From: Sasha Levin Date: Sun, 15 Dec 2019 21:31:09 +0000 (-0500) Subject: fixes for 4.9 X-Git-Tag: v5.4.4~49 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=662450d81779bf0955ff145f57a462d8f3cdd587;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.9 Signed-off-by: Sasha Levin --- diff --git a/queue-4.9/arm-dts-omap3-tao3530-fix-incorrect-mmc-card-detecti.patch b/queue-4.9/arm-dts-omap3-tao3530-fix-incorrect-mmc-card-detecti.patch new file mode 100644 index 00000000000..33c7d934b9b --- /dev/null +++ b/queue-4.9/arm-dts-omap3-tao3530-fix-incorrect-mmc-card-detecti.patch @@ -0,0 +1,50 @@ +From 3647b55a54d18ed6396af5a1d21d3779c46fe3da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Nov 2019 17:16:51 +0200 +Subject: ARM: dts: omap3-tao3530: Fix incorrect MMC card detection GPIO + polarity + +From: Jarkko Nikula + +[ Upstream commit 287897f9aaa2ad1c923d9875914f57c4dc9159c8 ] + +The MMC card detection GPIO polarity is active low on TAO3530, like in many +other similar boards. Now the card is not detected and it is unable to +mount rootfs from an SD card. + +Fix this by using the correct polarity. + +This incorrect polarity was defined already in the commit 30d95c6d7092 +("ARM: dts: omap3: Add Technexion TAO3530 SOM omap3-tao3530.dtsi") in v3.18 +kernel and later changed to use defined GPIO constants in v4.4 kernel by +the commit 3a637e008e54 ("ARM: dts: Use defined GPIO constants in flags +cell for OMAP2+ boards"). + +While the latter commit did not introduce the issue I'm marking it with +Fixes tag due the v4.4 kernels still being maintained. + +Fixes: 3a637e008e54 ("ARM: dts: Use defined GPIO constants in flags cell for OMAP2+ boards") +Cc: linux-stable # 4.4+ +Signed-off-by: Jarkko Nikula +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap3-tao3530.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/omap3-tao3530.dtsi b/arch/arm/boot/dts/omap3-tao3530.dtsi +index dc80886b53292..e3dfba8b3efec 100644 +--- a/arch/arm/boot/dts/omap3-tao3530.dtsi ++++ b/arch/arm/boot/dts/omap3-tao3530.dtsi +@@ -225,7 +225,7 @@ + pinctrl-0 = <&mmc1_pins>; + vmmc-supply = <&vmmc1>; + vmmc_aux-supply = <&vsim>; +- cd-gpios = <&twl_gpio 0 GPIO_ACTIVE_HIGH>; ++ cd-gpios = <&twl_gpio 0 GPIO_ACTIVE_LOW>; + bus-width = <8>; + }; + +-- +2.20.1 + diff --git a/queue-4.9/ath10k-fix-fw-crash-by-moving-chip-reset-after-napi-.patch b/queue-4.9/ath10k-fix-fw-crash-by-moving-chip-reset-after-napi-.patch new file mode 100644 index 00000000000..c3737b1e59d --- /dev/null +++ b/queue-4.9/ath10k-fix-fw-crash-by-moving-chip-reset-after-napi-.patch @@ -0,0 +1,74 @@ +From 99aaee1decdec4d8fc7a01394b13ffb555d598b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 May 2019 11:16:22 +0800 +Subject: ath10k: fix fw crash by moving chip reset after napi disabled + +From: Miaoqing Pan + +[ Upstream commit 08d80e4cd27ba19f9bee9e5f788f9a9fc440a22f ] + +On SMP platform, when continuously running wifi up/down, the napi +poll can be scheduled during chip reset, which will call +ath10k_pci_has_fw_crashed() to check the fw status. But in the reset +period, the value from FW_INDICATOR_ADDRESS register will return +0xdeadbeef, which also be treated as fw crash. Fix the issue by +moving chip reset after napi disabled. + +ath10k_pci 0000:01:00.0: firmware crashed! (guid 73b30611-5b1e-4bdd-90b4-64c81eb947b6) +ath10k_pci 0000:01:00.0: qca9984/qca9994 hw1.0 target 0x01000000 chip_id 0x00000000 sub 168c:cafe +ath10k_pci 0000:01:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal otp max-sta 512 raw 0 hwcrypto 1 +ath10k_pci 0000:01:00.0: failed to get memcpy hi address for firmware address 4: -16 +ath10k_pci 0000:01:00.0: failed to read firmware dump area: -16 +ath10k_pci 0000:01:00.0: Copy Engine register dump: +ath10k_pci 0000:01:00.0: [00]: 0x0004a000 0 0 0 0 +ath10k_pci 0000:01:00.0: [01]: 0x0004a400 0 0 0 0 +ath10k_pci 0000:01:00.0: [02]: 0x0004a800 0 0 0 0 +ath10k_pci 0000:01:00.0: [03]: 0x0004ac00 0 0 0 0 +ath10k_pci 0000:01:00.0: [04]: 0x0004b000 0 0 0 0 +ath10k_pci 0000:01:00.0: [05]: 0x0004b400 0 0 0 0 +ath10k_pci 0000:01:00.0: [06]: 0x0004b800 0 0 0 0 +ath10k_pci 0000:01:00.0: [07]: 0x0004bc00 1 0 1 0 +ath10k_pci 0000:01:00.0: [08]: 0x0004c000 0 0 0 0 +ath10k_pci 0000:01:00.0: [09]: 0x0004c400 0 0 0 0 +ath10k_pci 0000:01:00.0: [10]: 0x0004c800 0 0 0 0 +ath10k_pci 0000:01:00.0: [11]: 0x0004cc00 0 0 0 0 + +Tested HW: QCA9984,QCA9887,WCN3990 + +Signed-off-by: Miaoqing Pan +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/pci.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c +index d84a362a084ac..d96e062647fd9 100644 +--- a/drivers/net/wireless/ath/ath10k/pci.c ++++ b/drivers/net/wireless/ath/ath10k/pci.c +@@ -1765,6 +1765,11 @@ static void ath10k_pci_hif_stop(struct ath10k *ar) + + ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif stop\n"); + ++ ath10k_pci_irq_disable(ar); ++ ath10k_pci_irq_sync(ar); ++ napi_synchronize(&ar->napi); ++ napi_disable(&ar->napi); ++ + /* Most likely the device has HTT Rx ring configured. The only way to + * prevent the device from accessing (and possible corrupting) host + * memory is to reset the chip now. +@@ -1778,10 +1783,6 @@ static void ath10k_pci_hif_stop(struct ath10k *ar) + */ + ath10k_pci_safe_chip_reset(ar); + +- ath10k_pci_irq_disable(ar); +- ath10k_pci_irq_sync(ar); +- napi_synchronize(&ar->napi); +- napi_disable(&ar->napi); + ath10k_pci_flush(ar); + + spin_lock_irqsave(&ar_pci->ps_lock, flags); +-- +2.20.1 + diff --git a/queue-4.9/btrfs-fix-negative-subv_writers-counter-and-data-spa.patch b/queue-4.9/btrfs-fix-negative-subv_writers-counter-and-data-spa.patch new file mode 100644 index 00000000000..10eef3ade7f --- /dev/null +++ b/queue-4.9/btrfs-fix-negative-subv_writers-counter-and-data-spa.patch @@ -0,0 +1,91 @@ +From 7a826aae3e4c54eecb17f52f4143a421e430ac25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Oct 2019 16:41:20 +0100 +Subject: Btrfs: fix negative subv_writers counter and data space leak after + buffered write + +From: Filipe Manana + +[ Upstream commit a0e248bb502d5165b3314ac3819e888fdcdf7d9f ] + +When doing a buffered write it's possible to leave the subv_writers +counter of the root, used for synchronization between buffered nocow +writers and snapshotting. This happens in an exceptional case like the +following: + +1) We fail to allocate data space for the write, since there's not + enough available data space nor enough unallocated space for allocating + a new data block group; + +2) Because of that failure, we try to go to NOCOW mode, which succeeds + and therefore we set the local variable 'only_release_metadata' to true + and set the root's sub_writers counter to 1 through the call to + btrfs_start_write_no_snapshotting() made by check_can_nocow(); + +3) The call to btrfs_copy_from_user() returns zero, which is very unlikely + to happen but not impossible; + +4) No pages are copied because btrfs_copy_from_user() returned zero; + +5) We call btrfs_end_write_no_snapshotting() which decrements the root's + subv_writers counter to 0; + +6) We don't set 'only_release_metadata' back to 'false' because we do + it only if 'copied', the value returned by btrfs_copy_from_user(), is + greater than zero; + +7) On the next iteration of the while loop, which processes the same + page range, we are now able to allocate data space for the write (we + got enough data space released in the meanwhile); + +8) After this if we fail at btrfs_delalloc_reserve_metadata(), because + now there isn't enough free metadata space, or in some other place + further below (prepare_pages(), lock_and_cleanup_extent_if_need(), + btrfs_dirty_pages()), we break out of the while loop with + 'only_release_metadata' having a value of 'true'; + +9) Because 'only_release_metadata' is 'true' we end up decrementing the + root's subv_writers counter to -1 (through a call to + btrfs_end_write_no_snapshotting()), and we also end up not releasing the + data space previously reserved through btrfs_check_data_free_space(). + As a consequence the mechanism for synchronizing NOCOW buffered writes + with snapshotting gets broken. + +Fix this by always setting 'only_release_metadata' to false at the start +of each iteration. + +Fixes: 8257b2dc3c1a ("Btrfs: introduce btrfs_{start, end}_nocow_write() for each subvolume") +Fixes: 7ee9e4405f26 ("Btrfs: check if we can nocow if we don't have data space") +CC: stable@vger.kernel.org # 4.4+ +Reviewed-by: Josef Bacik +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index 6cdf27325576b..03661b744eaf0 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -1555,6 +1555,7 @@ static noinline ssize_t __btrfs_buffered_write(struct file *file, + break; + } + ++ only_release_metadata = false; + sector_offset = pos & (root->sectorsize - 1); + reserve_bytes = round_up(write_bytes + sector_offset, + root->sectorsize); +@@ -1704,7 +1705,6 @@ again: + set_extent_bit(&BTRFS_I(inode)->io_tree, lockstart, + lockend, EXTENT_NORESERVE, NULL, + NULL, GFP_NOFS); +- only_release_metadata = false; + } + + btrfs_drop_pages(pages, num_pages); +-- +2.20.1 + diff --git a/queue-4.9/e100-fix-passing-zero-to-ptr_err-warning-in-e100_loa.patch b/queue-4.9/e100-fix-passing-zero-to-ptr_err-warning-in-e100_loa.patch new file mode 100644 index 00000000000..34a74a1f7ba --- /dev/null +++ b/queue-4.9/e100-fix-passing-zero-to-ptr_err-warning-in-e100_loa.patch @@ -0,0 +1,39 @@ +From 8dbc7c961f330bda4ae35ad4731a4f2f69523e81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Nov 2018 20:48:19 +0800 +Subject: e100: Fix passing zero to 'PTR_ERR' warning in e100_load_ucode_wait + +From: YueHaibing + +[ Upstream commit cd0d465bb697a9c7bf66a9fe940f7981232f1676 ] + +Fix a static code checker warning: +drivers/net/ethernet/intel/e100.c:1349 + e100_load_ucode_wait() warn: passing zero to 'PTR_ERR' + +Signed-off-by: YueHaibing +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e100.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c +index 068789e694c9b..93c29094ceff9 100644 +--- a/drivers/net/ethernet/intel/e100.c ++++ b/drivers/net/ethernet/intel/e100.c +@@ -1370,8 +1370,8 @@ static inline int e100_load_ucode_wait(struct nic *nic) + + fw = e100_request_firmware(nic); + /* If it's NULL, then no ucode is required */ +- if (!fw || IS_ERR(fw)) +- return PTR_ERR(fw); ++ if (IS_ERR_OR_NULL(fw)) ++ return PTR_ERR_OR_ZERO(fw); + + if ((err = e100_exec_cb(nic, (void *)fw, e100_setup_ucode))) + netif_err(nic, probe, nic->netdev, +-- +2.20.1 + diff --git a/queue-4.9/iio-adis16480-add-debugfs_reg_access-entry.patch b/queue-4.9/iio-adis16480-add-debugfs_reg_access-entry.patch new file mode 100644 index 00000000000..1f4ba0cdc27 --- /dev/null +++ b/queue-4.9/iio-adis16480-add-debugfs_reg_access-entry.patch @@ -0,0 +1,41 @@ +From 4f1f79f6c62426e272b13625d1b27e3f040a813a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Oct 2019 17:33:49 +0100 +Subject: iio: adis16480: Add debugfs_reg_access entry +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nuno Sá + +[ Upstream commit 4c35b7a51e2f291471f7221d112c6a45c63e83bc ] + +The driver is defining debugfs entries by calling +`adis16480_debugfs_init()`. However, those entries are attached to the +iio_dev debugfs entry which won't exist if no debugfs_reg_access +callback is provided. + +Fixes: 2f3abe6cbb6c ("iio:imu: Add support for the ADIS16480 and similar IMUs") +Signed-off-by: Nuno Sá +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/imu/adis16480.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c +index 6f975538996cd..c950aa10d0ae0 100644 +--- a/drivers/iio/imu/adis16480.c ++++ b/drivers/iio/imu/adis16480.c +@@ -724,6 +724,7 @@ static const struct iio_info adis16480_info = { + .write_raw = &adis16480_write_raw, + .update_scan_mode = adis_update_scan_mode, + .driver_module = THIS_MODULE, ++ .debugfs_reg_access = adis_debugfs_reg_access, + }; + + static int adis16480_stop_device(struct iio_dev *indio_dev) +-- +2.20.1 + diff --git a/queue-4.9/omap-pdata-quirks-remove-openpandora-quirks-for-mmc3.patch b/queue-4.9/omap-pdata-quirks-remove-openpandora-quirks-for-mmc3.patch new file mode 100644 index 00000000000..3da8ef8aeef --- /dev/null +++ b/queue-4.9/omap-pdata-quirks-remove-openpandora-quirks-for-mmc3.patch @@ -0,0 +1,142 @@ +From a0e1a4ecf5d45a78252c9fb1f25faddf334ca68c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2019 11:30:39 +0100 +Subject: omap: pdata-quirks: remove openpandora quirks for mmc3 and wl1251 + +From: H. Nikolaus Schaller + +[ Upstream commit 2398c41d64321e62af54424fd399964f3d48cdc2 ] + +With a wl1251 child node of mmc3 in the device tree decoded +in omap_hsmmc.c to handle special wl1251 initialization, we do +no longer need to instantiate the mmc3 through pdata quirks. + +We also can remove the wlan regulator and reset/interrupt definitions +and do them through device tree. + +Fixes: 81eef6ca9201 ("mmc: omap_hsmmc: Use dma_request_chan() for requesting DMA channel") +Signed-off-by: H. Nikolaus Schaller +Cc: # v4.7+ +Acked-by: Tony Lindgren +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/pdata-quirks.c | 93 ------------------------------ + 1 file changed, 93 deletions(-) + +diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c +index 88676fe9b1194..c3b3972c301a5 100644 +--- a/arch/arm/mach-omap2/pdata-quirks.c ++++ b/arch/arm/mach-omap2/pdata-quirks.c +@@ -308,108 +308,15 @@ static void __init omap3_logicpd_torpedo_init(void) + } + + /* omap3pandora legacy devices */ +-#define PANDORA_WIFI_IRQ_GPIO 21 +-#define PANDORA_WIFI_NRESET_GPIO 23 + + static struct platform_device pandora_backlight = { + .name = "pandora-backlight", + .id = -1, + }; + +-static struct regulator_consumer_supply pandora_vmmc3_supply[] = { +- REGULATOR_SUPPLY("vmmc", "omap_hsmmc.2"), +-}; +- +-static struct regulator_init_data pandora_vmmc3 = { +- .constraints = { +- .valid_ops_mask = REGULATOR_CHANGE_STATUS, +- }, +- .num_consumer_supplies = ARRAY_SIZE(pandora_vmmc3_supply), +- .consumer_supplies = pandora_vmmc3_supply, +-}; +- +-static struct fixed_voltage_config pandora_vwlan = { +- .supply_name = "vwlan", +- .microvolts = 1800000, /* 1.8V */ +- .gpio = PANDORA_WIFI_NRESET_GPIO, +- .startup_delay = 50000, /* 50ms */ +- .enable_high = 1, +- .init_data = &pandora_vmmc3, +-}; +- +-static struct platform_device pandora_vwlan_device = { +- .name = "reg-fixed-voltage", +- .id = 1, +- .dev = { +- .platform_data = &pandora_vwlan, +- }, +-}; +- +-static void pandora_wl1251_init_card(struct mmc_card *card) +-{ +- /* +- * We have TI wl1251 attached to MMC3. Pass this information to +- * SDIO core because it can't be probed by normal methods. +- */ +- if (card->type == MMC_TYPE_SDIO || card->type == MMC_TYPE_SD_COMBO) { +- card->quirks |= MMC_QUIRK_NONSTD_SDIO; +- card->cccr.wide_bus = 1; +- card->cis.vendor = 0x104c; +- card->cis.device = 0x9066; +- card->cis.blksize = 512; +- card->cis.max_dtr = 24000000; +- card->ocr = 0x80; +- } +-} +- +-static struct omap2_hsmmc_info pandora_mmc3[] = { +- { +- .mmc = 3, +- .caps = MMC_CAP_4_BIT_DATA | MMC_CAP_POWER_OFF_CARD, +- .gpio_cd = -EINVAL, +- .gpio_wp = -EINVAL, +- .init_card = pandora_wl1251_init_card, +- }, +- {} /* Terminator */ +-}; +- +-static void __init pandora_wl1251_init(void) +-{ +- struct wl1251_platform_data pandora_wl1251_pdata; +- int ret; +- +- memset(&pandora_wl1251_pdata, 0, sizeof(pandora_wl1251_pdata)); +- +- pandora_wl1251_pdata.power_gpio = -1; +- +- ret = gpio_request_one(PANDORA_WIFI_IRQ_GPIO, GPIOF_IN, "wl1251 irq"); +- if (ret < 0) +- goto fail; +- +- pandora_wl1251_pdata.irq = gpio_to_irq(PANDORA_WIFI_IRQ_GPIO); +- if (pandora_wl1251_pdata.irq < 0) +- goto fail_irq; +- +- pandora_wl1251_pdata.use_eeprom = true; +- ret = wl1251_set_platform_data(&pandora_wl1251_pdata); +- if (ret < 0) +- goto fail_irq; +- +- return; +- +-fail_irq: +- gpio_free(PANDORA_WIFI_IRQ_GPIO); +-fail: +- pr_err("wl1251 board initialisation failed\n"); +-} +- + static void __init omap3_pandora_legacy_init(void) + { + platform_device_register(&pandora_backlight); +- platform_device_register(&pandora_vwlan_device); +- omap_hsmmc_init(pandora_mmc3); +- omap_hsmmc_late_init(pandora_mmc3); +- pandora_wl1251_init(); + } + #endif /* CONFIG_ARCH_OMAP3 */ + +-- +2.20.1 + diff --git a/queue-4.9/pinctrl-samsung-fix-device-node-refcount-leaks-in-s3.patch b/queue-4.9/pinctrl-samsung-fix-device-node-refcount-leaks-in-s3.patch new file mode 100644 index 00000000000..83445fbefa6 --- /dev/null +++ b/queue-4.9/pinctrl-samsung-fix-device-node-refcount-leaks-in-s3.patch @@ -0,0 +1,54 @@ +From bd50b62ab016021a2541954b57b09d1df9f1dcce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Aug 2019 18:27:09 +0200 +Subject: pinctrl: samsung: Fix device node refcount leaks in S3C64xx wakeup + controller init + +From: Krzysztof Kozlowski + +[ Upstream commit 7f028caadf6c37580d0f59c6c094ed09afc04062 ] + +In s3c64xx_eint_eint0_init() the for_each_child_of_node() loop is used +with a break to find a matching child node. Although each iteration of +for_each_child_of_node puts the previous node, but early exit from loop +misses it. This leads to leak of device node. + +Cc: +Fixes: 61dd72613177 ("pinctrl: Add pinctrl-s3c64xx driver") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/samsung/pinctrl-s3c64xx.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c +index 43407ab248f51..0cd9f3a7bb11a 100644 +--- a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c ++++ b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c +@@ -713,6 +713,7 @@ static int s3c64xx_eint_eint0_init(struct samsung_pinctrl_drv_data *d) + data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL); + if (!data) { + dev_err(dev, "could not allocate memory for wkup eint data\n"); ++ of_node_put(eint0_np); + return -ENOMEM; + } + data->drvdata = d; +@@ -723,6 +724,7 @@ static int s3c64xx_eint_eint0_init(struct samsung_pinctrl_drv_data *d) + irq = irq_of_parse_and_map(eint0_np, i); + if (!irq) { + dev_err(dev, "failed to get wakeup EINT IRQ %d\n", i); ++ of_node_put(eint0_np); + return -ENXIO; + } + +@@ -730,6 +732,7 @@ static int s3c64xx_eint_eint0_init(struct samsung_pinctrl_drv_data *d) + s3c64xx_eint0_handlers[i], + data); + } ++ of_node_put(eint0_np); + + bank = d->pin_banks; + for (i = 0; i < d->nr_banks; ++i, ++bank) { +-- +2.20.1 + diff --git a/queue-4.9/scsi-lpfc-cap-npiv-vports-to-256.patch b/queue-4.9/scsi-lpfc-cap-npiv-vports-to-256.patch new file mode 100644 index 00000000000..cc09eb24d6c --- /dev/null +++ b/queue-4.9/scsi-lpfc-cap-npiv-vports-to-256.patch @@ -0,0 +1,87 @@ +From 287154940a73920764cd767752faca2943e6dda1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Nov 2018 16:09:33 -0800 +Subject: scsi: lpfc: Cap NPIV vports to 256 + +From: James Smart + +[ Upstream commit 8b47ae69e049ae0b3373859d901f0334322f9fe9 ] + +Depending on the chipset, the number of NPIV vports may vary and be in +excess of what most switches support (256). To avoid confusion with the +users, limit the reported NPIV vports to 256. + +Additionally correct the 16G adapter which is reporting a bogus NPIV vport +number if the link is down. + +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc.h | 3 ++- + drivers/scsi/lpfc/lpfc_attr.c | 12 ++++++++++-- + drivers/scsi/lpfc/lpfc_init.c | 3 +++ + 3 files changed, 15 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h +index b484859464f6b..f0f6d71d28b81 100644 +--- a/drivers/scsi/lpfc/lpfc.h ++++ b/drivers/scsi/lpfc/lpfc.h +@@ -878,7 +878,8 @@ struct lpfc_hba { + struct list_head port_list; + struct lpfc_vport *pport; /* physical lpfc_vport pointer */ + uint16_t max_vpi; /* Maximum virtual nports */ +-#define LPFC_MAX_VPI 0xFFFF /* Max number of VPI supported */ ++#define LPFC_MAX_VPI 0xFF /* Max number VPI supported 0 - 0xff */ ++#define LPFC_MAX_VPORTS 0x100 /* Max vports per port, with pport */ + uint16_t max_vports; /* + * For IOV HBAs max_vpi can change + * after a reset. max_vports is max +diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c +index cf15b9754402b..aa0435b1ea1e7 100644 +--- a/drivers/scsi/lpfc/lpfc_attr.c ++++ b/drivers/scsi/lpfc/lpfc_attr.c +@@ -1214,6 +1214,9 @@ lpfc_get_hba_info(struct lpfc_hba *phba, + max_vpi = (bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config) > 0) ? + (bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config) - 1) : 0; + ++ /* Limit the max we support */ ++ if (max_vpi > LPFC_MAX_VPI) ++ max_vpi = LPFC_MAX_VPI; + if (mvpi) + *mvpi = max_vpi; + if (avpi) +@@ -1229,8 +1232,13 @@ lpfc_get_hba_info(struct lpfc_hba *phba, + *axri = pmb->un.varRdConfig.avail_xri; + if (mvpi) + *mvpi = pmb->un.varRdConfig.max_vpi; +- if (avpi) +- *avpi = pmb->un.varRdConfig.avail_vpi; ++ if (avpi) { ++ /* avail_vpi is only valid if link is up and ready */ ++ if (phba->link_state == LPFC_HBA_READY) ++ *avpi = pmb->un.varRdConfig.avail_vpi; ++ else ++ *avpi = pmb->un.varRdConfig.max_vpi; ++ } + } + + mempool_free(pmboxq, phba->mbox_mem_pool); +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c +index 2f80b2c0409e0..8c640bcf107bd 100644 +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -6973,6 +6973,9 @@ lpfc_sli4_read_config(struct lpfc_hba *phba) + bf_get(lpfc_mbx_rd_conf_xri_base, rd_config); + phba->sli4_hba.max_cfg_param.max_vpi = + bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config); ++ /* Limit the max we support */ ++ if (phba->sli4_hba.max_cfg_param.max_vpi > LPFC_MAX_VPORTS) ++ phba->sli4_hba.max_cfg_param.max_vpi = LPFC_MAX_VPORTS; + phba->sli4_hba.max_cfg_param.vpi_base = + bf_get(lpfc_mbx_rd_conf_vpi_base, rd_config); + phba->sli4_hba.max_cfg_param.max_rpi = +-- +2.20.1 + diff --git a/queue-4.9/scsi-qla2xxx-always-check-the-qla2x00_wait_for_hba_o.patch b/queue-4.9/scsi-qla2xxx-always-check-the-qla2x00_wait_for_hba_o.patch new file mode 100644 index 00000000000..d682929b16e --- /dev/null +++ b/queue-4.9/scsi-qla2xxx-always-check-the-qla2x00_wait_for_hba_o.patch @@ -0,0 +1,66 @@ +From 4ae6b86f71ed5337d8dc8270eadcb88963821090 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Aug 2019 20:01:52 -0700 +Subject: scsi: qla2xxx: Always check the qla2x00_wait_for_hba_online() return + value + +From: Bart Van Assche + +[ Upstream commit e6803efae5acd109fad9f2f07dab674563441a53 ] + +This patch fixes several Coverity complaints about not always checking +the qla2x00_wait_for_hba_online() return value. + +Cc: Himanshu Madhani +Signed-off-by: Bart Van Assche +Tested-by: Himanshu Madhani +Reviewed-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_attr.c | 3 ++- + drivers/scsi/qla2xxx/qla_target.c | 7 +++++-- + 2 files changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c +index 5c3dfd92ea024..33f4181ba9f76 100644 +--- a/drivers/scsi/qla2xxx/qla_attr.c ++++ b/drivers/scsi/qla2xxx/qla_attr.c +@@ -682,7 +682,8 @@ qla2x00_sysfs_write_reset(struct file *filp, struct kobject *kobj, + break; + } else { + /* Make sure FC side is not in reset */ +- qla2x00_wait_for_hba_online(vha); ++ WARN_ON_ONCE(qla2x00_wait_for_hba_online(vha) != ++ QLA_SUCCESS); + + /* Issue MPI reset */ + scsi_block_requests(vha->host); +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 3b20cf8b161e4..b889caa556a0b 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -6341,7 +6341,8 @@ qlt_enable_vha(struct scsi_qla_host *vha) + + set_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags); + qla2xxx_wake_dpc(base_vha); +- qla2x00_wait_for_hba_online(base_vha); ++ WARN_ON_ONCE(qla2x00_wait_for_hba_online(base_vha) != ++ QLA_SUCCESS); + } + } + EXPORT_SYMBOL(qlt_enable_vha); +@@ -6371,7 +6372,9 @@ static void qlt_disable_vha(struct scsi_qla_host *vha) + + set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags); + qla2xxx_wake_dpc(vha); +- qla2x00_wait_for_hba_online(vha); ++ if (qla2x00_wait_for_hba_online(vha) != QLA_SUCCESS) ++ ql_dbg(ql_dbg_tgt, vha, 0xe081, ++ "qla2x00_wait_for_hba_online() failed\n"); + } + + /* +-- +2.20.1 + diff --git a/queue-4.9/scsi-qla2xxx-fix-dma-unmap-leak.patch b/queue-4.9/scsi-qla2xxx-fix-dma-unmap-leak.patch new file mode 100644 index 00000000000..fbfcac2fca6 --- /dev/null +++ b/queue-4.9/scsi-qla2xxx-fix-dma-unmap-leak.patch @@ -0,0 +1,54 @@ +From 0262456f1e6bfcd03f7783d3301f63368c593880 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jul 2019 09:07:26 -0700 +Subject: scsi: qla2xxx: Fix DMA unmap leak + +From: Himanshu Madhani + +[ Upstream commit 5d328de64d89400dcf9911125844d8adc0db697f ] + +With debug kernel we see following wanings indicating memory leak. + +[28809.523959] WARNING: CPU: 3 PID: 6790 at lib/dma-debug.c:978 +dma_debug_device_change+0x166/0x1d0 +[28809.523964] pci 0000:0c:00.6: DMA-API: device driver has pending DMA +allocations while released from device [count=5] +[28809.523964] One of leaked entries details: [device +address=0x00000002aefe4000] [size=8208 bytes] [mapped with DMA_BIDIRECTIONAL] +[mapped as coherent] + +Fix this by unmapping DMA memory. + +Signed-off-by: Quinn Tran +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_bsg.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c +index 33e4dceb895f2..e7db95d442deb 100644 +--- a/drivers/scsi/qla2xxx/qla_bsg.c ++++ b/drivers/scsi/qla2xxx/qla_bsg.c +@@ -336,6 +336,8 @@ qla2x00_process_els(struct fc_bsg_job *bsg_job) + dma_map_sg(&ha->pdev->dev, bsg_job->request_payload.sg_list, + bsg_job->request_payload.sg_cnt, DMA_TO_DEVICE); + if (!req_sg_cnt) { ++ dma_unmap_sg(&ha->pdev->dev, bsg_job->request_payload.sg_list, ++ bsg_job->request_payload.sg_cnt, DMA_TO_DEVICE); + rval = -ENOMEM; + goto done_free_fcport; + } +@@ -343,6 +345,8 @@ qla2x00_process_els(struct fc_bsg_job *bsg_job) + rsp_sg_cnt = dma_map_sg(&ha->pdev->dev, bsg_job->reply_payload.sg_list, + bsg_job->reply_payload.sg_cnt, DMA_FROM_DEVICE); + if (!rsp_sg_cnt) { ++ dma_unmap_sg(&ha->pdev->dev, bsg_job->reply_payload.sg_list, ++ bsg_job->reply_payload.sg_cnt, DMA_FROM_DEVICE); + rval = -ENOMEM; + goto done_free_fcport; + } +-- +2.20.1 + diff --git a/queue-4.9/scsi-qla2xxx-fix-message-indicating-vectors-used-by-.patch b/queue-4.9/scsi-qla2xxx-fix-message-indicating-vectors-used-by-.patch new file mode 100644 index 00000000000..f1d811d7d2d --- /dev/null +++ b/queue-4.9/scsi-qla2xxx-fix-message-indicating-vectors-used-by-.patch @@ -0,0 +1,50 @@ +From 5a472be91a16af349e4c738ad651a988d04a1faf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2019 16:20:02 +0200 +Subject: scsi: qla2xxx: Fix message indicating vectors used by driver + +From: Mika Westerberg + +[ Upstream commit 16561db45eec03368cbfcf96ab11faf59fca58a9 ] + +[ Upstream commit da48b82425b8bf999fb9f7c220e967c4d661b5f8 ] + +This patch updates log message which indicates number of vectors used by +the driver instead of displaying failure to get maximum requested +vectors. Driver will always request maximum vectors during +initialization. In the event driver is not able to get maximum requested +vectors, it will adjust the allocated vectors. This is normal and does not +imply failure in driver. + +Signed-off-by: Himanshu Madhani +Reviewed-by: Ewan D. Milne +Reviewed-by: Lee Duncan +Link: https://lore.kernel.org/r/20190830222402.23688-2-hmadhani@marvell.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-mem.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 7199e400fbace..19818367ff5c3 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1940,10 +1940,14 @@ no_bw: + kfree(xhci->port_array); + kfree(xhci->rh_bw); + kfree(xhci->ext_caps); ++ kfree(xhci->usb2_rhub.psi); ++ kfree(xhci->usb3_rhub.psi); + + xhci->usb2_ports = NULL; + xhci->usb3_ports = NULL; + xhci->port_array = NULL; ++ xhci->usb2_rhub.psi = NULL; ++ xhci->usb3_rhub.psi = NULL; + xhci->rh_bw = NULL; + xhci->ext_caps = NULL; + +-- +2.20.1 + diff --git a/queue-4.9/scsi-qla2xxx-fix-qla24xx_process_bidir_cmd.patch b/queue-4.9/scsi-qla2xxx-fix-qla24xx_process_bidir_cmd.patch new file mode 100644 index 00000000000..fee0ddc4f57 --- /dev/null +++ b/queue-4.9/scsi-qla2xxx-fix-qla24xx_process_bidir_cmd.patch @@ -0,0 +1,70 @@ +From 9047b3ec2eb8fce54a3897f0008f132579dd76a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Aug 2019 20:01:48 -0700 +Subject: scsi: qla2xxx: Fix qla24xx_process_bidir_cmd() + +From: Bart Van Assche + +[ Upstream commit c29282c65d1cf54daeea63be46243d7f69d72f4d ] + +Set the r??_data_len variables before using these instead of after. + +This patch fixes the following Coverity complaint: + +const: At condition req_data_len != rsp_data_len, the value of req_data_len +must be equal to 0. +const: At condition req_data_len != rsp_data_len, the value of rsp_data_len +must be equal to 0. +dead_error_condition: The condition req_data_len != rsp_data_len cannot be +true. + +Cc: Himanshu Madhani +Fixes: a9b6f722f62d ("[SCSI] qla2xxx: Implementation of bidirectional.") # v3.7. +Signed-off-by: Bart Van Assche +Tested-by: Himanshu Madhani +Reviewed-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_bsg.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c +index e7db95d442deb..09f7a8cfed4d0 100644 +--- a/drivers/scsi/qla2xxx/qla_bsg.c ++++ b/drivers/scsi/qla2xxx/qla_bsg.c +@@ -1744,8 +1744,8 @@ qla24xx_process_bidir_cmd(struct fc_bsg_job *bsg_job) + uint16_t nextlid = 0; + uint32_t tot_dsds; + srb_t *sp = NULL; +- uint32_t req_data_len = 0; +- uint32_t rsp_data_len = 0; ++ uint32_t req_data_len; ++ uint32_t rsp_data_len; + + /* Check the type of the adapter */ + if (!IS_BIDI_CAPABLE(ha)) { +@@ -1850,6 +1850,9 @@ qla24xx_process_bidir_cmd(struct fc_bsg_job *bsg_job) + goto done_unmap_sg; + } + ++ req_data_len = bsg_job->request_payload.payload_len; ++ rsp_data_len = bsg_job->reply_payload.payload_len; ++ + if (req_data_len != rsp_data_len) { + rval = EXT_STATUS_BUSY; + ql_log(ql_log_warn, vha, 0x70aa, +@@ -1857,10 +1860,6 @@ qla24xx_process_bidir_cmd(struct fc_bsg_job *bsg_job) + goto done_unmap_sg; + } + +- req_data_len = bsg_job->request_payload.payload_len; +- rsp_data_len = bsg_job->reply_payload.payload_len; +- +- + /* Alloc SRB structure */ + sp = qla2x00_get_sp(vha, &(vha->bidir_fcport), GFP_KERNEL); + if (!sp) { +-- +2.20.1 + diff --git a/queue-4.9/scsi-qla2xxx-fix-session-lookup-in-qlt_abort_work.patch b/queue-4.9/scsi-qla2xxx-fix-session-lookup-in-qlt_abort_work.patch new file mode 100644 index 00000000000..1c6aa462c69 --- /dev/null +++ b/queue-4.9/scsi-qla2xxx-fix-session-lookup-in-qlt_abort_work.patch @@ -0,0 +1,48 @@ +From ba49a6674b5f0ec81d0e5bcc0c503d4bdb0596df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Aug 2019 20:01:40 -0700 +Subject: scsi: qla2xxx: Fix session lookup in qlt_abort_work() + +From: Bart Van Assche + +[ Upstream commit ac452b8e79320c9e90c78edf32ba2d42431e4daf ] + +Pass the correct session ID to find_sess_by_s_id() instead of passing an +uninitialized variable. + +Cc: Himanshu Madhani +Fixes: 2d70c103fd2a ("[SCSI] qla2xxx: Add LLD target-mode infrastructure for >= 24xx series") # v3.5. +Signed-off-by: Bart Van Assche +Tested-by: Himanshu Madhani +Reviewed-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_target.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index d13e91e164258..3b20cf8b161e4 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -5893,7 +5893,6 @@ static void qlt_abort_work(struct qla_tgt *tgt, + struct qla_hw_data *ha = vha->hw; + struct qla_tgt_sess *sess = NULL; + unsigned long flags = 0, flags2 = 0; +- uint32_t be_s_id; + uint8_t s_id[3]; + int rc; + +@@ -5906,8 +5905,7 @@ static void qlt_abort_work(struct qla_tgt *tgt, + s_id[1] = prm->abts.fcp_hdr_le.s_id[1]; + s_id[2] = prm->abts.fcp_hdr_le.s_id[0]; + +- sess = ha->tgt.tgt_ops->find_sess_by_s_id(vha, +- (unsigned char *)&be_s_id); ++ sess = ha->tgt.tgt_ops->find_sess_by_s_id(vha, s_id); + if (!sess) { + spin_unlock_irqrestore(&ha->tgt.sess_lock, flags2); + +-- +2.20.1 + diff --git a/queue-4.9/scsi-zfcp-trace-channel-log-even-for-fcp-command-res.patch b/queue-4.9/scsi-zfcp-trace-channel-log-even-for-fcp-command-res.patch new file mode 100644 index 00000000000..b36f4d4f54e --- /dev/null +++ b/queue-4.9/scsi-zfcp-trace-channel-log-even-for-fcp-command-res.patch @@ -0,0 +1,50 @@ +From 70aa85915486aee2cb67914195ae8e5426458dff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2019 18:12:53 +0200 +Subject: scsi: zfcp: trace channel log even for FCP command responses + +From: Steffen Maier + +[ Upstream commit 100843f176109af94600e500da0428e21030ca7f ] + +While v2.6.26 commit b75db73159cc ("[SCSI] zfcp: Add qtcb dump to hba debug +trace") is right that we don't want to flood the (payload) trace ring +buffer, we don't trace successful FCP command responses by default. So we +can include the channel log for problem determination with failed responses +of any FSF request type. + +Fixes: b75db73159cc ("[SCSI] zfcp: Add qtcb dump to hba debug trace") +Fixes: a54ca0f62f95 ("[SCSI] zfcp: Redesign of the debug tracing for HBA records.") +Cc: #2.6.38+ +Link: https://lore.kernel.org/r/e37597b5c4ae123aaa85fd86c23a9f71e994e4a9.1572018132.git.bblock@linux.ibm.com +Reviewed-by: Benjamin Block +Signed-off-by: Steffen Maier +Signed-off-by: Benjamin Block +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/s390/scsi/zfcp_dbf.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c +index b6caad0fee24c..c53ea0ac5f460 100644 +--- a/drivers/s390/scsi/zfcp_dbf.c ++++ b/drivers/s390/scsi/zfcp_dbf.c +@@ -93,11 +93,9 @@ void zfcp_dbf_hba_fsf_res(char *tag, int level, struct zfcp_fsf_req *req) + memcpy(rec->u.res.fsf_status_qual, &q_head->fsf_status_qual, + FSF_STATUS_QUALIFIER_SIZE); + +- if (req->fsf_command != FSF_QTCB_FCP_CMND) { +- rec->pl_len = q_head->log_length; +- zfcp_dbf_pl_write(dbf, (char *)q_pref + q_head->log_start, +- rec->pl_len, "fsf_res", req->req_id); +- } ++ rec->pl_len = q_head->log_length; ++ zfcp_dbf_pl_write(dbf, (char *)q_pref + q_head->log_start, ++ rec->pl_len, "fsf_res", req->req_id); + + debug_event(dbf->hba, level, rec, sizeof(*rec)); + spin_unlock_irqrestore(&dbf->hba_lock, flags); +-- +2.20.1 + diff --git a/queue-4.9/series b/queue-4.9/series index 10f15e2dfec..3518f090e8c 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -145,3 +145,21 @@ video-hdmi-fix-avi-bar-unpack.patch quota-check-that-quota-is-not-dirty-before-release.patch ext2-check-err-when-partial-null.patch quota-fix-livelock-in-dquot_writeback_dquots.patch +scsi-zfcp-trace-channel-log-even-for-fcp-command-res.patch +usb-xhci-only-set-d3hot-for-pci-device.patch +scsi-qla2xxx-fix-message-indicating-vectors-used-by-.patch +xhci-make-sure-interrupts-are-restored-to-correct-st.patch +iio-adis16480-add-debugfs_reg_access-entry.patch +btrfs-fix-negative-subv_writers-counter-and-data-spa.patch +omap-pdata-quirks-remove-openpandora-quirks-for-mmc3.patch +scsi-lpfc-cap-npiv-vports-to-256.patch +e100-fix-passing-zero-to-ptr_err-warning-in-e100_loa.patch +x86-mce-amd-turn-off-mc4_misc-thresholding-on-all-fa.patch +x86-mce-amd-carve-out-the-mc4_misc-thresholding-quir.patch +ath10k-fix-fw-crash-by-moving-chip-reset-after-napi-.patch +arm-dts-omap3-tao3530-fix-incorrect-mmc-card-detecti.patch +pinctrl-samsung-fix-device-node-refcount-leaks-in-s3.patch +scsi-qla2xxx-fix-dma-unmap-leak.patch +scsi-qla2xxx-fix-session-lookup-in-qlt_abort_work.patch +scsi-qla2xxx-fix-qla24xx_process_bidir_cmd.patch +scsi-qla2xxx-always-check-the-qla2x00_wait_for_hba_o.patch diff --git a/queue-4.9/usb-xhci-only-set-d3hot-for-pci-device.patch b/queue-4.9/usb-xhci-only-set-d3hot-for-pci-device.patch new file mode 100644 index 00000000000..40c9dacfeba --- /dev/null +++ b/queue-4.9/usb-xhci-only-set-d3hot-for-pci-device.patch @@ -0,0 +1,90 @@ +From 1db08226d7817daad183fdd4c5267357b9489081 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2019 16:20:04 +0200 +Subject: usb: xhci: only set D3hot for pci device + +From: Henry Lin + +[ Upstream commit f2c710f7dca8457e88b4ac9de2060f011254f9dd ] + +Xhci driver cannot call pci_set_power_state() on non-pci xhci host +controllers. For example, NVIDIA Tegra XHCI host controller which acts +as platform device with XHCI_SPURIOUS_WAKEUP quirk set in some platform +hits this issue during shutdown. + +Cc: +Fixes: 638298dc66ea ("xhci: Fix spurious wakeups after S5 on Haswell") +Signed-off-by: Henry Lin +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20191211142007.8847-4-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-pci.c | 13 +++++++++++++ + drivers/usb/host/xhci.c | 5 +---- + drivers/usb/host/xhci.h | 1 + + 3 files changed, 15 insertions(+), 4 deletions(-) + +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index b5140555a8d51..99bef8518fd2f 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -470,6 +470,18 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated) + } + #endif /* CONFIG_PM */ + ++static void xhci_pci_shutdown(struct usb_hcd *hcd) ++{ ++ struct xhci_hcd *xhci = hcd_to_xhci(hcd); ++ struct pci_dev *pdev = to_pci_dev(hcd->self.controller); ++ ++ xhci_shutdown(hcd); ++ ++ /* Yet another workaround for spurious wakeups at shutdown with HSW */ ++ if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) ++ pci_set_power_state(pdev, PCI_D3hot); ++} ++ + /*-------------------------------------------------------------------------*/ + + /* PCI driver selection metadata; PCI hotplugging uses this */ +@@ -505,6 +517,7 @@ static int __init xhci_pci_init(void) + #ifdef CONFIG_PM + xhci_pci_hc_driver.pci_suspend = xhci_pci_suspend; + xhci_pci_hc_driver.pci_resume = xhci_pci_resume; ++ xhci_pci_hc_driver.shutdown = xhci_pci_shutdown; + #endif + return pci_register_driver(&xhci_pci_driver); + } +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 06568a26de339..baacc442ec6a2 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -758,11 +758,8 @@ void xhci_shutdown(struct usb_hcd *hcd) + xhci_dbg_trace(xhci, trace_xhci_dbg_init, + "xhci_shutdown completed - status = %x", + readl(&xhci->op_regs->status)); +- +- /* Yet another workaround for spurious wakeups at shutdown with HSW */ +- if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) +- pci_set_power_state(to_pci_dev(hcd->self.controller), PCI_D3hot); + } ++EXPORT_SYMBOL_GPL(xhci_shutdown); + + #ifdef CONFIG_PM + static void xhci_save_registers(struct xhci_hcd *xhci) +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index de4771ce0df66..7472de2f704e3 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1865,6 +1865,7 @@ int xhci_run(struct usb_hcd *hcd); + void xhci_stop(struct usb_hcd *hcd); + void xhci_shutdown(struct usb_hcd *hcd); + int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks); ++void xhci_shutdown(struct usb_hcd *hcd); + void xhci_init_driver(struct hc_driver *drv, + const struct xhci_driver_overrides *over); + +-- +2.20.1 + diff --git a/queue-4.9/x86-mce-amd-carve-out-the-mc4_misc-thresholding-quir.patch b/queue-4.9/x86-mce-amd-carve-out-the-mc4_misc-thresholding-quir.patch new file mode 100644 index 00000000000..3a796eb59de --- /dev/null +++ b/queue-4.9/x86-mce-amd-carve-out-the-mc4_misc-thresholding-quir.patch @@ -0,0 +1,130 @@ +From 733255a13b9b4c6cd38acf76c709af224e7e1e46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jan 2019 15:10:40 +0000 +Subject: x86/MCE/AMD: Carve out the MC4_MISC thresholding quirk + +From: Shirish S + +[ Upstream commit 30aa3d26edb0f3d7992757287eec0ca588a5c259 ] + +The MC4_MISC thresholding quirk needs to be applied during S5 -> S0 and +S3 -> S0 state transitions, which follow different code paths. Carve it +out into a separate function and call it mce_amd_feature_init() where +the two code paths of the state transitions converge. + + [ bp: massage commit message and the carved out function. ] + +Signed-off-by: Shirish S +Signed-off-by: Borislav Petkov +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: Kees Cook +Cc: Thomas Gleixner +Cc: Tony Luck +Cc: Vishal Verma +Cc: Yazen Ghannam +Cc: x86-ml +Link: https://lkml.kernel.org/r/1547651417-23583-3-git-send-email-shirish.s@amd.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/mcheck/mce.c | 29 ---------------------- + arch/x86/kernel/cpu/mcheck/mce_amd.c | 36 ++++++++++++++++++++++++++++ + 2 files changed, 36 insertions(+), 29 deletions(-) + +diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c +index 2664c3df85a60..d3b2c5b25c9c0 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -1648,35 +1648,6 @@ static int __mcheck_cpu_apply_quirks(struct cpuinfo_x86 *c) + if (c->x86 == 0x15 && c->x86_model <= 0xf) + mce_flags.overflow_recov = 1; + +- /* +- * Turn off MC4_MISC thresholding banks on all models since +- * they're not supported there. +- */ +- if (c->x86 == 0x15) { +- int i; +- u64 hwcr; +- bool need_toggle; +- u32 msrs[] = { +- 0x00000413, /* MC4_MISC0 */ +- 0xc0000408, /* MC4_MISC1 */ +- }; +- +- rdmsrl(MSR_K7_HWCR, hwcr); +- +- /* McStatusWrEn has to be set */ +- need_toggle = !(hwcr & BIT(18)); +- +- if (need_toggle) +- wrmsrl(MSR_K7_HWCR, hwcr | BIT(18)); +- +- /* Clear CntP bit safely */ +- for (i = 0; i < ARRAY_SIZE(msrs); i++) +- msr_clear_bit(msrs[i], 62); +- +- /* restore old settings */ +- if (need_toggle) +- wrmsrl(MSR_K7_HWCR, hwcr); +- } + } + + if (c->x86_vendor == X86_VENDOR_INTEL) { +diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c +index 39526e1e3132d..2a473cda39774 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c ++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c +@@ -499,6 +499,40 @@ out: + return offset; + } + ++/* ++ * Turn off MC4_MISC thresholding banks on all family 0x15 models since ++ * they're not supported there. ++ */ ++void disable_err_thresholding(struct cpuinfo_x86 *c) ++{ ++ int i; ++ u64 hwcr; ++ bool need_toggle; ++ u32 msrs[] = { ++ 0x00000413, /* MC4_MISC0 */ ++ 0xc0000408, /* MC4_MISC1 */ ++ }; ++ ++ if (c->x86 != 0x15) ++ return; ++ ++ rdmsrl(MSR_K7_HWCR, hwcr); ++ ++ /* McStatusWrEn has to be set */ ++ need_toggle = !(hwcr & BIT(18)); ++ ++ if (need_toggle) ++ wrmsrl(MSR_K7_HWCR, hwcr | BIT(18)); ++ ++ /* Clear CntP bit safely */ ++ for (i = 0; i < ARRAY_SIZE(msrs); i++) ++ msr_clear_bit(msrs[i], 62); ++ ++ /* restore old settings */ ++ if (need_toggle) ++ wrmsrl(MSR_K7_HWCR, hwcr); ++} ++ + /* cpu init entry point, called from mce.c with preempt off */ + void mce_amd_feature_init(struct cpuinfo_x86 *c) + { +@@ -506,6 +540,8 @@ void mce_amd_feature_init(struct cpuinfo_x86 *c) + unsigned int bank, block, cpu = smp_processor_id(); + int offset = -1; + ++ disable_err_thresholding(c); ++ + for (bank = 0; bank < mca_cfg.banks; ++bank) { + if (mce_flags.smca) + get_smca_bank_info(bank); +-- +2.20.1 + diff --git a/queue-4.9/x86-mce-amd-turn-off-mc4_misc-thresholding-on-all-fa.patch b/queue-4.9/x86-mce-amd-turn-off-mc4_misc-thresholding-on-all-fa.patch new file mode 100644 index 00000000000..5b63dfb50ed --- /dev/null +++ b/queue-4.9/x86-mce-amd-turn-off-mc4_misc-thresholding-on-all-fa.patch @@ -0,0 +1,49 @@ +From aa4e1f68b9f1430bd6cecd402ed48250a661f744 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jan 2019 07:54:40 +0000 +Subject: x86/MCE/AMD: Turn off MC4_MISC thresholding on all family 0x15 models + +From: Shirish S + +[ Upstream commit c95b323dcd3598dd7ef5005d6723c1ba3b801093 ] + +MC4_MISC thresholding is not supported on all family 0x15 processors, +hence skip the x86_model check when applying the quirk. + + [ bp: massage commit message. ] + +Signed-off-by: Shirish S +Signed-off-by: Borislav Petkov +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: Thomas Gleixner +Cc: Tony Luck +Cc: Vishal Verma +Cc: x86-ml +Link: https://lkml.kernel.org/r/1547106849-3476-2-git-send-email-shirish.s@amd.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/mcheck/mce.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c +index e348bee411e35..2664c3df85a60 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -1649,11 +1649,10 @@ static int __mcheck_cpu_apply_quirks(struct cpuinfo_x86 *c) + mce_flags.overflow_recov = 1; + + /* +- * Turn off MC4_MISC thresholding banks on those models since ++ * Turn off MC4_MISC thresholding banks on all models since + * they're not supported there. + */ +- if (c->x86 == 0x15 && +- (c->x86_model >= 0x10 && c->x86_model <= 0x1f)) { ++ if (c->x86 == 0x15) { + int i; + u64 hwcr; + bool need_toggle; +-- +2.20.1 + diff --git a/queue-4.9/xhci-make-sure-interrupts-are-restored-to-correct-st.patch b/queue-4.9/xhci-make-sure-interrupts-are-restored-to-correct-st.patch new file mode 100644 index 00000000000..90d67dddd99 --- /dev/null +++ b/queue-4.9/xhci-make-sure-interrupts-are-restored-to-correct-st.patch @@ -0,0 +1,69 @@ +From bb7bc5ee0738302a0ace18c91b3a5ac415aa0112 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2019 16:20:07 +0200 +Subject: xhci: make sure interrupts are restored to correct state + +From: Mathias Nyman + +[ Upstream commit bd82873f23c9a6ad834348f8b83f3b6a5bca2c65 ] + +spin_unlock_irqrestore() might be called with stale flags after +reading port status, possibly restoring interrupts to a incorrect +state. + +If a usb2 port just finished resuming while the port status is read +the spin lock will be temporary released and re-acquired in a separate +function. The flags parameter is passed as value instead of a pointer, +not updating flags properly before the final spin_unlock_irqrestore() +is called. + +Cc: # v3.12+ +Fixes: 8b3d45705e54 ("usb: Fix xHCI host issues on remote wakeup.") +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20191211142007.8847-7-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-hub.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 39e2d32710355..6777a81fb372b 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -728,7 +728,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, + struct xhci_bus_state *bus_state, + __le32 __iomem **port_array, + u16 wIndex, u32 raw_port_status, +- unsigned long flags) ++ unsigned long *flags) + __releases(&xhci->lock) + __acquires(&xhci->lock) + { +@@ -810,12 +810,12 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, + xhci_set_link_state(xhci, port_array, wIndex, + XDEV_U0); + +- spin_unlock_irqrestore(&xhci->lock, flags); ++ spin_unlock_irqrestore(&xhci->lock, *flags); + time_left = wait_for_completion_timeout( + &bus_state->rexit_done[wIndex], + msecs_to_jiffies( + XHCI_MAX_REXIT_TIMEOUT_MS)); +- spin_lock_irqsave(&xhci->lock, flags); ++ spin_lock_irqsave(&xhci->lock, *flags); + + if (time_left) { + slot_id = xhci_find_slot_id_by_port(hcd, +@@ -961,7 +961,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + break; + } + status = xhci_get_port_status(hcd, bus_state, port_array, +- wIndex, temp, flags); ++ wIndex, temp, &flags); + if (status == 0xffffffff) + goto error; + +-- +2.20.1 +