From: Greg Kroah-Hartman Date: Fri, 16 Mar 2018 14:44:53 +0000 (+0100) Subject: 4.14-stable patches X-Git-Tag: v3.18.100~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fee2093ba8d7012a3623e4138a073d575289aed4;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: agp-intel-flush-all-chipset-writes-after-updating-the-ggtt.patch arm-dts-am335x-pepper-fix-the-audio-codec-s-reset-pin.patch arm-dts-exynos-correct-trats2-panel-reset-line.patch arm-dts-koelsch-move-cec_clock-to-root-node.patch arm-dts-omap3-n900-fix-the-audio-codec-s-reset-pin.patch arm64-dts-renesas-salvator-common-add-ethernetavb-phy-reset.patch asoc-nuc900-fix-a-loop-timeout-test.patch ath10k-fix-invalid-sts_cap_offset_mask.patch ath10k-update-tdls-teardown-state-to-target.patch bnxt_en-don-t-print-link-speed-1-no-longer-supported-messages.patch clk-meson-gxbb-fix-wrong-clock-for-saradc-sana.patch clk-qcom-msm8916-fix-mnd_width-for-codec_digcodec.patch clk-ti-clkctrl-add-support-for-retrying-failed-init.patch cpufreq-fix-governor-module-removal-race.patch crypto-caam-qi-use-correct-print-specifier-for-size_t.patch crypto-cavium-fix-memory-leak-on-info.patch crypto-ecc-fix-null-pointer-deref.-on-no-default_rng.patch dm-raid-fix-raid-set-size-revalidation.patch dma-buf-fence-fix-lock-inversion-within-dma-fence-array.patch dmaengine-amba-pl08x-use-vchan_terminate_vdesc-instead-of-desc_free.patch dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch dmaengine-qcom_hidma-check-pending-interrupts.patch drm-amdgpu-fix-get_max_engine_clock_in_mhz.patch drm-amdgpu-fix-random-missing-of-flr-notify.patch drm-amdgpu-fix-virtual-dce-bug.patch drm-amdkfd-fix-memory-leaks-in-kfd-topology.patch drm-edid-set-eld-connector-type-in-drm_edid_to_eld.patch drm-etnaviv-make-thermal-selectable.patch drm-sun4i-fix-format-mask-in-de2-driver.patch fix-misannotated-out-of-line-_copy_to_user.patch hid-elo-clear-btn_left-mapping.patch hid-multitouch-only-look-at-non-touch-fields-in-first-packet-of-a-frame.patch ib-mlx5-revisit-wmaybe-uninitialized-warning.patch iio-adc-ina2xx-shift-bus-voltage-register-to-mask-flag-bits.patch iio-health-max30102-add-power-enable-parameter-to-get_temp-function.patch ima-relax-requiring-a-file-signature-for-new-files-with-zero-length.patch ipvlan-add-l2-check-for-packets-arriving-via-virtual-devices.patch iwlwifi-mvm-avoid-dumping-assert-log-when-device-is-stopped.patch iwlwifi-mvm-rs-don-t-override-the-rate-history-in-the-search-cycle.patch leds-pm8058-silence-pointer-to-integer-size-warning.patch locking-locktorture-fix-num-reader-writer-corner-cases.patch mac80211-remove-bug-when-interface-type-is-invalid.patch mac80211_hwsim-enforce-ps_manual_poll-to-be-set-after-ps_enabled.patch media-cpia2-fix-a-couple-off-by-one-bugs.patch media-davinci-vpif_capture-add-null-check-on-devm_kzalloc-return-value.patch media-vsp1-prevent-suspending-and-resuming-drm-pipelines.patch mmc-mmc_test-ensure-command-queue-is-disabled-for-testing.patch mtd-nand-fix-interpretation-of-nand_cmd_none-in-nand_command.patch mtd-nand-ifc-update-bufnum-mask-for-ver-2.0.0.patch mwifiex-cfg80211-do-not-change-virtual-interface-during-scan-processing.patch net-ieee802154-adf7242-fix-bug-if-defined-debug.patch net-sched-drop-qdisc_reset-from-dev_graft_qdisc.patch net-thunderx-set-max-queue-count-taking-xdp_tx-into-account.patch net-xfrm-allow-clearing-socket-xfrm-policies.patch perf-annotate-fix-objdump-comment-parsing-for-intel-mov-dissassembly.patch perf-annotate-fix-unnecessary-memory-allocation-for-s390x.patch pinctrl-sh-pfc-r8a7791-add-can_clk-function.patch pinctrl-sh-pfc-r8a7795-es1-fix-mod_sel1-bit-to-0x3-when-using-stp_isen_1_d.patch power-supply-ab8500_charger-bail-out-in-case-of-error-in-ab8500_charger_init_hw_registers.patch power-supply-ab8500_charger-fix-an-error-handling-path.patch powerpc-64-don-t-trace-irqs-off-at-interrupt-return-to-soft-disabled-context.patch powerpc-modules-don-t-try-to-restore-r2-after-a-sibling-call.patch pwm-stmpe-fix-wrong-register-offset-for-hwpwm-2-case.patch rcutorture-configinit-fix-build-directory-error-message.patch rtc-brcmstb-waketimer-fix-error-handling-in-brcmstb_waketmr_probe.patch sched-stop-resched_cpu-from-sending-ipis-to-offline-cpus.patch sched-stop-switched_to_rt-from-sending-ipis-to-offline-cpus.patch scsi-core-scsi_get_device_flags_keyed-always-return-device-flags.patch scsi-devinfo-apply-to-hp-xp-the-same-flags-as-hitachi-vsp.patch scsi-dh-add-new-rdac-devices.patch scsi-ses-don-t-ask-for-diagnostic-pages-repeatedly-during-probe.patch spi-sun6i-disable-unprepare-clocks-on-remove.patch staging-rtl8822be-fix-missing-null-check-on-dev_alloc_skb-return.patch test_firmware-fix-setting-old-custom-fw-path-back-on-exit.patch tools-usbip-fixes-build-with-musl-libc-toolchain.patch typec-tcpm-fusb302-resolve-out-of-order-messaging-events.patch usb-ledtrig-usbport-fix-of-node-leak.patch userns-don-t-fail-follow_automount-based-on-s_user_ns.patch veth-set-peer-gso-values.patch video-hdmi-allow-empty-hdmi-infoframes.patch virtio_net-disable-interrupts-if-napi_complete_done-rescheduled-napi.patch xfrm-fix-xfrm_replay_overflow_offload_esn.patch --- diff --git a/queue-4.14/agp-intel-flush-all-chipset-writes-after-updating-the-ggtt.patch b/queue-4.14/agp-intel-flush-all-chipset-writes-after-updating-the-ggtt.patch new file mode 100644 index 00000000000..b15f603b565 --- /dev/null +++ b/queue-4.14/agp-intel-flush-all-chipset-writes-after-updating-the-ggtt.patch @@ -0,0 +1,46 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Chris Wilson +Date: Fri, 8 Dec 2017 21:46:16 +0000 +Subject: agp/intel: Flush all chipset writes after updating the GGTT + +From: Chris Wilson + + +[ Upstream commit 8516673a996870ea0ceb337ee4f83c33c5ec3111 ] + +Before accessing the GGTT we must flush the PTE writes and make them +visible to the chipset, or else the indirect access may end up in the +wrong page. In commit 3497971a71d8 ("agp/intel: Flush chipset writes +after updating a single PTE"), we noticed corruption of the uploads for +pwrite and for capturing GPU error states, but it was presumed that the +explicit calls to intel_gtt_chipset_flush() were sufficient for the +execbuffer path. However, we have not been flushing the chipset between +the PTE writes and access via the GTT itself. + +For simplicity, do the flush after any PTE update rather than try and +batch the flushes on a just-in-time basis. + +References: 3497971a71d8 ("agp/intel: Flush chipset writes after updating a single PTE") +Signed-off-by: Chris Wilson +Cc: Tvrtko Ursulin +Cc: Mika Kuoppala +Cc: drm-intel-fixes@lists.freedesktop.org +Reviewed-by: Joonas Lahtinen +Link: https://patchwork.freedesktop.org/patch/msgid/20171208214616.30147-1-chris@chris-wilson.co.uk +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/agp/intel-gtt.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/char/agp/intel-gtt.c ++++ b/drivers/char/agp/intel-gtt.c +@@ -872,6 +872,8 @@ void intel_gtt_insert_sg_entries(struct + } + } + wmb(); ++ if (intel_private.driver->chipset_flush) ++ intel_private.driver->chipset_flush(); + } + EXPORT_SYMBOL(intel_gtt_insert_sg_entries); + diff --git a/queue-4.14/arm-dts-am335x-pepper-fix-the-audio-codec-s-reset-pin.patch b/queue-4.14/arm-dts-am335x-pepper-fix-the-audio-codec-s-reset-pin.patch new file mode 100644 index 00000000000..cd7d5a59940 --- /dev/null +++ b/queue-4.14/arm-dts-am335x-pepper-fix-the-audio-codec-s-reset-pin.patch @@ -0,0 +1,34 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: "Andrew F. Davis" +Date: Wed, 29 Nov 2017 11:13:56 -0600 +Subject: ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin + +From: "Andrew F. Davis" + + +[ Upstream commit e153db03c6b7a035c797bcdf35262586f003ee93 ] + +The correct DT property for specifying a GPIO used for reset +is "reset-gpios", fix this here. + +Fixes: 4341881d0562 ("ARM: dts: Add devicetree for Gumstix Pepper board") + +Signed-off-by: Andrew F. Davis +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/am335x-pepper.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/am335x-pepper.dts ++++ b/arch/arm/boot/dts/am335x-pepper.dts +@@ -139,7 +139,7 @@ + &audio_codec { + status = "okay"; + +- gpio-reset = <&gpio1 16 GPIO_ACTIVE_LOW>; ++ reset-gpios = <&gpio1 16 GPIO_ACTIVE_LOW>; + AVDD-supply = <&ldo3_reg>; + IOVDD-supply = <&ldo3_reg>; + DRVDD-supply = <&ldo3_reg>; diff --git a/queue-4.14/arm-dts-exynos-correct-trats2-panel-reset-line.patch b/queue-4.14/arm-dts-exynos-correct-trats2-panel-reset-line.patch new file mode 100644 index 00000000000..7b07853e094 --- /dev/null +++ b/queue-4.14/arm-dts-exynos-correct-trats2-panel-reset-line.patch @@ -0,0 +1,35 @@ +From foo@baz Fri Mar 16 15:43:16 CET 2018 +From: Simon Shields +Date: Tue, 21 Nov 2017 22:24:24 +1100 +Subject: ARM: dts: exynos: Correct Trats2 panel reset line + +From: Simon Shields + + +[ Upstream commit 1b377924841df1e13ab5b225be3a83f807a92b52 ] + +Trats2 uses gpf2-1 as the panel reset GPIO. gpy4-5 was only used +on early revisions of the board. + +Fixes: 420ae8451a22 ("ARM: dts: exynos4412-trats2: add panel node") +Signed-off-by: Simon Shields +Acked-by: Marek Szyprowski +Tested-by: Marek Szyprowski +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/exynos4412-trats2.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/exynos4412-trats2.dts ++++ b/arch/arm/boot/dts/exynos4412-trats2.dts +@@ -395,7 +395,7 @@ + reg = <0>; + vdd3-supply = <&lcd_vdd3_reg>; + vci-supply = <&ldo25_reg>; +- reset-gpios = <&gpy4 5 GPIO_ACTIVE_HIGH>; ++ reset-gpios = <&gpf2 1 GPIO_ACTIVE_HIGH>; + power-on-delay= <50>; + reset-delay = <100>; + init-delay = <100>; diff --git a/queue-4.14/arm-dts-koelsch-move-cec_clock-to-root-node.patch b/queue-4.14/arm-dts-koelsch-move-cec_clock-to-root-node.patch new file mode 100644 index 00000000000..8b1afabae81 --- /dev/null +++ b/queue-4.14/arm-dts-koelsch-move-cec_clock-to-root-node.patch @@ -0,0 +1,52 @@ +From foo@baz Fri Mar 16 15:43:16 CET 2018 +From: Simon Horman +Date: Thu, 2 Nov 2017 10:18:05 +0100 +Subject: ARM: dts: koelsch: Move cec_clock to root node + +From: Simon Horman + + +[ Upstream commit d72f4f03854d1225c72d682bf0e01377e7016419 ] + +cec-clock is a fixed clock generator that is not controlled by i2c5 and +thus should not be a child of the i2c5 bus node. Rather, it should be +a child of the root node of the DT. + +Fixes: 02a5ab18d366 ("ARM: dts: koelsch: Add CEC clock for HDMI transmitter") +Reported-by: Laurent Pinchart +Signed-off-by: Simon Horman +Reviewed-by: Laurent Pinchart +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/r8a7791-koelsch.dts | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/arch/arm/boot/dts/r8a7791-koelsch.dts ++++ b/arch/arm/boot/dts/r8a7791-koelsch.dts +@@ -278,6 +278,12 @@ + }; + }; + ++ cec_clock: cec-clock { ++ compatible = "fixed-clock"; ++ #clock-cells = <0>; ++ clock-frequency = <12000000>; ++ }; ++ + hdmi-out { + compatible = "hdmi-connector"; + type = "a"; +@@ -642,12 +648,6 @@ + }; + }; + +- cec_clock: cec-clock { +- compatible = "fixed-clock"; +- #clock-cells = <0>; +- clock-frequency = <12000000>; +- }; +- + hdmi@39 { + compatible = "adi,adv7511w"; + reg = <0x39>; diff --git a/queue-4.14/arm-dts-omap3-n900-fix-the-audio-codec-s-reset-pin.patch b/queue-4.14/arm-dts-omap3-n900-fix-the-audio-codec-s-reset-pin.patch new file mode 100644 index 00000000000..0417b17d5aa --- /dev/null +++ b/queue-4.14/arm-dts-omap3-n900-fix-the-audio-codec-s-reset-pin.patch @@ -0,0 +1,43 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: "Andrew F. Davis" +Date: Wed, 29 Nov 2017 11:13:59 -0600 +Subject: ARM: dts: omap3-n900: Fix the audio CODEC's reset pin + +From: "Andrew F. Davis" + + +[ Upstream commit 7be4b5dc7ffa9499ac6ef33a5ffa9ff43f9b7057 ] + +The correct DT property for specifying a GPIO used for reset +is "reset-gpios", fix this here. + +Fixes: 14e3e295b2b9 ("ARM: dts: omap3-n900: Add TLV320AIC3X support") + +Signed-off-by: Andrew F. Davis +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/omap3-n900.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/omap3-n900.dts ++++ b/arch/arm/boot/dts/omap3-n900.dts +@@ -558,7 +558,7 @@ + tlv320aic3x: tlv320aic3x@18 { + compatible = "ti,tlv320aic3x"; + reg = <0x18>; +- gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */ ++ reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */ + ai3x-gpio-func = < + 0 /* AIC3X_GPIO1_FUNC_DISABLED */ + 5 /* AIC3X_GPIO2_FUNC_DIGITAL_MIC_INPUT */ +@@ -575,7 +575,7 @@ + tlv320aic3x_aux: tlv320aic3x@19 { + compatible = "ti,tlv320aic3x"; + reg = <0x19>; +- gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */ ++ reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */ + + AVDD-supply = <&vmmc2>; + DRVDD-supply = <&vmmc2>; diff --git a/queue-4.14/arm64-dts-renesas-salvator-common-add-ethernetavb-phy-reset.patch b/queue-4.14/arm64-dts-renesas-salvator-common-add-ethernetavb-phy-reset.patch new file mode 100644 index 00000000000..fc809e30fd8 --- /dev/null +++ b/queue-4.14/arm64-dts-renesas-salvator-common-add-ethernetavb-phy-reset.patch @@ -0,0 +1,43 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Geert Uytterhoeven +Date: Mon, 4 Dec 2017 11:34:51 +0100 +Subject: arm64: dts: renesas: salvator-common: Add EthernetAVB PHY reset + +From: Geert Uytterhoeven + + +[ Upstream commit f5bbcd533a9d1af97b8a0862a421bb8455f1bf6d ] + +Describe the GPIO used to reset the Ethernet PHY for EthernetAVB. +This allows the driver to reset the PHY during probe and after system +resume. + +This fixes Ethernet operation after resume from s2ram on Salvator-XS, +where the enable pin of the regulator providing PHY power is connected +to PRESETn, and PSCI powers down the SoC during system suspend. + +On Salvator-X, the enable pin is always pulled high, but the driver may +still need to reset the PHY if this wasn't done by the bootloader +before. + +Inspired by patches in the BSP for the individual Salvator-X/XS boards +by Kazuya Mizuguchi. + +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/renesas/salvator-common.dtsi | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm64/boot/dts/renesas/salvator-common.dtsi ++++ b/arch/arm64/boot/dts/renesas/salvator-common.dtsi +@@ -264,6 +264,7 @@ + reg = <0>; + interrupt-parent = <&gpio2>; + interrupts = <11 IRQ_TYPE_LEVEL_LOW>; ++ reset-gpios = <&gpio2 10 GPIO_ACTIVE_LOW>; + }; + }; + diff --git a/queue-4.14/asoc-nuc900-fix-a-loop-timeout-test.patch b/queue-4.14/asoc-nuc900-fix-a-loop-timeout-test.patch new file mode 100644 index 00000000000..c4e3ebec097 --- /dev/null +++ b/queue-4.14/asoc-nuc900-fix-a-loop-timeout-test.patch @@ -0,0 +1,42 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Dan Carpenter +Date: Sat, 9 Dec 2017 14:52:28 +0300 +Subject: ASoC: nuc900: Fix a loop timeout test + +From: Dan Carpenter + + +[ Upstream commit 65a12b3aafed5fc59f4ce41b22b752b1729e6701 ] + +We should be finishing the loop with timeout set to zero but because +this is a post-op we finish with timeout == -1. + +Fixes: 1082e2703a2d ("ASoC: NUC900/audio: add nuc900 audio driver support") +Signed-off-by: Dan Carpenter +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/nuc900/nuc900-ac97.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/soc/nuc900/nuc900-ac97.c ++++ b/sound/soc/nuc900/nuc900-ac97.c +@@ -67,7 +67,7 @@ static unsigned short nuc900_ac97_read(s + + /* polling the AC_R_FINISH */ + while (!(AUDIO_READ(nuc900_audio->mmio + ACTL_ACCON) & AC_R_FINISH) +- && timeout--) ++ && --timeout) + mdelay(1); + + if (!timeout) { +@@ -121,7 +121,7 @@ static void nuc900_ac97_write(struct snd + + /* polling the AC_W_FINISH */ + while ((AUDIO_READ(nuc900_audio->mmio + ACTL_ACCON) & AC_W_FINISH) +- && timeout--) ++ && --timeout) + mdelay(1); + + if (!timeout) diff --git a/queue-4.14/ath10k-fix-invalid-sts_cap_offset_mask.patch b/queue-4.14/ath10k-fix-invalid-sts_cap_offset_mask.patch new file mode 100644 index 00000000000..f7bdd454d71 --- /dev/null +++ b/queue-4.14/ath10k-fix-invalid-sts_cap_offset_mask.patch @@ -0,0 +1,35 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Ben Greear +Date: Sat, 2 Dec 2017 16:50:49 +0200 +Subject: ath10k: fix invalid STS_CAP_OFFSET_MASK + +From: Ben Greear + + +[ Upstream commit 8cec57f5277ef0e354e37a0bf909dc71bc1f865b ] + +The 10.4 firmware defines this as a 3-bit field, as does the +mac80211 stack. The 4th bit is defined as CONF_IMPLICIT_BF +at least in the firmware header I have seen. This patch +fixes the ath10k wmi header to match the firmware. + +Signed-off-by: Ben Greear +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath10k/wmi.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath10k/wmi.h ++++ b/drivers/net/wireless/ath/ath10k/wmi.h +@@ -5235,7 +5235,8 @@ enum wmi_10_4_vdev_param { + #define WMI_VDEV_PARAM_TXBF_MU_TX_BFER BIT(3) + + #define WMI_TXBF_STS_CAP_OFFSET_LSB 4 +-#define WMI_TXBF_STS_CAP_OFFSET_MASK 0xf0 ++#define WMI_TXBF_STS_CAP_OFFSET_MASK 0x70 ++#define WMI_TXBF_CONF_IMPLICIT_BF BIT(7) + #define WMI_BF_SOUND_DIM_OFFSET_LSB 8 + #define WMI_BF_SOUND_DIM_OFFSET_MASK 0xf00 + diff --git a/queue-4.14/ath10k-update-tdls-teardown-state-to-target.patch b/queue-4.14/ath10k-update-tdls-teardown-state-to-target.patch new file mode 100644 index 00000000000..a5d577d7bc4 --- /dev/null +++ b/queue-4.14/ath10k-update-tdls-teardown-state-to-target.patch @@ -0,0 +1,47 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Manikanta Pubbisetty +Date: Mon, 6 Nov 2017 13:39:31 +0530 +Subject: ath10k: update tdls teardown state to target + +From: Manikanta Pubbisetty + + +[ Upstream commit 424ea0d174e82365f85c6770225dba098b8f1d5f ] + +It is required to update the teardown state of the peer when +a tdls link with that peer is terminated. This information is +useful for the target to perform some cleanups wrt the tdls peer. + +Without proper cleanup, target assumes that the peer is connected and +blocks future connection requests, updating the teardown state of the +peer addresses the problem. + +Tested this change on QCA9888 with 10.4-3.5.1-00018 fw version. + +Signed-off-by: Manikanta Pubbisetty +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath10k/mac.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -6183,6 +6183,16 @@ static int ath10k_sta_state(struct ieee8 + "mac vdev %d peer delete %pM sta %pK (sta gone)\n", + arvif->vdev_id, sta->addr, sta); + ++ if (sta->tdls) { ++ ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id, ++ sta, ++ WMI_TDLS_PEER_STATE_TEARDOWN); ++ if (ret) ++ ath10k_warn(ar, "failed to update tdls peer state for %pM state %d: %i\n", ++ sta->addr, ++ WMI_TDLS_PEER_STATE_TEARDOWN, ret); ++ } ++ + ret = ath10k_peer_delete(ar, arvif->vdev_id, sta->addr); + if (ret) + ath10k_warn(ar, "failed to delete peer %pM for vdev %d: %i\n", diff --git a/queue-4.14/bnxt_en-don-t-print-link-speed-1-no-longer-supported-messages.patch b/queue-4.14/bnxt_en-don-t-print-link-speed-1-no-longer-supported-messages.patch new file mode 100644 index 00000000000..3ace9bed1da --- /dev/null +++ b/queue-4.14/bnxt_en-don-t-print-link-speed-1-no-longer-supported-messages.patch @@ -0,0 +1,51 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Michael Chan +Date: Wed, 6 Dec 2017 17:31:22 -0500 +Subject: bnxt_en: Don't print "Link speed -1 no longer supported" messages. + +From: Michael Chan + + +[ Upstream commit a8168b6cee6e9334dfebb4b9108e8d73794f6088 ] + +On some dual port NICs, the 2 ports have to be configured with compatible +link speeds. Under some conditions, a port's configured speed may no +longer be supported. The firmware will send a message to the driver +when this happens. + +Improve this logic that prints out the warning by only printing it if +we can determine the link speed that is no longer supported. If the +speed is unknown or it is in autoneg mode, skip the warning message. + +Reported-by: Thomas Bogendoerfer +Signed-off-by: Michael Chan +Tested-by: Thomas Bogendoerfer +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -1698,12 +1698,16 @@ static int bnxt_async_event_process(stru + + if (BNXT_VF(bp)) + goto async_event_process_exit; +- if (data1 & 0x20000) { ++ ++ /* print unsupported speed warning in forced speed mode only */ ++ if (!(link_info->autoneg & BNXT_AUTONEG_SPEED) && ++ (data1 & 0x20000)) { + u16 fw_speed = link_info->force_link_speed; + u32 speed = bnxt_fw_to_ethtool_speed(fw_speed); + +- netdev_warn(bp->dev, "Link speed %d no longer supported\n", +- speed); ++ if (speed != SPEED_UNKNOWN) ++ netdev_warn(bp->dev, "Link speed %d no longer supported\n", ++ speed); + } + set_bit(BNXT_LINK_SPEED_CHNG_SP_EVENT, &bp->sp_event); + /* fall thru */ diff --git a/queue-4.14/clk-meson-gxbb-fix-wrong-clock-for-saradc-sana.patch b/queue-4.14/clk-meson-gxbb-fix-wrong-clock-for-saradc-sana.patch new file mode 100644 index 00000000000..e7192dd0576 --- /dev/null +++ b/queue-4.14/clk-meson-gxbb-fix-wrong-clock-for-saradc-sana.patch @@ -0,0 +1,50 @@ +From foo@baz Fri Mar 16 15:43:16 CET 2018 +From: Yixun Lan +Date: Tue, 7 Nov 2017 22:12:23 +0800 +Subject: clk: meson: gxbb: fix wrong clock for SARADC/SANA + +From: Yixun Lan + + +[ Upstream commit 75eccf5ed83250c0aeaeeb76f7288254ac0a87b4 ] + +According to the datasheet, in Meson-GXBB/GXL series, +The clock gate bit for SARADC is HHI_GCLK_MPEG2 bit[22], +while clock gate bit for SANA is HHI_GCLK_MPEG0 bit[10]. + +Test passed at gxl-s905x-p212 board. + +The following published datasheets are wrong and should be updated +[1] GXBB v1.1.4 +[2] GXL v0.3_20170314 + +Fixes: 738f66d3211d ("clk: gxbb: add AmLogic GXBB clk controller driver") +Tested-by: Xingyu Chen +Signed-off-by: Yixun Lan +Signed-off-by: Jerome Brunet +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/meson/gxbb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/clk/meson/gxbb.c ++++ b/drivers/clk/meson/gxbb.c +@@ -1139,7 +1139,7 @@ static MESON_GATE(gxbb_pl301, HHI_GCLK_M + static MESON_GATE(gxbb_periphs, HHI_GCLK_MPEG0, 7); + static MESON_GATE(gxbb_spicc, HHI_GCLK_MPEG0, 8); + static MESON_GATE(gxbb_i2c, HHI_GCLK_MPEG0, 9); +-static MESON_GATE(gxbb_sar_adc, HHI_GCLK_MPEG0, 10); ++static MESON_GATE(gxbb_sana, HHI_GCLK_MPEG0, 10); + static MESON_GATE(gxbb_smart_card, HHI_GCLK_MPEG0, 11); + static MESON_GATE(gxbb_rng0, HHI_GCLK_MPEG0, 12); + static MESON_GATE(gxbb_uart0, HHI_GCLK_MPEG0, 13); +@@ -1190,7 +1190,7 @@ static MESON_GATE(gxbb_usb0_ddr_bridge, + static MESON_GATE(gxbb_mmc_pclk, HHI_GCLK_MPEG2, 11); + static MESON_GATE(gxbb_dvin, HHI_GCLK_MPEG2, 12); + static MESON_GATE(gxbb_uart2, HHI_GCLK_MPEG2, 15); +-static MESON_GATE(gxbb_sana, HHI_GCLK_MPEG2, 22); ++static MESON_GATE(gxbb_sar_adc, HHI_GCLK_MPEG2, 22); + static MESON_GATE(gxbb_vpu_intr, HHI_GCLK_MPEG2, 25); + static MESON_GATE(gxbb_sec_ahb_ahb3_bridge, HHI_GCLK_MPEG2, 26); + static MESON_GATE(gxbb_clk81_a53, HHI_GCLK_MPEG2, 29); diff --git a/queue-4.14/clk-qcom-msm8916-fix-mnd_width-for-codec_digcodec.patch b/queue-4.14/clk-qcom-msm8916-fix-mnd_width-for-codec_digcodec.patch new file mode 100644 index 00000000000..78e1bffed15 --- /dev/null +++ b/queue-4.14/clk-qcom-msm8916-fix-mnd_width-for-codec_digcodec.patch @@ -0,0 +1,32 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Srinivas Kandagatla +Date: Wed, 6 Dec 2017 12:11:38 +0000 +Subject: clk: qcom: msm8916: fix mnd_width for codec_digcodec + +From: Srinivas Kandagatla + + +[ Upstream commit d8e488e8242ecf129eebc440c92d800a99ca109d ] + +This patch fixes missing mnd_width for codec_digital clk, this is now set to +8 inline with datasheet. + +Fixes: 3966fab8b6ab ("clk: qcom: Add MSM8916 Global Clock Controller support") +Signed-off-by: Srinivas Kandagatla +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/qcom/gcc-msm8916.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/clk/qcom/gcc-msm8916.c ++++ b/drivers/clk/qcom/gcc-msm8916.c +@@ -1438,6 +1438,7 @@ static const struct freq_tbl ftbl_codec_ + + static struct clk_rcg2 codec_digcodec_clk_src = { + .cmd_rcgr = 0x1c09c, ++ .mnd_width = 8, + .hid_width = 5, + .parent_map = gcc_xo_gpll1_emclk_sleep_map, + .freq_tbl = ftbl_codec_clk, diff --git a/queue-4.14/clk-ti-clkctrl-add-support-for-retrying-failed-init.patch b/queue-4.14/clk-ti-clkctrl-add-support-for-retrying-failed-init.patch new file mode 100644 index 00000000000..94e4381d019 --- /dev/null +++ b/queue-4.14/clk-ti-clkctrl-add-support-for-retrying-failed-init.patch @@ -0,0 +1,57 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Tero Kristo +Date: Thu, 12 Oct 2017 10:55:29 +0300 +Subject: clk: ti: clkctrl: add support for retrying failed init + +From: Tero Kristo + + +[ Upstream commit 729e13bf58e643b9accd2a14c55b555958702fb0 ] + +In case the clkctrl node contains assigned-clock-* entries, registering +the provider can fail with -EPROBE_DEFER. In this case, add the +provider to the retry_init clock list so it will be cleaned up later. + +Signed-off-by: Tero Kristo +Acked-by: Stephen Boyd +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/ti/clkctrl.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/clk/ti/clkctrl.c ++++ b/drivers/clk/ti/clkctrl.c +@@ -400,6 +400,12 @@ _ti_clkctrl_setup_subclks(struct omap_cl + } + } + ++static void __init _clkctrl_add_provider(void *data, ++ struct device_node *np) ++{ ++ of_clk_add_hw_provider(np, _ti_omap4_clkctrl_xlate, data); ++} ++ + static void __init _ti_omap4_clkctrl_setup(struct device_node *node) + { + struct omap_clkctrl_provider *provider; +@@ -411,6 +417,7 @@ static void __init _ti_omap4_clkctrl_set + struct omap_clkctrl_clk *clkctrl_clk; + const __be32 *addrp; + u32 addr; ++ int ret; + + addrp = of_get_address(node, 0, NULL, NULL); + addr = (u32)of_translate_address(node, addrp); +@@ -485,7 +492,10 @@ static void __init _ti_omap4_clkctrl_set + reg_data++; + } + +- of_clk_add_hw_provider(node, _ti_omap4_clkctrl_xlate, provider); ++ ret = of_clk_add_hw_provider(node, _ti_omap4_clkctrl_xlate, provider); ++ if (ret == -EPROBE_DEFER) ++ ti_clk_retry_init(node, provider, _clkctrl_add_provider); ++ + return; + + cleanup: diff --git a/queue-4.14/cpufreq-fix-governor-module-removal-race.patch b/queue-4.14/cpufreq-fix-governor-module-removal-race.patch new file mode 100644 index 00000000000..5da5e3ebbd3 --- /dev/null +++ b/queue-4.14/cpufreq-fix-governor-module-removal-race.patch @@ -0,0 +1,56 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: "Rafael J. Wysocki" +Date: Thu, 23 Nov 2017 14:27:07 +0100 +Subject: cpufreq: Fix governor module removal race + +From: "Rafael J. Wysocki" + + +[ Upstream commit a8b149d32b663c1a4105273295184b78f53d33cf ] + +It is possible to remove a cpufreq governor module after +cpufreq_parse_governor() has returned success in +store_scaling_governor() and before cpufreq_set_policy() +acquires a reference to it, because the governor list is +not protected during that period and nothing prevents the +governor from being unregistered then. + +Prevent that from happening by acquiring an extra reference +to the governor module temporarily in cpufreq_parse_governor(), +under cpufreq_governor_mutex, and dropping it in +store_scaling_governor(), when cpufreq_set_policy() returns. + +Note that the second cpufreq_parse_governor() call site is fine, +because it only cares about the policy member of new_policy. + +Signed-off-by: Rafael J. Wysocki +Acked-by: Viresh Kumar +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpufreq/cpufreq.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -631,6 +631,8 @@ static int cpufreq_parse_governor(char * + *governor = t; + err = 0; + } ++ if (t && !try_module_get(t->owner)) ++ t = NULL; + + mutex_unlock(&cpufreq_governor_mutex); + } +@@ -759,6 +761,10 @@ static ssize_t store_scaling_governor(st + return -EINVAL; + + ret = cpufreq_set_policy(policy, &new_policy); ++ ++ if (new_policy.governor) ++ module_put(new_policy.governor->owner); ++ + return ret ? ret : count; + } + diff --git a/queue-4.14/crypto-caam-qi-use-correct-print-specifier-for-size_t.patch b/queue-4.14/crypto-caam-qi-use-correct-print-specifier-for-size_t.patch new file mode 100644 index 00000000000..ebdca0dbd55 --- /dev/null +++ b/queue-4.14/crypto-caam-qi-use-correct-print-specifier-for-size_t.patch @@ -0,0 +1,72 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: "Horia Geantă" +Date: Tue, 28 Nov 2017 18:48:08 +0200 +Subject: crypto: caam/qi - use correct print specifier for size_t + +From: "Horia Geantă" + + +[ Upstream commit 9db09e3bad65393dc23b0279beb7f3754d77065c ] + +Fix below warnings on ARMv7 by using %zu for printing size_t values: + +drivers/crypto/caam/caamalg_qi.c: In function aead_edesc_alloc: +drivers/crypto/caam/caamalg_qi.c:417:17: warning: format %lu expects argument of type long unsigned int, but argument 4 has type unsigned int [-Wformat=] + sizeof(struct qm_sg_entry)) + ^ +drivers/crypto/caam/caamalg_qi.c:672:16: note: in expansion of macro CAAM_QI_MAX_AEAD_SG + qm_sg_ents, CAAM_QI_MAX_AEAD_SG); + ^ +drivers/crypto/caam/caamalg_qi.c: In function ablkcipher_edesc_alloc: +drivers/crypto/caam/caamalg_qi.c:440:17: warning: format %lu expects argument of type long unsigned int, but argument 4 has type unsigned int [-Wformat=] + sizeof(struct qm_sg_entry)) + ^ +drivers/crypto/caam/caamalg_qi.c:909:16: note: in expansion of macro CAAM_QI_MAX_ABLKCIPHER_SG + qm_sg_ents, CAAM_QI_MAX_ABLKCIPHER_SG); + ^ +drivers/crypto/caam/caamalg_qi.c: In function ablkcipher_giv_edesc_alloc: +drivers/crypto/caam/caamalg_qi.c:440:17: warning: format %lu expects argument of type long unsigned int, but argument 4 has type unsigned int [-Wformat=] + sizeof(struct qm_sg_entry)) + ^ +drivers/crypto/caam/caamalg_qi.c:1062:16: note: in expansion of macro CAAM_QI_MAX_ABLKCIPHER_SG + qm_sg_ents, CAAM_QI_MAX_ABLKCIPHER_SG); + ^ + +Fixes: eb9ba37dc15a ("crypto: caam/qi - handle large number of S/Gs case") +Signed-off-by: Horia Geantă +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/caam/caamalg_qi.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/crypto/caam/caamalg_qi.c ++++ b/drivers/crypto/caam/caamalg_qi.c +@@ -668,7 +668,7 @@ static struct aead_edesc *aead_edesc_all + qm_sg_ents = 1 + !!ivsize + mapped_src_nents + + (mapped_dst_nents > 1 ? mapped_dst_nents : 0); + if (unlikely(qm_sg_ents > CAAM_QI_MAX_AEAD_SG)) { +- dev_err(qidev, "Insufficient S/G entries: %d > %lu\n", ++ dev_err(qidev, "Insufficient S/G entries: %d > %zu\n", + qm_sg_ents, CAAM_QI_MAX_AEAD_SG); + caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, + iv_dma, ivsize, op_type, 0, 0); +@@ -905,7 +905,7 @@ static struct ablkcipher_edesc *ablkciph + + qm_sg_ents += mapped_dst_nents > 1 ? mapped_dst_nents : 0; + if (unlikely(qm_sg_ents > CAAM_QI_MAX_ABLKCIPHER_SG)) { +- dev_err(qidev, "Insufficient S/G entries: %d > %lu\n", ++ dev_err(qidev, "Insufficient S/G entries: %d > %zu\n", + qm_sg_ents, CAAM_QI_MAX_ABLKCIPHER_SG); + caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, + iv_dma, ivsize, op_type, 0, 0); +@@ -1058,7 +1058,7 @@ static struct ablkcipher_edesc *ablkciph + } + + if (unlikely(qm_sg_ents > CAAM_QI_MAX_ABLKCIPHER_SG)) { +- dev_err(qidev, "Insufficient S/G entries: %d > %lu\n", ++ dev_err(qidev, "Insufficient S/G entries: %d > %zu\n", + qm_sg_ents, CAAM_QI_MAX_ABLKCIPHER_SG); + caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, + iv_dma, ivsize, GIVENCRYPT, 0, 0); diff --git a/queue-4.14/crypto-cavium-fix-memory-leak-on-info.patch b/queue-4.14/crypto-cavium-fix-memory-leak-on-info.patch new file mode 100644 index 00000000000..26d66eaf439 --- /dev/null +++ b/queue-4.14/crypto-cavium-fix-memory-leak-on-info.patch @@ -0,0 +1,37 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Colin Ian King +Date: Wed, 15 Nov 2017 12:37:19 +0000 +Subject: crypto: cavium - fix memory leak on info + +From: Colin Ian King + + +[ Upstream commit 87aae50af730a28dc1d8846d86dca5e9aa724a9f ] + +The object info is being leaked on an error return path, fix this +by setting ret to -ENOMEM and exiting via the request_cleanup path +that will free info. + +Detected by CoverityScan, CID#1408439 ("Resource Leak") + +Fixes: c694b233295b ("crypto: cavium - Add the Virtual Function driver for CPT") +Signed-off-by: Colin Ian King +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/cavium/cpt/cptvf_reqmanager.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/crypto/cavium/cpt/cptvf_reqmanager.c ++++ b/drivers/crypto/cavium/cpt/cptvf_reqmanager.c +@@ -459,7 +459,8 @@ int process_request(struct cpt_vf *cptvf + info->completion_addr = kzalloc(sizeof(union cpt_res_s), GFP_KERNEL); + if (unlikely(!info->completion_addr)) { + dev_err(&pdev->dev, "Unable to allocate memory for completion_addr\n"); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto request_cleanup; + } + + result = (union cpt_res_s *)info->completion_addr; diff --git a/queue-4.14/crypto-ecc-fix-null-pointer-deref.-on-no-default_rng.patch b/queue-4.14/crypto-ecc-fix-null-pointer-deref.-on-no-default_rng.patch new file mode 100644 index 00000000000..d8ef101967e --- /dev/null +++ b/queue-4.14/crypto-ecc-fix-null-pointer-deref.-on-no-default_rng.patch @@ -0,0 +1,38 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Pierre +Date: Sun, 12 Nov 2017 15:24:32 +0100 +Subject: crypto: ecc - Fix NULL pointer deref. on no default_rng + +From: Pierre + + +[ Upstream commit 4c0e22c90510308433272d7ba281b1eb4eda8209 ] + +If crypto_get_default_rng returns an error, the +function ecc_gen_privkey should return an error. +Instead, it currently tries to use the default_rng +nevertheless, thus creating a kernel panic with a +NULL pointer dereference. +Returning the error directly, as was supposedly +intended when looking at the code, fixes this. + +Signed-off-by: Pierre Ducroquet +Reviewed-by: PrasannaKumar Muralidharan +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + crypto/ecc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/crypto/ecc.c ++++ b/crypto/ecc.c +@@ -964,7 +964,7 @@ int ecc_gen_privkey(unsigned int curve_i + * DRBG with a security strength of 256. + */ + if (crypto_get_default_rng()) +- err = -EFAULT; ++ return -EFAULT; + + err = crypto_rng_get_bytes(crypto_default_rng, (u8 *)priv, nbytes); + crypto_put_default_rng(); diff --git a/queue-4.14/dm-raid-fix-raid-set-size-revalidation.patch b/queue-4.14/dm-raid-fix-raid-set-size-revalidation.patch new file mode 100644 index 00000000000..5951a633e72 --- /dev/null +++ b/queue-4.14/dm-raid-fix-raid-set-size-revalidation.patch @@ -0,0 +1,102 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Heinz Mauelshagen +Date: Sat, 2 Dec 2017 01:03:51 +0100 +Subject: dm raid: fix raid set size revalidation + +From: Heinz Mauelshagen + + +[ Upstream commit 61e06e2c3ebd986050958513bfa40dceed756f8f ] + +The raid set size is being revalidated unconditionally before a +reshaping conversion is started. MD requires the size to only be +reduced in case of a stripe removing (i.e. shrinking) reshape but not +when growing because the raid array has to stay small until after the +growing reshape finishes. + +Fix by avoiding the size revalidation in preresume unless a shrinking +reshape is requested. + +Signed-off-by: Heinz Mauelshagen +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/dm-raid.c | 30 ++++++++++++++++++++---------- + 1 file changed, 20 insertions(+), 10 deletions(-) + +--- a/drivers/md/dm-raid.c ++++ b/drivers/md/dm-raid.c +@@ -675,15 +675,11 @@ static struct raid_type *get_raid_type_b + return NULL; + } + +-/* +- * Conditionally change bdev capacity of @rs +- * in case of a disk add/remove reshape +- */ +-static void rs_set_capacity(struct raid_set *rs) ++/* Adjust rdev sectors */ ++static void rs_set_rdev_sectors(struct raid_set *rs) + { + struct mddev *mddev = &rs->md; + struct md_rdev *rdev; +- struct gendisk *gendisk = dm_disk(dm_table_get_md(rs->ti->table)); + + /* + * raid10 sets rdev->sector to the device size, which +@@ -692,8 +688,16 @@ static void rs_set_capacity(struct raid_ + rdev_for_each(rdev, mddev) + if (!test_bit(Journal, &rdev->flags)) + rdev->sectors = mddev->dev_sectors; ++} + +- set_capacity(gendisk, mddev->array_sectors); ++/* ++ * Change bdev capacity of @rs in case of a disk add/remove reshape ++ */ ++static void rs_set_capacity(struct raid_set *rs) ++{ ++ struct gendisk *gendisk = dm_disk(dm_table_get_md(rs->ti->table)); ++ ++ set_capacity(gendisk, rs->md.array_sectors); + revalidate_disk(gendisk); + } + +@@ -1674,8 +1678,11 @@ static void do_table_event(struct work_s + struct raid_set *rs = container_of(ws, struct raid_set, md.event_work); + + smp_rmb(); /* Make sure we access most actual mddev properties */ +- if (!rs_is_reshaping(rs)) ++ if (!rs_is_reshaping(rs)) { ++ if (rs_is_raid10(rs)) ++ rs_set_rdev_sectors(rs); + rs_set_capacity(rs); ++ } + dm_table_event(rs->ti->table); + } + +@@ -3845,11 +3852,10 @@ static int raid_preresume(struct dm_targ + mddev->resync_min = mddev->recovery_cp; + } + +- rs_set_capacity(rs); +- + /* Check for any reshape request unless new raid set */ + if (test_and_clear_bit(RT_FLAG_RESHAPE_RS, &rs->runtime_flags)) { + /* Initiate a reshape. */ ++ rs_set_rdev_sectors(rs); + mddev_lock_nointr(mddev); + r = rs_start_reshape(rs); + mddev_unlock(mddev); +@@ -3878,6 +3884,10 @@ static void raid_resume(struct dm_target + mddev->ro = 0; + mddev->in_sync = 0; + ++ /* Only reduce raid set size before running a disk removing reshape. */ ++ if (mddev->delta_disks < 0) ++ rs_set_capacity(rs); ++ + /* + * Keep the RAID set frozen if reshape/rebuild flags are set. + * The RAID set is unfrozen once the next table load/resume, diff --git a/queue-4.14/dma-buf-fence-fix-lock-inversion-within-dma-fence-array.patch b/queue-4.14/dma-buf-fence-fix-lock-inversion-within-dma-fence-array.patch new file mode 100644 index 00000000000..41880ba1c5e --- /dev/null +++ b/queue-4.14/dma-buf-fence-fix-lock-inversion-within-dma-fence-array.patch @@ -0,0 +1,112 @@ +From foo@baz Fri Mar 16 15:43:16 CET 2018 +From: Chris Wilson +Date: Tue, 14 Nov 2017 16:27:19 +0000 +Subject: dma-buf/fence: Fix lock inversion within dma-fence-array + +From: Chris Wilson + + +[ Upstream commit 03e4e0a9e02cf703da331ff6cfd57d0be9bf5692 ] + +Ages ago Rob Clark noted, + +"Currently with fence-array, we have a potential deadlock situation. If +we fence_add_callback() on an array-fence, the array-fence's lock is +acquired first, and in it's ->enable_signaling() callback, it will install +cbs on it's array-member fences, so the array-member's lock is acquired +second. + +But in the signal path, the array-member's lock is acquired first, and +the array-fence's lock acquired second." + +Rob proposed either extensive changes to dma-fence to unnest the +fence-array signaling, or to defer the signaling onto a workqueue. This +is a more refined version of the later, that should keep the latency +of the fence signaling to a minimum by using an irq-work, which is +executed asap. + +Reported-by: Rob Clark +Suggested-by: Rob Clark +References: 1476635975-21981-1-git-send-email-robdclark@gmail.com +Signed-off-by: Chris Wilson +Cc: Rob Clark +Cc: Gustavo Padovan +Cc: Sumit Semwal +Cc: Christian König +Reviewed-by: Christian König +Signed-off-by: Sumit Semwal +Link: https://patchwork.freedesktop.org/patch/msgid/20171114162719.30958-1-chris@chris-wilson.co.uk +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/Kconfig | 1 + + drivers/dma-buf/dma-fence-array.c | 14 ++++++++++++-- + include/linux/dma-fence-array.h | 3 +++ + 3 files changed, 16 insertions(+), 2 deletions(-) + +--- a/drivers/base/Kconfig ++++ b/drivers/base/Kconfig +@@ -249,6 +249,7 @@ config DMA_SHARED_BUFFER + bool + default n + select ANON_INODES ++ select IRQ_WORK + help + This option enables the framework for buffer-sharing between + multiple drivers. A buffer is associated with a file using driver +--- a/drivers/dma-buf/dma-fence-array.c ++++ b/drivers/dma-buf/dma-fence-array.c +@@ -31,6 +31,14 @@ static const char *dma_fence_array_get_t + return "unbound"; + } + ++static void irq_dma_fence_array_work(struct irq_work *wrk) ++{ ++ struct dma_fence_array *array = container_of(wrk, typeof(*array), work); ++ ++ dma_fence_signal(&array->base); ++ dma_fence_put(&array->base); ++} ++ + static void dma_fence_array_cb_func(struct dma_fence *f, + struct dma_fence_cb *cb) + { +@@ -39,8 +47,9 @@ static void dma_fence_array_cb_func(stru + struct dma_fence_array *array = array_cb->array; + + if (atomic_dec_and_test(&array->num_pending)) +- dma_fence_signal(&array->base); +- dma_fence_put(&array->base); ++ irq_work_queue(&array->work); ++ else ++ dma_fence_put(&array->base); + } + + static bool dma_fence_array_enable_signaling(struct dma_fence *fence) +@@ -136,6 +145,7 @@ struct dma_fence_array *dma_fence_array_ + spin_lock_init(&array->lock); + dma_fence_init(&array->base, &dma_fence_array_ops, &array->lock, + context, seqno); ++ init_irq_work(&array->work, irq_dma_fence_array_work); + + array->num_fences = num_fences; + atomic_set(&array->num_pending, signal_on_any ? 1 : num_fences); +--- a/include/linux/dma-fence-array.h ++++ b/include/linux/dma-fence-array.h +@@ -21,6 +21,7 @@ + #define __LINUX_DMA_FENCE_ARRAY_H + + #include ++#include + + /** + * struct dma_fence_array_cb - callback helper for fence array +@@ -47,6 +48,8 @@ struct dma_fence_array { + unsigned num_fences; + atomic_t num_pending; + struct dma_fence **fences; ++ ++ struct irq_work work; + }; + + extern const struct dma_fence_ops dma_fence_array_ops; diff --git a/queue-4.14/dmaengine-amba-pl08x-use-vchan_terminate_vdesc-instead-of-desc_free.patch b/queue-4.14/dmaengine-amba-pl08x-use-vchan_terminate_vdesc-instead-of-desc_free.patch new file mode 100644 index 00000000000..e78c5f5f7bf --- /dev/null +++ b/queue-4.14/dmaengine-amba-pl08x-use-vchan_terminate_vdesc-instead-of-desc_free.patch @@ -0,0 +1,66 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Peter Ujfalusi +Date: Tue, 14 Nov 2017 16:32:09 +0200 +Subject: dmaengine: amba-pl08x: Use vchan_terminate_vdesc() instead of desc_free + +From: Peter Ujfalusi + + +[ Upstream commit 47d71bc75d072ce25c1063aa629e55e1cfb961b2 ] + +To avoid race with vchan_complete, use the race free way to terminate +running transfer. + +Implement the device_synchronize callback to make sure that the terminated +descriptor is freed. + +Signed-off-by: Peter Ujfalusi +Reviewed-by: Linus Walleij +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/amba-pl08x.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/dma/amba-pl08x.c ++++ b/drivers/dma/amba-pl08x.c +@@ -2182,7 +2182,7 @@ static int pl08x_terminate_all(struct dm + } + /* Dequeue jobs and free LLIs */ + if (plchan->at) { +- pl08x_desc_free(&plchan->at->vd); ++ vchan_terminate_vdesc(&plchan->at->vd); + plchan->at = NULL; + } + /* Dequeue jobs not yet fired as well */ +@@ -2193,6 +2193,13 @@ static int pl08x_terminate_all(struct dm + return 0; + } + ++static void pl08x_synchronize(struct dma_chan *chan) ++{ ++ struct pl08x_dma_chan *plchan = to_pl08x_chan(chan); ++ ++ vchan_synchronize(&plchan->vc); ++} ++ + static int pl08x_pause(struct dma_chan *chan) + { + struct pl08x_dma_chan *plchan = to_pl08x_chan(chan); +@@ -2773,6 +2780,7 @@ static int pl08x_probe(struct amba_devic + pl08x->memcpy.device_pause = pl08x_pause; + pl08x->memcpy.device_resume = pl08x_resume; + pl08x->memcpy.device_terminate_all = pl08x_terminate_all; ++ pl08x->memcpy.device_synchronize = pl08x_synchronize; + pl08x->memcpy.src_addr_widths = PL80X_DMA_BUSWIDTHS; + pl08x->memcpy.dst_addr_widths = PL80X_DMA_BUSWIDTHS; + pl08x->memcpy.directions = BIT(DMA_MEM_TO_MEM); +@@ -2802,6 +2810,7 @@ static int pl08x_probe(struct amba_devic + pl08x->slave.device_pause = pl08x_pause; + pl08x->slave.device_resume = pl08x_resume; + pl08x->slave.device_terminate_all = pl08x_terminate_all; ++ pl08x->slave.device_synchronize = pl08x_synchronize; + pl08x->slave.src_addr_widths = PL80X_DMA_BUSWIDTHS; + pl08x->slave.dst_addr_widths = PL80X_DMA_BUSWIDTHS; + pl08x->slave.directions = diff --git a/queue-4.14/dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch b/queue-4.14/dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch new file mode 100644 index 00000000000..a71a5e587d2 --- /dev/null +++ b/queue-4.14/dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch @@ -0,0 +1,58 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Peter Ujfalusi +Date: Tue, 14 Nov 2017 16:32:07 +0200 +Subject: dmaengine: bcm2835-dma: Use vchan_terminate_vdesc() instead of desc_free + +From: Peter Ujfalusi + + +[ Upstream commit de92436ac40ffe9933230aa503e24dbb5ede9201 ] + +To avoid race with vchan_complete, use the race free way to terminate +running transfer. + +Implement the device_synchronize callback to make sure that the terminated +descriptor is freed. + +Signed-off-by: Peter Ujfalusi +Acked-by: Eric Anholt +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/bcm2835-dma.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/dma/bcm2835-dma.c ++++ b/drivers/dma/bcm2835-dma.c +@@ -812,7 +812,7 @@ static int bcm2835_dma_terminate_all(str + * c->desc is NULL and exit.) + */ + if (c->desc) { +- bcm2835_dma_desc_free(&c->desc->vd); ++ vchan_terminate_vdesc(&c->desc->vd); + c->desc = NULL; + bcm2835_dma_abort(c->chan_base); + +@@ -836,6 +836,13 @@ static int bcm2835_dma_terminate_all(str + return 0; + } + ++static void bcm2835_dma_synchronize(struct dma_chan *chan) ++{ ++ struct bcm2835_chan *c = to_bcm2835_dma_chan(chan); ++ ++ vchan_synchronize(&c->vc); ++} ++ + static int bcm2835_dma_chan_init(struct bcm2835_dmadev *d, int chan_id, + int irq, unsigned int irq_flags) + { +@@ -942,6 +949,7 @@ static int bcm2835_dma_probe(struct plat + od->ddev.device_prep_dma_memcpy = bcm2835_dma_prep_dma_memcpy; + od->ddev.device_config = bcm2835_dma_slave_config; + od->ddev.device_terminate_all = bcm2835_dma_terminate_all; ++ od->ddev.device_synchronize = bcm2835_dma_synchronize; + od->ddev.src_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES); + od->ddev.dst_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES); + od->ddev.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV) | diff --git a/queue-4.14/dmaengine-qcom_hidma-check-pending-interrupts.patch b/queue-4.14/dmaengine-qcom_hidma-check-pending-interrupts.patch new file mode 100644 index 00000000000..889cb7c8531 --- /dev/null +++ b/queue-4.14/dmaengine-qcom_hidma-check-pending-interrupts.patch @@ -0,0 +1,63 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Sinan Kaya +Date: Tue, 14 Nov 2017 09:55:01 -0500 +Subject: dmaengine: qcom_hidma: check pending interrupts + +From: Sinan Kaya + + +[ Upstream commit 38680bc6b1e3592bc9e18adc1d6e259667df27ce ] + +Driver is missing the interrupts if two requests are queued up at the same +time as the interrupt handler is servicing a request that was just +delivered. + +The ISR clears the interrupt at the end but it could be clearing the +interrupt for an outstanding event. Therefore, second interrupt never +arrives. + +Clear the interrupt first and then check for completions. + +Also, make sure that request start and interrupt clear do not overlap in +time by using a spinlock. + +Signed-off-by: Sinan Kaya +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/qcom/hidma_ll.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/dma/qcom/hidma_ll.c ++++ b/drivers/dma/qcom/hidma_ll.c +@@ -393,6 +393,8 @@ static int hidma_ll_reset(struct hidma_l + */ + static void hidma_ll_int_handler_internal(struct hidma_lldev *lldev, int cause) + { ++ unsigned long irqflags; ++ + if (cause & HIDMA_ERR_INT_MASK) { + dev_err(lldev->dev, "error 0x%x, disabling...\n", + cause); +@@ -410,6 +412,10 @@ static void hidma_ll_int_handler_interna + return; + } + ++ spin_lock_irqsave(&lldev->lock, irqflags); ++ writel_relaxed(cause, lldev->evca + HIDMA_EVCA_IRQ_CLR_REG); ++ spin_unlock_irqrestore(&lldev->lock, irqflags); ++ + /* + * Fine tuned for this HW... + * +@@ -421,9 +427,6 @@ static void hidma_ll_int_handler_interna + * Try to consume as many EVREs as possible. + */ + hidma_handle_tre_completion(lldev); +- +- /* We consumed TREs or there are pending TREs or EVREs. */ +- writel_relaxed(cause, lldev->evca + HIDMA_EVCA_IRQ_CLR_REG); + } + + irqreturn_t hidma_ll_inthandler(int chirq, void *arg) diff --git a/queue-4.14/drm-amdgpu-fix-get_max_engine_clock_in_mhz.patch b/queue-4.14/drm-amdgpu-fix-get_max_engine_clock_in_mhz.patch new file mode 100644 index 00000000000..4151d6ef8f3 --- /dev/null +++ b/queue-4.14/drm-amdgpu-fix-get_max_engine_clock_in_mhz.patch @@ -0,0 +1,36 @@ +From foo@baz Fri Mar 16 15:43:16 CET 2018 +From: Felix Kuehling +Date: Mon, 27 Nov 2017 18:29:43 -0500 +Subject: drm/amdgpu: fix get_max_engine_clock_in_mhz + +From: Felix Kuehling + + +[ Upstream commit a9efcc19161e20623c285fac967a32842972cebe ] + +Use proper powerplay function. This fixes OpenCL initialization +problems. + +Signed-off-by: Felix Kuehling +Acked-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c +@@ -265,6 +265,9 @@ uint32_t get_max_engine_clock_in_mhz(str + { + struct amdgpu_device *adev = (struct amdgpu_device *)kgd; + +- /* The sclk is in quantas of 10kHz */ +- return adev->pm.dpm.dyn_state.max_clock_voltage_on_ac.sclk / 100; ++ /* the sclk is in quantas of 10kHz */ ++ if (amdgpu_sriov_vf(adev)) ++ return adev->clock.default_sclk / 100; ++ ++ return amdgpu_dpm_get_sclk(adev, false) / 100; + } diff --git a/queue-4.14/drm-amdgpu-fix-random-missing-of-flr-notify.patch b/queue-4.14/drm-amdgpu-fix-random-missing-of-flr-notify.patch new file mode 100644 index 00000000000..bd2c690495e --- /dev/null +++ b/queue-4.14/drm-amdgpu-fix-random-missing-of-flr-notify.patch @@ -0,0 +1,42 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Monk Liu +Date: Tue, 24 Oct 2017 15:10:11 +0800 +Subject: drm/amdgpu:fix random missing of FLR NOTIFY + +From: Monk Liu + + +[ Upstream commit 34a4d2bf06b3ab92024b8e26d6049411369d1f1a ] + +Signed-off-by: Monk Liu +Acked-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c ++++ b/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c +@@ -276,9 +276,17 @@ static int xgpu_ai_mailbox_rcv_irq(struc + /* see what event we get */ + r = xgpu_ai_mailbox_rcv_msg(adev, IDH_FLR_NOTIFICATION); + +- /* only handle FLR_NOTIFY now */ +- if (!r) +- schedule_work(&adev->virt.flr_work); ++ /* sometimes the interrupt is delayed to inject to VM, so under such case ++ * the IDH_FLR_NOTIFICATION is overwritten by VF FLR from GIM side, thus ++ * above recieve message could be failed, we should schedule the flr_work ++ * anyway ++ */ ++ if (r) { ++ DRM_ERROR("FLR_NOTIFICATION is missed\n"); ++ xgpu_ai_mailbox_send_ack(adev); ++ } ++ ++ schedule_work(&adev->virt.flr_work); + } + + return 0; diff --git a/queue-4.14/drm-amdgpu-fix-virtual-dce-bug.patch b/queue-4.14/drm-amdgpu-fix-virtual-dce-bug.patch new file mode 100644 index 00000000000..588f97e1eb1 --- /dev/null +++ b/queue-4.14/drm-amdgpu-fix-virtual-dce-bug.patch @@ -0,0 +1,42 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Monk Liu +Date: Wed, 15 Nov 2017 17:10:13 +0800 +Subject: drm/amdgpu:fix virtual dce bug + +From: Monk Liu + + +[ Upstream commit 129d65c18ecfb249aceb540c31fdaf79bd5a11ff ] + +this fix the issue that access memory after freed +after driver unloaded. + +Signed-off-by: Monk Liu +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/dce_virtual.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/dce_virtual.c ++++ b/drivers/gpu/drm/amd/amdgpu/dce_virtual.c +@@ -437,6 +437,8 @@ static int dce_virtual_sw_fini(void *han + drm_kms_helper_poll_fini(adev->ddev); + + drm_mode_config_cleanup(adev->ddev); ++ /* clear crtcs pointer to avoid dce irq finish routine access freed data */ ++ memset(adev->mode_info.crtcs, 0, sizeof(adev->mode_info.crtcs[0]) * AMDGPU_MAX_CRTCS); + adev->mode_info.mode_config_initialized = false; + return 0; + } +@@ -723,7 +725,7 @@ static void dce_virtual_set_crtc_vblank_ + int crtc, + enum amdgpu_interrupt_state state) + { +- if (crtc >= adev->mode_info.num_crtc) { ++ if (crtc >= adev->mode_info.num_crtc || !adev->mode_info.crtcs[crtc]) { + DRM_DEBUG("invalid crtc %d\n", crtc); + return; + } diff --git a/queue-4.14/drm-amdkfd-fix-memory-leaks-in-kfd-topology.patch b/queue-4.14/drm-amdkfd-fix-memory-leaks-in-kfd-topology.patch new file mode 100644 index 00000000000..2f9350cc63c --- /dev/null +++ b/queue-4.14/drm-amdkfd-fix-memory-leaks-in-kfd-topology.patch @@ -0,0 +1,78 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Yong Zhao +Date: Fri, 8 Dec 2017 23:08:48 -0500 +Subject: drm/amdkfd: Fix memory leaks in kfd topology + +From: Yong Zhao + + +[ Upstream commit 5108d768408abc80e4e8d99f5b406a73cb04056b ] + +Kobject created using kobject_create_and_add() can be freed using +kobject_put() when there is no referenece any more. However, +kobject memory allocated with kzalloc() has to set up a release +callback in order to free it when the counter decreases to 0. +Otherwise it causes memory leak. + +Signed-off-by: Yong Zhao +Signed-off-by: Felix Kuehling +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c +@@ -501,11 +501,17 @@ static ssize_t sysprops_show(struct kobj + return ret; + } + ++static void kfd_topology_kobj_release(struct kobject *kobj) ++{ ++ kfree(kobj); ++} ++ + static const struct sysfs_ops sysprops_ops = { + .show = sysprops_show, + }; + + static struct kobj_type sysprops_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &sysprops_ops, + }; + +@@ -541,6 +547,7 @@ static const struct sysfs_ops iolink_ops + }; + + static struct kobj_type iolink_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &iolink_ops, + }; + +@@ -568,6 +575,7 @@ static const struct sysfs_ops mem_ops = + }; + + static struct kobj_type mem_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &mem_ops, + }; + +@@ -607,6 +615,7 @@ static const struct sysfs_ops cache_ops + }; + + static struct kobj_type cache_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &cache_ops, + }; + +@@ -729,6 +738,7 @@ static const struct sysfs_ops node_ops = + }; + + static struct kobj_type node_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &node_ops, + }; + diff --git a/queue-4.14/drm-edid-set-eld-connector-type-in-drm_edid_to_eld.patch b/queue-4.14/drm-edid-set-eld-connector-type-in-drm_edid_to_eld.patch new file mode 100644 index 00000000000..be4c1e28d9f --- /dev/null +++ b/queue-4.14/drm-edid-set-eld-connector-type-in-drm_edid_to_eld.patch @@ -0,0 +1,70 @@ +From foo@baz Fri Mar 16 15:43:16 CET 2018 +From: Jani Nikula +Date: Wed, 1 Nov 2017 16:20:58 +0200 +Subject: drm/edid: set ELD connector type in drm_edid_to_eld() + +From: Jani Nikula + + +[ Upstream commit 1d1c36650752b7fb81cee515a9bba4131cac4b7c ] + +Since drm_edid_to_eld() knows the connector type, we can set the type in +ELD while at it. Most connectors this gets called on are not DP +encoders, and with the HDMI type being 0, this does not change behaviour +for non-DP. + +For i915 having this in place earlier would have saved a considerable +amount of debugging that lead to the fix 2d8f63297b9f ("drm/i915: always +update ELD connector type after get modes"). I don't see other drivers, +even the ones calling drm_edid_to_eld() on DP connectors, setting the +connector type in ELD. + +Cc: Alex Deucher +Cc: Christian König +Cc: Archit Taneja +Cc: Andrzej Hajda +Cc: Russell King +Cc: CK Hu +Cc: Philipp Zabel +Cc: Ben Skeggs +Cc: Mark Yao +Cc: Benjamin Gaignard +Cc: Vincent Abriou +Cc: Thierry Reding +Cc: Eric Anholt +Reviewed-by: Ville Syrjälä +Reviewed-by: Alex Deucher +Acked-by: Thierry Reding +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/d527b31619528c477c2c136f25cdf118bc0cfc1d.1509545641.git.jani.nikula@intel.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_edid.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -3823,8 +3823,7 @@ EXPORT_SYMBOL(drm_edid_get_monitor_name) + * @edid: EDID to parse + * + * Fill the ELD (EDID-Like Data) buffer for passing to the audio driver. The +- * Conn_Type, HDCP and Port_ID ELD fields are left for the graphics driver to +- * fill in. ++ * HDCP and Port_ID ELD fields are left for the graphics driver to fill in. + */ + void drm_edid_to_eld(struct drm_connector *connector, struct edid *edid) + { +@@ -3905,6 +3904,12 @@ void drm_edid_to_eld(struct drm_connecto + } + eld[5] |= total_sad_count << 4; + ++ if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort || ++ connector->connector_type == DRM_MODE_CONNECTOR_eDP) ++ eld[DRM_ELD_SAD_COUNT_CONN_TYPE] |= DRM_ELD_CONN_TYPE_DP; ++ else ++ eld[DRM_ELD_SAD_COUNT_CONN_TYPE] |= DRM_ELD_CONN_TYPE_HDMI; ++ + eld[DRM_ELD_BASELINE_ELD_LEN] = + DIV_ROUND_UP(drm_eld_calc_baseline_block_size(eld), 4); + diff --git a/queue-4.14/drm-etnaviv-make-thermal-selectable.patch b/queue-4.14/drm-etnaviv-make-thermal-selectable.patch new file mode 100644 index 00000000000..e17eba6b5e5 --- /dev/null +++ b/queue-4.14/drm-etnaviv-make-thermal-selectable.patch @@ -0,0 +1,118 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Philipp Zabel +Date: Fri, 1 Dec 2017 16:00:41 +0100 +Subject: drm/etnaviv: make THERMAL selectable + +From: Philipp Zabel + + +[ Upstream commit 49b82c389d2a40eaef1355aaa35868b367aec9d1 ] + +The etnaviv driver causes a link failure if it is built-in but THERMAL +is built as a module: + + drivers/gpu/drm/etnaviv/etnaviv_gpu.o: In function `etnaviv_gpu_bind': + etnaviv_gpu.c:(.text+0x4c4): undefined reference to `thermal_of_cooling_device_register' + etnaviv_gpu.c:(.text+0x600): undefined reference to `thermal_cooling_device_unregister' + drivers/gpu/drm/etnaviv/etnaviv_gpu.o: In function `etnaviv_gpu_unbind': + etnaviv_gpu.c:(.text+0x2aac): undefined reference to `thermal_cooling_device_unregister' + +Adding a Kconfig dependency on THERMAL || !THERMAL to avoid this causes +a dependency loop on x86_64: + + drivers/gpu/drm/tve200/Kconfig:1:error: recursive dependency detected! + For a resolution refer to Documentation/kbuild/kconfig-language.txt + subsection "Kconfig recursive dependency limitations" + drivers/gpu/drm/tve200/Kconfig:1: symbol DRM_TVE200 depends on CMA + For a resolution refer to Documentation/kbuild/kconfig-language.txt + subsection "Kconfig recursive dependency limitations" + mm/Kconfig:489: symbol CMA is selected by DRM_ETNAVIV + For a resolution refer to Documentation/kbuild/kconfig-language.txt + subsection "Kconfig recursive dependency limitations" + drivers/gpu/drm/etnaviv/Kconfig:2: symbol DRM_ETNAVIV depends on THERMAL + For a resolution refer to Documentation/kbuild/kconfig-language.txt + subsection "Kconfig recursive dependency limitations" + drivers/thermal/Kconfig:5: symbol THERMAL is selected by ACPI_VIDEO + For a resolution refer to Documentation/kbuild/kconfig-language.txt + subsection "Kconfig recursive dependency limitations" + drivers/acpi/Kconfig:189: symbol ACPI_VIDEO is selected by BACKLIGHT_CLASS_DEVICE + For a resolution refer to Documentation/kbuild/kconfig-language.txt + subsection "Kconfig recursive dependency limitations" + drivers/video/backlight/Kconfig:158: symbol BACKLIGHT_CLASS_DEVICE is selected by DRM_PARADE_PS8622 + For a resolution refer to Documentation/kbuild/kconfig-language.txt + subsection "Kconfig recursive dependency limitations" + drivers/gpu/drm/bridge/Kconfig:62: symbol DRM_PARADE_PS8622 depends on DRM_BRIDGE + For a resolution refer to Documentation/kbuild/kconfig-language.txt + subsection "Kconfig recursive dependency limitations" + drivers/gpu/drm/bridge/Kconfig:1: symbol DRM_BRIDGE is selected by DRM_TVE200 + +To work around this, add a new option DRM_ETNAVIV_THERMAL to optionally +enable thermal throttling support and make DRM_ETNAVIV select THERMAL +at the same time. + +Reported-by: Stephen Rothwell +Signed-off-by: Philipp Zabel +Signed-off-by: Lucas Stach +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/etnaviv/Kconfig | 9 +++++++++ + drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 8 +++++--- + 2 files changed, 14 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/etnaviv/Kconfig ++++ b/drivers/gpu/drm/etnaviv/Kconfig +@@ -6,6 +6,7 @@ config DRM_ETNAVIV + depends on MMU + select SHMEM + select SYNC_FILE ++ select THERMAL if DRM_ETNAVIV_THERMAL + select TMPFS + select IOMMU_API + select IOMMU_SUPPORT +@@ -15,6 +16,14 @@ config DRM_ETNAVIV + help + DRM driver for Vivante GPUs. + ++config DRM_ETNAVIV_THERMAL ++ bool "enable ETNAVIV thermal throttling" ++ depends on DRM_ETNAVIV ++ default y ++ help ++ Compile in support for thermal throttling. ++ Say Y unless you want to risk burning your SoC. ++ + config DRM_ETNAVIV_REGISTER_LOGGING + bool "enable ETNAVIV register logging" + depends on DRM_ETNAVIV +--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c +@@ -1622,7 +1622,7 @@ static int etnaviv_gpu_bind(struct devic + struct etnaviv_gpu *gpu = dev_get_drvdata(dev); + int ret; + +- if (IS_ENABLED(CONFIG_THERMAL)) { ++ if (IS_ENABLED(CONFIG_DRM_ETNAVIV_THERMAL)) { + gpu->cooling = thermal_of_cooling_device_register(dev->of_node, + (char *)dev_name(dev), gpu, &cooling_ops); + if (IS_ERR(gpu->cooling)) +@@ -1635,7 +1635,8 @@ static int etnaviv_gpu_bind(struct devic + ret = etnaviv_gpu_clk_enable(gpu); + #endif + if (ret < 0) { +- thermal_cooling_device_unregister(gpu->cooling); ++ if (IS_ENABLED(CONFIG_DRM_ETNAVIV_THERMAL)) ++ thermal_cooling_device_unregister(gpu->cooling); + return ret; + } + +@@ -1692,7 +1693,8 @@ static void etnaviv_gpu_unbind(struct de + + gpu->drm = NULL; + +- thermal_cooling_device_unregister(gpu->cooling); ++ if (IS_ENABLED(CONFIG_DRM_ETNAVIV_THERMAL)) ++ thermal_cooling_device_unregister(gpu->cooling); + gpu->cooling = NULL; + } + diff --git a/queue-4.14/drm-sun4i-fix-format-mask-in-de2-driver.patch b/queue-4.14/drm-sun4i-fix-format-mask-in-de2-driver.patch new file mode 100644 index 00000000000..f1346bc4d3c --- /dev/null +++ b/queue-4.14/drm-sun4i-fix-format-mask-in-de2-driver.patch @@ -0,0 +1,34 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Jernej Skrabec +Date: Fri, 1 Dec 2017 07:05:24 +0100 +Subject: drm/sun4i: Fix format mask in DE2 driver + +From: Jernej Skrabec + + +[ Upstream commit a2407f4bd1f3001d6b46f6d32eb1cc98a60f5a43 ] + +Format mask is one bit too short. Fix it. + +Fixes: 9d75b8c0b999 (drm/sun4i: add support for Allwinner DE2 mixers) + +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20171201060550.10392-2-jernej.skrabec@siol.net +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/sun4i/sun8i_mixer.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/sun4i/sun8i_mixer.h ++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.h +@@ -80,7 +80,7 @@ + + #define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_EN BIT(0) + #define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_ALPHA_MODE_MASK GENMASK(2, 1) +-#define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_FBFMT_MASK GENMASK(11, 8) ++#define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_FBFMT_MASK GENMASK(12, 8) + #define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_ALPHA_MASK GENMASK(31, 24) + #define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_ALPHA_MODE_DEF (1 << 1) + #define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_FBFMT_ARGB8888 (0 << 8) diff --git a/queue-4.14/fix-misannotated-out-of-line-_copy_to_user.patch b/queue-4.14/fix-misannotated-out-of-line-_copy_to_user.patch new file mode 100644 index 00000000000..191675d05d2 --- /dev/null +++ b/queue-4.14/fix-misannotated-out-of-line-_copy_to_user.patch @@ -0,0 +1,33 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Christophe Leroy +Date: Sat, 9 Dec 2017 17:24:24 +0100 +Subject: Fix misannotated out-of-line _copy_to_user() + +From: Christophe Leroy + + +[ Upstream commit a0e94598e6b6c0d1df6a5fa14eb7c767ca817a20 ] + +Destination is a kernel pointer and source - a userland one +in _copy_from_user(); _copy_to_user() is the other way round. + +Fixes: d597580d37377 ("generic ...copy_..._user primitives") +Signed-off-by: Christophe Leroy +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + lib/usercopy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/lib/usercopy.c ++++ b/lib/usercopy.c +@@ -20,7 +20,7 @@ EXPORT_SYMBOL(_copy_from_user); + #endif + + #ifndef INLINE_COPY_TO_USER +-unsigned long _copy_to_user(void *to, const void __user *from, unsigned long n) ++unsigned long _copy_to_user(void __user *to, const void *from, unsigned long n) + { + might_fault(); + if (likely(access_ok(VERIFY_WRITE, to, n))) { diff --git a/queue-4.14/hid-elo-clear-btn_left-mapping.patch b/queue-4.14/hid-elo-clear-btn_left-mapping.patch new file mode 100644 index 00000000000..0048ffe5487 --- /dev/null +++ b/queue-4.14/hid-elo-clear-btn_left-mapping.patch @@ -0,0 +1,38 @@ +From foo@baz Fri Mar 16 15:43:16 CET 2018 +From: Jiri Kosina +Date: Wed, 22 Nov 2017 11:19:51 +0100 +Subject: HID: elo: clear BTN_LEFT mapping + +From: Jiri Kosina + + +[ Upstream commit 9abd04af951e5734c9d5cfee9b49790844b734cf ] + +ELO devices have one Button usage in GenDesk field, which makes hid-input map +it to BTN_LEFT; that confuses userspace, which then considers the device to be +a mouse/touchpad instead of touchscreen. + +Fix that by unmapping BTN_LEFT and keeping only BTN_TOUCH in place. + +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-elo.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/hid/hid-elo.c ++++ b/drivers/hid/hid-elo.c +@@ -42,6 +42,12 @@ static int elo_input_configured(struct h + { + struct input_dev *input = hidinput->input; + ++ /* ++ * ELO devices have one Button usage in GenDesk field, which makes ++ * hid-input map it to BTN_LEFT; that confuses userspace, which then ++ * considers the device to be a mouse/touchpad instead of touchscreen. ++ */ ++ clear_bit(BTN_LEFT, input->keybit); + set_bit(BTN_TOUCH, input->keybit); + set_bit(ABS_PRESSURE, input->absbit); + input_set_abs_params(input, ABS_PRESSURE, 0, 256, 0, 0); diff --git a/queue-4.14/hid-multitouch-only-look-at-non-touch-fields-in-first-packet-of-a-frame.patch b/queue-4.14/hid-multitouch-only-look-at-non-touch-fields-in-first-packet-of-a-frame.patch new file mode 100644 index 00000000000..975af317f15 --- /dev/null +++ b/queue-4.14/hid-multitouch-only-look-at-non-touch-fields-in-first-packet-of-a-frame.patch @@ -0,0 +1,85 @@ +From foo@baz Fri Mar 16 15:43:16 CET 2018 +From: Hans de Goede +Date: Wed, 22 Nov 2017 12:57:09 +0100 +Subject: HID: multitouch: Only look at non touch fields in first packet of a frame + +From: Hans de Goede + + +[ Upstream commit 55746d28d66860bccaae20a67b55b9d5db7c14af ] + +Devices in "single finger hybrid mode" will send one report per finger, +on some devices only the first report of such a multi-packet frame will +contain a value for BTN_LEFT, in subsequent reports (if multiple fingers +are down) the value is always 0, causing hid-mt to report BTN_LEFT going +1 - 0 - 1 - 0 when pressing a clickpad and putting down a second finger. +This happens for example on USB 0603:0002 mt touchpads. + +This commit fixes this by only reporting non touch fields for the first +packet of a (possibly) multi-packet frame. + +Signed-off-by: Hans de Goede +Reviewed-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-multitouch.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -738,9 +738,11 @@ static int mt_touch_event(struct hid_dev + } + + static void mt_process_mt_event(struct hid_device *hid, struct hid_field *field, +- struct hid_usage *usage, __s32 value) ++ struct hid_usage *usage, __s32 value, ++ bool first_packet) + { + struct mt_device *td = hid_get_drvdata(hid); ++ __s32 cls = td->mtclass.name; + __s32 quirks = td->mtclass.quirks; + struct input_dev *input = field->hidinput->input; + +@@ -794,6 +796,15 @@ static void mt_process_mt_event(struct h + break; + + default: ++ /* ++ * For Win8 PTP touchpads we should only look at ++ * non finger/touch events in the first_packet of ++ * a (possible) multi-packet frame. ++ */ ++ if ((cls == MT_CLS_WIN_8 || cls == MT_CLS_WIN_8_DUAL) && ++ !first_packet) ++ return; ++ + if (usage->type) + input_event(input, usage->type, usage->code, + value); +@@ -813,6 +824,7 @@ static void mt_touch_report(struct hid_d + { + struct mt_device *td = hid_get_drvdata(hid); + struct hid_field *field; ++ bool first_packet; + unsigned count; + int r, n; + +@@ -831,6 +843,7 @@ static void mt_touch_report(struct hid_d + td->num_expected = value; + } + ++ first_packet = td->num_received == 0; + for (r = 0; r < report->maxfield; r++) { + field = report->field[r]; + count = field->report_count; +@@ -840,7 +853,7 @@ static void mt_touch_report(struct hid_d + + for (n = 0; n < count; n++) + mt_process_mt_event(hid, field, &field->usage[n], +- field->value[n]); ++ field->value[n], first_packet); + } + + if (td->num_received >= td->num_expected) diff --git a/queue-4.14/ib-mlx5-revisit-wmaybe-uninitialized-warning.patch b/queue-4.14/ib-mlx5-revisit-wmaybe-uninitialized-warning.patch new file mode 100644 index 00000000000..37a57d9eeef --- /dev/null +++ b/queue-4.14/ib-mlx5-revisit-wmaybe-uninitialized-warning.patch @@ -0,0 +1,56 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Arnd Bergmann +Date: Mon, 11 Dec 2017 12:45:44 +0100 +Subject: IB/mlx5: revisit -Wmaybe-uninitialized warning + +From: Arnd Bergmann + + +[ Upstream commit 1b19b95169cd52fe82cd442fec0b279fe25cc838 ] + +A warning that I thought I had fixed before occasionally comes +back in rare randconfig builds (I found 7 instances in the last +100000 builds, originally it was much more frequent): + +drivers/infiniband/hw/mlx5/mr.c: In function 'mlx5_ib_reg_user_mr': +drivers/infiniband/hw/mlx5/mr.c:1229:5: error: 'order' may be used uninitialized in this function [-Werror=maybe-uninitialized] + if (order <= mr_cache_max_order(dev)) { + ^ +drivers/infiniband/hw/mlx5/mr.c:1247:8: error: 'ncont' may be used uninitialized in this function [-Werror=maybe-uninitialized] +drivers/infiniband/hw/mlx5/mr.c:1247:8: error: 'page_shift' may be used uninitialized in this function [-Werror=maybe-uninitialized] +drivers/infiniband/hw/mlx5/mr.c:1260:2: error: 'npages' may be used uninitialized in this function [-Werror=maybe-uninitialized] + +I've looked at all those findings again and noticed that they are all +with CONFIG_INFINIBAND_USER_MEM=n, which means ib_umem_get() returns +an error unconditionally and we never initialize or use those variables. +This triggers a condition in gcc iff mr_umem_get() is partially but not +entirely inlined, which in turn depends on the exact combination of +optimization settings. This is a known problem with gcc, with no +easy solution in the compiler, so this adds another workaround that +should be more reliable than my previous attempt. + +Returning an error from mlx5_ib_reg_user_mr() earlier means that we +can completely bypass the logic that caused the warning, the compiler +can now see that the variable is never accessed. + +Fixes: 14ab8896f5d9 ("IB/mlx5: avoid bogus -Wmaybe-uninitialized warning") +Signed-off-by: Arnd Bergmann +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/mlx5/mr.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -1206,6 +1206,9 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct + int err; + bool use_umr = true; + ++ if (!IS_ENABLED(CONFIG_INFINIBAND_USER_MEM)) ++ return ERR_PTR(-EINVAL); ++ + mlx5_ib_dbg(dev, "start 0x%llx, virt_addr 0x%llx, length 0x%llx, access_flags 0x%x\n", + start, virt_addr, length, access_flags); + diff --git a/queue-4.14/iio-adc-ina2xx-shift-bus-voltage-register-to-mask-flag-bits.patch b/queue-4.14/iio-adc-ina2xx-shift-bus-voltage-register-to-mask-flag-bits.patch new file mode 100644 index 00000000000..b9ec0803939 --- /dev/null +++ b/queue-4.14/iio-adc-ina2xx-shift-bus-voltage-register-to-mask-flag-bits.patch @@ -0,0 +1,116 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: "Stefan Brüns" +Date: Sat, 28 Oct 2017 23:12:46 +0200 +Subject: iio: adc: ina2xx: Shift bus voltage register to mask flag bits + +From: "Stefan Brüns" + + +[ Upstream commit 2e64438487697f3f099946edc8acd4ceea6b1ab2 ] + +Lower bits of the INA219/220 bus voltage register are conversion +status flags, properly shift the value. + +When reading via IIO buffer, the value is passed on unaltered, +shifting is the responsibility of the user. + +Signed-off-by: Stefan Brüns +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ina2xx-adc.c | 26 +++++++++++++++++--------- + 1 file changed, 17 insertions(+), 9 deletions(-) + +--- a/drivers/iio/adc/ina2xx-adc.c ++++ b/drivers/iio/adc/ina2xx-adc.c +@@ -44,7 +44,6 @@ + + #define INA226_MASK_ENABLE 0x06 + #define INA226_CVRF BIT(3) +-#define INA219_CNVR BIT(1) + + #define INA2XX_MAX_REGISTERS 8 + +@@ -79,6 +78,11 @@ + #define INA226_ITS_MASK GENMASK(5, 3) + #define INA226_SHIFT_ITS(val) ((val) << 3) + ++/* INA219 Bus voltage register, low bits are flags */ ++#define INA219_OVF BIT(0) ++#define INA219_CNVR BIT(1) ++#define INA219_BUS_VOLTAGE_SHIFT 3 ++ + /* Cosmetic macro giving the sampling period for a full P=UxI cycle */ + #define SAMPLING_PERIOD(c) ((c->int_time_vbus + c->int_time_vshunt) \ + * c->avg) +@@ -112,7 +116,7 @@ struct ina2xx_config { + u16 config_default; + int calibration_factor; + int shunt_div; +- int bus_voltage_shift; ++ int bus_voltage_shift; /* position of lsb */ + int bus_voltage_lsb; /* uV */ + int power_lsb; /* uW */ + enum ina2xx_ids chip_id; +@@ -135,7 +139,7 @@ static const struct ina2xx_config ina2xx + .config_default = INA219_CONFIG_DEFAULT, + .calibration_factor = 40960000, + .shunt_div = 100, +- .bus_voltage_shift = 3, ++ .bus_voltage_shift = INA219_BUS_VOLTAGE_SHIFT, + .bus_voltage_lsb = 4000, + .power_lsb = 20000, + .chip_id = ina219, +@@ -170,6 +174,9 @@ static int ina2xx_read_raw(struct iio_de + else + *val = regval; + ++ if (chan->address == INA2XX_BUS_VOLTAGE) ++ *val >>= chip->config->bus_voltage_shift; ++ + return IIO_VAL_INT; + + case IIO_CHAN_INFO_OVERSAMPLING_RATIO: +@@ -203,9 +210,9 @@ static int ina2xx_read_raw(struct iio_de + return IIO_VAL_FRACTIONAL; + + case INA2XX_BUS_VOLTAGE: +- /* processed (mV) = raw*lsb (uV) / (1000 << shift) */ ++ /* processed (mV) = raw * lsb (uV) / 1000 */ + *val = chip->config->bus_voltage_lsb; +- *val2 = 1000 << chip->config->bus_voltage_shift; ++ *val2 = 1000; + return IIO_VAL_FRACTIONAL; + + case INA2XX_POWER: +@@ -532,7 +539,7 @@ static ssize_t ina2xx_shunt_resistor_sto + * Sampling Freq is a consequence of the integration times of + * the Voltage channels. + */ +-#define INA219_CHAN_VOLTAGE(_index, _address) { \ ++#define INA219_CHAN_VOLTAGE(_index, _address, _shift) { \ + .type = IIO_VOLTAGE, \ + .address = (_address), \ + .indexed = 1, \ +@@ -544,7 +551,8 @@ static ssize_t ina2xx_shunt_resistor_sto + .scan_index = (_index), \ + .scan_type = { \ + .sign = 'u', \ +- .realbits = 16, \ ++ .shift = _shift, \ ++ .realbits = 16 - _shift, \ + .storagebits = 16, \ + .endianness = IIO_LE, \ + } \ +@@ -579,8 +587,8 @@ static const struct iio_chan_spec ina226 + }; + + static const struct iio_chan_spec ina219_channels[] = { +- INA219_CHAN_VOLTAGE(0, INA2XX_SHUNT_VOLTAGE), +- INA219_CHAN_VOLTAGE(1, INA2XX_BUS_VOLTAGE), ++ INA219_CHAN_VOLTAGE(0, INA2XX_SHUNT_VOLTAGE, 0), ++ INA219_CHAN_VOLTAGE(1, INA2XX_BUS_VOLTAGE, INA219_BUS_VOLTAGE_SHIFT), + INA219_CHAN(IIO_POWER, 2, INA2XX_POWER), + INA219_CHAN(IIO_CURRENT, 3, INA2XX_CURRENT), + IIO_CHAN_SOFT_TIMESTAMP(4), diff --git a/queue-4.14/iio-health-max30102-add-power-enable-parameter-to-get_temp-function.patch b/queue-4.14/iio-health-max30102-add-power-enable-parameter-to-get_temp-function.patch new file mode 100644 index 00000000000..02c902f5903 --- /dev/null +++ b/queue-4.14/iio-health-max30102-add-power-enable-parameter-to-get_temp-function.patch @@ -0,0 +1,89 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Peter Meerwald-Stadler +Date: Fri, 27 Oct 2017 21:45:38 +0200 +Subject: iio: health: max30102: Add power enable parameter to get_temp function + +From: Peter Meerwald-Stadler + + +[ Upstream commit a9c47abbdd71dceeaf1b923e5ce10e700e036905 ] + +Chip must not be in shutdown for reading temperature, so briefly leave +shutdown if buffer is not already running + +Signed-off-by: Peter Meerwald-Stadler +Acked-by: Matt Ranostay +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/health/max30102.c | 36 +++++++++++++++++++++++------------- + 1 file changed, 23 insertions(+), 13 deletions(-) + +--- a/drivers/iio/health/max30102.c ++++ b/drivers/iio/health/max30102.c +@@ -329,20 +329,31 @@ static int max30102_read_temp(struct max + return 0; + } + +-static int max30102_get_temp(struct max30102_data *data, int *val) ++static int max30102_get_temp(struct max30102_data *data, int *val, bool en) + { + int ret; + ++ if (en) { ++ ret = max30102_set_powermode(data, true); ++ if (ret) ++ return ret; ++ } ++ + /* start acquisition */ + ret = regmap_update_bits(data->regmap, MAX30102_REG_TEMP_CONFIG, + MAX30102_REG_TEMP_CONFIG_TEMP_EN, + MAX30102_REG_TEMP_CONFIG_TEMP_EN); + if (ret) +- return ret; ++ goto out; + + msleep(35); ++ ret = max30102_read_temp(data, val); ++ ++out: ++ if (en) ++ max30102_set_powermode(data, false); + +- return max30102_read_temp(data, val); ++ return ret; + } + + static int max30102_read_raw(struct iio_dev *indio_dev, +@@ -355,20 +366,19 @@ static int max30102_read_raw(struct iio_ + switch (mask) { + case IIO_CHAN_INFO_RAW: + /* +- * Temperature reading can only be acquired while engine +- * is running ++ * Temperature reading can only be acquired when not in ++ * shutdown; leave shutdown briefly when buffer not running + */ + mutex_lock(&indio_dev->mlock); +- + if (!iio_buffer_enabled(indio_dev)) +- ret = -EBUSY; +- else { +- ret = max30102_get_temp(data, val); +- if (!ret) +- ret = IIO_VAL_INT; +- } +- ++ ret = max30102_get_temp(data, val, true); ++ else ++ ret = max30102_get_temp(data, val, false); + mutex_unlock(&indio_dev->mlock); ++ if (ret) ++ return ret; ++ ++ ret = IIO_VAL_INT; + break; + case IIO_CHAN_INFO_SCALE: + *val = 1000; /* 62.5 */ diff --git a/queue-4.14/ima-relax-requiring-a-file-signature-for-new-files-with-zero-length.patch b/queue-4.14/ima-relax-requiring-a-file-signature-for-new-files-with-zero-length.patch new file mode 100644 index 00000000000..a7ce6a91123 --- /dev/null +++ b/queue-4.14/ima-relax-requiring-a-file-signature-for-new-files-with-zero-length.patch @@ -0,0 +1,43 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Mimi Zohar +Date: Wed, 8 Nov 2017 07:38:28 -0500 +Subject: ima: relax requiring a file signature for new files with zero length + +From: Mimi Zohar + + +[ Upstream commit b7e27bc1d42e8e0cc58b602b529c25cd0071b336 ] + +Custom policies can require file signatures based on LSM labels. These +files are normally created and only afterwards labeled, requiring them +to be signed. + +Instead of requiring file signatures based on LSM labels, entire +filesystems could require file signatures. In this case, we need the +ability of writing new files without requiring file signatures. + +The definition of a "new" file was originally defined as any file with +a length of zero. Subsequent patches redefined a "new" file to be based +on the FILE_CREATE open flag. By combining the open flag with a file +size of zero, this patch relaxes the file signature requirement. + +Fixes: 1ac202e978e1 ima: accept previously set IMA_NEW_FILE +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + security/integrity/ima/ima_appraise.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/security/integrity/ima/ima_appraise.c ++++ b/security/integrity/ima/ima_appraise.c +@@ -223,7 +223,8 @@ int ima_appraise_measurement(enum ima_ho + if (opened & FILE_CREATED) + iint->flags |= IMA_NEW_FILE; + if ((iint->flags & IMA_NEW_FILE) && +- !(iint->flags & IMA_DIGSIG_REQUIRED)) ++ (!(iint->flags & IMA_DIGSIG_REQUIRED) || ++ (inode->i_size == 0))) + status = INTEGRITY_PASS; + goto out; + } diff --git a/queue-4.14/ipvlan-add-l2-check-for-packets-arriving-via-virtual-devices.patch b/queue-4.14/ipvlan-add-l2-check-for-packets-arriving-via-virtual-devices.patch new file mode 100644 index 00000000000..cdfee41e039 --- /dev/null +++ b/queue-4.14/ipvlan-add-l2-check-for-packets-arriving-via-virtual-devices.patch @@ -0,0 +1,55 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Mahesh Bandewar +Date: Thu, 7 Dec 2017 15:15:43 -0800 +Subject: ipvlan: add L2 check for packets arriving via virtual devices + +From: Mahesh Bandewar + + +[ Upstream commit 92ff42645028fa6f9b8aa767718457b9264316b4 ] + +Packets that don't have dest mac as the mac of the master device should +not be entertained by the IPvlan rx-handler. This is mostly true as the +packet path mostly takes care of that, except when the master device is +a virtual device. As demonstrated in the following case - + + ip netns add ns1 + ip link add ve1 type veth peer name ve2 + ip link add link ve2 name iv1 type ipvlan mode l2 + ip link set dev iv1 netns ns1 + ip link set ve1 up + ip link set ve2 up + ip -n ns1 link set iv1 up + ip addr add 192.168.10.1/24 dev ve1 + ip -n ns1 addr 192.168.10.2/24 dev iv1 + ping -c2 192.168.10.2 + + ip neigh show dev ve1 + ip neigh show 192.168.10.2 lladdr dev ve1 + ping -c2 192.168.10.2 + + +This patch adds that missing check in the IPvlan rx-handler. + +Reported-by: Amit Sikka +Signed-off-by: Mahesh Bandewar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ipvlan/ipvlan_core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/ipvlan/ipvlan_core.c ++++ b/drivers/net/ipvlan/ipvlan_core.c +@@ -304,6 +304,10 @@ static int ipvlan_rcv_frame(struct ipvl_ + if (dev_forward_skb(ipvlan->dev, skb) == NET_RX_SUCCESS) + success = true; + } else { ++ if (!ether_addr_equal_64bits(eth_hdr(skb)->h_dest, ++ ipvlan->phy_dev->dev_addr)) ++ skb->pkt_type = PACKET_OTHERHOST; ++ + ret = RX_HANDLER_ANOTHER; + success = true; + } diff --git a/queue-4.14/iwlwifi-mvm-avoid-dumping-assert-log-when-device-is-stopped.patch b/queue-4.14/iwlwifi-mvm-avoid-dumping-assert-log-when-device-is-stopped.patch new file mode 100644 index 00000000000..7abf85c5753 --- /dev/null +++ b/queue-4.14/iwlwifi-mvm-avoid-dumping-assert-log-when-device-is-stopped.patch @@ -0,0 +1,51 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Sara Sharon +Date: Mon, 20 Nov 2017 18:02:05 +0200 +Subject: iwlwifi: mvm: avoid dumping assert log when device is stopped + +From: Sara Sharon + + +[ Upstream commit 6362ab721ef5c4ecfa01f53ad4137d3d984f0c6c ] + +We might erroneously get to error dumping code when the +device is already stopped. + +In that case the driver will detect a defective value and will try to +reset the HW, assuming it is only a bus issue. The driver than +proceeds with the dumping. + +The result has two side effects: + +1. The device won't be stopped again, since the transport status is +already stopped, so the device remains powered on while it actually +should be stopped. + +2. The dump in that case is completely garbaged and useless. + +Detect and avoid this. It will also make debugging such issues +easier. + +Signed-off-by: Sara Sharon +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c +@@ -603,6 +603,12 @@ static void iwl_mvm_dump_lmac_error_log( + + void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm) + { ++ if (!test_bit(STATUS_DEVICE_ENABLED, &mvm->trans->status)) { ++ IWL_ERR(mvm, ++ "DEVICE_ENABLED bit is not set. Aborting dump.\n"); ++ return; ++ } ++ + iwl_mvm_dump_lmac_error_log(mvm, mvm->error_event_table[0]); + + if (mvm->error_event_table[1]) diff --git a/queue-4.14/iwlwifi-mvm-rs-don-t-override-the-rate-history-in-the-search-cycle.patch b/queue-4.14/iwlwifi-mvm-rs-don-t-override-the-rate-history-in-the-search-cycle.patch new file mode 100644 index 00000000000..e8adb8da86b --- /dev/null +++ b/queue-4.14/iwlwifi-mvm-rs-don-t-override-the-rate-history-in-the-search-cycle.patch @@ -0,0 +1,59 @@ +From foo@baz Fri Mar 16 15:43:16 CET 2018 +From: Emmanuel Grumbach +Date: Thu, 19 Oct 2017 21:36:04 +0300 +Subject: iwlwifi: mvm: rs: don't override the rate history in the search cycle + +From: Emmanuel Grumbach + + +[ Upstream commit 992172e3aec19e5b0ea5b757ba40a146b9282d1e ] + +When we are in a search cycle, we try different combinations +of parameters. Those combinations are called 'columns'. +When we switch to a new column, we first need to check if +this column has a suitable rate, if not, we can't try it. +This means we must not erase the statistics we gathered +for the previous column until we are sure that we are +indeed switching column. + +The code that tries to switch to a new column first sets +a whole bunch of things for the new column, and only then +checks that we can find suitable rates in that column. +While doing that, the code mistakenly erased the rate +statistics. This code was right until +struct iwl_scale_tbl_info grew up for TPC. + +Fix this to make sure we don't erase the rate statistics +until we are sure that we can indeed switch to the new +column. + +Note that this bug is really harmless since it causes a +change in the behavior only when we can't find any rate +in the new column which should really not happen. In the +case we do find a suitable we reset the rate statistics +a few lines later anyway. + +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c +@@ -1881,12 +1881,10 @@ static int rs_switch_to_column(struct iw + struct rs_rate *rate = &search_tbl->rate; + const struct rs_tx_column *column = &rs_tx_columns[col_id]; + const struct rs_tx_column *curr_column = &rs_tx_columns[tbl->column]; +- u32 sz = (sizeof(struct iwl_scale_tbl_info) - +- (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT)); + unsigned long rate_mask = 0; + u32 rate_idx = 0; + +- memcpy(search_tbl, tbl, sz); ++ memcpy(search_tbl, tbl, offsetof(struct iwl_scale_tbl_info, win)); + + rate->sgi = column->sgi; + rate->ant = column->ant; diff --git a/queue-4.14/leds-pm8058-silence-pointer-to-integer-size-warning.patch b/queue-4.14/leds-pm8058-silence-pointer-to-integer-size-warning.patch new file mode 100644 index 00000000000..e013af5b26b --- /dev/null +++ b/queue-4.14/leds-pm8058-silence-pointer-to-integer-size-warning.patch @@ -0,0 +1,39 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Bjorn Andersson +Date: Thu, 30 Nov 2017 21:16:56 -0800 +Subject: leds: pm8058: Silence pointer to integer size warning + +From: Bjorn Andersson + + +[ Upstream commit 8f52df50d9366f770a894d14ef724e5e04574e98 ] + +The pointer returned by of_device_get_match_data() doesn't have the same +size as u32 on 64-bit architectures, causing a compile warning when +compile-testing the driver on such platform. + +Cast the return value of of_device_get_match_data() to unsigned long and +then to u32 to silence this warning. + +Fixes: 7f866986e705 ("leds: add PM8058 LEDs driver") +Signed-off-by: Bjorn Andersson +Reviewed-by: Linus Walleij +Acked-by: Pavel Machek +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/leds/leds-pm8058.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/leds/leds-pm8058.c ++++ b/drivers/leds/leds-pm8058.c +@@ -106,7 +106,7 @@ static int pm8058_led_probe(struct platf + if (!led) + return -ENOMEM; + +- led->ledtype = (u32)of_device_get_match_data(&pdev->dev); ++ led->ledtype = (u32)(unsigned long)of_device_get_match_data(&pdev->dev); + + map = dev_get_regmap(pdev->dev.parent, NULL); + if (!map) { diff --git a/queue-4.14/locking-locktorture-fix-num-reader-writer-corner-cases.patch b/queue-4.14/locking-locktorture-fix-num-reader-writer-corner-cases.patch new file mode 100644 index 00000000000..cfe9c1684dc --- /dev/null +++ b/queue-4.14/locking-locktorture-fix-num-reader-writer-corner-cases.patch @@ -0,0 +1,146 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Davidlohr Bueso +Date: Mon, 15 May 2017 02:07:23 -0700 +Subject: locking/locktorture: Fix num reader/writer corner cases + +From: Davidlohr Bueso + + +[ Upstream commit 2ce77d16db4240dd2e422fc0a5c26d3e2ec03446 ] + +Things can explode for locktorture if the user does combinations +of nwriters_stress=0 nreaders_stress=0. Fix this by not assuming +we always want to torture writer threads. + +Reported-by: Jeremy Linton +Signed-off-by: Davidlohr Bueso +Signed-off-by: Paul E. McKenney +Reviewed-by: Jeremy Linton +Tested-by: Jeremy Linton +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/locking/locktorture.c | 76 ++++++++++++++++++++++++------------------- + 1 file changed, 44 insertions(+), 32 deletions(-) + +--- a/kernel/locking/locktorture.c ++++ b/kernel/locking/locktorture.c +@@ -715,8 +715,7 @@ static void __torture_print_stats(char * + { + bool fail = 0; + int i, n_stress; +- long max = 0; +- long min = statp[0].n_lock_acquired; ++ long max = 0, min = statp ? statp[0].n_lock_acquired : 0; + long long sum = 0; + + n_stress = write ? cxt.nrealwriters_stress : cxt.nrealreaders_stress; +@@ -823,7 +822,7 @@ static void lock_torture_cleanup(void) + * such, only perform the underlying torture-specific cleanups, + * and avoid anything related to locktorture. + */ +- if (!cxt.lwsa) ++ if (!cxt.lwsa && !cxt.lrsa) + goto end; + + if (writer_tasks) { +@@ -898,6 +897,13 @@ static int __init lock_torture_init(void + firsterr = -EINVAL; + goto unwind; + } ++ ++ if (nwriters_stress == 0 && nreaders_stress == 0) { ++ pr_alert("lock-torture: must run at least one locking thread\n"); ++ firsterr = -EINVAL; ++ goto unwind; ++ } ++ + if (cxt.cur_ops->init) + cxt.cur_ops->init(); + +@@ -921,17 +927,19 @@ static int __init lock_torture_init(void + #endif + + /* Initialize the statistics so that each run gets its own numbers. */ ++ if (nwriters_stress) { ++ lock_is_write_held = 0; ++ cxt.lwsa = kmalloc(sizeof(*cxt.lwsa) * cxt.nrealwriters_stress, GFP_KERNEL); ++ if (cxt.lwsa == NULL) { ++ VERBOSE_TOROUT_STRING("cxt.lwsa: Out of memory"); ++ firsterr = -ENOMEM; ++ goto unwind; ++ } + +- lock_is_write_held = 0; +- cxt.lwsa = kmalloc(sizeof(*cxt.lwsa) * cxt.nrealwriters_stress, GFP_KERNEL); +- if (cxt.lwsa == NULL) { +- VERBOSE_TOROUT_STRING("cxt.lwsa: Out of memory"); +- firsterr = -ENOMEM; +- goto unwind; +- } +- for (i = 0; i < cxt.nrealwriters_stress; i++) { +- cxt.lwsa[i].n_lock_fail = 0; +- cxt.lwsa[i].n_lock_acquired = 0; ++ for (i = 0; i < cxt.nrealwriters_stress; i++) { ++ cxt.lwsa[i].n_lock_fail = 0; ++ cxt.lwsa[i].n_lock_acquired = 0; ++ } + } + + if (cxt.cur_ops->readlock) { +@@ -948,19 +956,21 @@ static int __init lock_torture_init(void + cxt.nrealreaders_stress = cxt.nrealwriters_stress; + } + +- lock_is_read_held = 0; +- cxt.lrsa = kmalloc(sizeof(*cxt.lrsa) * cxt.nrealreaders_stress, GFP_KERNEL); +- if (cxt.lrsa == NULL) { +- VERBOSE_TOROUT_STRING("cxt.lrsa: Out of memory"); +- firsterr = -ENOMEM; +- kfree(cxt.lwsa); +- cxt.lwsa = NULL; +- goto unwind; +- } +- +- for (i = 0; i < cxt.nrealreaders_stress; i++) { +- cxt.lrsa[i].n_lock_fail = 0; +- cxt.lrsa[i].n_lock_acquired = 0; ++ if (nreaders_stress) { ++ lock_is_read_held = 0; ++ cxt.lrsa = kmalloc(sizeof(*cxt.lrsa) * cxt.nrealreaders_stress, GFP_KERNEL); ++ if (cxt.lrsa == NULL) { ++ VERBOSE_TOROUT_STRING("cxt.lrsa: Out of memory"); ++ firsterr = -ENOMEM; ++ kfree(cxt.lwsa); ++ cxt.lwsa = NULL; ++ goto unwind; ++ } ++ ++ for (i = 0; i < cxt.nrealreaders_stress; i++) { ++ cxt.lrsa[i].n_lock_fail = 0; ++ cxt.lrsa[i].n_lock_acquired = 0; ++ } + } + } + +@@ -990,12 +1000,14 @@ static int __init lock_torture_init(void + goto unwind; + } + +- writer_tasks = kzalloc(cxt.nrealwriters_stress * sizeof(writer_tasks[0]), +- GFP_KERNEL); +- if (writer_tasks == NULL) { +- VERBOSE_TOROUT_ERRSTRING("writer_tasks: Out of memory"); +- firsterr = -ENOMEM; +- goto unwind; ++ if (nwriters_stress) { ++ writer_tasks = kzalloc(cxt.nrealwriters_stress * sizeof(writer_tasks[0]), ++ GFP_KERNEL); ++ if (writer_tasks == NULL) { ++ VERBOSE_TOROUT_ERRSTRING("writer_tasks: Out of memory"); ++ firsterr = -ENOMEM; ++ goto unwind; ++ } + } + + if (cxt.cur_ops->readlock) { diff --git a/queue-4.14/mac80211-remove-bug-when-interface-type-is-invalid.patch b/queue-4.14/mac80211-remove-bug-when-interface-type-is-invalid.patch new file mode 100644 index 00000000000..eea5ce3455f --- /dev/null +++ b/queue-4.14/mac80211-remove-bug-when-interface-type-is-invalid.patch @@ -0,0 +1,36 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Luca Coelho +Date: Sun, 29 Oct 2017 11:51:10 +0200 +Subject: mac80211: remove BUG() when interface type is invalid + +From: Luca Coelho + + +[ Upstream commit c7976f5272486e4ff406014c4b43e2fa3b70b052 ] + +In the ieee80211_setup_sdata() we check if the interface type is valid +and, if not, call BUG(). This should never happen, but if there is +something wrong with the code, it will not be caught until the bug +happens when an interface is being set up. Calling BUG() is too +extreme for this and a WARN_ON() would be better used instead. Change +that. + +Signed-off-by: Luca Coelho +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/mac80211/iface.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -1493,7 +1493,7 @@ static void ieee80211_setup_sdata(struct + break; + case NL80211_IFTYPE_UNSPECIFIED: + case NUM_NL80211_IFTYPES: +- BUG(); ++ WARN_ON(1); + break; + } + diff --git a/queue-4.14/mac80211_hwsim-enforce-ps_manual_poll-to-be-set-after-ps_enabled.patch b/queue-4.14/mac80211_hwsim-enforce-ps_manual_poll-to-be-set-after-ps_enabled.patch new file mode 100644 index 00000000000..cfab8dec211 --- /dev/null +++ b/queue-4.14/mac80211_hwsim-enforce-ps_manual_poll-to-be-set-after-ps_enabled.patch @@ -0,0 +1,60 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Adiel Aloni +Date: Fri, 1 Dec 2017 13:50:53 +0200 +Subject: mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED + +From: Adiel Aloni + + +[ Upstream commit e16ea4bb516bc21ea2202f2107718b29218bea59 ] + +Enforce using PS_MANUAL_POLL in ps hwsim debugfs to trigger a poll, +only if PS_ENABLED was set before. +This is required due to commit c9491367b759 ("mac80211: always update the +PM state of a peer on MGMT / DATA frames") that enforces the ap to +check only mgmt/data frames ps bit, and then update station's power save +accordingly. +When sending only ps-poll (control frame) the ap will not be aware that +the station entered power save. +Setting ps enable before triggering ps_poll, will send NDP with PM bit +enabled first. + +Signed-off-by: Adiel Aloni +Signed-off-by: Luca Coelho +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mac80211_hwsim.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -727,16 +727,21 @@ static int hwsim_fops_ps_write(void *dat + val != PS_MANUAL_POLL) + return -EINVAL; + +- old_ps = data->ps; +- data->ps = val; +- +- local_bh_disable(); + if (val == PS_MANUAL_POLL) { ++ if (data->ps != PS_ENABLED) ++ return -EINVAL; ++ local_bh_disable(); + ieee80211_iterate_active_interfaces_atomic( + data->hw, IEEE80211_IFACE_ITER_NORMAL, + hwsim_send_ps_poll, data); +- data->ps_poll_pending = true; +- } else if (old_ps == PS_DISABLED && val != PS_DISABLED) { ++ local_bh_enable(); ++ return 0; ++ } ++ old_ps = data->ps; ++ data->ps = val; ++ ++ local_bh_disable(); ++ if (old_ps == PS_DISABLED && val != PS_DISABLED) { + ieee80211_iterate_active_interfaces_atomic( + data->hw, IEEE80211_IFACE_ITER_NORMAL, + hwsim_send_nullfunc_ps, data); diff --git a/queue-4.14/media-cpia2-fix-a-couple-off-by-one-bugs.patch b/queue-4.14/media-cpia2-fix-a-couple-off-by-one-bugs.patch new file mode 100644 index 00000000000..eef6db416ea --- /dev/null +++ b/queue-4.14/media-cpia2-fix-a-couple-off-by-one-bugs.patch @@ -0,0 +1,46 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Dan Carpenter +Date: Thu, 9 Nov 2017 16:28:14 -0500 +Subject: media: cpia2: Fix a couple off by one bugs + +From: Dan Carpenter + + +[ Upstream commit d5ac225c7d64c9c3ef821239edc035634e594ec9 ] + +The cam->buffers[] array has cam->num_frames elements so the > needs to +be changed to >= to avoid going beyond the end of the array. The +->buffers[] array is allocated in cpia2_allocate_buffers() if you want +to confirm. + +Fixes: ab33d5071de7 ("V4L/DVB (3376): Add cpia2 camera support") + +Signed-off-by: Dan Carpenter +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/cpia2/cpia2_v4l.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/usb/cpia2/cpia2_v4l.c ++++ b/drivers/media/usb/cpia2/cpia2_v4l.c +@@ -808,7 +808,7 @@ static int cpia2_querybuf(struct file *f + struct camera_data *cam = video_drvdata(file); + + if(buf->type != V4L2_BUF_TYPE_VIDEO_CAPTURE || +- buf->index > cam->num_frames) ++ buf->index >= cam->num_frames) + return -EINVAL; + + buf->m.offset = cam->buffers[buf->index].data - cam->frame_buffer; +@@ -859,7 +859,7 @@ static int cpia2_qbuf(struct file *file, + + if(buf->type != V4L2_BUF_TYPE_VIDEO_CAPTURE || + buf->memory != V4L2_MEMORY_MMAP || +- buf->index > cam->num_frames) ++ buf->index >= cam->num_frames) + return -EINVAL; + + DBG("QBUF #%d\n", buf->index); diff --git a/queue-4.14/media-davinci-vpif_capture-add-null-check-on-devm_kzalloc-return-value.patch b/queue-4.14/media-davinci-vpif_capture-add-null-check-on-devm_kzalloc-return-value.patch new file mode 100644 index 00000000000..f8474f3c0cb --- /dev/null +++ b/queue-4.14/media-davinci-vpif_capture-add-null-check-on-devm_kzalloc-return-value.patch @@ -0,0 +1,37 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: "Gustavo A. R. Silva" +Date: Wed, 22 Nov 2017 22:34:44 -0500 +Subject: media: davinci: vpif_capture: add NULL check on devm_kzalloc return value + +From: "Gustavo A. R. Silva" + + +[ Upstream commit 5a18c2434f8bfc8bc2fb0f8af3e44f7408d63e4f ] + +Check return value from call to devm_kzalloc() in order to prevent +a NULL pointer dereference. + +This issue was detected with the help of Coccinelle. + +Fixes: 4a5f8ae50b66 ("[media] davinci: vpif_capture: get subdevs from DT when available") + +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/davinci/vpif_capture.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/media/platform/davinci/vpif_capture.c ++++ b/drivers/media/platform/davinci/vpif_capture.c +@@ -1545,6 +1545,8 @@ vpif_capture_get_pdata(struct platform_d + sizeof(*chan->inputs) * + VPIF_CAPTURE_NUM_CHANNELS, + GFP_KERNEL); ++ if (!chan->inputs) ++ return NULL; + + chan->input_count++; + chan->inputs[i].input.type = V4L2_INPUT_TYPE_CAMERA; diff --git a/queue-4.14/media-vsp1-prevent-suspending-and-resuming-drm-pipelines.patch b/queue-4.14/media-vsp1-prevent-suspending-and-resuming-drm-pipelines.patch new file mode 100644 index 00000000000..d41be3e6005 --- /dev/null +++ b/queue-4.14/media-vsp1-prevent-suspending-and-resuming-drm-pipelines.patch @@ -0,0 +1,61 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Kieran Bingham +Date: Mon, 4 Dec 2017 06:01:11 -0500 +Subject: media: vsp1: Prevent suspending and resuming DRM pipelines + +From: Kieran Bingham + + +[ Upstream commit a17d2d6cd9985ca09a9e384f1bc71d710f7e5203 ] + +When used as part of a display pipeline, the VSP is stopped and +restarted explicitly by the DU from its suspend and resume handlers. +There is thus no need to stop or restart pipelines in the VSP suspend +and resume handlers, and doing so would cause the hardware to be +left in a misconfigured state. + +Ensure that the VSP suspend and resume handlers do not affect DRM-based +pipelines. + +Signed-off-by: Kieran Bingham +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/vsp1/vsp1_drv.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/drivers/media/platform/vsp1/vsp1_drv.c ++++ b/drivers/media/platform/vsp1/vsp1_drv.c +@@ -571,7 +571,13 @@ static int __maybe_unused vsp1_pm_suspen + { + struct vsp1_device *vsp1 = dev_get_drvdata(dev); + +- vsp1_pipelines_suspend(vsp1); ++ /* ++ * When used as part of a display pipeline, the VSP is stopped and ++ * restarted explicitly by the DU. ++ */ ++ if (!vsp1->drm) ++ vsp1_pipelines_suspend(vsp1); ++ + pm_runtime_force_suspend(vsp1->dev); + + return 0; +@@ -582,7 +588,13 @@ static int __maybe_unused vsp1_pm_resume + struct vsp1_device *vsp1 = dev_get_drvdata(dev); + + pm_runtime_force_resume(vsp1->dev); +- vsp1_pipelines_resume(vsp1); ++ ++ /* ++ * When used as part of a display pipeline, the VSP is stopped and ++ * restarted explicitly by the DU. ++ */ ++ if (!vsp1->drm) ++ vsp1_pipelines_resume(vsp1); + + return 0; + } diff --git a/queue-4.14/mmc-mmc_test-ensure-command-queue-is-disabled-for-testing.patch b/queue-4.14/mmc-mmc_test-ensure-command-queue-is-disabled-for-testing.patch new file mode 100644 index 00000000000..38fbb1ab080 --- /dev/null +++ b/queue-4.14/mmc-mmc_test-ensure-command-queue-is-disabled-for-testing.patch @@ -0,0 +1,45 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Adrian Hunter +Date: Fri, 1 Dec 2017 14:55:31 +0200 +Subject: mmc: mmc_test: Ensure command queue is disabled for testing + +From: Adrian Hunter + + +[ Upstream commit 23a185254ace8e63dc4ca36e0315aed9440ae749 ] + +mmc_test disables the command queue because none of the tests use the +command queue. However the Reset Test will re-enable it, so disable it in +that case too. + +Fixes: 9d4579a85c84 ("mmc: mmc_test: Disable Command Queue while mmc_test is used") +Signed-off-by: Adrian Hunter +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/core/mmc_test.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/mmc/core/mmc_test.c ++++ b/drivers/mmc/core/mmc_test.c +@@ -2328,10 +2328,17 @@ static int mmc_test_reset(struct mmc_tes + int err; + + err = mmc_hw_reset(host); +- if (!err) ++ if (!err) { ++ /* ++ * Reset will re-enable the card's command queue, but tests ++ * expect it to be disabled. ++ */ ++ if (card->ext_csd.cmdq_en) ++ mmc_cmdq_disable(card); + return RESULT_OK; +- else if (err == -EOPNOTSUPP) ++ } else if (err == -EOPNOTSUPP) { + return RESULT_UNSUP_HOST; ++ } + + return RESULT_FAIL; + } diff --git a/queue-4.14/mtd-nand-fix-interpretation-of-nand_cmd_none-in-nand_command.patch b/queue-4.14/mtd-nand-fix-interpretation-of-nand_cmd_none-in-nand_command.patch new file mode 100644 index 00000000000..7fe3875120b --- /dev/null +++ b/queue-4.14/mtd-nand-fix-interpretation-of-nand_cmd_none-in-nand_command.patch @@ -0,0 +1,70 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Miquel Raynal +Date: Wed, 8 Nov 2017 17:00:27 +0100 +Subject: mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]() + +From: Miquel Raynal + + +[ Upstream commit df467899da0b71465760b4e35127bce837244eee ] + +Some drivers (like nand_hynix.c) call ->cmdfunc() with NAND_CMD_NONE +and a column address and expect the controller to only send address +cycles. Right now, the default ->cmdfunc() implementations provided by +the core do not filter out the command cycle in this case and forwards +the request to the controller driver through the ->cmd_ctrl() method. +The thing is, NAND controller drivers can get this wrong and send a +command cycle with a NAND_CMD_NONE opcode and since NAND_CMD_NONE is +-1, and the command field is usually casted to an u8, we end up sending +the 0xFF command which is actually a RESET operation. + +Add conditions in nand_command[_lp]() functions to sending the initial +command cycle when command == NAND_CMD_NONE. + +Signed-off-by: Miquel Raynal +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/nand_base.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/nand/nand_base.c ++++ b/drivers/mtd/nand/nand_base.c +@@ -710,7 +710,8 @@ static void nand_command(struct mtd_info + chip->cmd_ctrl(mtd, readcmd, ctrl); + ctrl &= ~NAND_CTRL_CHANGE; + } +- chip->cmd_ctrl(mtd, command, ctrl); ++ if (command != NAND_CMD_NONE) ++ chip->cmd_ctrl(mtd, command, ctrl); + + /* Address cycle, when necessary */ + ctrl = NAND_CTRL_ALE | NAND_CTRL_CHANGE; +@@ -739,6 +740,7 @@ static void nand_command(struct mtd_info + */ + switch (command) { + ++ case NAND_CMD_NONE: + case NAND_CMD_PAGEPROG: + case NAND_CMD_ERASE1: + case NAND_CMD_ERASE2: +@@ -832,7 +834,9 @@ static void nand_command_lp(struct mtd_i + } + + /* Command latch cycle */ +- chip->cmd_ctrl(mtd, command, NAND_NCE | NAND_CLE | NAND_CTRL_CHANGE); ++ if (command != NAND_CMD_NONE) ++ chip->cmd_ctrl(mtd, command, ++ NAND_NCE | NAND_CLE | NAND_CTRL_CHANGE); + + if (column != -1 || page_addr != -1) { + int ctrl = NAND_CTRL_CHANGE | NAND_NCE | NAND_ALE; +@@ -868,6 +872,7 @@ static void nand_command_lp(struct mtd_i + */ + switch (command) { + ++ case NAND_CMD_NONE: + case NAND_CMD_CACHEDPROG: + case NAND_CMD_PAGEPROG: + case NAND_CMD_ERASE1: diff --git a/queue-4.14/mtd-nand-ifc-update-bufnum-mask-for-ver-2.0.0.patch b/queue-4.14/mtd-nand-ifc-update-bufnum-mask-for-ver-2.0.0.patch new file mode 100644 index 00000000000..9e0b8605c7e --- /dev/null +++ b/queue-4.14/mtd-nand-ifc-update-bufnum-mask-for-ver-2.0.0.patch @@ -0,0 +1,40 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Jagdish Gediya +Date: Thu, 23 Nov 2017 17:04:31 +0530 +Subject: mtd: nand: ifc: update bufnum mask for ver >= 2.0.0 + +From: Jagdish Gediya + + +[ Upstream commit bccb06c353af3764ca86d9da47652458e6c2eb41 ] + +Bufnum mask is used to calculate page position in the internal SRAM. + +As IFC version 2.0.0 has 16KB of internal SRAM as compared to older +versions which had 8KB. Hence bufnum mask needs to be updated. + +Signed-off-by: Jagdish Gediya +Signed-off-by: Prabhakar Kushwaha +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/fsl_ifc_nand.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/mtd/nand/fsl_ifc_nand.c ++++ b/drivers/mtd/nand/fsl_ifc_nand.c +@@ -916,6 +916,13 @@ static int fsl_ifc_chip_init(struct fsl_ + if (ctrl->version >= FSL_IFC_VERSION_1_1_0) + fsl_ifc_sram_init(priv); + ++ /* ++ * As IFC version 2.0.0 has 16KB of internal SRAM as compared to older ++ * versions which had 8KB. Hence bufnum mask needs to be updated. ++ */ ++ if (ctrl->version >= FSL_IFC_VERSION_2_0_0) ++ priv->bufnum_mask = (priv->bufnum_mask * 2) + 1; ++ + return 0; + } + diff --git a/queue-4.14/mwifiex-cfg80211-do-not-change-virtual-interface-during-scan-processing.patch b/queue-4.14/mwifiex-cfg80211-do-not-change-virtual-interface-during-scan-processing.patch new file mode 100644 index 00000000000..f7c7bbe0b7c --- /dev/null +++ b/queue-4.14/mwifiex-cfg80211-do-not-change-virtual-interface-during-scan-processing.patch @@ -0,0 +1,47 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Limin Zhu +Date: Thu, 30 Nov 2017 14:22:34 +0800 +Subject: mwifiex: cfg80211: do not change virtual interface during scan processing + +From: Limin Zhu + + +[ Upstream commit c61cfe49f0f0f0d1f8b56d0b045838d597e8c3a3 ] + +(1) Change virtual interface operation in cfg80211 process reset and +reinitilize private data structure. +(2) Scan result event processed in main process will dereference private +data structure concurrently, ocassionly crash the kernel. + +The cornel case could be trigger by below steps: +(1) wpa_cli mlan0 scan +(2) ./hostapd mlan0.conf + +Cfg80211 asynchronous scan procedure is not all the time operated +under rtnl lock, here we add the protect to serialize the cfg80211 +scan and change_virtual interface operation. + +Signed-off-by: Limin Zhu +Signed-off-by: Xinming Hu +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/mwifiex/cfg80211.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -1116,6 +1116,12 @@ mwifiex_cfg80211_change_virtual_intf(str + struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev); + enum nl80211_iftype curr_iftype = dev->ieee80211_ptr->iftype; + ++ if (priv->scan_request) { ++ mwifiex_dbg(priv->adapter, ERROR, ++ "change virtual interface: scan in process\n"); ++ return -EBUSY; ++ } ++ + switch (curr_iftype) { + case NL80211_IFTYPE_ADHOC: + switch (type) { diff --git a/queue-4.14/net-ieee802154-adf7242-fix-bug-if-defined-debug.patch b/queue-4.14/net-ieee802154-adf7242-fix-bug-if-defined-debug.patch new file mode 100644 index 00000000000..f48720609ed --- /dev/null +++ b/queue-4.14/net-ieee802154-adf7242-fix-bug-if-defined-debug.patch @@ -0,0 +1,41 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Michael Hennerich +Date: Tue, 28 Nov 2017 13:53:12 +0100 +Subject: net: ieee802154: adf7242: Fix bug if defined DEBUG + +From: Michael Hennerich + + +[ Upstream commit 388b3b2b03701f3b3c10975c272892d7f78080df ] + +This fixes undefined reference to struct adf7242_local *lp in +case DEBUG is defined. + +Signed-off-by: Michael Hennerich +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ieee802154/adf7242.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ieee802154/adf7242.c ++++ b/drivers/net/ieee802154/adf7242.c +@@ -888,7 +888,7 @@ static const struct ieee802154_ops adf72 + .set_cca_ed_level = adf7242_set_cca_ed_level, + }; + +-static void adf7242_debug(u8 irq1) ++static void adf7242_debug(struct adf7242_local *lp, u8 irq1) + { + #ifdef DEBUG + u8 stat; +@@ -932,7 +932,7 @@ static irqreturn_t adf7242_isr(int irq, + dev_err(&lp->spi->dev, "%s :ERROR IRQ1 = 0x%X\n", + __func__, irq1); + +- adf7242_debug(irq1); ++ adf7242_debug(lp, irq1); + + xmit = test_bit(FLAG_XMIT, &lp->flags); + diff --git a/queue-4.14/net-sched-drop-qdisc_reset-from-dev_graft_qdisc.patch b/queue-4.14/net-sched-drop-qdisc_reset-from-dev_graft_qdisc.patch new file mode 100644 index 00000000000..20a91bf1e71 --- /dev/null +++ b/queue-4.14/net-sched-drop-qdisc_reset-from-dev_graft_qdisc.patch @@ -0,0 +1,102 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: John Fastabend +Date: Thu, 7 Dec 2017 09:56:04 -0800 +Subject: net: sched: drop qdisc_reset from dev_graft_qdisc + +From: John Fastabend + + +[ Upstream commit 7bbde83b1860c28a1cc35516352c4e7e5172c29a ] + +In qdisc_graft_qdisc a "new" qdisc is attached and the 'qdisc_destroy' +operation is called on the old qdisc. The destroy operation will wait +a rcu grace period and call qdisc_rcu_free(). At which point +gso_cpu_skb is free'd along with all stats so no need to zero stats +and gso_cpu_skb from the graft operation itself. + +Further after dropping the qdisc locks we can not continue to call +qdisc_reset before waiting an rcu grace period so that the qdisc is +detached from all cpus. By removing the qdisc_reset() here we get +the correct property of waiting an rcu grace period and letting the +qdisc_destroy operation clean up the qdisc correctly. + +Note, a refcnt greater than 1 would cause the destroy operation to +be aborted however if this ever happened the reference to the qdisc +would be lost and we would have a memory leak. + +Signed-off-by: John Fastabend +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_generic.c | 28 +++++++++++++++++++--------- + 1 file changed, 19 insertions(+), 9 deletions(-) + +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -743,10 +743,6 @@ struct Qdisc *dev_graft_qdisc(struct net + root_lock = qdisc_lock(oqdisc); + spin_lock_bh(root_lock); + +- /* Prune old scheduler */ +- if (oqdisc && refcount_read(&oqdisc->refcnt) <= 1) +- qdisc_reset(oqdisc); +- + /* ... and graft new one */ + if (qdisc == NULL) + qdisc = &noop_qdisc; +@@ -897,6 +893,16 @@ static bool some_qdisc_is_busy(struct ne + return false; + } + ++static void dev_qdisc_reset(struct net_device *dev, ++ struct netdev_queue *dev_queue, ++ void *none) ++{ ++ struct Qdisc *qdisc = dev_queue->qdisc_sleeping; ++ ++ if (qdisc) ++ qdisc_reset(qdisc); ++} ++ + /** + * dev_deactivate_many - deactivate transmissions on several devices + * @head: list of devices to deactivate +@@ -907,7 +913,6 @@ static bool some_qdisc_is_busy(struct ne + void dev_deactivate_many(struct list_head *head) + { + struct net_device *dev; +- bool sync_needed = false; + + list_for_each_entry(dev, head, close_list) { + netdev_for_each_tx_queue(dev, dev_deactivate_queue, +@@ -917,20 +922,25 @@ void dev_deactivate_many(struct list_hea + &noop_qdisc); + + dev_watchdog_down(dev); +- sync_needed |= !dev->dismantle; + } + + /* Wait for outstanding qdisc-less dev_queue_xmit calls. + * This is avoided if all devices are in dismantle phase : + * Caller will call synchronize_net() for us + */ +- if (sync_needed) +- synchronize_net(); ++ synchronize_net(); + + /* Wait for outstanding qdisc_run calls. */ +- list_for_each_entry(dev, head, close_list) ++ list_for_each_entry(dev, head, close_list) { + while (some_qdisc_is_busy(dev)) + yield(); ++ /* The new qdisc is assigned at this point so we can safely ++ * unwind stale skb lists and qdisc statistics ++ */ ++ netdev_for_each_tx_queue(dev, dev_qdisc_reset, NULL); ++ if (dev_ingress_queue(dev)) ++ dev_qdisc_reset(dev, dev_ingress_queue(dev), NULL); ++ } + } + + void dev_deactivate(struct net_device *dev) diff --git a/queue-4.14/net-thunderx-set-max-queue-count-taking-xdp_tx-into-account.patch b/queue-4.14/net-thunderx-set-max-queue-count-taking-xdp_tx-into-account.patch new file mode 100644 index 00000000000..d01e542d0bc --- /dev/null +++ b/queue-4.14/net-thunderx-set-max-queue-count-taking-xdp_tx-into-account.patch @@ -0,0 +1,38 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Sunil Goutham +Date: Fri, 24 Nov 2017 15:04:03 +0300 +Subject: net: thunderx: Set max queue count taking XDP_TX into account + +From: Sunil Goutham + + +[ Upstream commit 87de083857aa269fb171ef0b39696b2888361c58 ] + +on T81 there are only 4 cores, hence setting max queue count to 4 +would leave nothing for XDP_TX. This patch fixes this by doubling +max queue count in above scenarios. + +Signed-off-by: Sunil Goutham +Signed-off-by: cjacob +Signed-off-by: Aleksey Makarov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/cavium/thunder/nicvf_main.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c ++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c +@@ -1832,6 +1832,11 @@ static int nicvf_probe(struct pci_dev *p + nic->pdev = pdev; + nic->pnicvf = nic; + nic->max_queues = qcount; ++ /* If no of CPUs are too low, there won't be any queues left ++ * for XDP_TX, hence double it. ++ */ ++ if (!nic->t88) ++ nic->max_queues *= 2; + + /* MAP VF's configuration registers */ + nic->reg_base = pcim_iomap(pdev, PCI_CFG_REG_BAR_NUM, 0); diff --git a/queue-4.14/net-xfrm-allow-clearing-socket-xfrm-policies.patch b/queue-4.14/net-xfrm-allow-clearing-socket-xfrm-policies.patch new file mode 100644 index 00000000000..8f82f02bd75 --- /dev/null +++ b/queue-4.14/net-xfrm-allow-clearing-socket-xfrm-policies.patch @@ -0,0 +1,68 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Lorenzo Colitti +Date: Mon, 20 Nov 2017 19:26:02 +0900 +Subject: net: xfrm: allow clearing socket xfrm policies. + +From: Lorenzo Colitti + + +[ Upstream commit be8f8284cd897af2482d4e54fbc2bdfc15557259 ] + +Currently it is possible to add or update socket policies, but +not clear them. Therefore, once a socket policy has been applied, +the socket cannot be used for unencrypted traffic. + +This patch allows (privileged) users to clear socket policies by +passing in a NULL pointer and zero length argument to the +{IP,IPV6}_{IPSEC,XFRM}_POLICY setsockopts. This results in both +the incoming and outgoing policies being cleared. + +The simple approach taken in this patch cannot clear socket +policies in only one direction. If desired this could be added +in the future, for example by continuing to pass in a length of +zero (which currently is guaranteed to return EMSGSIZE) and +making the policy be a pointer to an integer that contains one +of the XFRM_POLICY_{IN,OUT} enum values. + +An alternative would have been to interpret the length as a +signed integer and use XFRM_POLICY_IN (i.e., 0) to clear the +input policy and -XFRM_POLICY_OUT (i.e., -1) to clear the output +policy. + +Tested: https://android-review.googlesource.com/539816 +Signed-off-by: Lorenzo Colitti +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/xfrm/xfrm_policy.c | 2 +- + net/xfrm/xfrm_state.c | 7 +++++++ + 2 files changed, 8 insertions(+), 1 deletion(-) + +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -1257,7 +1257,7 @@ EXPORT_SYMBOL(xfrm_policy_delete); + + int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol) + { +- struct net *net = xp_net(pol); ++ struct net *net = sock_net(sk); + struct xfrm_policy *old_pol; + + #ifdef CONFIG_XFRM_SUB_POLICY +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -2050,6 +2050,13 @@ int xfrm_user_policy(struct sock *sk, in + struct xfrm_mgr *km; + struct xfrm_policy *pol = NULL; + ++ if (!optval && !optlen) { ++ xfrm_sk_policy_insert(sk, XFRM_POLICY_IN, NULL); ++ xfrm_sk_policy_insert(sk, XFRM_POLICY_OUT, NULL); ++ __sk_dst_reset(sk); ++ return 0; ++ } ++ + if (optlen <= 0 || optlen > PAGE_SIZE) + return -EMSGSIZE; + diff --git a/queue-4.14/perf-annotate-fix-objdump-comment-parsing-for-intel-mov-dissassembly.patch b/queue-4.14/perf-annotate-fix-objdump-comment-parsing-for-intel-mov-dissassembly.patch new file mode 100644 index 00000000000..d30720476db --- /dev/null +++ b/queue-4.14/perf-annotate-fix-objdump-comment-parsing-for-intel-mov-dissassembly.patch @@ -0,0 +1,77 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Thomas Richter +Date: Tue, 28 Nov 2017 08:56:32 +0100 +Subject: perf annotate: Fix objdump comment parsing for Intel mov dissassembly + +From: Thomas Richter + + +[ Upstream commit 35a8a148d8c1ee9e5ae18f9565a880490f816f89 ] + +The command 'perf annotate' parses the output of objdump and also +investigates the comments produced by objdump. For example the +output of objdump produces (on x86): + +23eee: 4c 8b 3d 13 01 21 00 mov 0x210113(%rip),%r15 + # 234008 + +and the function mov__parse() is called to investigate the complete +line. Mov__parse() breaks this line into several parts and finally +calls function comment__symbol() to parse the data after the comment +character '#'. Comment__symbol() expects a hexadecimal address followed +by a symbol in '<' and '>' brackets. + +However the 2nd parameter given to function comment__symbol() +always points to the comment character '#'. The address parsing +always returns 0 because the character '#' is not a digit and +strtoull() fails without being noticed. + +Fix this by advancing the second parameter to function comment__symbol() +by one byte before invocation and add an error check after strtoull() +has been called. + +Signed-off-by: Thomas Richter +Reviewed-by: Hendrik Brueckner +Acked-by: Ravi Bangoria +Cc: Heiko Carstens +Cc: Martin Schwidefsky +Fixes: 6de783b6f50f ("perf annotate: Resolve symbols using objdump comment") +Link: http://lkml.kernel.org/r/20171128075632.72182-1-tmricht@linux.vnet.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/annotate.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/tools/perf/util/annotate.c ++++ b/tools/perf/util/annotate.c +@@ -323,6 +323,8 @@ static int comment__symbol(char *raw, ch + return 0; + + *addrp = strtoull(comment, &endptr, 16); ++ if (endptr == comment) ++ return 0; + name = strchr(endptr, '<'); + if (name == NULL) + return -1; +@@ -436,8 +438,8 @@ static int mov__parse(struct arch *arch, + return 0; + + comment = ltrim(comment); +- comment__symbol(ops->source.raw, comment, &ops->source.addr, &ops->source.name); +- comment__symbol(ops->target.raw, comment, &ops->target.addr, &ops->target.name); ++ comment__symbol(ops->source.raw, comment + 1, &ops->source.addr, &ops->source.name); ++ comment__symbol(ops->target.raw, comment + 1, &ops->target.addr, &ops->target.name); + + return 0; + +@@ -481,7 +483,7 @@ static int dec__parse(struct arch *arch + return 0; + + comment = ltrim(comment); +- comment__symbol(ops->target.raw, comment, &ops->target.addr, &ops->target.name); ++ comment__symbol(ops->target.raw, comment + 1, &ops->target.addr, &ops->target.name); + + return 0; + } diff --git a/queue-4.14/perf-annotate-fix-unnecessary-memory-allocation-for-s390x.patch b/queue-4.14/perf-annotate-fix-unnecessary-memory-allocation-for-s390x.patch new file mode 100644 index 00000000000..acbebcfbefb --- /dev/null +++ b/queue-4.14/perf-annotate-fix-unnecessary-memory-allocation-for-s390x.patch @@ -0,0 +1,97 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Thomas Richter +Date: Fri, 24 Nov 2017 10:46:37 +0100 +Subject: perf annotate: Fix unnecessary memory allocation for s390x + +From: Thomas Richter + + +[ Upstream commit 36c263607d36c6a3788c09301d9f5fe35404048a ] + +This patch fixes a bug introduced with commit d9f8dfa9baf9 ("perf +annotate s390: Implement jump types for perf annotate"). + +'perf annotate' displays annotated assembler output by reading output of +command objdump and parsing the disassembled lines. For each shown +mnemonic this function sequence is executed: + + disasm_line__new() + | + +--> disasm_line__init_ins() + | + +--> ins__find() + | + +--> arch->associate_instruction_ops() + +The s390x specific function assigned to function pointer +associate_instruction_ops refers to function s390__associate_ins_ops(). + +This function checks for supported mnemonics and assigns a NULL pointer +to unsupported mnemonics. However even the NULL pointer is added to the +architecture dependend instruction array. + +This leads to an extremely large architecture instruction array +(due to array resize logic in function arch__grow_instructions()). + +Depending on the objdump output being parsed the array can end up +with several ten-thousand elements. + +This patch checks if a mnemonic is supported and only adds supported +ones into the architecture instruction array. The array does not contain +elements with NULL pointers anymore. + +Before the patch (With some debug printf output): + +[root@s35lp76 perf]# time ./perf annotate --stdio > /tmp/xxxbb + +real 8m49.679s +user 7m13.008s +sys 0m1.649s +[root@s35lp76 perf]# fgrep '__ins__find sorted:1 nr_instructions:' + /tmp/xxxbb | tail -1 +__ins__find sorted:1 nr_instructions:87433 ins:0x341583c0 +[root@s35lp76 perf]# + +The number of different s390x branch/jump/call/return instructions +entered into the array is 87433. + +After the patch (With some printf debug output:) + +[root@s35lp76 perf]# time ./perf annotate --stdio > /tmp/xxxaa + +real 1m24.553s +user 0m0.587s +sys 0m1.530s +[root@s35lp76 perf]# fgrep '__ins__find sorted:1 nr_instructions:' + /tmp/xxxaa | tail -1 +__ins__find sorted:1 nr_instructions:56 ins:0x3f406570 +[root@s35lp76 perf]# + +The number of different s390x branch/jump/call/return instructions +entered into the array is 56 which is sensible. + +Signed-off-by: Thomas Richter +Reviewed-by: Hendrik Brueckner +Acked-by: Ravi Bangoria +Cc: Heiko Carstens +Cc: Martin Schwidefsky +Link: http://lkml.kernel.org/r/20171124094637.55558-1-tmricht@linux.vnet.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/arch/s390/annotate/instructions.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/tools/perf/arch/s390/annotate/instructions.c ++++ b/tools/perf/arch/s390/annotate/instructions.c +@@ -16,7 +16,8 @@ static struct ins_ops *s390__associate_i + if (!strcmp(name, "br")) + ops = &ret_ops; + +- arch__associate_ins_ops(arch, name, ops); ++ if (ops) ++ arch__associate_ins_ops(arch, name, ops); + return ops; + } + diff --git a/queue-4.14/pinctrl-sh-pfc-r8a7791-add-can_clk-function.patch b/queue-4.14/pinctrl-sh-pfc-r8a7791-add-can_clk-function.patch new file mode 100644 index 00000000000..59837366da1 --- /dev/null +++ b/queue-4.14/pinctrl-sh-pfc-r8a7791-add-can_clk-function.patch @@ -0,0 +1,76 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Fabrizio Castro +Date: Tue, 14 Nov 2017 15:41:17 +0000 +Subject: pinctrl: sh-pfc: r8a7791: Add can_clk function + +From: Fabrizio Castro + + +[ Upstream commit 57eec02caee60332b8052615e7257f932ae07abc ] + +This patch adds can_clk function to r8a7743/r8a7791 which is cleaner, +and allows for independent configuration. +We keep the can_clk* pins definitions from within can0_groups and +can1_groups for uniformity and backwards compatibility. + +Signed-off-by: Fabrizio Castro +Reviewed-by: Ramesh Shanmugasundaram +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c +@@ -4826,6 +4826,10 @@ static const char * const can0_groups[] + "can0_data_d", + "can0_data_e", + "can0_data_f", ++ /* ++ * Retained for backwards compatibility, use can_clk_groups in new ++ * designs. ++ */ + "can_clk", + "can_clk_b", + "can_clk_c", +@@ -4837,6 +4841,21 @@ static const char * const can1_groups[] + "can1_data_b", + "can1_data_c", + "can1_data_d", ++ /* ++ * Retained for backwards compatibility, use can_clk_groups in new ++ * designs. ++ */ ++ "can_clk", ++ "can_clk_b", ++ "can_clk_c", ++ "can_clk_d", ++}; ++ ++/* ++ * can_clk_groups allows for independent configuration, use can_clk function ++ * in new designs. ++ */ ++static const char * const can_clk_groups[] = { + "can_clk", + "can_clk_b", + "can_clk_c", +@@ -5308,7 +5327,7 @@ static const char * const vin2_groups[] + }; + + static const struct { +- struct sh_pfc_function common[56]; ++ struct sh_pfc_function common[57]; + struct sh_pfc_function r8a779x[2]; + } pinmux_functions = { + .common = { +@@ -5316,6 +5335,7 @@ static const struct { + SH_PFC_FUNCTION(avb), + SH_PFC_FUNCTION(can0), + SH_PFC_FUNCTION(can1), ++ SH_PFC_FUNCTION(can_clk), + SH_PFC_FUNCTION(du), + SH_PFC_FUNCTION(du0), + SH_PFC_FUNCTION(du1), diff --git a/queue-4.14/pinctrl-sh-pfc-r8a7795-es1-fix-mod_sel1-bit-to-0x3-when-using-stp_isen_1_d.patch b/queue-4.14/pinctrl-sh-pfc-r8a7795-es1-fix-mod_sel1-bit-to-0x3-when-using-stp_isen_1_d.patch new file mode 100644 index 00000000000..9edfc5bffd0 --- /dev/null +++ b/queue-4.14/pinctrl-sh-pfc-r8a7795-es1-fix-mod_sel1-bit-to-0x3-when-using-stp_isen_1_d.patch @@ -0,0 +1,38 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Takeshi Kihara +Date: Thu, 16 Nov 2017 12:16:00 +0900 +Subject: pinctrl: sh-pfc: r8a7795-es1: Fix MOD_SEL1 bit[25:24] to 0x3 when using STP_ISEN_1_D + +From: Takeshi Kihara + + +[ Upstream commit b16cd900de7911f96af17327a081a2141a0b763f ] + +This patch fixes the implementation incorrect of MOD_SEL1 bit[25:24] +value when STP_ISEN_1_D pin function is selected for IPSR16 bit[27:24]. + +This is a correction to the incorrect implementation of MOD_SEL register +pin assignment for R8A7795 SoC specification of R-Car Gen3 Hardware +User's Manual Rev.0.51E. + +Fixes: 0b0ffc96dbe30fa9 ("pinctrl: sh-pfc: Initial R8A7795 PFC support) +Signed-off-by: Takeshi Kihara +Signed-off-by: Yoshihiro Kaneko +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/sh-pfc/pfc-r8a7795-es1.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pinctrl/sh-pfc/pfc-r8a7795-es1.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7795-es1.c +@@ -1397,7 +1397,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_MSEL(IP16_27_24, AUDIO_CLKOUT_B, SEL_ADG_1), + PINMUX_IPSR_MSEL(IP16_27_24, SSI_SCK2_B, SEL_SSI_1), + PINMUX_IPSR_MSEL(IP16_27_24, TS_SDEN1_D, SEL_TSIF1_3), +- PINMUX_IPSR_MSEL(IP16_27_24, STP_ISEN_1_D, SEL_SSP1_1_2), ++ PINMUX_IPSR_MSEL(IP16_27_24, STP_ISEN_1_D, SEL_SSP1_1_3), + PINMUX_IPSR_MSEL(IP16_27_24, STP_OPWM_0_E, SEL_SSP1_0_4), + PINMUX_IPSR_MSEL(IP16_27_24, RIF3_D0_B, SEL_DRIF3_1), + PINMUX_IPSR_MSEL(IP16_27_24, TCLK2_B, SEL_TIMER_TMU_1), diff --git a/queue-4.14/power-supply-ab8500_charger-bail-out-in-case-of-error-in-ab8500_charger_init_hw_registers.patch b/queue-4.14/power-supply-ab8500_charger-bail-out-in-case-of-error-in-ab8500_charger_init_hw_registers.patch new file mode 100644 index 00000000000..9ebe10e171f --- /dev/null +++ b/queue-4.14/power-supply-ab8500_charger-bail-out-in-case-of-error-in-ab8500_charger_init_hw_registers.patch @@ -0,0 +1,45 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Christophe JAILLET +Date: Wed, 22 Nov 2017 21:31:20 +0100 +Subject: power: supply: ab8500_charger: Bail out in case of error in 'ab8500_charger_init_hw_registers()' + +From: Christophe JAILLET + + +[ Upstream commit 09edcb647542487864e23aa8d2ef26be3e08978a ] + +If an error occurs when we enable the backup battery charging, we should +go through the error handling path directly. + +Before commit db43e6c473b5 ("ab8500-bm: Add usb power path support") this +was the case, but this commit has added some code between the last test and +the 'out' label. +So, in case of error, this added code is executed and the error may be +silently ignored. + +Fix it by adding the missing 'goto out', as done in all other error +handling paths. + +Fixes: db43e6c473b5 ("ab8500-bm: Add usb power path support") +Signed-off-by: Christophe JAILLET +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/power/supply/ab8500_charger.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/power/supply/ab8500_charger.c ++++ b/drivers/power/supply/ab8500_charger.c +@@ -3221,8 +3221,10 @@ static int ab8500_charger_init_hw_regist + ret = abx500_mask_and_set_register_interruptible(di->dev, + AB8500_RTC, AB8500_RTC_CTRL_REG, + RTC_BUP_CH_ENA, RTC_BUP_CH_ENA); +- if (ret < 0) ++ if (ret < 0) { + dev_err(di->dev, "%s mask and set failed\n", __func__); ++ goto out; ++ } + + if (is_ab8540(di->parent)) { + ret = abx500_mask_and_set_register_interruptible(di->dev, diff --git a/queue-4.14/power-supply-ab8500_charger-fix-an-error-handling-path.patch b/queue-4.14/power-supply-ab8500_charger-fix-an-error-handling-path.patch new file mode 100644 index 00000000000..7af9557222c --- /dev/null +++ b/queue-4.14/power-supply-ab8500_charger-fix-an-error-handling-path.patch @@ -0,0 +1,35 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Christophe JAILLET +Date: Wed, 22 Nov 2017 21:27:31 +0100 +Subject: power: supply: ab8500_charger: Fix an error handling path + +From: Christophe JAILLET + + +[ Upstream commit bf59fddde1c3eab89eb8dca8f3d3dc097887d2bb ] + +'ret' is know to be 0 at this point, because it has not been updated by the +the previous call to 'abx500_mask_and_set_register_interruptible()'. + +Fix it by updating 'ret' before checking if an error occurred. + +Fixes: 84edbeeab67c ("ab8500-charger: AB8500 charger driver") +Signed-off-by: Christophe JAILLET +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/power/supply/ab8500_charger.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/power/supply/ab8500_charger.c ++++ b/drivers/power/supply/ab8500_charger.c +@@ -3218,7 +3218,7 @@ static int ab8500_charger_init_hw_regist + } + + /* Enable backup battery charging */ +- abx500_mask_and_set_register_interruptible(di->dev, ++ ret = abx500_mask_and_set_register_interruptible(di->dev, + AB8500_RTC, AB8500_RTC_CTRL_REG, + RTC_BUP_CH_ENA, RTC_BUP_CH_ENA); + if (ret < 0) diff --git a/queue-4.14/powerpc-64-don-t-trace-irqs-off-at-interrupt-return-to-soft-disabled-context.patch b/queue-4.14/powerpc-64-don-t-trace-irqs-off-at-interrupt-return-to-soft-disabled-context.patch new file mode 100644 index 00000000000..df3e479bf63 --- /dev/null +++ b/queue-4.14/powerpc-64-don-t-trace-irqs-off-at-interrupt-return-to-soft-disabled-context.patch @@ -0,0 +1,48 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Nicholas Piggin +Date: Fri, 17 Nov 2017 02:00:50 +1000 +Subject: powerpc/64: Don't trace irqs-off at interrupt return to soft-disabled context + +From: Nicholas Piggin + + +[ Upstream commit acb1feab320e38588fccc568e3767761f494976f ] + +When an interrupt is returning to a soft-disabled context (which can +happen for non-maskable interrupts or synchronous interrupts), it goes +through the motions of soft-disabling again, including calling +TRACE_DISABLE_INTS (i.e., trace_hardirqs_off()). + +This is not necessary, because we must already be soft-disabled in the +interrupt context, it also may be causing crashes in the irq tracing +code to re-enter as an nmi. Replace it with a warning to ensure that +soft-interrupts are still disabled. + +Fixes: 7c0482e3d055 ("powerpc/irq: Fix another case of lazy IRQ state getting out of sync") +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kernel/entry_64.S | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/arch/powerpc/kernel/entry_64.S ++++ b/arch/powerpc/kernel/entry_64.S +@@ -939,9 +939,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR) + beq 1f + rlwinm r7,r7,0,~PACA_IRQ_HARD_DIS + stb r7,PACAIRQHAPPENED(r13) +-1: li r0,0 +- stb r0,PACASOFTIRQEN(r13); +- TRACE_DISABLE_INTS ++1: ++#if defined(CONFIG_TRACE_IRQFLAGS) && defined(CONFIG_BUG) ++ /* The interrupt should not have soft enabled. */ ++ lbz r7,PACASOFTIRQEN(r13) ++1: tdnei r7,0 ++ EMIT_BUG_ENTRY 1b,__FILE__,__LINE__,BUGFLAG_WARNING ++#endif + b .Ldo_restore + + /* diff --git a/queue-4.14/powerpc-modules-don-t-try-to-restore-r2-after-a-sibling-call.patch b/queue-4.14/powerpc-modules-don-t-try-to-restore-r2-after-a-sibling-call.patch new file mode 100644 index 00000000000..dc65f14661f --- /dev/null +++ b/queue-4.14/powerpc-modules-don-t-try-to-restore-r2-after-a-sibling-call.patch @@ -0,0 +1,82 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Josh Poimboeuf +Date: Thu, 16 Nov 2017 11:45:37 -0600 +Subject: powerpc/modules: Don't try to restore r2 after a sibling call + +From: Josh Poimboeuf + + +[ Upstream commit b9eab08d012fa093947b230f9a87257c27fb829b ] + +When attempting to load a livepatch module, I got the following error: + + module_64: patch_module: Expect noop after relocate, got 3c820000 + +The error was triggered by the following code in +unregister_netdevice_queue(): + + 14c: 00 00 00 48 b 14c + 14c: R_PPC64_REL24 net_set_todo + 150: 00 00 82 3c addis r4,r2,0 + +GCC didn't insert a nop after the branch to net_set_todo() because it's +a sibling call, so it never returns. The nop isn't needed after the +branch in that case. + +Signed-off-by: Josh Poimboeuf +Acked-by: Naveen N. Rao +Reviewed-and-tested-by: Kamalesh Babulal +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/include/asm/code-patching.h | 1 + + arch/powerpc/kernel/module_64.c | 12 +++++++++++- + arch/powerpc/lib/code-patching.c | 5 +++++ + 3 files changed, 17 insertions(+), 1 deletion(-) + +--- a/arch/powerpc/include/asm/code-patching.h ++++ b/arch/powerpc/include/asm/code-patching.h +@@ -33,6 +33,7 @@ int patch_branch(unsigned int *addr, uns + int patch_instruction(unsigned int *addr, unsigned int instr); + + int instr_is_relative_branch(unsigned int instr); ++int instr_is_relative_link_branch(unsigned int instr); + int instr_is_branch_to_addr(const unsigned int *instr, unsigned long addr); + unsigned long branch_target(const unsigned int *instr); + unsigned int translate_branch(const unsigned int *dest, +--- a/arch/powerpc/kernel/module_64.c ++++ b/arch/powerpc/kernel/module_64.c +@@ -486,7 +486,17 @@ static bool is_early_mcount_callsite(u32 + restore r2. */ + static int restore_r2(u32 *instruction, struct module *me) + { +- if (is_early_mcount_callsite(instruction - 1)) ++ u32 *prev_insn = instruction - 1; ++ ++ if (is_early_mcount_callsite(prev_insn)) ++ return 1; ++ ++ /* ++ * Make sure the branch isn't a sibling call. Sibling calls aren't ++ * "link" branches and they don't return, so they don't need the r2 ++ * restore afterwards. ++ */ ++ if (!instr_is_relative_link_branch(*prev_insn)) + return 1; + + if (*instruction != PPC_INST_NOP) { +--- a/arch/powerpc/lib/code-patching.c ++++ b/arch/powerpc/lib/code-patching.c +@@ -302,6 +302,11 @@ int instr_is_relative_branch(unsigned in + return instr_is_branch_iform(instr) || instr_is_branch_bform(instr); + } + ++int instr_is_relative_link_branch(unsigned int instr) ++{ ++ return instr_is_relative_branch(instr) && (instr & BRANCH_SET_LINK); ++} ++ + static unsigned long branch_iform_target(const unsigned int *instr) + { + signed long imm; diff --git a/queue-4.14/pwm-stmpe-fix-wrong-register-offset-for-hwpwm-2-case.patch b/queue-4.14/pwm-stmpe-fix-wrong-register-offset-for-hwpwm-2-case.patch new file mode 100644 index 00000000000..9da115d3d42 --- /dev/null +++ b/queue-4.14/pwm-stmpe-fix-wrong-register-offset-for-hwpwm-2-case.patch @@ -0,0 +1,33 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Axel Lin +Date: Tue, 7 Nov 2017 13:18:53 +0800 +Subject: pwm: stmpe: Fix wrong register offset for hwpwm=2 case + +From: Axel Lin + + +[ Upstream commit 8472b529e113e0863ea064fdee51bf73c3f86fd6 ] + +Fix trivial copy/paste bug. + +Signed-off-by: Axel Lin +Reviewed-by: Linus Walleij +Fixes: ef1f09eca74a ("pwm: Add a driver for the STMPE PWM") +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pwm/pwm-stmpe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pwm/pwm-stmpe.c ++++ b/drivers/pwm/pwm-stmpe.c +@@ -145,7 +145,7 @@ static int stmpe_24xx_pwm_config(struct + break; + + case 2: +- offset = STMPE24XX_PWMIC1; ++ offset = STMPE24XX_PWMIC2; + break; + + default: diff --git a/queue-4.14/rcutorture-configinit-fix-build-directory-error-message.patch b/queue-4.14/rcutorture-configinit-fix-build-directory-error-message.patch new file mode 100644 index 00000000000..9e249cf12ad --- /dev/null +++ b/queue-4.14/rcutorture-configinit-fix-build-directory-error-message.patch @@ -0,0 +1,37 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: SeongJae Park +Date: Fri, 3 Nov 2017 19:17:20 +0900 +Subject: rcutorture/configinit: Fix build directory error message + +From: SeongJae Park + + +[ Upstream commit 2adfa4210f8f35cdfb4e08318cc06b99752964c2 ] + +The 'configinit.sh' script checks the format of optional argument for the +build directory, printing an error message if the format is not valid. +However, the error message uses the wrong variable, indicating an empty +string even though the user entered a non-empty (but erroneous) string. +This commit fixes the script to use the correct variable. + +Fixes: c87b9c601ac8 ("rcutorture: Add KVM-based test framework") + +Signed-off-by: SeongJae Park +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/rcutorture/bin/configinit.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/testing/selftests/rcutorture/bin/configinit.sh ++++ b/tools/testing/selftests/rcutorture/bin/configinit.sh +@@ -51,7 +51,7 @@ then + mkdir $builddir + fi + else +- echo Bad build directory: \"$builddir\" ++ echo Bad build directory: \"$buildloc\" + exit 2 + fi + fi diff --git a/queue-4.14/rtc-brcmstb-waketimer-fix-error-handling-in-brcmstb_waketmr_probe.patch b/queue-4.14/rtc-brcmstb-waketimer-fix-error-handling-in-brcmstb_waketmr_probe.patch new file mode 100644 index 00000000000..7c0875591dc --- /dev/null +++ b/queue-4.14/rtc-brcmstb-waketimer-fix-error-handling-in-brcmstb_waketmr_probe.patch @@ -0,0 +1,59 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Alexey Khoroshilov +Date: Sat, 18 Nov 2017 00:15:58 +0300 +Subject: rtc: brcmstb-waketimer: fix error handling in brcmstb_waketmr_probe() + +From: Alexey Khoroshilov + + +[ Upstream commit f2eef045de9defbc6fc6b72b17f0941cbe26c81d ] + +brcmstb_waketmr_probe() does not disable timer->clk on error paths. + +Found by Linux Driver Verification project (linuxtesting.org). + +Fixes: c4f07ecee22e ("rtc: brcmstb-waketimer: Add Broadcom STB wake-timer") +Signed-off-by: Alexey Khoroshilov +Reviewed-by: Florian Fainelli +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/rtc-brcmstb-waketimer.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/drivers/rtc/rtc-brcmstb-waketimer.c ++++ b/drivers/rtc/rtc-brcmstb-waketimer.c +@@ -253,7 +253,7 @@ static int brcmstb_waketmr_probe(struct + ret = devm_request_irq(dev, timer->irq, brcmstb_waketmr_irq, 0, + "brcmstb-waketimer", timer); + if (ret < 0) +- return ret; ++ goto err_clk; + + timer->reboot_notifier.notifier_call = brcmstb_waketmr_reboot; + register_reboot_notifier(&timer->reboot_notifier); +@@ -262,12 +262,21 @@ static int brcmstb_waketmr_probe(struct + &brcmstb_waketmr_ops, THIS_MODULE); + if (IS_ERR(timer->rtc)) { + dev_err(dev, "unable to register device\n"); +- unregister_reboot_notifier(&timer->reboot_notifier); +- return PTR_ERR(timer->rtc); ++ ret = PTR_ERR(timer->rtc); ++ goto err_notifier; + } + + dev_info(dev, "registered, with irq %d\n", timer->irq); + ++ return 0; ++ ++err_notifier: ++ unregister_reboot_notifier(&timer->reboot_notifier); ++ ++err_clk: ++ if (timer->clk) ++ clk_disable_unprepare(timer->clk); ++ + return ret; + } + diff --git a/queue-4.14/sched-stop-resched_cpu-from-sending-ipis-to-offline-cpus.patch b/queue-4.14/sched-stop-resched_cpu-from-sending-ipis-to-offline-cpus.patch new file mode 100644 index 00000000000..fbc1231872e --- /dev/null +++ b/queue-4.14/sched-stop-resched_cpu-from-sending-ipis-to-offline-cpus.patch @@ -0,0 +1,73 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: "Paul E. McKenney" +Date: Fri, 13 Oct 2017 16:24:28 -0700 +Subject: sched: Stop resched_cpu() from sending IPIs to offline CPUs + +From: "Paul E. McKenney" + + +[ Upstream commit a0982dfa03efca6c239c52cabebcea4afb93ea6b ] + +The rcutorture test suite occasionally provokes a splat due to invoking +resched_cpu() on an offline CPU: + +WARNING: CPU: 2 PID: 8 at /home/paulmck/public_git/linux-rcu/arch/x86/kernel/smp.c:128 native_smp_send_reschedule+0x37/0x40 +Modules linked in: +CPU: 2 PID: 8 Comm: rcu_preempt Not tainted 4.14.0-rc4+ #1 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 +task: ffff902ede9daf00 task.stack: ffff96c50010c000 +RIP: 0010:native_smp_send_reschedule+0x37/0x40 +RSP: 0018:ffff96c50010fdb8 EFLAGS: 00010096 +RAX: 000000000000002e RBX: ffff902edaab4680 RCX: 0000000000000003 +RDX: 0000000080000003 RSI: 0000000000000000 RDI: 00000000ffffffff +RBP: ffff96c50010fdb8 R08: 0000000000000000 R09: 0000000000000001 +R10: 0000000000000000 R11: 00000000299f36ae R12: 0000000000000001 +R13: ffffffff9de64240 R14: 0000000000000001 R15: ffffffff9de64240 +FS: 0000000000000000(0000) GS:ffff902edfc80000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00000000f7d4c642 CR3: 000000001e0e2000 CR4: 00000000000006e0 +Call Trace: + resched_curr+0x8f/0x1c0 + resched_cpu+0x2c/0x40 + rcu_implicit_dynticks_qs+0x152/0x220 + force_qs_rnp+0x147/0x1d0 + ? sync_rcu_exp_select_cpus+0x450/0x450 + rcu_gp_kthread+0x5a9/0x950 + kthread+0x142/0x180 + ? force_qs_rnp+0x1d0/0x1d0 + ? kthread_create_on_node+0x40/0x40 + ret_from_fork+0x27/0x40 +Code: 14 01 0f 92 c0 84 c0 74 14 48 8b 05 14 4f f4 00 be fd 00 00 00 ff 90 a0 00 00 00 5d c3 89 fe 48 c7 c7 38 89 ca 9d e8 e5 56 08 00 <0f> ff 5d c3 0f 1f 44 00 00 8b 05 52 9e 37 02 85 c0 75 38 55 48 +---[ end trace 26df9e5df4bba4ac ]--- + +This splat cannot be generated by expedited grace periods because they +always invoke resched_cpu() on the current CPU, which is good because +expedited grace periods require that resched_cpu() unconditionally +succeed. However, other parts of RCU can tolerate resched_cpu() acting +as a no-op, at least as long as it doesn't happen too often. + +This commit therefore makes resched_cpu() invoke resched_curr() only if +the CPU is either online or is the current CPU. + +Signed-off-by: Paul E. McKenney +Cc: Ingo Molnar +Cc: Peter Zijlstra + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/sched/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -506,7 +506,8 @@ void resched_cpu(int cpu) + unsigned long flags; + + raw_spin_lock_irqsave(&rq->lock, flags); +- resched_curr(rq); ++ if (cpu_online(cpu) || cpu == smp_processor_id()) ++ resched_curr(rq); + raw_spin_unlock_irqrestore(&rq->lock, flags); + } + diff --git a/queue-4.14/sched-stop-switched_to_rt-from-sending-ipis-to-offline-cpus.patch b/queue-4.14/sched-stop-switched_to_rt-from-sending-ipis-to-offline-cpus.patch new file mode 100644 index 00000000000..9a5925ded4d --- /dev/null +++ b/queue-4.14/sched-stop-switched_to_rt-from-sending-ipis-to-offline-cpus.patch @@ -0,0 +1,76 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: "Paul E. McKenney" +Date: Fri, 13 Oct 2017 17:00:18 -0700 +Subject: sched: Stop switched_to_rt() from sending IPIs to offline CPUs + +From: "Paul E. McKenney" + + +[ Upstream commit 2fe2582649aa2355f79acddb86bd4d6c5363eb63 ] + +The rcutorture test suite occasionally provokes a splat due to invoking +rt_mutex_lock() which needs to boost the priority of a task currently +sitting on a runqueue that belongs to an offline CPU: + +WARNING: CPU: 0 PID: 12 at /home/paulmck/public_git/linux-rcu/arch/x86/kernel/smp.c:128 native_smp_send_reschedule+0x37/0x40 +Modules linked in: +CPU: 0 PID: 12 Comm: rcub/7 Not tainted 4.14.0-rc4+ #1 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 +task: ffff9ed3de5f8cc0 task.stack: ffffbbf80012c000 +RIP: 0010:native_smp_send_reschedule+0x37/0x40 +RSP: 0018:ffffbbf80012fd10 EFLAGS: 00010082 +RAX: 000000000000002f RBX: ffff9ed3dd9cb300 RCX: 0000000000000004 +RDX: 0000000080000004 RSI: 0000000000000086 RDI: 00000000ffffffff +RBP: ffffbbf80012fd10 R08: 000000000009da7a R09: 0000000000007b9d +R10: 0000000000000001 R11: ffffffffbb57c2cd R12: 000000000000000d +R13: ffff9ed3de5f8cc0 R14: 0000000000000061 R15: ffff9ed3ded59200 +FS: 0000000000000000(0000) GS:ffff9ed3dea00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00000000080686f0 CR3: 000000001b9e0000 CR4: 00000000000006f0 +Call Trace: + resched_curr+0x61/0xd0 + switched_to_rt+0x8f/0xa0 + rt_mutex_setprio+0x25c/0x410 + task_blocks_on_rt_mutex+0x1b3/0x1f0 + rt_mutex_slowlock+0xa9/0x1e0 + rt_mutex_lock+0x29/0x30 + rcu_boost_kthread+0x127/0x3c0 + kthread+0x104/0x140 + ? rcu_report_unblock_qs_rnp+0x90/0x90 + ? kthread_create_on_node+0x40/0x40 + ret_from_fork+0x22/0x30 +Code: f0 00 0f 92 c0 84 c0 74 14 48 8b 05 34 74 c5 00 be fd 00 00 00 ff 90 a0 00 00 00 5d c3 89 fe 48 c7 c7 a0 c6 fc b9 e8 d5 b5 06 00 <0f> ff 5d c3 0f 1f 44 00 00 8b 05 a2 d1 13 02 85 c0 75 38 55 48 + +But the target task's priority has already been adjusted, so the only +purpose of switched_to_rt() invoking resched_curr() is to wake up the +CPU running some task that needs to be preempted by the boosted task. +But the CPU is offline, which presumably means that the task must be +migrated to some other CPU, and that this other CPU will undertake any +needed preemption at the time of migration. Because the runqueue lock +is held when resched_curr() is invoked, we know that the boosted task +cannot go anywhere, so it is not necessary to invoke resched_curr() +in this particular case. + +This commit therefore makes switched_to_rt() refrain from invoking +resched_curr() when the target CPU is offline. + +Signed-off-by: Paul E. McKenney +Cc: Ingo Molnar +Cc: Peter Zijlstra +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/sched/rt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -2218,7 +2218,7 @@ static void switched_to_rt(struct rq *rq + if (p->nr_cpus_allowed > 1 && rq->rt.overloaded) + queue_push_tasks(rq); + #endif /* CONFIG_SMP */ +- if (p->prio < rq->curr->prio) ++ if (p->prio < rq->curr->prio && cpu_online(cpu_of(rq))) + resched_curr(rq); + } + } diff --git a/queue-4.14/scsi-core-scsi_get_device_flags_keyed-always-return-device-flags.patch b/queue-4.14/scsi-core-scsi_get_device_flags_keyed-always-return-device-flags.patch new file mode 100644 index 00000000000..b5f4a8a7b44 --- /dev/null +++ b/queue-4.14/scsi-core-scsi_get_device_flags_keyed-always-return-device-flags.patch @@ -0,0 +1,50 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Bart Van Assche +Date: Mon, 4 Dec 2017 10:36:31 -0800 +Subject: scsi: core: scsi_get_device_flags_keyed(): Always return device flags + +From: Bart Van Assche + + +[ Upstream commit a44c9d36509c83cf64f33b93f6ab2e63822c01eb ] + +Since scsi_get_device_flags_keyed() callers do not check whether or not +the returned value is an error code, change that function such that it +returns a flags value even if the 'key' argument is invalid. Note: +since commit 28a0bc4120d3 ("scsi: sd: Implement blacklist option for +WRITE SAME w/ UNMAP") bit 31 is a valid device information flag so +checking whether bit 31 is set in the return value is not sufficient to +tell the difference between an error code and a flags value. + +Signed-off-by: Bart Van Assche +Cc: Christoph Hellwig +Cc: Hannes Reinecke +Cc: Johannes Thumshirn +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/scsi_devinfo.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -595,17 +595,12 @@ int scsi_get_device_flags_keyed(struct s + int key) + { + struct scsi_dev_info_list *devinfo; +- int err; + + devinfo = scsi_dev_info_list_find(vendor, model, key); + if (!IS_ERR(devinfo)) + return devinfo->flags; + +- err = PTR_ERR(devinfo); +- if (err != -ENOENT) +- return err; +- +- /* nothing found, return nothing */ ++ /* key or device not found: return nothing */ + if (key != SCSI_DEVINFO_GLOBAL) + return 0; + diff --git a/queue-4.14/scsi-devinfo-apply-to-hp-xp-the-same-flags-as-hitachi-vsp.patch b/queue-4.14/scsi-devinfo-apply-to-hp-xp-the-same-flags-as-hitachi-vsp.patch new file mode 100644 index 00000000000..6392dbfeb11 --- /dev/null +++ b/queue-4.14/scsi-devinfo-apply-to-hp-xp-the-same-flags-as-hitachi-vsp.patch @@ -0,0 +1,45 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Xose Vazquez Perez +Date: Fri, 17 Nov 2017 21:31:36 +0100 +Subject: scsi: devinfo: apply to HP XP the same flags as Hitachi VSP + +From: Xose Vazquez Perez + + +[ Upstream commit b369a0471503130cfc74f9f62071db97f48948c3 ] + +Commit 56f3d383f37b ("scsi: scsi_devinfo: Add TRY_VPD_PAGES to HITACHI +OPEN-V blacklist entry") modified some Hitachi entries: + + HITACHI is always supporting VPD pages, even though it's claiming to + support SCSI Revision 3 only. + +The same should have been done also for HP-rebranded. + +[mkp: checkpatch and tweaked commit message] + +Cc: Hannes Reinecke +Cc: Takahiro Yasui +Cc: Matthias Rudolph +Cc: Martin K. Petersen +Cc: James E.J. Bottomley +Cc: SCSI ML +Signed-off-by: Xose Vazquez Perez +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/scsi_devinfo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -181,7 +181,7 @@ static struct { + {"HITACHI", "6586-", "*", BLIST_SPARSELUN | BLIST_LARGELUN}, + {"HITACHI", "6588-", "*", BLIST_SPARSELUN | BLIST_LARGELUN}, + {"HP", "A6189A", NULL, BLIST_SPARSELUN | BLIST_LARGELUN}, /* HP VA7400 */ +- {"HP", "OPEN-", "*", BLIST_REPORTLUN2}, /* HP XP Arrays */ ++ {"HP", "OPEN-", "*", BLIST_REPORTLUN2 | BLIST_TRY_VPD_PAGES}, /* HP XP Arrays */ + {"HP", "NetRAID-4M", NULL, BLIST_FORCELUN}, + {"HP", "HSV100", NULL, BLIST_REPORTLUN2 | BLIST_NOSTARTONADD}, + {"HP", "C1557A", NULL, BLIST_FORCELUN}, diff --git a/queue-4.14/scsi-dh-add-new-rdac-devices.patch b/queue-4.14/scsi-dh-add-new-rdac-devices.patch new file mode 100644 index 00000000000..0def5f5fa96 --- /dev/null +++ b/queue-4.14/scsi-dh-add-new-rdac-devices.patch @@ -0,0 +1,51 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Xose Vazquez Perez +Date: Fri, 17 Nov 2017 22:05:13 +0100 +Subject: scsi: dh: add new rdac devices + +From: Xose Vazquez Perez + + +[ Upstream commit 4b3aec2bbbce1c35f50e7475a9fd78d24b9ea4ea ] + +Add IBM 3542 and 3552, arrays: FAStT200 and FAStT500. + +Add full STK OPENstorage family, arrays: 9176, D173, D178, D210, D220, +D240 and D280. + +Add STK BladeCtlr family, arrays: B210, B220, B240 and B280. + +These changes were done in multipath-tools time ago. + +Cc: NetApp RDAC team +Cc: Hannes Reinecke +Cc: Christophe Varoqui +Cc: Martin K. Petersen +Cc: James E.J. Bottomley +Cc: SCSI ML +Cc: device-mapper development +Signed-off-by: Xose Vazquez Perez +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/scsi_dh.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/scsi_dh.c ++++ b/drivers/scsi/scsi_dh.c +@@ -56,10 +56,13 @@ static const struct scsi_dh_blist scsi_d + {"IBM", "1815", "rdac", }, + {"IBM", "1818", "rdac", }, + {"IBM", "3526", "rdac", }, ++ {"IBM", "3542", "rdac", }, ++ {"IBM", "3552", "rdac", }, + {"SGI", "TP9", "rdac", }, + {"SGI", "IS", "rdac", }, +- {"STK", "OPENstorage D280", "rdac", }, ++ {"STK", "OPENstorage", "rdac", }, + {"STK", "FLEXLINE 380", "rdac", }, ++ {"STK", "BladeCtlr", "rdac", }, + {"SUN", "CSM", "rdac", }, + {"SUN", "LCSM100", "rdac", }, + {"SUN", "STK6580_6780", "rdac", }, diff --git a/queue-4.14/scsi-ses-don-t-ask-for-diagnostic-pages-repeatedly-during-probe.patch b/queue-4.14/scsi-ses-don-t-ask-for-diagnostic-pages-repeatedly-during-probe.patch new file mode 100644 index 00000000000..83e076ea2ed --- /dev/null +++ b/queue-4.14/scsi-ses-don-t-ask-for-diagnostic-pages-repeatedly-during-probe.patch @@ -0,0 +1,81 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Li Dongyang +Date: Tue, 14 Nov 2017 10:48:04 +1100 +Subject: scsi: ses: don't ask for diagnostic pages repeatedly during probe + +From: Li Dongyang + + +[ Upstream commit 9c0a50022b8ac7e863e6ec8342fa476fe5d1d75c ] + +We are testing if there is a match with the ses device in a loop by +calling ses_match_to_enclosure(), which will issue scsi receive +diagnostics commands to the ses device for every device on the same +host. On one of our boxes with 840 disks, it takes a long time to load +the driver: + +[root@g1b-oss06 ~]# time modprobe ses + +real 40m48.247s +user 0m0.001s +sys 0m0.196s + +With the patch: + +[root@g1b-oss06 ~]# time modprobe ses + +real 0m17.915s +user 0m0.008s +sys 0m0.053s + +Note that we still need to refresh page 10 when we see a new disk to +create the link. + +Signed-off-by: Li Dongyang +Tested-by: Jason Ozolins +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/ses.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -615,13 +615,16 @@ static void ses_enclosure_data_process(s + } + + static void ses_match_to_enclosure(struct enclosure_device *edev, +- struct scsi_device *sdev) ++ struct scsi_device *sdev, ++ int refresh) + { ++ struct scsi_device *edev_sdev = to_scsi_device(edev->edev.parent); + struct efd efd = { + .addr = 0, + }; + +- ses_enclosure_data_process(edev, to_scsi_device(edev->edev.parent), 0); ++ if (refresh) ++ ses_enclosure_data_process(edev, edev_sdev, 0); + + if (scsi_is_sas_rphy(sdev->sdev_target->dev.parent)) + efd.addr = sas_get_address(sdev); +@@ -652,7 +655,7 @@ static int ses_intf_add(struct device *c + struct enclosure_device *prev = NULL; + + while ((edev = enclosure_find(&sdev->host->shost_gendev, prev)) != NULL) { +- ses_match_to_enclosure(edev, sdev); ++ ses_match_to_enclosure(edev, sdev, 1); + prev = edev; + } + return -ENODEV; +@@ -768,7 +771,7 @@ page2_not_supported: + shost_for_each_device(tmp_sdev, sdev->host) { + if (tmp_sdev->lun != 0 || scsi_device_enclosure(tmp_sdev)) + continue; +- ses_match_to_enclosure(edev, tmp_sdev); ++ ses_match_to_enclosure(edev, tmp_sdev, 0); + } + + return 0; diff --git a/queue-4.14/series b/queue-4.14/series index 331729cb035..3794bb15b8f 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -24,3 +24,85 @@ serial-core-mark-port-as-initialized-in-autoconfig.patch earlycon-add-reg-offset-to-physical-address-before-mapping.patch dm-mpath-fix-passing-integrity-data.patch revert-btrfs-use-proper-endianness-accessors-for.patch +drm-edid-set-eld-connector-type-in-drm_edid_to_eld.patch +dma-buf-fence-fix-lock-inversion-within-dma-fence-array.patch +video-hdmi-allow-empty-hdmi-infoframes.patch +hid-multitouch-only-look-at-non-touch-fields-in-first-packet-of-a-frame.patch +hid-elo-clear-btn_left-mapping.patch +iwlwifi-mvm-rs-don-t-override-the-rate-history-in-the-search-cycle.patch +arm-dts-koelsch-move-cec_clock-to-root-node.patch +clk-meson-gxbb-fix-wrong-clock-for-saradc-sana.patch +arm-dts-exynos-correct-trats2-panel-reset-line.patch +drm-amdgpu-fix-get_max_engine_clock_in_mhz.patch +staging-rtl8822be-fix-missing-null-check-on-dev_alloc_skb-return.patch +typec-tcpm-fusb302-resolve-out-of-order-messaging-events.patch +usb-ledtrig-usbport-fix-of-node-leak.patch +sched-stop-switched_to_rt-from-sending-ipis-to-offline-cpus.patch +sched-stop-resched_cpu-from-sending-ipis-to-offline-cpus.patch +crypto-ecc-fix-null-pointer-deref.-on-no-default_rng.patch +crypto-cavium-fix-memory-leak-on-info.patch +test_firmware-fix-setting-old-custom-fw-path-back-on-exit.patch +net-ieee802154-adf7242-fix-bug-if-defined-debug.patch +rtc-brcmstb-waketimer-fix-error-handling-in-brcmstb_waketmr_probe.patch +net-xfrm-allow-clearing-socket-xfrm-policies.patch +mtd-nand-fix-interpretation-of-nand_cmd_none-in-nand_command.patch +net-thunderx-set-max-queue-count-taking-xdp_tx-into-account.patch +arm-dts-am335x-pepper-fix-the-audio-codec-s-reset-pin.patch +arm-dts-omap3-n900-fix-the-audio-codec-s-reset-pin.patch +mtd-nand-ifc-update-bufnum-mask-for-ver-2.0.0.patch +userns-don-t-fail-follow_automount-based-on-s_user_ns.patch +xfrm-fix-xfrm_replay_overflow_offload_esn.patch +leds-pm8058-silence-pointer-to-integer-size-warning.patch +clk-ti-clkctrl-add-support-for-retrying-failed-init.patch +power-supply-ab8500_charger-fix-an-error-handling-path.patch +power-supply-ab8500_charger-bail-out-in-case-of-error-in-ab8500_charger_init_hw_registers.patch +drm-etnaviv-make-thermal-selectable.patch +iio-adc-ina2xx-shift-bus-voltage-register-to-mask-flag-bits.patch +iio-health-max30102-add-power-enable-parameter-to-get_temp-function.patch +ath10k-update-tdls-teardown-state-to-target.patch +cpufreq-fix-governor-module-removal-race.patch +dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch +dmaengine-amba-pl08x-use-vchan_terminate_vdesc-instead-of-desc_free.patch +drm-amdgpu-fix-random-missing-of-flr-notify.patch +scsi-ses-don-t-ask-for-diagnostic-pages-repeatedly-during-probe.patch +pwm-stmpe-fix-wrong-register-offset-for-hwpwm-2-case.patch +drm-sun4i-fix-format-mask-in-de2-driver.patch +pinctrl-sh-pfc-r8a7791-add-can_clk-function.patch +pinctrl-sh-pfc-r8a7795-es1-fix-mod_sel1-bit-to-0x3-when-using-stp_isen_1_d.patch +perf-annotate-fix-unnecessary-memory-allocation-for-s390x.patch +perf-annotate-fix-objdump-comment-parsing-for-intel-mov-dissassembly.patch +iwlwifi-mvm-avoid-dumping-assert-log-when-device-is-stopped.patch +drm-amdgpu-fix-virtual-dce-bug.patch +clk-qcom-msm8916-fix-mnd_width-for-codec_digcodec.patch +mwifiex-cfg80211-do-not-change-virtual-interface-during-scan-processing.patch +ath10k-fix-invalid-sts_cap_offset_mask.patch +tools-usbip-fixes-build-with-musl-libc-toolchain.patch +spi-sun6i-disable-unprepare-clocks-on-remove.patch +bnxt_en-don-t-print-link-speed-1-no-longer-supported-messages.patch +scsi-core-scsi_get_device_flags_keyed-always-return-device-flags.patch +scsi-devinfo-apply-to-hp-xp-the-same-flags-as-hitachi-vsp.patch +scsi-dh-add-new-rdac-devices.patch +media-vsp1-prevent-suspending-and-resuming-drm-pipelines.patch +dm-raid-fix-raid-set-size-revalidation.patch +media-cpia2-fix-a-couple-off-by-one-bugs.patch +media-davinci-vpif_capture-add-null-check-on-devm_kzalloc-return-value.patch +virtio_net-disable-interrupts-if-napi_complete_done-rescheduled-napi.patch +net-sched-drop-qdisc_reset-from-dev_graft_qdisc.patch +veth-set-peer-gso-values.patch +drm-amdkfd-fix-memory-leaks-in-kfd-topology.patch +powerpc-modules-don-t-try-to-restore-r2-after-a-sibling-call.patch +powerpc-64-don-t-trace-irqs-off-at-interrupt-return-to-soft-disabled-context.patch +arm64-dts-renesas-salvator-common-add-ethernetavb-phy-reset.patch +agp-intel-flush-all-chipset-writes-after-updating-the-ggtt.patch +mac80211_hwsim-enforce-ps_manual_poll-to-be-set-after-ps_enabled.patch +mac80211-remove-bug-when-interface-type-is-invalid.patch +crypto-caam-qi-use-correct-print-specifier-for-size_t.patch +asoc-nuc900-fix-a-loop-timeout-test.patch +mmc-mmc_test-ensure-command-queue-is-disabled-for-testing.patch +fix-misannotated-out-of-line-_copy_to_user.patch +ipvlan-add-l2-check-for-packets-arriving-via-virtual-devices.patch +rcutorture-configinit-fix-build-directory-error-message.patch +locking-locktorture-fix-num-reader-writer-corner-cases.patch +ima-relax-requiring-a-file-signature-for-new-files-with-zero-length.patch +ib-mlx5-revisit-wmaybe-uninitialized-warning.patch +dmaengine-qcom_hidma-check-pending-interrupts.patch diff --git a/queue-4.14/spi-sun6i-disable-unprepare-clocks-on-remove.patch b/queue-4.14/spi-sun6i-disable-unprepare-clocks-on-remove.patch new file mode 100644 index 00000000000..929a0ea302e --- /dev/null +++ b/queue-4.14/spi-sun6i-disable-unprepare-clocks-on-remove.patch @@ -0,0 +1,39 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Tobias Jordan +Date: Thu, 7 Dec 2017 15:04:53 +0100 +Subject: spi: sun6i: disable/unprepare clocks on remove + +From: Tobias Jordan + + +[ Upstream commit 2d9bbd02c54094ceffa555143b0d68cd06504d63 ] + +sun6i_spi_probe() uses sun6i_spi_runtime_resume() to prepare/enable +clocks, so sun6i_spi_remove() should use sun6i_spi_runtime_suspend() to +disable/unprepare them if we're not suspended. +Replacing pm_runtime_disable() by pm_runtime_force_suspend() will ensure +that sun6i_spi_runtime_suspend() is called if needed. + +Found by Linux Driver Verification project (linuxtesting.org). + +Fixes: 3558fe900e8af (spi: sunxi: Add Allwinner A31 SPI controller driver) +Signed-off-by: Tobias Jordan +Acked-by: Maxime Ripard +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-sun6i.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/spi/spi-sun6i.c ++++ b/drivers/spi/spi-sun6i.c +@@ -541,7 +541,7 @@ err_free_master: + + static int sun6i_spi_remove(struct platform_device *pdev) + { +- pm_runtime_disable(&pdev->dev); ++ pm_runtime_force_suspend(&pdev->dev); + + return 0; + } diff --git a/queue-4.14/staging-rtl8822be-fix-missing-null-check-on-dev_alloc_skb-return.patch b/queue-4.14/staging-rtl8822be-fix-missing-null-check-on-dev_alloc_skb-return.patch new file mode 100644 index 00000000000..2da715ca77c --- /dev/null +++ b/queue-4.14/staging-rtl8822be-fix-missing-null-check-on-dev_alloc_skb-return.patch @@ -0,0 +1,36 @@ +From foo@baz Fri Mar 16 15:43:16 CET 2018 +From: Colin Ian King +Date: Fri, 17 Nov 2017 14:50:55 +0000 +Subject: staging: rtl8822be: fix missing null check on dev_alloc_skb return + +From: Colin Ian King + + +[ Upstream commit 3eb23426e1749a0483bc4c9b18e51f657569e3ed ] + +dev_alloc_skb can potentially return NULL, so add a null check to +avoid a null pointer dereference on skb + +Detected by CoverityScan, CID#1454558 ("Dereference on null return") + +Fixes: 7e5b796cde7e ("staging: r8822be: Add the driver code") +Signed-off-by: Colin Ian King +Acked-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/rtlwifi/rtl8822be/fw.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/staging/rtlwifi/rtl8822be/fw.c ++++ b/drivers/staging/rtlwifi/rtl8822be/fw.c +@@ -464,6 +464,8 @@ bool rtl8822b_halmac_cb_write_data_rsvd_ + int count; + + skb = dev_alloc_skb(size); ++ if (!skb) ++ return false; + memcpy((u8 *)skb_put(skb, size), buf, size); + + if (!_rtl8822be_send_bcn_or_cmd_packet(rtlpriv->hw, skb, BEACON_QUEUE)) diff --git a/queue-4.14/test_firmware-fix-setting-old-custom-fw-path-back-on-exit.patch b/queue-4.14/test_firmware-fix-setting-old-custom-fw-path-back-on-exit.patch new file mode 100644 index 00000000000..c872775a2b5 --- /dev/null +++ b/queue-4.14/test_firmware-fix-setting-old-custom-fw-path-back-on-exit.patch @@ -0,0 +1,48 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: "Luis R. Rodriguez" +Date: Mon, 20 Nov 2017 09:45:35 -0800 +Subject: test_firmware: fix setting old custom fw path back on exit + +From: "Luis R. Rodriguez" + + +[ Upstream commit 65c79230576873b312c3599479c1e42355c9f349 ] + +The file /sys/module/firmware_class/parameters/path can be used +to set a custom firmware path. The fw_filesystem.sh script creates +a temporary directory to add a test firmware file to be used during +testing, in order for this to work it uses the custom path syfs file +and it was supposed to reset back the file on execution exit. The +script failed to do this due to a typo, it was using OLD_PATH instead +of OLD_FWPATH, since its inception since v3.17. + +Its not as easy to just keep the old setting, it turns out that +resetting an empty setting won't actually do what we want, we need +to check if it was empty and set an empty space. + +Without this we end up having the temporary path always set after +we run these tests. + +Fixes: 0a8adf58475 ("test: add firmware_class loader test") +Signed-off-by: Luis R. Rodriguez +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/firmware/fw_filesystem.sh | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/tools/testing/selftests/firmware/fw_filesystem.sh ++++ b/tools/testing/selftests/firmware/fw_filesystem.sh +@@ -45,7 +45,10 @@ test_finish() + if [ "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then + echo "$OLD_TIMEOUT" >/sys/class/firmware/timeout + fi +- echo -n "$OLD_PATH" >/sys/module/firmware_class/parameters/path ++ if [ "$OLD_FWPATH" = "" ]; then ++ OLD_FWPATH=" " ++ fi ++ echo -n "$OLD_FWPATH" >/sys/module/firmware_class/parameters/path + rm -f "$FW" + rmdir "$FWPATH" + } diff --git a/queue-4.14/tools-usbip-fixes-build-with-musl-libc-toolchain.patch b/queue-4.14/tools-usbip-fixes-build-with-musl-libc-toolchain.patch new file mode 100644 index 00000000000..6289be5aeed --- /dev/null +++ b/queue-4.14/tools-usbip-fixes-build-with-musl-libc-toolchain.patch @@ -0,0 +1,45 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Julien BOIBESSOT +Date: Tue, 5 Dec 2017 18:48:14 +0100 +Subject: tools/usbip: fixes build with musl libc toolchain + +From: Julien BOIBESSOT + + +[ Upstream commit 77be4c878c72e411ad22af96b6f81dd45c26450a ] + +Indeed musl doesn't define old SIGCLD signal name but only new one SIGCHLD. +SIGCHLD is the new POSIX name for that signal so it doesn't change +anything on other libcs. + +This fixes this kind of build error: + +usbipd.c: In function ‘set_signal’: +usbipd.c:459:12: error: 'SIGCLD' undeclared (first use in this function) + sigaction(SIGCLD, &act, NULL); + ^~~~~~ +usbipd.c:459:12: note: each undeclared identifier is reported only once + for each function it appears in +Makefile:407: recipe for target 'usbipd.o' failed +make[3]: *** [usbipd.o] Error 1 + +Signed-off-by: Julien BOIBESSOT +Acked-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/usb/usbip/src/usbipd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/usb/usbip/src/usbipd.c ++++ b/tools/usb/usbip/src/usbipd.c +@@ -456,7 +456,7 @@ static void set_signal(void) + sigaction(SIGTERM, &act, NULL); + sigaction(SIGINT, &act, NULL); + act.sa_handler = SIG_IGN; +- sigaction(SIGCLD, &act, NULL); ++ sigaction(SIGCHLD, &act, NULL); + } + + static const char *pid_file; diff --git a/queue-4.14/typec-tcpm-fusb302-resolve-out-of-order-messaging-events.patch b/queue-4.14/typec-tcpm-fusb302-resolve-out-of-order-messaging-events.patch new file mode 100644 index 00000000000..79dc507456e --- /dev/null +++ b/queue-4.14/typec-tcpm-fusb302-resolve-out-of-order-messaging-events.patch @@ -0,0 +1,87 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Adam Thomson +Date: Tue, 21 Nov 2017 14:12:12 +0000 +Subject: typec: tcpm: fusb302: Resolve out of order messaging events + +From: Adam Thomson + + +[ Upstream commit ab69f61321140ff632d560775bc226259a78dfa2 ] + +The expectation in the FUSB302 driver is that a TX_SUCCESS event +should occur after a message has been sent, but before a GCRCSENT +event is raised to indicate successful receipt of a message from +the partner. However in some circumstances it is possible to see +the hardware raise a GCRCSENT event before a TX_SUCCESS event +is raised. The upshot of this is that the GCRCSENT handling portion +of code ends up reporting the GoodCRC message to TCPM because the +TX_SUCCESS event hasn't yet arrived to trigger a consumption of it. +When TX_SUCCESS is then raised by the chip it ends up consuming the +actual message that was meant for TCPM, and this incorrect sequence +results in a hard reset from TCPM. + +To avoid this problem, this commit updates the message reading +code to check whether a GoodCRC message was received or not. Based +on this check it will either report that the previous transmission +has completed or it will pass the msg data to TCPM for futher +processing. This way the incorrect ordering of the events no longer +matters. + +Signed-off-by: Adam Thomson +Reviewed-by: Guenter Roeck +Acked-by: Heikki Krogerus +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/typec/fusb302/fusb302.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +--- a/drivers/staging/typec/fusb302/fusb302.c ++++ b/drivers/staging/typec/fusb302/fusb302.c +@@ -1552,6 +1552,21 @@ static int fusb302_pd_read_message(struc + fusb302_log(chip, "PD message header: %x", msg->header); + fusb302_log(chip, "PD message len: %d", len); + ++ /* ++ * Check if we've read off a GoodCRC message. If so then indicate to ++ * TCPM that the previous transmission has completed. Otherwise we pass ++ * the received message over to TCPM for processing. ++ * ++ * We make this check here instead of basing the reporting decision on ++ * the IRQ event type, as it's possible for the chip to report the ++ * TX_SUCCESS and GCRCSENT events out of order on occasion, so we need ++ * to check the message type to ensure correct reporting to TCPM. ++ */ ++ if ((!len) && (pd_header_type_le(msg->header) == PD_CTRL_GOOD_CRC)) ++ tcpm_pd_transmit_complete(chip->tcpm_port, TCPC_TX_SUCCESS); ++ else ++ tcpm_pd_receive(chip->tcpm_port, msg); ++ + return ret; + } + +@@ -1659,13 +1674,12 @@ static irqreturn_t fusb302_irq_intn(int + + if (interrupta & FUSB_REG_INTERRUPTA_TX_SUCCESS) { + fusb302_log(chip, "IRQ: PD tx success"); +- /* read out the received good CRC */ + ret = fusb302_pd_read_message(chip, &pd_msg); + if (ret < 0) { +- fusb302_log(chip, "cannot read in GCRC, ret=%d", ret); ++ fusb302_log(chip, ++ "cannot read in PD message, ret=%d", ret); + goto done; + } +- tcpm_pd_transmit_complete(chip->tcpm_port, TCPC_TX_SUCCESS); + } + + if (interrupta & FUSB_REG_INTERRUPTA_HARDRESET) { +@@ -1686,7 +1700,6 @@ static irqreturn_t fusb302_irq_intn(int + "cannot read in PD message, ret=%d", ret); + goto done; + } +- tcpm_pd_receive(chip->tcpm_port, &pd_msg); + } + done: + mutex_unlock(&chip->lock); diff --git a/queue-4.14/usb-ledtrig-usbport-fix-of-node-leak.patch b/queue-4.14/usb-ledtrig-usbport-fix-of-node-leak.patch new file mode 100644 index 00000000000..71352f09b2e --- /dev/null +++ b/queue-4.14/usb-ledtrig-usbport-fix-of-node-leak.patch @@ -0,0 +1,51 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Johan Hovold +Date: Thu, 9 Nov 2017 18:07:22 +0100 +Subject: USB: ledtrig-usbport: fix of-node leak + +From: Johan Hovold + + +[ Upstream commit 03310a15484ab6a8f6d91bbf7fe486b17275c09a ] + +This code looks up a USB device node from a given parent USB device but +never dropped its reference to the returned node. + +As only the address of the node is used for a later matching, the +reference can be dropped immediately. + +Note that this trigger implementation confuses the description of the +USB device connected to a port with the port itself (which does not have +a device-tree representation). + +Fixes: 4f04c210d031 ("usb: core: read USB ports from DT in the usbport LED trigger driver") +Cc: Rafał Miłecki +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/ledtrig-usbport.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/ledtrig-usbport.c ++++ b/drivers/usb/core/ledtrig-usbport.c +@@ -140,11 +140,17 @@ static bool usbport_trig_port_observed(s + if (!led_np) + return false; + +- /* Get node of port being added */ ++ /* ++ * Get node of port being added ++ * ++ * FIXME: This is really the device node of the connected device ++ */ + port_np = usb_of_get_child_node(usb_dev->dev.of_node, port1); + if (!port_np) + return false; + ++ of_node_put(port_np); ++ + /* Amount of trigger sources for this LED */ + count = of_count_phandle_with_args(led_np, "trigger-sources", + "#trigger-source-cells"); diff --git a/queue-4.14/userns-don-t-fail-follow_automount-based-on-s_user_ns.patch b/queue-4.14/userns-don-t-fail-follow_automount-based-on-s_user_ns.patch new file mode 100644 index 00000000000..5984c82c217 --- /dev/null +++ b/queue-4.14/userns-don-t-fail-follow_automount-based-on-s_user_ns.patch @@ -0,0 +1,51 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: "Eric W. Biederman" +Date: Wed, 29 Nov 2017 17:29:20 -0600 +Subject: userns: Don't fail follow_automount based on s_user_ns + +From: "Eric W. Biederman" + + +[ Upstream commit bbc3e471011417598e598707486f5d8814ec9c01 ] + +When vfs_submount was added the test to limit automounts from +filesystems that with s_user_ns != &init_user_ns accidentially left +in follow_automount. The test was never about any security concerns +and was always about how do we implement this for filesystems whose +s_user_ns != &init_user_ns. + +At the moment this check makes no difference as there are no +filesystems that both set FS_USERNS_MOUNT and implement d_automount. + +Remove this check now while I am thinking about it so there will not +be odd booby traps for someone who does want to make this combination +work. + +vfs_submount still needs improvements to allow this combination to work, +and vfs_submount contains a check that presents a warning. + +The autofs4 filesystem could be modified to set FS_USERNS_MOUNT and it would +need not work on this code path, as userspace performs the mounts. + +Fixes: 93faccbbfa95 ("fs: Better permission checking for submounts") +Fixes: aeaa4a79ff6a ("fs: Call d_automount with the filesystems creds") +Acked-by: Ian Kent +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/namei.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -1133,9 +1133,6 @@ static int follow_automount(struct path + path->dentry->d_inode) + return -EISDIR; + +- if (path->dentry->d_sb->s_user_ns != &init_user_ns) +- return -EACCES; +- + nd->total_link_count++; + if (nd->total_link_count >= 40) + return -ELOOP; diff --git a/queue-4.14/veth-set-peer-gso-values.patch b/queue-4.14/veth-set-peer-gso-values.patch new file mode 100644 index 00000000000..167c41763ad --- /dev/null +++ b/queue-4.14/veth-set-peer-gso-values.patch @@ -0,0 +1,39 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Stephen Hemminger +Date: Thu, 7 Dec 2017 15:40:20 -0800 +Subject: veth: set peer GSO values + +From: Stephen Hemminger + + +[ Upstream commit 72d24955b44a4039db54a1c252b5031969eeaac3 ] + +When new veth is created, and GSO values have been configured +on one device, clone those values to the peer. + +For example: + # ip link add dev vm1 gso_max_size 65530 type veth peer name vm2 + +This should create vm1 <--> vm2 with both having GSO maximum +size set to 65530. + +Signed-off-by: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/veth.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -410,6 +410,9 @@ static int veth_newlink(struct net *src_ + if (ifmp && (dev->ifindex != 0)) + peer->ifindex = ifmp->ifi_index; + ++ peer->gso_max_size = dev->gso_max_size; ++ peer->gso_max_segs = dev->gso_max_segs; ++ + err = register_netdevice(peer); + put_net(net); + net = NULL; diff --git a/queue-4.14/video-hdmi-allow-empty-hdmi-infoframes.patch b/queue-4.14/video-hdmi-allow-empty-hdmi-infoframes.patch new file mode 100644 index 00000000000..86686f75f4a --- /dev/null +++ b/queue-4.14/video-hdmi-allow-empty-hdmi-infoframes.patch @@ -0,0 +1,135 @@ +From foo@baz Fri Mar 16 15:43:16 CET 2018 +From: "Ville Syrjälä" +Date: Mon, 13 Nov 2017 19:04:18 +0200 +Subject: video/hdmi: Allow "empty" HDMI infoframes + +From: "Ville Syrjälä" + + +[ Upstream commit 593f4b19a094c4426bd1e1e3cbab87a48bd13c71 ] + +HDMI 2.0 Appendix F suggest that we should keep sending the infoframe +when switching from 3D to 2D mode, even if the infoframe isn't strictly +necessary (ie. not needed to transmit the VIC or stereo information). +This is a workaround against some sinks that fail to realize that they +should switch from 3D to 2D mode when the source stop transmitting +the infoframe. + +v2: Handle unpack() as well + Pull the length calculation into a helper + +Cc: Shashank Sharma +Cc: Andrzej Hajda +Cc: Thierry Reding +Cc: Hans Verkuil +Cc: linux-media@vger.kernel.org +Reviewed-by: Andrzej Hajda #v1 +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20171113170427.4150-2-ville.syrjala@linux.intel.com +Reviewed-by: Shashank Sharma +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/hdmi.c | 51 +++++++++++++++++++++++++++++++-------------------- + 1 file changed, 31 insertions(+), 20 deletions(-) + +--- a/drivers/video/hdmi.c ++++ b/drivers/video/hdmi.c +@@ -321,6 +321,17 @@ int hdmi_vendor_infoframe_init(struct hd + } + EXPORT_SYMBOL(hdmi_vendor_infoframe_init); + ++static int hdmi_vendor_infoframe_length(const struct hdmi_vendor_infoframe *frame) ++{ ++ /* for side by side (half) we also need to provide 3D_Ext_Data */ ++ if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) ++ return 6; ++ else if (frame->vic != 0 || frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID) ++ return 5; ++ else ++ return 4; ++} ++ + /** + * hdmi_vendor_infoframe_pack() - write a HDMI vendor infoframe to binary buffer + * @frame: HDMI infoframe +@@ -341,19 +352,11 @@ ssize_t hdmi_vendor_infoframe_pack(struc + u8 *ptr = buffer; + size_t length; + +- /* empty info frame */ +- if (frame->vic == 0 && frame->s3d_struct == HDMI_3D_STRUCTURE_INVALID) +- return -EINVAL; +- + /* only one of those can be supplied */ + if (frame->vic != 0 && frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID) + return -EINVAL; + +- /* for side by side (half) we also need to provide 3D_Ext_Data */ +- if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) +- frame->length = 6; +- else +- frame->length = 5; ++ frame->length = hdmi_vendor_infoframe_length(frame); + + length = HDMI_INFOFRAME_HEADER_SIZE + frame->length; + +@@ -372,14 +375,16 @@ ssize_t hdmi_vendor_infoframe_pack(struc + ptr[5] = 0x0c; + ptr[6] = 0x00; + +- if (frame->vic) { +- ptr[7] = 0x1 << 5; /* video format */ +- ptr[8] = frame->vic; +- } else { ++ if (frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID) { + ptr[7] = 0x2 << 5; /* video format */ + ptr[8] = (frame->s3d_struct & 0xf) << 4; + if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) + ptr[9] = (frame->s3d_ext_data & 0xf) << 4; ++ } else if (frame->vic) { ++ ptr[7] = 0x1 << 5; /* video format */ ++ ptr[8] = frame->vic; ++ } else { ++ ptr[7] = 0x0 << 5; /* video format */ + } + + hdmi_infoframe_set_checksum(buffer, length); +@@ -1165,7 +1170,7 @@ hdmi_vendor_any_infoframe_unpack(union h + + if (ptr[0] != HDMI_INFOFRAME_TYPE_VENDOR || + ptr[1] != 1 || +- (ptr[2] != 5 && ptr[2] != 6)) ++ (ptr[2] != 4 && ptr[2] != 5 && ptr[2] != 6)) + return -EINVAL; + + length = ptr[2]; +@@ -1193,16 +1198,22 @@ hdmi_vendor_any_infoframe_unpack(union h + + hvf->length = length; + +- if (hdmi_video_format == 0x1) { +- hvf->vic = ptr[4]; +- } else if (hdmi_video_format == 0x2) { ++ if (hdmi_video_format == 0x2) { ++ if (length != 5 && length != 6) ++ return -EINVAL; + hvf->s3d_struct = ptr[4] >> 4; + if (hvf->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) { +- if (length == 6) +- hvf->s3d_ext_data = ptr[5] >> 4; +- else ++ if (length != 6) + return -EINVAL; ++ hvf->s3d_ext_data = ptr[5] >> 4; + } ++ } else if (hdmi_video_format == 0x1) { ++ if (length != 5) ++ return -EINVAL; ++ hvf->vic = ptr[4]; ++ } else { ++ if (length != 4) ++ return -EINVAL; + } + + return 0; diff --git a/queue-4.14/virtio_net-disable-interrupts-if-napi_complete_done-rescheduled-napi.patch b/queue-4.14/virtio_net-disable-interrupts-if-napi_complete_done-rescheduled-napi.patch new file mode 100644 index 00000000000..97db46f635d --- /dev/null +++ b/queue-4.14/virtio_net-disable-interrupts-if-napi_complete_done-rescheduled-napi.patch @@ -0,0 +1,81 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Toshiaki Makita +Date: Thu, 7 Dec 2017 13:15:15 +0900 +Subject: virtio_net: Disable interrupts if napi_complete_done rescheduled napi + +From: Toshiaki Makita + + +[ Upstream commit fdaa767aefc1685f9a41e91f447c9aea94103df6 ] + +Since commit 39e6c8208d7b ("net: solve a NAPI race") napi has been able +to be rescheduled within napi_complete_done() even in non-busypoll case, +but virtnet_poll() always enabled interrupts before complete, and when +napi was rescheduled within napi_complete_done() it did not disable +interrupts. +This caused more interrupts when event idx is disabled. + +According to commit cbdadbbf0c79 ("virtio_net: fix race in RX VQ +processing") we cannot place virtqueue_enable_cb_prepare() after +NAPI_STATE_SCHED is cleared, so disable interrupts again if +napi_complete_done() returned false. + +Tested with vhost-user of OVS 2.7 on host, which does not have the event +idx feature. + +* Before patch: + +$ netperf -t UDP_STREAM -H 192.168.150.253 -l 60 -- -m 1472 +MIGRATED UDP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 192.168.150.253 () port 0 AF_INET +Socket Message Elapsed Messages +Size Size Time Okay Errors Throughput +bytes bytes secs # # 10^6bits/sec + +212992 1472 60.00 32763206 0 6430.32 +212992 60.00 23384299 4589.56 + +Interrupts on guest: 9872369 +Packets/interrupt: 2.37 + +* After patch + +$ netperf -t UDP_STREAM -H 192.168.150.253 -l 60 -- -m 1472 +MIGRATED UDP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 192.168.150.253 () port 0 AF_INET +Socket Message Elapsed Messages +Size Size Time Okay Errors Throughput +bytes bytes secs # # 10^6bits/sec + +212992 1472 60.00 32794646 0 6436.49 +212992 60.00 32793501 6436.27 + +Interrupts on guest: 4941299 +Packets/interrupt: 6.64 + +Signed-off-by: Toshiaki Makita +Acked-by: Michael S. Tsirkin +Acked-by: Jason Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/virtio_net.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -260,9 +260,12 @@ static void virtqueue_napi_complete(stru + int opaque; + + opaque = virtqueue_enable_cb_prepare(vq); +- if (napi_complete_done(napi, processed) && +- unlikely(virtqueue_poll(vq, opaque))) +- virtqueue_napi_schedule(napi, vq); ++ if (napi_complete_done(napi, processed)) { ++ if (unlikely(virtqueue_poll(vq, opaque))) ++ virtqueue_napi_schedule(napi, vq); ++ } else { ++ virtqueue_disable_cb(vq); ++ } + } + + static void skb_xmit_done(struct virtqueue *vq) diff --git a/queue-4.14/xfrm-fix-xfrm_replay_overflow_offload_esn.patch b/queue-4.14/xfrm-fix-xfrm_replay_overflow_offload_esn.patch new file mode 100644 index 00000000000..a9b19d086a8 --- /dev/null +++ b/queue-4.14/xfrm-fix-xfrm_replay_overflow_offload_esn.patch @@ -0,0 +1,44 @@ +From foo@baz Fri Mar 16 15:43:17 CET 2018 +From: Yossef Efraim +Date: Tue, 28 Nov 2017 11:49:28 +0200 +Subject: xfrm: Fix xfrm_replay_overflow_offload_esn + +From: Yossef Efraim + + +[ Upstream commit 0ba23a211360af7b6658e4fcfc571970bbbacc55 ] + +In case of wrap around, replay_esn->oseq_hi is not updated +before it is tested for it's actual value, leading function +to fail with overflow indication and packets being dropped. + +This patch updates replay_esn->oseq_hi in the right place. + +Fixes: d7dbefc45cf5 ("xfrm: Add xfrm_replay_overflow functions for offloading") +Signed-off-by: Yossef Efraim +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/xfrm/xfrm_replay.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/net/xfrm/xfrm_replay.c ++++ b/net/xfrm/xfrm_replay.c +@@ -666,7 +666,7 @@ static int xfrm_replay_overflow_offload_ + if (unlikely(oseq < replay_esn->oseq)) { + XFRM_SKB_CB(skb)->seq.output.hi = ++oseq_hi; + xo->seq.hi = oseq_hi; +- ++ replay_esn->oseq_hi = oseq_hi; + if (replay_esn->oseq_hi == 0) { + replay_esn->oseq--; + replay_esn->oseq_hi--; +@@ -678,7 +678,6 @@ static int xfrm_replay_overflow_offload_ + } + + replay_esn->oseq = oseq; +- replay_esn->oseq_hi = oseq_hi; + + if (xfrm_aevent_is_on(net)) + x->repl->notify(x, XFRM_REPLAY_UPDATE);