --git a/queue-4.4/pinctrl-at91-don-t-use-the-same-irqchip-with-multipl.patch b/queue-4.4/pinctrl-at91-don-t-use-the-same-irqchip-with-multipl.patch new file mode 100644 index 00000000000..45721e73f4c --- /dev/null +++ b/queue-4.4/pinctrl-at91-don-t-use-the-same-irqchip-with-multipl.patch @@ -0,0 +1,88 @@ +From 96d8d017debe2b071a931a2ee0267b83a0e11002 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Sep 2018 14:42:13 +0200 +Subject: pinctrl: at91: don't use the same irqchip with multiple gpiochips + +From: Ludovic Desroches + +[ Upstream commit 0c3dfa176912b5f87732545598200fb55e9c1978 ] + +Sharing the same irqchip with multiple gpiochips is not a good +practice. For instance, when installing hooks, we change the state +of the irqchip. The initial state of the irqchip for the second +gpiochip to register is then disrupted. + +Signed-off-by: Ludovic Desroches +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-at91.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c +index 0d2fc0cff35ee..52bbd34f7d0d9 100644 +--- a/drivers/pinctrl/pinctrl-at91.c ++++ b/drivers/pinctrl/pinctrl-at91.c +@@ -1556,16 +1556,6 @@ void at91_pinctrl_gpio_resume(void) + #define gpio_irq_set_wake NULL + #endif /* CONFIG_PM */ + +-static struct irq_chip gpio_irqchip = { +- .name = "GPIO", +- .irq_ack = gpio_irq_ack, +- .irq_disable = gpio_irq_mask, +- .irq_mask = gpio_irq_mask, +- .irq_unmask = gpio_irq_unmask, +- /* .irq_set_type is set dynamically */ +- .irq_set_wake = gpio_irq_set_wake, +-}; +- + static void gpio_irq_handler(struct irq_desc *desc) + { + struct irq_chip *chip = irq_desc_get_chip(desc); +@@ -1608,12 +1598,22 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev, + struct gpio_chip *gpiochip_prev = NULL; + struct at91_gpio_chip *prev = NULL; + struct irq_data *d = irq_get_irq_data(at91_gpio->pioc_virq); ++ struct irq_chip *gpio_irqchip; + int ret, i; + ++ gpio_irqchip = devm_kzalloc(&pdev->dev, sizeof(*gpio_irqchip), GFP_KERNEL); ++ if (!gpio_irqchip) ++ return -ENOMEM; ++ + at91_gpio->pioc_hwirq = irqd_to_hwirq(d); + +- /* Setup proper .irq_set_type function */ +- gpio_irqchip.irq_set_type = at91_gpio->ops->irq_type; ++ gpio_irqchip->name = "GPIO"; ++ gpio_irqchip->irq_ack = gpio_irq_ack; ++ gpio_irqchip->irq_disable = gpio_irq_mask; ++ gpio_irqchip->irq_mask = gpio_irq_mask; ++ gpio_irqchip->irq_unmask = gpio_irq_unmask; ++ gpio_irqchip->irq_set_wake = gpio_irq_set_wake, ++ gpio_irqchip->irq_set_type = at91_gpio->ops->irq_type; + + /* Disable irqs of this PIO controller */ + writel_relaxed(~0, at91_gpio->regbase + PIO_IDR); +@@ -1624,7 +1624,7 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev, + * interrupt. + */ + ret = gpiochip_irqchip_add(&at91_gpio->chip, +- &gpio_irqchip, ++ gpio_irqchip, + 0, + handle_edge_irq, + IRQ_TYPE_EDGE_BOTH); +@@ -1642,7 +1642,7 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev, + if (!gpiochip_prev) { + /* Then register the chain on the parent IRQ */ + gpiochip_set_chained_irqchip(&at91_gpio->chip, +- &gpio_irqchip, ++ gpio_irqchip, + at91_gpio->pioc_virq, + gpio_irq_handler); + return 0; +-- +2.20.1 + diff --git a/queue-4.4/pinctrl-at91-pio4-fix-has_config-check-in-atmel_pctl.patch b/queue-4.4/pinctrl-at91-pio4-fix-has_config-check-in-atmel_pctl.patch new file mode 100644 index 00000000000..465133f73a9 --- /dev/null +++ b/queue-4.4/pinctrl-at91-pio4-fix-has_config-check-in-atmel_pctl.patch @@ -0,0 +1,71 @@ +From b181c7765189ff88d80ea45f2dae766756bd279b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Sep 2018 11:37:45 +0300 +Subject: pinctrl: at91-pio4: fix has_config check in + atmel_pctl_dt_subnode_to_map() + +From: Dan Carpenter + +[ Upstream commit b97760ae8e3dc8bb91881c13425a0bff55f2bd85 ] + +Smatch complains about this condition: + + if (has_config && num_pins >= 1) + +The "has_config" variable is either uninitialized or true. The +"num_pins" variable is unsigned and we verified that it is non-zero on +the lines before so we know "num_pines >= 1" is true. Really, we could +just check "num_configs" directly and remove the "has_config" variable. + +Fixes: 776180848b57 ("pinctrl: introduce driver for Atmel PIO4 controller") +Signed-off-by: Dan Carpenter +Acked-by: Ludovic Desroches +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-at91-pio4.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c +index 9aa82a4e9e254..b4420a0bf7d66 100644 +--- a/drivers/pinctrl/pinctrl-at91-pio4.c ++++ b/drivers/pinctrl/pinctrl-at91-pio4.c +@@ -477,7 +477,6 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev, + unsigned num_pins, num_configs, reserve; + unsigned long *configs; + struct property *pins; +- bool has_config; + u32 pinfunc; + int ret, i; + +@@ -493,9 +492,6 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev, + return ret; + } + +- if (num_configs) +- has_config = true; +- + num_pins = pins->length / sizeof(u32); + if (!num_pins) { + dev_err(pctldev->dev, "no pins found in node %s\n", +@@ -508,7 +504,7 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev, + * map for each pin. + */ + reserve = 1; +- if (has_config && num_pins >= 1) ++ if (num_configs) + reserve++; + reserve *= num_pins; + ret = pinctrl_utils_reserve_map(pctldev, map, reserved_maps, num_maps, +@@ -531,7 +527,7 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev, + pinctrl_utils_add_map_mux(pctldev, map, reserved_maps, num_maps, + group, func); + +- if (has_config) { ++ if (num_configs) { + ret = pinctrl_utils_add_map_configs(pctldev, map, + reserved_maps, num_maps, group, + configs, num_configs, +-- +2.20.1 + diff --git a/queue-4.4/power-supply-ab8500_fg-silence-uninitialized-variabl.patch b/queue-4.4/power-supply-ab8500_fg-silence-uninitialized-variabl.patch new file mode 100644 index 00000000000..b7ff590e0ab --- /dev/null +++ b/queue-4.4/power-supply-ab8500_fg-silence-uninitialized-variabl.patch @@ -0,0 +1,78 @@ +From f51910fa62c88377457b6507aae79890ab2998ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Sep 2018 11:39:04 +0300 +Subject: power: supply: ab8500_fg: silence uninitialized variable warnings + +From: Dan Carpenter + +[ Upstream commit 54baff8d4e5dce2cef61953b1dc22079cda1ddb1 ] + +If kstrtoul() fails then we print "charge_full" when it's uninitialized. +The debug printk doesn't add anything so I deleted it and cleaned these +two functions up a bit. + +Signed-off-by: Dan Carpenter +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/ab8500_fg.c | 31 ++++++++++++------------------- + 1 file changed, 12 insertions(+), 19 deletions(-) + +diff --git a/drivers/power/ab8500_fg.c b/drivers/power/ab8500_fg.c +index 3830dade5d69d..d91111200dde2 100644 +--- a/drivers/power/ab8500_fg.c ++++ b/drivers/power/ab8500_fg.c +@@ -2447,17 +2447,14 @@ static ssize_t charge_full_store(struct ab8500_fg *di, const char *buf, + size_t count) + { + unsigned long charge_full; +- ssize_t ret; ++ int ret; + + ret = kstrtoul(buf, 10, &charge_full); ++ if (ret) ++ return ret; + +- dev_dbg(di->dev, "Ret %zd charge_full %lu", ret, charge_full); +- +- if (!ret) { +- di->bat_cap.max_mah = (int) charge_full; +- ret = count; +- } +- return ret; ++ di->bat_cap.max_mah = (int) charge_full; ++ return count; + } + + static ssize_t charge_now_show(struct ab8500_fg *di, char *buf) +@@ -2469,20 +2466,16 @@ static ssize_t charge_now_store(struct ab8500_fg *di, const char *buf, + size_t count) + { + unsigned long charge_now; +- ssize_t ret; ++ int ret; + + ret = kstrtoul(buf, 10, &charge_now); ++ if (ret) ++ return ret; + +- dev_dbg(di->dev, "Ret %zd charge_now %lu was %d", +- ret, charge_now, di->bat_cap.prev_mah); +- +- if (!ret) { +- di->bat_cap.user_mah = (int) charge_now; +- di->flags.user_cap = true; +- ret = count; +- queue_delayed_work(di->fg_wq, &di->fg_periodic_work, 0); +- } +- return ret; ++ di->bat_cap.user_mah = (int) charge_now; ++ di->flags.user_cap = true; ++ queue_delayed_work(di->fg_wq, &di->fg_periodic_work, 0); ++ return count; + } + + static struct ab8500_fg_sysfs_entry charge_full_attr = +-- +2.20.1 + diff --git a/queue-4.4/power-supply-max8998-charger-fix-platform-data-retri.patch b/queue-4.4/power-supply-max8998-charger-fix-platform-data-retri.patch new file mode 100644 index 00000000000..51836254173 --- /dev/null +++ b/queue-4.4/power-supply-max8998-charger-fix-platform-data-retri.patch @@ -0,0 +1,41 @@ +From 231ffdbc6939eddd51d254b34688abff473890b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jul 2018 18:05:07 +0200 +Subject: power: supply: max8998-charger: Fix platform data retrieval +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tomasz Figa + +[ Upstream commit cb90a2c6f77fe9b43d1e3f759bb2f13fe7fa1811 ] + +Since the max8998 MFD driver supports instantiation by DT, platform data +retrieval is handled in MFD probe and cell drivers should get use +the pdata field of max8998_dev struct to obtain them. + +Fixes: ee999fb3f17f ("mfd: max8998: Add support for Device Tree") +Signed-off-by: Tomasz Figa +Signed-off-by: Paweł Chmiel +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/max8998_charger.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/power/max8998_charger.c b/drivers/power/max8998_charger.c +index b64cf0f141425..66438029bdd0c 100644 +--- a/drivers/power/max8998_charger.c ++++ b/drivers/power/max8998_charger.c +@@ -85,7 +85,7 @@ static const struct power_supply_desc max8998_battery_desc = { + static int max8998_battery_probe(struct platform_device *pdev) + { + struct max8998_dev *iodev = dev_get_drvdata(pdev->dev.parent); +- struct max8998_platform_data *pdata = dev_get_platdata(iodev->dev); ++ struct max8998_platform_data *pdata = iodev->pdata; + struct power_supply_config psy_cfg = {}; + struct max8998_battery_data *max8998; + struct i2c_client *i2c; +-- +2.20.1 + diff --git a/queue-4.4/power-supply-twl4030_charger-disable-eoc-interrupt-o.patch b/queue-4.4/power-supply-twl4030_charger-disable-eoc-interrupt-o.patch new file mode 100644 index 00000000000..f8f8b31d9e3 --- /dev/null +++ b/queue-4.4/power-supply-twl4030_charger-disable-eoc-interrupt-o.patch @@ -0,0 +1,76 @@ +From 1d12d9ee84fc0308b81352ce41d706e29e5f22d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Sep 2018 07:00:07 +0200 +Subject: power: supply: twl4030_charger: disable eoc interrupt on linear + charge + +From: Andreas Kemnade + +[ Upstream commit 079cdff3d0a09c5da10ae1be35def7a116776328 ] + +This avoids getting woken up from suspend after power interruptions +when the bci wrongly thinks the battery is full just because +of input current going low because of low input power + +Signed-off-by: Andreas Kemnade +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/twl4030_charger.c | 27 ++++++++++++++++++++++++++- + 1 file changed, 26 insertions(+), 1 deletion(-) + +diff --git a/drivers/power/twl4030_charger.c b/drivers/power/twl4030_charger.c +index 14fed11e8f6e3..5b1f147b11cb0 100644 +--- a/drivers/power/twl4030_charger.c ++++ b/drivers/power/twl4030_charger.c +@@ -469,6 +469,7 @@ static void twl4030_current_worker(struct work_struct *data) + static int twl4030_charger_enable_usb(struct twl4030_bci *bci, bool enable) + { + int ret; ++ u32 reg; + + if (bci->usb_mode == CHARGE_OFF) + enable = false; +@@ -482,14 +483,38 @@ static int twl4030_charger_enable_usb(struct twl4030_bci *bci, bool enable) + bci->usb_enabled = 1; + } + +- if (bci->usb_mode == CHARGE_AUTO) ++ if (bci->usb_mode == CHARGE_AUTO) { ++ /* Enable interrupts now. */ ++ reg = ~(u32)(TWL4030_ICHGLOW | TWL4030_ICHGEOC | ++ TWL4030_TBATOR2 | TWL4030_TBATOR1 | ++ TWL4030_BATSTS); ++ ret = twl_i2c_write_u8(TWL4030_MODULE_INTERRUPTS, reg, ++ TWL4030_INTERRUPTS_BCIIMR1A); ++ if (ret < 0) { ++ dev_err(bci->dev, ++ "failed to unmask interrupts: %d\n", ++ ret); ++ return ret; ++ } + /* forcing the field BCIAUTOUSB (BOOT_BCI[1]) to 1 */ + ret = twl4030_clear_set_boot_bci(0, TWL4030_BCIAUTOUSB); ++ } + + /* forcing USBFASTMCHG(BCIMFSTS4[2]) to 1 */ + ret = twl4030_clear_set(TWL_MODULE_MAIN_CHARGE, 0, + TWL4030_USBFASTMCHG, TWL4030_BCIMFSTS4); + if (bci->usb_mode == CHARGE_LINEAR) { ++ /* Enable interrupts now. */ ++ reg = ~(u32)(TWL4030_ICHGLOW | TWL4030_TBATOR2 | ++ TWL4030_TBATOR1 | TWL4030_BATSTS); ++ ret = twl_i2c_write_u8(TWL4030_MODULE_INTERRUPTS, reg, ++ TWL4030_INTERRUPTS_BCIIMR1A); ++ if (ret < 0) { ++ dev_err(bci->dev, ++ "failed to unmask interrupts: %d\n", ++ ret); ++ return ret; ++ } + twl4030_clear_set_boot_bci(TWL4030_BCIAUTOAC|TWL4030_CVENAC, 0); + /* Watch dog key: WOVF acknowledge */ + ret = twl_i2c_write_u8(TWL_MODULE_MAIN_CHARGE, 0x33, +-- +2.20.1 + diff --git a/queue-4.4/power-supply-twl4030_charger-fix-charging-current-ou.patch b/queue-4.4/power-supply-twl4030_charger-fix-charging-current-ou.patch new file mode 100644 index 00000000000..1be02d944d1 --- /dev/null +++ b/queue-4.4/power-supply-twl4030_charger-fix-charging-current-ou.patch @@ -0,0 +1,38 @@ +From ea0784b4566cb933746d27d53dfe65657e9a1735 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Sep 2018 07:20:35 +0200 +Subject: power: supply: twl4030_charger: fix charging current out-of-bounds + +From: Andreas Kemnade + +[ Upstream commit 8314c212f995bc0d06b54ad02ef0ab4089781540 ] + +the charging current uses unsigned int variables, if we step back +if the current is still low, we would run into negative which +means setting the target to a huge value. +Better add checks here. + +Signed-off-by: Andreas Kemnade +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/twl4030_charger.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/power/twl4030_charger.c b/drivers/power/twl4030_charger.c +index bcd4dc304f270..14fed11e8f6e3 100644 +--- a/drivers/power/twl4030_charger.c ++++ b/drivers/power/twl4030_charger.c +@@ -449,7 +449,8 @@ static void twl4030_current_worker(struct work_struct *data) + + if (v < USB_MIN_VOLT) { + /* Back up and stop adjusting. */ +- bci->usb_cur -= USB_CUR_STEP; ++ if (bci->usb_cur >= USB_CUR_STEP) ++ bci->usb_cur -= USB_CUR_STEP; + bci->usb_cur_target = bci->usb_cur; + } else if (bci->usb_cur >= bci->usb_cur_target || + bci->usb_cur + USB_CUR_STEP > USB_MAX_CURRENT) { +-- +2.20.1 + diff --git a/queue-4.4/powerpc-64s-hash-fix-stab_rr-off-by-one-initializati.patch b/queue-4.4/powerpc-64s-hash-fix-stab_rr-off-by-one-initializati.patch new file mode 100644 index 00000000000..ceaebf37e52 --- /dev/null +++ b/queue-4.4/powerpc-64s-hash-fix-stab_rr-off-by-one-initializati.patch @@ -0,0 +1,36 @@ +From dcd923743a74319df31c0b0f58c2220745adae59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Sep 2018 01:30:45 +1000 +Subject: powerpc/64s/hash: Fix stab_rr off by one initialization + +From: Nicholas Piggin + +[ Upstream commit 09b4438db13fa83b6219aee5993711a2aa2a0c64 ] + +This causes SLB alloation to start 1 beyond the start of the SLB. +There is no real problem because after it wraps it stats behaving +properly, it's just surprisig to see when looking at SLB traces. + +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/slb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/mm/slb.c b/arch/powerpc/mm/slb.c +index 309027208f7c0..27f00a7c1085f 100644 +--- a/arch/powerpc/mm/slb.c ++++ b/arch/powerpc/mm/slb.c +@@ -322,7 +322,7 @@ void slb_initialize(void) + #endif + } + +- get_paca()->stab_rr = SLB_NUM_BOLTED; ++ get_paca()->stab_rr = SLB_NUM_BOLTED - 1; + + lflags = SLB_VSID_KERNEL | linear_llp; + vflags = SLB_VSID_KERNEL | vmalloc_llp; +-- +2.20.1 + diff --git a/queue-4.4/powerpc-iommu-avoid-derefence-before-pointer-check.patch b/queue-4.4/powerpc-iommu-avoid-derefence-before-pointer-check.patch new file mode 100644 index 00000000000..38f4fa5218d --- /dev/null +++ b/queue-4.4/powerpc-iommu-avoid-derefence-before-pointer-check.patch @@ -0,0 +1,40 @@ +From 1a830ee67343e77f61137c0dafec4a7213c91722 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Aug 2018 15:44:48 -0300 +Subject: powerpc/iommu: Avoid derefence before pointer check + +From: Breno Leitao + +[ Upstream commit 984ecdd68de0fa1f63ce205d6c19ef5a7bc67b40 ] + +The tbl pointer is being derefenced by IOMMU_PAGE_SIZE prior the check +if it is not NULL. + +Just moving the dereference code to after the check, where there will +be guarantee that 'tbl' will not be NULL. + +Signed-off-by: Breno Leitao +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c +index a8e3490b54e3b..4c9b5970af371 100644 +--- a/arch/powerpc/kernel/iommu.c ++++ b/arch/powerpc/kernel/iommu.c +@@ -764,9 +764,9 @@ dma_addr_t iommu_map_page(struct device *dev, struct iommu_table *tbl, + + vaddr = page_address(page) + offset; + uaddr = (unsigned long)vaddr; +- npages = iommu_num_pages(uaddr, size, IOMMU_PAGE_SIZE(tbl)); + + if (tbl) { ++ npages = iommu_num_pages(uaddr, size, IOMMU_PAGE_SIZE(tbl)); + align = 0; + if (tbl->it_page_shift < PAGE_SHIFT && size >= PAGE_SIZE && + ((unsigned long)vaddr & ~PAGE_MASK) == 0) +-- +2.20.1 + diff --git a/queue-4.4/powerpc-pseries-disable-cpu-hotplug-across-migration.patch b/queue-4.4/powerpc-pseries-disable-cpu-hotplug-across-migration.patch new file mode 100644 index 00000000000..7c0f012d577 --- /dev/null +++ b/queue-4.4/powerpc-pseries-disable-cpu-hotplug-across-migration.patch @@ -0,0 +1,53 @@ +From 91489f93b6729d62feaacb2c84837a4ac56a71a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Sep 2018 14:14:02 -0500 +Subject: powerpc/pseries: Disable CPU hotplug across migrations + +From: Nathan Fontenot + +[ Upstream commit 85a88cabad57d26d826dd94ea34d3a785824d802 ] + +When performing partition migrations all present CPUs must be online +as all present CPUs must make the H_JOIN call as part of the migration +process. Once all present CPUs make the H_JOIN call, one CPU is returned +to make the rtas call to perform the migration to the destination system. + +During testing of migration and changing the SMT state we have found +instances where CPUs are offlined, as part of the SMT state change, +before they make the H_JOIN call. This results in a hung system where +every CPU is either in H_JOIN or offline. + +To prevent this this patch disables CPU hotplug during the migration +process. + +Signed-off-by: Nathan Fontenot +Reviewed-by: Tyrel Datwyler +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/rtas.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c +index 0c42e872d548b..4fcaa7d3d544f 100644 +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -967,6 +967,7 @@ int rtas_ibm_suspend_me(u64 handle) + goto out; + } + ++ cpu_hotplug_disable(); + stop_topology_update(); + + /* Call function on all CPUs. One of us will make the +@@ -981,6 +982,7 @@ int rtas_ibm_suspend_me(u64 handle) + printk(KERN_ERR "Error doing global join\n"); + + start_topology_update(); ++ cpu_hotplug_enable(); + + /* Take down CPUs not online prior to suspend */ + cpuret = rtas_offline_cpus_mask(offline_mask); +-- +2.20.1 + diff --git a/queue-4.4/powerpc-vdso-correct-call-frame-information.patch b/queue-4.4/powerpc-vdso-correct-call-frame-information.patch new file mode 100644 index 00000000000..5b6d964db11 --- /dev/null +++ b/queue-4.4/powerpc-vdso-correct-call-frame-information.patch @@ -0,0 +1,100 @@ +From fe4e406fc915a66e2763dddd4c674a733973e249 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Sep 2018 13:10:04 +0930 +Subject: powerpc/vdso: Correct call frame information + +From: Alan Modra + +[ Upstream commit 56d20861c027498b5a1112b4f9f05b56d906fdda ] + +Call Frame Information is used by gdb for back-traces and inserting +breakpoints on function return for the "finish" command. This failed +when inside __kernel_clock_gettime. More concerning than difficulty +debugging is that CFI is also used by stack frame unwinding code to +implement exceptions. If you have an app that needs to handle +asynchronous exceptions for some reason, and you are unlucky enough to +get one inside the VDSO time functions, your app will crash. + +What's wrong: There is control flow in __kernel_clock_gettime that +reaches label 99 without saving lr in r12. CFI info however is +interpreted by the unwinder without reference to control flow: It's a +simple matter of "Execute all the CFI opcodes up to the current +address". That means the unwinder thinks r12 contains the return +address at label 99. Disabuse it of that notion by resetting CFI for +the return address at label 99. + +Note that the ".cfi_restore lr" could have gone anywhere from the +"mtlr r12" a few instructions earlier to the instruction at label 99. +I put the CFI as late as possible, because in general that's best +practice (and if possible grouped with other CFI in order to reduce +the number of CFI opcodes executed when unwinding). Using r12 as the +return address is perfectly fine after the "mtlr r12" since r12 on +that code path still contains the return address. + +__get_datapage also has a CFI error. That function temporarily saves +lr in r0, and reflects that fact with ".cfi_register lr,r0". A later +use of r0 means the CFI at that point isn't correct, as r0 no longer +contains the return address. Fix that too. + +Signed-off-by: Alan Modra +Tested-by: Reza Arbab +Signed-off-by: Paul Mackerras +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/vdso32/datapage.S | 1 + + arch/powerpc/kernel/vdso32/gettimeofday.S | 1 + + arch/powerpc/kernel/vdso64/datapage.S | 1 + + arch/powerpc/kernel/vdso64/gettimeofday.S | 1 + + 4 files changed, 4 insertions(+) + +diff --git a/arch/powerpc/kernel/vdso32/datapage.S b/arch/powerpc/kernel/vdso32/datapage.S +index 59cf5f452879b..9d112e1b31b8b 100644 +--- a/arch/powerpc/kernel/vdso32/datapage.S ++++ b/arch/powerpc/kernel/vdso32/datapage.S +@@ -37,6 +37,7 @@ data_page_branch: + mtlr r0 + addi r3, r3, __kernel_datapage_offset-data_page_branch + lwz r0,0(r3) ++ .cfi_restore lr + add r3,r0,r3 + blr + .cfi_endproc +diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S +index 6b2b69616e776..7b341b86216c2 100644 +--- a/arch/powerpc/kernel/vdso32/gettimeofday.S ++++ b/arch/powerpc/kernel/vdso32/gettimeofday.S +@@ -139,6 +139,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime) + */ + 99: + li r0,__NR_clock_gettime ++ .cfi_restore lr + sc + blr + .cfi_endproc +diff --git a/arch/powerpc/kernel/vdso64/datapage.S b/arch/powerpc/kernel/vdso64/datapage.S +index 7612eeb31da14..6832e41c372b0 100644 +--- a/arch/powerpc/kernel/vdso64/datapage.S ++++ b/arch/powerpc/kernel/vdso64/datapage.S +@@ -37,6 +37,7 @@ data_page_branch: + mtlr r0 + addi r3, r3, __kernel_datapage_offset-data_page_branch + lwz r0,0(r3) ++ .cfi_restore lr + add r3,r0,r3 + blr + .cfi_endproc +diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S +index 3820213248836..09b2a49f6dd53 100644 +--- a/arch/powerpc/kernel/vdso64/gettimeofday.S ++++ b/arch/powerpc/kernel/vdso64/gettimeofday.S +@@ -124,6 +124,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime) + */ + 99: + li r0,__NR_clock_gettime ++ .cfi_restore lr + sc + blr + .cfi_endproc +-- +2.20.1 + diff --git a/queue-4.4/rtl8187-fix-warning-generated-when-strncpy-destinati.patch b/queue-4.4/rtl8187-fix-warning-generated-when-strncpy-destinati.patch new file mode 100644 index 00000000000..6c3af964f24 --- /dev/null +++ b/queue-4.4/rtl8187-fix-warning-generated-when-strncpy-destinati.patch @@ -0,0 +1,37 @@ +From b3dff42850217444c211daa6f4859f655187eff9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Aug 2018 13:48:31 -0500 +Subject: rtl8187: Fix warning generated when strncpy() destination length + matches the sixe argument + +From: Larry Finger + +[ Upstream commit 199ba9faca909e77ac533449ecd1248123ce89e7 ] + +In gcc8, when the 3rd argument (size) of a call to strncpy() matches the +length of the first argument, the compiler warns of the possibility of an +unterminated string. Using strlcpy() forces a null at the end. + +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c +index c2d5b495c179a..c089540116fa7 100644 +--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c ++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c +@@ -146,7 +146,7 @@ static int rtl8187_register_led(struct ieee80211_hw *dev, + led->dev = dev; + led->ledpin = ledpin; + led->is_radio = is_radio; +- strncpy(led->name, name, sizeof(led->name)); ++ strlcpy(led->name, name, sizeof(led->name)); + + led->led_dev.name = led->name; + led->led_dev.default_trigger = default_trigger; +-- +2.20.1 + diff --git a/queue-4.4/s390-qeth-invoke-softirqs-after-napi_schedule.patch b/queue-4.4/s390-qeth-invoke-softirqs-after-napi_schedule.patch new file mode 100644 index 00000000000..fb2c09f3208 --- /dev/null +++ b/queue-4.4/s390-qeth-invoke-softirqs-after-napi_schedule.patch @@ -0,0 +1,62 @@ +From 41ddc2826355b94d3dd7cb092c8add88d7294793 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Sep 2018 17:36:06 +0200 +Subject: s390/qeth: invoke softirqs after napi_schedule() + +From: Julian Wiedmann + +[ Upstream commit 4d19db777a2f32c9b76f6fd517ed8960576cb43e ] + +Calling napi_schedule() from process context does not ensure that the +NET_RX softirq is run in a timely fashion. So trigger it manually. + +This is no big issue with current code. A call to ndo_open() is usually +followed by a ndo_set_rx_mode() call, and for qeth this contains a +spin_unlock_bh(). Except for OSN, where qeth_l2_set_rx_mode() bails out +early. +Nevertheless it's best to not depend on this behaviour, and just fix +the issue at its source like all other drivers do. For instance see +commit 83a0c6e58901 ("i40e: Invoke softirqs after napi_reschedule"). + +Fixes: a1c3ed4c9ca0 ("qeth: NAPI support for l2 and l3 discipline") +Signed-off-by: Julian Wiedmann +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/s390/net/qeth_l2_main.c | 3 +++ + drivers/s390/net/qeth_l3_main.c | 3 +++ + 2 files changed, 6 insertions(+) + +diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c +index 22045e7d78ac3..97211f7f0cf02 100644 +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -996,7 +996,10 @@ static int __qeth_l2_open(struct net_device *dev) + + if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) { + napi_enable(&card->napi); ++ local_bh_disable(); + napi_schedule(&card->napi); ++ /* kick-start the NAPI softirq: */ ++ local_bh_enable(); + } else + rc = -EIO; + return rc; +diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c +index 2cc9bc1ef1e38..0d71d2e6419af 100644 +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -3031,7 +3031,10 @@ static int __qeth_l3_open(struct net_device *dev) + + if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) { + napi_enable(&card->napi); ++ local_bh_disable(); + napi_schedule(&card->napi); ++ /* kick-start the NAPI softirq: */ ++ local_bh_enable(); + } else + rc = -EIO; + return rc; +-- +2.20.1 + diff --git a/queue-4.4/scsi-libsas-always-unregister-the-old-device-if-goin.patch b/queue-4.4/scsi-libsas-always-unregister-the-old-device-if-goin.patch new file mode 100644 index 00000000000..c16445fa9c1 --- /dev/null +++ b/queue-4.4/scsi-libsas-always-unregister-the-old-device-if-goin.patch @@ -0,0 +1,61 @@ +From 85d46aa9c8684ebd64f59de7cf5f587ed1488528 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Sep 2018 10:56:52 +0800 +Subject: scsi: libsas: always unregister the old device if going to discover + new + +From: Jason Yan + +[ Upstream commit 32c850bf587f993b2620b91e5af8a64a7813f504 ] + +If we went into sas_rediscover_dev() the attached_sas_addr was already insured +not to be zero. So it's unnecessary to check if the attached_sas_addr is zero. + +And although if the sas address is not changed, we always have to unregister +the old device when we are going to register a new one. We cannot just leave +the device there and bring up the new. + +Signed-off-by: Jason Yan +CC: chenxiang +CC: John Garry +CC: Johannes Thumshirn +CC: Ewan Milne +CC: Christoph Hellwig +CC: Tomas Henzl +CC: Dan Williams +CC: Hannes Reinecke +Reviewed-by: Johannes Thumshirn +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libsas/sas_expander.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c +index 400eee9d77832..d44f18f773c0f 100644 +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -2049,14 +2049,11 @@ static int sas_rediscover_dev(struct domain_device *dev, int phy_id, bool last) + return res; + } + +- /* delete the old link */ +- if (SAS_ADDR(phy->attached_sas_addr) && +- SAS_ADDR(sas_addr) != SAS_ADDR(phy->attached_sas_addr)) { +- SAS_DPRINTK("ex %016llx phy 0x%x replace %016llx\n", +- SAS_ADDR(dev->sas_addr), phy_id, +- SAS_ADDR(phy->attached_sas_addr)); +- sas_unregister_devs_sas_addr(dev, phy_id, last); +- } ++ /* we always have to delete the old device when we went here */ ++ SAS_DPRINTK("ex %016llx phy 0x%x replace %016llx\n", ++ SAS_ADDR(dev->sas_addr), phy_id, ++ SAS_ADDR(phy->attached_sas_addr)); ++ sas_unregister_devs_sas_addr(dev, phy_id, last); + + return sas_discover_new(dev, phy_id); + } +-- +2.20.1 + diff --git a/queue-4.4/scsi-pm80xx-corrected-dma_unmap_sg-parameter.patch b/queue-4.4/scsi-pm80xx-corrected-dma_unmap_sg-parameter.patch new file mode 100644 index 00000000000..97bc5f7856b --- /dev/null +++ b/queue-4.4/scsi-pm80xx-corrected-dma_unmap_sg-parameter.patch @@ -0,0 +1,37 @@ +From 4a1e03aa68fcfd672dc6ac48dfd70514e251c331 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Sep 2018 14:18:03 +0530 +Subject: scsi: pm80xx: Corrected dma_unmap_sg() parameter + +From: Deepak Ukey + +[ Upstream commit 76cb25b058034d37244be6aca97a2ad52a5fbcad ] + +For the function dma_unmap_sg(), the parameter should be number of +elements in the scatter list prior to the mapping, not after the mapping. + +Signed-off-by: Deepak Ukey +Signed-off-by: Viswas G +Acked-by: Jack Wang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_sas.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index 949198c01ced6..ef1687f798cc1 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -463,7 +463,7 @@ err_out: + dev_printk(KERN_ERR, pm8001_ha->dev, "pm8001 exec failed[%d]!\n", rc); + if (!sas_protocol_ata(t->task_proto)) + if (n_elem) +- dma_unmap_sg(pm8001_ha->dev, t->scatter, n_elem, ++ dma_unmap_sg(pm8001_ha->dev, t->scatter, t->num_scatter, + t->data_dir); + out_done: + spin_unlock_irqrestore(&pm8001_ha->lock, flags); +-- +2.20.1 + diff --git a/queue-4.4/scsi-pm80xx-fixed-system-hang-issue-during-kexec-boo.patch b/queue-4.4/scsi-pm80xx-fixed-system-hang-issue-during-kexec-boo.patch new file mode 100644 index 00000000000..1a1f1b338e5 --- /dev/null +++ b/queue-4.4/scsi-pm80xx-fixed-system-hang-issue-during-kexec-boo.patch @@ -0,0 +1,215 @@ +From a637121d7935382aea10f5d233444efd7f16f7c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Sep 2018 14:18:04 +0530 +Subject: scsi: pm80xx: Fixed system hang issue during kexec boot + +From: Deepak Ukey + +[ Upstream commit 72349b62a571effd6faadd0600b8e657dd87afbf ] + +When the firmware is not responding, execution of kexec boot causes a system +hang. When firmware assertion happened, driver get notified with interrupt +vector updated in MPI configuration table. Then, the driver will read +scratchpad register and set controller_fatal_error flag to true. + +Signed-off-by: Deepak Ukey +Signed-off-by: Viswas G +Acked-by: Jack Wang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_hwi.c | 6 +++ + drivers/scsi/pm8001/pm8001_sas.c | 7 +++ + drivers/scsi/pm8001/pm8001_sas.h | 1 + + drivers/scsi/pm8001/pm80xx_hwi.c | 80 +++++++++++++++++++++++++++++--- + drivers/scsi/pm8001/pm80xx_hwi.h | 3 ++ + 5 files changed, 91 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c +index 04e67a190652e..b3490b4a046a2 100644 +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -1479,6 +1479,12 @@ u32 pm8001_mpi_msg_consume(struct pm8001_hba_info *pm8001_ha, + } else { + u32 producer_index; + void *pi_virt = circularQ->pi_virt; ++ /* spurious interrupt during setup if ++ * kexec-ing and driver doing a doorbell access ++ * with the pre-kexec oq interrupt setup ++ */ ++ if (!pi_virt) ++ break; + /* Update the producer index from SPC */ + producer_index = pm8001_read_32(pi_virt); + circularQ->producer_index = cpu_to_le32(producer_index); +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index ef1687f798cc1..3862d8b1defe3 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -371,6 +371,13 @@ static int pm8001_task_exec(struct sas_task *task, + return 0; + } + pm8001_ha = pm8001_find_ha_by_dev(task->dev); ++ if (pm8001_ha->controller_fatal_error) { ++ struct task_status_struct *ts = &t->task_status; ++ ++ ts->resp = SAS_TASK_UNDELIVERED; ++ t->task_done(t); ++ return 0; ++ } + PM8001_IO_DBG(pm8001_ha, pm8001_printk("pm8001_task_exec device \n ")); + spin_lock_irqsave(&pm8001_ha->lock, flags); + do { +diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h +index 6628cc38316c2..d8768ac41ebbf 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.h ++++ b/drivers/scsi/pm8001/pm8001_sas.h +@@ -531,6 +531,7 @@ struct pm8001_hba_info { + u32 logging_level; + u32 fw_status; + u32 smp_exp_mode; ++ bool controller_fatal_error; + const struct firmware *fw_image; + struct isr_param irq_vector[PM8001_MAX_MSIX_VEC]; + }; +diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c +index eb4fee61df729..9edd61c063a1a 100644 +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -572,6 +572,9 @@ static void update_main_config_table(struct pm8001_hba_info *pm8001_ha) + pm8001_ha->main_cfg_tbl.pm80xx_tbl.pcs_event_log_size); + pm8001_mw32(address, MAIN_PCS_EVENT_LOG_OPTION, + pm8001_ha->main_cfg_tbl.pm80xx_tbl.pcs_event_log_severity); ++ /* Update Fatal error interrupt vector */ ++ pm8001_ha->main_cfg_tbl.pm80xx_tbl.fatal_err_interrupt |= ++ ((pm8001_ha->number_of_intr - 1) << 8); + pm8001_mw32(address, MAIN_FATAL_ERROR_INTERRUPT, + pm8001_ha->main_cfg_tbl.pm80xx_tbl.fatal_err_interrupt); + pm8001_mw32(address, MAIN_EVENT_CRC_CHECK, +@@ -1099,6 +1102,9 @@ static int pm80xx_chip_init(struct pm8001_hba_info *pm8001_ha) + return -EBUSY; + } + ++ /* Initialize the controller fatal error flag */ ++ pm8001_ha->controller_fatal_error = false; ++ + /* Initialize pci space address eg: mpi offset */ + init_pci_device_addresses(pm8001_ha); + init_default_table_values(pm8001_ha); +@@ -1207,13 +1213,17 @@ pm80xx_chip_soft_rst(struct pm8001_hba_info *pm8001_ha) + u32 bootloader_state; + u32 ibutton0, ibutton1; + +- /* Check if MPI is in ready state to reset */ +- if (mpi_uninit_check(pm8001_ha) != 0) { +- PM8001_FAIL_DBG(pm8001_ha, +- pm8001_printk("MPI state is not ready\n")); +- return -1; ++ /* Process MPI table uninitialization only if FW is ready */ ++ if (!pm8001_ha->controller_fatal_error) { ++ /* Check if MPI is in ready state to reset */ ++ if (mpi_uninit_check(pm8001_ha) != 0) { ++ regval = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1); ++ PM8001_FAIL_DBG(pm8001_ha, pm8001_printk( ++ "MPI state is not ready scratch1 :0x%x\n", ++ regval)); ++ return -1; ++ } + } +- + /* checked for reset register normal state; 0x0 */ + regval = pm8001_cr32(pm8001_ha, 0, SPC_REG_SOFT_RESET); + PM8001_INIT_DBG(pm8001_ha, +@@ -3717,6 +3727,46 @@ static void process_one_iomb(struct pm8001_hba_info *pm8001_ha, void *piomb) + } + } + ++static void print_scratchpad_registers(struct pm8001_hba_info *pm8001_ha) ++{ ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_SCRATCH_PAD_0: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_0))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_SCRATCH_PAD_1:0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_SCRATCH_PAD_2: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_2))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_SCRATCH_PAD_3: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_3))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_0: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_0))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_1: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_1))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_2: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_2))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_3: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_3))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_4: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_4))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_5: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_5))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_RSVD_SCRATCH_PAD_0: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_6))); ++ PM8001_FAIL_DBG(pm8001_ha, ++ pm8001_printk("MSGU_RSVD_SCRATCH_PAD_1: 0x%x\n", ++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_7))); ++} ++ + static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec) + { + struct outbound_queue_table *circularQ; +@@ -3724,10 +3774,28 @@ static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec) + u8 uninitialized_var(bc); + u32 ret = MPI_IO_STATUS_FAIL; + unsigned long flags; ++ u32 regval; + ++ if (vec == (pm8001_ha->number_of_intr - 1)) { ++ regval = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1); ++ if ((regval & SCRATCH_PAD_MIPSALL_READY) != ++ SCRATCH_PAD_MIPSALL_READY) { ++ pm8001_ha->controller_fatal_error = true; ++ PM8001_FAIL_DBG(pm8001_ha, pm8001_printk( ++ "Firmware Fatal error! Regval:0x%x\n", regval)); ++ print_scratchpad_registers(pm8001_ha); ++ return ret; ++ } ++ } + spin_lock_irqsave(&pm8001_ha->lock, flags); + circularQ = &pm8001_ha->outbnd_q_tbl[vec]; + do { ++ /* spurious interrupt during setup if kexec-ing and ++ * driver doing a doorbell access w/ the pre-kexec oq ++ * interrupt setup. ++ */ ++ if (!circularQ->pi_virt) ++ break; + ret = pm8001_mpi_msg_consume(pm8001_ha, circularQ, &pMsg1, &bc); + if (MPI_IO_STATUS_SUCCESS == ret) { + /* process the outbound message */ +diff --git a/drivers/scsi/pm8001/pm80xx_hwi.h b/drivers/scsi/pm8001/pm80xx_hwi.h +index 7a443bad61634..411b414a9a0ef 100644 +--- a/drivers/scsi/pm8001/pm80xx_hwi.h ++++ b/drivers/scsi/pm8001/pm80xx_hwi.h +@@ -1288,6 +1288,9 @@ typedef struct SASProtocolTimerConfig SASProtocolTimerConfig_t; + #define SCRATCH_PAD_BOOT_LOAD_SUCCESS 0x0 + #define SCRATCH_PAD_IOP0_READY 0xC00 + #define SCRATCH_PAD_IOP1_READY 0x3000 ++#define SCRATCH_PAD_MIPSALL_READY (SCRATCH_PAD_IOP1_READY | \ ++ SCRATCH_PAD_IOP0_READY | \ ++ SCRATCH_PAD_RAAE_READY) + + /* boot loader state */ + #define SCRATCH_PAD1_BOOTSTATE_MASK 0x70 /* Bit 4-6 */ +-- +2.20.1 + diff --git a/queue-4.4/scsi-sym53c8xx-fix-null-pointer-dereference-panic-in.patch b/queue-4.4/scsi-sym53c8xx-fix-null-pointer-dereference-panic-in.patch new file mode 100644 index 00000000000..c857b517fa2 --- /dev/null +++ b/queue-4.4/scsi-sym53c8xx-fix-null-pointer-dereference-panic-in.patch @@ -0,0 +1,79 @@ +From 6c218d98e35191a9535bebe777e7233a8ba842f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Aug 2018 11:38:16 -0400 +Subject: scsi: sym53c8xx: fix NULL pointer dereference panic in sym_int_sir() + +From: George Kennedy + +[ Upstream commit 288315e95264b6355e26609e9dec5dc4563d4ab0 ] + +sym_int_sir() in sym_hipd.c does not check the command pointer for NULL before +using it in debug message prints. + +Suggested-by: Matthew Wilcox +Signed-off-by: George Kennedy +Reviewed-by: Mark Kanda +Acked-by: Matthew Wilcox +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/sym53c8xx_2/sym_hipd.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c +index c6425e3df5a04..f1c7714377524 100644 +--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c ++++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c +@@ -4371,6 +4371,13 @@ static void sym_nego_rejected(struct sym_hcb *np, struct sym_tcb *tp, struct sym + OUTB(np, HS_PRT, HS_BUSY); + } + ++#define sym_printk(lvl, tp, cp, fmt, v...) do { \ ++ if (cp) \ ++ scmd_printk(lvl, cp->cmd, fmt, ##v); \ ++ else \ ++ starget_printk(lvl, tp->starget, fmt, ##v); \ ++} while (0) ++ + /* + * chip exception handler for programmed interrupts. + */ +@@ -4416,7 +4423,7 @@ static void sym_int_sir(struct sym_hcb *np) + * been selected with ATN. We do not want to handle that. + */ + case SIR_SEL_ATN_NO_MSG_OUT: +- scmd_printk(KERN_WARNING, cp->cmd, ++ sym_printk(KERN_WARNING, tp, cp, + "No MSG OUT phase after selection with ATN\n"); + goto out_stuck; + /* +@@ -4424,7 +4431,7 @@ static void sym_int_sir(struct sym_hcb *np) + * having reselected the initiator. + */ + case SIR_RESEL_NO_MSG_IN: +- scmd_printk(KERN_WARNING, cp->cmd, ++ sym_printk(KERN_WARNING, tp, cp, + "No MSG IN phase after reselection\n"); + goto out_stuck; + /* +@@ -4432,7 +4439,7 @@ static void sym_int_sir(struct sym_hcb *np) + * an IDENTIFY. + */ + case SIR_RESEL_NO_IDENTIFY: +- scmd_printk(KERN_WARNING, cp->cmd, ++ sym_printk(KERN_WARNING, tp, cp, + "No IDENTIFY after reselection\n"); + goto out_stuck; + /* +@@ -4461,7 +4468,7 @@ static void sym_int_sir(struct sym_hcb *np) + case SIR_RESEL_ABORTED: + np->lastmsg = np->msgout[0]; + np->msgout[0] = M_NOOP; +- scmd_printk(KERN_WARNING, cp->cmd, ++ sym_printk(KERN_WARNING, tp, cp, + "message %x sent on bad reselection\n", np->lastmsg); + goto out; + /* +-- +2.20.1 + diff --git a/queue-4.4/serial-mxs-auart-fix-potential-infinite-loop.patch b/queue-4.4/serial-mxs-auart-fix-potential-infinite-loop.patch new file mode 100644 index 00000000000..d53926e31d3 --- /dev/null +++ b/queue-4.4/serial-mxs-auart-fix-potential-infinite-loop.patch @@ -0,0 +1,48 @@ +From 298e2da76539c18c8172ca92bad83a5b7748cdc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Aug 2018 13:59:05 +0300 +Subject: serial: mxs-auart: Fix potential infinite loop +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Anton Vasilyev + +[ Upstream commit 5963e8a3122471cadfe0eba41c4ceaeaa5c8bb4d ] + +On the error path of mxs_auart_request_gpio_irq() is performed +backward iterating with index i of enum type. Underline enum type +may be unsigned char. In this case check (--i >= 0) will be always +true and error handling goes into infinite loop. + +The patch changes the check so that it is valid for signed and unsigned +types. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Anton Vasilyev +Acked-by: Uwe Kleine-König +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/mxs-auart.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c +index daa4a65ef6ffc..fe870170db74a 100644 +--- a/drivers/tty/serial/mxs-auart.c ++++ b/drivers/tty/serial/mxs-auart.c +@@ -1248,8 +1248,9 @@ static int mxs_auart_request_gpio_irq(struct mxs_auart_port *s) + + /* + * If something went wrong, rollback. ++ * Be careful: i may be unsigned. + */ +- while (err && (--i >= 0)) ++ while (err && (i-- > 0)) + if (irq[i] >= 0) + free_irq(irq[i], s); + +-- +2.20.1 + diff --git a/queue-4.4/series b/queue-4.4/series index a1c86b27a8c..7785c0a4ba9 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -10,3 +10,87 @@ iommu-vt-d-fix-qi_dev_iotlb_pfsid-and-qi_dev_eiotlb_pfsid-macros.patch mm-memcg-switch-to-css_tryget-in-get_mem_cgroup_from_mm.patch mm-hugetlb-switch-to-css_tryget-in-hugetlb_cgroup_charge_cgroup.patch mmc-sdhci-of-at91-fix-quirk2-overwrite.patch +iio-dac-mcp4922-fix-error-handling-in-mcp4922_write_.patch +alsa-pcm-signedness-bug-in-snd_pcm_plug_alloc.patch +arm-dts-at91-trivial-fix-usart1-definition-for-at91s.patch +alsa-seq-do-error-checks-at-creating-system-ports.patch +gfs2-don-t-set-gfs2_rdf_uptodate-when-the-lvb-is-upd.patch +asoc-dpcm-properly-initialise-hw-rate_max.patch +mips-bcm47xx-enable-usb-power-on-netgear-wndr3400v3.patch +arm-dts-exynos-fix-sound-in-snow-rev5-chromebook.patch +i40e-use-correct-length-for-strncpy.patch +i40e-hold-the-rtnl-lock-on-clearing-interrupt-scheme.patch +i40e-prevent-deleting-mac-address-from-vf-when-set-b.patch +arm-dts-pxa-fix-power-i2c-base-address.patch +rtl8187-fix-warning-generated-when-strncpy-destinati.patch +net-lan78xx-bail-out-if-lan78xx_get_endpoints-fails.patch +asoc-sgtl5000-avoid-division-by-zero-if-lo_vag-is-ze.patch +arm-dts-exynos-disable-pull-control-for-s5m8767-pmic.patch +ath10k-wmi-disable-softirq-s-while-calling-ieee80211.patch +mips-txx9-fix-iounmap-related-issue.patch +of-make-powermac-cache-node-search-conditional-on-co.patch +arm-dts-omap3-gta04-give-spi_lcd-node-a-label-so-tha.patch +arm-dts-omap3-gta04-tvout-enable-as-display1-alias.patch +arm-dts-omap3-gta04-make-nand-partitions-compatible-.patch +arm-dts-omap3-gta04-keep-vpll2-always-on.patch +dmaengine-dma-jz4780-further-residue-status-fix.patch +signal-always-ignore-sigkill-and-sigstop-sent-to-the.patch +signal-properly-deliver-sigill-from-uprobes.patch +signal-properly-deliver-sigsegv-from-x86-uprobes.patch +scsi-sym53c8xx-fix-null-pointer-dereference-panic-in.patch +arm-imx6-register-pm_power_off-handler-if-fsl-pmic-s.patch +scsi-pm80xx-corrected-dma_unmap_sg-parameter.patch +scsi-pm80xx-fixed-system-hang-issue-during-kexec-boo.patch +kprobes-don-t-call-bug_on-if-there-is-a-kprobe-in-us.patch +nvmem-core-return-error-code-instead-of-null-from-nv.patch +media-fix-media-pci-meye-validate-offset-to-avoid-ar.patch +alsa-intel8x0m-register-irq-handler-after-register-i.patch +pinctrl-at91-pio4-fix-has_config-check-in-atmel_pctl.patch +llc-avoid-blocking-in-llc_sap_close.patch +powerpc-vdso-correct-call-frame-information.patch +arm-dts-socfpga-fix-i2c-bus-unit-address-error.patch +pinctrl-at91-don-t-use-the-same-irqchip-with-multipl.patch +cxgb4-fix-endianness-issue-in-t4_fwcache.patch +power-supply-ab8500_fg-silence-uninitialized-variabl.patch +power-supply-max8998-charger-fix-platform-data-retri.patch +kernfs-fix-range-checks-in-kernfs_get_target_path.patch +s390-qeth-invoke-softirqs-after-napi_schedule.patch +pci-acpi-correct-error-message-for-aspm-disabling.patch +serial-mxs-auart-fix-potential-infinite-loop.patch +powerpc-iommu-avoid-derefence-before-pointer-check.patch +powerpc-64s-hash-fix-stab_rr-off-by-one-initializati.patch +powerpc-pseries-disable-cpu-hotplug-across-migration.patch +libfdt-ensure-int_max-is-defined-in-libfdt_env.h.patch +power-supply-twl4030_charger-fix-charging-current-ou.patch +power-supply-twl4030_charger-disable-eoc-interrupt-o.patch +net-toshiba-fix-return-type-of-ndo_start_xmit-functi.patch +net-xilinx-fix-return-type-of-ndo_start_xmit-functio.patch +net-broadcom-fix-return-type-of-ndo_start_xmit-funct.patch +net-amd-fix-return-type-of-ndo_start_xmit-function.patch +usb-chipidea-fix-otg-event-handler.patch +arm-dts-am335x-evm-fix-number-of-cpsw.patch +arm-dts-ux500-correct-scu-unit-address.patch +arm-dts-ux500-fix-lcda-clock-line-muxing.patch +arm-dts-ste-fix-spi-controller-node-names.patch +cpufeature-avoid-warning-when-compiling-with-clang.patch +bnx2x-ignore-bandwidth-attention-in-single-function-.patch +net-micrel-fix-return-type-of-ndo_start_xmit-functio.patch +x86-cpu-use-correct-macros-for-cyrix-calls.patch +mips-kexec-relax-memory-restriction.patch +media-pci-ivtv-fix-a-sleep-in-atomic-context-bug-in-.patch +media-davinci-fix-implicit-enum-conversion-warning.patch +usb-gadget-uvc-configfs-drop-leaked-references-to-co.patch +usb-gadget-uvc-configfs-prevent-format-changes-after.patch +usb-gadget-uvc-factor-out-video-usb-request-queueing.patch +usb-gadget-uvc-only-halt-video-streaming-endpoint-in.patch +misc-kgdbts-fix-restrict-error.patch +misc-genwqe-should-return-proper-error-value.patch +vfio-pci-fix-potential-memory-leak-in-vfio_msi_cap_l.patch +scsi-libsas-always-unregister-the-old-device-if-goin.patch +arm-dts-tegra30-fix-xcvr-setup-use-fuses.patch +arm-tegra-apalis_t30-fix-mmc1-cmd-pull-up.patch +net-smsc-fix-return-type-of-ndo_start_xmit-function.patch +edac-raise-the-maximum-number-of-memory-controllers.patch +bluetooth-l2cap-detect-if-remote-is-not-able-to-use-.patch +arm64-dts-amd-fix-spi-bus-warnings.patch +fuse-use-read_once-on-congestion_threshold-and-max_b.patch diff --git a/queue-4.4/signal-always-ignore-sigkill-and-sigstop-sent-to-the.patch b/queue-4.4/signal-always-ignore-sigkill-and-sigstop-sent-to-the.patch new file mode 100644 index 00000000000..29a829c65aa --- /dev/null +++ b/queue-4.4/signal-always-ignore-sigkill-and-sigstop-sent-to-the.patch @@ -0,0 +1,44 @@ +From 677405236fe32f244dad5d0963eaa584cd84326f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jul 2018 19:47:27 -0500 +Subject: signal: Always ignore SIGKILL and SIGSTOP sent to the global init + +From: Eric W. Biederman + +[ Upstream commit 86989c41b5ea08776c450cb759592532314a4ed6 ] + +If the first process started (aka /sbin/init) receives a SIGKILL it +will panic the system if it is delivered. Making the system unusable +and undebugable. It isn't much better if the first process started +receives SIGSTOP. + +So always ignore SIGSTOP and SIGKILL sent to init. + +This is done in a separate clause in sig_task_ignored as force_sig_info +can clear SIG_UNKILLABLE and this protection should work even then. + +Reviewed-by: Thomas Gleixner +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Sasha Levin +--- + kernel/signal.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/kernel/signal.c b/kernel/signal.c +index 072fd152ab01e..3095b2309876d 100644 +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -71,6 +71,10 @@ static int sig_task_ignored(struct task_struct *t, int sig, bool force) + + handler = sig_handler(t, sig); + ++ /* SIGKILL and SIGSTOP may not be sent to the global init */ ++ if (unlikely(is_global_init(t) && sig_kernel_only(sig))) ++ return true; ++ + if (unlikely(t->signal->flags & SIGNAL_UNKILLABLE) && + handler == SIG_DFL && !(force && sig_kernel_only(sig))) + return 1; +-- +2.20.1 + diff --git a/queue-4.4/signal-properly-deliver-sigill-from-uprobes.patch b/queue-4.4/signal-properly-deliver-sigill-from-uprobes.patch new file mode 100644 index 00000000000..db5a68bbc7d --- /dev/null +++ b/queue-4.4/signal-properly-deliver-sigill-from-uprobes.patch @@ -0,0 +1,55 @@ +From eaa55c5ede9ee9d38d939b657cd6fc15df1d05c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jul 2018 20:33:53 -0500 +Subject: signal: Properly deliver SIGILL from uprobes + +From: Eric W. Biederman + +[ Upstream commit 55a3235fc71bf34303e34a95eeee235b2d2a35dd ] + +For userspace to tell the difference between a random signal and an +exception, the exception must include siginfo information. + +Using SEND_SIG_FORCED for SIGILL is thus wrong, and it will result +in userspace seeing si_code == SI_USER (like a random signal) instead +of si_code == SI_KERNEL or a more specific si_code as all exceptions +deliver. + +Therefore replace force_sig_info(SIGILL, SEND_SIG_FORCE, current) +with force_sig(SIG_ILL, current) which gets this right and is +shorter and easier to type. + +Fixes: 014940bad8e4 ("uprobes/x86: Send SIGILL if arch_uprobe_post_xol() fails") +Fixes: 0b5256c7f173 ("uprobes: Send SIGILL if handle_trampoline() fails") +Reviewed-by: Thomas Gleixner +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Sasha Levin +--- + kernel/events/uprobes.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c +index aad43c88a6685..8cad3cd92e23e 100644 +--- a/kernel/events/uprobes.c ++++ b/kernel/events/uprobes.c +@@ -1836,7 +1836,7 @@ static void handle_trampoline(struct pt_regs *regs) + + sigill: + uprobe_warn(current, "handle uretprobe, sending SIGILL."); +- force_sig_info(SIGILL, SEND_SIG_FORCED, current); ++ force_sig(SIGILL, current); + + } + +@@ -1952,7 +1952,7 @@ static void handle_singlestep(struct uprobe_task *utask, struct pt_regs *regs) + + if (unlikely(err)) { + uprobe_warn(current, "execute the probed insn, sending SIGILL."); +- force_sig_info(SIGILL, SEND_SIG_FORCED, current); ++ force_sig(SIGILL, current); + } + } + +-- +2.20.1 + diff --git a/queue-4.4/signal-properly-deliver-sigsegv-from-x86-uprobes.patch b/queue-4.4/signal-properly-deliver-sigsegv-from-x86-uprobes.patch new file mode 100644 index 00000000000..8617aae57dd --- /dev/null +++ b/queue-4.4/signal-properly-deliver-sigsegv-from-x86-uprobes.patch @@ -0,0 +1,45 @@ +From 55239b75d6298b59900bfe1008a99e98a264e245 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jul 2018 20:48:30 -0500 +Subject: signal: Properly deliver SIGSEGV from x86 uprobes + +From: Eric W. Biederman + +[ Upstream commit 4a63c1ffd384ebdce40aac9c997dab68379137be ] + +For userspace to tell the difference between an random signal +and an exception, the exception must include siginfo information. + +Using SEND_SIG_FORCED for SIGSEGV is thus wrong, and it will result in +userspace seeing si_code == SI_USER (like a random signal) instead of +si_code == SI_KERNEL or a more specific si_code as all exceptions +deliver. + +Therefore replace force_sig_info(SIGSEGV, SEND_SIG_FORCE, current) +with force_sig(SIG_SEGV, current) which gets this right and is shorter +and easier to type. + +Fixes: 791eca10107f ("uretprobes/x86: Hijack return address") +Reviewed-by: Thomas Gleixner +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/uprobes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c +index 178d63cac321b..60b12c14cf6fb 100644 +--- a/arch/x86/kernel/uprobes.c ++++ b/arch/x86/kernel/uprobes.c +@@ -983,7 +983,7 @@ arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs + pr_err("uprobe: return address clobbered: pid=%d, %%sp=%#lx, " + "%%ip=%#lx\n", current->pid, regs->sp, regs->ip); + +- force_sig_info(SIGSEGV, SEND_SIG_FORCED, current); ++ force_sig(SIGSEGV, current); + } + + return -1; +-- +2.20.1 + diff --git a/queue-4.4/usb-chipidea-fix-otg-event-handler.patch b/queue-4.4/usb-chipidea-fix-otg-event-handler.patch new file mode 100644 index 00000000000..375d1320187 --- /dev/null +++ b/queue-4.4/usb-chipidea-fix-otg-event-handler.patch @@ -0,0 +1,48 @@ +From d2156ae6710a90985bcc81df7b15273518583e80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Sep 2018 17:18:58 +0200 +Subject: usb: chipidea: Fix otg event handler + +From: Loic Poulain + +[ Upstream commit 59739131e0ca06db7560f9073fff2fb83f6bc2a5 ] + +At OTG work running time, it's possible that several events need to be +addressed (e.g. ID and VBUS events). The current implementation handles +only one event at a time which leads to ignoring the other one. Fix it. + +Signed-off-by: Loic Poulain +Signed-off-by: Peter Chen +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/otg.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c +index f36a1ac3bfbdf..b8650210be0f7 100644 +--- a/drivers/usb/chipidea/otg.c ++++ b/drivers/usb/chipidea/otg.c +@@ -206,14 +206,17 @@ static void ci_otg_work(struct work_struct *work) + } + + pm_runtime_get_sync(ci->dev); ++ + if (ci->id_event) { + ci->id_event = false; + ci_handle_id_switch(ci); +- } else if (ci->b_sess_valid_event) { ++ } ++ ++ if (ci->b_sess_valid_event) { + ci->b_sess_valid_event = false; + ci_handle_vbus_change(ci); +- } else +- dev_err(ci->dev, "unexpected event occurs at %s\n", __func__); ++ } ++ + pm_runtime_put_sync(ci->dev); + + enable_irq(ci->irq); +-- +2.20.1 + diff --git a/queue-4.4/usb-gadget-uvc-configfs-drop-leaked-references-to-co.patch b/queue-4.4/usb-gadget-uvc-configfs-drop-leaked-references-to-co.patch new file mode 100644 index 00000000000..e005ddb8069 --- /dev/null +++ b/queue-4.4/usb-gadget-uvc-configfs-drop-leaked-references-to-co.patch @@ -0,0 +1,59 @@ +From ab4d9b083d8d50ac120719fba60c959bf7aaea22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Aug 2018 00:14:00 +0300 +Subject: usb: gadget: uvc: configfs: Drop leaked references to config items + +From: Laurent Pinchart + +[ Upstream commit 86f3daed59bceb4fa7981d85e89f63ebbae1d561 ] + +Some of the .allow_link() and .drop_link() operations implementations +call config_group_find_item() and then leak the reference to the +returned item. Fix this by dropping those references where needed. + +Signed-off-by: Laurent Pinchart +Reviewed-by: Kieran Bingham +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/uvc_configfs.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c +index 01656f1c6d650..74df80a25b469 100644 +--- a/drivers/usb/gadget/function/uvc_configfs.c ++++ b/drivers/usb/gadget/function/uvc_configfs.c +@@ -564,6 +564,7 @@ static int uvcg_control_class_allow_link(struct config_item *src, + unlock: + mutex_unlock(&opts->lock); + out: ++ config_item_put(header); + mutex_unlock(su_mutex); + return ret; + } +@@ -605,6 +606,7 @@ static int uvcg_control_class_drop_link(struct config_item *src, + unlock: + mutex_unlock(&opts->lock); + out: ++ config_item_put(header); + mutex_unlock(su_mutex); + return ret; + } +@@ -2087,6 +2089,7 @@ static int uvcg_streaming_class_allow_link(struct config_item *src, + unlock: + mutex_unlock(&opts->lock); + out: ++ config_item_put(header); + mutex_unlock(su_mutex); + return ret; + } +@@ -2131,6 +2134,7 @@ static int uvcg_streaming_class_drop_link(struct config_item *src, + unlock: + mutex_unlock(&opts->lock); + out: ++ config_item_put(header); + mutex_unlock(su_mutex); + return ret; + } +-- +2.20.1 + diff --git a/queue-4.4/usb-gadget-uvc-configfs-prevent-format-changes-after.patch b/queue-4.4/usb-gadget-uvc-configfs-prevent-format-changes-after.patch new file mode 100644 index 00000000000..a70cca54db6 --- /dev/null +++ b/queue-4.4/usb-gadget-uvc-configfs-prevent-format-changes-after.patch @@ -0,0 +1,47 @@ +From ffb5ef096d08c04362ac5927778193cecea93de9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 May 2018 21:02:12 +0200 +Subject: usb: gadget: uvc: configfs: Prevent format changes after linking + header + +From: Joel Pepper + +[ Upstream commit cb2200f7af8341aaf0c6abd7ba37e4c667c41639 ] + +While checks are in place to avoid attributes and children of a format +being manipulated after the format is linked into the streaming header, +the linked flag was never actually set, invalidating the protections. +Update the flag as appropriate in the header link calls. + +Signed-off-by: Joel Pepper +Reviewed-by: Kieran Bingham +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/uvc_configfs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c +index 74df80a25b469..a49ff1f5c0f93 100644 +--- a/drivers/usb/gadget/function/uvc_configfs.c ++++ b/drivers/usb/gadget/function/uvc_configfs.c +@@ -807,6 +807,7 @@ static int uvcg_streaming_header_allow_link(struct config_item *src, + format_ptr->fmt = target_fmt; + list_add_tail(&format_ptr->entry, &src_hdr->formats); + ++src_hdr->num_fmt; ++ ++target_fmt->linked; + + out: + mutex_unlock(&opts->lock); +@@ -845,6 +846,8 @@ static int uvcg_streaming_header_drop_link(struct config_item *src, + break; + } + ++ --target_fmt->linked; ++ + out: + mutex_unlock(&opts->lock); + mutex_unlock(su_mutex); +-- +2.20.1 + diff --git a/queue-4.4/usb-gadget-uvc-factor-out-video-usb-request-queueing.patch b/queue-4.4/usb-gadget-uvc-factor-out-video-usb-request-queueing.patch new file mode 100644 index 00000000000..ea3d777fc18 --- /dev/null +++ b/queue-4.4/usb-gadget-uvc-factor-out-video-usb-request-queueing.patch @@ -0,0 +1,87 @@ +From 1cfb8255334c17911897fb31e2ee114f89466f14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Aug 2018 15:42:03 +0300 +Subject: usb: gadget: uvc: Factor out video USB request queueing + +From: Laurent Pinchart + +[ Upstream commit 9d1ff5dcb3cd3390b1e56f1c24ae42c72257c4a3 ] + +USB requests for video data are queued from two different locations in +the driver, with the same code block occurring twice. Factor it out to a +function. + +Signed-off-by: Laurent Pinchart +Reviewed-by: Paul Elder +Tested-by: Paul Elder +Reviewed-by: Kieran Bingham +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/uvc_video.c | 30 ++++++++++++++++--------- + 1 file changed, 20 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c +index 0f01c04d7cbd8..540917f54506a 100644 +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -129,6 +129,19 @@ uvc_video_encode_isoc(struct usb_request *req, struct uvc_video *video, + * Request handling + */ + ++static int uvcg_video_ep_queue(struct uvc_video *video, struct usb_request *req) ++{ ++ int ret; ++ ++ ret = usb_ep_queue(video->ep, req, GFP_ATOMIC); ++ if (ret < 0) { ++ printk(KERN_INFO "Failed to queue request (%d).\n", ret); ++ usb_ep_set_halt(video->ep); ++ } ++ ++ return ret; ++} ++ + /* + * I somehow feel that synchronisation won't be easy to achieve here. We have + * three events that control USB requests submission: +@@ -193,14 +206,13 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req) + + video->encode(req, video, buf); + +- if ((ret = usb_ep_queue(ep, req, GFP_ATOMIC)) < 0) { +- printk(KERN_INFO "Failed to queue request (%d).\n", ret); +- usb_ep_set_halt(ep); +- spin_unlock_irqrestore(&video->queue.irqlock, flags); ++ ret = uvcg_video_ep_queue(video, req); ++ spin_unlock_irqrestore(&video->queue.irqlock, flags); ++ ++ if (ret < 0) { + uvcg_queue_cancel(queue, 0); + goto requeue; + } +- spin_unlock_irqrestore(&video->queue.irqlock, flags); + + return; + +@@ -320,15 +332,13 @@ int uvcg_video_pump(struct uvc_video *video) + video->encode(req, video, buf); + + /* Queue the USB request */ +- ret = usb_ep_queue(video->ep, req, GFP_ATOMIC); ++ ret = uvcg_video_ep_queue(video, req); ++ spin_unlock_irqrestore(&queue->irqlock, flags); ++ + if (ret < 0) { +- printk(KERN_INFO "Failed to queue request (%d)\n", ret); +- usb_ep_set_halt(video->ep); +- spin_unlock_irqrestore(&queue->irqlock, flags); + uvcg_queue_cancel(queue, 0); + break; + } +- spin_unlock_irqrestore(&queue->irqlock, flags); + } + + spin_lock_irqsave(&video->req_lock, flags); +-- +2.20.1 + diff --git a/queue-4.4/usb-gadget-uvc-only-halt-video-streaming-endpoint-in.patch b/queue-4.4/usb-gadget-uvc-only-halt-video-streaming-endpoint-in.patch new file mode 100644 index 00000000000..f206a681152 --- /dev/null +++ b/queue-4.4/usb-gadget-uvc-only-halt-video-streaming-endpoint-in.patch @@ -0,0 +1,44 @@ +From f0cb00592528e85a2364835ce08ac4033ae7f5ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Aug 2018 15:44:57 +0300 +Subject: usb: gadget: uvc: Only halt video streaming endpoint in bulk mode + +From: Laurent Pinchart + +[ Upstream commit 8dbf9c7abefd5c1434a956d5c6b25e11183061a3 ] + +When USB requests for video data fail to be submitted, the driver +signals a problem to the host by halting the video streaming endpoint. +This is only valid in bulk mode, as isochronous transfers have no +handshake phase and can't thus report a stall. The usb_ep_set_halt() +call returns an error when using isochronous endpoints, which we happily +ignore, but some UDCs complain in the kernel log. Fix this by only +trying to halt the endpoint in bulk mode. + +Signed-off-by: Laurent Pinchart +Reviewed-by: Paul Elder +Tested-by: Paul Elder +Reviewed-by: Kieran Bingham +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/uvc_video.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c +index 540917f54506a..d6bab12b0b47d 100644 +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -136,7 +136,9 @@ static int uvcg_video_ep_queue(struct uvc_video *video, struct usb_request *req) + ret = usb_ep_queue(video->ep, req, GFP_ATOMIC); + if (ret < 0) { + printk(KERN_INFO "Failed to queue request (%d).\n", ret); +- usb_ep_set_halt(video->ep); ++ /* Isochronous endpoints can't be halted. */ ++ if (usb_endpoint_xfer_bulk(video->ep->desc)) ++ usb_ep_set_halt(video->ep); + } + + return ret; +-- +2.20.1 + diff --git a/queue-4.4/vfio-pci-fix-potential-memory-leak-in-vfio_msi_cap_l.patch b/queue-4.4/vfio-pci-fix-potential-memory-leak-in-vfio_msi_cap_l.patch new file mode 100644 index 00000000000..e7a6385ce9c --- /dev/null +++ b/queue-4.4/vfio-pci-fix-potential-memory-leak-in-vfio_msi_cap_l.patch @@ -0,0 +1,38 @@ +From 7dd5d4e60e8a06487b3870c4e4994668475d7f21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Sep 2018 13:01:27 -0600 +Subject: vfio/pci: Fix potential memory leak in vfio_msi_cap_len + +From: Li Qiang + +[ Upstream commit 30ea32ab1951c80c6113f300fce2c70cd12659e4 ] + +Free allocated vdev->msi_perm in error path. + +Signed-off-by: Li Qiang +Reviewed-by: Eric Auger +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/vfio_pci_config.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c +index c55c632a3b249..ad5929fbceb16 100644 +--- a/drivers/vfio/pci/vfio_pci_config.c ++++ b/drivers/vfio/pci/vfio_pci_config.c +@@ -1130,8 +1130,10 @@ static int vfio_msi_cap_len(struct vfio_pci_device *vdev, u8 pos) + return -ENOMEM; + + ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); +- if (ret) ++ if (ret) { ++ kfree(vdev->msi_perm); + return ret; ++ } + + return len; + } +-- +2.20.1 + diff --git a/queue-4.4/x86-cpu-use-correct-macros-for-cyrix-calls.patch b/queue-4.4/x86-cpu-use-correct-macros-for-cyrix-calls.patch new file mode 100644 index 00000000000..223604ac93d --- /dev/null +++ b/queue-4.4/x86-cpu-use-correct-macros-for-cyrix-calls.patch @@ -0,0 +1,67 @@ +From 1ff2f218e37531ff9ebb2ec1e3854f104961ecb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Sep 2018 17:20:40 -0400 +Subject: x86/CPU: Use correct macros for Cyrix calls + +From: Matthew Whitehead + +[ Upstream commit 03b099bdcdf7125d4a63dc9ddeefdd454e05123d ] + +There are comments in processor-cyrix.h advising you to _not_ make calls +using the deprecated macros in this style: + + setCx86_old(CX86_CCR4, getCx86_old(CX86_CCR4) | 0x80); + +This is because it expands the macro into a non-functioning calling +sequence. The calling order must be: + + outb(CX86_CCR2, 0x22); + inb(0x23); + +From the comments: + + * When using the old macros a line like + * setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x88); + * gets expanded to: + * do { + * outb((CX86_CCR2), 0x22); + * outb((({ + * outb((CX86_CCR2), 0x22); + * inb(0x23); + * }) | 0x88), 0x23); + * } while (0); + +The new macros fix this problem, so use them instead. + +Signed-off-by: Matthew Whitehead +Signed-off-by: Borislav Petkov +Reviewed-by: Andy Lutomirski +Cc: Greg Kroah-Hartman +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: Jia Zhang +Cc: Peter Zijlstra +Cc: Philippe Ombredanne +Cc: Thomas Gleixner +Link: http://lkml.kernel.org/r/20180921212041.13096-2-tedheadster@gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/cyrix.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c +index 6e4e4191abb56..151625a83d9e2 100644 +--- a/arch/x86/kernel/cpu/cyrix.c ++++ b/arch/x86/kernel/cpu/cyrix.c +@@ -433,7 +433,7 @@ static void cyrix_identify(struct cpuinfo_x86 *c) + /* enable MAPEN */ + setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10); + /* enable cpuid */ +- setCx86_old(CX86_CCR4, getCx86_old(CX86_CCR4) | 0x80); ++ setCx86(CX86_CCR4, getCx86(CX86_CCR4) | 0x80); + /* disable MAPEN */ + setCx86(CX86_CCR3, ccr3); + local_irq_restore(flags); +-- +2.20.1 +