--- /dev/null
+From foo@baz Thu Jun 15 13:06:48 CEST 2017
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Tue, 10 Jan 2017 09:44:54 -0200
+Subject: [media] cec: fix wrong last_la determination
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+
+[ Upstream commit f9f96fc10c09ca16e336854c08bc1563eed97985 ]
+
+Due to an incorrect condition the last_la used for the initial attempt at
+claiming a logical address could be wrong.
+
+The last_la wasn't converted to a mask when ANDing with type2mask, so that
+test was broken.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/media/cec/cec-adap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/media/cec/cec-adap.c
++++ b/drivers/staging/media/cec/cec-adap.c
+@@ -1017,7 +1017,7 @@ static int cec_config_thread_func(void *
+ las->log_addr[i] = CEC_LOG_ADDR_INVALID;
+ if (last_la == CEC_LOG_ADDR_INVALID ||
+ last_la == CEC_LOG_ADDR_UNREGISTERED ||
+- !(last_la & type2mask[type]))
++ !((1 << last_la) & type2mask[type]))
+ last_la = la_list[0];
+
+ err = cec_config_log_addr(adap, i, last_la);
--- /dev/null
+From foo@baz Thu Jun 15 13:06:48 CEST 2017
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Tue, 23 May 2017 21:54:09 -0400
+Subject: drm/nouveau/fence/g84-: protect against concurrent access to semaphore buffers
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+
+[ Upstream commit 96692b097ba76d0c637ae8af47b29c73da33c9d0 ]
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_fence.h | 1 +
+ drivers/gpu/drm/nouveau/nv84_fence.c | 6 ++++++
+ 2 files changed, 7 insertions(+)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_fence.h
++++ b/drivers/gpu/drm/nouveau/nouveau_fence.h
+@@ -100,6 +100,7 @@ struct nv84_fence_priv {
+ struct nouveau_bo *bo;
+ struct nouveau_bo *bo_gart;
+ u32 *suspend;
++ struct mutex mutex;
+ };
+
+ u64 nv84_fence_crtc(struct nouveau_channel *, int);
+--- a/drivers/gpu/drm/nouveau/nv84_fence.c
++++ b/drivers/gpu/drm/nouveau/nv84_fence.c
+@@ -121,8 +121,10 @@ nv84_fence_context_del(struct nouveau_ch
+ }
+
+ nouveau_bo_wr32(priv->bo, chan->chid * 16 / 4, fctx->base.sequence);
++ mutex_lock(&priv->mutex);
+ nouveau_bo_vma_del(priv->bo, &fctx->vma_gart);
+ nouveau_bo_vma_del(priv->bo, &fctx->vma);
++ mutex_unlock(&priv->mutex);
+ nouveau_fence_context_del(&fctx->base);
+ chan->fence = NULL;
+ nouveau_fence_context_free(&fctx->base);
+@@ -148,11 +150,13 @@ nv84_fence_context_new(struct nouveau_ch
+ fctx->base.sync32 = nv84_fence_sync32;
+ fctx->base.sequence = nv84_fence_read(chan);
+
++ mutex_lock(&priv->mutex);
+ ret = nouveau_bo_vma_add(priv->bo, cli->vm, &fctx->vma);
+ if (ret == 0) {
+ ret = nouveau_bo_vma_add(priv->bo_gart, cli->vm,
+ &fctx->vma_gart);
+ }
++ mutex_unlock(&priv->mutex);
+
+ /* map display semaphore buffers into channel's vm */
+ for (i = 0; !ret && i < chan->drm->dev->mode_config.num_crtc; i++) {
+@@ -232,6 +236,8 @@ nv84_fence_create(struct nouveau_drm *dr
+ priv->base.context_base = fence_context_alloc(priv->base.contexts);
+ priv->base.uevent = true;
+
++ mutex_init(&priv->mutex);
++
+ /* Use VRAM if there is any ; otherwise fallback to system memory */
+ domain = drm->device.info.ram_size != 0 ? TTM_PL_FLAG_VRAM :
+ /*
--- /dev/null
+From foo@baz Thu Jun 15 13:06:48 CEST 2017
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Sun, 18 Dec 2016 14:35:45 +0100
+Subject: drm: prevent double-(un)registration for connectors
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+
+[ Upstream commit e73ab00e9a0f1731f34d0620a9c55f5c30c4ad4e ]
+
+If we're unlucky then the registration from a hotplugged connector
+might race with the final registration step on driver load. And since
+MST topology discover is asynchronous that's even somewhat likely.
+
+v2: Also update the kerneldoc for @registered!
+
+v3: Review from Chris:
+- Improve kerneldoc for late_register/early_unregister callbacks.
+- Use mutex_destroy.
+
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Reviewed-by: Sean Paul <seanpaul@chromium.org>
+Reported-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20161218133545.2106-1-daniel.vetter@ffwll.ch
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_connector.c | 20 +++++++++++++++-----
+ include/drm/drm_connector.h | 16 +++++++++++++++-
+ 2 files changed, 30 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/drm_connector.c
++++ b/drivers/gpu/drm/drm_connector.c
+@@ -225,6 +225,7 @@ int drm_connector_init(struct drm_device
+
+ INIT_LIST_HEAD(&connector->probed_modes);
+ INIT_LIST_HEAD(&connector->modes);
++ mutex_init(&connector->mutex);
+ connector->edid_blob_ptr = NULL;
+ connector->status = connector_status_unknown;
+
+@@ -359,6 +360,8 @@ void drm_connector_cleanup(struct drm_co
+ connector->funcs->atomic_destroy_state(connector,
+ connector->state);
+
++ mutex_destroy(&connector->mutex);
++
+ memset(connector, 0, sizeof(*connector));
+ }
+ EXPORT_SYMBOL(drm_connector_cleanup);
+@@ -374,14 +377,15 @@ EXPORT_SYMBOL(drm_connector_cleanup);
+ */
+ int drm_connector_register(struct drm_connector *connector)
+ {
+- int ret;
++ int ret = 0;
+
++ mutex_lock(&connector->mutex);
+ if (connector->registered)
+- return 0;
++ goto unlock;
+
+ ret = drm_sysfs_connector_add(connector);
+ if (ret)
+- return ret;
++ goto unlock;
+
+ ret = drm_debugfs_connector_add(connector);
+ if (ret) {
+@@ -397,12 +401,14 @@ int drm_connector_register(struct drm_co
+ drm_mode_object_register(connector->dev, &connector->base);
+
+ connector->registered = true;
+- return 0;
++ goto unlock;
+
+ err_debugfs:
+ drm_debugfs_connector_remove(connector);
+ err_sysfs:
+ drm_sysfs_connector_remove(connector);
++unlock:
++ mutex_unlock(&connector->mutex);
+ return ret;
+ }
+ EXPORT_SYMBOL(drm_connector_register);
+@@ -415,8 +421,11 @@ EXPORT_SYMBOL(drm_connector_register);
+ */
+ void drm_connector_unregister(struct drm_connector *connector)
+ {
+- if (!connector->registered)
++ mutex_lock(&connector->mutex);
++ if (!connector->registered) {
++ mutex_unlock(&connector->mutex);
+ return;
++ }
+
+ if (connector->funcs->early_unregister)
+ connector->funcs->early_unregister(connector);
+@@ -425,6 +434,7 @@ void drm_connector_unregister(struct drm
+ drm_debugfs_connector_remove(connector);
+
+ connector->registered = false;
++ mutex_unlock(&connector->mutex);
+ }
+ EXPORT_SYMBOL(drm_connector_unregister);
+
+--- a/include/drm/drm_connector.h
++++ b/include/drm/drm_connector.h
+@@ -345,6 +345,8 @@ struct drm_connector_funcs {
+ * core drm connector interfaces. Everything added from this callback
+ * should be unregistered in the early_unregister callback.
+ *
++ * This is called while holding drm_connector->mutex.
++ *
+ * Returns:
+ *
+ * 0 on success, or a negative error code on failure.
+@@ -359,6 +361,8 @@ struct drm_connector_funcs {
+ * late_register(). It is called from drm_connector_unregister(),
+ * early in the driver unload sequence to disable userspace access
+ * before data structures are torndown.
++ *
++ * This is called while holding drm_connector->mutex.
+ */
+ void (*early_unregister)(struct drm_connector *connector);
+
+@@ -511,7 +515,6 @@ struct drm_cmdline_mode {
+ * @interlace_allowed: can this connector handle interlaced modes?
+ * @doublescan_allowed: can this connector handle doublescan?
+ * @stereo_allowed: can this connector handle stereo modes?
+- * @registered: is this connector exposed (registered) with userspace?
+ * @modes: modes available on this connector (from fill_modes() + user)
+ * @status: one of the drm_connector_status enums (connected, not, or unknown)
+ * @probed_modes: list of modes derived directly from the display
+@@ -560,6 +563,13 @@ struct drm_connector {
+ char *name;
+
+ /**
++ * @mutex: Lock for general connector state, but currently only protects
++ * @registered. Most of the connector state is still protected by the
++ * mutex in &drm_mode_config.
++ */
++ struct mutex mutex;
++
++ /**
+ * @index: Compacted connector index, which matches the position inside
+ * the mode_config.list for drivers not supporting hot-add/removing. Can
+ * be used as an array index. It is invariant over the lifetime of the
+@@ -572,6 +582,10 @@ struct drm_connector {
+ bool interlace_allowed;
+ bool doublescan_allowed;
+ bool stereo_allowed;
++ /**
++ * @registered: Is this connector exposed (registered) with userspace?
++ * Protected by @mutex.
++ */
+ bool registered;
+ struct list_head modes; /* list of modes on this connector */
+
--- /dev/null
+From foo@baz Thu Jun 15 13:06:48 CEST 2017
+From: Arseny Solokha <asolokha@kb.kras.ru>
+Date: Sun, 29 Jan 2017 19:52:20 +0700
+Subject: gianfar: synchronize DMA API usage by free_skb_rx_queue w/ gfar_new_page
+
+From: Arseny Solokha <asolokha@kb.kras.ru>
+
+
+[ Upstream commit 4af0e5bb95ee3ba5ea4bd7dbb94e1648a5279cc9 ]
+
+In spite of switching to paged allocation of Rx buffers, the driver still
+called dma_unmap_single() in the Rx queues tear-down path.
+
+The DMA region unmapping code in free_skb_rx_queue() basically predates
+the introduction of paged allocation to the driver. While being refactored,
+it apparently hasn't reflected the change in the DMA API usage by its
+counterpart gfar_new_page().
+
+As a result, setting an interface to the DOWN state now yields the following:
+
+ # ip link set eth2 down
+ fsl-gianfar ffe24000.ethernet: DMA-API: device driver frees DMA memory with wrong function [device address=0x000000001ecd0000] [size=40]
+ ------------[ cut here ]------------
+ WARNING: CPU: 1 PID: 189 at lib/dma-debug.c:1123 check_unmap+0x8e0/0xa28
+ CPU: 1 PID: 189 Comm: ip Tainted: G O 4.9.5 #1
+ task: dee73400 task.stack: dede2000
+ NIP: c02101e8 LR: c02101e8 CTR: c0260d74
+ REGS: dede3bb0 TRAP: 0700 Tainted: G O (4.9.5)
+ MSR: 00021000 <CE,ME> CR: 28002222 XER: 00000000
+
+ GPR00: c02101e8 dede3c60 dee73400 000000b6 dfbd033c dfbd36c4 1f622000 dede2000
+ GPR08: 00000007 c05b1634 1f622000 00000000 22002484 100a9904 00000000 00000000
+ GPR16: 00000000 db4c849c 00000002 db4c8480 00000001 df142240 db4c84bc 00000000
+ GPR24: c0706148 c0700000 00029000 c07552e8 c07323b4 dede3cb8 c07605e0 db535540
+ NIP [c02101e8] check_unmap+0x8e0/0xa28
+ LR [c02101e8] check_unmap+0x8e0/0xa28
+ Call Trace:
+ [dede3c60] [c02101e8] check_unmap+0x8e0/0xa28 (unreliable)
+ [dede3cb0] [c02103b8] debug_dma_unmap_page+0x88/0x9c
+ [dede3d30] [c02dffbc] free_skb_resources+0x2c4/0x404
+ [dede3d80] [c02e39b4] gfar_close+0x24/0xc8
+ [dede3da0] [c0361550] __dev_close_many+0xa0/0xf8
+ [dede3dd0] [c03616f0] __dev_close+0x2c/0x4c
+ [dede3df0] [c036b1b8] __dev_change_flags+0xa0/0x174
+ [dede3e10] [c036b2ac] dev_change_flags+0x20/0x60
+ [dede3e30] [c03e130c] devinet_ioctl+0x540/0x824
+ [dede3e90] [c0347dcc] sock_ioctl+0x134/0x298
+ [dede3eb0] [c0111814] do_vfs_ioctl+0xac/0x854
+ [dede3f20] [c0111ffc] SyS_ioctl+0x40/0x74
+ [dede3f40] [c000f290] ret_from_syscall+0x0/0x3c
+ --- interrupt: c01 at 0xff45da0
+ LR = 0xff45cd0
+ Instruction dump:
+ 811d001c 7c66482e 813d0020 9061000c 807f000c 5463103a 7cc6182e 3c60c052
+ 386309ac 90c10008 4cc63182 4826b845 <0fe00000> 4bfffa60 3c80c052 388402c4
+ ---[ end trace 695ae6d7ac1d0c47 ]---
+ Mapped at:
+ [<c02e22a8>] gfar_alloc_rx_buffs+0x178/0x248
+ [<c02e3ef0>] startup_gfar+0x368/0x570
+ [<c036aeb4>] __dev_open+0xdc/0x150
+ [<c036b1b8>] __dev_change_flags+0xa0/0x174
+ [<c036b2ac>] dev_change_flags+0x20/0x60
+
+Even though the issue was discovered in 4.9 kernel, the code in question
+is identical in the current net and net-next trees.
+
+Fixes: 75354148ce69 ("gianfar: Add paged allocation and Rx S/G")
+Signed-off-by: Arseny Solokha <asolokha@kb.kras.ru>
+Acked-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/gianfar.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -2007,8 +2007,8 @@ static void free_skb_rx_queue(struct gfa
+ if (!rxb->page)
+ continue;
+
+- dma_unmap_single(rx_queue->dev, rxb->dma,
+- PAGE_SIZE, DMA_FROM_DEVICE);
++ dma_unmap_page(rx_queue->dev, rxb->dma,
++ PAGE_SIZE, DMA_FROM_DEVICE);
+ __free_page(rxb->page);
+
+ rxb->page = NULL;
--- /dev/null
+From foo@baz Thu Jun 15 13:06:48 CEST 2017
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Date: Mon, 30 Jan 2017 15:11:45 +0200
+Subject: net/mlx4_core: Avoid command timeouts during VF driver device shutdown
+
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+
+
+[ Upstream commit d585df1c5ccf995fcee910705ad7a9cdd11d4152 ]
+
+Some Hypervisors detach VFs from VMs by instantly causing an FLR event
+to be generated for a VF.
+
+In the mlx4 case, this will cause that VF's comm channel to be disabled
+before the VM has an opportunity to invoke the VF device's "shutdown"
+method.
+
+The result is that the VF driver on the VM will experience a command
+timeout during the shutdown process when the Hypervisor does not deliver
+a command-completion event to the VM.
+
+To avoid FW command timeouts on the VM when the driver's shutdown method
+is invoked, we detect the absence of the VF's comm channel at the very
+start of the shutdown process. If the comm-channel has already been
+disabled, we cause all FW commands during the device shutdown process to
+immediately return success (and thus avoid all command timeouts).
+
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/catas.c | 2 +-
+ drivers/net/ethernet/mellanox/mlx4/intf.c | 12 ++++++++++++
+ drivers/net/ethernet/mellanox/mlx4/mlx4.h | 1 +
+ 3 files changed, 14 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/catas.c
++++ b/drivers/net/ethernet/mellanox/mlx4/catas.c
+@@ -158,7 +158,7 @@ static int mlx4_reset_slave(struct mlx4_
+ return -ETIMEDOUT;
+ }
+
+-static int mlx4_comm_internal_err(u32 slave_read)
++int mlx4_comm_internal_err(u32 slave_read)
+ {
+ return (u32)COMM_CHAN_EVENT_INTERNAL_ERR ==
+ (slave_read & (u32)COMM_CHAN_EVENT_INTERNAL_ERR) ? 1 : 0;
+--- a/drivers/net/ethernet/mellanox/mlx4/intf.c
++++ b/drivers/net/ethernet/mellanox/mlx4/intf.c
+@@ -222,6 +222,18 @@ void mlx4_unregister_device(struct mlx4_
+ return;
+
+ mlx4_stop_catas_poll(dev);
++ if (dev->persist->interface_state & MLX4_INTERFACE_STATE_DELETION &&
++ mlx4_is_slave(dev)) {
++ /* In mlx4_remove_one on a VF */
++ u32 slave_read =
++ swab32(readl(&mlx4_priv(dev)->mfunc.comm->slave_read));
++
++ if (mlx4_comm_internal_err(slave_read)) {
++ mlx4_dbg(dev, "%s: comm channel is down, entering error state.\n",
++ __func__);
++ mlx4_enter_error_state(dev->persist);
++ }
++ }
+ mutex_lock(&intf_mutex);
+
+ list_for_each_entry(intf, &intf_list, list)
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+@@ -1220,6 +1220,7 @@ void mlx4_qp_event(struct mlx4_dev *dev,
+ void mlx4_srq_event(struct mlx4_dev *dev, u32 srqn, int event_type);
+
+ void mlx4_enter_error_state(struct mlx4_dev_persistent *persist);
++int mlx4_comm_internal_err(u32 slave_read);
+
+ int mlx4_SENSE_PORT(struct mlx4_dev *dev, int port,
+ enum mlx4_port_type *type);
--- /dev/null
+From foo@baz Thu Jun 15 13:06:48 CEST 2017
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Thu, 26 Jan 2017 19:24:07 +0200
+Subject: pinctrl: baytrail: Rectify debounce support (part 2)
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+
+[ Upstream commit 827e1579e1d5cb66e340e7be1944b825b542bbdf ]
+
+The commit 04ff5a095d66 ("pinctrl: baytrail: Rectify debounce support")
+almost fixes the logic of debuonce but missed couple of things, i.e.
+typo in mask when disabling debounce and lack of enabling it back.
+
+This patch addresses above issues.
+
+Reported-by: Jean Delvare <jdelvare@suse.de>
+Fixes: 04ff5a095d66 ("pinctrl: baytrail: Rectify debounce support")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Jean Delvare <jdelvare@suse.de>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/intel/pinctrl-baytrail.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
+@@ -1250,10 +1250,12 @@ static int byt_pin_config_set(struct pin
+ debounce = readl(db_reg);
+ debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
+
++ if (arg)
++ conf |= BYT_DEBOUNCE_EN;
++ else
++ conf &= ~BYT_DEBOUNCE_EN;
++
+ switch (arg) {
+- case 0:
+- conf &= BYT_DEBOUNCE_EN;
+- break;
+ case 375:
+ debounce |= BYT_DEBOUNCE_PULSE_375US;
+ break;
+@@ -1276,7 +1278,9 @@ static int byt_pin_config_set(struct pin
+ debounce |= BYT_DEBOUNCE_PULSE_24MS;
+ break;
+ default:
+- ret = -EINVAL;
++ if (arg)
++ ret = -EINVAL;
++ break;
+ }
+
+ if (!ret)
fs-cache-initialise-stores_lock-in-netfs-cookie.patch
ipv6-fix-flow-labels-when-the-traffic-class-is-non-0.patch
drm-nouveau-prevent-userspace-from-deleting-client-object.patch
+drm-nouveau-fence-g84-protect-against-concurrent-access-to-semaphore-buffers.patch
+net-mlx4_core-avoid-command-timeouts-during-vf-driver-device-shutdown.patch
+gianfar-synchronize-dma-api-usage-by-free_skb_rx_queue-w-gfar_new_page.patch
+pinctrl-baytrail-rectify-debounce-support-part-2.patch
+cec-fix-wrong-last_la-determination.patch
+drm-prevent-double-un-registration-for-connectors.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
