From f720d24e4ae550a47b8c1b34fd2600b6e70b1fc6 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 23 Feb 2018 11:58:57 +0100 Subject: [PATCH] 4.9-stable patches added patches: 509-fix-printing-uninitialized-stack-memory-when-oid-is-empty.patch arm-am33xx-prm-remove-am33xx_pwrdm_read_prev_pwrst-function.patch arm-dts-am4372-correct-the-interrupts_properties-of-mcasp.patch arm-dts-am437x-cm-t43-correct-the-dmas-property-of-spi0.patch arm-dts-fix-elm-interrupt-compiler-warning.patch arm-dts-fix-omap4-hang-with-gps-connected-to-usb-by-using-wakeupgen.patch arm-dts-logicpd-som-lv-fix-gpmc-addresses-for-nand-and-enet.patch arm-dts-logicpd-somlv-fix-wl127x-pinmux.patch arm-omap2-fix-sram-virt-to-phys-translation-for-save_secure_ram_context.patch asoc-rockchip-disable-clock-on-error.patch brcmfmac-avoid-build-error-with-make-w-1.patch btrfs-fix-possible-off-by-one-in-btrfs_search_path_in_tree.patch clk-fix-a-panic-error-caused-by-accessing-null-pointer.patch dmaengine-at_hdmac-fix-potential-null-pointer-dereference-in-atc_prep_dma_interleaved.patch dmaengine-ioat-fix-error-handling-path.patch dmaengine-jz4740-disable-unprepare-clk-if-probe-fails.patch drm-armada-fix-leak-of-crtc-structure.patch gianfar-disable-eee-autoneg-by-default.patch gianfar-fix-a-flooded-alignment-reports-because-of-padding-issue.patch hippi-fix-a-fix-a-possible-sleep-in-atomic-bug-in-rr_close.patch i40iw-correct-arp-index-mask.patch ipvlan-add-the-skb-mark-as-flow4-s-member-to-lookup-route.patch m68k-add-missing-softirqentry_text-linker-section.patch media-s5k6aa-describe-some-function-parameters.patch mm-early_ioremap-fix-boot-hang-with-earlyprintk-efi-keep.patch net-ethernet-arc-fix-error-handling-in-emac_rockchip_probe.patch net_sched-red-avoid-devision-by-zero.patch net_sched-red-avoid-illegal-values.patch perf-bench-numa-fixup-discontiguous-sparse-numa-nodes.patch perf-top-fix-window-dimensions-change-handling.patch pinctrl-sunxi-fix-a64-uart-mux-value.patch pinctrl-sunxi-fix-a80-interrupt-pin-bank.patch platform-x86-dell-laptop-fix-keyboard-max-lighting-for-dell-latitude-e6410.patch powerpc-perf-fix-oops-when-grouping-different-pmu-events.patch rdma-cma-make-sure-that-psn-is-not-over-max-allowed.patch s390-dasd-prevent-prefix-i-o-error.patch scripts-kernel-doc-don-t-fail-with-status-0-if-error-encountered-with-none.patch sctp-only-update-outstanding_bytes-for-transmitted-queue-when-doing-prsctp_prune.patch spi-sun4i-disable-clocks-in-the-remove-function.patch usb-build-drivers-usb-common-when-usb_support-is-set.patch usb-dwc3-gadget-wait-longer-for-controller-to-end-command-processing.patch usb-dwc3-of-simple-fix-missing-clk_disable_unprepare.patch x86-mm-kmmio-fix-mmiotrace-for-page-unaligned-addresses.patch xen-xen_acpi_processor-is-dom0-only.patch xfrm-fix-stack-out-of-bounds-with-misconfigured-transport-mode-policies.patch --- ...lized-stack-memory-when-oid-is-empty.patch | 56 +++++ ...m33xx_pwrdm_read_prev_pwrst-function.patch | 59 +++++ ...t-the-interrupts_properties-of-mcasp.patch | 50 +++++ ...43-correct-the-dmas-property-of-spi0.patch | 34 +++ ...s-fix-elm-interrupt-compiler-warning.patch | 34 +++ ...-connected-to-usb-by-using-wakeupgen.patch | 61 ++++++ ...fix-gpmc-addresses-for-nand-and-enet.patch | 49 +++++ ...-dts-logicpd-somlv-fix-wl127x-pinmux.patch | 70 ++++++ ...nslation-for-save_secure_ram_context.patch | 201 ++++++++++++++++++ ...asoc-rockchip-disable-clock-on-error.patch | 73 +++++++ ...fmac-avoid-build-error-with-make-w-1.patch | 40 ++++ ...-by-one-in-btrfs_search_path_in_tree.patch | 56 +++++ ...ror-caused-by-accessing-null-pointer.patch | 43 ++++ ...eference-in-atc_prep_dma_interleaved.patch | 48 +++++ ...aengine-ioat-fix-error-handling-path.patch | 33 +++ ...disable-unprepare-clk-if-probe-fails.patch | 44 ++++ ...rm-armada-fix-leak-of-crtc-structure.patch | 82 +++++++ ...anfar-disable-eee-autoneg-by-default.patch | 49 +++++ ...ent-reports-because-of-padding-issue.patch | 81 +++++++ ...ible-sleep-in-atomic-bug-in-rr_close.patch | 39 ++++ queue-4.9/i40iw-correct-arp-index-mask.patch | 38 ++++ ...rk-as-flow4-s-member-to-lookup-route.patch | 31 +++ ...ing-softirqentry_text-linker-section.patch | 72 +++++++ ...aa-describe-some-function-parameters.patch | 59 +++++ ...-boot-hang-with-earlyprintk-efi-keep.patch | 48 +++++ ...rror-handling-in-emac_rockchip_probe.patch | 46 ++++ ...net_sched-red-avoid-devision-by-zero.patch | 32 +++ .../net_sched-red-avoid-illegal-values.patch | 93 ++++++++ ...ixup-discontiguous-sparse-numa-nodes.patch | 132 ++++++++++++ ...ix-window-dimensions-change-handling.patch | 82 +++++++ ...pinctrl-sunxi-fix-a64-uart-mux-value.patch | 35 +++ ...trl-sunxi-fix-a80-interrupt-pin-bank.patch | 53 +++++ ...max-lighting-for-dell-latitude-e6410.patch | 71 +++++++ ...s-when-grouping-different-pmu-events.patch | 60 ++++++ ...ure-that-psn-is-not-over-max-allowed.patch | 35 +++ .../s390-dasd-prevent-prefix-i-o-error.patch | 62 ++++++ ...tus-0-if-error-encountered-with-none.patch | 52 +++++ ...mitted-queue-when-doing-prsctp_prune.patch | 58 +++++ queue-4.9/series | 45 ++++ ...isable-clocks-in-the-remove-function.patch | 35 +++ ...s-usb-common-when-usb_support-is-set.patch | 40 ++++ ...controller-to-end-command-processing.patch | 79 +++++++ ...le-fix-missing-clk_disable_unprepare.patch | 40 ++++ ...iotrace-for-page-unaligned-addresses.patch | 116 ++++++++++ .../xen-xen_acpi_processor-is-dom0-only.patch | 32 +++ ...isconfigured-transport-mode-policies.patch | 64 ++++++ 46 files changed, 2712 insertions(+) create mode 100644 queue-4.9/509-fix-printing-uninitialized-stack-memory-when-oid-is-empty.patch create mode 100644 queue-4.9/arm-am33xx-prm-remove-am33xx_pwrdm_read_prev_pwrst-function.patch create mode 100644 queue-4.9/arm-dts-am4372-correct-the-interrupts_properties-of-mcasp.patch create mode 100644 queue-4.9/arm-dts-am437x-cm-t43-correct-the-dmas-property-of-spi0.patch create mode 100644 queue-4.9/arm-dts-fix-elm-interrupt-compiler-warning.patch create mode 100644 queue-4.9/arm-dts-fix-omap4-hang-with-gps-connected-to-usb-by-using-wakeupgen.patch create mode 100644 queue-4.9/arm-dts-logicpd-som-lv-fix-gpmc-addresses-for-nand-and-enet.patch create mode 100644 queue-4.9/arm-dts-logicpd-somlv-fix-wl127x-pinmux.patch create mode 100644 queue-4.9/arm-omap2-fix-sram-virt-to-phys-translation-for-save_secure_ram_context.patch create mode 100644 queue-4.9/asoc-rockchip-disable-clock-on-error.patch create mode 100644 queue-4.9/brcmfmac-avoid-build-error-with-make-w-1.patch create mode 100644 queue-4.9/btrfs-fix-possible-off-by-one-in-btrfs_search_path_in_tree.patch create mode 100644 queue-4.9/clk-fix-a-panic-error-caused-by-accessing-null-pointer.patch create mode 100644 queue-4.9/dmaengine-at_hdmac-fix-potential-null-pointer-dereference-in-atc_prep_dma_interleaved.patch create mode 100644 queue-4.9/dmaengine-ioat-fix-error-handling-path.patch create mode 100644 queue-4.9/dmaengine-jz4740-disable-unprepare-clk-if-probe-fails.patch create mode 100644 queue-4.9/drm-armada-fix-leak-of-crtc-structure.patch create mode 100644 queue-4.9/gianfar-disable-eee-autoneg-by-default.patch create mode 100644 queue-4.9/gianfar-fix-a-flooded-alignment-reports-because-of-padding-issue.patch create mode 100644 queue-4.9/hippi-fix-a-fix-a-possible-sleep-in-atomic-bug-in-rr_close.patch create mode 100644 queue-4.9/i40iw-correct-arp-index-mask.patch create mode 100644 queue-4.9/ipvlan-add-the-skb-mark-as-flow4-s-member-to-lookup-route.patch create mode 100644 queue-4.9/m68k-add-missing-softirqentry_text-linker-section.patch create mode 100644 queue-4.9/media-s5k6aa-describe-some-function-parameters.patch create mode 100644 queue-4.9/mm-early_ioremap-fix-boot-hang-with-earlyprintk-efi-keep.patch create mode 100644 queue-4.9/net-ethernet-arc-fix-error-handling-in-emac_rockchip_probe.patch create mode 100644 queue-4.9/net_sched-red-avoid-devision-by-zero.patch create mode 100644 queue-4.9/net_sched-red-avoid-illegal-values.patch create mode 100644 queue-4.9/perf-bench-numa-fixup-discontiguous-sparse-numa-nodes.patch create mode 100644 queue-4.9/perf-top-fix-window-dimensions-change-handling.patch create mode 100644 queue-4.9/pinctrl-sunxi-fix-a64-uart-mux-value.patch create mode 100644 queue-4.9/pinctrl-sunxi-fix-a80-interrupt-pin-bank.patch create mode 100644 queue-4.9/platform-x86-dell-laptop-fix-keyboard-max-lighting-for-dell-latitude-e6410.patch create mode 100644 queue-4.9/powerpc-perf-fix-oops-when-grouping-different-pmu-events.patch create mode 100644 queue-4.9/rdma-cma-make-sure-that-psn-is-not-over-max-allowed.patch create mode 100644 queue-4.9/s390-dasd-prevent-prefix-i-o-error.patch create mode 100644 queue-4.9/scripts-kernel-doc-don-t-fail-with-status-0-if-error-encountered-with-none.patch create mode 100644 queue-4.9/sctp-only-update-outstanding_bytes-for-transmitted-queue-when-doing-prsctp_prune.patch create mode 100644 queue-4.9/spi-sun4i-disable-clocks-in-the-remove-function.patch create mode 100644 queue-4.9/usb-build-drivers-usb-common-when-usb_support-is-set.patch create mode 100644 queue-4.9/usb-dwc3-gadget-wait-longer-for-controller-to-end-command-processing.patch create mode 100644 queue-4.9/usb-dwc3-of-simple-fix-missing-clk_disable_unprepare.patch create mode 100644 queue-4.9/x86-mm-kmmio-fix-mmiotrace-for-page-unaligned-addresses.patch create mode 100644 queue-4.9/xen-xen_acpi_processor-is-dom0-only.patch create mode 100644 queue-4.9/xfrm-fix-stack-out-of-bounds-with-misconfigured-transport-mode-policies.patch diff --git a/queue-4.9/509-fix-printing-uninitialized-stack-memory-when-oid-is-empty.patch b/queue-4.9/509-fix-printing-uninitialized-stack-memory-when-oid-is-empty.patch new file mode 100644 index 00000000000..e682c701033 --- /dev/null +++ b/queue-4.9/509-fix-printing-uninitialized-stack-memory-when-oid-is-empty.patch @@ -0,0 +1,56 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Eric Biggers +Date: Fri, 8 Dec 2017 15:13:28 +0000 +Subject: 509: fix printing uninitialized stack memory when OID is empty + +From: Eric Biggers + + +[ Upstream commit 8dfd2f22d3bf3ab7714f7495ad5d897b8845e8c1 ] + +Callers of sprint_oid() do not check its return value before printing +the result. In the case where the OID is zero-length, -EBADMSG was +being returned without anything being written to the buffer, resulting +in uninitialized stack memory being printed. Fix this by writing +"(bad)" to the buffer in the cases where -EBADMSG is returned. + +Fixes: 4f73175d0375 ("X.509: Add utility functions to render OIDs as strings") +Signed-off-by: Eric Biggers +Signed-off-by: David Howells +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + lib/oid_registry.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/lib/oid_registry.c ++++ b/lib/oid_registry.c +@@ -116,7 +116,7 @@ int sprint_oid(const void *data, size_t + int count; + + if (v >= end) +- return -EBADMSG; ++ goto bad; + + n = *v++; + ret = count = snprintf(buffer, bufsize, "%u.%u", n / 40, n % 40); +@@ -134,7 +134,7 @@ int sprint_oid(const void *data, size_t + num = n & 0x7f; + do { + if (v >= end) +- return -EBADMSG; ++ goto bad; + n = *v++; + num <<= 7; + num |= n & 0x7f; +@@ -148,6 +148,10 @@ int sprint_oid(const void *data, size_t + } + + return ret; ++ ++bad: ++ snprintf(buffer, bufsize, "(bad)"); ++ return -EBADMSG; + } + EXPORT_SYMBOL_GPL(sprint_oid); + diff --git a/queue-4.9/arm-am33xx-prm-remove-am33xx_pwrdm_read_prev_pwrst-function.patch b/queue-4.9/arm-am33xx-prm-remove-am33xx_pwrdm_read_prev_pwrst-function.patch new file mode 100644 index 00000000000..4038b6f91e5 --- /dev/null +++ b/queue-4.9/arm-am33xx-prm-remove-am33xx_pwrdm_read_prev_pwrst-function.patch @@ -0,0 +1,59 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Keerthy +Date: Fri, 10 Nov 2017 16:56:52 +0530 +Subject: ARM: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function + +From: Keerthy + + +[ Upstream commit b6d6af7226465b6d11eac09d0be2ab78a4a9eb62 ] + +Referring TRM Am335X series: +http://www.ti.com/lit/ug/spruh73p/spruh73p.pdf + +The LastPowerStateEntered bitfield is present only for PM_CEFUSE +domain. This is not present in any of the other power domains. Hence +remove the generic am33xx_pwrdm_read_prev_pwrst hook which wrongly +reads the reserved bit fields for all the other power domains. + +Reading the reserved bits leads to wrongly interpreting the low +power transitions for various power domains that do not have the +LastPowerStateEntered field. The pm debug counters values are wrong +currently as we are incrementing them based on the reserved bits. + +Signed-off-by: Keerthy +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-omap2/prm33xx.c | 12 ------------ + 1 file changed, 12 deletions(-) + +--- a/arch/arm/mach-omap2/prm33xx.c ++++ b/arch/arm/mach-omap2/prm33xx.c +@@ -176,17 +176,6 @@ static int am33xx_pwrdm_read_pwrst(struc + return v; + } + +-static int am33xx_pwrdm_read_prev_pwrst(struct powerdomain *pwrdm) +-{ +- u32 v; +- +- v = am33xx_prm_read_reg(pwrdm->prcm_offs, pwrdm->pwrstst_offs); +- v &= AM33XX_LASTPOWERSTATEENTERED_MASK; +- v >>= AM33XX_LASTPOWERSTATEENTERED_SHIFT; +- +- return v; +-} +- + static int am33xx_pwrdm_set_lowpwrstchange(struct powerdomain *pwrdm) + { + am33xx_prm_rmw_reg_bits(AM33XX_LOWPOWERSTATECHANGE_MASK, +@@ -357,7 +346,6 @@ struct pwrdm_ops am33xx_pwrdm_operations + .pwrdm_set_next_pwrst = am33xx_pwrdm_set_next_pwrst, + .pwrdm_read_next_pwrst = am33xx_pwrdm_read_next_pwrst, + .pwrdm_read_pwrst = am33xx_pwrdm_read_pwrst, +- .pwrdm_read_prev_pwrst = am33xx_pwrdm_read_prev_pwrst, + .pwrdm_set_logic_retst = am33xx_pwrdm_set_logic_retst, + .pwrdm_read_logic_pwrst = am33xx_pwrdm_read_logic_pwrst, + .pwrdm_read_logic_retst = am33xx_pwrdm_read_logic_retst, diff --git a/queue-4.9/arm-dts-am4372-correct-the-interrupts_properties-of-mcasp.patch b/queue-4.9/arm-dts-am4372-correct-the-interrupts_properties-of-mcasp.patch new file mode 100644 index 00000000000..25d868e5bc3 --- /dev/null +++ b/queue-4.9/arm-dts-am4372-correct-the-interrupts_properties-of-mcasp.patch @@ -0,0 +1,50 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Peter Ujfalusi +Date: Wed, 1 Nov 2017 11:03:31 +0200 +Subject: ARM: dts: am4372: Correct the interrupts_properties of McASP + +From: Peter Ujfalusi + + +[ Upstream commit 627395a6f8091c0aa18f49dca7df59ba3ec147ef ] + +Fixes the following warnings: + +arch/arm/boot/dts/am437x-cm-t43.dtb: Warning (interrupts_property): +interrupts size is (8), expected multiple of 12 in +/ocp@44000000/mcasp@48038000 + +arch/arm/boot/dts/am437x-cm-t43.dtb: Warning (interrupts_property): +interrupts size is (8), expected multiple of 12 in +/ocp@44000000/mcasp@4803C000 + +Signed-off-by: Peter Ujfalusi +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/am4372.dtsi | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/am4372.dtsi ++++ b/arch/arm/boot/dts/am4372.dtsi +@@ -926,7 +926,8 @@ + reg = <0x48038000 0x2000>, + <0x46000000 0x400000>; + reg-names = "mpu", "dat"; +- interrupts = <80>, <81>; ++ interrupts = , ++ ; + interrupt-names = "tx", "rx"; + status = "disabled"; + dmas = <&edma 8 2>, +@@ -940,7 +941,8 @@ + reg = <0x4803C000 0x2000>, + <0x46400000 0x400000>; + reg-names = "mpu", "dat"; +- interrupts = <82>, <83>; ++ interrupts = , ++ ; + interrupt-names = "tx", "rx"; + status = "disabled"; + dmas = <&edma 10 2>, diff --git a/queue-4.9/arm-dts-am437x-cm-t43-correct-the-dmas-property-of-spi0.patch b/queue-4.9/arm-dts-am437x-cm-t43-correct-the-dmas-property-of-spi0.patch new file mode 100644 index 00000000000..4c00fc0a445 --- /dev/null +++ b/queue-4.9/arm-dts-am437x-cm-t43-correct-the-dmas-property-of-spi0.patch @@ -0,0 +1,34 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Peter Ujfalusi +Date: Wed, 1 Nov 2017 11:03:40 +0200 +Subject: ARM: dts: am437x-cm-t43: Correct the dmas property of spi0 + +From: Peter Ujfalusi + + +[ Upstream commit ca41e244517d6d3f1600c229ff7ca615049c1e9c ] + +The DMA binding for eDMA needs 2 parameters, not 1. +The second, missing parameter is the tptc to be used for the channel. + +Signed-off-by: Peter Ujfalusi +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/am437x-cm-t43.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/am437x-cm-t43.dts ++++ b/arch/arm/boot/dts/am437x-cm-t43.dts +@@ -301,8 +301,8 @@ + status = "okay"; + pinctrl-names = "default"; + pinctrl-0 = <&spi0_pins>; +- dmas = <&edma 16 +- &edma 17>; ++ dmas = <&edma 16 0 ++ &edma 17 0>; + dma-names = "tx0", "rx0"; + + flash: w25q64cvzpig@0 { diff --git a/queue-4.9/arm-dts-fix-elm-interrupt-compiler-warning.patch b/queue-4.9/arm-dts-fix-elm-interrupt-compiler-warning.patch new file mode 100644 index 00000000000..f2819befd26 --- /dev/null +++ b/queue-4.9/arm-dts-fix-elm-interrupt-compiler-warning.patch @@ -0,0 +1,34 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Tony Lindgren +Date: Mon, 4 Dec 2017 08:27:17 -0800 +Subject: ARM: dts: Fix elm interrupt compiler warning + +From: Tony Lindgren + + +[ Upstream commit d364b038bc962f494cffb8f6cb6cddbe41bcb5b6 ] + +Looks like the interrupt property is missing the controller and level +information causing: + +Warning (interrupts_property): interrupts size is (4), expected multiple +of 12 in /ocp/elm@48078000 + +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/omap4.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/omap4.dtsi ++++ b/arch/arm/boot/dts/omap4.dtsi +@@ -352,7 +352,7 @@ + elm: elm@48078000 { + compatible = "ti,am3352-elm"; + reg = <0x48078000 0x2000>; +- interrupts = <4>; ++ interrupts = ; + ti,hwmods = "elm"; + status = "disabled"; + }; diff --git a/queue-4.9/arm-dts-fix-omap4-hang-with-gps-connected-to-usb-by-using-wakeupgen.patch b/queue-4.9/arm-dts-fix-omap4-hang-with-gps-connected-to-usb-by-using-wakeupgen.patch new file mode 100644 index 00000000000..461e3d80415 --- /dev/null +++ b/queue-4.9/arm-dts-fix-omap4-hang-with-gps-connected-to-usb-by-using-wakeupgen.patch @@ -0,0 +1,61 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Tony Lindgren +Date: Fri, 17 Nov 2017 08:56:58 -0800 +Subject: ARM: dts: Fix omap4 hang with GPS connected to USB by using wakeupgen + +From: Tony Lindgren + + +[ Upstream commit cf87634c8b24e24bf379b8c6807c8b0fb5f23567 ] + +There's been a reproducable USB OHCI/EHCI cpuidle related hang on omap4 +for a while that happens after about 20 - 40 minutes on an idle system +with some data feeding device being connected, like a USB GPS device or +a cellular modem. + +This issue happens in cpuidle states C2 and C3 and does not happen if +cpuidle is limited to C1 state only. The symptoms are that the whole +system hangs and never wakes up from idle, and if a watchdog is +configured the system reboots after a while. + +Turns out that OHCI/EHCI devices on omap4 are trying to use the GIC +interrupt controller directly as a parent instead of the WUGEN. We +need to pass the interrupts through WUGEN to GIC to provide the wakeup +events for the processor. + +Let's fix the issue by removing the gic interrupt-parent and use the +default interrupt-parent wakeupgen instead. Note that omap5.dtsi had +this already fixes earlier by commit 7136d457f365 ("ARM: omap: convert +wakeupgen to stacked domains") but we somehow missed omap4 at that +point. + +Fixes: 7136d457f365 ("ARM: omap: convert wakeupgen to stacked domains") +Cc: Dave Gerlach +Cc: Nishanth Menon +Cc: Marc Zyngier +Cc: Sebastian Reichel +Reviewed-by: Roger Quadros +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/omap4.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +--- a/arch/arm/boot/dts/omap4.dtsi ++++ b/arch/arm/boot/dts/omap4.dtsi +@@ -859,14 +859,12 @@ + usbhsohci: ohci@4a064800 { + compatible = "ti,ohci-omap3"; + reg = <0x4a064800 0x400>; +- interrupt-parent = <&gic>; + interrupts = ; + }; + + usbhsehci: ehci@4a064c00 { + compatible = "ti,ehci-omap"; + reg = <0x4a064c00 0x400>; +- interrupt-parent = <&gic>; + interrupts = ; + }; + }; diff --git a/queue-4.9/arm-dts-logicpd-som-lv-fix-gpmc-addresses-for-nand-and-enet.patch b/queue-4.9/arm-dts-logicpd-som-lv-fix-gpmc-addresses-for-nand-and-enet.patch new file mode 100644 index 00000000000..4067a1b8748 --- /dev/null +++ b/queue-4.9/arm-dts-logicpd-som-lv-fix-gpmc-addresses-for-nand-and-enet.patch @@ -0,0 +1,49 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Adam Ford +Date: Tue, 31 Oct 2017 13:42:13 -0500 +Subject: ARM: dts: logicpd-som-lv: Fix gpmc addresses for NAND and enet + +From: Adam Ford + + +[ Upstream commit 3c18bbf3d11d2005da08b57ff26f44ff1c2b12d0 ] + +This patch fixes and issue where the NAND and GPMC based ethernet +controller stopped working. This also updates the GPMC settings +to be consistent with the Logic PD Torpedo development from the +commit listed above. + +Fixes: 44e4716499b8 ("ARM: dts: omap3: Fix NAND device nodes") + +Signed-off-by: Adam Ford +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts | 3 ++- + arch/arm/boot/dts/logicpd-som-lv.dtsi | 2 +- + 2 files changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts ++++ b/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts +@@ -72,7 +72,8 @@ + }; + + &gpmc { +- ranges = <1 0 0x08000000 0x1000000>; /* CS1: 16MB for LAN9221 */ ++ ranges = <0 0 0x30000000 0x1000000 /* CS0: 16MB for NAND */ ++ 1 0 0x2c000000 0x1000000>; /* CS1: 16MB for LAN9221 */ + + ethernet@gpmc { + pinctrl-names = "default"; +--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi ++++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi +@@ -37,7 +37,7 @@ + }; + + &gpmc { +- ranges = <0 0 0x00000000 0x1000000>; /* CS0: 16MB for NAND */ ++ ranges = <0 0 0x30000000 0x1000000>; /* CS0: 16MB for NAND */ + + nand@0,0 { + compatible = "ti,omap2-nand"; diff --git a/queue-4.9/arm-dts-logicpd-somlv-fix-wl127x-pinmux.patch b/queue-4.9/arm-dts-logicpd-somlv-fix-wl127x-pinmux.patch new file mode 100644 index 00000000000..6f91e7ce1d6 --- /dev/null +++ b/queue-4.9/arm-dts-logicpd-somlv-fix-wl127x-pinmux.patch @@ -0,0 +1,70 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Adam Ford +Date: Tue, 31 Oct 2017 13:45:59 -0500 +Subject: ARM: dts: logicpd-somlv: Fix wl127x pinmux + +From: Adam Ford + + +[ Upstream commit cd7594ac3281722cb8f10d6f6c7e4287747c7a9d ] + +The pin assignment for the wl127x interrupt was incorrect. I am +not sure how this every worked. This also eliminates a conflict with +the SMC911x ethernet driver and properly moves pinmuxes for the +related gpio to omap3_pmx_wkup from omap3_pmx_core. + +Fixes: ab8dd3aed011 ("ARM: DTS: Add minimal Support for Logic PD +DM3730 SOM-LV") + +Signed-off-by: Adam Ford +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/logicpd-som-lv.dtsi | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi ++++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi +@@ -121,7 +121,7 @@ + + &mmc3 { + interrupts-extended = <&intc 94 &omap3_pmx_core2 0x46>; +- pinctrl-0 = <&mmc3_pins>; ++ pinctrl-0 = <&mmc3_pins &wl127x_gpio>; + pinctrl-names = "default"; + vmmc-supply = <&wl12xx_vmmc>; + non-removable; +@@ -132,8 +132,8 @@ + wlcore: wlcore@2 { + compatible = "ti,wl1273"; + reg = <2>; +- interrupt-parent = <&gpio5>; +- interrupts = <24 IRQ_TYPE_LEVEL_HIGH>; /* gpio 152 */ ++ interrupt-parent = <&gpio1>; ++ interrupts = <2 IRQ_TYPE_LEVEL_HIGH>; /* gpio 2 */ + ref-clock-frequency = <26000000>; + }; + }; +@@ -157,8 +157,6 @@ + OMAP3_CORE1_IOPAD(0x2166, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat5.sdmmc3_dat1 */ + OMAP3_CORE1_IOPAD(0x2168, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat6.sdmmc3_dat2 */ + OMAP3_CORE1_IOPAD(0x216a, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat6.sdmmc3_dat3 */ +- OMAP3_CORE1_IOPAD(0x2184, PIN_INPUT_PULLUP | MUX_MODE4) /* mcbsp4_clkx.gpio_152 */ +- OMAP3_CORE1_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4) /* sys_boot1.gpio_3 */ + OMAP3_CORE1_IOPAD(0x21d0, PIN_INPUT_PULLUP | MUX_MODE3) /* mcspi1_cs1.sdmmc3_cmd */ + OMAP3_CORE1_IOPAD(0x21d2, PIN_INPUT_PULLUP | MUX_MODE3) /* mcspi1_cs2.sdmmc_clk */ + >; +@@ -228,6 +226,12 @@ + OMAP3_WKUP_IOPAD(0x2a0e, PIN_OUTPUT | MUX_MODE4) /* sys_boot2.gpio_4 */ + >; + }; ++ wl127x_gpio: pinmux_wl127x_gpio_pin { ++ pinctrl-single,pins = < ++ OMAP3_WKUP_IOPAD(0x2a0c, PIN_INPUT | MUX_MODE4) /* sys_boot0.gpio_2 */ ++ OMAP3_WKUP_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4) /* sys_boot1.gpio_3 */ ++ >; ++ }; + }; + + &omap3_pmx_core2 { diff --git a/queue-4.9/arm-omap2-fix-sram-virt-to-phys-translation-for-save_secure_ram_context.patch b/queue-4.9/arm-omap2-fix-sram-virt-to-phys-translation-for-save_secure_ram_context.patch new file mode 100644 index 00000000000..8d01c5e2fcf --- /dev/null +++ b/queue-4.9/arm-omap2-fix-sram-virt-to-phys-translation-for-save_secure_ram_context.patch @@ -0,0 +1,201 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Tony Lindgren +Date: Mon, 27 Nov 2017 08:57:26 -0800 +Subject: ARM: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context + +From: Tony Lindgren + + +[ Upstream commit d09220a887f70368afa79e850c95e74890c0a32d ] + +With the CMA changes from Joonsoo Kim , it +was noticed that n900 stopped booting. After investigating it turned +out that n900 save_secure_ram_context does some whacky virtual to +physical address translation for the SRAM data address. + +As we now only have minimal parts of omap3 idle code copied to SRAM, +running save_secure_ram_context() in SRAM is not needed. It only gets +called on PM init. And it seems there's no need to ever call this from +SRAM idle code. + +So let's just keep save_secure_ram_context() in DDR, and pass it the +physical address of the parameters. We can do everything else in +omap-secure.c like we already do for other secure code. + +And since we don't have any documentation, I still have no clue what +the values for 0, 1 and 1 for the parameters might be. If somebody has +figured it out, please do send a patch to add some comments. + +Debugged-by: Joonsoo Kim +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-omap2/omap-secure.c | 19 +++++++++++++++++++ + arch/arm/mach-omap2/omap-secure.h | 4 ++++ + arch/arm/mach-omap2/pm.h | 4 ---- + arch/arm/mach-omap2/pm34xx.c | 13 ++++--------- + arch/arm/mach-omap2/sleep34xx.S | 26 ++++---------------------- + 5 files changed, 31 insertions(+), 35 deletions(-) + +--- a/arch/arm/mach-omap2/omap-secure.c ++++ b/arch/arm/mach-omap2/omap-secure.c +@@ -73,6 +73,25 @@ phys_addr_t omap_secure_ram_mempool_base + return omap_secure_memblock_base; + } + ++u32 omap3_save_secure_ram(void __iomem *addr, int size) ++{ ++ u32 ret; ++ u32 param[5]; ++ ++ if (size != OMAP3_SAVE_SECURE_RAM_SZ) ++ return OMAP3_SAVE_SECURE_RAM_SZ; ++ ++ param[0] = 4; /* Number of arguments */ ++ param[1] = __pa(addr); /* Physical address for saving */ ++ param[2] = 0; ++ param[3] = 1; ++ param[4] = 1; ++ ++ ret = save_secure_ram_context(__pa(param)); ++ ++ return ret; ++} ++ + /** + * rx51_secure_dispatcher: Routine to dispatch secure PPA API calls + * @idx: The PPA API index +--- a/arch/arm/mach-omap2/omap-secure.h ++++ b/arch/arm/mach-omap2/omap-secure.h +@@ -31,6 +31,8 @@ + /* Maximum Secure memory storage size */ + #define OMAP_SECURE_RAM_STORAGE (88 * SZ_1K) + ++#define OMAP3_SAVE_SECURE_RAM_SZ 0x803F ++ + /* Secure low power HAL API index */ + #define OMAP4_HAL_SAVESECURERAM_INDEX 0x1a + #define OMAP4_HAL_SAVEHW_INDEX 0x1b +@@ -65,6 +67,8 @@ extern u32 omap_smc2(u32 id, u32 falg, u + extern u32 omap_smc3(u32 id, u32 process, u32 flag, u32 pargs); + extern phys_addr_t omap_secure_ram_mempool_base(void); + extern int omap_secure_ram_reserve_memblock(void); ++extern u32 save_secure_ram_context(u32 args_pa); ++extern u32 omap3_save_secure_ram(void __iomem *save_regs, int size); + + extern u32 rx51_secure_dispatcher(u32 idx, u32 process, u32 flag, u32 nargs, + u32 arg1, u32 arg2, u32 arg3, u32 arg4); +--- a/arch/arm/mach-omap2/pm.h ++++ b/arch/arm/mach-omap2/pm.h +@@ -81,10 +81,6 @@ extern unsigned int omap3_do_wfi_sz; + /* ... and its pointer from SRAM after copy */ + extern void (*omap3_do_wfi_sram)(void); + +-/* save_secure_ram_context function pointer and size, for copy to SRAM */ +-extern int save_secure_ram_context(u32 *addr); +-extern unsigned int save_secure_ram_context_sz; +- + extern void omap3_save_scratchpad_contents(void); + + #define PM_RTA_ERRATUM_i608 (1 << 0) +--- a/arch/arm/mach-omap2/pm34xx.c ++++ b/arch/arm/mach-omap2/pm34xx.c +@@ -48,6 +48,7 @@ + #include "prm3xxx.h" + #include "pm.h" + #include "sdrc.h" ++#include "omap-secure.h" + #include "sram.h" + #include "control.h" + #include "vc.h" +@@ -66,7 +67,6 @@ struct power_state { + + static LIST_HEAD(pwrst_list); + +-static int (*_omap_save_secure_sram)(u32 *addr); + void (*omap3_do_wfi_sram)(void); + + static struct powerdomain *mpu_pwrdm, *neon_pwrdm; +@@ -121,8 +121,8 @@ static void omap3_save_secure_ram_contex + * will hang the system. + */ + pwrdm_set_next_pwrst(mpu_pwrdm, PWRDM_POWER_ON); +- ret = _omap_save_secure_sram((u32 *)(unsigned long) +- __pa(omap3_secure_ram_storage)); ++ ret = omap3_save_secure_ram(omap3_secure_ram_storage, ++ OMAP3_SAVE_SECURE_RAM_SZ); + pwrdm_set_next_pwrst(mpu_pwrdm, mpu_next_state); + /* Following is for error tracking, it should not happen */ + if (ret) { +@@ -434,15 +434,10 @@ static int __init pwrdms_setup(struct po + * + * The minimum set of functions is pushed to SRAM for execution: + * - omap3_do_wfi for erratum i581 WA, +- * - save_secure_ram_context for security extensions. + */ + void omap_push_sram_idle(void) + { + omap3_do_wfi_sram = omap_sram_push(omap3_do_wfi, omap3_do_wfi_sz); +- +- if (omap_type() != OMAP2_DEVICE_TYPE_GP) +- _omap_save_secure_sram = omap_sram_push(save_secure_ram_context, +- save_secure_ram_context_sz); + } + + static void __init pm_errata_configure(void) +@@ -554,7 +549,7 @@ int __init omap3_pm_init(void) + clkdm_add_wkdep(neon_clkdm, mpu_clkdm); + if (omap_type() != OMAP2_DEVICE_TYPE_GP) { + omap3_secure_ram_storage = +- kmalloc(0x803F, GFP_KERNEL); ++ kmalloc(OMAP3_SAVE_SECURE_RAM_SZ, GFP_KERNEL); + if (!omap3_secure_ram_storage) + pr_err("Memory allocation failed when allocating for secure sram context\n"); + +--- a/arch/arm/mach-omap2/sleep34xx.S ++++ b/arch/arm/mach-omap2/sleep34xx.S +@@ -93,20 +93,13 @@ ENTRY(enable_omap3630_toggle_l2_on_resto + ENDPROC(enable_omap3630_toggle_l2_on_restore) + + /* +- * Function to call rom code to save secure ram context. This gets +- * relocated to SRAM, so it can be all in .data section. Otherwise +- * we need to initialize api_params separately. ++ * Function to call rom code to save secure ram context. ++ * ++ * r0 = physical address of the parameters + */ +- .data +- .align 3 + ENTRY(save_secure_ram_context) + stmfd sp!, {r4 - r11, lr} @ save registers on stack +- adr r3, api_params @ r3 points to parameters +- str r0, [r3,#0x4] @ r0 has sdram address +- ldr r12, high_mask +- and r3, r3, r12 +- ldr r12, sram_phy_addr_mask +- orr r3, r3, r12 ++ mov r3, r0 @ physical address of parameters + mov r0, #25 @ set service ID for PPA + mov r12, r0 @ copy secure service ID in r12 + mov r1, #0 @ set task id for ROM code in r1 +@@ -120,18 +113,7 @@ ENTRY(save_secure_ram_context) + nop + nop + ldmfd sp!, {r4 - r11, pc} +- .align +-sram_phy_addr_mask: +- .word SRAM_BASE_P +-high_mask: +- .word 0xffff +-api_params: +- .word 0x4, 0x0, 0x0, 0x1, 0x1 + ENDPROC(save_secure_ram_context) +-ENTRY(save_secure_ram_context_sz) +- .word . - save_secure_ram_context +- +- .text + + /* + * ====================== diff --git a/queue-4.9/asoc-rockchip-disable-clock-on-error.patch b/queue-4.9/asoc-rockchip-disable-clock-on-error.patch new file mode 100644 index 00000000000..025f2c46318 --- /dev/null +++ b/queue-4.9/asoc-rockchip-disable-clock-on-error.patch @@ -0,0 +1,73 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Stefan Potyra +Date: Wed, 6 Dec 2017 16:03:24 +0100 +Subject: ASoC: rockchip: disable clock on error + +From: Stefan Potyra + + +[ Upstream commit c7b92172a61b91936be985cb9bc499a4ebc6489b ] + +Disable the clocks in rk_spdif_probe when an error occurs after one +of the clocks has been enabled previously. + +Found by Linux Driver Verification project (linuxtesting.org). + +Fixes: f874b80e1571 ASoC: rockchip: Add rockchip SPDIF transceiver driver +Signed-off-by: Stefan Potyra +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/rockchip/rockchip_spdif.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +--- a/sound/soc/rockchip/rockchip_spdif.c ++++ b/sound/soc/rockchip/rockchip_spdif.c +@@ -318,26 +318,30 @@ static int rk_spdif_probe(struct platfor + spdif->mclk = devm_clk_get(&pdev->dev, "mclk"); + if (IS_ERR(spdif->mclk)) { + dev_err(&pdev->dev, "Can't retrieve rk_spdif master clock\n"); +- return PTR_ERR(spdif->mclk); ++ ret = PTR_ERR(spdif->mclk); ++ goto err_disable_hclk; + } + + ret = clk_prepare_enable(spdif->mclk); + if (ret) { + dev_err(spdif->dev, "clock enable failed %d\n", ret); +- return ret; ++ goto err_disable_clocks; + } + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + regs = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(regs)) +- return PTR_ERR(regs); ++ if (IS_ERR(regs)) { ++ ret = PTR_ERR(regs); ++ goto err_disable_clocks; ++ } + + spdif->regmap = devm_regmap_init_mmio_clk(&pdev->dev, "hclk", regs, + &rk_spdif_regmap_config); + if (IS_ERR(spdif->regmap)) { + dev_err(&pdev->dev, + "Failed to initialise managed register map\n"); +- return PTR_ERR(spdif->regmap); ++ ret = PTR_ERR(spdif->regmap); ++ goto err_disable_clocks; + } + + spdif->playback_dma_data.addr = res->start + SPDIF_SMPDR; +@@ -369,6 +373,10 @@ static int rk_spdif_probe(struct platfor + + err_pm_runtime: + pm_runtime_disable(&pdev->dev); ++err_disable_clocks: ++ clk_disable_unprepare(spdif->mclk); ++err_disable_hclk: ++ clk_disable_unprepare(spdif->hclk); + + return ret; + } diff --git a/queue-4.9/brcmfmac-avoid-build-error-with-make-w-1.patch b/queue-4.9/brcmfmac-avoid-build-error-with-make-w-1.patch new file mode 100644 index 00000000000..3712731cff3 --- /dev/null +++ b/queue-4.9/brcmfmac-avoid-build-error-with-make-w-1.patch @@ -0,0 +1,40 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Andy Shevchenko +Date: Thu, 23 Nov 2017 17:57:04 +0200 +Subject: brcmfmac: Avoid build error with make W=1 + +From: Andy Shevchenko + + +[ Upstream commit 51ef7925e10688c57186d438e784532e063492e4 ] + +When I run make W=1 on gcc (Debian 7.2.0-16) 7.2.0 I got an error for +the first run, all next ones are okay. + + CC [M] drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.o +drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:2078: error: Cannot parse struct or union! +scripts/Makefile.build:310: recipe for target 'drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.o' failed + +Seems like something happened with W=1 and wrong kernel doc format. +As a quick fix remove dubious /** in the code. + +Signed-off-by: Andy Shevchenko +Acked-by: Arend van Spriel +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -2049,7 +2049,7 @@ static int brcmf_sdio_txpkt_hdalign(stru + return head_pad; + } + +-/** ++/* + * struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for + * bus layer usage. + */ diff --git a/queue-4.9/btrfs-fix-possible-off-by-one-in-btrfs_search_path_in_tree.patch b/queue-4.9/btrfs-fix-possible-off-by-one-in-btrfs_search_path_in_tree.patch new file mode 100644 index 00000000000..46dc25d102c --- /dev/null +++ b/queue-4.9/btrfs-fix-possible-off-by-one-in-btrfs_search_path_in_tree.patch @@ -0,0 +1,56 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Nikolay Borisov +Date: Fri, 1 Dec 2017 11:19:42 +0200 +Subject: btrfs: Fix possible off-by-one in btrfs_search_path_in_tree + +From: Nikolay Borisov + + +[ Upstream commit c8bcbfbd239ed60a6562964b58034ac8a25f4c31 ] + +The name char array passed to btrfs_search_path_in_tree is of size +BTRFS_INO_LOOKUP_PATH_MAX (4080). So the actual accessible char indexes +are in the range of [0, 4079]. Currently the code uses the define but this +represents an off-by-one. + +Implications: + +Size of btrfs_ioctl_ino_lookup_args is 4096, so the new byte will be +written to extra space, not some padding that could be provided by the +allocator. + +btrfs-progs store the arguments on stack, but kernel does own copy of +the ioctl buffer and the off-by-one overwrite does not affect userspace, +but the ending 0 might be lost. + +Kernel ioctl buffer is allocated dynamically so we're overwriting +somebody else's memory, and the ioctl is privileged if args.objectid is +not 256. Which is in most cases, but resolving a subvolume stored in +another directory will trigger that path. + +Before this patch the buffer was one byte larger, but then the -1 was +not added. + +Fixes: ac8e9819d71f907 ("Btrfs: add search and inode lookup ioctls") +Signed-off-by: Nikolay Borisov +Reviewed-by: David Sterba +[ added implications ] +Signed-off-by: David Sterba + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/ioctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -2244,7 +2244,7 @@ static noinline int btrfs_search_path_in + if (!path) + return -ENOMEM; + +- ptr = &name[BTRFS_INO_LOOKUP_PATH_MAX]; ++ ptr = &name[BTRFS_INO_LOOKUP_PATH_MAX - 1]; + + key.objectid = tree_id; + key.type = BTRFS_ROOT_ITEM_KEY; diff --git a/queue-4.9/clk-fix-a-panic-error-caused-by-accessing-null-pointer.patch b/queue-4.9/clk-fix-a-panic-error-caused-by-accessing-null-pointer.patch new file mode 100644 index 00000000000..185d32c61eb --- /dev/null +++ b/queue-4.9/clk-fix-a-panic-error-caused-by-accessing-null-pointer.patch @@ -0,0 +1,43 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Cai Li +Date: Tue, 21 Nov 2017 17:24:38 +0800 +Subject: clk: fix a panic error caused by accessing NULL pointer + +From: Cai Li + + +[ Upstream commit 975b820b6836b6b6c42fb84cd2e772e2b41bca67 ] + +In some cases the clock parent would be set NULL when doing re-parent, +it will cause a NULL pointer accessing if clk_set trace event is +enabled. + +This patch sets the parent as "none" if the input parameter is NULL. + +Fixes: dfc202ead312 (clk: Add tracepoints for hardware operations) +Signed-off-by: Cai Li +Signed-off-by: Chunyan Zhang +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/trace/events/clk.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/trace/events/clk.h ++++ b/include/trace/events/clk.h +@@ -134,12 +134,12 @@ DECLARE_EVENT_CLASS(clk_parent, + + TP_STRUCT__entry( + __string( name, core->name ) +- __string( pname, parent->name ) ++ __string( pname, parent ? parent->name : "none" ) + ), + + TP_fast_assign( + __assign_str(name, core->name); +- __assign_str(pname, parent->name); ++ __assign_str(pname, parent ? parent->name : "none"); + ), + + TP_printk("%s %s", __get_str(name), __get_str(pname)) diff --git a/queue-4.9/dmaengine-at_hdmac-fix-potential-null-pointer-dereference-in-atc_prep_dma_interleaved.patch b/queue-4.9/dmaengine-at_hdmac-fix-potential-null-pointer-dereference-in-atc_prep_dma_interleaved.patch new file mode 100644 index 00000000000..ce24883f339 --- /dev/null +++ b/queue-4.9/dmaengine-at_hdmac-fix-potential-null-pointer-dereference-in-atc_prep_dma_interleaved.patch @@ -0,0 +1,48 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: "Gustavo A. R. Silva" +Date: Mon, 20 Nov 2017 08:28:14 -0600 +Subject: dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved + +From: "Gustavo A. R. Silva" + + +[ Upstream commit 62a277d43d47e74972de44d33bd3763e31992414 ] + +_xt_ is being dereferenced before it is null checked, hence there is a +potential null pointer dereference. + +Fix this by moving the pointer dereference after _xt_ has been null +checked. + +This issue was detected with the help of Coccinelle. + +Fixes: 4483320e241c ("dmaengine: Use Pointer xt after NULL check.") +Signed-off-by: Gustavo A. R. Silva +Acked-by: Ludovic Desroches +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/at_hdmac.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -709,7 +709,7 @@ atc_prep_dma_interleaved(struct dma_chan + unsigned long flags) + { + struct at_dma_chan *atchan = to_at_dma_chan(chan); +- struct data_chunk *first = xt->sgl; ++ struct data_chunk *first; + struct at_desc *desc = NULL; + size_t xfer_count; + unsigned int dwidth; +@@ -721,6 +721,8 @@ atc_prep_dma_interleaved(struct dma_chan + if (unlikely(!xt || xt->numf != 1 || !xt->frame_size)) + return NULL; + ++ first = xt->sgl; ++ + dev_info(chan2dev(chan), + "%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n", + __func__, &xt->src_start, &xt->dst_start, xt->numf, diff --git a/queue-4.9/dmaengine-ioat-fix-error-handling-path.patch b/queue-4.9/dmaengine-ioat-fix-error-handling-path.patch new file mode 100644 index 00000000000..69138507997 --- /dev/null +++ b/queue-4.9/dmaengine-ioat-fix-error-handling-path.patch @@ -0,0 +1,33 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Christophe JAILLET +Date: Fri, 17 Nov 2017 22:37:53 +0100 +Subject: dmaengine: ioat: Fix error handling path + +From: Christophe JAILLET + + +[ Upstream commit 5c9afbda911ce20b3f2181d1e440a0222e1027dd ] + +If the last test in 'ioat_dma_self_test()' fails, we must release all +the allocated resources and not just part of them. + +Signed-off-by: Christophe JAILLET +Acked-by: Dave Jiang +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/ioat/init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma/ioat/init.c ++++ b/drivers/dma/ioat/init.c +@@ -388,7 +388,7 @@ static int ioat_dma_self_test(struct ioa + if (memcmp(src, dest, IOAT_TEST_SIZE)) { + dev_err(dev, "Self-test copy failed compare, disabling\n"); + err = -ENODEV; +- goto free_resources; ++ goto unmap_dma; + } + + unmap_dma: diff --git a/queue-4.9/dmaengine-jz4740-disable-unprepare-clk-if-probe-fails.patch b/queue-4.9/dmaengine-jz4740-disable-unprepare-clk-if-probe-fails.patch new file mode 100644 index 00000000000..458fd624e38 --- /dev/null +++ b/queue-4.9/dmaengine-jz4740-disable-unprepare-clk-if-probe-fails.patch @@ -0,0 +1,44 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Tobias Jordan +Date: Wed, 6 Dec 2017 14:28:27 +0100 +Subject: dmaengine: jz4740: disable/unprepare clk if probe fails + +From: Tobias Jordan + + +[ Upstream commit eb9436966fdc84cebdf222952a99898ab46d9bb0 ] + +in error path of jz4740_dma_probe(), call clk_disable_unprepare() to clean +up. + +Found by Linux Driver Verification project (linuxtesting.org). + +Fixes: 25ce6c35fea0 MIPS: jz4740: Remove custom DMA API +Signed-off-by: Tobias Jordan +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/dma-jz4740.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/dma/dma-jz4740.c ++++ b/drivers/dma/dma-jz4740.c +@@ -555,7 +555,7 @@ static int jz4740_dma_probe(struct platf + + ret = dma_async_device_register(dd); + if (ret) +- return ret; ++ goto err_clk; + + irq = platform_get_irq(pdev, 0); + ret = request_irq(irq, jz4740_dma_irq, 0, dev_name(&pdev->dev), dmadev); +@@ -568,6 +568,8 @@ static int jz4740_dma_probe(struct platf + + err_unregister: + dma_async_device_unregister(dd); ++err_clk: ++ clk_disable_unprepare(dmadev->clk); + return ret; + } + diff --git a/queue-4.9/drm-armada-fix-leak-of-crtc-structure.patch b/queue-4.9/drm-armada-fix-leak-of-crtc-structure.patch new file mode 100644 index 00000000000..164bcb0f435 --- /dev/null +++ b/queue-4.9/drm-armada-fix-leak-of-crtc-structure.patch @@ -0,0 +1,82 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Russell King +Date: Fri, 8 Dec 2017 12:16:22 +0000 +Subject: drm/armada: fix leak of crtc structure + +From: Russell King + + +[ Upstream commit 33cd3c07a976e11c3c4cc6b0b3db6760ad1590c5 ] + +Fix the leak of the CRTC structure in the failure paths of +armada_drm_crtc_create(). + +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/armada/armada_crtc.c | 25 +++++++++++++------------ + 1 file changed, 13 insertions(+), 12 deletions(-) + +--- a/drivers/gpu/drm/armada/armada_crtc.c ++++ b/drivers/gpu/drm/armada/armada_crtc.c +@@ -1178,17 +1178,13 @@ static int armada_drm_crtc_create(struct + + ret = devm_request_irq(dev, irq, armada_drm_irq, 0, "armada_drm_crtc", + dcrtc); +- if (ret < 0) { +- kfree(dcrtc); +- return ret; +- } ++ if (ret < 0) ++ goto err_crtc; + + if (dcrtc->variant->init) { + ret = dcrtc->variant->init(dcrtc, dev); +- if (ret) { +- kfree(dcrtc); +- return ret; +- } ++ if (ret) ++ goto err_crtc; + } + + /* Ensure AXI pipeline is enabled */ +@@ -1199,13 +1195,15 @@ static int armada_drm_crtc_create(struct + dcrtc->crtc.port = port; + + primary = kzalloc(sizeof(*primary), GFP_KERNEL); +- if (!primary) +- return -ENOMEM; ++ if (!primary) { ++ ret = -ENOMEM; ++ goto err_crtc; ++ } + + ret = armada_drm_plane_init(primary); + if (ret) { + kfree(primary); +- return ret; ++ goto err_crtc; + } + + ret = drm_universal_plane_init(drm, &primary->base, 0, +@@ -1215,7 +1213,7 @@ static int armada_drm_crtc_create(struct + DRM_PLANE_TYPE_PRIMARY, NULL); + if (ret) { + kfree(primary); +- return ret; ++ goto err_crtc; + } + + ret = drm_crtc_init_with_planes(drm, &dcrtc->crtc, &primary->base, NULL, +@@ -1234,6 +1232,9 @@ static int armada_drm_crtc_create(struct + + err_crtc_init: + primary->base.funcs->destroy(&primary->base); ++err_crtc: ++ kfree(dcrtc); ++ + return ret; + } + diff --git a/queue-4.9/gianfar-disable-eee-autoneg-by-default.patch b/queue-4.9/gianfar-disable-eee-autoneg-by-default.patch new file mode 100644 index 00000000000..796539a7eab --- /dev/null +++ b/queue-4.9/gianfar-disable-eee-autoneg-by-default.patch @@ -0,0 +1,49 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Claudiu Manoil +Date: Thu, 7 Dec 2017 18:44:23 +0200 +Subject: gianfar: Disable EEE autoneg by default + +From: Claudiu Manoil + + +[ Upstream commit b6b5e8a691185606dfffff3198c89e3b4fd9d4f6 ] + +This controller does not support EEE, but it may connect to a PHY +which supports EEE and advertises EEE by default, while its link +partner also advertises EEE. If this happens, the PHY enters low +power mode when the traffic rate is low and causes packet loss. +This patch disables EEE advertisement by default for any PHY that +gianfar connects to, to prevent the above unwanted outcome. + +Signed-off-by: Shaohui Xie +Tested-by: Yangbo Lu +Signed-off-by: Claudiu Manoil +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/gianfar.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -1789,6 +1789,7 @@ static int init_phy(struct net_device *d + GFAR_SUPPORTED_GBIT : 0; + phy_interface_t interface; + struct phy_device *phydev; ++ struct ethtool_eee edata; + + priv->oldlink = 0; + priv->oldspeed = 0; +@@ -1813,6 +1814,10 @@ static int init_phy(struct net_device *d + /* Add support for flow control, but don't advertise it by default */ + phydev->supported |= (SUPPORTED_Pause | SUPPORTED_Asym_Pause); + ++ /* disable EEE autoneg, EEE not supported by eTSEC */ ++ memset(&edata, 0, sizeof(struct ethtool_eee)); ++ phy_ethtool_set_eee(phydev, &edata); ++ + return 0; + } + diff --git a/queue-4.9/gianfar-fix-a-flooded-alignment-reports-because-of-padding-issue.patch b/queue-4.9/gianfar-fix-a-flooded-alignment-reports-because-of-padding-issue.patch new file mode 100644 index 00000000000..1a41d8da9ec --- /dev/null +++ b/queue-4.9/gianfar-fix-a-flooded-alignment-reports-because-of-padding-issue.patch @@ -0,0 +1,81 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Zumeng Chen +Date: Mon, 4 Dec 2017 11:22:02 +0800 +Subject: gianfar: fix a flooded alignment reports because of padding issue. + +From: Zumeng Chen + + +[ Upstream commit 58117672943734715bbe7565ac9f062effa524f0 ] + +According to LS1021A RM, the value of PAL can be set so that the start of the +IP header in the receive data buffer is aligned to a 32-bit boundary. Normally, +setting PAL = 2 provides minimal padding to ensure such alignment of the IP +header. + +However every incoming packet's 8-byte time stamp will be inserted into the +packet data buffer as padding alignment bytes when hardware time stamping is +enabled. + +So we set the padding 8+2 here to avoid the flooded alignment faults: + +root@128:~# cat /proc/cpu/alignment +User: 0 +System: 17539 (inet_gro_receive+0x114/0x2c0) +Skipped: 0 +Half: 0 +Word: 0 +DWord: 0 +Multi: 17539 +User faults: 2 (fixup) + +Also shown when exception report enablement + +CPU: 0 PID: 161 Comm: irq/66-eth1_g0_ Not tainted 4.1.21-rt13-WR8.0.0.0_preempt-rt #16 +Hardware name: Freescale LS1021A +[<8001b420>] (unwind_backtrace) from [<8001476c>] (show_stack+0x20/0x24) +[<8001476c>] (show_stack) from [<807cfb48>] (dump_stack+0x94/0xac) +[<807cfb48>] (dump_stack) from [<80025d70>] (do_alignment+0x720/0x958) +[<80025d70>] (do_alignment) from [<80009224>] (do_DataAbort+0x40/0xbc) +[<80009224>] (do_DataAbort) from [<80015398>] (__dabt_svc+0x38/0x60) +Exception stack(0x86ad1cc0 to 0x86ad1d08) +1cc0: f9b3e080 86b3d072 2d78d287 00000000 866816c0 86b3d05e 86e785d0 00000000 +1ce0: 00000011 0000000e 80840ab0 86ad1d3c 86ad1d08 86ad1d08 806d7fc0 806d806c +1d00: 40070013 ffffffff +[<80015398>] (__dabt_svc) from [<806d806c>] (inet_gro_receive+0x114/0x2c0) +[<806d806c>] (inet_gro_receive) from [<80660eec>] (dev_gro_receive+0x21c/0x3c0) +[<80660eec>] (dev_gro_receive) from [<8066133c>] (napi_gro_receive+0x44/0x17c) +[<8066133c>] (napi_gro_receive) from [<804f0538>] (gfar_clean_rx_ring+0x39c/0x7d4) +[<804f0538>] (gfar_clean_rx_ring) from [<804f0bf4>] (gfar_poll_rx_sq+0x58/0xe0) +[<804f0bf4>] (gfar_poll_rx_sq) from [<80660b10>] (net_rx_action+0x27c/0x43c) +[<80660b10>] (net_rx_action) from [<80033638>] (do_current_softirqs+0x1e0/0x3dc) +[<80033638>] (do_current_softirqs) from [<800338c4>] (__local_bh_enable+0x90/0xa8) +[<800338c4>] (__local_bh_enable) from [<8008025c>] (irq_forced_thread_fn+0x70/0x84) +[<8008025c>] (irq_forced_thread_fn) from [<800805e8>] (irq_thread+0x16c/0x244) +[<800805e8>] (irq_thread) from [<8004e490>] (kthread+0xe8/0x104) +[<8004e490>] (kthread) from [<8000fda8>] (ret_from_fork+0x14/0x2c) + +Signed-off-by: Zumeng Chen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/gianfar.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -1375,9 +1375,11 @@ static int gfar_probe(struct platform_de + + gfar_init_addr_hash_table(priv); + +- /* Insert receive time stamps into padding alignment bytes */ ++ /* Insert receive time stamps into padding alignment bytes, and ++ * plus 2 bytes padding to ensure the cpu alignment. ++ */ + if (priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER) +- priv->padding = 8; ++ priv->padding = 8 + DEFAULT_PADDING; + + if (dev->features & NETIF_F_IP_CSUM || + priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER) diff --git a/queue-4.9/hippi-fix-a-fix-a-possible-sleep-in-atomic-bug-in-rr_close.patch b/queue-4.9/hippi-fix-a-fix-a-possible-sleep-in-atomic-bug-in-rr_close.patch new file mode 100644 index 00000000000..29c54c13068 --- /dev/null +++ b/queue-4.9/hippi-fix-a-fix-a-possible-sleep-in-atomic-bug-in-rr_close.patch @@ -0,0 +1,39 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Jia-Ju Bai +Date: Tue, 12 Dec 2017 16:49:52 +0800 +Subject: hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close + +From: Jia-Ju Bai + + +[ Upstream commit 6e266610eb6553cfb7e7eb5d11914bd01509c406 ] + +The driver may sleep under a spinlock. +The function call path is: +rr_close (acquire the spinlock) + free_irq --> may sleep + +To fix it, free_irq is moved to the place without holding the spinlock. + +This bug is found by my static analysis tool(DSAC) and checked by my code review. + +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/hippi/rrunner.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/hippi/rrunner.c ++++ b/drivers/net/hippi/rrunner.c +@@ -1381,8 +1381,8 @@ static int rr_close(struct net_device *d + rrpriv->info_dma); + rrpriv->info = NULL; + +- free_irq(pdev->irq, dev); + spin_unlock_irqrestore(&rrpriv->lock, flags); ++ free_irq(pdev->irq, dev); + + return 0; + } diff --git a/queue-4.9/i40iw-correct-arp-index-mask.patch b/queue-4.9/i40iw-correct-arp-index-mask.patch new file mode 100644 index 00000000000..e2f4d71a018 --- /dev/null +++ b/queue-4.9/i40iw-correct-arp-index-mask.patch @@ -0,0 +1,38 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Mustafa Ismail +Date: Tue, 21 Nov 2017 16:18:32 -0600 +Subject: i40iw: Correct ARP index mask + +From: Mustafa Ismail + + +[ Upstream commit a283cdc4d3670700182c820b59078387f9a01a30 ] + +The ARP table entry indexes are aliased to 12bits +instead of the intended 16bits when uploaded to +the QP Context. This will present an issue when the +number of connections exceeds 4096 as ARP entries are +reused. Fix this by adjusting the mask to account for +the full 16bits. + +Fixes: 4e9042e647ff ("i40iw: add hw and utils files") +Signed-off-by: Mustafa Ismail +Signed-off-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/i40iw/i40iw_d.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/i40iw/i40iw_d.h ++++ b/drivers/infiniband/hw/i40iw/i40iw_d.h +@@ -1102,7 +1102,7 @@ + #define I40IWQPC_VLANTAG_MASK (0xffffULL << I40IWQPC_VLANTAG_SHIFT) + + #define I40IWQPC_ARPIDX_SHIFT 48 +-#define I40IWQPC_ARPIDX_MASK (0xfffULL << I40IWQPC_ARPIDX_SHIFT) ++#define I40IWQPC_ARPIDX_MASK (0xffffULL << I40IWQPC_ARPIDX_SHIFT) + + #define I40IWQPC_FLOWLABEL_SHIFT 0 + #define I40IWQPC_FLOWLABEL_MASK (0xfffffUL << I40IWQPC_FLOWLABEL_SHIFT) diff --git a/queue-4.9/ipvlan-add-the-skb-mark-as-flow4-s-member-to-lookup-route.patch b/queue-4.9/ipvlan-add-the-skb-mark-as-flow4-s-member-to-lookup-route.patch new file mode 100644 index 00000000000..8c1a6d3ba12 --- /dev/null +++ b/queue-4.9/ipvlan-add-the-skb-mark-as-flow4-s-member-to-lookup-route.patch @@ -0,0 +1,31 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Gao Feng +Date: Fri, 1 Dec 2017 09:58:42 +0800 +Subject: ipvlan: Add the skb->mark as flow4's member to lookup route + +From: Gao Feng + + +[ Upstream commit a98a4ebc8c61d20f0150d6be66e0e65223a347af ] + +Current codes don't use skb->mark to assign flowi4_mark, it would +make the policy route rule with fwmark doesn't work as expected. + +Signed-off-by: Gao Feng +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ipvlan/ipvlan_core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ipvlan/ipvlan_core.c ++++ b/drivers/net/ipvlan/ipvlan_core.c +@@ -370,6 +370,7 @@ static int ipvlan_process_v4_outbound(st + .flowi4_oif = dev->ifindex, + .flowi4_tos = RT_TOS(ip4h->tos), + .flowi4_flags = FLOWI_FLAG_ANYSRC, ++ .flowi4_mark = skb->mark, + .daddr = ip4h->daddr, + .saddr = ip4h->saddr, + }; diff --git a/queue-4.9/m68k-add-missing-softirqentry_text-linker-section.patch b/queue-4.9/m68k-add-missing-softirqentry_text-linker-section.patch new file mode 100644 index 00000000000..01f8c000a37 --- /dev/null +++ b/queue-4.9/m68k-add-missing-softirqentry_text-linker-section.patch @@ -0,0 +1,72 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Greg Ungerer +Date: Tue, 14 Nov 2017 11:50:07 +1000 +Subject: m68k: add missing SOFTIRQENTRY_TEXT linker section + +From: Greg Ungerer + + +[ Upstream commit 969de0988b77e5a57aac2f7270191a3c50540c52 ] + +Commit be7635e7287e ("arch, ftrace: for KASAN put hard/soft IRQ entries +into separate sections") added a new linker section, SOFTIRQENTRY_TEXT, +to the linker scripts for most architectures. It didn't add it to any of +the linker scripts for the m68k architecture. This was not really a problem +because it is only defined if either of CONFIG_FUNCTION_GRAPH_TRACER or +CONFIG_KASAN are enabled - which can never be true for m68k. + +However commit 229a71860547 ("irq: Make the irqentry text section +unconditional") means that SOFTIRQENTRY_TEXT is now always defined. So on +m68k we now end up with a separate ELF section for .softirqentry.text +instead of it being part of the .text section. On some m68k targets in some +configurations this can also cause a fatal link error: + + LD vmlinux +/usr/local/bin/../m68k-uclinux/bin/ld.real: section .softirqentry.text loaded at [0000000010de10c0,0000000010de12dd] overlaps section .rodata loaded at [0000000010de10c0,0000000010e0fd67] + +To fix add in the missing SOFTIRQENTRY_TEXT section into the m68k linker +scripts. I noticed that m68k is also missing the IRQENTRY_TEXT section, +so this patch also adds an entry for that too. + +Signed-off-by: Greg Ungerer +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/m68k/kernel/vmlinux-nommu.lds | 2 ++ + arch/m68k/kernel/vmlinux-std.lds | 2 ++ + arch/m68k/kernel/vmlinux-sun3.lds | 2 ++ + 3 files changed, 6 insertions(+) + +--- a/arch/m68k/kernel/vmlinux-nommu.lds ++++ b/arch/m68k/kernel/vmlinux-nommu.lds +@@ -44,6 +44,8 @@ SECTIONS { + .text : { + HEAD_TEXT + TEXT_TEXT ++ IRQENTRY_TEXT ++ SOFTIRQENTRY_TEXT + SCHED_TEXT + CPUIDLE_TEXT + LOCK_TEXT +--- a/arch/m68k/kernel/vmlinux-std.lds ++++ b/arch/m68k/kernel/vmlinux-std.lds +@@ -15,6 +15,8 @@ SECTIONS + .text : { + HEAD_TEXT + TEXT_TEXT ++ IRQENTRY_TEXT ++ SOFTIRQENTRY_TEXT + SCHED_TEXT + CPUIDLE_TEXT + LOCK_TEXT +--- a/arch/m68k/kernel/vmlinux-sun3.lds ++++ b/arch/m68k/kernel/vmlinux-sun3.lds +@@ -15,6 +15,8 @@ SECTIONS + .text : { + HEAD_TEXT + TEXT_TEXT ++ IRQENTRY_TEXT ++ SOFTIRQENTRY_TEXT + SCHED_TEXT + CPUIDLE_TEXT + LOCK_TEXT diff --git a/queue-4.9/media-s5k6aa-describe-some-function-parameters.patch b/queue-4.9/media-s5k6aa-describe-some-function-parameters.patch new file mode 100644 index 00000000000..84274c21f45 --- /dev/null +++ b/queue-4.9/media-s5k6aa-describe-some-function-parameters.patch @@ -0,0 +1,59 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Mauro Carvalho Chehab +Date: Wed, 29 Nov 2017 08:44:41 -0500 +Subject: media: s5k6aa: describe some function parameters + +From: Mauro Carvalho Chehab + + +[ Upstream commit 070250a1715cee2297de0d9e7e2cea58be999d37 ] + +as warned: + drivers/media/i2c/s5k6aa.c:429: warning: No description found for parameter 's5k6aa' + drivers/media/i2c/s5k6aa.c:679: warning: No description found for parameter 's5k6aa' + drivers/media/i2c/s5k6aa.c:733: warning: No description found for parameter 's5k6aa' + drivers/media/i2c/s5k6aa.c:733: warning: No description found for parameter 'preset' + drivers/media/i2c/s5k6aa.c:787: warning: No description found for parameter 'sd' + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/s5k6aa.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/media/i2c/s5k6aa.c ++++ b/drivers/media/i2c/s5k6aa.c +@@ -421,6 +421,7 @@ static int s5k6aa_set_ahb_address(struct + + /** + * s5k6aa_configure_pixel_clock - apply ISP main clock/PLL configuration ++ * @s5k6aa: pointer to &struct s5k6aa describing the device + * + * Configure the internal ISP PLL for the required output frequency. + * Locking: called with s5k6aa.lock mutex held. +@@ -669,6 +670,7 @@ static int s5k6aa_set_input_params(struc + + /** + * s5k6aa_configure_video_bus - configure the video output interface ++ * @s5k6aa: pointer to &struct s5k6aa describing the device + * @bus_type: video bus type: parallel or MIPI-CSI + * @nlanes: number of MIPI lanes to be used (MIPI-CSI only) + * +@@ -724,6 +726,8 @@ static int s5k6aa_new_config_sync(struct + + /** + * s5k6aa_set_prev_config - write user preview register set ++ * @s5k6aa: pointer to &struct s5k6aa describing the device ++ * @preset: s5kaa preset to be applied + * + * Configure output resolution and color fromat, pixel clock + * frequency range, device frame rate type and frame period range. +@@ -777,6 +781,7 @@ static int s5k6aa_set_prev_config(struct + + /** + * s5k6aa_initialize_isp - basic ISP MCU initialization ++ * @sd: pointer to V4L2 sub-device descriptor + * + * Configure AHB addresses for registers read/write; configure PLLs for + * required output pixel clock. The ISP power supply needs to be already diff --git a/queue-4.9/mm-early_ioremap-fix-boot-hang-with-earlyprintk-efi-keep.patch b/queue-4.9/mm-early_ioremap-fix-boot-hang-with-earlyprintk-efi-keep.patch new file mode 100644 index 00000000000..11d53cdf1a2 --- /dev/null +++ b/queue-4.9/mm-early_ioremap-fix-boot-hang-with-earlyprintk-efi-keep.patch @@ -0,0 +1,48 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Dave Young +Date: Sat, 9 Dec 2017 12:16:10 +0800 +Subject: mm/early_ioremap: Fix boot hang with earlyprintk=efi,keep + +From: Dave Young + + +[ Upstream commit 7f6f60a1ba52538c16f26930bfbcfe193d9d746a ] + +earlyprintk=efi,keep does not work any more with a warning +in mm/early_ioremap.c: WARN_ON(system_state != SYSTEM_BOOTING): +Boot just hangs because of the earlyprintk within the earlyprintk +implementation code itself. + +This is caused by a new introduced middle state in: + + 69a78ff226fe ("init: Introduce SYSTEM_SCHEDULING state") + +early_ioremap() is fine in both SYSTEM_BOOTING and SYSTEM_SCHEDULING +states, original condition should be updated accordingly. + +Signed-off-by: Dave Young +Acked-by: Thomas Gleixner +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: bp@suse.de +Cc: linux-efi@vger.kernel.org +Cc: linux-mm@kvack.org +Link: http://lkml.kernel.org/r/20171209041610.GA3249@dhcp-128-65.nay.redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + mm/early_ioremap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/early_ioremap.c ++++ b/mm/early_ioremap.c +@@ -103,7 +103,7 @@ __early_ioremap(resource_size_t phys_add + enum fixed_addresses idx; + int i, slot; + +- WARN_ON(system_state != SYSTEM_BOOTING); ++ WARN_ON(system_state >= SYSTEM_RUNNING); + + slot = -1; + for (i = 0; i < FIX_BTMAPS_SLOTS; i++) { diff --git a/queue-4.9/net-ethernet-arc-fix-error-handling-in-emac_rockchip_probe.patch b/queue-4.9/net-ethernet-arc-fix-error-handling-in-emac_rockchip_probe.patch new file mode 100644 index 00000000000..16bd47c18dc --- /dev/null +++ b/queue-4.9/net-ethernet-arc-fix-error-handling-in-emac_rockchip_probe.patch @@ -0,0 +1,46 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Branislav Radocaj +Date: Thu, 7 Dec 2017 00:07:38 +0100 +Subject: net: ethernet: arc: fix error handling in emac_rockchip_probe + +From: Branislav Radocaj + + +[ Upstream commit e46772a6946a7d1f3fbbc1415871851d6651f1d4 ] + +If clk_set_rate() fails, we should disable clk before return. +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Branislav Radocaj +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/arc/emac_rockchip.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/arc/emac_rockchip.c ++++ b/drivers/net/ethernet/arc/emac_rockchip.c +@@ -220,9 +220,11 @@ static int emac_rockchip_probe(struct pl + + /* RMII TX/RX needs always a rate of 25MHz */ + err = clk_set_rate(priv->macclk, 25000000); +- if (err) ++ if (err) { + dev_err(dev, + "failed to change mac clock rate (%d)\n", err); ++ goto out_clk_disable_macclk; ++ } + } + + err = arc_emac_probe(ndev, interface); +@@ -232,7 +234,8 @@ static int emac_rockchip_probe(struct pl + } + + return 0; +- ++out_clk_disable_macclk: ++ clk_disable_unprepare(priv->macclk); + out_regulator_disable: + if (priv->regulator) + regulator_disable(priv->regulator); diff --git a/queue-4.9/net_sched-red-avoid-devision-by-zero.patch b/queue-4.9/net_sched-red-avoid-devision-by-zero.patch new file mode 100644 index 00000000000..7d6d7beedcb --- /dev/null +++ b/queue-4.9/net_sched-red-avoid-devision-by-zero.patch @@ -0,0 +1,32 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Nogah Frankel +Date: Mon, 4 Dec 2017 13:31:10 +0200 +Subject: net_sched: red: Avoid devision by zero + +From: Nogah Frankel + + +[ Upstream commit 5c472203421ab4f928aa1ae9e1dbcfdd80324148 ] + +Do not allow delta value to be zero since it is used as a divisor. + +Fixes: 8af2a218de38 ("sch_red: Adaptative RED AQM") +Signed-off-by: Nogah Frankel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/net/red.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/net/red.h ++++ b/include/net/red.h +@@ -178,7 +178,7 @@ static inline void red_set_parms(struct + p->qth_max = qth_max << Wlog; + p->Wlog = Wlog; + p->Plog = Plog; +- if (delta < 0) ++ if (delta <= 0) + delta = 1; + p->qth_delta = delta; + if (!max_P) { diff --git a/queue-4.9/net_sched-red-avoid-illegal-values.patch b/queue-4.9/net_sched-red-avoid-illegal-values.patch new file mode 100644 index 00000000000..12ce1f45c86 --- /dev/null +++ b/queue-4.9/net_sched-red-avoid-illegal-values.patch @@ -0,0 +1,93 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Nogah Frankel +Date: Mon, 4 Dec 2017 13:31:11 +0200 +Subject: net_sched: red: Avoid illegal values + +From: Nogah Frankel + + +[ Upstream commit 8afa10cbe281b10371fee5a87ab266e48d71a7f9 ] + +Check the qmin & qmax values doesn't overflow for the given Wlog value. +Check that qmin <= qmax. + +Fixes: a783474591f2 ("[PKT_SCHED]: Generic RED layer") +Signed-off-by: Nogah Frankel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/net/red.h | 11 +++++++++++ + net/sched/sch_choke.c | 3 +++ + net/sched/sch_gred.c | 3 +++ + net/sched/sch_red.c | 2 ++ + net/sched/sch_sfq.c | 3 +++ + 5 files changed, 22 insertions(+) + +--- a/include/net/red.h ++++ b/include/net/red.h +@@ -167,6 +167,17 @@ static inline void red_set_vars(struct r + v->qcount = -1; + } + ++static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog) ++{ ++ if (fls(qth_min) + Wlog > 32) ++ return false; ++ if (fls(qth_max) + Wlog > 32) ++ return false; ++ if (qth_max < qth_min) ++ return false; ++ return true; ++} ++ + static inline void red_set_parms(struct red_parms *p, + u32 qth_min, u32 qth_max, u8 Wlog, u8 Plog, + u8 Scell_log, u8 *stab, u32 max_P) +--- a/net/sched/sch_choke.c ++++ b/net/sched/sch_choke.c +@@ -424,6 +424,9 @@ static int choke_change(struct Qdisc *sc + + ctl = nla_data(tb[TCA_CHOKE_PARMS]); + ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog)) ++ return -EINVAL; ++ + if (ctl->limit > CHOKE_MAX_QUEUE) + return -EINVAL; + +--- a/net/sched/sch_gred.c ++++ b/net/sched/sch_gred.c +@@ -356,6 +356,9 @@ static inline int gred_change_vq(struct + struct gred_sched *table = qdisc_priv(sch); + struct gred_sched_data *q = table->tab[dp]; + ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog)) ++ return -EINVAL; ++ + if (!q) { + table->tab[dp] = q = *prealloc; + *prealloc = NULL; +--- a/net/sched/sch_red.c ++++ b/net/sched/sch_red.c +@@ -184,6 +184,8 @@ static int red_change(struct Qdisc *sch, + max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0; + + ctl = nla_data(tb[TCA_RED_PARMS]); ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog)) ++ return -EINVAL; + + if (ctl->limit > 0) { + child = fifo_create_dflt(sch, &bfifo_qdisc_ops, ctl->limit); +--- a/net/sched/sch_sfq.c ++++ b/net/sched/sch_sfq.c +@@ -633,6 +633,9 @@ static int sfq_change(struct Qdisc *sch, + if (ctl->divisor && + (!is_power_of_2(ctl->divisor) || ctl->divisor > 65536)) + return -EINVAL; ++ if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max, ++ ctl_v1->Wlog)) ++ return -EINVAL; + if (ctl_v1 && ctl_v1->qth_min) { + p = kmalloc(sizeof(*p), GFP_KERNEL); + if (!p) diff --git a/queue-4.9/perf-bench-numa-fixup-discontiguous-sparse-numa-nodes.patch b/queue-4.9/perf-bench-numa-fixup-discontiguous-sparse-numa-nodes.patch new file mode 100644 index 00000000000..812ced30d5e --- /dev/null +++ b/queue-4.9/perf-bench-numa-fixup-discontiguous-sparse-numa-nodes.patch @@ -0,0 +1,132 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Satheesh Rajendran +Date: Wed, 22 Nov 2017 22:13:53 +0530 +Subject: perf bench numa: Fixup discontiguous/sparse numa nodes + +From: Satheesh Rajendran + + +[ Upstream commit 321a7c35c90cc834851ceda18a8ee18f1d032b92 ] + +Certain systems are designed to have sparse/discontiguous nodes. On +such systems, 'perf bench numa' hangs, shows wrong number of nodes and +shows values for non-existent nodes. Handle this by only taking nodes +that are exposed by kernel to userspace. + +Signed-off-by: Satheesh Rajendran +Reviewed-by: Srikar Dronamraju +Acked-by: Naveen N. Rao +Link: http://lkml.kernel.org/r/1edbcd353c009e109e93d78f2f46381930c340fe.1511368645.git.sathnaga@linux.vnet.ibm.com +Signed-off-by: Balamuruhan S +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/bench/numa.c | 56 +++++++++++++++++++++++++++++++++++++++++++----- + 1 file changed, 51 insertions(+), 5 deletions(-) + +--- a/tools/perf/bench/numa.c ++++ b/tools/perf/bench/numa.c +@@ -211,6 +211,47 @@ static const char * const numa_usage[] = + NULL + }; + ++/* ++ * To get number of numa nodes present. ++ */ ++static int nr_numa_nodes(void) ++{ ++ int i, nr_nodes = 0; ++ ++ for (i = 0; i < g->p.nr_nodes; i++) { ++ if (numa_bitmask_isbitset(numa_nodes_ptr, i)) ++ nr_nodes++; ++ } ++ ++ return nr_nodes; ++} ++ ++/* ++ * To check if given numa node is present. ++ */ ++static int is_node_present(int node) ++{ ++ return numa_bitmask_isbitset(numa_nodes_ptr, node); ++} ++ ++/* ++ * To check given numa node has cpus. ++ */ ++static bool node_has_cpus(int node) ++{ ++ struct bitmask *cpu = numa_allocate_cpumask(); ++ unsigned int i; ++ ++ if (cpu && !numa_node_to_cpus(node, cpu)) { ++ for (i = 0; i < cpu->size; i++) { ++ if (numa_bitmask_isbitset(cpu, i)) ++ return true; ++ } ++ } ++ ++ return false; /* lets fall back to nocpus safely */ ++} ++ + static cpu_set_t bind_to_cpu(int target_cpu) + { + cpu_set_t orig_mask, mask; +@@ -239,12 +280,12 @@ static cpu_set_t bind_to_cpu(int target_ + + static cpu_set_t bind_to_node(int target_node) + { +- int cpus_per_node = g->p.nr_cpus/g->p.nr_nodes; ++ int cpus_per_node = g->p.nr_cpus / nr_numa_nodes(); + cpu_set_t orig_mask, mask; + int cpu; + int ret; + +- BUG_ON(cpus_per_node*g->p.nr_nodes != g->p.nr_cpus); ++ BUG_ON(cpus_per_node * nr_numa_nodes() != g->p.nr_cpus); + BUG_ON(!cpus_per_node); + + ret = sched_getaffinity(0, sizeof(orig_mask), &orig_mask); +@@ -644,7 +685,7 @@ static int parse_setup_node_list(void) + int i; + + for (i = 0; i < mul; i++) { +- if (t >= g->p.nr_tasks) { ++ if (t >= g->p.nr_tasks || !node_has_cpus(bind_node)) { + printf("\n# NOTE: ignoring bind NODEs starting at NODE#%d\n", bind_node); + goto out; + } +@@ -959,6 +1000,8 @@ static void calc_convergence(double runt + sum = 0; + + for (node = 0; node < g->p.nr_nodes; node++) { ++ if (!is_node_present(node)) ++ continue; + nr = nodes[node]; + nr_min = min(nr, nr_min); + nr_max = max(nr, nr_max); +@@ -979,8 +1022,11 @@ static void calc_convergence(double runt + process_groups = 0; + + for (node = 0; node < g->p.nr_nodes; node++) { +- int processes = count_node_processes(node); ++ int processes; + ++ if (!is_node_present(node)) ++ continue; ++ processes = count_node_processes(node); + nr = nodes[node]; + tprintf(" %2d/%-2d", nr, processes); + +@@ -1286,7 +1332,7 @@ static void print_summary(void) + + printf("\n ###\n"); + printf(" # %d %s will execute (on %d nodes, %d CPUs):\n", +- g->p.nr_tasks, g->p.nr_tasks == 1 ? "task" : "tasks", g->p.nr_nodes, g->p.nr_cpus); ++ g->p.nr_tasks, g->p.nr_tasks == 1 ? "task" : "tasks", nr_numa_nodes(), g->p.nr_cpus); + printf(" # %5dx %5ldMB global shared mem operations\n", + g->p.nr_loops, g->p.bytes_global/1024/1024); + printf(" # %5dx %5ldMB process shared mem operations\n", diff --git a/queue-4.9/perf-top-fix-window-dimensions-change-handling.patch b/queue-4.9/perf-top-fix-window-dimensions-change-handling.patch new file mode 100644 index 00000000000..94ef14d545f --- /dev/null +++ b/queue-4.9/perf-top-fix-window-dimensions-change-handling.patch @@ -0,0 +1,82 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Jiri Olsa +Date: Tue, 14 Nov 2017 10:23:39 +0100 +Subject: perf top: Fix window dimensions change handling + +From: Jiri Olsa + + +[ Upstream commit 89d0aeab4252adc2a7ea693637dd21c588bfa2d1 ] + +The stdio perf top crashes when we change the terminal +window size. The reason is that we assumed we get the +perf_top pointer as a signal handler argument which is +not the case. + +Changing the SIGWINCH handler logic to change global +resize variable, which is checked in the main thread +loop. + +Signed-off-by: Jiri Olsa +Tested-by: Arnaldo Carvalho de Melo +Tested-by: Ravi Bangoria +Cc: Adrian Hunter +Cc: Andi Kleen +Cc: David Ahern +Cc: Namhyung Kim +Cc: Wang Nan +Link: http://lkml.kernel.org/n/tip-ysuzwz77oev1ftgvdscn9bpu@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/builtin-top.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/tools/perf/builtin-top.c ++++ b/tools/perf/builtin-top.c +@@ -73,6 +73,7 @@ + #include + + static volatile int done; ++static volatile int resize; + + #define HEADER_LINE_NR 5 + +@@ -82,10 +83,13 @@ static void perf_top__update_print_entri + } + + static void perf_top__sig_winch(int sig __maybe_unused, +- siginfo_t *info __maybe_unused, void *arg) ++ siginfo_t *info __maybe_unused, void *arg __maybe_unused) + { +- struct perf_top *top = arg; ++ resize = 1; ++} + ++static void perf_top__resize(struct perf_top *top) ++{ + get_term_dimensions(&top->winsize); + perf_top__update_print_entries(top); + } +@@ -472,7 +476,7 @@ static bool perf_top__handle_keypress(st + .sa_sigaction = perf_top__sig_winch, + .sa_flags = SA_SIGINFO, + }; +- perf_top__sig_winch(SIGWINCH, NULL, top); ++ perf_top__resize(top); + sigaction(SIGWINCH, &act, NULL); + } else { + signal(SIGWINCH, SIG_DFL); +@@ -1003,6 +1007,11 @@ static int __cmd_top(struct perf_top *to + + if (hits == top->samples) + ret = perf_evlist__poll(top->evlist, 100); ++ ++ if (resize) { ++ perf_top__resize(top); ++ resize = 0; ++ } + } + + ret = 0; diff --git a/queue-4.9/pinctrl-sunxi-fix-a64-uart-mux-value.patch b/queue-4.9/pinctrl-sunxi-fix-a64-uart-mux-value.patch new file mode 100644 index 00000000000..42e46b403b5 --- /dev/null +++ b/queue-4.9/pinctrl-sunxi-fix-a64-uart-mux-value.patch @@ -0,0 +1,35 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Andre Przywara +Date: Sat, 25 Nov 2017 12:12:30 +0000 +Subject: pinctrl: sunxi: Fix A64 UART mux value + +From: Andre Przywara + + +[ Upstream commit 7c5c2c2d18d778e51fd8b899965097168306031c ] + +To use pin PF4 as the RX signal of UART0, we have to write 0b011 into +the respective pin controller register. +Fix the wrong value we had in our table so far. + +Fixes: 96851d391d02 ("drivers: pinctrl: add driver for Allwinner A64 SoC") +Signed-off-by: Andre Przywara +Acked-by: Chen-Yu Tsai +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c ++++ b/drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c +@@ -428,7 +428,7 @@ static const struct sunxi_desc_pin a64_p + SUNXI_FUNCTION(0x0, "gpio_in"), + SUNXI_FUNCTION(0x1, "gpio_out"), + SUNXI_FUNCTION(0x2, "mmc0"), /* D3 */ +- SUNXI_FUNCTION(0x4, "uart0")), /* RX */ ++ SUNXI_FUNCTION(0x3, "uart0")), /* RX */ + SUNXI_PIN(SUNXI_PINCTRL_PIN(F, 5), + SUNXI_FUNCTION(0x0, "gpio_in"), + SUNXI_FUNCTION(0x1, "gpio_out"), diff --git a/queue-4.9/pinctrl-sunxi-fix-a80-interrupt-pin-bank.patch b/queue-4.9/pinctrl-sunxi-fix-a80-interrupt-pin-bank.patch new file mode 100644 index 00000000000..57af9767ac0 --- /dev/null +++ b/queue-4.9/pinctrl-sunxi-fix-a80-interrupt-pin-bank.patch @@ -0,0 +1,53 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Andre Przywara +Date: Sat, 25 Nov 2017 12:19:48 +0000 +Subject: pinctrl: sunxi: Fix A80 interrupt pin bank + +From: Andre Przywara + + +[ Upstream commit 6ad4cc8d1ac483e0fd33f605fb2788b0ecf51ed4 ] + +On the A80 the pins on port B can trigger interrupts, and those are +assigned to the second interrupt bank. +Having two pins assigned to the same interrupt bank/pin combination does +not look healthy (instead more like a copy&paste bug from pins PA14-PA16), +so fix the interrupt bank for pins PB14-PB16, which is actually 1. + +I don't have any A80 board, so could not test this. + +Fixes: d5e9fb31baa2 ("pinctrl: sunxi: Add A80 pinctrl muxing options") +Signed-off-by: Andre Przywara +Acked-by: Chen-Yu Tsai +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c ++++ b/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c +@@ -145,19 +145,19 @@ static const struct sunxi_desc_pin sun9i + SUNXI_FUNCTION(0x0, "gpio_in"), + SUNXI_FUNCTION(0x1, "gpio_out"), + SUNXI_FUNCTION(0x3, "mcsi"), /* MCLK */ +- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 14)), /* PB_EINT14 */ ++ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 14)), /* PB_EINT14 */ + SUNXI_PIN(SUNXI_PINCTRL_PIN(B, 15), + SUNXI_FUNCTION(0x0, "gpio_in"), + SUNXI_FUNCTION(0x1, "gpio_out"), + SUNXI_FUNCTION(0x3, "mcsi"), /* SCK */ + SUNXI_FUNCTION(0x4, "i2c4"), /* SCK */ +- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 15)), /* PB_EINT15 */ ++ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 15)), /* PB_EINT15 */ + SUNXI_PIN(SUNXI_PINCTRL_PIN(B, 16), + SUNXI_FUNCTION(0x0, "gpio_in"), + SUNXI_FUNCTION(0x1, "gpio_out"), + SUNXI_FUNCTION(0x3, "mcsi"), /* SDA */ + SUNXI_FUNCTION(0x4, "i2c4"), /* SDA */ +- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 16)), /* PB_EINT16 */ ++ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 16)), /* PB_EINT16 */ + + /* Hole */ + SUNXI_PIN(SUNXI_PINCTRL_PIN(C, 0), diff --git a/queue-4.9/platform-x86-dell-laptop-fix-keyboard-max-lighting-for-dell-latitude-e6410.patch b/queue-4.9/platform-x86-dell-laptop-fix-keyboard-max-lighting-for-dell-latitude-e6410.patch new file mode 100644 index 00000000000..a20b1d08294 --- /dev/null +++ b/queue-4.9/platform-x86-dell-laptop-fix-keyboard-max-lighting-for-dell-latitude-e6410.patch @@ -0,0 +1,71 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: "Pali Rohár" +Date: Thu, 2 Nov 2017 21:25:24 +0100 +Subject: platform/x86: dell-laptop: Fix keyboard max lighting for Dell Latitude E6410 + +From: "Pali Rohár" + + +[ Upstream commit 68a213d325c23d39f109f4c7c824b906a7d209de ] + +This machine reports number of keyboard backlight led levels, instead of +value of the last led level index. Therefore max_brightness properly needs +to be subtracted by 1 to match led max_brightness API. + +Signed-off-by: Pali Rohár +Reported-by: Gabriel M. Elder +Link: https://bugzilla.kernel.org/show_bug.cgi?id=196913 +Signed-off-by: Darren Hart (VMware) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/dell-laptop.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +--- a/drivers/platform/x86/dell-laptop.c ++++ b/drivers/platform/x86/dell-laptop.c +@@ -45,6 +45,7 @@ + + struct quirk_entry { + u8 touchpad_led; ++ u8 kbd_led_levels_off_1; + + int needs_kbd_timeouts; + /* +@@ -75,6 +76,10 @@ static struct quirk_entry quirk_dell_xps + .kbd_timeouts = { 0, 5, 15, 60, 5 * 60, 15 * 60, -1 }, + }; + ++static struct quirk_entry quirk_dell_latitude_e6410 = { ++ .kbd_led_levels_off_1 = 1, ++}; ++ + static struct platform_driver platform_driver = { + .driver = { + .name = "dell-laptop", +@@ -270,6 +275,15 @@ static const struct dmi_system_id dell_q + }, + .driver_data = &quirk_dell_xps13_9333, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "Dell Latitude E6410", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E6410"), ++ }, ++ .driver_data = &quirk_dell_latitude_e6410, ++ }, + { } + }; + +@@ -1170,6 +1184,9 @@ static int kbd_get_info(struct kbd_info + units = (buffer->output[2] >> 8) & 0xFF; + info->levels = (buffer->output[2] >> 16) & 0xFF; + ++ if (quirks && quirks->kbd_led_levels_off_1 && info->levels) ++ info->levels--; ++ + if (units & BIT(0)) + info->seconds = (buffer->output[3] >> 0) & 0xFF; + if (units & BIT(1)) diff --git a/queue-4.9/powerpc-perf-fix-oops-when-grouping-different-pmu-events.patch b/queue-4.9/powerpc-perf-fix-oops-when-grouping-different-pmu-events.patch new file mode 100644 index 00000000000..066111a8fae --- /dev/null +++ b/queue-4.9/powerpc-perf-fix-oops-when-grouping-different-pmu-events.patch @@ -0,0 +1,60 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Ravi Bangoria +Date: Thu, 30 Nov 2017 14:03:22 +0530 +Subject: powerpc/perf: Fix oops when grouping different pmu events + +From: Ravi Bangoria + + +[ Upstream commit 5aa04b3eb6fca63d2e9827be656dcadc26d54e11 ] + +When user tries to group imc (In-Memory Collections) event with +normal event, (sometime) kernel crashes with following log: + + Faulting instruction address: 0x00000000 + [link register ] c00000000010ce88 power_check_constraints+0x128/0x980 + ... + c00000000010e238 power_pmu_event_init+0x268/0x6f0 + c0000000002dc60c perf_try_init_event+0xdc/0x1a0 + c0000000002dce88 perf_event_alloc+0x7b8/0xac0 + c0000000002e92e0 SyS_perf_event_open+0x530/0xda0 + c00000000000b004 system_call+0x38/0xe0 + +'event_base' field of 'struct hw_perf_event' is used as flags for +normal hw events and used as memory address for imc events. While +grouping these two types of events, collect_events() tries to +interpret imc 'event_base' as a flag, which causes a corruption +resulting in a crash. + +Consider only those events which belongs to 'perf_hw_context' in +collect_events(). + +Signed-off-by: Ravi Bangoria +Reviewed-By: Madhavan Srinivasan +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/perf/core-book3s.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/powerpc/perf/core-book3s.c ++++ b/arch/powerpc/perf/core-book3s.c +@@ -1381,7 +1381,7 @@ static int collect_events(struct perf_ev + int n = 0; + struct perf_event *event; + +- if (!is_software_event(group)) { ++ if (group->pmu->task_ctx_nr == perf_hw_context) { + if (n >= max_count) + return -1; + ctrs[n] = group; +@@ -1389,7 +1389,7 @@ static int collect_events(struct perf_ev + events[n++] = group->hw.config; + } + list_for_each_entry(event, &group->sibling_list, group_entry) { +- if (!is_software_event(event) && ++ if (event->pmu->task_ctx_nr == perf_hw_context && + event->state != PERF_EVENT_STATE_OFF) { + if (n >= max_count) + return -1; diff --git a/queue-4.9/rdma-cma-make-sure-that-psn-is-not-over-max-allowed.patch b/queue-4.9/rdma-cma-make-sure-that-psn-is-not-over-max-allowed.patch new file mode 100644 index 00000000000..c9581c074e5 --- /dev/null +++ b/queue-4.9/rdma-cma-make-sure-that-psn-is-not-over-max-allowed.patch @@ -0,0 +1,35 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Moni Shoua +Date: Sun, 26 Nov 2017 20:23:54 +0200 +Subject: RDMA/cma: Make sure that PSN is not over max allowed + +From: Moni Shoua + + +[ Upstream commit 23a9cd2ad90543e9da3786878d2b2729c095439d ] + +This patch limits the initial value for PSN to 24 bits as +spec requires. + +Signed-off-by: Moni Shoua +Signed-off-by: Mukesh Kacker +Signed-off-by: Daniel Jurgens +Reviewed-by: Parav Pandit +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/cma.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -744,6 +744,7 @@ struct rdma_cm_id *rdma_create_id(struct + INIT_LIST_HEAD(&id_priv->mc_list); + get_random_bytes(&id_priv->seq_num, sizeof id_priv->seq_num); + id_priv->id.route.addr.dev_addr.net = get_net(net); ++ id_priv->seq_num &= 0x00ffffff; + + return &id_priv->id; + } diff --git a/queue-4.9/s390-dasd-prevent-prefix-i-o-error.patch b/queue-4.9/s390-dasd-prevent-prefix-i-o-error.patch new file mode 100644 index 00000000000..8923cac3e16 --- /dev/null +++ b/queue-4.9/s390-dasd-prevent-prefix-i-o-error.patch @@ -0,0 +1,62 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Stefan Haberland +Date: Thu, 26 Oct 2017 14:37:35 +0200 +Subject: s390/dasd: prevent prefix I/O error + +From: Stefan Haberland + + +[ Upstream commit da340f921d3454f1521671c7a5a43ad3331fbe50 ] + +Prevent that a prefix flag is set based on invalid configuration data. +The validity.verify_base flag should only be set for alias devices. +Usually the unit address type is either one of base, PAV alias or +HyperPAV alias. But in cases where the unit address type is not set or +any other value the validity.verify_base flag might be set as well. +This would lead to follow on errors. +Explicitly check for alias devices and set the validity flag only for +them. + +Signed-off-by: Stefan Haberland +Reviewed-by: Jan Hoeppner +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/block/dasd_eckd.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/s390/block/dasd_eckd.c ++++ b/drivers/s390/block/dasd_eckd.c +@@ -521,10 +521,12 @@ static int prefix_LRE(struct ccw1 *ccw, + pfxdata->validity.define_extent = 1; + + /* private uid is kept up to date, conf_data may be outdated */ +- if (startpriv->uid.type != UA_BASE_DEVICE) { ++ if (startpriv->uid.type == UA_BASE_PAV_ALIAS) + pfxdata->validity.verify_base = 1; +- if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) +- pfxdata->validity.hyper_pav = 1; ++ ++ if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) { ++ pfxdata->validity.verify_base = 1; ++ pfxdata->validity.hyper_pav = 1; + } + + /* define extend data (mostly)*/ +@@ -3471,10 +3473,12 @@ static int prepare_itcw(struct itcw *itc + pfxdata.validity.define_extent = 1; + + /* private uid is kept up to date, conf_data may be outdated */ +- if (startpriv->uid.type != UA_BASE_DEVICE) { ++ if (startpriv->uid.type == UA_BASE_PAV_ALIAS) ++ pfxdata.validity.verify_base = 1; ++ ++ if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) { + pfxdata.validity.verify_base = 1; +- if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) +- pfxdata.validity.hyper_pav = 1; ++ pfxdata.validity.hyper_pav = 1; + } + + switch (cmd) { diff --git a/queue-4.9/scripts-kernel-doc-don-t-fail-with-status-0-if-error-encountered-with-none.patch b/queue-4.9/scripts-kernel-doc-don-t-fail-with-status-0-if-error-encountered-with-none.patch new file mode 100644 index 00000000000..adb6aaa15ac --- /dev/null +++ b/queue-4.9/scripts-kernel-doc-don-t-fail-with-status-0-if-error-encountered-with-none.patch @@ -0,0 +1,52 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Will Deacon +Date: Wed, 29 Nov 2017 15:20:03 +0000 +Subject: scripts/kernel-doc: Don't fail with status != 0 if error encountered with -none + +From: Will Deacon + + +[ Upstream commit e814bccbafece52a24e152d2395b5d49eef55841 ] + +My bisect scripts starting running into build failures when trying to +compile 4.15-rc1 with the builds failing with things like: + +drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:2078: error: Cannot parse struct or union! + +The line in question is actually just a #define, but after some digging +it turns out that my scripts pass W=1 and since commit 3a025e1d1c2ea +("Add optional check for bad kernel-doc comments") that results in +kernel-doc running on each source file. The file in question has a +badly formatted comment immediately before the #define: + +/** + * struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for + * bus layer usage. + */ + +which causes the regex in dump_struct to fail (lack of braces following +struct declaration) and kernel-doc returns 1, which causes the build +to fail. + +Fix the issue by always returning 0 from kernel-doc when invoked with +-none. It successfully generates no documentation, and prints out any +issues. + +Cc: Matthew Wilcox +Cc: Jonathan Corbet +Signed-off-by: Will Deacon +Signed-off-by: Jonathan Corbet +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + scripts/kernel-doc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/scripts/kernel-doc ++++ b/scripts/kernel-doc +@@ -3139,4 +3139,4 @@ if ($verbose && $warnings) { + print STDERR "$warnings warnings\n"; + } + +-exit($errors); ++exit($output_mode eq "none" ? 0 : $errors); diff --git a/queue-4.9/sctp-only-update-outstanding_bytes-for-transmitted-queue-when-doing-prsctp_prune.patch b/queue-4.9/sctp-only-update-outstanding_bytes-for-transmitted-queue-when-doing-prsctp_prune.patch new file mode 100644 index 00000000000..ca01aa0c362 --- /dev/null +++ b/queue-4.9/sctp-only-update-outstanding_bytes-for-transmitted-queue-when-doing-prsctp_prune.patch @@ -0,0 +1,58 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Xin Long +Date: Sat, 25 Nov 2017 21:18:34 +0800 +Subject: sctp: only update outstanding_bytes for transmitted queue when doing prsctp_prune + +From: Xin Long + + +[ Upstream commit d30fc5126efb0c33b7adf5966d3051db2c3d7721 ] + +Now outstanding_bytes is only increased when appending chunks into one +packet and sending it at 1st time, while decreased when it is about to +move into retransmit queue. It means outstanding_bytes value is already +decreased for all chunks in retransmit queue. + +However sctp_prsctp_prune_sent is a common function to check the chunks +in both transmitted and retransmit queue, it decrease outstanding_bytes +when moving a chunk into abandoned queue from either of them. + +It could cause outstanding_bytes underflow, as it also decreases it's +value for the chunks in retransmit queue. + +This patch fixes it by only updating outstanding_bytes for transmitted +queue when pruning queues for prsctp prio policy, the same fix is also +needed in sctp_check_transmitted. + +Fixes: 8dbdf1f5b09c ("sctp: implement prsctp PRIO policy") +Signed-off-by: Xin Long +Acked-by: Marcelo Ricardo Leitner +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/outqueue.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/sctp/outqueue.c ++++ b/net/sctp/outqueue.c +@@ -364,7 +364,8 @@ static int sctp_prsctp_prune_sent(struct + asoc->sent_cnt_removable--; + asoc->abandoned_sent[SCTP_PR_INDEX(PRIO)]++; + +- if (!chk->tsn_gap_acked) { ++ if (queue != &asoc->outqueue.retransmit && ++ !chk->tsn_gap_acked) { + if (chk->transport) + chk->transport->flight_size -= + sctp_data_size(chk); +@@ -1409,7 +1410,8 @@ static void sctp_check_transmitted(struc + /* If this chunk has not been acked, stop + * considering it as 'outstanding'. + */ +- if (!tchunk->tsn_gap_acked) { ++ if (transmitted_queue != &q->retransmit && ++ !tchunk->tsn_gap_acked) { + if (tchunk->transport) + tchunk->transport->flight_size -= + sctp_data_size(tchunk); diff --git a/queue-4.9/series b/queue-4.9/series index eef71f6af60..4e1cb66ba9b 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -39,3 +39,48 @@ binder-check-for-binder_thread-allocation-failure-in-binder_poll.patch staging-iio-adc-ad7192-fix-external-frequency-setting.patch staging-iio-ad5933-switch-buffer-mode-to-software.patch usbip-keep-usbip_device-sockfd-state-in-sync-with-tcp_socket.patch +usb-build-drivers-usb-common-when-usb_support-is-set.patch +arm-omap2-fix-sram-virt-to-phys-translation-for-save_secure_ram_context.patch +arm-am33xx-prm-remove-am33xx_pwrdm_read_prev_pwrst-function.patch +arm-dts-fix-omap4-hang-with-gps-connected-to-usb-by-using-wakeupgen.patch +arm-dts-logicpd-som-lv-fix-gpmc-addresses-for-nand-and-enet.patch +arm-dts-logicpd-somlv-fix-wl127x-pinmux.patch +arm-dts-am4372-correct-the-interrupts_properties-of-mcasp.patch +arm-dts-am437x-cm-t43-correct-the-dmas-property-of-spi0.patch +perf-top-fix-window-dimensions-change-handling.patch +perf-bench-numa-fixup-discontiguous-sparse-numa-nodes.patch +media-s5k6aa-describe-some-function-parameters.patch +pinctrl-sunxi-fix-a80-interrupt-pin-bank.patch +pinctrl-sunxi-fix-a64-uart-mux-value.patch +i40iw-correct-arp-index-mask.patch +rdma-cma-make-sure-that-psn-is-not-over-max-allowed.patch +sctp-only-update-outstanding_bytes-for-transmitted-queue-when-doing-prsctp_prune.patch +scripts-kernel-doc-don-t-fail-with-status-0-if-error-encountered-with-none.patch +ipvlan-add-the-skb-mark-as-flow4-s-member-to-lookup-route.patch +m68k-add-missing-softirqentry_text-linker-section.patch +powerpc-perf-fix-oops-when-grouping-different-pmu-events.patch +s390-dasd-prevent-prefix-i-o-error.patch +arm-dts-fix-elm-interrupt-compiler-warning.patch +gianfar-fix-a-flooded-alignment-reports-because-of-padding-issue.patch +net_sched-red-avoid-devision-by-zero.patch +net_sched-red-avoid-illegal-values.patch +btrfs-fix-possible-off-by-one-in-btrfs_search_path_in_tree.patch +brcmfmac-avoid-build-error-with-make-w-1.patch +net-ethernet-arc-fix-error-handling-in-emac_rockchip_probe.patch +509-fix-printing-uninitialized-stack-memory-when-oid-is-empty.patch +gianfar-disable-eee-autoneg-by-default.patch +dmaengine-ioat-fix-error-handling-path.patch +dmaengine-at_hdmac-fix-potential-null-pointer-dereference-in-atc_prep_dma_interleaved.patch +clk-fix-a-panic-error-caused-by-accessing-null-pointer.patch +asoc-rockchip-disable-clock-on-error.patch +spi-sun4i-disable-clocks-in-the-remove-function.patch +xfrm-fix-stack-out-of-bounds-with-misconfigured-transport-mode-policies.patch +drm-armada-fix-leak-of-crtc-structure.patch +dmaengine-jz4740-disable-unprepare-clk-if-probe-fails.patch +usb-dwc3-gadget-wait-longer-for-controller-to-end-command-processing.patch +usb-dwc3-of-simple-fix-missing-clk_disable_unprepare.patch +mm-early_ioremap-fix-boot-hang-with-earlyprintk-efi-keep.patch +x86-mm-kmmio-fix-mmiotrace-for-page-unaligned-addresses.patch +platform-x86-dell-laptop-fix-keyboard-max-lighting-for-dell-latitude-e6410.patch +xen-xen_acpi_processor-is-dom0-only.patch +hippi-fix-a-fix-a-possible-sleep-in-atomic-bug-in-rr_close.patch diff --git a/queue-4.9/spi-sun4i-disable-clocks-in-the-remove-function.patch b/queue-4.9/spi-sun4i-disable-clocks-in-the-remove-function.patch new file mode 100644 index 00000000000..6c85b962b08 --- /dev/null +++ b/queue-4.9/spi-sun4i-disable-clocks-in-the-remove-function.patch @@ -0,0 +1,35 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Takuo Koguchi +Date: Thu, 7 Dec 2017 16:20:14 +0900 +Subject: spi: sun4i: disable clocks in the remove function + +From: Takuo Koguchi + + +[ Upstream commit c810daba0ab5226084a56893a789af427a801146 ] + +mclk and hclk need to be disabled. Since pm_runtime_disable does +not disable the clocks, use pm_runtime_force_suspend instead. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Takuo Koguchi +Acked-by: Maxime Ripard +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-sun4i.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/spi/spi-sun4i.c ++++ b/drivers/spi/spi-sun4i.c +@@ -466,7 +466,7 @@ err_free_master: + + static int sun4i_spi_remove(struct platform_device *pdev) + { +- pm_runtime_disable(&pdev->dev); ++ pm_runtime_force_suspend(&pdev->dev); + + return 0; + } diff --git a/queue-4.9/usb-build-drivers-usb-common-when-usb_support-is-set.patch b/queue-4.9/usb-build-drivers-usb-common-when-usb_support-is-set.patch new file mode 100644 index 00000000000..353db944f74 --- /dev/null +++ b/queue-4.9/usb-build-drivers-usb-common-when-usb_support-is-set.patch @@ -0,0 +1,40 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Randy Dunlap +Date: Fri, 17 Nov 2017 11:00:45 -0800 +Subject: usb: build drivers/usb/common/ when USB_SUPPORT is set + +From: Randy Dunlap + + +[ Upstream commit c9d24f78268be444e803fb2bb138a2f598de9c23 ] + +PHY drivers can use ULPI interfaces when CONFIG_USB (which is host side +support) is not enabled, so also build drivers/usb/ when CONFIG_USB_SUPPORT +is enabled so that drivers/usb/common/ is built. + +ERROR: "ulpi_unregister_driver" [drivers/phy/ti/phy-tusb1210.ko] undefined! +ERROR: "__ulpi_register_driver" [drivers/phy/ti/phy-tusb1210.ko] undefined! +ERROR: "ulpi_read" [drivers/phy/ti/phy-tusb1210.ko] undefined! +ERROR: "ulpi_write" [drivers/phy/ti/phy-tusb1210.ko] undefined! +ERROR: "ulpi_unregister_driver" [drivers/phy/qualcomm/phy-qcom-usb-hs.ko] undefined! +ERROR: "__ulpi_register_driver" [drivers/phy/qualcomm/phy-qcom-usb-hs.ko] undefined! +ERROR: "ulpi_write" [drivers/phy/qualcomm/phy-qcom-usb-hs.ko] undefined! + +Signed-off-by: Randy Dunlap +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/Makefile | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/Makefile ++++ b/drivers/Makefile +@@ -99,6 +99,7 @@ obj-$(CONFIG_TC) += tc/ + obj-$(CONFIG_UWB) += uwb/ + obj-$(CONFIG_USB_PHY) += usb/ + obj-$(CONFIG_USB) += usb/ ++obj-$(CONFIG_USB_SUPPORT) += usb/ + obj-$(CONFIG_PCI) += usb/ + obj-$(CONFIG_USB_GADGET) += usb/ + obj-$(CONFIG_OF) += usb/ diff --git a/queue-4.9/usb-dwc3-gadget-wait-longer-for-controller-to-end-command-processing.patch b/queue-4.9/usb-dwc3-gadget-wait-longer-for-controller-to-end-command-processing.patch new file mode 100644 index 00000000000..e0d24427571 --- /dev/null +++ b/queue-4.9/usb-dwc3-gadget-wait-longer-for-controller-to-end-command-processing.patch @@ -0,0 +1,79 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Vincent Pelletier +Date: Thu, 30 Nov 2017 15:31:06 +0000 +Subject: usb: dwc3: gadget: Wait longer for controller to end command processing + +From: Vincent Pelletier + + +[ Upstream commit 8722e095f5a44d0e409e45c5ddc2ee9cf589c777 ] + +DWC3_DEPCMD_ENDTRANSFER has been witnessed to require around 600 iterations +before controller would become idle again after unplugging the USB cable +with AIO reads submitted. +Bump timeout from 500 iterations to 1000 so dwc3_stop_active_transfer does +not receive -ETIMEDOUT and does not WARN: + +[ 81.326273] ------------[ cut here ]------------ +[ 81.335341] WARNING: CPU: 0 PID: 1874 at drivers/usb/dwc3/gadget.c:2627 dwc3_stop_active_transfer.constprop.23+0x69/0xc0 [dwc3] +[ 81.347094] Modules linked in: usb_f_fs libcomposite configfs bnep btsdio bluetooth ecdh_generic brcmfmac brcmutil dwc3 intel_powerclamp coretemp ulpi kvm_intel udc_core kvm irqbypass crc32_pclmul crc32c_intel pcbc dwc3_pci aesni_intel aes_i586 crypto_simd cryptd ehci_pci ehci_hcd basincove_gpadc industrialio gpio_keys usbcore usb_common +[ 81.378142] CPU: 0 PID: 1874 Comm: irq/34-dwc3 Not tainted 4.14.0-edison+ #119 +[ 81.385545] Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542 2015.01.21:18.19.48 +[ 81.394548] task: f5b1be00 task.stack: f420a000 +[ 81.399219] EIP: dwc3_stop_active_transfer.constprop.23+0x69/0xc0 [dwc3] +[ 81.406086] EFLAGS: 00010086 CPU: 0 +[ 81.409672] EAX: 0000001f EBX: f5729800 ECX: c132a2a2 EDX: 00000000 +[ 81.416096] ESI: f4054014 EDI: f41cf400 EBP: f420be10 ESP: f420bdf4 +[ 81.422521] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 +[ 81.428061] CR0: 80050033 CR2: b7a3f000 CR3: 01d94000 CR4: 001006d0 +[ 81.434483] Call Trace: +[ 81.437063] __dwc3_gadget_ep_disable+0xa3/0x2b0 [dwc3] +[ 81.442438] ? _raw_spin_lock_irqsave+0x32/0x40 +[ 81.447135] dwc3_gadget_ep_disable+0xbf/0xe0 [dwc3] +[ 81.452269] usb_ep_disable+0x1c/0xd0 [udc_core] +[ 81.457048] ffs_func_eps_disable.isra.15+0x3b/0x90 [usb_f_fs] +[ 81.463070] ffs_func_set_alt+0x7d/0x310 [usb_f_fs] +[ 81.468132] ffs_func_disable+0x14/0x20 [usb_f_fs] +[ 81.473075] reset_config+0x5b/0x90 [libcomposite] +[ 81.478023] composite_disconnect+0x2b/0x50 [libcomposite] +[ 81.483685] dwc3_disconnect_gadget+0x39/0x50 [dwc3] +[ 81.488808] dwc3_gadget_disconnect_interrupt+0x21b/0x250 [dwc3] +[ 81.495014] dwc3_thread_interrupt+0x2a8/0xf70 [dwc3] +[ 81.500219] ? __schedule+0x78c/0x7e0 +[ 81.504027] irq_thread_fn+0x18/0x30 +[ 81.507715] ? irq_thread+0xb7/0x180 +[ 81.511400] irq_thread+0x111/0x180 +[ 81.515000] ? irq_finalize_oneshot+0xe0/0xe0 +[ 81.519490] ? wake_threads_waitq+0x30/0x30 +[ 81.523806] kthread+0x107/0x110 +[ 81.527131] ? disable_percpu_irq+0x50/0x50 +[ 81.531439] ? kthread_stop+0x150/0x150 +[ 81.535397] ret_from_fork+0x19/0x24 +[ 81.539136] Code: 89 d8 c7 45 ec 00 00 00 00 c7 45 f0 00 00 00 00 c7 45 f4 00 00 00 00 e8 56 ef ff ff 85 c0 74 12 50 68 b9 1c 14 f8 e8 64 0f f7 c8 <0f> ff 58 5a 8d 76 00 8b 83 98 00 00 00 c6 83 a0 00 00 00 00 83 +[ 81.559295] ---[ end trace f3133eec81a473b8 ]--- + +Number of iterations measured on 4 consecutive unplugs: +[ 1088.799777] dwc3_send_gadget_ep_cmd(cmd=331016, params={0, 0, 0}) iterated 605 times +[ 1222.024986] dwc3_send_gadget_ep_cmd(cmd=331016, params={0, 0, 0}) iterated 580 times +[ 1317.590452] dwc3_send_gadget_ep_cmd(cmd=331016, params={0, 0, 0}) iterated 598 times +[ 1453.218314] dwc3_send_gadget_ep_cmd(cmd=331016, params={0, 0, 0}) iterated 594 times + +Signed-off-by: Vincent Pelletier +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -247,7 +247,7 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ + struct dwc3_gadget_ep_cmd_params *params) + { + struct dwc3 *dwc = dep->dwc; +- u32 timeout = 500; ++ u32 timeout = 1000; + u32 reg; + + int cmd_status = 0; diff --git a/queue-4.9/usb-dwc3-of-simple-fix-missing-clk_disable_unprepare.patch b/queue-4.9/usb-dwc3-of-simple-fix-missing-clk_disable_unprepare.patch new file mode 100644 index 00000000000..446a0105a68 --- /dev/null +++ b/queue-4.9/usb-dwc3-of-simple-fix-missing-clk_disable_unprepare.patch @@ -0,0 +1,40 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Andreas Platschek +Date: Thu, 7 Dec 2017 11:32:20 +0100 +Subject: usb: dwc3: of-simple: fix missing clk_disable_unprepare + +From: Andreas Platschek + + +[ Upstream commit ded600ea9fb51a495d2fcd21e90351df876488e8 ] + +If of_clk_get() fails, the clean-up of already initialized clocks should be +the same as when clk_prepare_enable() fails. Thus a clk_disable_unprepare() +for each clock should be called before the clk_put(). + +Found by Linux Driver Verification project (linuxtesting.org). + +Fixes: 16adc674d0d6 ("usb: dwc3: ep0: fix setup_packet_pending initialization") + +Signed-off-by: Andreas Platschek +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-of-simple.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/dwc3-of-simple.c ++++ b/drivers/usb/dwc3/dwc3-of-simple.c +@@ -58,8 +58,10 @@ static int dwc3_of_simple_clk_init(struc + + clk = of_clk_get(np, i); + if (IS_ERR(clk)) { +- while (--i >= 0) ++ while (--i >= 0) { ++ clk_disable_unprepare(simple->clks[i]); + clk_put(simple->clks[i]); ++ } + return PTR_ERR(clk); + } + diff --git a/queue-4.9/x86-mm-kmmio-fix-mmiotrace-for-page-unaligned-addresses.patch b/queue-4.9/x86-mm-kmmio-fix-mmiotrace-for-page-unaligned-addresses.patch new file mode 100644 index 00000000000..0e894898ff7 --- /dev/null +++ b/queue-4.9/x86-mm-kmmio-fix-mmiotrace-for-page-unaligned-addresses.patch @@ -0,0 +1,116 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Karol Herbst +Date: Mon, 27 Nov 2017 08:51:39 +0100 +Subject: x86/mm/kmmio: Fix mmiotrace for page unaligned addresses + +From: Karol Herbst + + +[ Upstream commit 6d60ce384d1d5ca32b595244db4077a419acc687 ] + +If something calls ioremap() with an address not aligned to PAGE_SIZE, the +returned address might be not aligned as well. This led to a probe +registered on exactly the returned address, but the entire page was armed +for mmiotracing. + +On calling iounmap() the address passed to unregister_kmmio_probe() was +PAGE_SIZE aligned by the caller leading to a complete freeze of the +machine. + +We should always page align addresses while (un)registerung mappings, +because the mmiotracer works on top of pages, not mappings. We still keep +track of the probes based on their real addresses and lengths though, +because the mmiotrace still needs to know what are mapped memory regions. + +Also move the call to mmiotrace_iounmap() prior page aligning the address, +so that all probes are unregistered properly, otherwise the kernel ends up +failing memory allocations randomly after disabling the mmiotracer. + +Tested-by: Lyude +Signed-off-by: Karol Herbst +Acked-by: Pekka Paalanen +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Steven Rostedt +Cc: Thomas Gleixner +Cc: nouveau@lists.freedesktop.org +Link: http://lkml.kernel.org/r/20171127075139.4928-1-kherbst@redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/mm/ioremap.c | 4 ++-- + arch/x86/mm/kmmio.c | 12 +++++++----- + 2 files changed, 9 insertions(+), 7 deletions(-) + +--- a/arch/x86/mm/ioremap.c ++++ b/arch/x86/mm/ioremap.c +@@ -347,11 +347,11 @@ void iounmap(volatile void __iomem *addr + (void __force *)addr < phys_to_virt(ISA_END_ADDRESS)) + return; + ++ mmiotrace_iounmap(addr); ++ + addr = (volatile void __iomem *) + (PAGE_MASK & (unsigned long __force)addr); + +- mmiotrace_iounmap(addr); +- + /* Use the vm area unlocked, assuming the caller + ensures there isn't another iounmap for the same address + in parallel. Reuse of the virtual address is prevented by +--- a/arch/x86/mm/kmmio.c ++++ b/arch/x86/mm/kmmio.c +@@ -434,17 +434,18 @@ int register_kmmio_probe(struct kmmio_pr + unsigned long flags; + int ret = 0; + unsigned long size = 0; ++ unsigned long addr = p->addr & PAGE_MASK; + const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK); + unsigned int l; + pte_t *pte; + + spin_lock_irqsave(&kmmio_lock, flags); +- if (get_kmmio_probe(p->addr)) { ++ if (get_kmmio_probe(addr)) { + ret = -EEXIST; + goto out; + } + +- pte = lookup_address(p->addr, &l); ++ pte = lookup_address(addr, &l); + if (!pte) { + ret = -EINVAL; + goto out; +@@ -453,7 +454,7 @@ int register_kmmio_probe(struct kmmio_pr + kmmio_count++; + list_add_rcu(&p->list, &kmmio_probes); + while (size < size_lim) { +- if (add_kmmio_fault_page(p->addr + size)) ++ if (add_kmmio_fault_page(addr + size)) + pr_err("Unable to set page fault.\n"); + size += page_level_size(l); + } +@@ -527,19 +528,20 @@ void unregister_kmmio_probe(struct kmmio + { + unsigned long flags; + unsigned long size = 0; ++ unsigned long addr = p->addr & PAGE_MASK; + const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK); + struct kmmio_fault_page *release_list = NULL; + struct kmmio_delayed_release *drelease; + unsigned int l; + pte_t *pte; + +- pte = lookup_address(p->addr, &l); ++ pte = lookup_address(addr, &l); + if (!pte) + return; + + spin_lock_irqsave(&kmmio_lock, flags); + while (size < size_lim) { +- release_kmmio_fault_page(p->addr + size, &release_list); ++ release_kmmio_fault_page(addr + size, &release_list); + size += page_level_size(l); + } + list_del_rcu(&p->list); diff --git a/queue-4.9/xen-xen_acpi_processor-is-dom0-only.patch b/queue-4.9/xen-xen_acpi_processor-is-dom0-only.patch new file mode 100644 index 00000000000..464925326f9 --- /dev/null +++ b/queue-4.9/xen-xen_acpi_processor-is-dom0-only.patch @@ -0,0 +1,32 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Jan Beulich +Date: Tue, 12 Dec 2017 03:18:11 -0700 +Subject: xen: XEN_ACPI_PROCESSOR is Dom0-only + +From: Jan Beulich + + +[ Upstream commit c4f9d9cb2c29ff04c6b4bb09b72802d8aedfc7cb ] + +Add a respective dependency. + +Signed-off-by: Jan Beulich +Reviewed-by: Juergen Gross +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/xen/Kconfig ++++ b/drivers/xen/Kconfig +@@ -246,7 +246,7 @@ config XEN_ACPI_HOTPLUG_CPU + + config XEN_ACPI_PROCESSOR + tristate "Xen ACPI processor" +- depends on XEN && X86 && ACPI_PROCESSOR && CPU_FREQ ++ depends on XEN && XEN_DOM0 && X86 && ACPI_PROCESSOR && CPU_FREQ + default m + help + This ACPI processor uploads Power Management information to the Xen diff --git a/queue-4.9/xfrm-fix-stack-out-of-bounds-with-misconfigured-transport-mode-policies.patch b/queue-4.9/xfrm-fix-stack-out-of-bounds-with-misconfigured-transport-mode-policies.patch new file mode 100644 index 00000000000..e6e61688a86 --- /dev/null +++ b/queue-4.9/xfrm-fix-stack-out-of-bounds-with-misconfigured-transport-mode-policies.patch @@ -0,0 +1,64 @@ +From foo@baz Fri Feb 23 11:48:40 CET 2018 +From: Steffen Klassert +Date: Fri, 8 Dec 2017 08:07:25 +0100 +Subject: xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies. + +From: Steffen Klassert + + +[ Upstream commit 732706afe1cc46ef48493b3d2b69c98f36314ae4 ] + +On policies with a transport mode template, we pass the addresses +from the flowi to xfrm_state_find(), assuming that the IP addresses +(and address family) don't change during transformation. + +Unfortunately our policy template validation is not strict enough. +It is possible to configure policies with transport mode template +where the address family of the template does not match the selectors +address family. This lead to stack-out-of-bound reads because +we compare arddesses of the wrong family. Fix this by refusing +such a configuration, address family can not change on transport +mode. + +We use the assumption that, on transport mode, the first templates +address family must match the address family of the policy selector. +Subsequent transport mode templates must mach the address family of +the previous template. + +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/xfrm/xfrm_user.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -1380,11 +1380,14 @@ static void copy_templates(struct xfrm_p + + static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family) + { ++ u16 prev_family; + int i; + + if (nr > XFRM_MAX_DEPTH) + return -EINVAL; + ++ prev_family = family; ++ + for (i = 0; i < nr; i++) { + /* We never validated the ut->family value, so many + * applications simply leave it at zero. The check was +@@ -1396,6 +1399,12 @@ static int validate_tmpl(int nr, struct + if (!ut[i].family) + ut[i].family = family; + ++ if ((ut[i].mode == XFRM_MODE_TRANSPORT) && ++ (ut[i].family != prev_family)) ++ return -EINVAL; ++ ++ prev_family = ut[i].family; ++ + switch (ut[i].family) { + case AF_INET: + break; -- 2.47.3