--- /dev/null
+From b3a834b1596ac668df206aa2bb1f191c31f5f5e4 Mon Sep 17 00:00:00 2001
+From: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Date: Mon, 16 May 2016 09:54:47 -0600
+Subject: blk-mq: fix undefined behaviour in order_to_size()
+
+From: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+
+commit b3a834b1596ac668df206aa2bb1f191c31f5f5e4 upstream.
+
+When this_order variable in blk_mq_init_rq_map() becomes zero
+the code incorrectly decrements the variable and passes the result
+to order_to_size() helper causing undefined behaviour:
+
+ UBSAN: Undefined behaviour in block/blk-mq.c:1459:27
+ shift exponent 4294967295 is too large for 32-bit type 'unsigned int'
+ CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.6.0-rc6-00072-g33656a1 #22
+
+Fix the code by checking this_order variable for not having the zero
+value first.
+
+Reported-by: Meelis Roos <mroos@linux.ee>
+Fixes: 320ae51feed5 ("blk-mq: new multi-queue block IO queueing mechanism")
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-mq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1491,7 +1491,7 @@ static struct blk_mq_tags *blk_mq_init_r
+ int to_do;
+ void *p;
+
+- while (left < order_to_size(this_order - 1) && this_order)
++ while (this_order && left < order_to_size(this_order - 1))
+ this_order--;
+
+ do {
--- /dev/null
+From 8d09e6b8b9c9969ac59496dc21e10b67fe727e7e Mon Sep 17 00:00:00 2001
+From: Hariprasad Shenai <hariprasad@chelsio.com>
+Date: Thu, 28 Jul 2016 13:28:57 +0530
+Subject: cxgb4/cxgb4vf: Fixes regression in perf when tx vlan offload is disabled
+
+From: Hariprasad Shenai <hariprasad@chelsio.com>
+
+commit 8d09e6b8b9c9969ac59496dc21e10b67fe727e7e upstream.
+
+The commit 637d3e997351 ("cxgb4: Discard the packet if the length is
+greater than mtu") introduced a regression in the VLAN interface
+performance when Tx VLAN offload is disabled.
+
+Check if skb is tagged, regardless of whether it is hardware accelerated
+or not. Presently we were checking only for hardware acclereated one,
+which caused performance to drop to ~0.17Mbps on a 10GbE adapter for
+VLAN interface, when tx vlan offload is turned off using ethtool.
+The ethernet head length calculation was going wrong in this case, and
+driver ended up dropping packets.
+
+Fixes: 637d3e997351 ("cxgb4: Discard the packet if the length is greater than mtu")
+Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/chelsio/cxgb4/sge.c | 2 +-
+ drivers/net/ethernet/chelsio/cxgb4vf/sge.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
+@@ -1165,7 +1165,7 @@ out_free: dev_kfree_skb_any(skb);
+
+ /* Discard the packet if the length is greater than mtu */
+ max_pkt_len = ETH_HLEN + dev->mtu;
+- if (skb_vlan_tag_present(skb))
++ if (skb_vlan_tagged(skb))
+ max_pkt_len += VLAN_HLEN;
+ if (!skb_shinfo(skb)->gso_size && (unlikely(skb->len > max_pkt_len)))
+ goto out_free;
+--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
++++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+@@ -1188,7 +1188,7 @@ int t4vf_eth_xmit(struct sk_buff *skb, s
+
+ /* Discard the packet if the length is greater than mtu */
+ max_pkt_len = ETH_HLEN + dev->mtu;
+- if (skb_vlan_tag_present(skb))
++ if (skb_vlan_tagged(skb))
+ max_pkt_len += VLAN_HLEN;
+ if (!skb_shinfo(skb)->gso_size && (unlikely(skb->len > max_pkt_len)))
+ goto out_free;
--- /dev/null
+From bd9f55ea1cf6e14eb054b06ea877d2d1fa339514 Mon Sep 17 00:00:00 2001
+From: Tahsin Erdogan <tahsin@google.com>
+Date: Fri, 15 Jul 2016 06:27:08 -0700
+Subject: dm: fix second blk_delay_queue() parameter to be in msec units not jiffies
+
+From: Tahsin Erdogan <tahsin@google.com>
+
+commit bd9f55ea1cf6e14eb054b06ea877d2d1fa339514 upstream.
+
+Commit d548b34b062 ("dm: reduce the queue delay used in dm_request_fn
+from 100ms to 10ms") always intended the value to be 10 msecs -- it
+just expressed it in jiffies because earlier commit 7eaceaccab ("block:
+remove per-queue plugging") did.
+
+Signed-off-by: Tahsin Erdogan <tahsin@google.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Fixes: d548b34b062 ("dm: reduce the queue delay used in dm_request_fn from 100ms to 10ms")
+Cc: stable@vger.kernel.org # 4.1+ -- stable@ backports must be applied to drivers/md/dm.c
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -2192,7 +2192,7 @@ static void dm_request_fn(struct request
+ goto out;
+
+ delay_and_out:
+- blk_delay_queue(q, HZ / 100);
++ blk_delay_queue(q, 10);
+ out:
+ dm_put_live_table(md, srcu_idx);
+ }
--- /dev/null
+From 4fa2d09c1ae879c2ee2760ab419a4f97026dd97b Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Wed, 16 Dec 2015 15:19:05 +0200
+Subject: dmaengine: edma: Add probe callback to edma_tptc_driver
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+commit 4fa2d09c1ae879c2ee2760ab419a4f97026dd97b upstream.
+
+Due to changes in device and platform code drivers w/o probe will fail to
+load. This means that the devices for eDMA TPTCs are goign to be without
+driver and omap hwmod code will turn them off after the kernel finished
+loading:
+[ 3.015900] platform 49800000.tptc: omap_device_late_idle: enabled but no driver. Idling
+[ 3.024671] platform 49a00000.tptc: omap_device_late_idle: enabled but no driver. Idling
+
+This will prevent eDMA to work since the TPTCs are not enabled.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Fixes: 34635b1accb9 ("dmaengine: edma: Add dummy driver skeleton for edma3-tptc")
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/edma.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/dma/edma.c
++++ b/drivers/dma/edma.c
+@@ -2439,7 +2439,13 @@ static struct platform_driver edma_drive
+ },
+ };
+
++static int edma_tptc_probe(struct platform_device *pdev)
++{
++ return 0;
++}
++
+ static struct platform_driver edma_tptc_driver = {
++ .probe = edma_tptc_probe,
+ .driver = {
+ .name = "edma3-tptc",
+ .of_match_table = edma_tptc_of_ids,
--- /dev/null
+From a93a99838248bdab49db2eaac00236847670bc7f Mon Sep 17 00:00:00 2001
+From: Junxiao Bi <junxiao.bi@oracle.com>
+Date: Tue, 22 Dec 2015 08:06:08 -0600
+Subject: gfs2: fix flock panic issue
+
+From: Junxiao Bi <junxiao.bi@oracle.com>
+
+commit a93a99838248bdab49db2eaac00236847670bc7f upstream.
+
+Commit 4f6563677ae8 ("Move locks API users to locks_lock_inode_wait()")
+moved flock/posix lock identify code to locks_lock_inode_wait(), but
+missed to set fl_flags to FL_FLOCK which will cause kernel panic in
+locks_lock_inode_wait().
+
+Fixes: 4f6563677ae8 ("Move locks API users to locks_lock_inode_wait()")
+Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/gfs2/file.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/fs/gfs2/file.c
++++ b/fs/gfs2/file.c
+@@ -1035,7 +1035,10 @@ static int do_flock(struct file *file, i
+ if (fl_gh->gh_state == state)
+ goto out;
+ locks_lock_file_wait(file,
+- &(struct file_lock){.fl_type = F_UNLCK});
++ &(struct file_lock) {
++ .fl_type = F_UNLCK,
++ .fl_flags = FL_FLOCK
++ });
+ gfs2_glock_dq(fl_gh);
+ gfs2_holder_reinit(state, flags, fl_gh);
+ } else {
--- /dev/null
+From 65fa40276ac1318e75264e5a204547b57c2cf397 Mon Sep 17 00:00:00 2001
+From: Vivien Didelot <vivien.didelot@gmail.com>
+Date: Thu, 14 Apr 2016 14:42:07 -0400
+Subject: net: dsa: mv88e6xxx: unlock DSA and CPU ports
+
+From: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+
+commit 65fa40276ac1318e75264e5a204547b57c2cf397 upstream.
+
+Locking a port generates an hardware interrupt when a new SA address is
+received. This enables CPU directed learning, which is needed for 802.1X
+MAC authentication.
+
+To disable automatic learning on a port, the only configuration needed
+is to set its Port Association Vector to all zero.
+
+Clear PAV when SA learning should be disabled instead of locking a port.
+
+Fixes: 4c7ea3c0791e ("net: dsa: mv88e6xxx: disable SA learning for DSA and CPU ports")
+Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/dsa/mv88e6xxx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/mv88e6xxx.c
++++ b/drivers/net/dsa/mv88e6xxx.c
+@@ -2066,7 +2066,7 @@ static int mv88e6xxx_setup_port(struct d
+ reg = 1 << port;
+ /* Disable learning for DSA and CPU ports */
+ if (dsa_is_cpu_port(ds, port) || dsa_is_dsa_port(ds, port))
+- reg = PORT_ASSOC_VECTOR_LOCKED_PORT;
++ reg = 0;
+
+ ret = _mv88e6xxx_reg_write(ds, REG_PORT(port), PORT_ASSOC_VECTOR, reg);
+ if (ret)
--- /dev/null
+From bc7cc5999fd392cc799630d7e375b2f4e29cc398 Mon Sep 17 00:00:00 2001
+From: Simon Horman <simon.horman@netronome.com>
+Date: Mon, 30 May 2016 14:04:25 +0900
+Subject: openvswitch: update checksum in {push,pop}_mpls
+
+From: Simon Horman <simon.horman@netronome.com>
+
+commit bc7cc5999fd392cc799630d7e375b2f4e29cc398 upstream.
+
+In the case of CHECKSUM_COMPLETE the skb checksum should be updated in
+{push,pop}_mpls() as they the type in the ethernet header.
+
+As suggested by Pravin Shelar.
+
+Cc: Pravin Shelar <pshelar@nicira.com>
+Fixes: 25cd9ba0abc0 ("openvswitch: Add basic MPLS support to kernel")
+Signed-off-by: Simon Horman <simon.horman@netronome.com>
+Acked-by: Pravin B Shelar <pshelar@ovn.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/openvswitch/actions.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+--- a/net/openvswitch/actions.c
++++ b/net/openvswitch/actions.c
+@@ -137,11 +137,23 @@ static bool is_flow_key_valid(const stru
+ return !!key->eth.type;
+ }
+
++static void update_ethertype(struct sk_buff *skb, struct ethhdr *hdr,
++ __be16 ethertype)
++{
++ if (skb->ip_summed == CHECKSUM_COMPLETE) {
++ __be16 diff[] = { ~(hdr->h_proto), ethertype };
++
++ skb->csum = ~csum_partial((char *)diff, sizeof(diff),
++ ~skb->csum);
++ }
++
++ hdr->h_proto = ethertype;
++}
++
+ static int push_mpls(struct sk_buff *skb, struct sw_flow_key *key,
+ const struct ovs_action_push_mpls *mpls)
+ {
+ __be32 *new_mpls_lse;
+- struct ethhdr *hdr;
+
+ /* Networking stack do not allow simultaneous Tunnel and MPLS GSO. */
+ if (skb->encapsulation)
+@@ -160,9 +172,7 @@ static int push_mpls(struct sk_buff *skb
+
+ skb_postpush_rcsum(skb, new_mpls_lse, MPLS_HLEN);
+
+- hdr = eth_hdr(skb);
+- hdr->h_proto = mpls->mpls_ethertype;
+-
++ update_ethertype(skb, eth_hdr(skb), mpls->mpls_ethertype);
+ if (!skb->inner_protocol)
+ skb_set_inner_protocol(skb, skb->protocol);
+ skb->protocol = mpls->mpls_ethertype;
+@@ -193,7 +203,7 @@ static int pop_mpls(struct sk_buff *skb,
+ * field correctly in the presence of VLAN tags.
+ */
+ hdr = (struct ethhdr *)(skb_mpls_header(skb) - ETH_HLEN);
+- hdr->h_proto = ethertype;
++ update_ethertype(skb, hdr, ethertype);
+ if (eth_p_mpls(skb->protocol))
+ skb->protocol = ethertype;
+
--- /dev/null
+From 68e80dae09033d778b98dc88e5bfe8fdade188e5 Mon Sep 17 00:00:00 2001
+From: Viresh Kumar <viresh.kumar@linaro.org>
+Date: Tue, 9 Feb 2016 09:01:35 +0530
+Subject: Revert "cpufreq: Drop rwsem lock around CPUFREQ_GOV_POLICY_EXIT"
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+commit 68e80dae09033d778b98dc88e5bfe8fdade188e5 upstream.
+
+Earlier, when the struct freq-attr was used to represent governor
+attributes, the standard cpufreq show/store sysfs attribute callbacks
+were applied to the governor tunable attributes and they always acquire
+the policy->rwsem lock before carrying out the operation. That could
+have resulted in an ABBA deadlock if governor tunable attributes are
+removed under policy->rwsem while one of them is being accessed
+concurrently (if sysfs attributes removal wins the race, it will wait
+for the access to complete with policy->rwsem held while the attribute
+callback will block on policy->rwsem indefinitely).
+
+We attempted to address this issue by dropping policy->rwsem around
+governor tunable attributes removal (that is, around invocations of the
+->governor callback with the event arg equal to CPUFREQ_GOV_POLICY_EXIT)
+in cpufreq_set_policy(), but that opened up race conditions that had not
+been possible with policy->rwsem held all the time.
+
+The previous commit, "cpufreq: governor: New sysfs show/store callbacks
+for governor tunables", fixed the original ABBA deadlock by adding new
+governor specific show/store callbacks.
+
+We don't have to drop rwsem around invocations of governor event
+CPUFREQ_GOV_POLICY_EXIT anymore, and original fix can be reverted now.
+
+Fixes: 955ef4833574 (cpufreq: Drop rwsem lock around CPUFREQ_GOV_POLICY_EXIT)
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Reported-by: Juri Lelli <juri.lelli@arm.com>
+Tested-by: Juri Lelli <juri.lelli@arm.com>
+Tested-by: Shilpasri G Bhat <shilpa.bhat@linux.vnet.ibm.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/cpufreq.c | 5 -----
+ include/linux/cpufreq.h | 4 ----
+ 2 files changed, 9 deletions(-)
+
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -2171,10 +2171,7 @@ static int cpufreq_set_policy(struct cpu
+ return ret;
+ }
+
+- up_write(&policy->rwsem);
+ ret = __cpufreq_governor(policy, CPUFREQ_GOV_POLICY_EXIT);
+- down_write(&policy->rwsem);
+-
+ if (ret) {
+ pr_err("%s: Failed to Exit Governor: %s (%d)\n",
+ __func__, old_gov->name, ret);
+@@ -2190,9 +2187,7 @@ static int cpufreq_set_policy(struct cpu
+ if (!ret)
+ goto out;
+
+- up_write(&policy->rwsem);
+ __cpufreq_governor(policy, CPUFREQ_GOV_POLICY_EXIT);
+- down_write(&policy->rwsem);
+ }
+
+ /* new governor failed, so re-start old one */
+--- a/include/linux/cpufreq.h
++++ b/include/linux/cpufreq.h
+@@ -100,10 +100,6 @@ struct cpufreq_policy {
+ * - Any routine that will write to the policy structure and/or may take away
+ * the policy altogether (eg. CPU hotplug), will hold this lock in write
+ * mode before doing so.
+- *
+- * Additional rules:
+- * - Lock should not be held across
+- * __cpufreq_governor(data, CPUFREQ_GOV_POLICY_EXIT);
+ */
+ struct rw_semaphore rwsem;
+
alsa-fm801-initialize-chip-after-irq-handler-is-registered.patch
bonding-fix-length-of-actor-system.patch
mips-perf-remove-incorrect-odd-even-counter-handling-for-i6400.patch
+revert-cpufreq-drop-rwsem-lock-around-cpufreq_gov_policy_exit.patch
+net-dsa-mv88e6xxx-unlock-dsa-and-cpu-ports.patch
+gfs2-fix-flock-panic-issue.patch
+blk-mq-fix-undefined-behaviour-in-order_to_size.patch
+dm-fix-second-blk_delay_queue-parameter-to-be-in-msec-units-not-jiffies.patch
+dmaengine-edma-add-probe-callback-to-edma_tptc_driver.patch
+spi-rockchip-modify-dma-max-burst-to-1.patch
+openvswitch-update-checksum-in-push-pop-_mpls.patch
+cxgb4-cxgb4vf-fixes-regression-in-perf-when-tx-vlan-offload-is-disabled.patch
--- /dev/null
+From 80abf8880cc6e1594c11b7c417f22dde60e25312 Mon Sep 17 00:00:00 2001
+From: Addy Ke <addy.ke@rock-chips.com>
+Date: Fri, 22 Jan 2016 19:06:52 +0800
+Subject: spi: rockchip: modify DMA max burst to 1
+
+From: Addy Ke <addy.ke@rock-chips.com>
+
+commit 80abf8880cc6e1594c11b7c417f22dde60e25312 upstream.
+
+Generic dma controller on Rockchips' platform cannot support
+DMAFLUSHP instruction which make dma to flush the req of non-aligned
+or non-multiple of what we need. That will cause an unrecoverable
+dma bus error. The saftest way is to set dma max burst to 1.
+
+Signed-off-by: Addy ke <addy.ke@rock-chips.com>
+Fixes: 64e36824b32b06 ("spi/rockchip: add driver for Rockchip...")
+Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
+cc: Heiko Stuebner <heiko@sntech.de>
+cc: Olof Johansson <olof@lixom.net>
+cc: Doug Anderson <dianders@chromium.org>
+cc: Sonny Rao <sonnyrao@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+Acked-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Caesar Wang <wxt@rock-chips.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+
+---
+ drivers/spi/spi-rockchip.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/spi/spi-rockchip.c
++++ b/drivers/spi/spi-rockchip.c
+@@ -199,6 +199,7 @@ struct rockchip_spi {
+ struct sg_table rx_sg;
+ struct rockchip_spi_dma_data dma_rx;
+ struct rockchip_spi_dma_data dma_tx;
++ struct dma_slave_caps dma_caps;
+ };
+
+ static inline void spi_enable_chip(struct rockchip_spi *rs, int enable)
+@@ -457,7 +458,10 @@ static void rockchip_spi_prepare_dma(str
+ rxconf.direction = rs->dma_rx.direction;
+ rxconf.src_addr = rs->dma_rx.addr;
+ rxconf.src_addr_width = rs->n_bytes;
+- rxconf.src_maxburst = rs->n_bytes;
++ if (rs->dma_caps.max_burst > 4)
++ rxconf.src_maxburst = 4;
++ else
++ rxconf.src_maxburst = 1;
+ dmaengine_slave_config(rs->dma_rx.ch, &rxconf);
+
+ rxdesc = dmaengine_prep_slave_sg(
+@@ -474,7 +478,10 @@ static void rockchip_spi_prepare_dma(str
+ txconf.direction = rs->dma_tx.direction;
+ txconf.dst_addr = rs->dma_tx.addr;
+ txconf.dst_addr_width = rs->n_bytes;
+- txconf.dst_maxburst = rs->n_bytes;
++ if (rs->dma_caps.max_burst > 4)
++ txconf.dst_maxburst = 4;
++ else
++ txconf.dst_maxburst = 1;
+ dmaengine_slave_config(rs->dma_tx.ch, &txconf);
+
+ txdesc = dmaengine_prep_slave_sg(
+@@ -738,6 +745,7 @@ static int rockchip_spi_probe(struct pla
+ }
+
+ if (rs->dma_tx.ch && rs->dma_rx.ch) {
++ dma_get_slave_caps(rs->dma_rx.ch, &(rs->dma_caps));
+ rs->dma_tx.addr = (dma_addr_t)(mem->start + ROCKCHIP_SPI_TXDR);
+ rs->dma_rx.addr = (dma_addr_t)(mem->start + ROCKCHIP_SPI_RXDR);
+ rs->dma_tx.direction = DMA_MEM_TO_DEV;
projects / thirdparty / kernel / stable-queue.git / commitdiff
