From a5f52adcd88070a313fccb5afb54439abd0193b5 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 9 Jan 2017 16:25:59 +0100 Subject: [PATCH] 4.9-stable patches added patches: asoc-cht_bsw_rt5645-fix-leftover-kmalloc.patch asoc-intel-skylake-fix-a-shift-wrapping-bug.patch asoc-lpass-platform-initialize-dma-channel-number.patch asoc-samsung-i2s-fixup-last-irq-unsafe-spin-lock-call.patch clk-clk-wm831x-fix-a-logic-error.patch clk-imx31-fix-rewritten-input-argument-of-mx31_clocks_init.patch clk-qcom-ipq806x-fix-board-clk-rates.patch clk-renesas-mstp-support-8-bit-registers-for-r7s72100.patch clk-sunxi-ng-sun8i-a23-set-clk_set_rate_parent-for-audio-module-clocks.patch clk-sunxi-ng-sun8i-h3-set-clk_set_rate_parent-for-audio-module-clocks.patch clk-ti-dra7-fix-failed-to-lookup-clock-node-gmac_gmii_ref_clk_div-boot-message.patch crypto-arm-aes-ce-fix-for-big-endian.patch crypto-arm64-aes-ccm-ce-fix-for-big-endian.patch crypto-arm64-aes-ce-fix-for-big-endian.patch crypto-arm64-aes-neon-fix-for-big-endian.patch crypto-arm64-aes-xts-ce-fix-for-big-endian.patch crypto-arm64-ghash-ce-fix-for-big-endian.patch crypto-arm64-sha1-ce-fix-for-big-endian.patch crypto-arm64-sha2-ce-fix-for-big-endian.patch docs-rst-fix-latex-durole-renewcommand-with-sphinx-1.3.patch f2fs-hide-a-maybe-uninitialized-warning.patch f2fs-remove-percpu_count-due-to-performance-regression.patch genirq-affinity-fix-node-generation-from-cpumask.patch hwmon-amc6821-sign-extension-temperature.patch hwmon-ds620-fix-overflows-seen-when-writing-temperature-limits.patch hwmon-g762-fix-overflows-and-crash-seen-when-writing-limit-attributes.patch hwmon-lm90-fix-temp1_max_alarm-attribute.patch hwmon-nct7802-fix-overflows-seen-when-writing-into-limit-attributes.patch hwmon-scpi-fix-module-autoload.patch ima-fix-memory-leak-in-ima_release_policy.patch input-synaptics-rmi4-unlock-on-error.patch iommu-amd-fix-the-left-value-check-of-cmd-buffer.patch iommu-amd-missing-error-code-in-amd_iommu_init_device.patch iommu-vt-d-fix-pasid-table-size-encoding.patch iommu-vt-d-flush-old-iommu-caches-for-kdump-when-the-device-gets-context-mapped.patch irqchip-bcm7038-l1-implement-irq_cpu_offline-callback.patch md-fix-refcount-problem-on-mddev-when-stopping-array.patch md-md_recovery_needed-is-set-for-mddev-recovery.patch mm-compaction-fix-nr_isolated_-stats-for-pfn-based-migration.patch mm-hugetlb.c-use-the-right-pte-val-for-compare-in-hugetlb_cow.patch mm-khugepaged-close-use-after-free-race-during-shmem-collapsing.patch mm-khugepaged-fix-radix-tree-node-leak-in-shmem-collapse-error-path.patch mmc-mmc_test-uninitialized-return-value.patch pci-add-mellanox-device-ids.patch pci-convert-broken-intx-masking-quirks-from-header-to-final.patch pci-convert-mellanox-broken-intx-quirks-to-be-for-listed-devices-only.patch pci-enable-access-to-non-standard-vpd-for-chelsio-devices-cxgb3.patch pci-msi-check-for-null-affinity-mask-in-pci_irq_get_affinity.patch pci-rockchip-correct-the-use-of-fts-mask.patch pci-rockchip-fix-negotiated-lanes-calculation.patch pci-support-intx-masking-on-connectx-4-with-firmware-x.14.1100.patch platform-x86-fujitsu-laptop-use-brightness_set_blocking-for-led-setting-callbacks.patch pm-wakeirq-fix-dedicated-wakeirq-for-drivers-not-using-autosuspend.patch powerpc-pci-rpadlpar-fix-device-reference-leaks.patch relay-check-array-offset-before-using-it.patch rpmsg-qcom_smd-correct-return-value-for-o_nonblock.patch s390-crypto-unlock-on-error-in-prng_tdes_read.patch s390-pci-fix-dma-address-calculation-in-map_sg.patch s390-topology-always-use-s390-specific-sched_domain_topology_level.patch sbp-target-fix-second-argument-of-percpu_ida_alloc.patch scsi-g_ncr5380-fix-release_region-in-error-handling.patch scsi-mvsas-fix-command_active-typo.patch staging-media-davinci_vpfe-unlock-on-error-in-vpfe_reqbufs.patch target-iscsi-fix-double-free-in-lio_target_tiqn_addtpg.patch x86-cpu-probe-cpuid-leaf-6-even-when-cpuid_level-6.patch x86-prctl-uapi-remove-ifdef-for-checkpoint_restore.patch --- ...-cht_bsw_rt5645-fix-leftover-kmalloc.patch | 55 ++++ ...tel-skylake-fix-a-shift-wrapping-bug.patch | 34 +++ ...atform-initialize-dma-channel-number.patch | 44 +++ ...fixup-last-irq-unsafe-spin-lock-call.patch | 57 ++++ .../clk-clk-wm831x-fix-a-logic-error.patch | 35 +++ ...n-input-argument-of-mx31_clocks_init.patch | 47 ++++ ...clk-qcom-ipq806x-fix-board-clk-rates.patch | 37 +++ ...support-8-bit-registers-for-r7s72100.patch | 107 ++++++++ ..._rate_parent-for-audio-module-clocks.patch | 49 ++++ ..._rate_parent-for-audio-module-clocks.patch | 57 ++++ ...e-gmac_gmii_ref_clk_div-boot-message.patch | 33 +++ ...crypto-arm-aes-ce-fix-for-big-endian.patch | 39 +++ ...-arm64-aes-ccm-ce-fix-for-big-endian.patch | 201 ++++++++++++++ ...ypto-arm64-aes-ce-fix-for-big-endian.patch | 100 +++++++ ...to-arm64-aes-neon-fix-for-big-endian.patch | 109 ++++++++ ...-arm64-aes-xts-ce-fix-for-big-endian.patch | 44 +++ ...to-arm64-ghash-ce-fix-for-big-endian.patch | 43 +++ ...pto-arm64-sha1-ce-fix-for-big-endian.patch | 43 +++ ...pto-arm64-sha2-ce-fix-for-big-endian.patch | 42 +++ ...-durole-renewcommand-with-sphinx-1.3.patch | 67 +++++ ...s-hide-a-maybe-uninitialized-warning.patch | 50 ++++ ..._count-due-to-performance-regression.patch | 142 ++++++++++ ...ity-fix-node-generation-from-cpumask.patch | 68 +++++ ...n-amc6821-sign-extension-temperature.patch | 37 +++ ...seen-when-writing-temperature-limits.patch | 37 +++ ...h-seen-when-writing-limit-attributes.patch | 48 ++++ ...n-lm90-fix-temp1_max_alarm-attribute.patch | 33 +++ ...n-when-writing-into-limit-attributes.patch | 69 +++++ .../hwmon-scpi-fix-module-autoload.patch | 45 +++ ...ix-memory-leak-in-ima_release_policy.patch | 38 +++ ...input-synaptics-rmi4-unlock-on-error.patch | 43 +++ ...x-the-left-value-check-of-cmd-buffer.patch | 42 +++ ...-error-code-in-amd_iommu_init_device.patch | 34 +++ ...u-vt-d-fix-pasid-table-size-encoding.patch | 73 +++++ ...-when-the-device-gets-context-mapped.patch | 89 ++++++ ...1-implement-irq_cpu_offline-callback.patch | 73 +++++ ...problem-on-mddev-when-stopping-array.patch | 52 ++++ ...ery_needed-is-set-for-mddev-recovery.patch | 31 +++ ...lated_-stats-for-pfn-based-migration.patch | 166 +++++++++++ ...t-pte-val-for-compare-in-hugetlb_cow.patch | 83 ++++++ ...er-free-race-during-shmem-collapsing.patch | 77 ++++++ ...de-leak-in-shmem-collapse-error-path.patch | 48 ++++ ...-mmc_test-uninitialized-return-value.patch | 31 +++ queue-4.9/pci-add-mellanox-device-ids.patch | 58 ++++ ...-masking-quirks-from-header-to-final.patch | 117 ++++++++ ...quirks-to-be-for-listed-devices-only.patch | 94 +++++++ ...andard-vpd-for-chelsio-devices-cxgb3.patch | 117 ++++++++ ...ffinity-mask-in-pci_irq_get_affinity.patch | 39 +++ ...rockchip-correct-the-use-of-fts-mask.patch | 35 +++ ...hip-fix-negotiated-lanes-calculation.patch | 35 +++ ...n-connectx-4-with-firmware-x.14.1100.patch | 117 ++++++++ ...t_blocking-for-led-setting-callbacks.patch | 150 ++++++++++ ...rq-for-drivers-not-using-autosuspend.patch | 257 ++++++++++++++++++ ...-rpadlpar-fix-device-reference-leaks.patch | 48 ++++ ...y-check-array-offset-before-using-it.patch | 39 +++ ...-correct-return-value-for-o_nonblock.patch | 31 +++ ...to-unlock-on-error-in-prng_tdes_read.patch | 35 +++ ...ix-dma-address-calculation-in-map_sg.patch | 79 ++++++ ...specific-sched_domain_topology_level.patch | 42 +++ ...-second-argument-of-percpu_ida_alloc.patch | 31 +++ ...fix-release_region-in-error-handling.patch | 43 +++ .../scsi-mvsas-fix-command_active-typo.patch | 42 +++ queue-4.9/series | 66 +++++ ...vpfe-unlock-on-error-in-vpfe_reqbufs.patch | 33 +++ ...ouble-free-in-lio_target_tiqn_addtpg.patch | 35 +++ ...cpuid-leaf-6-even-when-cpuid_level-6.patch | 44 +++ ...-remove-ifdef-for-checkpoint_restore.patch | 57 ++++ 67 files changed, 4296 insertions(+) create mode 100644 queue-4.9/asoc-cht_bsw_rt5645-fix-leftover-kmalloc.patch create mode 100644 queue-4.9/asoc-intel-skylake-fix-a-shift-wrapping-bug.patch create mode 100644 queue-4.9/asoc-lpass-platform-initialize-dma-channel-number.patch create mode 100644 queue-4.9/asoc-samsung-i2s-fixup-last-irq-unsafe-spin-lock-call.patch create mode 100644 queue-4.9/clk-clk-wm831x-fix-a-logic-error.patch create mode 100644 queue-4.9/clk-imx31-fix-rewritten-input-argument-of-mx31_clocks_init.patch create mode 100644 queue-4.9/clk-qcom-ipq806x-fix-board-clk-rates.patch create mode 100644 queue-4.9/clk-renesas-mstp-support-8-bit-registers-for-r7s72100.patch create mode 100644 queue-4.9/clk-sunxi-ng-sun8i-a23-set-clk_set_rate_parent-for-audio-module-clocks.patch create mode 100644 queue-4.9/clk-sunxi-ng-sun8i-h3-set-clk_set_rate_parent-for-audio-module-clocks.patch create mode 100644 queue-4.9/clk-ti-dra7-fix-failed-to-lookup-clock-node-gmac_gmii_ref_clk_div-boot-message.patch create mode 100644 queue-4.9/crypto-arm-aes-ce-fix-for-big-endian.patch create mode 100644 queue-4.9/crypto-arm64-aes-ccm-ce-fix-for-big-endian.patch create mode 100644 queue-4.9/crypto-arm64-aes-ce-fix-for-big-endian.patch create mode 100644 queue-4.9/crypto-arm64-aes-neon-fix-for-big-endian.patch create mode 100644 queue-4.9/crypto-arm64-aes-xts-ce-fix-for-big-endian.patch create mode 100644 queue-4.9/crypto-arm64-ghash-ce-fix-for-big-endian.patch create mode 100644 queue-4.9/crypto-arm64-sha1-ce-fix-for-big-endian.patch create mode 100644 queue-4.9/crypto-arm64-sha2-ce-fix-for-big-endian.patch create mode 100644 queue-4.9/docs-rst-fix-latex-durole-renewcommand-with-sphinx-1.3.patch create mode 100644 queue-4.9/f2fs-hide-a-maybe-uninitialized-warning.patch create mode 100644 queue-4.9/f2fs-remove-percpu_count-due-to-performance-regression.patch create mode 100644 queue-4.9/genirq-affinity-fix-node-generation-from-cpumask.patch create mode 100644 queue-4.9/hwmon-amc6821-sign-extension-temperature.patch create mode 100644 queue-4.9/hwmon-ds620-fix-overflows-seen-when-writing-temperature-limits.patch create mode 100644 queue-4.9/hwmon-g762-fix-overflows-and-crash-seen-when-writing-limit-attributes.patch create mode 100644 queue-4.9/hwmon-lm90-fix-temp1_max_alarm-attribute.patch create mode 100644 queue-4.9/hwmon-nct7802-fix-overflows-seen-when-writing-into-limit-attributes.patch create mode 100644 queue-4.9/hwmon-scpi-fix-module-autoload.patch create mode 100644 queue-4.9/ima-fix-memory-leak-in-ima_release_policy.patch create mode 100644 queue-4.9/input-synaptics-rmi4-unlock-on-error.patch create mode 100644 queue-4.9/iommu-amd-fix-the-left-value-check-of-cmd-buffer.patch create mode 100644 queue-4.9/iommu-amd-missing-error-code-in-amd_iommu_init_device.patch create mode 100644 queue-4.9/iommu-vt-d-fix-pasid-table-size-encoding.patch create mode 100644 queue-4.9/iommu-vt-d-flush-old-iommu-caches-for-kdump-when-the-device-gets-context-mapped.patch create mode 100644 queue-4.9/irqchip-bcm7038-l1-implement-irq_cpu_offline-callback.patch create mode 100644 queue-4.9/md-fix-refcount-problem-on-mddev-when-stopping-array.patch create mode 100644 queue-4.9/md-md_recovery_needed-is-set-for-mddev-recovery.patch create mode 100644 queue-4.9/mm-compaction-fix-nr_isolated_-stats-for-pfn-based-migration.patch create mode 100644 queue-4.9/mm-hugetlb.c-use-the-right-pte-val-for-compare-in-hugetlb_cow.patch create mode 100644 queue-4.9/mm-khugepaged-close-use-after-free-race-during-shmem-collapsing.patch create mode 100644 queue-4.9/mm-khugepaged-fix-radix-tree-node-leak-in-shmem-collapse-error-path.patch create mode 100644 queue-4.9/mmc-mmc_test-uninitialized-return-value.patch create mode 100644 queue-4.9/pci-add-mellanox-device-ids.patch create mode 100644 queue-4.9/pci-convert-broken-intx-masking-quirks-from-header-to-final.patch create mode 100644 queue-4.9/pci-convert-mellanox-broken-intx-quirks-to-be-for-listed-devices-only.patch create mode 100644 queue-4.9/pci-enable-access-to-non-standard-vpd-for-chelsio-devices-cxgb3.patch create mode 100644 queue-4.9/pci-msi-check-for-null-affinity-mask-in-pci_irq_get_affinity.patch create mode 100644 queue-4.9/pci-rockchip-correct-the-use-of-fts-mask.patch create mode 100644 queue-4.9/pci-rockchip-fix-negotiated-lanes-calculation.patch create mode 100644 queue-4.9/pci-support-intx-masking-on-connectx-4-with-firmware-x.14.1100.patch create mode 100644 queue-4.9/platform-x86-fujitsu-laptop-use-brightness_set_blocking-for-led-setting-callbacks.patch create mode 100644 queue-4.9/pm-wakeirq-fix-dedicated-wakeirq-for-drivers-not-using-autosuspend.patch create mode 100644 queue-4.9/powerpc-pci-rpadlpar-fix-device-reference-leaks.patch create mode 100644 queue-4.9/relay-check-array-offset-before-using-it.patch create mode 100644 queue-4.9/rpmsg-qcom_smd-correct-return-value-for-o_nonblock.patch create mode 100644 queue-4.9/s390-crypto-unlock-on-error-in-prng_tdes_read.patch create mode 100644 queue-4.9/s390-pci-fix-dma-address-calculation-in-map_sg.patch create mode 100644 queue-4.9/s390-topology-always-use-s390-specific-sched_domain_topology_level.patch create mode 100644 queue-4.9/sbp-target-fix-second-argument-of-percpu_ida_alloc.patch create mode 100644 queue-4.9/scsi-g_ncr5380-fix-release_region-in-error-handling.patch create mode 100644 queue-4.9/scsi-mvsas-fix-command_active-typo.patch create mode 100644 queue-4.9/staging-media-davinci_vpfe-unlock-on-error-in-vpfe_reqbufs.patch create mode 100644 queue-4.9/target-iscsi-fix-double-free-in-lio_target_tiqn_addtpg.patch create mode 100644 queue-4.9/x86-cpu-probe-cpuid-leaf-6-even-when-cpuid_level-6.patch create mode 100644 queue-4.9/x86-prctl-uapi-remove-ifdef-for-checkpoint_restore.patch diff --git a/queue-4.9/asoc-cht_bsw_rt5645-fix-leftover-kmalloc.patch b/queue-4.9/asoc-cht_bsw_rt5645-fix-leftover-kmalloc.patch new file mode 100644 index 00000000000..3f047798889 --- /dev/null +++ b/queue-4.9/asoc-cht_bsw_rt5645-fix-leftover-kmalloc.patch @@ -0,0 +1,55 @@ +From a823a17981a73faa115bc0f7eda0190763075e2c Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 22 Nov 2016 18:11:08 +0100 +Subject: ASoC: cht_bsw_rt5645: Fix leftover kmalloc + +From: Takashi Iwai + +commit a823a17981a73faa115bc0f7eda0190763075e2c upstream. + +cht_bsw_rt5645 driver allocates the own codec_id string but doesn't +release it. For simplicity, put the string in cht_mc_private; then +the string is allocated in a shot and released altogether. + +Fixes: c8560b7c917f ("ASoC: cht_bsw_rt5645: Fix writing to string literal") +Signed-off-by: Takashi Iwai +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/intel/boards/cht_bsw_rt5645.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/sound/soc/intel/boards/cht_bsw_rt5645.c ++++ b/sound/soc/intel/boards/cht_bsw_rt5645.c +@@ -44,6 +44,7 @@ struct cht_acpi_card { + struct cht_mc_private { + struct snd_soc_jack jack; + struct cht_acpi_card *acpi_card; ++ char codec_name[16]; + }; + + static inline struct snd_soc_dai *cht_get_codec_dai(struct snd_soc_card *card) +@@ -354,7 +355,6 @@ static int snd_cht_mc_probe(struct platf + int i; + struct cht_mc_private *drv; + struct snd_soc_card *card = snd_soc_cards[0].soc_card; +- char codec_name[16]; + struct sst_acpi_mach *mach; + const char *i2c_name = NULL; + int dai_index = 0; +@@ -374,12 +374,12 @@ static int snd_cht_mc_probe(struct platf + } + card->dev = &pdev->dev; + mach = card->dev->platform_data; +- sprintf(codec_name, "i2c-%s:00", drv->acpi_card->codec_id); ++ sprintf(drv->codec_name, "i2c-%s:00", drv->acpi_card->codec_id); + + /* set correct codec name */ + for (i = 0; i < ARRAY_SIZE(cht_dailink); i++) + if (!strcmp(card->dai_link[i].codec_name, "i2c-10EC5645:00")) { +- card->dai_link[i].codec_name = kstrdup(codec_name, GFP_KERNEL); ++ card->dai_link[i].codec_name = drv->codec_name; + dai_index = i; + } + diff --git a/queue-4.9/asoc-intel-skylake-fix-a-shift-wrapping-bug.patch b/queue-4.9/asoc-intel-skylake-fix-a-shift-wrapping-bug.patch new file mode 100644 index 00000000000..13fc998ce21 --- /dev/null +++ b/queue-4.9/asoc-intel-skylake-fix-a-shift-wrapping-bug.patch @@ -0,0 +1,34 @@ +From c8eabf821cac120afb78ca251b07cbf520406a7e Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 13 Oct 2016 11:55:48 +0300 +Subject: ASoC: Intel: Skylake: Fix a shift wrapping bug + +From: Dan Carpenter + +commit c8eabf821cac120afb78ca251b07cbf520406a7e upstream. + +"*val" is a u64. It definitely looks like we intend to use the high 32 +bits as well. + +Fixes: 700a9a63f9c1 ("ASoC: Intel: Skylake: Add module instance id generation APIs") +Signed-off-by: Dan Carpenter +Acked-by: Vinod Koul +Tested-by: Kranthi G +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/intel/skylake/skl-sst-utils.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/intel/skylake/skl-sst-utils.c ++++ b/sound/soc/intel/skylake/skl-sst-utils.c +@@ -179,7 +179,7 @@ static inline int skl_getid_32(struct uu + index = ffz(mask_val); + pvt_id = index + word1_mask + word2_mask; + if (pvt_id <= (max_inst - 1)) { +- *val |= 1 << (index + word1_mask); ++ *val |= 1ULL << (index + word1_mask); + return pvt_id; + } + } diff --git a/queue-4.9/asoc-lpass-platform-initialize-dma-channel-number.patch b/queue-4.9/asoc-lpass-platform-initialize-dma-channel-number.patch new file mode 100644 index 00000000000..42a652383eb --- /dev/null +++ b/queue-4.9/asoc-lpass-platform-initialize-dma-channel-number.patch @@ -0,0 +1,44 @@ +From 3b89e4b77ef9c2f985964fab17032db98f074ed0 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Tue, 8 Nov 2016 14:38:52 +0100 +Subject: ASoC: lpass-platform: initialize dma channel number +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnd Bergmann + +commit 3b89e4b77ef9c2f985964fab17032db98f074ed0 upstream. + +A bugfix accidentally removed the implicit initialization of the +dma channel number, causing undefined behavior when +v->alloc_dma_channel is NULL: + +sound/soc/qcom/lpass-platform.c: In function ‘lpass_platform_pcmops_open’: +sound/soc/qcom/lpass-platform.c:83:29: error: ‘dma_ch’ may be used uninitialized in this function [-Werror=maybe-uninitialized] + +This adds back an explicit initialization to zero, restoring the +previous behavior for that case. + +Fixes: 022d00ee0b55 ("ASoC: lpass-platform: Fix broken pcm data usage") +Signed-off-by: Arnd Bergmann +Acked-by: Kenneth Westfield +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/qcom/lpass-platform.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/sound/soc/qcom/lpass-platform.c ++++ b/sound/soc/qcom/lpass-platform.c +@@ -78,6 +78,9 @@ static int lpass_platform_pcmops_open(st + dma_ch = 0; + if (v->alloc_dma_channel) + dma_ch = v->alloc_dma_channel(drvdata, dir); ++ else ++ dma_ch = 0; ++ + if (dma_ch < 0) + return dma_ch; + diff --git a/queue-4.9/asoc-samsung-i2s-fixup-last-irq-unsafe-spin-lock-call.patch b/queue-4.9/asoc-samsung-i2s-fixup-last-irq-unsafe-spin-lock-call.patch new file mode 100644 index 00000000000..678742390ef --- /dev/null +++ b/queue-4.9/asoc-samsung-i2s-fixup-last-irq-unsafe-spin-lock-call.patch @@ -0,0 +1,57 @@ +From 5faf071d08ddd1c1be66deaa93a09ccf43f5b538 Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Fri, 21 Oct 2016 14:18:48 +0100 +Subject: ASoC: samsung: i2s: Fixup last IRQ unsafe spin lock call + +From: Charles Keepax + +commit 5faf071d08ddd1c1be66deaa93a09ccf43f5b538 upstream. + +Unfortunately, I seem to have missed a case where an IRQ safe spinlock was +required, in samsung_i2s_dai_remove, when I fixed up the other calls in +this patch: + +316fa9e09ad7 ("ASoC: samsung: Use IRQ safe spin lock calls") + +This causes a lockdep warning when unbinding and rebinding the audio card: + +[ 104.357664] CPU0 CPU1 +[ 104.362174] ---- ---- +[ 104.366692] lock(&(&pri_dai->spinlock)->rlock); +[ 104.371372] local_irq_disable(); +[ 104.377283] lock(&(&substream->self_group.lock)->rlock); +[ 104.385259] lock(&(&pri_dai->spinlock)->rlock); +[ 104.392469] +[ 104.395072] lock(&(&substream->self_group.lock)->rlock); +[ 104.400710] +[ 104.400710] *** DEADLOCK *** + +Fixes: ce8bcdbb61d9 ("ASoC: samsung: i2s: Protect more registers with a spinlock") +Signed-off-by: Charles Keepax +Reviewed-by: Krzysztof Kozlowski +Reviewed-by: Sylwester Nawrocki +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/samsung/i2s.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/sound/soc/samsung/i2s.c ++++ b/sound/soc/samsung/i2s.c +@@ -1029,12 +1029,13 @@ static int samsung_i2s_dai_probe(struct + static int samsung_i2s_dai_remove(struct snd_soc_dai *dai) + { + struct i2s_dai *i2s = snd_soc_dai_get_drvdata(dai); ++ unsigned long flags; + + if (!is_secondary(i2s)) { + if (i2s->quirks & QUIRK_NEED_RSTCLR) { +- spin_lock(i2s->lock); ++ spin_lock_irqsave(i2s->lock, flags); + writel(0, i2s->addr + I2SCON); +- spin_unlock(i2s->lock); ++ spin_unlock_irqrestore(i2s->lock, flags); + } + } + diff --git a/queue-4.9/clk-clk-wm831x-fix-a-logic-error.patch b/queue-4.9/clk-clk-wm831x-fix-a-logic-error.patch new file mode 100644 index 00000000000..ecf18398987 --- /dev/null +++ b/queue-4.9/clk-clk-wm831x-fix-a-logic-error.patch @@ -0,0 +1,35 @@ +From 20979202ee6e4c68dab7bcf408787225a656d18e Mon Sep 17 00:00:00 2001 +From: Pan Bian +Date: Thu, 1 Dec 2016 14:25:44 +0800 +Subject: clk: clk-wm831x: fix a logic error + +From: Pan Bian + +commit 20979202ee6e4c68dab7bcf408787225a656d18e upstream. + +Fix bug https://bugzilla.kernel.org/show_bug.cgi?id=188561. Function +wm831x_clkout_is_prepared() returns "true" when it fails to read +CLOCK_CONTROL_1. "true" means the device is already prepared. So +return "true" on the read failure seems improper. + +Signed-off-by: Pan Bian +Acked-by: Charles Keepax +Fixes: f05259a6ffa4 ("clk: wm831x: Add initial WM831x clock driver") +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/clk-wm831x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/clk-wm831x.c ++++ b/drivers/clk/clk-wm831x.c +@@ -243,7 +243,7 @@ static int wm831x_clkout_is_prepared(str + if (ret < 0) { + dev_err(wm831x->dev, "Unable to read CLOCK_CONTROL_1: %d\n", + ret); +- return true; ++ return false; + } + + return (ret & WM831X_CLKOUT_ENA) != 0; diff --git a/queue-4.9/clk-imx31-fix-rewritten-input-argument-of-mx31_clocks_init.patch b/queue-4.9/clk-imx31-fix-rewritten-input-argument-of-mx31_clocks_init.patch new file mode 100644 index 00000000000..e5db0080d73 --- /dev/null +++ b/queue-4.9/clk-imx31-fix-rewritten-input-argument-of-mx31_clocks_init.patch @@ -0,0 +1,47 @@ +From bae203d58b7dce89664071b3fafe20cedaa3e4f6 Mon Sep 17 00:00:00 2001 +From: Vladimir Zapolskiy +Date: Mon, 26 Sep 2016 03:03:42 +0300 +Subject: clk: imx31: fix rewritten input argument of mx31_clocks_init() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vladimir Zapolskiy + +commit bae203d58b7dce89664071b3fafe20cedaa3e4f6 upstream. + +Function mx31_clocks_init() is called during clock intialization on +legacy boards with reference clock frequency passed as its input +argument, this can be verified by examination of the function +declaration found in arch/arm/mach-imx/common.h and actual function +users which include that header file. + +Inside CCF driver the function ignores its input argument, by chance +the used value in the function body is the same as input arguments on +side of all callers. + +Fixes: d9388c843237 ("clk: imx31: Do not call mxc_timer_init twice when booting with DT") +Signed-off-by: Vladimir Zapolskiy +Reviewed-by: Uwe Kleine-König +Acked-by: Stephen Boyd +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/imx/clk-imx31.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/clk/imx/clk-imx31.c ++++ b/drivers/clk/imx/clk-imx31.c +@@ -157,10 +157,8 @@ static void __init _mx31_clocks_init(uns + } + } + +-int __init mx31_clocks_init(void) ++int __init mx31_clocks_init(unsigned long fref) + { +- u32 fref = 26000000; /* default */ +- + _mx31_clocks_init(fref); + + clk_register_clkdev(clk[gpt_gate], "per", "imx-gpt.0"); diff --git a/queue-4.9/clk-qcom-ipq806x-fix-board-clk-rates.patch b/queue-4.9/clk-qcom-ipq806x-fix-board-clk-rates.patch new file mode 100644 index 00000000000..b42ede06f8e --- /dev/null +++ b/queue-4.9/clk-qcom-ipq806x-fix-board-clk-rates.patch @@ -0,0 +1,37 @@ +From cbf2e548ca8ad4bb274d014e9a70bd841d29948e Mon Sep 17 00:00:00 2001 +From: Stephen Boyd +Date: Wed, 9 Nov 2016 17:08:28 -0800 +Subject: clk: qcom: ipq806x: Fix board clk rates + +From: Stephen Boyd + +commit cbf2e548ca8ad4bb274d014e9a70bd841d29948e upstream. + +The clocks on these boards run at 25 MHz, not 19.2 and 27 like +other platforms. Unfortunately I copy/pasted from other similar +SoCs but forgot this one is different. Fix it. + +Fixes: a085f877a882 ("clk: qcom: Move cxo/pxo/xo into dt files") +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/qcom/gcc-ipq806x.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/clk/qcom/gcc-ipq806x.c ++++ b/drivers/clk/qcom/gcc-ipq806x.c +@@ -2990,11 +2990,11 @@ static int gcc_ipq806x_probe(struct plat + struct regmap *regmap; + int ret; + +- ret = qcom_cc_register_board_clk(dev, "cxo_board", "cxo", 19200000); ++ ret = qcom_cc_register_board_clk(dev, "cxo_board", "cxo", 25000000); + if (ret) + return ret; + +- ret = qcom_cc_register_board_clk(dev, "pxo_board", "pxo", 27000000); ++ ret = qcom_cc_register_board_clk(dev, "pxo_board", "pxo", 25000000); + if (ret) + return ret; + diff --git a/queue-4.9/clk-renesas-mstp-support-8-bit-registers-for-r7s72100.patch b/queue-4.9/clk-renesas-mstp-support-8-bit-registers-for-r7s72100.patch new file mode 100644 index 00000000000..181b7305779 --- /dev/null +++ b/queue-4.9/clk-renesas-mstp-support-8-bit-registers-for-r7s72100.patch @@ -0,0 +1,107 @@ +From e2a33c34ddff22ee208d80abdd12b88a98d6cb60 Mon Sep 17 00:00:00 2001 +From: Chris Brandt +Date: Thu, 15 Dec 2016 12:00:27 -0500 +Subject: clk: renesas: mstp: Support 8-bit registers for r7s72100 + +From: Chris Brandt + +commit e2a33c34ddff22ee208d80abdd12b88a98d6cb60 upstream. + +The RZ/A1 is different than the other Renesas SOCs because the MSTP +registers are 8-bit instead of 32-bit and if you try writing values as +32-bit nothing happens...meaning this driver never worked for r7s72100. + +Fixes: b6face404f38 ("ARM: shmobile: r7s72100: add essential clock nodes to dtsi") +Signed-off-by: Chris Brandt +Reviewed-by: Geert Uytterhoeven +Tested-by: Geert Uytterhoeven +Acked-by: Kuninori Morimoto +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/renesas/clk-mstp.c | 27 ++++++++++++++++++++++----- + 1 file changed, 22 insertions(+), 5 deletions(-) + +--- a/drivers/clk/renesas/clk-mstp.c ++++ b/drivers/clk/renesas/clk-mstp.c +@@ -37,12 +37,14 @@ + * @smstpcr: module stop control register + * @mstpsr: module stop status register (optional) + * @lock: protects writes to SMSTPCR ++ * @width_8bit: registers are 8-bit, not 32-bit + */ + struct mstp_clock_group { + struct clk_onecell_data data; + void __iomem *smstpcr; + void __iomem *mstpsr; + spinlock_t lock; ++ bool width_8bit; + }; + + /** +@@ -59,6 +61,18 @@ struct mstp_clock { + + #define to_mstp_clock(_hw) container_of(_hw, struct mstp_clock, hw) + ++static inline u32 cpg_mstp_read(struct mstp_clock_group *group, ++ u32 __iomem *reg) ++{ ++ return group->width_8bit ? readb(reg) : clk_readl(reg); ++} ++ ++static inline void cpg_mstp_write(struct mstp_clock_group *group, u32 val, ++ u32 __iomem *reg) ++{ ++ group->width_8bit ? writeb(val, reg) : clk_writel(val, reg); ++} ++ + static int cpg_mstp_clock_endisable(struct clk_hw *hw, bool enable) + { + struct mstp_clock *clock = to_mstp_clock(hw); +@@ -70,12 +84,12 @@ static int cpg_mstp_clock_endisable(stru + + spin_lock_irqsave(&group->lock, flags); + +- value = clk_readl(group->smstpcr); ++ value = cpg_mstp_read(group, group->smstpcr); + if (enable) + value &= ~bitmask; + else + value |= bitmask; +- clk_writel(value, group->smstpcr); ++ cpg_mstp_write(group, value, group->smstpcr); + + spin_unlock_irqrestore(&group->lock, flags); + +@@ -83,7 +97,7 @@ static int cpg_mstp_clock_endisable(stru + return 0; + + for (i = 1000; i > 0; --i) { +- if (!(clk_readl(group->mstpsr) & bitmask)) ++ if (!(cpg_mstp_read(group, group->mstpsr) & bitmask)) + break; + cpu_relax(); + } +@@ -114,9 +128,9 @@ static int cpg_mstp_clock_is_enabled(str + u32 value; + + if (group->mstpsr) +- value = clk_readl(group->mstpsr); ++ value = cpg_mstp_read(group, group->mstpsr); + else +- value = clk_readl(group->smstpcr); ++ value = cpg_mstp_read(group, group->smstpcr); + + return !(value & BIT(clock->bit_index)); + } +@@ -188,6 +202,9 @@ static void __init cpg_mstp_clocks_init( + return; + } + ++ if (of_device_is_compatible(np, "renesas,r7s72100-mstp-clocks")) ++ group->width_8bit = true; ++ + for (i = 0; i < MSTP_MAX_CLOCKS; ++i) + clks[i] = ERR_PTR(-ENOENT); + diff --git a/queue-4.9/clk-sunxi-ng-sun8i-a23-set-clk_set_rate_parent-for-audio-module-clocks.patch b/queue-4.9/clk-sunxi-ng-sun8i-a23-set-clk_set_rate_parent-for-audio-module-clocks.patch new file mode 100644 index 00000000000..7c0e39f5d8c --- /dev/null +++ b/queue-4.9/clk-sunxi-ng-sun8i-a23-set-clk_set_rate_parent-for-audio-module-clocks.patch @@ -0,0 +1,49 @@ +From 937ff9ded8b6ebe8963ade55bdd77a61ded88075 Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Fri, 11 Nov 2016 18:05:57 +0800 +Subject: clk: sunxi-ng: sun8i-a23: Set CLK_SET_RATE_PARENT for audio module clocks + +From: Chen-Yu Tsai + +commit 937ff9ded8b6ebe8963ade55bdd77a61ded88075 upstream. + +The audio module clocks are supposed to be set according to the sample +rate of the audio stream. The audio PLL provides the clock signal for +these module clocks, and only it is freely tunable. + +Set CLK_SET_RATE_PARENT for the audio module clocks so their users can +properly tune the clock rate. + +Fixes: 5690879d93e8 ("clk: sunxi-ng: Add A23 CCU") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/sunxi-ng/ccu-sun8i-a23.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c ++++ b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c +@@ -344,10 +344,10 @@ static SUNXI_CCU_MP_WITH_MUX_GATE(spi1_c + static const char * const i2s_parents[] = { "pll-audio-8x", "pll-audio-4x", + "pll-audio-2x", "pll-audio" }; + static SUNXI_CCU_MUX_WITH_GATE(i2s0_clk, "i2s0", i2s_parents, +- 0x0b0, 16, 2, BIT(31), 0); ++ 0x0b0, 16, 2, BIT(31), CLK_SET_RATE_PARENT); + + static SUNXI_CCU_MUX_WITH_GATE(i2s1_clk, "i2s1", i2s_parents, +- 0x0b4, 16, 2, BIT(31), 0); ++ 0x0b4, 16, 2, BIT(31), CLK_SET_RATE_PARENT); + + /* TODO: the parent for most of the USB clocks is not known */ + static SUNXI_CCU_GATE(usb_phy0_clk, "usb-phy0", "osc24M", +@@ -415,7 +415,7 @@ static SUNXI_CCU_M_WITH_GATE(ve_clk, "ve + 0x13c, 16, 3, BIT(31), CLK_SET_RATE_PARENT); + + static SUNXI_CCU_GATE(ac_dig_clk, "ac-dig", "pll-audio", +- 0x140, BIT(31), 0); ++ 0x140, BIT(31), CLK_SET_RATE_PARENT); + static SUNXI_CCU_GATE(avs_clk, "avs", "osc24M", + 0x144, BIT(31), 0); + diff --git a/queue-4.9/clk-sunxi-ng-sun8i-h3-set-clk_set_rate_parent-for-audio-module-clocks.patch b/queue-4.9/clk-sunxi-ng-sun8i-h3-set-clk_set_rate_parent-for-audio-module-clocks.patch new file mode 100644 index 00000000000..ccfb7f0245c --- /dev/null +++ b/queue-4.9/clk-sunxi-ng-sun8i-h3-set-clk_set_rate_parent-for-audio-module-clocks.patch @@ -0,0 +1,57 @@ +From 0f6f9302b819ca352cfd4f42c18ec08d521f9cae Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Fri, 11 Nov 2016 18:05:58 +0800 +Subject: clk: sunxi-ng: sun8i-h3: Set CLK_SET_RATE_PARENT for audio module clocks + +From: Chen-Yu Tsai + +commit 0f6f9302b819ca352cfd4f42c18ec08d521f9cae upstream. + +The audio module clocks are supposed to be set according to the sample +rate of the audio stream. The audio PLL provides the clock signal for +these module clocks, and only it is freely tunable. + +Set CLK_SET_RATE_PARENT for the audio module clocks so their users can +properly tune the clock rate. + +Fixes: 0577e4853bfb ("clk: sunxi-ng: Add H3 clocks") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/sunxi-ng/ccu-sun8i-h3.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c ++++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c +@@ -394,16 +394,16 @@ static SUNXI_CCU_MP_WITH_MUX_GATE(spi1_c + static const char * const i2s_parents[] = { "pll-audio-8x", "pll-audio-4x", + "pll-audio-2x", "pll-audio" }; + static SUNXI_CCU_MUX_WITH_GATE(i2s0_clk, "i2s0", i2s_parents, +- 0x0b0, 16, 2, BIT(31), 0); ++ 0x0b0, 16, 2, BIT(31), CLK_SET_RATE_PARENT); + + static SUNXI_CCU_MUX_WITH_GATE(i2s1_clk, "i2s1", i2s_parents, +- 0x0b4, 16, 2, BIT(31), 0); ++ 0x0b4, 16, 2, BIT(31), CLK_SET_RATE_PARENT); + + static SUNXI_CCU_MUX_WITH_GATE(i2s2_clk, "i2s2", i2s_parents, +- 0x0b8, 16, 2, BIT(31), 0); ++ 0x0b8, 16, 2, BIT(31), CLK_SET_RATE_PARENT); + + static SUNXI_CCU_M_WITH_GATE(spdif_clk, "spdif", "pll-audio", +- 0x0c0, 0, 4, BIT(31), 0); ++ 0x0c0, 0, 4, BIT(31), CLK_SET_RATE_PARENT); + + static SUNXI_CCU_GATE(usb_phy0_clk, "usb-phy0", "osc24M", + 0x0cc, BIT(8), 0); +@@ -466,7 +466,7 @@ static SUNXI_CCU_M_WITH_GATE(ve_clk, "ve + 0x13c, 16, 3, BIT(31), 0); + + static SUNXI_CCU_GATE(ac_dig_clk, "ac-dig", "pll-audio", +- 0x140, BIT(31), 0); ++ 0x140, BIT(31), CLK_SET_RATE_PARENT); + static SUNXI_CCU_GATE(avs_clk, "avs", "osc24M", + 0x144, BIT(31), 0); + diff --git a/queue-4.9/clk-ti-dra7-fix-failed-to-lookup-clock-node-gmac_gmii_ref_clk_div-boot-message.patch b/queue-4.9/clk-ti-dra7-fix-failed-to-lookup-clock-node-gmac_gmii_ref_clk_div-boot-message.patch new file mode 100644 index 00000000000..2a8102b9986 --- /dev/null +++ b/queue-4.9/clk-ti-dra7-fix-failed-to-lookup-clock-node-gmac_gmii_ref_clk_div-boot-message.patch @@ -0,0 +1,33 @@ +From f8d17344a60921c2387759fc0a85aa64299d1ec6 Mon Sep 17 00:00:00 2001 +From: Grygorii Strashko +Date: Tue, 29 Nov 2016 17:07:57 -0600 +Subject: clk: ti: dra7: fix "failed to lookup clock node gmac_gmii_ref_clk_div" boot message + +From: Grygorii Strashko + +commit f8d17344a60921c2387759fc0a85aa64299d1ec6 upstream. + +Prevent creating clk alias for non existing gmac_gmii_ref_clk_div clock and, +this way, eliminate excessive error message during boot: + + "ti_dt_clocks_register: failed to lookup clock node gmac_gmii_ref_clk_div" + +Fixes: c097338ebd3f ("ARM: dts: dra7: cpsw: fix clocks tree") +Signed-off-by: Grygorii Strashko +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/ti/clk-7xx.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/clk/ti/clk-7xx.c ++++ b/drivers/clk/ti/clk-7xx.c +@@ -201,7 +201,6 @@ static struct ti_dt_clk dra7xx_clks[] = + DT_CLK(NULL, "atl_dpll_clk_mux", "atl_dpll_clk_mux"), + DT_CLK(NULL, "atl_gfclk_mux", "atl_gfclk_mux"), + DT_CLK(NULL, "dcan1_sys_clk_mux", "dcan1_sys_clk_mux"), +- DT_CLK(NULL, "gmac_gmii_ref_clk_div", "gmac_gmii_ref_clk_div"), + DT_CLK(NULL, "gmac_rft_clk_mux", "gmac_rft_clk_mux"), + DT_CLK(NULL, "gpu_core_gclk_mux", "gpu_core_gclk_mux"), + DT_CLK(NULL, "gpu_hyd_gclk_mux", "gpu_hyd_gclk_mux"), diff --git a/queue-4.9/crypto-arm-aes-ce-fix-for-big-endian.patch b/queue-4.9/crypto-arm-aes-ce-fix-for-big-endian.patch new file mode 100644 index 00000000000..b2a3a606da1 --- /dev/null +++ b/queue-4.9/crypto-arm-aes-ce-fix-for-big-endian.patch @@ -0,0 +1,39 @@ +From 58010fa6f71c9577922b22e46014b95a4ec80fa0 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Tue, 11 Oct 2016 19:15:20 +0100 +Subject: crypto: arm/aes-ce - fix for big endian + +From: Ard Biesheuvel + +commit 58010fa6f71c9577922b22e46014b95a4ec80fa0 upstream. + +The AES key schedule generation is mostly endian agnostic, with the +exception of the rotation and the incorporation of the round constant +at the start of each round. So implement a big endian specific version +of that part to make the whole routine big endian compatible. + +Fixes: 86464859cc77 ("crypto: arm - AES in ECB/CBC/CTR/XTS modes using ARMv8 Crypto Extensions") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/crypto/aes-ce-glue.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/arch/arm/crypto/aes-ce-glue.c ++++ b/arch/arm/crypto/aes-ce-glue.c +@@ -88,8 +88,13 @@ static int ce_aes_expandkey(struct crypt + u32 *rki = ctx->key_enc + (i * kwords); + u32 *rko = rki + kwords; + ++#ifndef CONFIG_CPU_BIG_ENDIAN + rko[0] = ror32(ce_aes_sub(rki[kwords - 1]), 8); + rko[0] = rko[0] ^ rki[0] ^ rcon[i]; ++#else ++ rko[0] = rol32(ce_aes_sub(rki[kwords - 1]), 8); ++ rko[0] = rko[0] ^ rki[0] ^ (rcon[i] << 24); ++#endif + rko[1] = rko[0] ^ rki[1]; + rko[2] = rko[1] ^ rki[2]; + rko[3] = rko[2] ^ rki[3]; diff --git a/queue-4.9/crypto-arm64-aes-ccm-ce-fix-for-big-endian.patch b/queue-4.9/crypto-arm64-aes-ccm-ce-fix-for-big-endian.patch new file mode 100644 index 00000000000..f631b88e941 --- /dev/null +++ b/queue-4.9/crypto-arm64-aes-ccm-ce-fix-for-big-endian.patch @@ -0,0 +1,201 @@ +From 56e4e76c68fcb51547b5299e5b66a135935ff414 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Tue, 11 Oct 2016 19:15:17 +0100 +Subject: crypto: arm64/aes-ccm-ce: fix for big endian + +From: Ard Biesheuvel + +commit 56e4e76c68fcb51547b5299e5b66a135935ff414 upstream. + +The AES-CCM implementation that uses ARMv8 Crypto Extensions instructions +refers to the AES round keys as pairs of 64-bit quantities, which causes +failures when building the code for big endian. In addition, it byte swaps +the input counter unconditionally, while this is only required for little +endian builds. So fix both issues. + +Fixes: 12ac3efe74f8 ("arm64/crypto: use crypto instructions to generate AES key schedule") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/crypto/aes-ce-ccm-core.S | 53 ++++++++++++++++++------------------ + 1 file changed, 27 insertions(+), 26 deletions(-) + +--- a/arch/arm64/crypto/aes-ce-ccm-core.S ++++ b/arch/arm64/crypto/aes-ce-ccm-core.S +@@ -9,6 +9,7 @@ + */ + + #include ++#include + + .text + .arch armv8-a+crypto +@@ -19,7 +20,7 @@ + */ + ENTRY(ce_aes_ccm_auth_data) + ldr w8, [x3] /* leftover from prev round? */ +- ld1 {v0.2d}, [x0] /* load mac */ ++ ld1 {v0.16b}, [x0] /* load mac */ + cbz w8, 1f + sub w8, w8, #16 + eor v1.16b, v1.16b, v1.16b +@@ -31,7 +32,7 @@ ENTRY(ce_aes_ccm_auth_data) + beq 8f /* out of input? */ + cbnz w8, 0b + eor v0.16b, v0.16b, v1.16b +-1: ld1 {v3.2d}, [x4] /* load first round key */ ++1: ld1 {v3.16b}, [x4] /* load first round key */ + prfm pldl1strm, [x1] + cmp w5, #12 /* which key size? */ + add x6, x4, #16 +@@ -41,17 +42,17 @@ ENTRY(ce_aes_ccm_auth_data) + mov v5.16b, v3.16b + b 4f + 2: mov v4.16b, v3.16b +- ld1 {v5.2d}, [x6], #16 /* load 2nd round key */ ++ ld1 {v5.16b}, [x6], #16 /* load 2nd round key */ + 3: aese v0.16b, v4.16b + aesmc v0.16b, v0.16b +-4: ld1 {v3.2d}, [x6], #16 /* load next round key */ ++4: ld1 {v3.16b}, [x6], #16 /* load next round key */ + aese v0.16b, v5.16b + aesmc v0.16b, v0.16b +-5: ld1 {v4.2d}, [x6], #16 /* load next round key */ ++5: ld1 {v4.16b}, [x6], #16 /* load next round key */ + subs w7, w7, #3 + aese v0.16b, v3.16b + aesmc v0.16b, v0.16b +- ld1 {v5.2d}, [x6], #16 /* load next round key */ ++ ld1 {v5.16b}, [x6], #16 /* load next round key */ + bpl 3b + aese v0.16b, v4.16b + subs w2, w2, #16 /* last data? */ +@@ -60,7 +61,7 @@ ENTRY(ce_aes_ccm_auth_data) + ld1 {v1.16b}, [x1], #16 /* load next input block */ + eor v0.16b, v0.16b, v1.16b /* xor with mac */ + bne 1b +-6: st1 {v0.2d}, [x0] /* store mac */ ++6: st1 {v0.16b}, [x0] /* store mac */ + beq 10f + adds w2, w2, #16 + beq 10f +@@ -79,7 +80,7 @@ ENTRY(ce_aes_ccm_auth_data) + adds w7, w7, #1 + bne 9b + eor v0.16b, v0.16b, v1.16b +- st1 {v0.2d}, [x0] ++ st1 {v0.16b}, [x0] + 10: str w8, [x3] + ret + ENDPROC(ce_aes_ccm_auth_data) +@@ -89,27 +90,27 @@ ENDPROC(ce_aes_ccm_auth_data) + * u32 rounds); + */ + ENTRY(ce_aes_ccm_final) +- ld1 {v3.2d}, [x2], #16 /* load first round key */ +- ld1 {v0.2d}, [x0] /* load mac */ ++ ld1 {v3.16b}, [x2], #16 /* load first round key */ ++ ld1 {v0.16b}, [x0] /* load mac */ + cmp w3, #12 /* which key size? */ + sub w3, w3, #2 /* modified # of rounds */ +- ld1 {v1.2d}, [x1] /* load 1st ctriv */ ++ ld1 {v1.16b}, [x1] /* load 1st ctriv */ + bmi 0f + bne 3f + mov v5.16b, v3.16b + b 2f + 0: mov v4.16b, v3.16b +-1: ld1 {v5.2d}, [x2], #16 /* load next round key */ ++1: ld1 {v5.16b}, [x2], #16 /* load next round key */ + aese v0.16b, v4.16b + aesmc v0.16b, v0.16b + aese v1.16b, v4.16b + aesmc v1.16b, v1.16b +-2: ld1 {v3.2d}, [x2], #16 /* load next round key */ ++2: ld1 {v3.16b}, [x2], #16 /* load next round key */ + aese v0.16b, v5.16b + aesmc v0.16b, v0.16b + aese v1.16b, v5.16b + aesmc v1.16b, v1.16b +-3: ld1 {v4.2d}, [x2], #16 /* load next round key */ ++3: ld1 {v4.16b}, [x2], #16 /* load next round key */ + subs w3, w3, #3 + aese v0.16b, v3.16b + aesmc v0.16b, v0.16b +@@ -120,47 +121,47 @@ ENTRY(ce_aes_ccm_final) + aese v1.16b, v4.16b + /* final round key cancels out */ + eor v0.16b, v0.16b, v1.16b /* en-/decrypt the mac */ +- st1 {v0.2d}, [x0] /* store result */ ++ st1 {v0.16b}, [x0] /* store result */ + ret + ENDPROC(ce_aes_ccm_final) + + .macro aes_ccm_do_crypt,enc + ldr x8, [x6, #8] /* load lower ctr */ +- ld1 {v0.2d}, [x5] /* load mac */ +- rev x8, x8 /* keep swabbed ctr in reg */ ++ ld1 {v0.16b}, [x5] /* load mac */ ++CPU_LE( rev x8, x8 ) /* keep swabbed ctr in reg */ + 0: /* outer loop */ +- ld1 {v1.1d}, [x6] /* load upper ctr */ ++ ld1 {v1.8b}, [x6] /* load upper ctr */ + prfm pldl1strm, [x1] + add x8, x8, #1 + rev x9, x8 + cmp w4, #12 /* which key size? */ + sub w7, w4, #2 /* get modified # of rounds */ + ins v1.d[1], x9 /* no carry in lower ctr */ +- ld1 {v3.2d}, [x3] /* load first round key */ ++ ld1 {v3.16b}, [x3] /* load first round key */ + add x10, x3, #16 + bmi 1f + bne 4f + mov v5.16b, v3.16b + b 3f + 1: mov v4.16b, v3.16b +- ld1 {v5.2d}, [x10], #16 /* load 2nd round key */ ++ ld1 {v5.16b}, [x10], #16 /* load 2nd round key */ + 2: /* inner loop: 3 rounds, 2x interleaved */ + aese v0.16b, v4.16b + aesmc v0.16b, v0.16b + aese v1.16b, v4.16b + aesmc v1.16b, v1.16b +-3: ld1 {v3.2d}, [x10], #16 /* load next round key */ ++3: ld1 {v3.16b}, [x10], #16 /* load next round key */ + aese v0.16b, v5.16b + aesmc v0.16b, v0.16b + aese v1.16b, v5.16b + aesmc v1.16b, v1.16b +-4: ld1 {v4.2d}, [x10], #16 /* load next round key */ ++4: ld1 {v4.16b}, [x10], #16 /* load next round key */ + subs w7, w7, #3 + aese v0.16b, v3.16b + aesmc v0.16b, v0.16b + aese v1.16b, v3.16b + aesmc v1.16b, v1.16b +- ld1 {v5.2d}, [x10], #16 /* load next round key */ ++ ld1 {v5.16b}, [x10], #16 /* load next round key */ + bpl 2b + aese v0.16b, v4.16b + aese v1.16b, v4.16b +@@ -177,14 +178,14 @@ ENDPROC(ce_aes_ccm_final) + eor v0.16b, v0.16b, v2.16b /* xor mac with pt ^ rk[last] */ + st1 {v1.16b}, [x0], #16 /* write output block */ + bne 0b +- rev x8, x8 +- st1 {v0.2d}, [x5] /* store mac */ ++CPU_LE( rev x8, x8 ) ++ st1 {v0.16b}, [x5] /* store mac */ + str x8, [x6, #8] /* store lsb end of ctr (BE) */ + 5: ret + + 6: eor v0.16b, v0.16b, v5.16b /* final round mac */ + eor v1.16b, v1.16b, v5.16b /* final round enc */ +- st1 {v0.2d}, [x5] /* store mac */ ++ st1 {v0.16b}, [x5] /* store mac */ + add w2, w2, #16 /* process partial tail block */ + 7: ldrb w9, [x1], #1 /* get 1 byte of input */ + umov w6, v1.b[0] /* get top crypted ctr byte */ diff --git a/queue-4.9/crypto-arm64-aes-ce-fix-for-big-endian.patch b/queue-4.9/crypto-arm64-aes-ce-fix-for-big-endian.patch new file mode 100644 index 00000000000..21c33d468d6 --- /dev/null +++ b/queue-4.9/crypto-arm64-aes-ce-fix-for-big-endian.patch @@ -0,0 +1,100 @@ +From 1803b9a52c4e5a5dbb8a27126f6bc06939359753 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Tue, 11 Oct 2016 19:15:13 +0100 +Subject: crypto: arm64/aes-ce - fix for big endian + +From: Ard Biesheuvel + +commit 1803b9a52c4e5a5dbb8a27126f6bc06939359753 upstream. + +The core AES cipher implementation that uses ARMv8 Crypto Extensions +instructions erroneously loads the round keys as 64-bit quantities, +which causes the algorithm to fail when built for big endian. In +addition, the key schedule generation routine fails to take endianness +into account as well, when loading the combining the input key with +the round constants. So fix both issues. + +Fixes: 12ac3efe74f8 ("arm64/crypto: use crypto instructions to generate AES key schedule") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/crypto/aes-ce-cipher.c | 25 +++++++++++++++---------- + 1 file changed, 15 insertions(+), 10 deletions(-) + +--- a/arch/arm64/crypto/aes-ce-cipher.c ++++ b/arch/arm64/crypto/aes-ce-cipher.c +@@ -47,24 +47,24 @@ static void aes_cipher_encrypt(struct cr + kernel_neon_begin_partial(4); + + __asm__(" ld1 {v0.16b}, %[in] ;" +- " ld1 {v1.2d}, [%[key]], #16 ;" ++ " ld1 {v1.16b}, [%[key]], #16 ;" + " cmp %w[rounds], #10 ;" + " bmi 0f ;" + " bne 3f ;" + " mov v3.16b, v1.16b ;" + " b 2f ;" + "0: mov v2.16b, v1.16b ;" +- " ld1 {v3.2d}, [%[key]], #16 ;" ++ " ld1 {v3.16b}, [%[key]], #16 ;" + "1: aese v0.16b, v2.16b ;" + " aesmc v0.16b, v0.16b ;" +- "2: ld1 {v1.2d}, [%[key]], #16 ;" ++ "2: ld1 {v1.16b}, [%[key]], #16 ;" + " aese v0.16b, v3.16b ;" + " aesmc v0.16b, v0.16b ;" +- "3: ld1 {v2.2d}, [%[key]], #16 ;" ++ "3: ld1 {v2.16b}, [%[key]], #16 ;" + " subs %w[rounds], %w[rounds], #3 ;" + " aese v0.16b, v1.16b ;" + " aesmc v0.16b, v0.16b ;" +- " ld1 {v3.2d}, [%[key]], #16 ;" ++ " ld1 {v3.16b}, [%[key]], #16 ;" + " bpl 1b ;" + " aese v0.16b, v2.16b ;" + " eor v0.16b, v0.16b, v3.16b ;" +@@ -92,24 +92,24 @@ static void aes_cipher_decrypt(struct cr + kernel_neon_begin_partial(4); + + __asm__(" ld1 {v0.16b}, %[in] ;" +- " ld1 {v1.2d}, [%[key]], #16 ;" ++ " ld1 {v1.16b}, [%[key]], #16 ;" + " cmp %w[rounds], #10 ;" + " bmi 0f ;" + " bne 3f ;" + " mov v3.16b, v1.16b ;" + " b 2f ;" + "0: mov v2.16b, v1.16b ;" +- " ld1 {v3.2d}, [%[key]], #16 ;" ++ " ld1 {v3.16b}, [%[key]], #16 ;" + "1: aesd v0.16b, v2.16b ;" + " aesimc v0.16b, v0.16b ;" +- "2: ld1 {v1.2d}, [%[key]], #16 ;" ++ "2: ld1 {v1.16b}, [%[key]], #16 ;" + " aesd v0.16b, v3.16b ;" + " aesimc v0.16b, v0.16b ;" +- "3: ld1 {v2.2d}, [%[key]], #16 ;" ++ "3: ld1 {v2.16b}, [%[key]], #16 ;" + " subs %w[rounds], %w[rounds], #3 ;" + " aesd v0.16b, v1.16b ;" + " aesimc v0.16b, v0.16b ;" +- " ld1 {v3.2d}, [%[key]], #16 ;" ++ " ld1 {v3.16b}, [%[key]], #16 ;" + " bpl 1b ;" + " aesd v0.16b, v2.16b ;" + " eor v0.16b, v0.16b, v3.16b ;" +@@ -173,7 +173,12 @@ int ce_aes_expandkey(struct crypto_aes_c + u32 *rki = ctx->key_enc + (i * kwords); + u32 *rko = rki + kwords; + ++#ifndef CONFIG_CPU_BIG_ENDIAN + rko[0] = ror32(aes_sub(rki[kwords - 1]), 8) ^ rcon[i] ^ rki[0]; ++#else ++ rko[0] = rol32(aes_sub(rki[kwords - 1]), 8) ^ (rcon[i] << 24) ^ ++ rki[0]; ++#endif + rko[1] = rko[0] ^ rki[1]; + rko[2] = rko[1] ^ rki[2]; + rko[3] = rko[2] ^ rki[3]; diff --git a/queue-4.9/crypto-arm64-aes-neon-fix-for-big-endian.patch b/queue-4.9/crypto-arm64-aes-neon-fix-for-big-endian.patch new file mode 100644 index 00000000000..dc53eb5dacc --- /dev/null +++ b/queue-4.9/crypto-arm64-aes-neon-fix-for-big-endian.patch @@ -0,0 +1,109 @@ +From a2c435cc99862fd3d165e1b66bf48ac72c839c62 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Tue, 11 Oct 2016 19:15:18 +0100 +Subject: crypto: arm64/aes-neon - fix for big endian + +From: Ard Biesheuvel + +commit a2c435cc99862fd3d165e1b66bf48ac72c839c62 upstream. + +The AES implementation using pure NEON instructions relies on the generic +AES key schedule generation routines, which store the round keys as arrays +of 32-bit quantities stored in memory using native endianness. This means +we should refer to these round keys using 4x4 loads rather than 16x1 loads. +In addition, the ShiftRows tables are loading using a single scalar load, +which is also affected by endianness, so emit these tables in the correct +order depending on whether we are building for big endian or not. + +Fixes: 49788fe2a128 ("arm64/crypto: AES-ECB/CBC/CTR/XTS using ARMv8 NEON and Crypto Extensions") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/crypto/aes-neon.S | 25 +++++++++++++++---------- + 1 file changed, 15 insertions(+), 10 deletions(-) + +--- a/arch/arm64/crypto/aes-neon.S ++++ b/arch/arm64/crypto/aes-neon.S +@@ -9,6 +9,7 @@ + */ + + #include ++#include + + #define AES_ENTRY(func) ENTRY(neon_ ## func) + #define AES_ENDPROC(func) ENDPROC(neon_ ## func) +@@ -83,13 +84,13 @@ + .endm + + .macro do_block, enc, in, rounds, rk, rkp, i +- ld1 {v15.16b}, [\rk] ++ ld1 {v15.4s}, [\rk] + add \rkp, \rk, #16 + mov \i, \rounds + 1111: eor \in\().16b, \in\().16b, v15.16b /* ^round key */ + tbl \in\().16b, {\in\().16b}, v13.16b /* ShiftRows */ + sub_bytes \in +- ld1 {v15.16b}, [\rkp], #16 ++ ld1 {v15.4s}, [\rkp], #16 + subs \i, \i, #1 + beq 2222f + .if \enc == 1 +@@ -229,7 +230,7 @@ + .endm + + .macro do_block_2x, enc, in0, in1 rounds, rk, rkp, i +- ld1 {v15.16b}, [\rk] ++ ld1 {v15.4s}, [\rk] + add \rkp, \rk, #16 + mov \i, \rounds + 1111: eor \in0\().16b, \in0\().16b, v15.16b /* ^round key */ +@@ -237,7 +238,7 @@ + sub_bytes_2x \in0, \in1 + tbl \in0\().16b, {\in0\().16b}, v13.16b /* ShiftRows */ + tbl \in1\().16b, {\in1\().16b}, v13.16b /* ShiftRows */ +- ld1 {v15.16b}, [\rkp], #16 ++ ld1 {v15.4s}, [\rkp], #16 + subs \i, \i, #1 + beq 2222f + .if \enc == 1 +@@ -254,7 +255,7 @@ + .endm + + .macro do_block_4x, enc, in0, in1, in2, in3, rounds, rk, rkp, i +- ld1 {v15.16b}, [\rk] ++ ld1 {v15.4s}, [\rk] + add \rkp, \rk, #16 + mov \i, \rounds + 1111: eor \in0\().16b, \in0\().16b, v15.16b /* ^round key */ +@@ -266,7 +267,7 @@ + tbl \in1\().16b, {\in1\().16b}, v13.16b /* ShiftRows */ + tbl \in2\().16b, {\in2\().16b}, v13.16b /* ShiftRows */ + tbl \in3\().16b, {\in3\().16b}, v13.16b /* ShiftRows */ +- ld1 {v15.16b}, [\rkp], #16 ++ ld1 {v15.4s}, [\rkp], #16 + subs \i, \i, #1 + beq 2222f + .if \enc == 1 +@@ -306,12 +307,16 @@ + .text + .align 4 + .LForward_ShiftRows: +- .byte 0x0, 0x5, 0xa, 0xf, 0x4, 0x9, 0xe, 0x3 +- .byte 0x8, 0xd, 0x2, 0x7, 0xc, 0x1, 0x6, 0xb ++CPU_LE( .byte 0x0, 0x5, 0xa, 0xf, 0x4, 0x9, 0xe, 0x3 ) ++CPU_LE( .byte 0x8, 0xd, 0x2, 0x7, 0xc, 0x1, 0x6, 0xb ) ++CPU_BE( .byte 0xb, 0x6, 0x1, 0xc, 0x7, 0x2, 0xd, 0x8 ) ++CPU_BE( .byte 0x3, 0xe, 0x9, 0x4, 0xf, 0xa, 0x5, 0x0 ) + + .LReverse_ShiftRows: +- .byte 0x0, 0xd, 0xa, 0x7, 0x4, 0x1, 0xe, 0xb +- .byte 0x8, 0x5, 0x2, 0xf, 0xc, 0x9, 0x6, 0x3 ++CPU_LE( .byte 0x0, 0xd, 0xa, 0x7, 0x4, 0x1, 0xe, 0xb ) ++CPU_LE( .byte 0x8, 0x5, 0x2, 0xf, 0xc, 0x9, 0x6, 0x3 ) ++CPU_BE( .byte 0x3, 0x6, 0x9, 0xc, 0xf, 0x2, 0x5, 0x8 ) ++CPU_BE( .byte 0xb, 0xe, 0x1, 0x4, 0x7, 0xa, 0xd, 0x0 ) + + .LForward_Sbox: + .byte 0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5 diff --git a/queue-4.9/crypto-arm64-aes-xts-ce-fix-for-big-endian.patch b/queue-4.9/crypto-arm64-aes-xts-ce-fix-for-big-endian.patch new file mode 100644 index 00000000000..c9f659588e2 --- /dev/null +++ b/queue-4.9/crypto-arm64-aes-xts-ce-fix-for-big-endian.patch @@ -0,0 +1,44 @@ +From caf4b9e2b326cc2a5005a5c557274306536ace61 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Tue, 11 Oct 2016 19:15:19 +0100 +Subject: crypto: arm64/aes-xts-ce: fix for big endian + +From: Ard Biesheuvel + +commit caf4b9e2b326cc2a5005a5c557274306536ace61 upstream. + +Emit the XTS tweak literal constants in the appropriate order for a +single 128-bit scalar literal load. + +Fixes: 49788fe2a128 ("arm64/crypto: AES-ECB/CBC/CTR/XTS using ARMv8 NEON and Crypto Extensions") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/crypto/aes-ce.S | 1 + + arch/arm64/crypto/aes-modes.S | 3 ++- + 2 files changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/arm64/crypto/aes-ce.S ++++ b/arch/arm64/crypto/aes-ce.S +@@ -10,6 +10,7 @@ + */ + + #include ++#include + + #define AES_ENTRY(func) ENTRY(ce_ ## func) + #define AES_ENDPROC(func) ENDPROC(ce_ ## func) +--- a/arch/arm64/crypto/aes-modes.S ++++ b/arch/arm64/crypto/aes-modes.S +@@ -386,7 +386,8 @@ AES_ENDPROC(aes_ctr_encrypt) + .endm + + .Lxts_mul_x: +- .word 1, 0, 0x87, 0 ++CPU_LE( .quad 1, 0x87 ) ++CPU_BE( .quad 0x87, 1 ) + + AES_ENTRY(aes_xts_encrypt) + FRAME_PUSH diff --git a/queue-4.9/crypto-arm64-ghash-ce-fix-for-big-endian.patch b/queue-4.9/crypto-arm64-ghash-ce-fix-for-big-endian.patch new file mode 100644 index 00000000000..16ed1c6198c --- /dev/null +++ b/queue-4.9/crypto-arm64-ghash-ce-fix-for-big-endian.patch @@ -0,0 +1,43 @@ +From 9c433ad5083fd4a4a3c721d86cbfbd0b2a2326a5 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Tue, 11 Oct 2016 19:15:14 +0100 +Subject: crypto: arm64/ghash-ce - fix for big endian + +From: Ard Biesheuvel + +commit 9c433ad5083fd4a4a3c721d86cbfbd0b2a2326a5 upstream. + +The GHASH key and digest are both pairs of 64-bit quantities, but the +GHASH code does not always refer to them as such, causing failures when +built for big endian. So replace the 16x1 loads and stores with 2x8 ones. + +Fixes: b913a6404ce2 ("arm64/crypto: improve performance of GHASH algorithm") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/crypto/ghash-ce-core.S | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/arm64/crypto/ghash-ce-core.S ++++ b/arch/arm64/crypto/ghash-ce-core.S +@@ -29,8 +29,8 @@ + * struct ghash_key const *k, const char *head) + */ + ENTRY(pmull_ghash_update) +- ld1 {SHASH.16b}, [x3] +- ld1 {XL.16b}, [x1] ++ ld1 {SHASH.2d}, [x3] ++ ld1 {XL.2d}, [x1] + movi MASK.16b, #0xe1 + ext SHASH2.16b, SHASH.16b, SHASH.16b, #8 + shl MASK.2d, MASK.2d, #57 +@@ -74,6 +74,6 @@ CPU_LE( rev64 T1.16b, T1.16b ) + + cbnz w0, 0b + +- st1 {XL.16b}, [x1] ++ st1 {XL.2d}, [x1] + ret + ENDPROC(pmull_ghash_update) diff --git a/queue-4.9/crypto-arm64-sha1-ce-fix-for-big-endian.patch b/queue-4.9/crypto-arm64-sha1-ce-fix-for-big-endian.patch new file mode 100644 index 00000000000..871067266a1 --- /dev/null +++ b/queue-4.9/crypto-arm64-sha1-ce-fix-for-big-endian.patch @@ -0,0 +1,43 @@ +From ee71e5f1e7d25543ee63a80451871f8985b8d431 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Tue, 11 Oct 2016 19:15:15 +0100 +Subject: crypto: arm64/sha1-ce - fix for big endian + +From: Ard Biesheuvel + +commit ee71e5f1e7d25543ee63a80451871f8985b8d431 upstream. + +The SHA1 digest is an array of 5 32-bit quantities, so we should refer +to them as such in order for this code to work correctly when built for +big endian. So replace 16 byte scalar loads and stores with 4x4 vector +ones where appropriate. + +Fixes: 2c98833a42cd ("arm64/crypto: SHA-1 using ARMv8 Crypto Extensions") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/crypto/sha1-ce-core.S | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/crypto/sha1-ce-core.S ++++ b/arch/arm64/crypto/sha1-ce-core.S +@@ -78,7 +78,7 @@ ENTRY(sha1_ce_transform) + ld1r {k3.4s}, [x6] + + /* load state */ +- ldr dga, [x0] ++ ld1 {dgav.4s}, [x0] + ldr dgb, [x0, #16] + + /* load sha1_ce_state::finalize */ +@@ -144,7 +144,7 @@ CPU_LE( rev32 v11.16b, v11.16b ) + b 1b + + /* store new state */ +-3: str dga, [x0] ++3: st1 {dgav.4s}, [x0] + str dgb, [x0, #16] + ret + ENDPROC(sha1_ce_transform) diff --git a/queue-4.9/crypto-arm64-sha2-ce-fix-for-big-endian.patch b/queue-4.9/crypto-arm64-sha2-ce-fix-for-big-endian.patch new file mode 100644 index 00000000000..eaa8469277a --- /dev/null +++ b/queue-4.9/crypto-arm64-sha2-ce-fix-for-big-endian.patch @@ -0,0 +1,42 @@ +From 174122c39c369ed924d2608fc0be0171997ce800 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Tue, 11 Oct 2016 19:15:16 +0100 +Subject: crypto: arm64/sha2-ce - fix for big endian + +From: Ard Biesheuvel + +commit 174122c39c369ed924d2608fc0be0171997ce800 upstream. + +The SHA256 digest is an array of 8 32-bit quantities, so we should refer +to them as such in order for this code to work correctly when built for +big endian. So replace 16 byte scalar loads and stores with 4x32 vector +ones where appropriate. + +Fixes: 6ba6c74dfc6b ("arm64/crypto: SHA-224/SHA-256 using ARMv8 Crypto Extensions") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/crypto/sha2-ce-core.S | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/crypto/sha2-ce-core.S ++++ b/arch/arm64/crypto/sha2-ce-core.S +@@ -85,7 +85,7 @@ ENTRY(sha2_ce_transform) + ld1 {v12.4s-v15.4s}, [x8] + + /* load state */ +- ldp dga, dgb, [x0] ++ ld1 {dgav.4s, dgbv.4s}, [x0] + + /* load sha256_ce_state::finalize */ + ldr w4, [x0, #:lo12:sha256_ce_offsetof_finalize] +@@ -148,6 +148,6 @@ CPU_LE( rev32 v19.16b, v19.16b ) + b 1b + + /* store new state */ +-3: stp dga, dgb, [x0] ++3: st1 {dgav.4s, dgbv.4s}, [x0] + ret + ENDPROC(sha2_ce_transform) diff --git a/queue-4.9/docs-rst-fix-latex-durole-renewcommand-with-sphinx-1.3.patch b/queue-4.9/docs-rst-fix-latex-durole-renewcommand-with-sphinx-1.3.patch new file mode 100644 index 00000000000..3877fe48960 --- /dev/null +++ b/queue-4.9/docs-rst-fix-latex-durole-renewcommand-with-sphinx-1.3.patch @@ -0,0 +1,67 @@ +From e2a91f4f42018994d7424d405900d17eba6555d0 Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Mon, 14 Nov 2016 14:32:27 -0200 +Subject: docs-rst: fix LaTeX \DURole renewcommand with Sphinx 1.3+ + +From: Mauro Carvalho Chehab + +commit e2a91f4f42018994d7424d405900d17eba6555d0 upstream. + +PDF build on Kernel 4.9-rc? returns an error with Sphinx 1.3.x +and Sphinx 1.4.x, when trying to solve some cross-references. + +The solution is to redefine the \DURole macro. + +However, this is redefined too late. Move such redefinition to +LaTeX preamble and bind it to just the Sphinx versions where the +error is known to be present. + +Tested by building the documentation on interactive mode: + make PDFLATEX=xelatex -C Documentation/output/./latex + +Fixes: e61a39baf74d ("[media] index.rst: Fix LaTeX error in interactive mode on Sphinx 1.4.x") +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Jonathan Corbet +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/conf.py | 6 +++++- + Documentation/media/index.rst | 5 ----- + 2 files changed, 5 insertions(+), 6 deletions(-) + +--- a/Documentation/conf.py ++++ b/Documentation/conf.py +@@ -37,7 +37,7 @@ from load_config import loadConfig + extensions = ['kernel-doc', 'rstFlatTable', 'kernel_include', 'cdomain'] + + # The name of the math extension changed on Sphinx 1.4 +-if minor > 3: ++if major == 1 and minor > 3: + extensions.append("sphinx.ext.imgmath") + else: + extensions.append("sphinx.ext.pngmath") +@@ -332,6 +332,10 @@ latex_elements = { + ''' + } + ++# Fix reference escape troubles with Sphinx 1.4.x ++if major == 1 and minor > 3: ++ latex_elements['preamble'] += '\\renewcommand*{\\DUrole}[2]{ #2 }\n' ++ + # Grouping the document tree into LaTeX files. List of tuples + # (source start file, target name, title, + # author, documentclass [howto, manual, or own class]). +--- a/Documentation/media/index.rst ++++ b/Documentation/media/index.rst +@@ -1,11 +1,6 @@ + Linux Media Subsystem Documentation + =================================== + +-.. Sphinx 1.4.x has a definition for DUrole that doesn't work on alltt blocks +-.. raw:: latex +- +- \renewcommand*{\DUrole}[2]{ #2 } +- + Contents: + + .. toctree:: diff --git a/queue-4.9/f2fs-hide-a-maybe-uninitialized-warning.patch b/queue-4.9/f2fs-hide-a-maybe-uninitialized-warning.patch new file mode 100644 index 00000000000..faae9ae1185 --- /dev/null +++ b/queue-4.9/f2fs-hide-a-maybe-uninitialized-warning.patch @@ -0,0 +1,50 @@ +From 230436b3ef3fd7d4a1da19edf5e87bb2d74e0fc2 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Wed, 2 Nov 2016 14:52:15 +0100 +Subject: f2fs: hide a maybe-uninitialized warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnd Bergmann + +commit 230436b3ef3fd7d4a1da19edf5e87bb2d74e0fc2 upstream. + +gcc is unsure about the use of last_ofs_in_node, which might happen +without a prior initialization: + +fs/f2fs//git/arm-soc/fs/f2fs/data.c: In function ‘f2fs_map_blocks’: +fs/f2fs/data.c:799:54: warning: ‘last_ofs_in_node’ may be used uninitialized in this function [-Wmaybe-uninitialized] + if (prealloc && dn.ofs_in_node != last_ofs_in_node + 1) { + +As pointed out by Chao Yu, the code is actually correct as 'prealloc' +is only set if the last_ofs_in_node has been set, the two always +get updated together. + +This initializes last_ofs_in_node to dn.ofs_in_node for each +new dnode at the start of the 'next_block' loop, which at that +point is a correct initialization as well. I assume that compilers +that correctly track the contents of the variables and do not +warn about the condition also figure out that they can eliminate +the extra assignment here. + +Fixes: 46008c6d4232 ("f2fs: support in batch multi blocks preallocation") +Signed-off-by: Arnd Bergmann +Signed-off-by: Jaegeuk Kim +Signed-off-by: Greg Kroah-Hartman + +--- + fs/f2fs/data.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -716,7 +716,7 @@ next_dnode: + } + + prealloc = 0; +- ofs_in_node = dn.ofs_in_node; ++ last_ofs_in_node = ofs_in_node = dn.ofs_in_node; + end_offset = ADDRS_PER_PAGE(dn.node_page, inode); + + next_block: diff --git a/queue-4.9/f2fs-remove-percpu_count-due-to-performance-regression.patch b/queue-4.9/f2fs-remove-percpu_count-due-to-performance-regression.patch new file mode 100644 index 00000000000..776d41a5d63 --- /dev/null +++ b/queue-4.9/f2fs-remove-percpu_count-due-to-performance-regression.patch @@ -0,0 +1,142 @@ +From 35782b233f37e48ecc469d9c7232f3f6a7fad41a Mon Sep 17 00:00:00 2001 +From: Jaegeuk Kim +Date: Thu, 20 Oct 2016 19:09:57 -0700 +Subject: f2fs: remove percpu_count due to performance regression + +From: Jaegeuk Kim + +commit 35782b233f37e48ecc469d9c7232f3f6a7fad41a upstream. + +This patch removes percpu_count usage due to performance regression in iozone. + +Fixes: 523be8a6b3 ("f2fs: use percpu_counter for page counters") +Signed-off-by: Jaegeuk Kim +Signed-off-by: Greg Kroah-Hartman + +--- + fs/f2fs/debug.c | 12 ++++++------ + fs/f2fs/f2fs.h | 12 ++++++------ + fs/f2fs/super.c | 16 +++++----------- + 3 files changed, 17 insertions(+), 23 deletions(-) + +--- a/fs/f2fs/debug.c ++++ b/fs/f2fs/debug.c +@@ -310,17 +310,17 @@ static int stat_show(struct seq_file *s, + seq_printf(s, " - Inner Struct Count: tree: %d(%d), node: %d\n", + si->ext_tree, si->zombie_tree, si->ext_node); + seq_puts(s, "\nBalancing F2FS Async:\n"); +- seq_printf(s, " - inmem: %4lld, wb_bios: %4d\n", ++ seq_printf(s, " - inmem: %4d, wb_bios: %4d\n", + si->inmem_pages, si->wb_bios); +- seq_printf(s, " - nodes: %4lld in %4d\n", ++ seq_printf(s, " - nodes: %4d in %4d\n", + si->ndirty_node, si->node_pages); +- seq_printf(s, " - dents: %4lld in dirs:%4d (%4d)\n", ++ seq_printf(s, " - dents: %4d in dirs:%4d (%4d)\n", + si->ndirty_dent, si->ndirty_dirs, si->ndirty_all); +- seq_printf(s, " - datas: %4lld in files:%4d\n", ++ seq_printf(s, " - datas: %4d in files:%4d\n", + si->ndirty_data, si->ndirty_files); +- seq_printf(s, " - meta: %4lld in %4d\n", ++ seq_printf(s, " - meta: %4d in %4d\n", + si->ndirty_meta, si->meta_pages); +- seq_printf(s, " - imeta: %4lld\n", ++ seq_printf(s, " - imeta: %4d\n", + si->ndirty_imeta); + seq_printf(s, " - NATs: %9d/%9d\n - SITs: %9d/%9d\n", + si->dirty_nats, si->nats, si->dirty_sits, si->sits); +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -819,7 +819,7 @@ struct f2fs_sb_info { + atomic_t nr_wb_bios; /* # of writeback bios */ + + /* # of pages, see count_type */ +- struct percpu_counter nr_pages[NR_COUNT_TYPE]; ++ atomic_t nr_pages[NR_COUNT_TYPE]; + /* # of allocated blocks */ + struct percpu_counter alloc_valid_block_count; + +@@ -1233,7 +1233,7 @@ static inline void dec_valid_block_count + + static inline void inc_page_count(struct f2fs_sb_info *sbi, int count_type) + { +- percpu_counter_inc(&sbi->nr_pages[count_type]); ++ atomic_inc(&sbi->nr_pages[count_type]); + + if (count_type == F2FS_DIRTY_DATA || count_type == F2FS_INMEM_PAGES) + return; +@@ -1250,7 +1250,7 @@ static inline void inode_inc_dirty_pages + + static inline void dec_page_count(struct f2fs_sb_info *sbi, int count_type) + { +- percpu_counter_dec(&sbi->nr_pages[count_type]); ++ atomic_dec(&sbi->nr_pages[count_type]); + } + + static inline void inode_dec_dirty_pages(struct inode *inode) +@@ -1266,7 +1266,7 @@ static inline void inode_dec_dirty_pages + + static inline s64 get_pages(struct f2fs_sb_info *sbi, int count_type) + { +- return percpu_counter_sum_positive(&sbi->nr_pages[count_type]); ++ return atomic_read(&sbi->nr_pages[count_type]); + } + + static inline int get_dirty_pages(struct inode *inode) +@@ -2187,8 +2187,8 @@ struct f2fs_stat_info { + unsigned long long hit_largest, hit_cached, hit_rbtree; + unsigned long long hit_total, total_ext; + int ext_tree, zombie_tree, ext_node; +- s64 ndirty_node, ndirty_dent, ndirty_meta, ndirty_data, ndirty_imeta; +- s64 inmem_pages; ++ int ndirty_node, ndirty_dent, ndirty_meta, ndirty_data, ndirty_imeta; ++ int inmem_pages; + unsigned int ndirty_dirs, ndirty_files, ndirty_all; + int nats, dirty_nats, sits, dirty_sits, fnids; + int total_count, utilization; +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -688,10 +688,6 @@ static void f2fs_destroy_inode(struct in + + static void destroy_percpu_info(struct f2fs_sb_info *sbi) + { +- int i; +- +- for (i = 0; i < NR_COUNT_TYPE; i++) +- percpu_counter_destroy(&sbi->nr_pages[i]); + percpu_counter_destroy(&sbi->alloc_valid_block_count); + percpu_counter_destroy(&sbi->total_valid_inode_count); + } +@@ -1442,6 +1438,7 @@ int sanity_check_ckpt(struct f2fs_sb_inf + static void init_sb_info(struct f2fs_sb_info *sbi) + { + struct f2fs_super_block *raw_super = sbi->raw_super; ++ int i; + + sbi->log_sectors_per_block = + le32_to_cpu(raw_super->log_sectors_per_block); +@@ -1466,6 +1463,9 @@ static void init_sb_info(struct f2fs_sb_ + sbi->interval_time[REQ_TIME] = DEF_IDLE_INTERVAL; + clear_sbi_flag(sbi, SBI_NEED_FSCK); + ++ for (i = 0; i < NR_COUNT_TYPE; i++) ++ atomic_set(&sbi->nr_pages[i], 0); ++ + INIT_LIST_HEAD(&sbi->s_list); + mutex_init(&sbi->umount_mutex); + mutex_init(&sbi->wio_mutex[NODE]); +@@ -1481,13 +1481,7 @@ static void init_sb_info(struct f2fs_sb_ + + static int init_percpu_info(struct f2fs_sb_info *sbi) + { +- int i, err; +- +- for (i = 0; i < NR_COUNT_TYPE; i++) { +- err = percpu_counter_init(&sbi->nr_pages[i], 0, GFP_KERNEL); +- if (err) +- return err; +- } ++ int err; + + err = percpu_counter_init(&sbi->alloc_valid_block_count, 0, GFP_KERNEL); + if (err) diff --git a/queue-4.9/genirq-affinity-fix-node-generation-from-cpumask.patch b/queue-4.9/genirq-affinity-fix-node-generation-from-cpumask.patch new file mode 100644 index 00000000000..5790365d378 --- /dev/null +++ b/queue-4.9/genirq-affinity-fix-node-generation-from-cpumask.patch @@ -0,0 +1,68 @@ +From c0af52437254fda8b0cdbaae5a9b6d9327f1fcd5 Mon Sep 17 00:00:00 2001 +From: "Guilherme G. Piccoli" +Date: Wed, 14 Dec 2016 16:01:12 -0200 +Subject: genirq/affinity: Fix node generation from cpumask + +From: Guilherme G. Piccoli + +commit c0af52437254fda8b0cdbaae5a9b6d9327f1fcd5 upstream. + +Commit 34c3d9819fda ("genirq/affinity: Provide smarter irq spreading +infrastructure") introduced a better IRQ spreading mechanism, taking +account of the available NUMA nodes in the machine. + +Problem is that the algorithm of retrieving the nodemask iterates +"linearly" based on the number of online nodes - some architectures +present non-linear node distribution among the nodemask, like PowerPC. +If this is the case, the algorithm lead to a wrong node count number +and therefore to a bad/incomplete IRQ affinity distribution. + +For example, this problem were found in a machine with 128 CPUs and two +nodes, namely nodes 0 and 8 (instead of 0 and 1, if it was linearly +distributed). This led to a wrong affinity distribution which then led to +a bad mq allocation for nvme driver. + +Finally, we take the opportunity to fix a comment regarding the affinity +distribution when we have _more_ nodes than vectors. + +Fixes: 34c3d9819fda ("genirq/affinity: Provide smarter irq spreading infrastructure") +Reported-by: Gabriel Krisman Bertazi +Signed-off-by: Guilherme G. Piccoli +Reviewed-by: Christoph Hellwig +Reviewed-by: Gabriel Krisman Bertazi +Reviewed-by: Gavin Shan +Cc: linux-pci@vger.kernel.org +Cc: linuxppc-dev@lists.ozlabs.org +Cc: hch@lst.de +Link: http://lkml.kernel.org/r/1481738472-2671-1-git-send-email-gpiccoli@linux.vnet.ibm.com +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/irq/affinity.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/kernel/irq/affinity.c ++++ b/kernel/irq/affinity.c +@@ -37,10 +37,10 @@ static void irq_spread_init_one(struct c + + static int get_nodes_in_cpumask(const struct cpumask *mask, nodemask_t *nodemsk) + { +- int n, nodes; ++ int n, nodes = 0; + + /* Calculate the number of nodes in the supplied affinity mask */ +- for (n = 0, nodes = 0; n < num_online_nodes(); n++) { ++ for_each_online_node(n) { + if (cpumask_intersects(mask, cpumask_of_node(n))) { + node_set(n, *nodemsk); + nodes++; +@@ -81,7 +81,7 @@ struct cpumask *irq_create_affinity_mask + nodes = get_nodes_in_cpumask(affinity, &nodemsk); + + /* +- * If the number of nodes in the mask is less than or equal the ++ * If the number of nodes in the mask is greater than or equal the + * number of vectors we just spread the vectors across the nodes. + */ + if (nvec <= nodes) { diff --git a/queue-4.9/hwmon-amc6821-sign-extension-temperature.patch b/queue-4.9/hwmon-amc6821-sign-extension-temperature.patch new file mode 100644 index 00000000000..5c02a61e0df --- /dev/null +++ b/queue-4.9/hwmon-amc6821-sign-extension-temperature.patch @@ -0,0 +1,37 @@ +From 4538bfbf2d9f1fc48c07ac0cc0ee58716fe7fe96 Mon Sep 17 00:00:00 2001 +From: Jared Bents +Date: Fri, 18 Nov 2016 22:20:38 -0600 +Subject: hwmon: (amc6821) sign extension temperature + +From: Jared Bents + +commit 4538bfbf2d9f1fc48c07ac0cc0ee58716fe7fe96 upstream. + +Converts the unsigned temperature values from the i2c read +to be sign extended as defined in the datasheet so that +negative temperatures are properly read. + +Fixes: 28e6274d8fa67 ("hwmon: (amc6821) Avoid forward declaration") +Signed-off-by: Jared Bents +Signed-off-by: Matt Weber +[groeck: Dropped unnecessary continuation line] +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/amc6821.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/hwmon/amc6821.c ++++ b/drivers/hwmon/amc6821.c +@@ -188,8 +188,8 @@ static struct amc6821_data *amc6821_upda + !data->valid) { + + for (i = 0; i < TEMP_IDX_LEN; i++) +- data->temp[i] = i2c_smbus_read_byte_data(client, +- temp_reg[i]); ++ data->temp[i] = (int8_t)i2c_smbus_read_byte_data( ++ client, temp_reg[i]); + + data->stat1 = i2c_smbus_read_byte_data(client, + AMC6821_REG_STAT1); diff --git a/queue-4.9/hwmon-ds620-fix-overflows-seen-when-writing-temperature-limits.patch b/queue-4.9/hwmon-ds620-fix-overflows-seen-when-writing-temperature-limits.patch new file mode 100644 index 00000000000..a3a869a1c14 --- /dev/null +++ b/queue-4.9/hwmon-ds620-fix-overflows-seen-when-writing-temperature-limits.patch @@ -0,0 +1,37 @@ +From e36ce99ee0815d7919a7b589bfb66f3de50b6bc7 Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Sun, 20 Nov 2016 10:37:39 -0800 +Subject: hwmon: (ds620) Fix overflows seen when writing temperature limits + +From: Guenter Roeck + +commit e36ce99ee0815d7919a7b589bfb66f3de50b6bc7 upstream. + +Module test reports: + +temp1_max: Suspected overflow: [160000 vs. 0] +temp1_min: Suspected overflow: [160000 vs. 0] + +This is seen because the values passed when writing temperature limits +are unbound. + +Reviewed-by: Jean Delvare +Fixes: 6099469805c2 ("hwmon: Support for Dallas Semiconductor DS620") +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/ds620.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/ds620.c ++++ b/drivers/hwmon/ds620.c +@@ -166,7 +166,7 @@ static ssize_t set_temp(struct device *d + if (res) + return res; + +- val = (val * 10 / 625) * 8; ++ val = (clamp_val(val, -128000, 128000) * 10 / 625) * 8; + + mutex_lock(&data->update_lock); + data->temp[attr->index] = val; diff --git a/queue-4.9/hwmon-g762-fix-overflows-and-crash-seen-when-writing-limit-attributes.patch b/queue-4.9/hwmon-g762-fix-overflows-and-crash-seen-when-writing-limit-attributes.patch new file mode 100644 index 00000000000..7766d2e3b5b --- /dev/null +++ b/queue-4.9/hwmon-g762-fix-overflows-and-crash-seen-when-writing-limit-attributes.patch @@ -0,0 +1,48 @@ +From 4fccd4a1e8944033bcd7693ea4e8fb478cd2059a Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Sun, 11 Dec 2016 13:27:42 -0800 +Subject: hwmon: (g762) Fix overflows and crash seen when writing limit attributes + +From: Guenter Roeck + +commit 4fccd4a1e8944033bcd7693ea4e8fb478cd2059a upstream. + +Fix overflows seen when writing into fan speed limit attributes. +Also fix crash due to division by zero, seen when certain very +large values (such as 2147483648, or 0x80000000) are written +into fan speed limit attributes. + +Fixes: 594fbe713bf60 ("Add support for GMT G762/G763 PWM fan controllers") +Cc: Arnaud Ebalard +Reviewed-by: Jean Delvare +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/g762.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/hwmon/g762.c ++++ b/drivers/hwmon/g762.c +@@ -193,14 +193,17 @@ static inline unsigned int rpm_from_cnt( + * Convert fan RPM value from sysfs into count value for fan controller + * register (FAN_SET_CNT). + */ +-static inline unsigned char cnt_from_rpm(u32 rpm, u32 clk_freq, u16 p, ++static inline unsigned char cnt_from_rpm(unsigned long rpm, u32 clk_freq, u16 p, + u8 clk_div, u8 gear_mult) + { +- if (!rpm) /* to stop the fan, set cnt to 255 */ ++ unsigned long f1 = clk_freq * 30 * gear_mult; ++ unsigned long f2 = p * clk_div; ++ ++ if (!rpm) /* to stop the fan, set cnt to 255 */ + return 0xff; + +- return clamp_val(((clk_freq * 30 * gear_mult) / (rpm * p * clk_div)), +- 0, 255); ++ rpm = clamp_val(rpm, f1 / (255 * f2), ULONG_MAX / f2); ++ return DIV_ROUND_CLOSEST(f1, rpm * f2); + } + + /* helper to grab and cache data, at most one time per second */ diff --git a/queue-4.9/hwmon-lm90-fix-temp1_max_alarm-attribute.patch b/queue-4.9/hwmon-lm90-fix-temp1_max_alarm-attribute.patch new file mode 100644 index 00000000000..d1004b16500 --- /dev/null +++ b/queue-4.9/hwmon-lm90-fix-temp1_max_alarm-attribute.patch @@ -0,0 +1,33 @@ +From e9572fdd13e299cfba03abbfd2786c84ac055249 Mon Sep 17 00:00:00 2001 +From: Michael Walle +Date: Mon, 2 Jan 2017 17:53:39 +0100 +Subject: hwmon: (lm90) fix temp1_max_alarm attribute + +From: Michael Walle + +commit e9572fdd13e299cfba03abbfd2786c84ac055249 upstream. + +Since commit commit eb1c8f4325d5 ("hwmon: (lm90) Convert to use new hwmon +registration API") the temp1_max_alarm and temp1_crit_alarm attributes are +mapped to the same alarm bit. Fix the typo. + +Fixes: eb1c8f4325d5 ("hwmon: (lm90) Convert to use new hwmon registration API") +Signed-off-by: Micehael Walle +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/lm90.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/lm90.c ++++ b/drivers/hwmon/lm90.c +@@ -1036,7 +1036,7 @@ static const u8 lm90_temp_emerg_index[3] + }; + + static const u8 lm90_min_alarm_bits[3] = { 5, 3, 11 }; +-static const u8 lm90_max_alarm_bits[3] = { 0, 4, 12 }; ++static const u8 lm90_max_alarm_bits[3] = { 6, 4, 12 }; + static const u8 lm90_crit_alarm_bits[3] = { 0, 1, 9 }; + static const u8 lm90_emergency_alarm_bits[3] = { 15, 13, 14 }; + static const u8 lm90_fault_bits[3] = { 0, 2, 10 }; diff --git a/queue-4.9/hwmon-nct7802-fix-overflows-seen-when-writing-into-limit-attributes.patch b/queue-4.9/hwmon-nct7802-fix-overflows-seen-when-writing-into-limit-attributes.patch new file mode 100644 index 00000000000..4b0d24c5703 --- /dev/null +++ b/queue-4.9/hwmon-nct7802-fix-overflows-seen-when-writing-into-limit-attributes.patch @@ -0,0 +1,69 @@ +From c0d04e9112ad59d73f23f3b0f6726c5e798dfcbf Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Sun, 4 Dec 2016 18:15:25 -0800 +Subject: hwmon: (nct7802) Fix overflows seen when writing into limit attributes + +From: Guenter Roeck + +commit c0d04e9112ad59d73f23f3b0f6726c5e798dfcbf upstream. + +Fix overflows seen when writing voltage and temperature limit attributes. + +The value passed to DIV_ROUND_CLOSEST() needs to be clamped, and the +value parameter passed to nct7802_write_fan_min() is an unsigned long. + +Also, writing values larger than 2700000 into a fan limit attribute results +in writing 0 into the chip's limit registers. The exact behavior when +writing this value is unspecified. For consistency, report a limit of +1350000 if the chip register reads 0. This may be wrong, and the chip +behavior should be verified with the actual chip, but it is better than +reporting a value of 0 (which, when written, results in writing a value +of 0x1fff into the chip register). + +Fixes: 3434f3783580 ("hwmon: Driver for Nuvoton NCT7802Y") +Reviewed-by: Jean Delvare +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/nct7802.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/hwmon/nct7802.c ++++ b/drivers/hwmon/nct7802.c +@@ -259,13 +259,15 @@ static int nct7802_read_fan_min(struct n + ret = 0; + else if (ret) + ret = DIV_ROUND_CLOSEST(1350000U, ret); ++ else ++ ret = 1350000U; + abort: + mutex_unlock(&data->access_lock); + return ret; + } + + static int nct7802_write_fan_min(struct nct7802_data *data, u8 reg_fan_low, +- u8 reg_fan_high, unsigned int limit) ++ u8 reg_fan_high, unsigned long limit) + { + int err; + +@@ -326,8 +328,8 @@ static int nct7802_write_voltage(struct + int shift = 8 - REG_VOLTAGE_LIMIT_MSB_SHIFT[index - 1][nr]; + int err; + ++ voltage = clamp_val(voltage, 0, 0x3ff * nct7802_vmul[nr]); + voltage = DIV_ROUND_CLOSEST(voltage, nct7802_vmul[nr]); +- voltage = clamp_val(voltage, 0, 0x3ff); + + mutex_lock(&data->access_lock); + err = regmap_write(data->regmap, +@@ -402,7 +404,7 @@ static ssize_t store_temp(struct device + if (err < 0) + return err; + +- val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), -128, 127); ++ val = DIV_ROUND_CLOSEST(clamp_val(val, -128000, 127000), 1000); + + err = regmap_write(data->regmap, nr, val & 0xff); + return err ? : count; diff --git a/queue-4.9/hwmon-scpi-fix-module-autoload.patch b/queue-4.9/hwmon-scpi-fix-module-autoload.patch new file mode 100644 index 00000000000..31b5c81c8c8 --- /dev/null +++ b/queue-4.9/hwmon-scpi-fix-module-autoload.patch @@ -0,0 +1,45 @@ +From 13edb767aa609b6efb7c0c2b57fbd72a6ded0eed Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Mon, 7 Nov 2016 17:31:44 -0300 +Subject: hwmon: (scpi) Fix module autoload + +From: Javier Martinez Canillas + +commit 13edb767aa609b6efb7c0c2b57fbd72a6ded0eed upstream. + +If the driver is built as a module, autoload won't work because the module +alias information is not filled. So user-space can't match the registered +device with the corresponding module. + +Export the module alias information using the MODULE_DEVICE_TABLE() macro. + +Before this patch: + +$ modinfo drivers/hwmon/scpi-hwmon.ko | grep alias +$ + +After this patch: + +$ modinfo drivers/hwmon/scpi-hwmon.ko | grep alias +alias: of:N*T*Carm,scpi-sensorsC* +alias: of:N*T*Carm,scpi-sensors + +Signed-off-by: Javier Martinez Canillas +Fixes: ea98b29a05e9c ("hwmon: Support sensors exported via ARM SCP interface") +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/scpi-hwmon.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hwmon/scpi-hwmon.c ++++ b/drivers/hwmon/scpi-hwmon.c +@@ -251,6 +251,7 @@ static const struct of_device_id scpi_of + {.compatible = "arm,scpi-sensors"}, + {}, + }; ++MODULE_DEVICE_TABLE(of, scpi_of_match); + + static struct platform_driver scpi_hwmon_platdrv = { + .driver = { diff --git a/queue-4.9/ima-fix-memory-leak-in-ima_release_policy.patch b/queue-4.9/ima-fix-memory-leak-in-ima_release_policy.patch new file mode 100644 index 00000000000..e07e63e0ee2 --- /dev/null +++ b/queue-4.9/ima-fix-memory-leak-in-ima_release_policy.patch @@ -0,0 +1,38 @@ +From 9a11a18902bc3b904353063763d06480620245a6 Mon Sep 17 00:00:00 2001 +From: Eric Richter +Date: Thu, 13 Oct 2016 17:47:36 -0500 +Subject: ima: fix memory leak in ima_release_policy + +From: Eric Richter + +commit 9a11a18902bc3b904353063763d06480620245a6 upstream. + +When the "policy" securityfs file is opened for read, it is opened as a +sequential file. However, when it is eventually released, there is no +cleanup for the sequential file, therefore some memory is leaked. + +This patch adds a call to seq_release() in ima_release_policy() to clean up +the memory when the file is opened for read. + +Fixes: 80eae209d63a IMA: allow reading back the current policy +Reported-by: Colin Ian King +Signed-off-by: Eric Richter +Tested-by: Colin Ian King +Signed-off-by: Mimi Zohar +Signed-off-by: Greg Kroah-Hartman + +--- + security/integrity/ima/ima_fs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/security/integrity/ima/ima_fs.c ++++ b/security/integrity/ima/ima_fs.c +@@ -401,7 +401,7 @@ static int ima_release_policy(struct ino + const char *cause = valid_policy ? "completed" : "failed"; + + if ((file->f_flags & O_ACCMODE) == O_RDONLY) +- return 0; ++ return seq_release(inode, file); + + if (valid_policy && ima_check_policy() < 0) { + cause = "failed"; diff --git a/queue-4.9/input-synaptics-rmi4-unlock-on-error.patch b/queue-4.9/input-synaptics-rmi4-unlock-on-error.patch new file mode 100644 index 00000000000..a55b3f8c0d6 --- /dev/null +++ b/queue-4.9/input-synaptics-rmi4-unlock-on-error.patch @@ -0,0 +1,43 @@ +From 792f497b22afd0563b94dd8fa129a05f762a2c25 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 16 Nov 2016 17:23:22 -0800 +Subject: Input: synaptics-rmi4 - unlock on error + +From: Dan Carpenter + +commit 792f497b22afd0563b94dd8fa129a05f762a2c25 upstream. + +We should unlock before returning on this error path. + +Fixes: 3a762dbd5347 ('[media] Input: synaptics-rmi4 - add support for F54 diagnostics') +Signed-off-by: Dan Carpenter +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/rmi4/rmi_f54.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/input/rmi4/rmi_f54.c ++++ b/drivers/input/rmi4/rmi_f54.c +@@ -200,7 +200,7 @@ static int rmi_f54_request_report(struct + + error = rmi_write(rmi_dev, fn->fd.command_base_addr, F54_GET_REPORT); + if (error < 0) +- return error; ++ goto unlock; + + init_completion(&f54->cmd_done); + +@@ -209,9 +209,10 @@ static int rmi_f54_request_report(struct + + queue_delayed_work(f54->workqueue, &f54->work, 0); + ++unlock: + mutex_unlock(&f54->data_mutex); + +- return 0; ++ return error; + } + + static size_t rmi_f54_get_report_size(struct f54_data *f54) diff --git a/queue-4.9/iommu-amd-fix-the-left-value-check-of-cmd-buffer.patch b/queue-4.9/iommu-amd-fix-the-left-value-check-of-cmd-buffer.patch new file mode 100644 index 00000000000..73852f16dd3 --- /dev/null +++ b/queue-4.9/iommu-amd-fix-the-left-value-check-of-cmd-buffer.patch @@ -0,0 +1,42 @@ +From 432abf68a79332282329286d190e21fe3ac02a31 Mon Sep 17 00:00:00 2001 +From: Huang Rui +Date: Mon, 12 Dec 2016 07:28:26 -0500 +Subject: iommu/amd: Fix the left value check of cmd buffer + +From: Huang Rui + +commit 432abf68a79332282329286d190e21fe3ac02a31 upstream. + +The generic command buffer entry is 128 bits (16 bytes), so the offset +of tail and head pointer should be 16 bytes aligned and increased with +0x10 per command. + +When cmd buf is full, head = (tail + 0x10) % CMD_BUFFER_SIZE. + +So when left space of cmd buf should be able to store only two +command, we should be issued one COMPLETE_WAIT additionally to wait +all older commands completed. Then the left space should be increased +after IOMMU fetching from cmd buf. + +So left check value should be left <= 0x20 (two commands). + +Signed-off-by: Huang Rui +Fixes: ac0ea6e92b222 ('x86/amd-iommu: Improve handling of full command buffer') +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/amd_iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -1021,7 +1021,7 @@ again: + next_tail = (tail + sizeof(*cmd)) % CMD_BUFFER_SIZE; + left = (head - next_tail) % CMD_BUFFER_SIZE; + +- if (left <= 2) { ++ if (left <= 0x20) { + struct iommu_cmd sync_cmd; + int ret; + diff --git a/queue-4.9/iommu-amd-missing-error-code-in-amd_iommu_init_device.patch b/queue-4.9/iommu-amd-missing-error-code-in-amd_iommu_init_device.patch new file mode 100644 index 00000000000..25eaa4b8bb6 --- /dev/null +++ b/queue-4.9/iommu-amd-missing-error-code-in-amd_iommu_init_device.patch @@ -0,0 +1,34 @@ +From 24c790fbf5d8f54c8c82979db11edea8855b74bf Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 24 Nov 2016 14:05:44 +0300 +Subject: iommu/amd: Missing error code in amd_iommu_init_device() + +From: Dan Carpenter + +commit 24c790fbf5d8f54c8c82979db11edea8855b74bf upstream. + +We should set "ret" to -EINVAL if iommu_group_get() fails. + +Fixes: 55c99a4dc50f ("iommu/amd: Use iommu_attach_group()") +Signed-off-by: Dan Carpenter +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/amd_iommu_v2.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/iommu/amd_iommu_v2.c ++++ b/drivers/iommu/amd_iommu_v2.c +@@ -805,8 +805,10 @@ int amd_iommu_init_device(struct pci_dev + goto out_free_domain; + + group = iommu_group_get(&pdev->dev); +- if (!group) ++ if (!group) { ++ ret = -EINVAL; + goto out_free_domain; ++ } + + ret = iommu_attach_group(dev_state->domain, group); + if (ret != 0) diff --git a/queue-4.9/iommu-vt-d-fix-pasid-table-size-encoding.patch b/queue-4.9/iommu-vt-d-fix-pasid-table-size-encoding.patch new file mode 100644 index 00000000000..86c0bffc8fb --- /dev/null +++ b/queue-4.9/iommu-vt-d-fix-pasid-table-size-encoding.patch @@ -0,0 +1,73 @@ +From 65ca7f5f7d1cdde6c25172fe6107cd16902f826f Mon Sep 17 00:00:00 2001 +From: Jacob Pan +Date: Tue, 6 Dec 2016 10:14:23 -0800 +Subject: iommu/vt-d: Fix pasid table size encoding + +From: Jacob Pan + +commit 65ca7f5f7d1cdde6c25172fe6107cd16902f826f upstream. + +Different encodings are used to represent supported PASID bits +and number of PASID table entries. +The current code assigns ecap_pss directly to extended context +table entry PTS which is wrong and could result in writing +non-zero bits to the reserved fields. IOMMU fault reason +11 will be reported when reserved bits are nonzero. +This patch converts ecap_pss to extend context entry pts encoding +based on VT-d spec. Chapter 9.4 as follows: + - number of PASID bits = ecap_pss + 1 + - number of PASID table entries = 2^(pts + 5) +Software assigned limit of pasid_max value is also respected to +match the allocation limitation of PASID table. + +cc: Mika Kuoppala +cc: Ashok Raj +Signed-off-by: Jacob Pan +Tested-by: Mika Kuoppala +Fixes: 2f26e0a9c9860 ('iommu/vt-d: Add basic SVM PASID support') +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/intel-iommu.c | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -5197,6 +5197,25 @@ static void intel_iommu_remove_device(st + } + + #ifdef CONFIG_INTEL_IOMMU_SVM ++#define MAX_NR_PASID_BITS (20) ++static inline unsigned long intel_iommu_get_pts(struct intel_iommu *iommu) ++{ ++ /* ++ * Convert ecap_pss to extend context entry pts encoding, also ++ * respect the soft pasid_max value set by the iommu. ++ * - number of PASID bits = ecap_pss + 1 ++ * - number of PASID table entries = 2^(pts + 5) ++ * Therefore, pts = ecap_pss - 4 ++ * e.g. KBL ecap_pss = 0x13, PASID has 20 bits, pts = 15 ++ */ ++ if (ecap_pss(iommu->ecap) < 5) ++ return 0; ++ ++ /* pasid_max is encoded as actual number of entries not the bits */ ++ return find_first_bit((unsigned long *)&iommu->pasid_max, ++ MAX_NR_PASID_BITS) - 5; ++} ++ + int intel_iommu_enable_pasid(struct intel_iommu *iommu, struct intel_svm_dev *sdev) + { + struct device_domain_info *info; +@@ -5229,7 +5248,9 @@ int intel_iommu_enable_pasid(struct inte + + if (!(ctx_lo & CONTEXT_PASIDE)) { + context[1].hi = (u64)virt_to_phys(iommu->pasid_state_table); +- context[1].lo = (u64)virt_to_phys(iommu->pasid_table) | ecap_pss(iommu->ecap); ++ context[1].lo = (u64)virt_to_phys(iommu->pasid_table) | ++ intel_iommu_get_pts(iommu); ++ + wmb(); + /* CONTEXT_TT_MULTI_LEVEL and CONTEXT_TT_DEV_IOTLB are both + * extended to permit requests-with-PASID if the PASIDE bit diff --git a/queue-4.9/iommu-vt-d-flush-old-iommu-caches-for-kdump-when-the-device-gets-context-mapped.patch b/queue-4.9/iommu-vt-d-flush-old-iommu-caches-for-kdump-when-the-device-gets-context-mapped.patch new file mode 100644 index 00000000000..5e70464e597 --- /dev/null +++ b/queue-4.9/iommu-vt-d-flush-old-iommu-caches-for-kdump-when-the-device-gets-context-mapped.patch @@ -0,0 +1,89 @@ +From aec0e86172a79eb5e44aff1055bb953fe4d47c59 Mon Sep 17 00:00:00 2001 +From: Xunlei Pang +Date: Mon, 5 Dec 2016 20:09:07 +0800 +Subject: iommu/vt-d: Flush old iommu caches for kdump when the device gets context mapped + +From: Xunlei Pang + +commit aec0e86172a79eb5e44aff1055bb953fe4d47c59 upstream. + +We met the DMAR fault both on hpsa P420i and P421 SmartArray controllers +under kdump, it can be steadily reproduced on several different machines, +the dmesg log is like: +HP HPSA Driver (v 3.4.16-0) +hpsa 0000:02:00.0: using doorbell to reset controller +hpsa 0000:02:00.0: board ready after hard reset. +hpsa 0000:02:00.0: Waiting for controller to respond to no-op +DMAR: Setting identity map for device 0000:02:00.0 [0xe8000 - 0xe8fff] +DMAR: Setting identity map for device 0000:02:00.0 [0xf4000 - 0xf4fff] +DMAR: Setting identity map for device 0000:02:00.0 [0xbdf6e000 - 0xbdf6efff] +DMAR: Setting identity map for device 0000:02:00.0 [0xbdf6f000 - 0xbdf7efff] +DMAR: Setting identity map for device 0000:02:00.0 [0xbdf7f000 - 0xbdf82fff] +DMAR: Setting identity map for device 0000:02:00.0 [0xbdf83000 - 0xbdf84fff] +DMAR: DRHD: handling fault status reg 2 +DMAR: [DMA Read] Request device [02:00.0] fault addr fffff000 [fault reason 06] PTE Read access is not set +hpsa 0000:02:00.0: controller message 03:00 timed out +hpsa 0000:02:00.0: no-op failed; re-trying + +After some debugging, we found that the fault addr is from DMA initiated at +the driver probe stage after reset(not in-flight DMA), and the corresponding +pte entry value is correct, the fault is likely due to the old iommu caches +of the in-flight DMA before it. + +Thus we need to flush the old cache after context mapping is setup for the +device, where the device is supposed to finish reset at its driver probe +stage and no in-flight DMA exists hereafter. + +I'm not sure if the hardware is responsible for invalidating all the related +caches allocated in the iommu hardware before, but seems not the case for hpsa, +actually many device drivers have problems in properly resetting the hardware. +Anyway flushing (again) by software in kdump kernel when the device gets context +mapped which is a quite infrequent operation does little harm. + +With this patch, the problematic machine can survive the kdump tests. + +CC: Myron Stowe +CC: Joseph Szczypek +CC: Don Brace +CC: Baoquan He +CC: Dave Young +Fixes: 091d42e43d21 ("iommu/vt-d: Copy translation tables from old kernel") +Fixes: dbcd861f252d ("iommu/vt-d: Do not re-use domain-ids from the old kernel") +Fixes: cf484d0e6939 ("iommu/vt-d: Mark copied context entries") +Signed-off-by: Xunlei Pang +Tested-by: Don Brace +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/intel-iommu.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -2037,6 +2037,25 @@ static int domain_context_mapping_one(st + if (context_present(context)) + goto out_unlock; + ++ /* ++ * For kdump cases, old valid entries may be cached due to the ++ * in-flight DMA and copied pgtable, but there is no unmapping ++ * behaviour for them, thus we need an explicit cache flush for ++ * the newly-mapped device. For kdump, at this point, the device ++ * is supposed to finish reset at its driver probe stage, so no ++ * in-flight DMA will exist, and we don't need to worry anymore ++ * hereafter. ++ */ ++ if (context_copied(context)) { ++ u16 did_old = context_domain_id(context); ++ ++ if (did_old >= 0 && did_old < cap_ndoms(iommu->cap)) ++ iommu->flush.flush_context(iommu, did_old, ++ (((u16)bus) << 8) | devfn, ++ DMA_CCMD_MASK_NOBIT, ++ DMA_CCMD_DEVICE_INVL); ++ } ++ + pgd = domain->pgd; + + context_clear_entry(context); diff --git a/queue-4.9/irqchip-bcm7038-l1-implement-irq_cpu_offline-callback.patch b/queue-4.9/irqchip-bcm7038-l1-implement-irq_cpu_offline-callback.patch new file mode 100644 index 00000000000..9f7d1430379 --- /dev/null +++ b/queue-4.9/irqchip-bcm7038-l1-implement-irq_cpu_offline-callback.patch @@ -0,0 +1,73 @@ +From 34c535793bcbf9263cf22f8a52101f796cdfab8e Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Mon, 31 Oct 2016 14:17:35 -0700 +Subject: irqchip/bcm7038-l1: Implement irq_cpu_offline() callback + +From: Florian Fainelli + +commit 34c535793bcbf9263cf22f8a52101f796cdfab8e upstream. + +We did not implement an irq_cpu_offline callback for our irqchip, yet we +support setting a given IRQ's affinity. This resulted in interrupts +whose affinity mask included CPUs being taken offline not to work +correctly once the CPU had been put offline. + +Fixes: 5f7f0317ed28 ("IRQCHIP: Add new driver for BCM7038-style level 1 interrupt controllers") +Signed-off-by: Florian Fainelli +Cc: linux-mips@linux-mips.org +Cc: jason@lakedaemon.net +Cc: marc.zyngier@arm.com +Cc: cernekee@gmail.com +Cc: jaedon.shin@gmail.com +Cc: ralf@linux-mips.org +Cc: justinpopo6@gmail.com +Link: http://lkml.kernel.org/r/1477948656-12966-2-git-send-email-f.fainelli@gmail.com +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/irqchip/irq-bcm7038-l1.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +--- a/drivers/irqchip/irq-bcm7038-l1.c ++++ b/drivers/irqchip/irq-bcm7038-l1.c +@@ -215,6 +215,31 @@ static int bcm7038_l1_set_affinity(struc + return 0; + } + ++static void bcm7038_l1_cpu_offline(struct irq_data *d) ++{ ++ struct cpumask *mask = irq_data_get_affinity_mask(d); ++ int cpu = smp_processor_id(); ++ cpumask_t new_affinity; ++ ++ /* This CPU was not on the affinity mask */ ++ if (!cpumask_test_cpu(cpu, mask)) ++ return; ++ ++ if (cpumask_weight(mask) > 1) { ++ /* ++ * Multiple CPU affinity, remove this CPU from the affinity ++ * mask ++ */ ++ cpumask_copy(&new_affinity, mask); ++ cpumask_clear_cpu(cpu, &new_affinity); ++ } else { ++ /* Only CPU, put on the lowest online CPU */ ++ cpumask_clear(&new_affinity); ++ cpumask_set_cpu(cpumask_first(cpu_online_mask), &new_affinity); ++ } ++ irq_set_affinity_locked(d, &new_affinity, false); ++} ++ + static int __init bcm7038_l1_init_one(struct device_node *dn, + unsigned int idx, + struct bcm7038_l1_chip *intc) +@@ -266,6 +291,7 @@ static struct irq_chip bcm7038_l1_irq_ch + .irq_mask = bcm7038_l1_mask, + .irq_unmask = bcm7038_l1_unmask, + .irq_set_affinity = bcm7038_l1_set_affinity, ++ .irq_cpu_offline = bcm7038_l1_cpu_offline, + }; + + static int bcm7038_l1_map(struct irq_domain *d, unsigned int virq, diff --git a/queue-4.9/md-fix-refcount-problem-on-mddev-when-stopping-array.patch b/queue-4.9/md-fix-refcount-problem-on-mddev-when-stopping-array.patch new file mode 100644 index 00000000000..73968334a73 --- /dev/null +++ b/queue-4.9/md-fix-refcount-problem-on-mddev-when-stopping-array.patch @@ -0,0 +1,52 @@ +From e2342ca832726a840ca6bd196dd2cc073815b08a Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Mon, 5 Dec 2016 16:40:50 +1100 +Subject: md: fix refcount problem on mddev when stopping array. + +From: NeilBrown + +commit e2342ca832726a840ca6bd196dd2cc073815b08a upstream. + +md_open() gets a counted reference on an mddev using mddev_find(). +If it ends up returning an error, it must drop this reference. + +There are two error paths where the reference is not dropped. +One only happens if the process is signalled and an awkward time, +which is quite unlikely. +The other was introduced recently in commit af8d8e6f0. + +Change the code to ensure the drop the reference when returning an error, +and make it harded to re-introduce this sort of bug in the future. + +Reported-by: Marc Smith +Fixes: af8d8e6f0315 ("md: changes for MD_STILL_CLOSED flag") +Signed-off-by: NeilBrown +Acked-by: Guoqing Jiang +Signed-off-by: Shaohua Li +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -7092,7 +7092,8 @@ static int md_open(struct block_device * + + if (test_bit(MD_CLOSING, &mddev->flags)) { + mutex_unlock(&mddev->open_mutex); +- return -ENODEV; ++ err = -ENODEV; ++ goto out; + } + + err = 0; +@@ -7101,6 +7102,8 @@ static int md_open(struct block_device * + + check_disk_change(bdev); + out: ++ if (err) ++ mddev_put(mddev); + return err; + } + diff --git a/queue-4.9/md-md_recovery_needed-is-set-for-mddev-recovery.patch b/queue-4.9/md-md_recovery_needed-is-set-for-mddev-recovery.patch new file mode 100644 index 00000000000..ddb93c28945 --- /dev/null +++ b/queue-4.9/md-md_recovery_needed-is-set-for-mddev-recovery.patch @@ -0,0 +1,31 @@ +From 82a301cb0ea2df8a5c88213094a01660067c7fb4 Mon Sep 17 00:00:00 2001 +From: Shaohua Li +Date: Thu, 8 Dec 2016 15:48:18 -0800 +Subject: md: MD_RECOVERY_NEEDED is set for mddev->recovery + +From: Shaohua Li + +commit 82a301cb0ea2df8a5c88213094a01660067c7fb4 upstream. + +Fixes: 90f5f7ad4f38("md: Wait for md_check_recovery before attempting device +removal.") + +Reviewed-by: NeilBrown +Signed-off-by: Shaohua Li +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -6829,7 +6829,7 @@ static int md_ioctl(struct block_device + /* need to ensure recovery thread has run */ + wait_event_interruptible_timeout(mddev->sb_wait, + !test_bit(MD_RECOVERY_NEEDED, +- &mddev->flags), ++ &mddev->recovery), + msecs_to_jiffies(5000)); + if (cmd == STOP_ARRAY || cmd == STOP_ARRAY_RO) { + /* Need to flush page cache, and ensure no-one else opens diff --git a/queue-4.9/mm-compaction-fix-nr_isolated_-stats-for-pfn-based-migration.patch b/queue-4.9/mm-compaction-fix-nr_isolated_-stats-for-pfn-based-migration.patch new file mode 100644 index 00000000000..68a1e80449e --- /dev/null +++ b/queue-4.9/mm-compaction-fix-nr_isolated_-stats-for-pfn-based-migration.patch @@ -0,0 +1,166 @@ +From 6afcf8ef0ca0a69d014f8edb613d94821f0ae700 Mon Sep 17 00:00:00 2001 +From: Ming Ling +Date: Mon, 12 Dec 2016 16:42:26 -0800 +Subject: mm, compaction: fix NR_ISOLATED_* stats for pfn based migration + +From: Ming Ling + +commit 6afcf8ef0ca0a69d014f8edb613d94821f0ae700 upstream. + +Since commit bda807d44454 ("mm: migrate: support non-lru movable page +migration") isolate_migratepages_block) can isolate !PageLRU pages which +would acct_isolated account as NR_ISOLATED_*. Accounting these non-lru +pages NR_ISOLATED_{ANON,FILE} doesn't make any sense and it can misguide +heuristics based on those counters such as pgdat_reclaimable_pages resp. +too_many_isolated which would lead to unexpected stalls during the +direct reclaim without any good reason. Note that +__alloc_contig_migrate_range can isolate a lot of pages at once. + +On mobile devices such as 512M ram android Phone, it may use a big zram +swap. In some cases zram(zsmalloc) uses too many non-lru but +migratedable pages, such as: + + MemTotal: 468148 kB + Normal free:5620kB + Free swap:4736kB + Total swap:409596kB + ZRAM: 164616kB(zsmalloc non-lru pages) + active_anon:60700kB + inactive_anon:60744kB + active_file:34420kB + inactive_file:37532kB + +Fix this by only accounting lru pages to NR_ISOLATED_* in +isolate_migratepages_block right after they were isolated and we still +know they were on LRU. Drop acct_isolated because it is called after +the fact and we've lost that information. Batching per-cpu counter +doesn't make much improvement anyway. Also make sure that we uncharge +only LRU pages when putting them back on the LRU in +putback_movable_pages resp. when unmap_and_move migrates the page. + +[mhocko@suse.com: replace acct_isolated() with direct counting] +Fixes: bda807d44454 ("mm: migrate: support non-lru movable page migration") +Link: http://lkml.kernel.org/r/20161019080240.9682-1-mhocko@kernel.org +Signed-off-by: Ming Ling +Signed-off-by: Michal Hocko +Acked-by: Minchan Kim +Acked-by: Vlastimil Babka +Cc: Mel Gorman +Cc: Joonsoo Kim +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/compaction.c | 25 +++---------------------- + mm/migrate.c | 15 +++++++++++---- + 2 files changed, 14 insertions(+), 26 deletions(-) + +--- a/mm/compaction.c ++++ b/mm/compaction.c +@@ -634,22 +634,6 @@ isolate_freepages_range(struct compact_c + return pfn; + } + +-/* Update the number of anon and file isolated pages in the zone */ +-static void acct_isolated(struct zone *zone, struct compact_control *cc) +-{ +- struct page *page; +- unsigned int count[2] = { 0, }; +- +- if (list_empty(&cc->migratepages)) +- return; +- +- list_for_each_entry(page, &cc->migratepages, lru) +- count[!!page_is_file_cache(page)]++; +- +- mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_ANON, count[0]); +- mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_FILE, count[1]); +-} +- + /* Similar to reclaim, but different enough that they don't share logic */ + static bool too_many_isolated(struct zone *zone) + { +@@ -866,6 +850,8 @@ isolate_migratepages_block(struct compac + + /* Successfully isolated */ + del_page_from_lru_list(page, lruvec, page_lru(page)); ++ inc_node_page_state(page, ++ NR_ISOLATED_ANON + page_is_file_cache(page)); + + isolate_success: + list_add(&page->lru, &cc->migratepages); +@@ -902,7 +888,6 @@ isolate_fail: + spin_unlock_irqrestore(zone_lru_lock(zone), flags); + locked = false; + } +- acct_isolated(zone, cc); + putback_movable_pages(&cc->migratepages); + cc->nr_migratepages = 0; + cc->last_migrated_pfn = 0; +@@ -988,7 +973,6 @@ isolate_migratepages_range(struct compac + if (cc->nr_migratepages == COMPACT_CLUSTER_MAX) + break; + } +- acct_isolated(cc->zone, cc); + + return pfn; + } +@@ -1258,10 +1242,8 @@ static isolate_migrate_t isolate_migrate + low_pfn = isolate_migratepages_block(cc, low_pfn, + block_end_pfn, isolate_mode); + +- if (!low_pfn || cc->contended) { +- acct_isolated(zone, cc); ++ if (!low_pfn || cc->contended) + return ISOLATE_ABORT; +- } + + /* + * Either we isolated something and proceed with migration. Or +@@ -1271,7 +1253,6 @@ static isolate_migrate_t isolate_migrate + break; + } + +- acct_isolated(zone, cc); + /* Record where migration scanner will be restarted. */ + cc->migrate_pfn = low_pfn; + +--- a/mm/migrate.c ++++ b/mm/migrate.c +@@ -168,8 +168,6 @@ void putback_movable_pages(struct list_h + continue; + } + list_del(&page->lru); +- dec_node_page_state(page, NR_ISOLATED_ANON + +- page_is_file_cache(page)); + /* + * We isolated non-lru movable page so here we can use + * __PageMovable because LRU page's mapping cannot have +@@ -186,6 +184,8 @@ void putback_movable_pages(struct list_h + put_page(page); + } else { + putback_lru_page(page); ++ dec_node_page_state(page, NR_ISOLATED_ANON + ++ page_is_file_cache(page)); + } + } + } +@@ -1121,8 +1121,15 @@ out: + * restored. + */ + list_del(&page->lru); +- dec_node_page_state(page, NR_ISOLATED_ANON + +- page_is_file_cache(page)); ++ ++ /* ++ * Compaction can migrate also non-LRU pages which are ++ * not accounted to NR_ISOLATED_*. They can be recognized ++ * as __PageMovable ++ */ ++ if (likely(!__PageMovable(page))) ++ dec_node_page_state(page, NR_ISOLATED_ANON + ++ page_is_file_cache(page)); + } + + /* diff --git a/queue-4.9/mm-hugetlb.c-use-the-right-pte-val-for-compare-in-hugetlb_cow.patch b/queue-4.9/mm-hugetlb.c-use-the-right-pte-val-for-compare-in-hugetlb_cow.patch new file mode 100644 index 00000000000..61d8823fc7f --- /dev/null +++ b/queue-4.9/mm-hugetlb.c-use-the-right-pte-val-for-compare-in-hugetlb_cow.patch @@ -0,0 +1,83 @@ +From 3999f52e3198e76607446ab1a4610c1ddc406c56 Mon Sep 17 00:00:00 2001 +From: "Aneesh Kumar K.V" +Date: Mon, 12 Dec 2016 16:41:56 -0800 +Subject: mm/hugetlb.c: use the right pte val for compare in hugetlb_cow + +From: Aneesh Kumar K.V + +commit 3999f52e3198e76607446ab1a4610c1ddc406c56 upstream. + +We cannot use the pte value used in set_pte_at for pte_same comparison, +because archs like ppc64, filter/add new pte flag in set_pte_at. +Instead fetch the pte value inside hugetlb_cow. We are comparing pte +value to make sure the pte didn't change since we dropped the page table +lock. hugetlb_cow get called with page table lock held, and we can take +a copy of the pte value before we drop the page table lock. + +With hugetlbfs, we optimize the MAP_PRIVATE write fault path with no +previous mapping (huge_pte_none entries), by forcing a cow in the fault +path. This avoid take an addition fault to covert a read-only mapping +to read/write. Here we were comparing a recently instantiated pte (via +set_pte_at) to the pte values from linux page table. As explained above +on ppc64 such pte_same check returned wrong result, resulting in us +taking an additional fault on ppc64. + +Fixes: 6a119eae942c ("powerpc/mm: Add a _PAGE_PTE bit") +Link: http://lkml.kernel.org/r/20161018154245.18023-1-aneesh.kumar@linux.vnet.ibm.com +Signed-off-by: Aneesh Kumar K.V +Reported-by: Jan Stancek +Acked-by: Hillf Danton +Cc: Mike Kravetz +Cc: Scott Wood +Cc: Michael Ellerman +Cc: Kirill A. Shutemov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/hugetlb.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -3450,15 +3450,17 @@ static void unmap_ref_private(struct mm_ + * Keep the pte_same checks anyway to make transition from the mutex easier. + */ + static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma, +- unsigned long address, pte_t *ptep, pte_t pte, +- struct page *pagecache_page, spinlock_t *ptl) ++ unsigned long address, pte_t *ptep, ++ struct page *pagecache_page, spinlock_t *ptl) + { ++ pte_t pte; + struct hstate *h = hstate_vma(vma); + struct page *old_page, *new_page; + int ret = 0, outside_reserve = 0; + unsigned long mmun_start; /* For mmu_notifiers */ + unsigned long mmun_end; /* For mmu_notifiers */ + ++ pte = huge_ptep_get(ptep); + old_page = pte_page(pte); + + retry_avoidcopy: +@@ -3733,7 +3735,7 @@ retry: + hugetlb_count_add(pages_per_huge_page(h), mm); + if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) { + /* Optimization, do the COW without a second fault */ +- ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page, ptl); ++ ret = hugetlb_cow(mm, vma, address, ptep, page, ptl); + } + + spin_unlock(ptl); +@@ -3888,8 +3890,8 @@ int hugetlb_fault(struct mm_struct *mm, + + if (flags & FAULT_FLAG_WRITE) { + if (!huge_pte_write(entry)) { +- ret = hugetlb_cow(mm, vma, address, ptep, entry, +- pagecache_page, ptl); ++ ret = hugetlb_cow(mm, vma, address, ptep, ++ pagecache_page, ptl); + goto out_put_page; + } + entry = huge_pte_mkdirty(entry); diff --git a/queue-4.9/mm-khugepaged-close-use-after-free-race-during-shmem-collapsing.patch b/queue-4.9/mm-khugepaged-close-use-after-free-race-during-shmem-collapsing.patch new file mode 100644 index 00000000000..a71e6f1663b --- /dev/null +++ b/queue-4.9/mm-khugepaged-close-use-after-free-race-during-shmem-collapsing.patch @@ -0,0 +1,77 @@ +From 91a45f71078a6569ec3ca5bef74e1ab58121d80e Mon Sep 17 00:00:00 2001 +From: Johannes Weiner +Date: Mon, 12 Dec 2016 16:43:32 -0800 +Subject: mm: khugepaged: close use-after-free race during shmem collapsing + +From: Johannes Weiner + +commit 91a45f71078a6569ec3ca5bef74e1ab58121d80e upstream. + +Patch series "mm: workingset: radix tree subtleties & single-page file +refaults", v3. + +This is another revision of the radix tree / workingset patches based on +feedback from Jan and Kirill. + +This is a follow-up to d3798ae8c6f3 ("mm: filemap: don't plant shadow +entries without radix tree node"). That patch fixed an issue that was +caused mainly by the page cache sneaking special shadow page entries +into the radix tree and relying on subtleties in the radix tree code to +make that work. The fix also had to stop tracking refaults for +single-page files because shadow pages stored as direct pointers in +radix_tree_root->rnode weren't properly handled during tree extension. + +These patches make the radix tree code explicitely support and track +such special entries, to eliminate the subtleties and to restore the +thrash detection for single-page files. + +This patch (of 9): + +When a radix tree iteration drops the tree lock, another thread might +swoop in and free the node holding the current slot. The iteration +needs to do another tree lookup from the current index to continue. + +[kirill.shutemov@linux.intel.com: re-lookup for replacement] +Fixes: f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages") +Link: http://lkml.kernel.org/r/20161117191138.22769-2-hannes@cmpxchg.org +Signed-off-by: Johannes Weiner +Acked-by: Kirill A. Shutemov +Reviewed-by: Jan Kara +Cc: Hugh Dickins +Cc: Matthew Wilcox +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/khugepaged.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -1403,6 +1403,9 @@ static void collapse_shmem(struct mm_str + + spin_lock_irq(&mapping->tree_lock); + ++ slot = radix_tree_lookup_slot(&mapping->page_tree, index); ++ VM_BUG_ON_PAGE(page != radix_tree_deref_slot_protected(slot, ++ &mapping->tree_lock), page); + VM_BUG_ON_PAGE(page_mapped(page), page); + + /* +@@ -1426,6 +1429,7 @@ static void collapse_shmem(struct mm_str + radix_tree_replace_slot(slot, + new_page + (index % HPAGE_PMD_NR)); + ++ slot = radix_tree_iter_next(&iter); + index++; + continue; + out_lru: +@@ -1537,6 +1541,7 @@ tree_unlocked: + putback_lru_page(page); + unlock_page(page); + spin_lock_irq(&mapping->tree_lock); ++ slot = radix_tree_iter_next(&iter); + } + VM_BUG_ON(nr_none); + spin_unlock_irq(&mapping->tree_lock); diff --git a/queue-4.9/mm-khugepaged-fix-radix-tree-node-leak-in-shmem-collapse-error-path.patch b/queue-4.9/mm-khugepaged-fix-radix-tree-node-leak-in-shmem-collapse-error-path.patch new file mode 100644 index 00000000000..3a0751d7bf9 --- /dev/null +++ b/queue-4.9/mm-khugepaged-fix-radix-tree-node-leak-in-shmem-collapse-error-path.patch @@ -0,0 +1,48 @@ +From 59749e6ce53735d8b696763742225f126e94603f Mon Sep 17 00:00:00 2001 +From: Johannes Weiner +Date: Mon, 12 Dec 2016 16:43:35 -0800 +Subject: mm: khugepaged: fix radix tree node leak in shmem collapse error path + +From: Johannes Weiner + +commit 59749e6ce53735d8b696763742225f126e94603f upstream. + +The radix tree counts valid entries in each tree node. Entries stored +in the tree cannot be removed by simpling storing NULL in the slot or +the internal counters will be off and the node never gets freed again. + +When collapsing a shmem page fails, restore the holes that were filled +with radix_tree_insert() with a proper radix tree deletion. + +Fixes: f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages") +Link: http://lkml.kernel.org/r/20161117191138.22769-3-hannes@cmpxchg.org +Signed-off-by: Johannes Weiner +Reported-by: Jan Kara +Acked-by: Kirill A. Shutemov +Reviewed-by: Jan Kara +Cc: Hugh Dickins +Cc: Matthew Wilcox +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/khugepaged.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -1525,9 +1525,11 @@ tree_unlocked: + if (!page || iter.index < page->index) { + if (!nr_none) + break; +- /* Put holes back where they were */ +- radix_tree_replace_slot(slot, NULL); + nr_none--; ++ /* Put holes back where they were */ ++ radix_tree_delete(&mapping->page_tree, ++ iter.index); ++ slot = radix_tree_iter_next(&iter); + continue; + } + diff --git a/queue-4.9/mmc-mmc_test-uninitialized-return-value.patch b/queue-4.9/mmc-mmc_test-uninitialized-return-value.patch new file mode 100644 index 00000000000..9410bfb7d52 --- /dev/null +++ b/queue-4.9/mmc-mmc_test-uninitialized-return-value.patch @@ -0,0 +1,31 @@ +From 16652a936e96f5dae53c3fbd38a570497baadaa8 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 14 Nov 2016 14:31:34 +0300 +Subject: mmc: mmc_test: Uninitialized return value + +From: Dan Carpenter + +commit 16652a936e96f5dae53c3fbd38a570497baadaa8 upstream. + +We never set "ret" to RESULT_OK. + +Fixes: 9f9c4180f88d ("mmc: mmc_test: add test for non-blocking transfers") +Signed-off-by: Dan Carpenter +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/card/mmc_test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/card/mmc_test.c ++++ b/drivers/mmc/card/mmc_test.c +@@ -818,7 +818,7 @@ static int mmc_test_nonblock_transfer(st + struct mmc_async_req *cur_areq = &test_areq[0].areq; + struct mmc_async_req *other_areq = &test_areq[1].areq; + int i; +- int ret; ++ int ret = RESULT_OK; + + test_areq[0].test = test; + test_areq[1].test = test; diff --git a/queue-4.9/pci-add-mellanox-device-ids.patch b/queue-4.9/pci-add-mellanox-device-ids.patch new file mode 100644 index 00000000000..0092f051afc --- /dev/null +++ b/queue-4.9/pci-add-mellanox-device-ids.patch @@ -0,0 +1,58 @@ +From 7254383341bc6e1a61996accd836009f0c922b21 Mon Sep 17 00:00:00 2001 +From: Noa Osherovich +Date: Thu, 17 Nov 2016 16:06:56 -0600 +Subject: PCI: Add Mellanox device IDs + +From: Noa Osherovich + +commit 7254383341bc6e1a61996accd836009f0c922b21 upstream. + +Add Mellanox device IDs for use by the mlx4 driver and INTx quirks. + +[bhelgaas: sorted and adapted from +http://lkml.kernel.org/r/1478011644-12080-1-git-send-email-noaos@mellanox.com] +Signed-off-by: Noa Osherovich +Signed-off-by: Bjorn Helgaas +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/pci_ids.h | 27 ++++++++++++++++++++++----- + 1 file changed, 22 insertions(+), 5 deletions(-) + +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -2256,12 +2256,29 @@ + #define PCI_DEVICE_ID_ZOLTRIX_2BD0 0x2bd0 + + #define PCI_VENDOR_ID_MELLANOX 0x15b3 +-#define PCI_DEVICE_ID_MELLANOX_TAVOR 0x5a44 ++#define PCI_DEVICE_ID_MELLANOX_CONNECTX3 0x1003 ++#define PCI_DEVICE_ID_MELLANOX_CONNECTX3_PRO 0x1007 ++#define PCI_DEVICE_ID_MELLANOX_CONNECTIB 0x1011 ++#define PCI_DEVICE_ID_MELLANOX_CONNECTX4 0x1013 ++#define PCI_DEVICE_ID_MELLANOX_CONNECTX4_LX 0x1015 ++#define PCI_DEVICE_ID_MELLANOX_TAVOR 0x5a44 + #define PCI_DEVICE_ID_MELLANOX_TAVOR_BRIDGE 0x5a46 +-#define PCI_DEVICE_ID_MELLANOX_ARBEL_COMPAT 0x6278 +-#define PCI_DEVICE_ID_MELLANOX_ARBEL 0x6282 +-#define PCI_DEVICE_ID_MELLANOX_SINAI_OLD 0x5e8c +-#define PCI_DEVICE_ID_MELLANOX_SINAI 0x6274 ++#define PCI_DEVICE_ID_MELLANOX_SINAI_OLD 0x5e8c ++#define PCI_DEVICE_ID_MELLANOX_SINAI 0x6274 ++#define PCI_DEVICE_ID_MELLANOX_ARBEL_COMPAT 0x6278 ++#define PCI_DEVICE_ID_MELLANOX_ARBEL 0x6282 ++#define PCI_DEVICE_ID_MELLANOX_HERMON_SDR 0x6340 ++#define PCI_DEVICE_ID_MELLANOX_HERMON_DDR 0x634a ++#define PCI_DEVICE_ID_MELLANOX_HERMON_QDR 0x6354 ++#define PCI_DEVICE_ID_MELLANOX_HERMON_EN 0x6368 ++#define PCI_DEVICE_ID_MELLANOX_CONNECTX_EN 0x6372 ++#define PCI_DEVICE_ID_MELLANOX_HERMON_DDR_GEN2 0x6732 ++#define PCI_DEVICE_ID_MELLANOX_HERMON_QDR_GEN2 0x673c ++#define PCI_DEVICE_ID_MELLANOX_CONNECTX_EN_5_GEN2 0x6746 ++#define PCI_DEVICE_ID_MELLANOX_HERMON_EN_GEN2 0x6750 ++#define PCI_DEVICE_ID_MELLANOX_CONNECTX_EN_T_GEN2 0x675a ++#define PCI_DEVICE_ID_MELLANOX_CONNECTX_EN_GEN2 0x6764 ++#define PCI_DEVICE_ID_MELLANOX_CONNECTX2 0x676e + + #define PCI_VENDOR_ID_DFI 0x15bd + diff --git a/queue-4.9/pci-convert-broken-intx-masking-quirks-from-header-to-final.patch b/queue-4.9/pci-convert-broken-intx-masking-quirks-from-header-to-final.patch new file mode 100644 index 00000000000..f349f5c1b3f --- /dev/null +++ b/queue-4.9/pci-convert-broken-intx-masking-quirks-from-header-to-final.patch @@ -0,0 +1,117 @@ +From b88214ce4d7064992452765028bd50702414f15f Mon Sep 17 00:00:00 2001 +From: Noa Osherovich +Date: Tue, 15 Nov 2016 09:59:58 +0200 +Subject: PCI: Convert broken INTx masking quirks from HEADER to FINAL + +From: Noa Osherovich + +commit b88214ce4d7064992452765028bd50702414f15f upstream. + +Convert all quirk_broken_intx_masking() quirks from HEADER to FINAL. + +The quirk sets dev->broken_intx_masking, which is only used by +pci_intx_mask_supported(), which is not needed until after FINAL +quirks have been run. + +[bhelgaas: changelog] +Signed-off-by: Noa Osherovich +Signed-off-by: Bjorn Helgaas +Reviewed-by: Gavin Shan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 72 +++++++++++++++++++++++++-------------------------- + 1 file changed, 36 insertions(+), 36 deletions(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3146,53 +3146,53 @@ static void quirk_broken_intx_masking(st + { + dev->broken_intx_masking = 1; + } +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CHELSIO, 0x0030, +- quirk_broken_intx_masking); +-DECLARE_PCI_FIXUP_HEADER(0x1814, 0x0601, /* Ralink RT2800 802.11n PCI */ +- quirk_broken_intx_masking); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x0030, ++ quirk_broken_intx_masking); ++DECLARE_PCI_FIXUP_FINAL(0x1814, 0x0601, /* Ralink RT2800 802.11n PCI */ ++ quirk_broken_intx_masking); + /* + * Realtek RTL8169 PCI Gigabit Ethernet Controller (rev 10) + * Subsystem: Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC + * + * RTL8110SC - Fails under PCI device assignment using DisINTx masking. + */ +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_REALTEK, 0x8169, +- quirk_broken_intx_masking); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, PCI_ANY_ID, +- quirk_broken_intx_masking); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_REALTEK, 0x8169, ++ quirk_broken_intx_masking); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MELLANOX, PCI_ANY_ID, ++ quirk_broken_intx_masking); + + /* + * Intel i40e (XL710/X710) 10/20/40GbE NICs all have broken INTx masking, + * DisINTx can be set but the interrupt status bit is non-functional. + */ +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1572, +- quirk_broken_intx_masking); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1574, +- quirk_broken_intx_masking); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1580, +- quirk_broken_intx_masking); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1581, +- quirk_broken_intx_masking); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1583, +- quirk_broken_intx_masking); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1584, +- quirk_broken_intx_masking); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1585, +- quirk_broken_intx_masking); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1586, +- quirk_broken_intx_masking); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1587, +- quirk_broken_intx_masking); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1588, +- quirk_broken_intx_masking); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1589, +- quirk_broken_intx_masking); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x37d0, +- quirk_broken_intx_masking); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x37d1, +- quirk_broken_intx_masking); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x37d2, +- quirk_broken_intx_masking); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1572, ++ quirk_broken_intx_masking); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1574, ++ quirk_broken_intx_masking); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1580, ++ quirk_broken_intx_masking); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1581, ++ quirk_broken_intx_masking); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1583, ++ quirk_broken_intx_masking); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1584, ++ quirk_broken_intx_masking); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1585, ++ quirk_broken_intx_masking); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1586, ++ quirk_broken_intx_masking); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1587, ++ quirk_broken_intx_masking); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1588, ++ quirk_broken_intx_masking); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1589, ++ quirk_broken_intx_masking); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x37d0, ++ quirk_broken_intx_masking); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x37d1, ++ quirk_broken_intx_masking); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x37d2, ++ quirk_broken_intx_masking); + + static void quirk_no_bus_reset(struct pci_dev *dev) + { diff --git a/queue-4.9/pci-convert-mellanox-broken-intx-quirks-to-be-for-listed-devices-only.patch b/queue-4.9/pci-convert-mellanox-broken-intx-quirks-to-be-for-listed-devices-only.patch new file mode 100644 index 00000000000..b602e28c4bb --- /dev/null +++ b/queue-4.9/pci-convert-mellanox-broken-intx-quirks-to-be-for-listed-devices-only.patch @@ -0,0 +1,94 @@ +From d76d2fe05fd93673d184af77255bbbc63780f4ea Mon Sep 17 00:00:00 2001 +From: Noa Osherovich +Date: Tue, 15 Nov 2016 09:59:59 +0200 +Subject: PCI: Convert Mellanox broken INTx quirks to be for listed devices only + +From: Noa Osherovich + +commit d76d2fe05fd93673d184af77255bbbc63780f4ea upstream. + +Change Mellanox's broken_intx_masking() quirk from an "all Mellanox +devices" to a quirk for listed devices only. + +[bhelgaas: remove #defines, reorder to keep other quirks together] +Signed-off-by: Noa Osherovich +Signed-off-by: Bjorn Helgaas +Reviewed-by: Or Gerlitz +Reviewed-by: Gavin Shan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 40 +++++++++++++++++++++++++++++++++++++--- + 1 file changed, 37 insertions(+), 3 deletions(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3137,8 +3137,9 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_IN + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x22b7, quirk_remove_d3_delay); + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x2298, quirk_remove_d3_delay); + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x229c, quirk_remove_d3_delay); ++ + /* +- * Some devices may pass our check in pci_intx_mask_supported if ++ * Some devices may pass our check in pci_intx_mask_supported() if + * PCI_COMMAND_INTX_DISABLE works though they actually do not properly + * support this feature. + */ +@@ -3150,6 +3151,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CH + quirk_broken_intx_masking); + DECLARE_PCI_FIXUP_FINAL(0x1814, 0x0601, /* Ralink RT2800 802.11n PCI */ + quirk_broken_intx_masking); ++ + /* + * Realtek RTL8169 PCI Gigabit Ethernet Controller (rev 10) + * Subsystem: Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC +@@ -3158,8 +3160,6 @@ DECLARE_PCI_FIXUP_FINAL(0x1814, 0x0601, + */ + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_REALTEK, 0x8169, + quirk_broken_intx_masking); +-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MELLANOX, PCI_ANY_ID, +- quirk_broken_intx_masking); + + /* + * Intel i40e (XL710/X710) 10/20/40GbE NICs all have broken INTx masking, +@@ -3194,6 +3194,40 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_IN + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x37d2, + quirk_broken_intx_masking); + ++static u16 mellanox_broken_intx_devs[] = { ++ PCI_DEVICE_ID_MELLANOX_HERMON_SDR, ++ PCI_DEVICE_ID_MELLANOX_HERMON_DDR, ++ PCI_DEVICE_ID_MELLANOX_HERMON_QDR, ++ PCI_DEVICE_ID_MELLANOX_HERMON_DDR_GEN2, ++ PCI_DEVICE_ID_MELLANOX_HERMON_QDR_GEN2, ++ PCI_DEVICE_ID_MELLANOX_HERMON_EN, ++ PCI_DEVICE_ID_MELLANOX_HERMON_EN_GEN2, ++ PCI_DEVICE_ID_MELLANOX_CONNECTX_EN, ++ PCI_DEVICE_ID_MELLANOX_CONNECTX_EN_T_GEN2, ++ PCI_DEVICE_ID_MELLANOX_CONNECTX_EN_GEN2, ++ PCI_DEVICE_ID_MELLANOX_CONNECTX_EN_5_GEN2, ++ PCI_DEVICE_ID_MELLANOX_CONNECTX2, ++ PCI_DEVICE_ID_MELLANOX_CONNECTX3, ++ PCI_DEVICE_ID_MELLANOX_CONNECTX3_PRO, ++ PCI_DEVICE_ID_MELLANOX_CONNECTIB, ++ PCI_DEVICE_ID_MELLANOX_CONNECTX4, ++ PCI_DEVICE_ID_MELLANOX_CONNECTX4_LX, ++}; ++ ++static void mellanox_check_broken_intx_masking(struct pci_dev *pdev) ++{ ++ int i; ++ ++ for (i = 0; i < ARRAY_SIZE(mellanox_broken_intx_devs); i++) { ++ if (pdev->device == mellanox_broken_intx_devs[i]) { ++ pdev->broken_intx_masking = 1; ++ return; ++ } ++ } ++} ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MELLANOX, PCI_ANY_ID, ++ mellanox_check_broken_intx_masking); ++ + static void quirk_no_bus_reset(struct pci_dev *dev) + { + dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET; diff --git a/queue-4.9/pci-enable-access-to-non-standard-vpd-for-chelsio-devices-cxgb3.patch b/queue-4.9/pci-enable-access-to-non-standard-vpd-for-chelsio-devices-cxgb3.patch new file mode 100644 index 00000000000..cb0a3565735 --- /dev/null +++ b/queue-4.9/pci-enable-access-to-non-standard-vpd-for-chelsio-devices-cxgb3.patch @@ -0,0 +1,117 @@ +From 1c7de2b4ff886a45fbd2f4c3d4627e0f37a9dd77 Mon Sep 17 00:00:00 2001 +From: Alexey Kardashevskiy +Date: Mon, 24 Oct 2016 18:04:17 +1100 +Subject: PCI: Enable access to non-standard VPD for Chelsio devices (cxgb3) + +From: Alexey Kardashevskiy + +commit 1c7de2b4ff886a45fbd2f4c3d4627e0f37a9dd77 upstream. + +There is at least one Chelsio 10Gb card which uses VPD area to store some +non-standard blocks (example below). However pci_vpd_size() returns the +length of the first block only assuming that there can be only one VPD "End +Tag". + +Since 4e1a635552d3 ("vfio/pci: Use kernel VPD access functions"), VFIO +blocks access beyond that offset, which prevents the guest "cxgb3" driver +from probing the device. The host system does not have this problem as its +driver accesses the config space directly without pci_read_vpd(). + +Add a quirk to override the VPD size to a bigger value. The maximum size +is taken from EEPROMSIZE in drivers/net/ethernet/chelsio/cxgb3/common.h. +We do not read the tag as the cxgb3 driver does as the driver supports +writing to EEPROM/VPD and when it writes, it only checks for 8192 bytes +boundary. The quirk is registered for all devices supported by the cxgb3 +driver. + +This adds a quirk to the PCI layer (not to the cxgb3 driver) as the cxgb3 +driver itself accesses VPD directly and the problem only exists with the +vfio-pci driver (when cxgb3 is not running on the host and may not be even +loaded) which blocks accesses beyond the first block of VPD data. However +vfio-pci itself does not have quirks mechanism so we add it to PCI. + +This is the controller: +Ethernet controller [0200]: Chelsio Communications Inc T310 10GbE Single Port Adapter [1425:0030] + +This is what I parsed from its VPD: +=== +b'\x82*\x0010 Gigabit Ethernet-SR PCI Express Adapter\x90J\x00EC\x07D76809 FN\x0746K' + 0000 Large item 42 bytes; name 0x2 Identifier String + b'10 Gigabit Ethernet-SR PCI Express Adapter' + 002d Large item 74 bytes; name 0x10 + #00 [EC] len=7: b'D76809 ' + #0a [FN] len=7: b'46K7897' + #14 [PN] len=7: b'46K7897' + #1e [MN] len=4: b'1037' + #25 [FC] len=4: b'5769' + #2c [SN] len=12: b'YL102035603V' + #3b [NA] len=12: b'00145E992ED1' + 007a Small item 1 bytes; name 0xf End Tag + + 0c00 Large item 16 bytes; name 0x2 Identifier String + b'S310E-SR-X ' + 0c13 Large item 234 bytes; name 0x10 + #00 [PN] len=16: b'TBD ' + #13 [EC] len=16: b'110107730D2 ' + #26 [SN] len=16: b'97YL102035603V ' + #39 [NA] len=12: b'00145E992ED1' + #48 [V0] len=6: b'175000' + #51 [V1] len=6: b'266666' + #5a [V2] len=6: b'266666' + #63 [V3] len=6: b'2000 ' + #6c [V4] len=2: b'1 ' + #71 [V5] len=6: b'c2 ' + #7a [V6] len=6: b'0 ' + #83 [V7] len=2: b'1 ' + #88 [V8] len=2: b'0 ' + #8d [V9] len=2: b'0 ' + #92 [VA] len=2: b'0 ' + #97 [RV] len=80: b's\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'... + 0d00 Large item 252 bytes; name 0x11 + #00 [VC] len=16: b'122310_1222 dp ' + #13 [VD] len=16: b'610-0001-00 H1\x00\x00' + #26 [VE] len=16: b'122310_1353 fp ' + #39 [VF] len=16: b'610-0001-00 H1\x00\x00' + #4c [RW] len=173: b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'... + 0dff Small item 0 bytes; name 0xf End Tag + +10f3 Large item 13315 bytes; name 0x62 +!!! unknown item name 98: b'\xd0\x03\x00@`\x0c\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00' +=== + +Signed-off-by: Alexey Kardashevskiy +Signed-off-by: Bjorn Helgaas +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3342,6 +3342,25 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_IN + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PORT_RIDGE, + quirk_thunderbolt_hotplug_msi); + ++static void quirk_chelsio_extend_vpd(struct pci_dev *dev) ++{ ++ pci_set_vpd_size(dev, 8192); ++} ++ ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x20, quirk_chelsio_extend_vpd); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x21, quirk_chelsio_extend_vpd); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x22, quirk_chelsio_extend_vpd); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x23, quirk_chelsio_extend_vpd); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x24, quirk_chelsio_extend_vpd); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x25, quirk_chelsio_extend_vpd); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x26, quirk_chelsio_extend_vpd); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x30, quirk_chelsio_extend_vpd); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x31, quirk_chelsio_extend_vpd); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x32, quirk_chelsio_extend_vpd); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x35, quirk_chelsio_extend_vpd); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x36, quirk_chelsio_extend_vpd); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x37, quirk_chelsio_extend_vpd); ++ + #ifdef CONFIG_ACPI + /* + * Apple: Shutdown Cactus Ridge Thunderbolt controller. diff --git a/queue-4.9/pci-msi-check-for-null-affinity-mask-in-pci_irq_get_affinity.patch b/queue-4.9/pci-msi-check-for-null-affinity-mask-in-pci_irq_get_affinity.patch new file mode 100644 index 00000000000..626f2fbd585 --- /dev/null +++ b/queue-4.9/pci-msi-check-for-null-affinity-mask-in-pci_irq_get_affinity.patch @@ -0,0 +1,39 @@ +From d1d111e073840b8dbc1ae90ba3fc274736451bdc Mon Sep 17 00:00:00 2001 +From: Jan Beulich +Date: Tue, 8 Nov 2016 00:43:54 -0700 +Subject: PCI/MSI: Check for NULL affinity mask in pci_irq_get_affinity() + +From: Jan Beulich + +commit d1d111e073840b8dbc1ae90ba3fc274736451bdc upstream. + +If msi_setup_entry() fails to allocate an affinity mask, it logs a message +but continues on and allocates an MSI entry with entry->affinity == NULL. + +Check for this case in pci_irq_get_affinity() so we don't try to +dereference a NULL pointer. + +[bhelgaas: changelog] +Fixes: ee8d41e53efe "pci/msi: Retrieve affinity for a vector" +Signed-off-by: Jan Beulich +Signed-off-by: Bjorn Helgaas +Reviewed-by: Christoph Hellwig +CC: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/msi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/pci/msi.c ++++ b/drivers/pci/msi.c +@@ -1294,7 +1294,8 @@ const struct cpumask *pci_irq_get_affini + } else if (dev->msi_enabled) { + struct msi_desc *entry = first_pci_msi_entry(dev); + +- if (WARN_ON_ONCE(!entry || nr >= entry->nvec_used)) ++ if (WARN_ON_ONCE(!entry || !entry->affinity || ++ nr >= entry->nvec_used)) + return NULL; + + return &entry->affinity[nr]; diff --git a/queue-4.9/pci-rockchip-correct-the-use-of-fts-mask.patch b/queue-4.9/pci-rockchip-correct-the-use-of-fts-mask.patch new file mode 100644 index 00000000000..78df1e13bf7 --- /dev/null +++ b/queue-4.9/pci-rockchip-correct-the-use-of-fts-mask.patch @@ -0,0 +1,35 @@ +From a45e2611b9bbd81288d97d02ce7e74a60a698d43 Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Wed, 7 Dec 2016 15:06:00 -0600 +Subject: PCI: rockchip: Correct the use of FTS mask + +From: Brian Norris + +commit a45e2611b9bbd81288d97d02ce7e74a60a698d43 upstream. + +We're trying to mask out bits[23:8] while retaining [32:24, 7:0], but we're +doing the inverse. That doesn't have too much effect, since we're setting +all the [23:8] bits to 1, and the other bits are only relevant for modes +we're currently not using. But we should get this right. + +Fixes: ca1989084054 ("PCI: rockchip: Fix wrong transmitted FTS count") +Signed-off-by: Brian Norris +Signed-off-by: Bjorn Helgaas +Acked-by: Shawn Lin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/host/pcie-rockchip.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/host/pcie-rockchip.c ++++ b/drivers/pci/host/pcie-rockchip.c +@@ -533,7 +533,7 @@ static int rockchip_pcie_init_port(struc + + /* Fix the transmitted FTS count desired to exit from L0s. */ + status = rockchip_pcie_read(rockchip, PCIE_CORE_CTRL_PLC1); +- status = (status & PCIE_CORE_CTRL_PLC1_FTS_MASK) | ++ status = (status & ~PCIE_CORE_CTRL_PLC1_FTS_MASK) | + (PCIE_CORE_CTRL_PLC1_FTS_CNT << PCIE_CORE_CTRL_PLC1_FTS_SHIFT); + rockchip_pcie_write(rockchip, status, PCIE_CORE_CTRL_PLC1); + diff --git a/queue-4.9/pci-rockchip-fix-negotiated-lanes-calculation.patch b/queue-4.9/pci-rockchip-fix-negotiated-lanes-calculation.patch new file mode 100644 index 00000000000..8def0d1e355 --- /dev/null +++ b/queue-4.9/pci-rockchip-fix-negotiated-lanes-calculation.patch @@ -0,0 +1,35 @@ +From 45e9320f3a4ef9588ee50a2eb1891c4bfdbb07df Mon Sep 17 00:00:00 2001 +From: Shawn Lin +Date: Wed, 7 Dec 2016 15:05:59 -0600 +Subject: PCI: rockchip: Fix negotiated lanes calculation + +From: Shawn Lin + +commit 45e9320f3a4ef9588ee50a2eb1891c4bfdbb07df upstream. + +The calculation of negotiated lanes is wrong: it should be shifted by +PCIE_CORE_PL_CONF_LANE_SHIFT, but it is shifted by +PCIE_CORE_PL_CONF_LANE_MASK instead. Let's fix it. + +Fixes: e77f847df54c ("PCI: rockchip: Add Rockchip PCIe controller support") +Signed-off-by: Shawn Lin +Signed-off-by: Bjorn Helgaas +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/host/pcie-rockchip.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/pci/host/pcie-rockchip.c ++++ b/drivers/pci/host/pcie-rockchip.c +@@ -590,8 +590,8 @@ static int rockchip_pcie_init_port(struc + + /* Check the final link width from negotiated lane counter from MGMT */ + status = rockchip_pcie_read(rockchip, PCIE_CORE_CTRL); +- status = 0x1 << ((status & PCIE_CORE_PL_CONF_LANE_MASK) >> +- PCIE_CORE_PL_CONF_LANE_MASK); ++ status = 0x1 << ((status & PCIE_CORE_PL_CONF_LANE_MASK) >> ++ PCIE_CORE_PL_CONF_LANE_SHIFT); + dev_dbg(dev, "current link width is x%d\n", status); + + rockchip_pcie_write(rockchip, ROCKCHIP_VENDOR_ID, diff --git a/queue-4.9/pci-support-intx-masking-on-connectx-4-with-firmware-x.14.1100.patch b/queue-4.9/pci-support-intx-masking-on-connectx-4-with-firmware-x.14.1100.patch new file mode 100644 index 00000000000..b46d733604f --- /dev/null +++ b/queue-4.9/pci-support-intx-masking-on-connectx-4-with-firmware-x.14.1100.patch @@ -0,0 +1,117 @@ +From 1600f62534b7b3da7978b43b52231a54c24df287 Mon Sep 17 00:00:00 2001 +From: Noa Osherovich +Date: Tue, 15 Nov 2016 10:00:00 +0200 +Subject: PCI: Support INTx masking on ConnectX-4 with firmware x.14.1100+ + +From: Noa Osherovich + +commit 1600f62534b7b3da7978b43b52231a54c24df287 upstream. + +Mellanox devices were marked as having INTx masking ability broken. As a +result, the VFIO driver fails to start when more than one device function +is passed-through to a VM if both have the same INTx pin. + +Prior to Connect-IB, Mellanox devices exposed to the operating system one +PCI function per all ports. Starting from Connect-IB, the devices are +function-per-port. When passing the second function to a VM, VFIO will +fail to start. + +Exclude ConnectX-4, ConnectX4-Lx and Connect-IB from the list of Mellanox +devices marked as having broken INTx masking: + +- ConnectX-4 and ConnectX4-LX firmware version is checked. If INTx + masking is supported, we unmark the broken INTx masking. +- Connect-IB does not support INTx currently so will not cause any + problem. + +[bhelgaas: call pci_disable_device() always, after iounmap()] +Fixes: 11e42532ada3 ("PCI: Assume all Mellanox devices have broken INTx masking") +Signed-off-by: Noa Osherovich +Signed-off-by: Bjorn Helgaas +Reviewed-by: Or Gerlitz +Reviewed-by: Gavin Shan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 59 ++++++++++++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 56 insertions(+), 3 deletions(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3209,13 +3209,25 @@ static u16 mellanox_broken_intx_devs[] = + PCI_DEVICE_ID_MELLANOX_CONNECTX2, + PCI_DEVICE_ID_MELLANOX_CONNECTX3, + PCI_DEVICE_ID_MELLANOX_CONNECTX3_PRO, +- PCI_DEVICE_ID_MELLANOX_CONNECTIB, +- PCI_DEVICE_ID_MELLANOX_CONNECTX4, +- PCI_DEVICE_ID_MELLANOX_CONNECTX4_LX, + }; + ++#define CONNECTX_4_CURR_MAX_MINOR 99 ++#define CONNECTX_4_INTX_SUPPORT_MINOR 14 ++ ++/* ++ * Check ConnectX-4/LX FW version to see if it supports legacy interrupts. ++ * If so, don't mark it as broken. ++ * FW minor > 99 means older FW version format and no INTx masking support. ++ * FW minor < 14 means new FW version format and no INTx masking support. ++ */ + static void mellanox_check_broken_intx_masking(struct pci_dev *pdev) + { ++ __be32 __iomem *fw_ver; ++ u16 fw_major; ++ u16 fw_minor; ++ u16 fw_subminor; ++ u32 fw_maj_min; ++ u32 fw_sub_min; + int i; + + for (i = 0; i < ARRAY_SIZE(mellanox_broken_intx_devs); i++) { +@@ -3224,6 +3236,47 @@ static void mellanox_check_broken_intx_m + return; + } + } ++ ++ /* Getting here means Connect-IB cards and up. Connect-IB has no INTx ++ * support so shouldn't be checked further ++ */ ++ if (pdev->device == PCI_DEVICE_ID_MELLANOX_CONNECTIB) ++ return; ++ ++ if (pdev->device != PCI_DEVICE_ID_MELLANOX_CONNECTX4 && ++ pdev->device != PCI_DEVICE_ID_MELLANOX_CONNECTX4_LX) ++ return; ++ ++ /* For ConnectX-4 and ConnectX-4LX, need to check FW support */ ++ if (pci_enable_device_mem(pdev)) { ++ dev_warn(&pdev->dev, "Can't enable device memory\n"); ++ return; ++ } ++ ++ fw_ver = ioremap(pci_resource_start(pdev, 0), 4); ++ if (!fw_ver) { ++ dev_warn(&pdev->dev, "Can't map ConnectX-4 initialization segment\n"); ++ goto out; ++ } ++ ++ /* Reading from resource space should be 32b aligned */ ++ fw_maj_min = ioread32be(fw_ver); ++ fw_sub_min = ioread32be(fw_ver + 1); ++ fw_major = fw_maj_min & 0xffff; ++ fw_minor = fw_maj_min >> 16; ++ fw_subminor = fw_sub_min & 0xffff; ++ if (fw_minor > CONNECTX_4_CURR_MAX_MINOR || ++ fw_minor < CONNECTX_4_INTX_SUPPORT_MINOR) { ++ dev_warn(&pdev->dev, "ConnectX-4: FW %u.%u.%u doesn't support INTx masking, disabling. Please upgrade FW to %d.14.1100 and up for INTx support\n", ++ fw_major, fw_minor, fw_subminor, pdev->device == ++ PCI_DEVICE_ID_MELLANOX_CONNECTX4 ? 12 : 14); ++ pdev->broken_intx_masking = 1; ++ } ++ ++ iounmap(fw_ver); ++ ++out: ++ pci_disable_device(pdev); + } + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MELLANOX, PCI_ANY_ID, + mellanox_check_broken_intx_masking); diff --git a/queue-4.9/platform-x86-fujitsu-laptop-use-brightness_set_blocking-for-led-setting-callbacks.patch b/queue-4.9/platform-x86-fujitsu-laptop-use-brightness_set_blocking-for-led-setting-callbacks.patch new file mode 100644 index 00000000000..c5290dfa9c3 --- /dev/null +++ b/queue-4.9/platform-x86-fujitsu-laptop-use-brightness_set_blocking-for-led-setting-callbacks.patch @@ -0,0 +1,150 @@ +From a608a9d52fa4168efd478d684039ed545a69dbcd Mon Sep 17 00:00:00 2001 +From: Micha? K?pie? +Date: Fri, 23 Dec 2016 10:00:08 +0100 +Subject: platform/x86: fujitsu-laptop: use brightness_set_blocking for LED-setting callbacks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Micha? K?pie? + +commit a608a9d52fa4168efd478d684039ed545a69dbcd upstream. + +All LED-setting functions in fujitsu-laptop are currently assigned to +the brightness_set callback, which is incorrect because they can sleep +(due to their use of call_fext_func(), which in turn issues ACPI calls) +and the documentation (in include/linux/leds.h) clearly states they must +not. Assign them to brightness_set_blocking instead and change them to +match the expected function prototype. + +This change makes it possible to use Fujitsu-specific LEDs with "heavy" +triggers, like disk-activity or phy0rx. + +Fixes: 3a407086090b ("fujitsu-laptop: Add BL power, LED control and radio state information") +Fixes: 4f62568c1fcf ("fujitsu-laptop: Support radio LED") +Fixes: d6b88f64b0d4 ("fujitsu-laptop: Add support for eco LED") +Signed-off-by: Michał Kępień +Acked-by: Jonathan Woithe +Signed-off-by: Andy Shevchenko +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/fujitsu-laptop.c | 42 +++++++++++++++++----------------- + 1 file changed, 21 insertions(+), 21 deletions(-) + +--- a/drivers/platform/x86/fujitsu-laptop.c ++++ b/drivers/platform/x86/fujitsu-laptop.c +@@ -177,43 +177,43 @@ static void acpi_fujitsu_hotkey_notify(s + + #if IS_ENABLED(CONFIG_LEDS_CLASS) + static enum led_brightness logolamp_get(struct led_classdev *cdev); +-static void logolamp_set(struct led_classdev *cdev, ++static int logolamp_set(struct led_classdev *cdev, + enum led_brightness brightness); + + static struct led_classdev logolamp_led = { + .name = "fujitsu::logolamp", + .brightness_get = logolamp_get, +- .brightness_set = logolamp_set ++ .brightness_set_blocking = logolamp_set + }; + + static enum led_brightness kblamps_get(struct led_classdev *cdev); +-static void kblamps_set(struct led_classdev *cdev, ++static int kblamps_set(struct led_classdev *cdev, + enum led_brightness brightness); + + static struct led_classdev kblamps_led = { + .name = "fujitsu::kblamps", + .brightness_get = kblamps_get, +- .brightness_set = kblamps_set ++ .brightness_set_blocking = kblamps_set + }; + + static enum led_brightness radio_led_get(struct led_classdev *cdev); +-static void radio_led_set(struct led_classdev *cdev, ++static int radio_led_set(struct led_classdev *cdev, + enum led_brightness brightness); + + static struct led_classdev radio_led = { + .name = "fujitsu::radio_led", + .brightness_get = radio_led_get, +- .brightness_set = radio_led_set ++ .brightness_set_blocking = radio_led_set + }; + + static enum led_brightness eco_led_get(struct led_classdev *cdev); +-static void eco_led_set(struct led_classdev *cdev, ++static int eco_led_set(struct led_classdev *cdev, + enum led_brightness brightness); + + static struct led_classdev eco_led = { + .name = "fujitsu::eco_led", + .brightness_get = eco_led_get, +- .brightness_set = eco_led_set ++ .brightness_set_blocking = eco_led_set + }; + #endif + +@@ -267,48 +267,48 @@ static int call_fext_func(int cmd, int a + #if IS_ENABLED(CONFIG_LEDS_CLASS) + /* LED class callbacks */ + +-static void logolamp_set(struct led_classdev *cdev, ++static int logolamp_set(struct led_classdev *cdev, + enum led_brightness brightness) + { + if (brightness >= LED_FULL) { + call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_POWERON, FUNC_LED_ON); +- call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_ALWAYS, FUNC_LED_ON); ++ return call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_ALWAYS, FUNC_LED_ON); + } else if (brightness >= LED_HALF) { + call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_POWERON, FUNC_LED_ON); +- call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_ALWAYS, FUNC_LED_OFF); ++ return call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_ALWAYS, FUNC_LED_OFF); + } else { +- call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_POWERON, FUNC_LED_OFF); ++ return call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_POWERON, FUNC_LED_OFF); + } + } + +-static void kblamps_set(struct led_classdev *cdev, ++static int kblamps_set(struct led_classdev *cdev, + enum led_brightness brightness) + { + if (brightness >= LED_FULL) +- call_fext_func(FUNC_LEDS, 0x1, KEYBOARD_LAMPS, FUNC_LED_ON); ++ return call_fext_func(FUNC_LEDS, 0x1, KEYBOARD_LAMPS, FUNC_LED_ON); + else +- call_fext_func(FUNC_LEDS, 0x1, KEYBOARD_LAMPS, FUNC_LED_OFF); ++ return call_fext_func(FUNC_LEDS, 0x1, KEYBOARD_LAMPS, FUNC_LED_OFF); + } + +-static void radio_led_set(struct led_classdev *cdev, ++static int radio_led_set(struct led_classdev *cdev, + enum led_brightness brightness) + { + if (brightness >= LED_FULL) +- call_fext_func(FUNC_RFKILL, 0x5, RADIO_LED_ON, RADIO_LED_ON); ++ return call_fext_func(FUNC_RFKILL, 0x5, RADIO_LED_ON, RADIO_LED_ON); + else +- call_fext_func(FUNC_RFKILL, 0x5, RADIO_LED_ON, 0x0); ++ return call_fext_func(FUNC_RFKILL, 0x5, RADIO_LED_ON, 0x0); + } + +-static void eco_led_set(struct led_classdev *cdev, ++static int eco_led_set(struct led_classdev *cdev, + enum led_brightness brightness) + { + int curr; + + curr = call_fext_func(FUNC_LEDS, 0x2, ECO_LED, 0x0); + if (brightness >= LED_FULL) +- call_fext_func(FUNC_LEDS, 0x1, ECO_LED, curr | ECO_LED_ON); ++ return call_fext_func(FUNC_LEDS, 0x1, ECO_LED, curr | ECO_LED_ON); + else +- call_fext_func(FUNC_LEDS, 0x1, ECO_LED, curr & ~ECO_LED_ON); ++ return call_fext_func(FUNC_LEDS, 0x1, ECO_LED, curr & ~ECO_LED_ON); + } + + static enum led_brightness logolamp_get(struct led_classdev *cdev) diff --git a/queue-4.9/pm-wakeirq-fix-dedicated-wakeirq-for-drivers-not-using-autosuspend.patch b/queue-4.9/pm-wakeirq-fix-dedicated-wakeirq-for-drivers-not-using-autosuspend.patch new file mode 100644 index 00000000000..77ae9f72292 --- /dev/null +++ b/queue-4.9/pm-wakeirq-fix-dedicated-wakeirq-for-drivers-not-using-autosuspend.patch @@ -0,0 +1,257 @@ +From bed570307ed78f21b77cb04a1df781dee4a8f05a Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Mon, 5 Dec 2016 16:38:16 -0800 +Subject: PM / wakeirq: Fix dedicated wakeirq for drivers not using autosuspend + +From: Tony Lindgren + +commit bed570307ed78f21b77cb04a1df781dee4a8f05a upstream. + +I noticed some wakeirq flakeyness with consumer drivers not using +autosuspend. For drivers not using autosuspend, the wakeirq may never +get unmasked in rpm_suspend() because of irq desc->depth. + +We are configuring dedicated wakeirqs to start with IRQ_NOAUTOEN as we +naturally don't want them running until rpm_suspend() is called. + +However, when a consumer driver initially calls pm_runtime_get(), we +now wrongly start with disable_irq_nosync() call on the dedicated +wakeirq that is disabled to start with. + +This causes desc->depth to toggle between 1 and 2 instead of the usual +0 and 1. This can prevent enable_irq() from unmasking the wakeirq as +that only happens at desc->depth 1. + +This does not necessarily show up with drivers using autosuspend as +there is time for disable_irq_nosync() before rpm_suspend() gets called +after the autosuspend timeout. + +Let's fix the issue by adding wirq->status that lazily gets set on +the first rpm_suspend(). We also need PM runtime core private functions +for dev_pm_enable_wake_irq_check() and dev_pm_disable_wake_irq_check() +so we can enable the dedicated wakeirq on the first rpm_suspend(). + +While at it, let's also fix the comments for dev_pm_enable_wake_irq() +and dev_pm_disable_wake_irq(). Those can still be used by the consumer +drivers as needed because the IRQ core manages the interrupt usecount +for us. + +Fixes: 4990d4fe327b (PM / Wakeirq: Add automated device wake IRQ handling) +Signed-off-by: Tony Lindgren +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/power/power.h | 19 ++++++++++ + drivers/base/power/runtime.c | 8 ++-- + drivers/base/power/wakeirq.c | 76 +++++++++++++++++++++++++++++++++++++------ + 3 files changed, 88 insertions(+), 15 deletions(-) + +--- a/drivers/base/power/power.h ++++ b/drivers/base/power/power.h +@@ -21,14 +21,22 @@ extern void pm_runtime_init(struct devic + extern void pm_runtime_reinit(struct device *dev); + extern void pm_runtime_remove(struct device *dev); + ++#define WAKE_IRQ_DEDICATED_ALLOCATED BIT(0) ++#define WAKE_IRQ_DEDICATED_MANAGED BIT(1) ++#define WAKE_IRQ_DEDICATED_MASK (WAKE_IRQ_DEDICATED_ALLOCATED | \ ++ WAKE_IRQ_DEDICATED_MANAGED) ++ + struct wake_irq { + struct device *dev; ++ unsigned int status; + int irq; +- bool dedicated_irq:1; + }; + + extern void dev_pm_arm_wake_irq(struct wake_irq *wirq); + extern void dev_pm_disarm_wake_irq(struct wake_irq *wirq); ++extern void dev_pm_enable_wake_irq_check(struct device *dev, ++ bool can_change_status); ++extern void dev_pm_disable_wake_irq_check(struct device *dev); + + #ifdef CONFIG_PM_SLEEP + +@@ -104,6 +112,15 @@ static inline void dev_pm_disarm_wake_ir + { + } + ++static inline void dev_pm_enable_wake_irq_check(struct device *dev, ++ bool can_change_status) ++{ ++} ++ ++static inline void dev_pm_disable_wake_irq_check(struct device *dev) ++{ ++} ++ + #endif + + #ifdef CONFIG_PM_SLEEP +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -515,7 +515,7 @@ static int rpm_suspend(struct device *de + + callback = RPM_GET_CALLBACK(dev, runtime_suspend); + +- dev_pm_enable_wake_irq(dev); ++ dev_pm_enable_wake_irq_check(dev, true); + retval = rpm_callback(callback, dev); + if (retval) + goto fail; +@@ -554,7 +554,7 @@ static int rpm_suspend(struct device *de + return retval; + + fail: +- dev_pm_disable_wake_irq(dev); ++ dev_pm_disable_wake_irq_check(dev); + __update_runtime_status(dev, RPM_ACTIVE); + dev->power.deferred_resume = false; + wake_up_all(&dev->power.wait_queue); +@@ -737,12 +737,12 @@ static int rpm_resume(struct device *dev + + callback = RPM_GET_CALLBACK(dev, runtime_resume); + +- dev_pm_disable_wake_irq(dev); ++ dev_pm_disable_wake_irq_check(dev); + retval = rpm_callback(callback, dev); + if (retval) { + __update_runtime_status(dev, RPM_SUSPENDED); + pm_runtime_cancel_pending(dev); +- dev_pm_enable_wake_irq(dev); ++ dev_pm_enable_wake_irq_check(dev, false); + } else { + no_callback: + __update_runtime_status(dev, RPM_ACTIVE); +--- a/drivers/base/power/wakeirq.c ++++ b/drivers/base/power/wakeirq.c +@@ -110,8 +110,10 @@ void dev_pm_clear_wake_irq(struct device + dev->power.wakeirq = NULL; + spin_unlock_irqrestore(&dev->power.lock, flags); + +- if (wirq->dedicated_irq) ++ if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED) { + free_irq(wirq->irq, wirq); ++ wirq->status &= ~WAKE_IRQ_DEDICATED_MASK; ++ } + kfree(wirq); + } + EXPORT_SYMBOL_GPL(dev_pm_clear_wake_irq); +@@ -179,7 +181,6 @@ int dev_pm_set_dedicated_wake_irq(struct + + wirq->dev = dev; + wirq->irq = irq; +- wirq->dedicated_irq = true; + irq_set_status_flags(irq, IRQ_NOAUTOEN); + + /* +@@ -195,6 +196,8 @@ int dev_pm_set_dedicated_wake_irq(struct + if (err) + goto err_free_irq; + ++ wirq->status = WAKE_IRQ_DEDICATED_ALLOCATED; ++ + return err; + + err_free_irq: +@@ -210,9 +213,9 @@ EXPORT_SYMBOL_GPL(dev_pm_set_dedicated_w + * dev_pm_enable_wake_irq - Enable device wake-up interrupt + * @dev: Device + * +- * Called from the bus code or the device driver for +- * runtime_suspend() to enable the wake-up interrupt while +- * the device is running. ++ * Optionally called from the bus code or the device driver for ++ * runtime_resume() to override the PM runtime core managed wake-up ++ * interrupt handling to enable the wake-up interrupt. + * + * Note that for runtime_suspend()) the wake-up interrupts + * should be unconditionally enabled unlike for suspend() +@@ -222,7 +225,7 @@ void dev_pm_enable_wake_irq(struct devic + { + struct wake_irq *wirq = dev->power.wakeirq; + +- if (wirq && wirq->dedicated_irq) ++ if (wirq && (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED)) + enable_irq(wirq->irq); + } + EXPORT_SYMBOL_GPL(dev_pm_enable_wake_irq); +@@ -231,20 +234,73 @@ EXPORT_SYMBOL_GPL(dev_pm_enable_wake_irq + * dev_pm_disable_wake_irq - Disable device wake-up interrupt + * @dev: Device + * +- * Called from the bus code or the device driver for +- * runtime_resume() to disable the wake-up interrupt while +- * the device is running. ++ * Optionally called from the bus code or the device driver for ++ * runtime_suspend() to override the PM runtime core managed wake-up ++ * interrupt handling to disable the wake-up interrupt. + */ + void dev_pm_disable_wake_irq(struct device *dev) + { + struct wake_irq *wirq = dev->power.wakeirq; + +- if (wirq && wirq->dedicated_irq) ++ if (wirq && (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED)) + disable_irq_nosync(wirq->irq); + } + EXPORT_SYMBOL_GPL(dev_pm_disable_wake_irq); + + /** ++ * dev_pm_enable_wake_irq_check - Checks and enables wake-up interrupt ++ * @dev: Device ++ * @can_change_status: Can change wake-up interrupt status ++ * ++ * Enables wakeirq conditionally. We need to enable wake-up interrupt ++ * lazily on the first rpm_suspend(). This is needed as the consumer device ++ * starts in RPM_SUSPENDED state, and the the first pm_runtime_get() would ++ * otherwise try to disable already disabled wakeirq. The wake-up interrupt ++ * starts disabled with IRQ_NOAUTOEN set. ++ * ++ * Should be only called from rpm_suspend() and rpm_resume() path. ++ * Caller must hold &dev->power.lock to change wirq->status ++ */ ++void dev_pm_enable_wake_irq_check(struct device *dev, ++ bool can_change_status) ++{ ++ struct wake_irq *wirq = dev->power.wakeirq; ++ ++ if (!wirq || !((wirq->status & WAKE_IRQ_DEDICATED_MASK))) ++ return; ++ ++ if (likely(wirq->status & WAKE_IRQ_DEDICATED_MANAGED)) { ++ goto enable; ++ } else if (can_change_status) { ++ wirq->status |= WAKE_IRQ_DEDICATED_MANAGED; ++ goto enable; ++ } ++ ++ return; ++ ++enable: ++ enable_irq(wirq->irq); ++} ++ ++/** ++ * dev_pm_disable_wake_irq_check - Checks and disables wake-up interrupt ++ * @dev: Device ++ * ++ * Disables wake-up interrupt conditionally based on status. ++ * Should be only called from rpm_suspend() and rpm_resume() path. ++ */ ++void dev_pm_disable_wake_irq_check(struct device *dev) ++{ ++ struct wake_irq *wirq = dev->power.wakeirq; ++ ++ if (!wirq || !((wirq->status & WAKE_IRQ_DEDICATED_MASK))) ++ return; ++ ++ if (wirq->status & WAKE_IRQ_DEDICATED_MANAGED) ++ disable_irq_nosync(wirq->irq); ++} ++ ++/** + * dev_pm_arm_wake_irq - Arm device wake-up + * @wirq: Device wake-up interrupt + * diff --git a/queue-4.9/powerpc-pci-rpadlpar-fix-device-reference-leaks.patch b/queue-4.9/powerpc-pci-rpadlpar-fix-device-reference-leaks.patch new file mode 100644 index 00000000000..2c234b85531 --- /dev/null +++ b/queue-4.9/powerpc-pci-rpadlpar-fix-device-reference-leaks.patch @@ -0,0 +1,48 @@ +From 99e5cde5eae78bef95bfe7c16ccda87fb070149b Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 1 Nov 2016 16:26:03 +0100 +Subject: powerpc/pci/rpadlpar: Fix device reference leaks + +From: Johan Hovold + +commit 99e5cde5eae78bef95bfe7c16ccda87fb070149b upstream. + +Make sure to drop any device reference taken by vio_find_node() when +adding and removing virtual I/O slots. + +Fixes: 5eeb8c63a38f ("[PATCH] PCI Hotplug: rpaphp: Move VIO registration") +Signed-off-by: Johan Hovold +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/hotplug/rpadlpar_core.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/pci/hotplug/rpadlpar_core.c ++++ b/drivers/pci/hotplug/rpadlpar_core.c +@@ -257,8 +257,13 @@ static int dlpar_add_phb(char *drc_name, + + static int dlpar_add_vio_slot(char *drc_name, struct device_node *dn) + { +- if (vio_find_node(dn)) ++ struct vio_dev *vio_dev; ++ ++ vio_dev = vio_find_node(dn); ++ if (vio_dev) { ++ put_device(&vio_dev->dev); + return -EINVAL; ++ } + + if (!vio_register_device_node(dn)) { + printk(KERN_ERR +@@ -334,6 +339,9 @@ static int dlpar_remove_vio_slot(char *d + return -EINVAL; + + vio_unregister_device(vio_dev); ++ ++ put_device(&vio_dev->dev); ++ + return 0; + } + diff --git a/queue-4.9/relay-check-array-offset-before-using-it.patch b/queue-4.9/relay-check-array-offset-before-using-it.patch new file mode 100644 index 00000000000..430b57d0c41 --- /dev/null +++ b/queue-4.9/relay-check-array-offset-before-using-it.patch @@ -0,0 +1,39 @@ +From 9a29d0fbc2d9ad99fb8a981ab72548cc360e9d4c Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 14 Dec 2016 15:05:38 -0800 +Subject: relay: check array offset before using it + +From: Dan Carpenter + +commit 9a29d0fbc2d9ad99fb8a981ab72548cc360e9d4c upstream. + +Smatch complains that we started using the array offset before we +checked that it was valid. + +Fixes: 017c59c042d0 ('relay: Use per CPU constructs for the relay channel buffer pointers') +Link: http://lkml.kernel.org/r/20161013084947.GC16198@mwanda +Signed-off-by: Dan Carpenter +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/relay.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/relay.c ++++ b/kernel/relay.c +@@ -809,11 +809,11 @@ void relay_subbufs_consumed(struct rchan + { + struct rchan_buf *buf; + +- if (!chan) ++ if (!chan || cpu >= NR_CPUS) + return; + + buf = *per_cpu_ptr(chan->buf, cpu); +- if (cpu >= NR_CPUS || !buf || subbufs_consumed > chan->n_subbufs) ++ if (!buf || subbufs_consumed > chan->n_subbufs) + return; + + if (subbufs_consumed > buf->subbufs_produced - buf->subbufs_consumed) diff --git a/queue-4.9/rpmsg-qcom_smd-correct-return-value-for-o_nonblock.patch b/queue-4.9/rpmsg-qcom_smd-correct-return-value-for-o_nonblock.patch new file mode 100644 index 00000000000..98b9d126d63 --- /dev/null +++ b/queue-4.9/rpmsg-qcom_smd-correct-return-value-for-o_nonblock.patch @@ -0,0 +1,31 @@ +From 1d74e7ed5dc1903ac081574a9b6aa94e7ba4ad45 Mon Sep 17 00:00:00 2001 +From: Bjorn Andersson +Date: Thu, 1 Dec 2016 16:59:55 -0800 +Subject: rpmsg: qcom_smd: Correct return value for O_NONBLOCK + +From: Bjorn Andersson + +commit 1d74e7ed5dc1903ac081574a9b6aa94e7ba4ad45 upstream. + +qcom_smd_send() should return -EAGAIN for non-blocking channels with +insufficient space, so that we can propagate this event to user space. + +Fixes: 53e2822e56c7 ("rpmsg: Introduce Qualcomm SMD backend") +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rpmsg/qcom_smd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/rpmsg/qcom_smd.c ++++ b/drivers/rpmsg/qcom_smd.c +@@ -739,7 +739,7 @@ static int __qcom_smd_send(struct qcom_s + + while (qcom_smd_get_tx_avail(channel) < tlen) { + if (!wait) { +- ret = -ENOMEM; ++ ret = -EAGAIN; + goto out; + } + diff --git a/queue-4.9/s390-crypto-unlock-on-error-in-prng_tdes_read.patch b/queue-4.9/s390-crypto-unlock-on-error-in-prng_tdes_read.patch new file mode 100644 index 00000000000..55e3751cf08 --- /dev/null +++ b/queue-4.9/s390-crypto-unlock-on-error-in-prng_tdes_read.patch @@ -0,0 +1,35 @@ +From 9e6e7c74315095fd40f41003850690c711e44420 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 18 Nov 2016 14:11:00 +0300 +Subject: s390/crypto: unlock on error in prng_tdes_read() + +From: Dan Carpenter + +commit 9e6e7c74315095fd40f41003850690c711e44420 upstream. + +We added some new locking but forgot to unlock on error. + +Fixes: 57127645d79d ("s390/zcrypt: Introduce new SHA-512 based Pseudo Random Generator.") +Signed-off-by: Dan Carpenter +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/crypto/prng.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/s390/crypto/prng.c ++++ b/arch/s390/crypto/prng.c +@@ -507,8 +507,10 @@ static ssize_t prng_tdes_read(struct fil + prng_data->prngws.byte_counter += n; + prng_data->prngws.reseed_counter += n; + +- if (copy_to_user(ubuf, prng_data->buf, chunk)) +- return -EFAULT; ++ if (copy_to_user(ubuf, prng_data->buf, chunk)) { ++ ret = -EFAULT; ++ break; ++ } + + nbytes -= chunk; + ret += chunk; diff --git a/queue-4.9/s390-pci-fix-dma-address-calculation-in-map_sg.patch b/queue-4.9/s390-pci-fix-dma-address-calculation-in-map_sg.patch new file mode 100644 index 00000000000..99ef8f10c88 --- /dev/null +++ b/queue-4.9/s390-pci-fix-dma-address-calculation-in-map_sg.patch @@ -0,0 +1,79 @@ +From 6b7df3ce92ac82ec3f4a2953b6fed77da7b38aaa Mon Sep 17 00:00:00 2001 +From: Sebastian Ott +Date: Mon, 7 Nov 2016 15:06:03 +0100 +Subject: s390/pci: fix dma address calculation in map_sg + +From: Sebastian Ott + +commit 6b7df3ce92ac82ec3f4a2953b6fed77da7b38aaa upstream. + +__s390_dma_map_sg maps a dma-contiguous area. Although we only map +whole pages we have to take into account that the area doesn't start +or stop at a page boundary because we use the dma address to loop +over the individual sg entries. Failing to do that might lead to an +access of the wrong sg entry. + +Fixes: ee877b81c6b9 ("s390/pci_dma: improve map_sg") +Reported-and-tested-by: Christoph Raisch +Signed-off-by: Sebastian Ott +Reviewed-by: Gerald Schaefer +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/pci/pci_dma.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/arch/s390/pci/pci_dma.c ++++ b/arch/s390/pci/pci_dma.c +@@ -419,6 +419,7 @@ static int __s390_dma_map_sg(struct devi + size_t size, dma_addr_t *handle, + enum dma_data_direction dir) + { ++ unsigned long nr_pages = PAGE_ALIGN(size) >> PAGE_SHIFT; + struct zpci_dev *zdev = to_zpci(to_pci_dev(dev)); + dma_addr_t dma_addr_base, dma_addr; + int flags = ZPCI_PTE_VALID; +@@ -426,8 +427,7 @@ static int __s390_dma_map_sg(struct devi + unsigned long pa = 0; + int ret; + +- size = PAGE_ALIGN(size); +- dma_addr_base = dma_alloc_address(dev, size >> PAGE_SHIFT); ++ dma_addr_base = dma_alloc_address(dev, nr_pages); + if (dma_addr_base == DMA_ERROR_CODE) + return -ENOMEM; + +@@ -436,26 +436,27 @@ static int __s390_dma_map_sg(struct devi + flags |= ZPCI_TABLE_PROTECTED; + + for (s = sg; dma_addr < dma_addr_base + size; s = sg_next(s)) { +- pa = page_to_phys(sg_page(s)) + s->offset; +- ret = __dma_update_trans(zdev, pa, dma_addr, s->length, flags); ++ pa = page_to_phys(sg_page(s)); ++ ret = __dma_update_trans(zdev, pa, dma_addr, ++ s->offset + s->length, flags); + if (ret) + goto unmap; + +- dma_addr += s->length; ++ dma_addr += s->offset + s->length; + } + ret = __dma_purge_tlb(zdev, dma_addr_base, size, flags); + if (ret) + goto unmap; + + *handle = dma_addr_base; +- atomic64_add(size >> PAGE_SHIFT, &zdev->mapped_pages); ++ atomic64_add(nr_pages, &zdev->mapped_pages); + + return ret; + + unmap: + dma_update_trans(zdev, 0, dma_addr_base, dma_addr - dma_addr_base, + ZPCI_PTE_INVALID); +- dma_free_address(dev, dma_addr_base, size >> PAGE_SHIFT); ++ dma_free_address(dev, dma_addr_base, nr_pages); + zpci_err("map error:\n"); + zpci_err_dma(ret, pa); + return ret; diff --git a/queue-4.9/s390-topology-always-use-s390-specific-sched_domain_topology_level.patch b/queue-4.9/s390-topology-always-use-s390-specific-sched_domain_topology_level.patch new file mode 100644 index 00000000000..a619e14fd6f --- /dev/null +++ b/queue-4.9/s390-topology-always-use-s390-specific-sched_domain_topology_level.patch @@ -0,0 +1,42 @@ +From ebb299a51059017ec253bd30781a83d1f6e11b24 Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Sat, 3 Dec 2016 09:50:16 +0100 +Subject: s390/topology: always use s390 specific sched_domain_topology_level + +From: Heiko Carstens + +commit ebb299a51059017ec253bd30781a83d1f6e11b24 upstream. + +The s390 specific sched_domain_topology_level should always be used, +not only if the machine provides topology information. Luckily this +odd behaviour, that was by accident introduced with git commit +d05d15da18f5 ("s390/topology: delay initialization of topology cpu +masks") has currently no side effect. + +Fixes: d05d15da18f5 ("s390/topology: delay initialization of topology cpumasks") +Signed-off-by: Heiko Carstens +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kernel/topology.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/kernel/topology.c ++++ b/arch/s390/kernel/topology.c +@@ -448,6 +448,7 @@ static int __init s390_topology_init(voi + struct sysinfo_15_1_x *info; + int i; + ++ set_sched_topology(s390_topology); + if (!MACHINE_HAS_TOPOLOGY) + return 0; + tl_info = (struct sysinfo_15_1_x *)__get_free_page(GFP_KERNEL); +@@ -460,7 +461,6 @@ static int __init s390_topology_init(voi + alloc_masks(info, &socket_info, 1); + alloc_masks(info, &book_info, 2); + alloc_masks(info, &drawer_info, 3); +- set_sched_topology(s390_topology); + return 0; + } + early_initcall(s390_topology_init); diff --git a/queue-4.9/sbp-target-fix-second-argument-of-percpu_ida_alloc.patch b/queue-4.9/sbp-target-fix-second-argument-of-percpu_ida_alloc.patch new file mode 100644 index 00000000000..ef8038d4323 --- /dev/null +++ b/queue-4.9/sbp-target-fix-second-argument-of-percpu_ida_alloc.patch @@ -0,0 +1,31 @@ +From 8456066a57940b3884aa080c58b166567dc9de39 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Fri, 18 Nov 2016 15:40:31 -0800 +Subject: sbp-target: Fix second argument of percpu_ida_alloc() + +From: Bart Van Assche + +commit 8456066a57940b3884aa080c58b166567dc9de39 upstream. + +Pass a task state as second argument to percpu_ida_alloc(). + +Fixes: commit 5a3ee221b543 ("sbp-target: Conversion to percpu_ida tag pre-allocation") +Signed-off-by: Bart Van Assche +Cc: Chris Boot +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/sbp/sbp_target.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/target/sbp/sbp_target.c ++++ b/drivers/target/sbp/sbp_target.c +@@ -928,7 +928,7 @@ static struct sbp_target_request *sbp_mg + struct sbp_target_request *req; + int tag; + +- tag = percpu_ida_alloc(&se_sess->sess_tag_pool, GFP_ATOMIC); ++ tag = percpu_ida_alloc(&se_sess->sess_tag_pool, TASK_RUNNING); + if (tag < 0) + return ERR_PTR(-ENOMEM); + diff --git a/queue-4.9/scsi-g_ncr5380-fix-release_region-in-error-handling.patch b/queue-4.9/scsi-g_ncr5380-fix-release_region-in-error-handling.patch new file mode 100644 index 00000000000..2c0a3317ce8 --- /dev/null +++ b/queue-4.9/scsi-g_ncr5380-fix-release_region-in-error-handling.patch @@ -0,0 +1,43 @@ +From 7b93ca43b7e21fbe6fb1a6f4ecce4a2f70f424a0 Mon Sep 17 00:00:00 2001 +From: Ondrej Zary +Date: Fri, 11 Nov 2016 10:00:20 +1100 +Subject: scsi: g_NCR5380: Fix release_region in error handling + +From: Ondrej Zary + +commit 7b93ca43b7e21fbe6fb1a6f4ecce4a2f70f424a0 upstream. + +When a SW-configurable card is specified but not found, the driver +releases wrong region, causing the following message in kernel log: +Trying to free nonexistent resource <0000000000000000-000000000000000f> + +Fix it by assigning base earlier. + +Signed-off-by: Ondrej Zary +Fixes: a8cfbcaec0c1 ("scsi: g_NCR5380: Stop using scsi_module.c") +Signed-off-by: Finn Thain +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/g_NCR5380.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/g_NCR5380.c ++++ b/drivers/scsi/g_NCR5380.c +@@ -170,12 +170,12 @@ static int generic_NCR5380_init_one(stru + if (ports[i]) { + /* At this point we have our region reserved */ + magic_configure(i, 0, magic); /* no IRQ yet */ +- outb(0xc0, ports[i] + 9); +- if (inb(ports[i] + 9) != 0x80) { ++ base = ports[i]; ++ outb(0xc0, base + 9); ++ if (inb(base + 9) != 0x80) { + ret = -ENODEV; + goto out_release; + } +- base = ports[i]; + port_idx = i; + } else + return -EINVAL; diff --git a/queue-4.9/scsi-mvsas-fix-command_active-typo.patch b/queue-4.9/scsi-mvsas-fix-command_active-typo.patch new file mode 100644 index 00000000000..0892b29d2e9 --- /dev/null +++ b/queue-4.9/scsi-mvsas-fix-command_active-typo.patch @@ -0,0 +1,42 @@ +From af15769ffab13d777e55fdef09d0762bf0c249c4 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Wed, 16 Nov 2016 16:08:34 +0100 +Subject: scsi: mvsas: fix command_active typo + +From: Arnd Bergmann + +commit af15769ffab13d777e55fdef09d0762bf0c249c4 upstream. + +gcc-7 notices that the condition in mvs_94xx_command_active looks +suspicious: + +drivers/scsi/mvsas/mv_94xx.c: In function 'mvs_94xx_command_active': +drivers/scsi/mvsas/mv_94xx.c:671:15: error: '<<' in boolean context, did you mean '<' ? [-Werror=int-in-bool-context] + +This was introduced when the mv_printk() statement got added, and leads +to the condition being ignored. This is probably harmless. + +Changing '&&' to '&' makes the code look reasonable, as we check the +command bit before setting and printing it. + +Fixes: a4632aae8b66 ("[SCSI] mvsas: Add new macros and functions") +Signed-off-by: Arnd Bergmann +Reviewed-by: Johannes Thumshirn +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/mvsas/mv_94xx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/mvsas/mv_94xx.c ++++ b/drivers/scsi/mvsas/mv_94xx.c +@@ -668,7 +668,7 @@ static void mvs_94xx_command_active(stru + { + u32 tmp; + tmp = mvs_cr32(mvi, MVS_COMMAND_ACTIVE+(slot_idx >> 3)); +- if (tmp && 1 << (slot_idx % 32)) { ++ if (tmp & 1 << (slot_idx % 32)) { + mv_printk("command active %08X, slot [%x].\n", tmp, slot_idx); + mvs_cw32(mvi, MVS_COMMAND_ACTIVE + (slot_idx >> 3), + 1 << (slot_idx % 32)); diff --git a/queue-4.9/series b/queue-4.9/series index d7ac608fa69..d968515d41a 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -99,3 +99,69 @@ cris-only-build-flash-rescue-image-if-config_etrax_axisflashmap-is-selected.patc efi-efivar_ssdt_load-don-t-return-success-on-allocation-failure.patch clk-renesas-cpg-mssr-fix-inverted-debug-check.patch debugfs-improve-define_debugfs_attribute-for-config_debug_fs.patch +x86-prctl-uapi-remove-ifdef-for-checkpoint_restore.patch +x86-cpu-probe-cpuid-leaf-6-even-when-cpuid_level-6.patch +platform-x86-fujitsu-laptop-use-brightness_set_blocking-for-led-setting-callbacks.patch +hwmon-scpi-fix-module-autoload.patch +hwmon-amc6821-sign-extension-temperature.patch +hwmon-ds620-fix-overflows-seen-when-writing-temperature-limits.patch +hwmon-nct7802-fix-overflows-seen-when-writing-into-limit-attributes.patch +hwmon-g762-fix-overflows-and-crash-seen-when-writing-limit-attributes.patch +hwmon-lm90-fix-temp1_max_alarm-attribute.patch +input-synaptics-rmi4-unlock-on-error.patch +clk-qcom-ipq806x-fix-board-clk-rates.patch +clk-clk-wm831x-fix-a-logic-error.patch +clk-ti-dra7-fix-failed-to-lookup-clock-node-gmac_gmii_ref_clk_div-boot-message.patch +clk-sunxi-ng-sun8i-a23-set-clk_set_rate_parent-for-audio-module-clocks.patch +clk-sunxi-ng-sun8i-h3-set-clk_set_rate_parent-for-audio-module-clocks.patch +clk-imx31-fix-rewritten-input-argument-of-mx31_clocks_init.patch +clk-renesas-mstp-support-8-bit-registers-for-r7s72100.patch +iommu-amd-missing-error-code-in-amd_iommu_init_device.patch +iommu-amd-fix-the-left-value-check-of-cmd-buffer.patch +iommu-vt-d-fix-pasid-table-size-encoding.patch +iommu-vt-d-flush-old-iommu-caches-for-kdump-when-the-device-gets-context-mapped.patch +asoc-lpass-platform-initialize-dma-channel-number.patch +asoc-cht_bsw_rt5645-fix-leftover-kmalloc.patch +asoc-intel-skylake-fix-a-shift-wrapping-bug.patch +asoc-samsung-i2s-fixup-last-irq-unsafe-spin-lock-call.patch +scsi-g_ncr5380-fix-release_region-in-error-handling.patch +scsi-mvsas-fix-command_active-typo.patch +target-iscsi-fix-double-free-in-lio_target_tiqn_addtpg.patch +sbp-target-fix-second-argument-of-percpu_ida_alloc.patch +relay-check-array-offset-before-using-it.patch +ima-fix-memory-leak-in-ima_release_policy.patch +pci-msi-check-for-null-affinity-mask-in-pci_irq_get_affinity.patch +irqchip-bcm7038-l1-implement-irq_cpu_offline-callback.patch +pm-wakeirq-fix-dedicated-wakeirq-for-drivers-not-using-autosuspend.patch +genirq-affinity-fix-node-generation-from-cpumask.patch +mmc-mmc_test-uninitialized-return-value.patch +rpmsg-qcom_smd-correct-return-value-for-o_nonblock.patch +mm-hugetlb.c-use-the-right-pte-val-for-compare-in-hugetlb_cow.patch +docs-rst-fix-latex-durole-renewcommand-with-sphinx-1.3.patch +mm-khugepaged-close-use-after-free-race-during-shmem-collapsing.patch +mm-khugepaged-fix-radix-tree-node-leak-in-shmem-collapse-error-path.patch +mm-compaction-fix-nr_isolated_-stats-for-pfn-based-migration.patch +s390-crypto-unlock-on-error-in-prng_tdes_read.patch +crypto-arm64-sha2-ce-fix-for-big-endian.patch +crypto-arm64-ghash-ce-fix-for-big-endian.patch +crypto-arm-aes-ce-fix-for-big-endian.patch +crypto-arm64-aes-ccm-ce-fix-for-big-endian.patch +crypto-arm64-aes-neon-fix-for-big-endian.patch +crypto-arm64-sha1-ce-fix-for-big-endian.patch +crypto-arm64-aes-xts-ce-fix-for-big-endian.patch +crypto-arm64-aes-ce-fix-for-big-endian.patch +md-md_recovery_needed-is-set-for-mddev-recovery.patch +md-fix-refcount-problem-on-mddev-when-stopping-array.patch +f2fs-remove-percpu_count-due-to-performance-regression.patch +f2fs-hide-a-maybe-uninitialized-warning.patch +staging-media-davinci_vpfe-unlock-on-error-in-vpfe_reqbufs.patch +pci-rockchip-fix-negotiated-lanes-calculation.patch +pci-rockchip-correct-the-use-of-fts-mask.patch +pci-add-mellanox-device-ids.patch +pci-convert-broken-intx-masking-quirks-from-header-to-final.patch +pci-convert-mellanox-broken-intx-quirks-to-be-for-listed-devices-only.patch +pci-support-intx-masking-on-connectx-4-with-firmware-x.14.1100.patch +pci-enable-access-to-non-standard-vpd-for-chelsio-devices-cxgb3.patch +powerpc-pci-rpadlpar-fix-device-reference-leaks.patch +s390-topology-always-use-s390-specific-sched_domain_topology_level.patch +s390-pci-fix-dma-address-calculation-in-map_sg.patch diff --git a/queue-4.9/staging-media-davinci_vpfe-unlock-on-error-in-vpfe_reqbufs.patch b/queue-4.9/staging-media-davinci_vpfe-unlock-on-error-in-vpfe_reqbufs.patch new file mode 100644 index 00000000000..63568a2ea03 --- /dev/null +++ b/queue-4.9/staging-media-davinci_vpfe-unlock-on-error-in-vpfe_reqbufs.patch @@ -0,0 +1,33 @@ +From c4a407b91f4b644145492e28723f9f880efb1da0 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 18 Nov 2016 09:30:24 -0200 +Subject: [media] staging: media: davinci_vpfe: unlock on error in vpfe_reqbufs() + +From: Dan Carpenter + +commit c4a407b91f4b644145492e28723f9f880efb1da0 upstream. + +We should unlock before returning this error code in vpfe_reqbufs(). + +Fixes: 622897da67b3 ("[media] davinci: vpfe: add v4l2 video driver support") + +Signed-off-by: Dan Carpenter +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/media/davinci_vpfe/vpfe_video.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/media/davinci_vpfe/vpfe_video.c ++++ b/drivers/staging/media/davinci_vpfe/vpfe_video.c +@@ -1362,7 +1362,7 @@ static int vpfe_reqbufs(struct file *fil + ret = vb2_queue_init(q); + if (ret) { + v4l2_err(&vpfe_dev->v4l2_dev, "vb2_queue_init() failed\n"); +- return ret; ++ goto unlock_out; + } + + fh->io_allowed = 1; diff --git a/queue-4.9/target-iscsi-fix-double-free-in-lio_target_tiqn_addtpg.patch b/queue-4.9/target-iscsi-fix-double-free-in-lio_target_tiqn_addtpg.patch new file mode 100644 index 00000000000..b74c622aef8 --- /dev/null +++ b/queue-4.9/target-iscsi-fix-double-free-in-lio_target_tiqn_addtpg.patch @@ -0,0 +1,35 @@ +From a91918cd3ea11f91c68e08e1e8ce1b560447a80e Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 13 Dec 2016 15:27:04 +0300 +Subject: target/iscsi: Fix double free in lio_target_tiqn_addtpg() + +From: Dan Carpenter + +commit a91918cd3ea11f91c68e08e1e8ce1b560447a80e upstream. + +This iscsit_tpg_add_portal_group() function is only called from +lio_target_tiqn_addtpg(). Both functions free the "tpg" pointer on +error so it's a double free bug. The memory is allocated in the caller +so it should be freed in the caller and not here. + +Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1") +Signed-off-by: Dan Carpenter +Reviewed-by: David Disseldorp +[ bvanassche: Added "Fix" at start of patch title ] +Signed-off-by: Bart Van Assche +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target_tpg.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/target/iscsi/iscsi_target_tpg.c ++++ b/drivers/target/iscsi/iscsi_target_tpg.c +@@ -260,7 +260,6 @@ err_out: + iscsi_release_param_list(tpg->param_list); + tpg->param_list = NULL; + } +- kfree(tpg); + return -ENOMEM; + } + diff --git a/queue-4.9/x86-cpu-probe-cpuid-leaf-6-even-when-cpuid_level-6.patch b/queue-4.9/x86-cpu-probe-cpuid-leaf-6-even-when-cpuid_level-6.patch new file mode 100644 index 00000000000..18efa14f2eb --- /dev/null +++ b/queue-4.9/x86-cpu-probe-cpuid-leaf-6-even-when-cpuid_level-6.patch @@ -0,0 +1,44 @@ +From 3df8d9208569ef0b2313e516566222d745f3b94b Mon Sep 17 00:00:00 2001 +From: Andy Lutomirski +Date: Thu, 15 Dec 2016 10:14:42 -0800 +Subject: x86/cpu: Probe CPUID leaf 6 even when cpuid_level == 6 + +From: Andy Lutomirski + +commit 3df8d9208569ef0b2313e516566222d745f3b94b upstream. + +A typo (or mis-merge?) resulted in leaf 6 only being probed if +cpuid_level >= 7. + +Fixes: 2ccd71f1b278 ("x86/cpufeature: Move some of the scattered feature bits to x86_capability") +Signed-off-by: Andy Lutomirski +Acked-by: Borislav Petkov +Cc: Brian Gerst +Link: http://lkml.kernel.org/r/6ea30c0e9daec21e488b54761881a6dfcf3e04d0.1481825597.git.luto@kernel.org +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/common.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -667,13 +667,14 @@ void get_cpu_cap(struct cpuinfo_x86 *c) + c->x86_capability[CPUID_1_EDX] = edx; + } + ++ /* Thermal and Power Management Leaf: level 0x00000006 (eax) */ ++ if (c->cpuid_level >= 0x00000006) ++ c->x86_capability[CPUID_6_EAX] = cpuid_eax(0x00000006); ++ + /* Additional Intel-defined flags: level 0x00000007 */ + if (c->cpuid_level >= 0x00000007) { + cpuid_count(0x00000007, 0, &eax, &ebx, &ecx, &edx); +- + c->x86_capability[CPUID_7_0_EBX] = ebx; +- +- c->x86_capability[CPUID_6_EAX] = cpuid_eax(0x00000006); + c->x86_capability[CPUID_7_ECX] = ecx; + } + diff --git a/queue-4.9/x86-prctl-uapi-remove-ifdef-for-checkpoint_restore.patch b/queue-4.9/x86-prctl-uapi-remove-ifdef-for-checkpoint_restore.patch new file mode 100644 index 00000000000..5e47606652a --- /dev/null +++ b/queue-4.9/x86-prctl-uapi-remove-ifdef-for-checkpoint_restore.patch @@ -0,0 +1,57 @@ +From a01aa6c9f40fe03c82032e7f8b3bcf1e6c93ac0e Mon Sep 17 00:00:00 2001 +From: Dmitry Safonov +Date: Thu, 27 Oct 2016 17:15:15 +0300 +Subject: x86/prctl/uapi: Remove #ifdef for CHECKPOINT_RESTORE + +From: Dmitry Safonov + +commit a01aa6c9f40fe03c82032e7f8b3bcf1e6c93ac0e upstream. + +As userspace knows nothing about kernel config, thus #ifdefs +around ABI prctl constants makes them invisible to userspace. + +Let it be clean'n'simple: remove #ifdefs. + +If kernel has CONFIG_CHECKPOINT_RESTORE disabled, sys_prctl() +will return -EINVAL for those prctls. + +Reported-by: Paul Bolle +Signed-off-by: Dmitry Safonov +Acked-by: Andy Lutomirski +Cc: 0x7f454c46@gmail.com +Cc: Borislav Petkov +Cc: Brian Gerst +Cc: Cyrill Gorcunov +Cc: Denys Vlasenko +Cc: H. Peter Anvin +Cc: Josh Poimboeuf +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: linux-mm@kvack.org +Cc: oleg@redhat.com +Fixes: 2eefd8789698 ("x86/arch_prctl/vdso: Add ARCH_MAP_VDSO_*") +Link: http://lkml.kernel.org/r/20161027141516.28447-2-dsafonov@virtuozzo.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/uapi/asm/prctl.h | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +--- a/arch/x86/include/uapi/asm/prctl.h ++++ b/arch/x86/include/uapi/asm/prctl.h +@@ -6,10 +6,8 @@ + #define ARCH_GET_FS 0x1003 + #define ARCH_GET_GS 0x1004 + +-#ifdef CONFIG_CHECKPOINT_RESTORE +-# define ARCH_MAP_VDSO_X32 0x2001 +-# define ARCH_MAP_VDSO_32 0x2002 +-# define ARCH_MAP_VDSO_64 0x2003 +-#endif ++#define ARCH_MAP_VDSO_X32 0x2001 ++#define ARCH_MAP_VDSO_32 0x2002 ++#define ARCH_MAP_VDSO_64 0x2003 + + #endif /* _ASM_X86_PRCTL_H */ -- 2.47.3