[PATCH 4.8 063/125] ASoC: dapm: Fix value setting for _ENUM_DOUBLE MUXs second channel

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Chen-Yu Tsai 

commit 071133a209354f39d4e5785d5a6a390e03241841 upstream.

The value for the second channel in _ENUM_DOUBLE (double channel) MUXs
is not correctly updated, due to using the wrong bit shift.

Use the correct bit shift, so both channels toggle together.

Fixes: 3727b4968453 (ASoC: dapm: Consolidate MUXs and value MUXs)
Signed-off-by: Chen-Yu Tsai 
Reviewed-by: Charles Keepax 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/soc/soc-dapm.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -3203,7 +3203,7 @@ int snd_soc_dapm_put_enum_double(struct
if (e->shift_l != e->shift_r) {
if (item[1] > e->items)
return -EINVAL;
-   val |= snd_soc_enum_item_to_val(e, item[1]) << e->shift_l;
+   val |= snd_soc_enum_item_to_val(e, item[1]) << e->shift_r;
mask |= e->mask << e->shift_r;
}
 

[PATCH 4.8 054/125] ath10k: fix throughput regression in multi client mode

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Rajkumar Manoharan 

commit 18f53fe0f30331e826b075709ed7b26b9283235e upstream.

commit 7a0adc83f34d ("ath10k: improve tx scheduling") is causing
severe throughput drop in multi client mode. This issue is originally
reported in veriwave setup with 50 clients with TCP downlink traffic.
While increasing number of clients, the average throughput drops
gradually. With 50 clients, the combined peak throughput is decreased
to 98 Mbps whereas reverting given commit restored it to 550 Mbps.

Processing txqs for every tx completion is causing overhead. Ideally for
management frame tx completion, pending txqs processing can be avoided.
The change partly reverts the commit "ath10k: improve tx scheduling".
Processing pending txqs after all skbs tx completion will yeild enough
room to burst tx frames.

Fixes: 7a0adc83f34d ("ath10k: improve tx scheduling")
Signed-off-by: Rajkumar Manoharan 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/ath/ath10k/htt_rx.c |2 ++
 drivers/net/wireless/ath/ath10k/txrx.c   |2 --
 2 files changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -2394,6 +2394,8 @@ static void ath10k_htt_txrx_compl_task(u
skb_queue_splice_init(>rx_in_ord_compl_q, _ind_q);
spin_unlock_irqrestore(>rx_in_ord_compl_q.lock, flags);
 
+   ath10k_mac_tx_push_pending(ar);
+
spin_lock_irqsave(>tx_fetch_ind_q.lock, flags);
skb_queue_splice_init(>tx_fetch_ind_q, _ind_q);
spin_unlock_irqrestore(>tx_fetch_ind_q.lock, flags);
--- a/drivers/net/wireless/ath/ath10k/txrx.c
+++ b/drivers/net/wireless/ath/ath10k/txrx.c
@@ -119,8 +119,6 @@ int ath10k_txrx_tx_unref(struct ath10k_h
ieee80211_tx_status(htt->ar->hw, msdu);
/* we do not own the msdu anymore */
 
-   ath10k_mac_tx_push_pending(ar);
-
return 0;
 }
 

[PATCH 4.8 009/125] drm/amdgpu/dce11: add missing drm_mode_config_cleanup call

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Grazvydas Ignotas 

commit 140c94da3c3338c0ff4cc127cf9bec87905ca83c upstream.

All other amdgpu/dce_v* files have this call, it's only mysteriously
missing from dce_v11_0.c since the file was added and causes leaks.

Fixes: aaa36a976bbb ("drm/amdgpu: Add initial VI support")
Signed-off-by: Grazvydas Ignotas 
Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/gpu/drm/amd/amdgpu/dce_v11_0.c |1 +
 1 file changed, 1 insertion(+)

--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -3112,6 +3112,7 @@ static int dce_v11_0_sw_fini(void *handl
 
dce_v11_0_afmt_fini(adev);
 
+   drm_mode_config_cleanup(adev->ddev);
adev->mode_info.mode_config_initialized = false;
 
return 0;

[PATCH 4.8 057/125] crypto: marvell - Update transformation context for each dequeued req

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Romain Perier 

commit 09951d83fc58a6f772de09c08e370f6d9970dbb6 upstream.

So far, sub part of mv_cesa_int was responsible of dequeuing complete
requests, then call the 'cleanup' operation on these reqs and call the
crypto api callback 'complete'. The problem is that the transformation
context 'ctx' is retrieved only once before the while loop. Which means
that the wrong 'cleanup' operation might be called on the wrong type of
cesa requests, it can lead to memory corruptions with this message:

marvell-cesa f109.crypto: dma_pool_free cesa_padding, 5a5a5a5a/5a5a5a5a 
(bad dma)

This commit fixes the issue, by updating the transformation context for
each dequeued cesa request.

Fixes: commit 85030c5168f1 ("crypto: marvell - Add support for chai...")
Signed-off-by: Romain Perier 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/crypto/marvell/cesa.c |1 +
 1 file changed, 1 insertion(+)

--- a/drivers/crypto/marvell/cesa.c
+++ b/drivers/crypto/marvell/cesa.c
@@ -166,6 +166,7 @@ static irqreturn_t mv_cesa_int(int irq,
if (!req)
break;
 
+   ctx = crypto_tfm_ctx(req->tfm);
mv_cesa_complete_req(ctx, req, 0);
}
}

[PATCH 4.8 058/125] crypto: arm/ghash-ce - add missing async import/export

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Ard Biesheuvel 

commit ed4767d612fd2c39e2c4c69eba484c1219dcddb6 upstream.

Since commit 8996eafdcbad ("crypto: ahash - ensure statesize is non-zero"),
all ahash drivers are required to implement import()/export(), and must have
a non-zero statesize. Fix this for the ARM Crypto Extensions GHASH
implementation.

Fixes: 8996eafdcbad ("crypto: ahash - ensure statesize is non-zero")
Signed-off-by: Ard Biesheuvel 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm/crypto/ghash-ce-glue.c |   24 
 1 file changed, 24 insertions(+)

--- a/arch/arm/crypto/ghash-ce-glue.c
+++ b/arch/arm/crypto/ghash-ce-glue.c
@@ -220,6 +220,27 @@ static int ghash_async_digest(struct aha
}
 }
 
+static int ghash_async_import(struct ahash_request *req, const void *in)
+{
+   struct ahash_request *cryptd_req = ahash_request_ctx(req);
+   struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
+   struct ghash_async_ctx *ctx = crypto_ahash_ctx(tfm);
+   struct shash_desc *desc = cryptd_shash_desc(cryptd_req);
+
+   desc->tfm = cryptd_ahash_child(ctx->cryptd_tfm);
+   desc->flags = req->base.flags;
+
+   return crypto_shash_import(desc, in);
+}
+
+static int ghash_async_export(struct ahash_request *req, void *out)
+{
+   struct ahash_request *cryptd_req = ahash_request_ctx(req);
+   struct shash_desc *desc = cryptd_shash_desc(cryptd_req);
+
+   return crypto_shash_export(desc, out);
+}
+
 static int ghash_async_setkey(struct crypto_ahash *tfm, const u8 *key,
  unsigned int keylen)
 {
@@ -268,7 +289,10 @@ static struct ahash_alg ghash_async_alg
.final  = ghash_async_final,
.setkey = ghash_async_setkey,
.digest = ghash_async_digest,
+   .import = ghash_async_import,
+   .export = ghash_async_export,
.halg.digestsize= GHASH_DIGEST_SIZE,
+   .halg.statesize = sizeof(struct ghash_desc_ctx),
.halg.base  = {
.cra_name   = "ghash",
.cra_driver_name = "ghash-ce",

[PATCH 4.8 051/125] ath10k: Add WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT wmi service

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Tamizh chelvam 

commit 64ed5771aca2fcfb8ea440fc679741054011fd7e upstream.

WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT service has missed in
the commit 7e247a9e88dc ("ath10k: add dynamic tx mode switch
config support for qca4019"). This patch adds the service to
avoid mismatch between host and target.

Fixes: 7e247a9e88dc ("ath10k: add dynamic tx mode switch config support for 
qca4019")
Signed-off-by: Tamizh chelvam 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/ath/ath10k/wmi.h |5 +
 1 file changed, 5 insertions(+)

--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -180,6 +180,7 @@ enum wmi_service {
WMI_SERVICE_MESH_NON_11S,
WMI_SERVICE_PEER_STATS,
WMI_SERVICE_RESTRT_CHNL_SUPPORT,
+   WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT,
WMI_SERVICE_TX_MODE_PUSH_ONLY,
WMI_SERVICE_TX_MODE_PUSH_PULL,
WMI_SERVICE_TX_MODE_DYNAMIC,
@@ -305,6 +306,7 @@ enum wmi_10_4_service {
WMI_10_4_SERVICE_RESTRT_CHNL_SUPPORT,
WMI_10_4_SERVICE_PEER_STATS,
WMI_10_4_SERVICE_MESH_11S,
+   WMI_10_4_SERVICE_PERIODIC_CHAN_STAT_SUPPORT,
WMI_10_4_SERVICE_TX_MODE_PUSH_ONLY,
WMI_10_4_SERVICE_TX_MODE_PUSH_PULL,
WMI_10_4_SERVICE_TX_MODE_DYNAMIC,
@@ -402,6 +404,7 @@ static inline char *wmi_service_name(int
SVCSTR(WMI_SERVICE_MESH_NON_11S);
SVCSTR(WMI_SERVICE_PEER_STATS);
SVCSTR(WMI_SERVICE_RESTRT_CHNL_SUPPORT);
+   SVCSTR(WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT);
SVCSTR(WMI_SERVICE_TX_MODE_PUSH_ONLY);
SVCSTR(WMI_SERVICE_TX_MODE_PUSH_PULL);
SVCSTR(WMI_SERVICE_TX_MODE_DYNAMIC);
@@ -652,6 +655,8 @@ static inline void wmi_10_4_svc_map(cons
   WMI_SERVICE_PEER_STATS, len);
SVCMAP(WMI_10_4_SERVICE_MESH_11S,
   WMI_SERVICE_MESH_11S, len);
+   SVCMAP(WMI_10_4_SERVICE_PERIODIC_CHAN_STAT_SUPPORT,
+  WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT, len);
SVCMAP(WMI_10_4_SERVICE_TX_MODE_PUSH_ONLY,
   WMI_SERVICE_TX_MODE_PUSH_ONLY, len);
SVCMAP(WMI_10_4_SERVICE_TX_MODE_PUSH_PULL,

[PATCH 4.8 063/125] ASoC: dapm: Fix value setting for _ENUM_DOUBLE MUXs second channel

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Chen-Yu Tsai 

commit 071133a209354f39d4e5785d5a6a390e03241841 upstream.

The value for the second channel in _ENUM_DOUBLE (double channel) MUXs
is not correctly updated, due to using the wrong bit shift.

Use the correct bit shift, so both channels toggle together.

Fixes: 3727b4968453 (ASoC: dapm: Consolidate MUXs and value MUXs)
Signed-off-by: Chen-Yu Tsai 
Reviewed-by: Charles Keepax 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/soc/soc-dapm.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -3203,7 +3203,7 @@ int snd_soc_dapm_put_enum_double(struct
if (e->shift_l != e->shift_r) {
if (item[1] > e->items)
return -EINVAL;
-   val |= snd_soc_enum_item_to_val(e, item[1]) << e->shift_l;
+   val |= snd_soc_enum_item_to_val(e, item[1]) << e->shift_r;
mask |= e->mask << e->shift_r;
}
 

[PATCH 4.8 054/125] ath10k: fix throughput regression in multi client mode

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Rajkumar Manoharan 

commit 18f53fe0f30331e826b075709ed7b26b9283235e upstream.

commit 7a0adc83f34d ("ath10k: improve tx scheduling") is causing
severe throughput drop in multi client mode. This issue is originally
reported in veriwave setup with 50 clients with TCP downlink traffic.
While increasing number of clients, the average throughput drops
gradually. With 50 clients, the combined peak throughput is decreased
to 98 Mbps whereas reverting given commit restored it to 550 Mbps.

Processing txqs for every tx completion is causing overhead. Ideally for
management frame tx completion, pending txqs processing can be avoided.
The change partly reverts the commit "ath10k: improve tx scheduling".
Processing pending txqs after all skbs tx completion will yeild enough
room to burst tx frames.

Fixes: 7a0adc83f34d ("ath10k: improve tx scheduling")
Signed-off-by: Rajkumar Manoharan 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/ath/ath10k/htt_rx.c |2 ++
 drivers/net/wireless/ath/ath10k/txrx.c   |2 --
 2 files changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -2394,6 +2394,8 @@ static void ath10k_htt_txrx_compl_task(u
skb_queue_splice_init(>rx_in_ord_compl_q, _ind_q);
spin_unlock_irqrestore(>rx_in_ord_compl_q.lock, flags);
 
+   ath10k_mac_tx_push_pending(ar);
+
spin_lock_irqsave(>tx_fetch_ind_q.lock, flags);
skb_queue_splice_init(>tx_fetch_ind_q, _ind_q);
spin_unlock_irqrestore(>tx_fetch_ind_q.lock, flags);
--- a/drivers/net/wireless/ath/ath10k/txrx.c
+++ b/drivers/net/wireless/ath/ath10k/txrx.c
@@ -119,8 +119,6 @@ int ath10k_txrx_tx_unref(struct ath10k_h
ieee80211_tx_status(htt->ar->hw, msdu);
/* we do not own the msdu anymore */
 
-   ath10k_mac_tx_push_pending(ar);
-
return 0;
 }
 

[PATCH 4.8 009/125] drm/amdgpu/dce11: add missing drm_mode_config_cleanup call

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Grazvydas Ignotas 

commit 140c94da3c3338c0ff4cc127cf9bec87905ca83c upstream.

All other amdgpu/dce_v* files have this call, it's only mysteriously
missing from dce_v11_0.c since the file was added and causes leaks.

Fixes: aaa36a976bbb ("drm/amdgpu: Add initial VI support")
Signed-off-by: Grazvydas Ignotas 
Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/gpu/drm/amd/amdgpu/dce_v11_0.c |1 +
 1 file changed, 1 insertion(+)

--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -3112,6 +3112,7 @@ static int dce_v11_0_sw_fini(void *handl
 
dce_v11_0_afmt_fini(adev);
 
+   drm_mode_config_cleanup(adev->ddev);
adev->mode_info.mode_config_initialized = false;
 
return 0;

[PATCH 4.8 057/125] crypto: marvell - Update transformation context for each dequeued req

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Romain Perier 

commit 09951d83fc58a6f772de09c08e370f6d9970dbb6 upstream.

So far, sub part of mv_cesa_int was responsible of dequeuing complete
requests, then call the 'cleanup' operation on these reqs and call the
crypto api callback 'complete'. The problem is that the transformation
context 'ctx' is retrieved only once before the while loop. Which means
that the wrong 'cleanup' operation might be called on the wrong type of
cesa requests, it can lead to memory corruptions with this message:

marvell-cesa f109.crypto: dma_pool_free cesa_padding, 5a5a5a5a/5a5a5a5a 
(bad dma)

This commit fixes the issue, by updating the transformation context for
each dequeued cesa request.

Fixes: commit 85030c5168f1 ("crypto: marvell - Add support for chai...")
Signed-off-by: Romain Perier 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/crypto/marvell/cesa.c |1 +
 1 file changed, 1 insertion(+)

--- a/drivers/crypto/marvell/cesa.c
+++ b/drivers/crypto/marvell/cesa.c
@@ -166,6 +166,7 @@ static irqreturn_t mv_cesa_int(int irq,
if (!req)
break;
 
+   ctx = crypto_tfm_ctx(req->tfm);
mv_cesa_complete_req(ctx, req, 0);
}
}

[PATCH 4.8 058/125] crypto: arm/ghash-ce - add missing async import/export

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Ard Biesheuvel 

commit ed4767d612fd2c39e2c4c69eba484c1219dcddb6 upstream.

Since commit 8996eafdcbad ("crypto: ahash - ensure statesize is non-zero"),
all ahash drivers are required to implement import()/export(), and must have
a non-zero statesize. Fix this for the ARM Crypto Extensions GHASH
implementation.

Fixes: 8996eafdcbad ("crypto: ahash - ensure statesize is non-zero")
Signed-off-by: Ard Biesheuvel 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm/crypto/ghash-ce-glue.c |   24 
 1 file changed, 24 insertions(+)

--- a/arch/arm/crypto/ghash-ce-glue.c
+++ b/arch/arm/crypto/ghash-ce-glue.c
@@ -220,6 +220,27 @@ static int ghash_async_digest(struct aha
}
 }
 
+static int ghash_async_import(struct ahash_request *req, const void *in)
+{
+   struct ahash_request *cryptd_req = ahash_request_ctx(req);
+   struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
+   struct ghash_async_ctx *ctx = crypto_ahash_ctx(tfm);
+   struct shash_desc *desc = cryptd_shash_desc(cryptd_req);
+
+   desc->tfm = cryptd_ahash_child(ctx->cryptd_tfm);
+   desc->flags = req->base.flags;
+
+   return crypto_shash_import(desc, in);
+}
+
+static int ghash_async_export(struct ahash_request *req, void *out)
+{
+   struct ahash_request *cryptd_req = ahash_request_ctx(req);
+   struct shash_desc *desc = cryptd_shash_desc(cryptd_req);
+
+   return crypto_shash_export(desc, out);
+}
+
 static int ghash_async_setkey(struct crypto_ahash *tfm, const u8 *key,
  unsigned int keylen)
 {
@@ -268,7 +289,10 @@ static struct ahash_alg ghash_async_alg
.final  = ghash_async_final,
.setkey = ghash_async_setkey,
.digest = ghash_async_digest,
+   .import = ghash_async_import,
+   .export = ghash_async_export,
.halg.digestsize= GHASH_DIGEST_SIZE,
+   .halg.statesize = sizeof(struct ghash_desc_ctx),
.halg.base  = {
.cra_name   = "ghash",
.cra_driver_name = "ghash-ce",

[PATCH 4.8 051/125] ath10k: Add WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT wmi service

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Tamizh chelvam 

commit 64ed5771aca2fcfb8ea440fc679741054011fd7e upstream.

WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT service has missed in
the commit 7e247a9e88dc ("ath10k: add dynamic tx mode switch
config support for qca4019"). This patch adds the service to
avoid mismatch between host and target.

Fixes: 7e247a9e88dc ("ath10k: add dynamic tx mode switch config support for 
qca4019")
Signed-off-by: Tamizh chelvam 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/ath/ath10k/wmi.h |5 +
 1 file changed, 5 insertions(+)

--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -180,6 +180,7 @@ enum wmi_service {
WMI_SERVICE_MESH_NON_11S,
WMI_SERVICE_PEER_STATS,
WMI_SERVICE_RESTRT_CHNL_SUPPORT,
+   WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT,
WMI_SERVICE_TX_MODE_PUSH_ONLY,
WMI_SERVICE_TX_MODE_PUSH_PULL,
WMI_SERVICE_TX_MODE_DYNAMIC,
@@ -305,6 +306,7 @@ enum wmi_10_4_service {
WMI_10_4_SERVICE_RESTRT_CHNL_SUPPORT,
WMI_10_4_SERVICE_PEER_STATS,
WMI_10_4_SERVICE_MESH_11S,
+   WMI_10_4_SERVICE_PERIODIC_CHAN_STAT_SUPPORT,
WMI_10_4_SERVICE_TX_MODE_PUSH_ONLY,
WMI_10_4_SERVICE_TX_MODE_PUSH_PULL,
WMI_10_4_SERVICE_TX_MODE_DYNAMIC,
@@ -402,6 +404,7 @@ static inline char *wmi_service_name(int
SVCSTR(WMI_SERVICE_MESH_NON_11S);
SVCSTR(WMI_SERVICE_PEER_STATS);
SVCSTR(WMI_SERVICE_RESTRT_CHNL_SUPPORT);
+   SVCSTR(WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT);
SVCSTR(WMI_SERVICE_TX_MODE_PUSH_ONLY);
SVCSTR(WMI_SERVICE_TX_MODE_PUSH_PULL);
SVCSTR(WMI_SERVICE_TX_MODE_DYNAMIC);
@@ -652,6 +655,8 @@ static inline void wmi_10_4_svc_map(cons
   WMI_SERVICE_PEER_STATS, len);
SVCMAP(WMI_10_4_SERVICE_MESH_11S,
   WMI_SERVICE_MESH_11S, len);
+   SVCMAP(WMI_10_4_SERVICE_PERIODIC_CHAN_STAT_SUPPORT,
+  WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT, len);
SVCMAP(WMI_10_4_SERVICE_TX_MODE_PUSH_ONLY,
   WMI_SERVICE_TX_MODE_PUSH_ONLY, len);
SVCMAP(WMI_10_4_SERVICE_TX_MODE_PUSH_PULL,

[PATCH 4.8 043/125] coresight: Remove erroneous dma_free_coherent in tmc_probe

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Suzuki K Poulose 

commit 481e46fe7a88557b66330cbb047b25cc13eff4b9 upstream.

commit de5461970b3e9e194 ("coresight: tmc: allocating memory when needed")
removed the static allocation of buffer for the trace data in ETR mode in
tmc_probe. However it failed to remove the "devm_free_coherent" in
tmc_probe when the probe fails due to other reasons. This patch gets
rid of the incorrect dma_free_coherent() call.

Fixes: commit de5461970b3e9e194 ("coresight: tmc: allocating memory when 
needed")
Cc: Mathieu Poirier 
Signed-off-by: Suzuki K Poulose 
Signed-off-by: Mathieu Poirier 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/hwtracing/coresight/coresight-tmc.c |3 ---
 1 file changed, 3 deletions(-)

--- a/drivers/hwtracing/coresight/coresight-tmc.c
+++ b/drivers/hwtracing/coresight/coresight-tmc.c
@@ -388,9 +388,6 @@ static int tmc_probe(struct amba_device
 err_misc_register:
coresight_unregister(drvdata->csdev);
 err_devm_kzalloc:
-   if (drvdata->config_type == TMC_CONFIG_TYPE_ETR)
-   dma_free_coherent(dev, drvdata->size,
-   drvdata->vaddr, drvdata->paddr);
return ret;
 }
 

[PATCH 4.8 042/125] genirq/generic_chip: Add irq_unmap callback

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Sebastian Frias 

commit ee26c013cdee0b947e29d6cadfb9ff3341c69ff9 upstream.

Without this patch irq_domain_disassociate() cannot properly release the
interrupt. In fact, irq_map_generic_chip() checks a bit on 'gc->installed'
but said bit is never cleared, only set.

Commit 088f40b7b027 ("genirq: Generic chip: Add linear irq domain support")
added irq_map_generic_chip() function and also stated "This lacks a removal
function for now".

This commit provides an implementation of an unmap function that can be
called by irq_domain_disassociate().

[ tglx: Made the function static and removed the export as we have neither
a prototype nor a modular user. ]

Fixes: 088f40b7b027 ("genirq: Generic chip: Add linear irq domain support")
Signed-off-by: Sebastian Frias 
Cc: Marc Zyngier 
Cc: Mason 
Cc: Jason Cooper 
Link: http://lkml.kernel.org/r/579f5c5a.2070...@laposte.net
Signed-off-by: Thomas Gleixner 
Signed-off-by: Greg Kroah-Hartman 

---
 kernel/irq/generic-chip.c |   21 +
 1 file changed, 21 insertions(+)

--- a/kernel/irq/generic-chip.c
+++ b/kernel/irq/generic-chip.c
@@ -411,8 +411,29 @@ int irq_map_generic_chip(struct irq_doma
 }
 EXPORT_SYMBOL_GPL(irq_map_generic_chip);
 
+static void irq_unmap_generic_chip(struct irq_domain *d, unsigned int virq)
+{
+   struct irq_data *data = irq_domain_get_irq_data(d, virq);
+   struct irq_domain_chip_generic *dgc = d->gc;
+   unsigned int hw_irq = data->hwirq;
+   struct irq_chip_generic *gc;
+   int irq_idx;
+
+   gc = irq_get_domain_generic_chip(d, hw_irq);
+   if (!gc)
+   return;
+
+   irq_idx = hw_irq % dgc->irqs_per_chip;
+
+   clear_bit(irq_idx, >installed);
+   irq_domain_set_info(d, virq, hw_irq, _irq_chip, NULL, NULL, NULL,
+   NULL);
+
+}
+
 struct irq_domain_ops irq_generic_chip_ops = {
.map= irq_map_generic_chip,
+   .unmap  = irq_unmap_generic_chip,
.xlate  = irq_domain_xlate_onetwocell,
 };
 EXPORT_SYMBOL_GPL(irq_generic_chip_ops);

[PATCH] proc: make struct struct map_files_info::len unsigned int

[Alexey Dobriyan]

Linux doesn't support 4GB+ filenames in /proc, so unsigned long is too much.

MOV r64, r/m64 is smaller than MOV r32, r/m32.

Signed-off-by: Alexey Dobriyan 
---

 fs/proc/base.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1967,7 +1967,7 @@ static int map_files_get_link(struct dentry *dentry, 
struct path *path)
 
 struct map_files_info {
fmode_t mode;
-   unsigned long   len;
+   unsigned intlen;
unsigned char   name[4*sizeof(long)+2]; /* max: %lx-%lx\0 */
 };
 

[PATCH 4.8 006/125] drm/amdgpu/dce10: disable hpd on local panels

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Alex Deucher 

commit e96ec90f496603c48e0945f8bdeb4cdf3088cbba upstream.

Otherwise we can get a hotplug interrupt storm when
we turn the panel off if hpd interrupts were enabled
by the bios.

bug:
https://bugs.freedesktop.org/show_bug.cgi?id=97471

Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/gpu/drm/amd/amdgpu/dce_v10_0.c |   23 +--
 1 file changed, 13 insertions(+), 10 deletions(-)

--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
@@ -425,16 +425,6 @@ static void dce_v10_0_hpd_init(struct am
list_for_each_entry(connector, >mode_config.connector_list, head) {
struct amdgpu_connector *amdgpu_connector = 
to_amdgpu_connector(connector);
 
-   if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
-   connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
-   /* don't try to enable hpd on eDP or LVDS avoid 
breaking the
-* aux dp channel on imac and help (but not completely 
fix)
-* https://bugzilla.redhat.com/show_bug.cgi?id=726143
-* also avoid interrupt storms during dpms.
-*/
-   continue;
-   }
-
switch (amdgpu_connector->hpd.hpd) {
case AMDGPU_HPD_1:
idx = 0;
@@ -458,6 +448,19 @@ static void dce_v10_0_hpd_init(struct am
continue;
}
 
+   if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
+   connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
+   /* don't try to enable hpd on eDP or LVDS avoid 
breaking the
+* aux dp channel on imac and help (but not completely 
fix)
+* https://bugzilla.redhat.com/show_bug.cgi?id=726143
+* also avoid interrupt storms during dpms.
+*/
+   tmp = RREG32(mmDC_HPD_INT_CONTROL + hpd_offsets[idx]);
+   tmp = REG_SET_FIELD(tmp, DC_HPD_INT_CONTROL, 
DC_HPD_INT_EN, 0);
+   WREG32(mmDC_HPD_INT_CONTROL + hpd_offsets[idx], tmp);
+   continue;
+   }
+
tmp = RREG32(mmDC_HPD_CONTROL + hpd_offsets[idx]);
tmp = REG_SET_FIELD(tmp, DC_HPD_CONTROL, DC_HPD_EN, 1);
WREG32(mmDC_HPD_CONTROL + hpd_offsets[idx], tmp);

Re: [PATCH 00/14] introduce the BFQ-v0 I/O scheduler as an extra scheduler

[Jens Axboe]

On 10/28/2016 11:38 PM, Paolo Valente wrote:



Il giorno 26 ott 2016, alle ore 18:12, Jens Axboe  ha scritto:

On 10/26/2016 10:04 AM, Paolo Valente wrote:



Il giorno 26 ott 2016, alle ore 17:32, Jens Axboe  ha scritto:

On 10/26/2016 09:29 AM, Christoph Hellwig wrote:

On Wed, Oct 26, 2016 at 05:13:07PM +0200, Arnd Bergmann wrote:

The question to ask first is whether to actually have pluggable
schedulers on blk-mq at all, or just have one that is meant to
do the right thing in every case (and possibly can be bypassed
completely).


That would be my preference.  Have a BFQ-variant for blk-mq as an
option (default to off unless opted in by the driver or user), and
not other scheduler for blk-mq.  Don't bother with bfq for non
blk-mq.  It's not like there is any advantage in the legacy-request
device even for slow devices, except for the option of having I/O
scheduling.


It's the only right way forward. blk-mq might not offer any substantial
advantages to rotating storage, but with scheduling, it won't offer a
downside either. And it'll take us towards the real goal, which is to
have just one IO path.


ok


Adding a new scheduler for the legacy IO path
makes no sense.


I would fully agree if effective and stable I/O scheduling would be
available in blk-mq in one or two months.  But I guess that it will
take at least one year optimistically, given the current status of the
needed infrastructure, and given the great difficulties of doing
effective scheduling at the high parallelism and extreme target speeds
of blk-mq.  Of course, this holds true unless little clever scheduling
is performed.

So, what's the point in forcing a lot of users wait another year or
more, for a solution that has yet to be even defined, while they could
enjoy a much better system, and then switch an even better system when
scheduling is ready in blk-mq too?


That same argument could have been made 2 years ago. Saying no to a new
scheduler for the legacy framework goes back roughly that long. We could
have had BFQ for mq NOW, if we didn't keep coming back to this very
point.

I'm hesistant to add a new scheduler because it's very easy to add, very
difficult to get rid of. If we do add BFQ as a legacy scheduler now,
it'll take us years and years to get rid of it again. We should be
moving towards LESS moving parts in the legacy path, not more.

We can keep having this discussion every few years, but I think we'd
both prefer to make some actual progress here.


ok Jens, I give up


It's perfectly fine to
add an interface for a single queue interface for an IO scheduler for
blk-mq, since we don't care too much about scalability there. And that
won't take years, that should be a few weeks. Retrofitting BFQ on top of
that should not be hard either. That can co-exist with a real multiqueue
scheduler as well, something that's geared towards some fairness for
faster devices.



AFAICT this solution is good, for many practical reasons.  I don't
have the expertise to make such an infrastructure well on my own.  At
least not in an acceptable amount of time, because working on this
nice stuff is unfortunately not my job (although Linaro is now
supporting me for BFQ).

Then, assuming that this solution may be of general interest, and that
BFQ benefits convinced you a little bit too, may I get significant
collaboration/help on implementing this infrastructure?


Of course, I already offered to help with this.


If so, Jens
and all possibly interested parties, could we have a sort of short
kick-off technical meeting during KS/LPC?


I'm not a huge fan of setting up a BoF to discuss something technical,
when there's no code to discuss yet. We need some actual meat on the
bone in the shape of code, and that's much better dealt with in email.
Timing is pretty advanced at this point, otherwise I'd offer to cook
something up that we COULD discuss, but I will not have time to do that
for KS.

If you are at LPC, why don't the two of us sit down and talk about it
Wednesday or Thursday? I'd like to try and understand what parts of
blk-mq you aren't up to speed on, and how we can best get a simple
framework going that will allow us to entertain single queue scheduling
within blk-mq.

--
Jens Axboe

[PATCH 4.8 052/125] ath10k: fix sending frame in management path in push txq logic

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Ashok Raj Nagarajan 

commit e4fd726f21cdae0dc9cea6cbfcb7e27f21393f88 upstream.

In the wake tx queue path, we are not checking if the frame to be sent
takes management path or not. For eg. QOS null func frame coming here will
take the management path. Since we are not incrementing the descriptor
counter (num_pending_mgmt_tx) w.r.t tx management, on tx completion it is
possible to see negative values.

When the above counter reaches a negative value, we will not be sending a
probe response out.

if (is_presp &&
ar->hw_params.max_probe_resp_desc_thres < htt->num_pending_mgmt_tx)

For IPQ4019, max_probe_resp_desc_thres (u32) is 24 is compared against
num_pending_mgmt_tx (int) and the above condtions comes true if the counter
is negative and we drop the probe response.

To avoid this, check on the wake tx queue path as well for the tx path of
the frame and increment the appropriate counters

Fixes: cac085524cf1 "ath10k: move mgmt descriptor limit handle under mgmt_tx"
Signed-off-by: Ashok Raj Nagarajan 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/ath/ath10k/mac.c |   20 
 1 file changed, 20 insertions(+)

--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -3777,7 +3777,9 @@ int ath10k_mac_tx_push_txq(struct ieee80
enum ath10k_hw_txrx_mode txmode;
enum ath10k_mac_tx_path txpath;
struct sk_buff *skb;
+   struct ieee80211_hdr *hdr;
size_t skb_len;
+   bool is_mgmt, is_presp;
int ret;
 
spin_lock_bh(>htt.tx_lock);
@@ -3801,6 +3803,22 @@ int ath10k_mac_tx_push_txq(struct ieee80
skb_len = skb->len;
txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb);
txpath = ath10k_mac_tx_h_get_txpath(ar, skb, txmode);
+   is_mgmt = (txpath == ATH10K_MAC_TX_HTT_MGMT);
+
+   if (is_mgmt) {
+   hdr = (struct ieee80211_hdr *)skb->data;
+   is_presp = ieee80211_is_probe_resp(hdr->frame_control);
+
+   spin_lock_bh(>htt.tx_lock);
+   ret = ath10k_htt_tx_mgmt_inc_pending(htt, is_mgmt, is_presp);
+
+   if (ret) {
+   ath10k_htt_tx_dec_pending(htt);
+   spin_unlock_bh(>htt.tx_lock);
+   return ret;
+   }
+   spin_unlock_bh(>htt.tx_lock);
+   }
 
ret = ath10k_mac_tx(ar, vif, sta, txmode, txpath, skb);
if (unlikely(ret)) {
@@ -3808,6 +3826,8 @@ int ath10k_mac_tx_push_txq(struct ieee80
 
spin_lock_bh(>htt.tx_lock);
ath10k_htt_tx_dec_pending(htt);
+   if (is_mgmt)
+   ath10k_htt_tx_mgmt_dec_pending(htt);
spin_unlock_bh(>htt.tx_lock);
 
return ret;

[PATCH 4.8 053/125] ath10k: fix reporting channel survey data

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Ashok Raj Nagarajan 

commit 77eb3d693182b4eaa88c6ba406fbb92b1f1bd636 upstream.

When user requests for survey dump data, driver is providing wrong survey
information. This information we sent is the survey data that we have
collected during previous user request.

This issue occurs because we request survey dump for wrong channel. With
this change, we correctly display the correct and current survey
information to userspace.

Fixes: fa7937e3d5c2 ("ath10k: update bss channel survey information")
Signed-off-by: Ashok Raj Nagarajan 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/ath/ath10k/mac.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -6558,7 +6558,7 @@ static int ath10k_get_survey(struct ieee
goto exit;
}
 
-   ath10k_mac_update_bss_chan_survey(ar, survey->channel);
+   ath10k_mac_update_bss_chan_survey(ar, >channels[idx]);
 
spin_lock_bh(>data_lock);
memcpy(survey, ar_survey, sizeof(*survey));

[PATCH 4.8 043/125] coresight: Remove erroneous dma_free_coherent in tmc_probe

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Suzuki K Poulose 

commit 481e46fe7a88557b66330cbb047b25cc13eff4b9 upstream.

commit de5461970b3e9e194 ("coresight: tmc: allocating memory when needed")
removed the static allocation of buffer for the trace data in ETR mode in
tmc_probe. However it failed to remove the "devm_free_coherent" in
tmc_probe when the probe fails due to other reasons. This patch gets
rid of the incorrect dma_free_coherent() call.

Fixes: commit de5461970b3e9e194 ("coresight: tmc: allocating memory when 
needed")
Cc: Mathieu Poirier 
Signed-off-by: Suzuki K Poulose 
Signed-off-by: Mathieu Poirier 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/hwtracing/coresight/coresight-tmc.c |3 ---
 1 file changed, 3 deletions(-)

--- a/drivers/hwtracing/coresight/coresight-tmc.c
+++ b/drivers/hwtracing/coresight/coresight-tmc.c
@@ -388,9 +388,6 @@ static int tmc_probe(struct amba_device
 err_misc_register:
coresight_unregister(drvdata->csdev);
 err_devm_kzalloc:
-   if (drvdata->config_type == TMC_CONFIG_TYPE_ETR)
-   dma_free_coherent(dev, drvdata->size,
-   drvdata->vaddr, drvdata->paddr);
return ret;
 }
 

[PATCH 4.8 042/125] genirq/generic_chip: Add irq_unmap callback

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Sebastian Frias 

commit ee26c013cdee0b947e29d6cadfb9ff3341c69ff9 upstream.

Without this patch irq_domain_disassociate() cannot properly release the
interrupt. In fact, irq_map_generic_chip() checks a bit on 'gc->installed'
but said bit is never cleared, only set.

Commit 088f40b7b027 ("genirq: Generic chip: Add linear irq domain support")
added irq_map_generic_chip() function and also stated "This lacks a removal
function for now".

This commit provides an implementation of an unmap function that can be
called by irq_domain_disassociate().

[ tglx: Made the function static and removed the export as we have neither
a prototype nor a modular user. ]

Fixes: 088f40b7b027 ("genirq: Generic chip: Add linear irq domain support")
Signed-off-by: Sebastian Frias 
Cc: Marc Zyngier 
Cc: Mason 
Cc: Jason Cooper 
Link: http://lkml.kernel.org/r/579f5c5a.2070...@laposte.net
Signed-off-by: Thomas Gleixner 
Signed-off-by: Greg Kroah-Hartman 

---
 kernel/irq/generic-chip.c |   21 +
 1 file changed, 21 insertions(+)

--- a/kernel/irq/generic-chip.c
+++ b/kernel/irq/generic-chip.c
@@ -411,8 +411,29 @@ int irq_map_generic_chip(struct irq_doma
 }
 EXPORT_SYMBOL_GPL(irq_map_generic_chip);
 
+static void irq_unmap_generic_chip(struct irq_domain *d, unsigned int virq)
+{
+   struct irq_data *data = irq_domain_get_irq_data(d, virq);
+   struct irq_domain_chip_generic *dgc = d->gc;
+   unsigned int hw_irq = data->hwirq;
+   struct irq_chip_generic *gc;
+   int irq_idx;
+
+   gc = irq_get_domain_generic_chip(d, hw_irq);
+   if (!gc)
+   return;
+
+   irq_idx = hw_irq % dgc->irqs_per_chip;
+
+   clear_bit(irq_idx, >installed);
+   irq_domain_set_info(d, virq, hw_irq, _irq_chip, NULL, NULL, NULL,
+   NULL);
+
+}
+
 struct irq_domain_ops irq_generic_chip_ops = {
.map= irq_map_generic_chip,
+   .unmap  = irq_unmap_generic_chip,
.xlate  = irq_domain_xlate_onetwocell,
 };
 EXPORT_SYMBOL_GPL(irq_generic_chip_ops);

[PATCH] proc: make struct struct map_files_info::len unsigned int

[Alexey Dobriyan]

Linux doesn't support 4GB+ filenames in /proc, so unsigned long is too much.

MOV r64, r/m64 is smaller than MOV r32, r/m32.

Signed-off-by: Alexey Dobriyan 
---

 fs/proc/base.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1967,7 +1967,7 @@ static int map_files_get_link(struct dentry *dentry, 
struct path *path)
 
 struct map_files_info {
fmode_t mode;
-   unsigned long   len;
+   unsigned intlen;
unsigned char   name[4*sizeof(long)+2]; /* max: %lx-%lx\0 */
 };
 

[PATCH 4.8 006/125] drm/amdgpu/dce10: disable hpd on local panels

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Alex Deucher 

commit e96ec90f496603c48e0945f8bdeb4cdf3088cbba upstream.

Otherwise we can get a hotplug interrupt storm when
we turn the panel off if hpd interrupts were enabled
by the bios.

bug:
https://bugs.freedesktop.org/show_bug.cgi?id=97471

Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/gpu/drm/amd/amdgpu/dce_v10_0.c |   23 +--
 1 file changed, 13 insertions(+), 10 deletions(-)

--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
@@ -425,16 +425,6 @@ static void dce_v10_0_hpd_init(struct am
list_for_each_entry(connector, >mode_config.connector_list, head) {
struct amdgpu_connector *amdgpu_connector = 
to_amdgpu_connector(connector);
 
-   if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
-   connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
-   /* don't try to enable hpd on eDP or LVDS avoid 
breaking the
-* aux dp channel on imac and help (but not completely 
fix)
-* https://bugzilla.redhat.com/show_bug.cgi?id=726143
-* also avoid interrupt storms during dpms.
-*/
-   continue;
-   }
-
switch (amdgpu_connector->hpd.hpd) {
case AMDGPU_HPD_1:
idx = 0;
@@ -458,6 +448,19 @@ static void dce_v10_0_hpd_init(struct am
continue;
}
 
+   if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
+   connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
+   /* don't try to enable hpd on eDP or LVDS avoid 
breaking the
+* aux dp channel on imac and help (but not completely 
fix)
+* https://bugzilla.redhat.com/show_bug.cgi?id=726143
+* also avoid interrupt storms during dpms.
+*/
+   tmp = RREG32(mmDC_HPD_INT_CONTROL + hpd_offsets[idx]);
+   tmp = REG_SET_FIELD(tmp, DC_HPD_INT_CONTROL, 
DC_HPD_INT_EN, 0);
+   WREG32(mmDC_HPD_INT_CONTROL + hpd_offsets[idx], tmp);
+   continue;
+   }
+
tmp = RREG32(mmDC_HPD_CONTROL + hpd_offsets[idx]);
tmp = REG_SET_FIELD(tmp, DC_HPD_CONTROL, DC_HPD_EN, 1);
WREG32(mmDC_HPD_CONTROL + hpd_offsets[idx], tmp);

Re: [PATCH 00/14] introduce the BFQ-v0 I/O scheduler as an extra scheduler

[Jens Axboe]

On 10/28/2016 11:38 PM, Paolo Valente wrote:



Il giorno 26 ott 2016, alle ore 18:12, Jens Axboe  ha scritto:

On 10/26/2016 10:04 AM, Paolo Valente wrote:



Il giorno 26 ott 2016, alle ore 17:32, Jens Axboe  ha scritto:

On 10/26/2016 09:29 AM, Christoph Hellwig wrote:

On Wed, Oct 26, 2016 at 05:13:07PM +0200, Arnd Bergmann wrote:

The question to ask first is whether to actually have pluggable
schedulers on blk-mq at all, or just have one that is meant to
do the right thing in every case (and possibly can be bypassed
completely).


That would be my preference.  Have a BFQ-variant for blk-mq as an
option (default to off unless opted in by the driver or user), and
not other scheduler for blk-mq.  Don't bother with bfq for non
blk-mq.  It's not like there is any advantage in the legacy-request
device even for slow devices, except for the option of having I/O
scheduling.


It's the only right way forward. blk-mq might not offer any substantial
advantages to rotating storage, but with scheduling, it won't offer a
downside either. And it'll take us towards the real goal, which is to
have just one IO path.


ok


Adding a new scheduler for the legacy IO path
makes no sense.


I would fully agree if effective and stable I/O scheduling would be
available in blk-mq in one or two months.  But I guess that it will
take at least one year optimistically, given the current status of the
needed infrastructure, and given the great difficulties of doing
effective scheduling at the high parallelism and extreme target speeds
of blk-mq.  Of course, this holds true unless little clever scheduling
is performed.

So, what's the point in forcing a lot of users wait another year or
more, for a solution that has yet to be even defined, while they could
enjoy a much better system, and then switch an even better system when
scheduling is ready in blk-mq too?


That same argument could have been made 2 years ago. Saying no to a new
scheduler for the legacy framework goes back roughly that long. We could
have had BFQ for mq NOW, if we didn't keep coming back to this very
point.

I'm hesistant to add a new scheduler because it's very easy to add, very
difficult to get rid of. If we do add BFQ as a legacy scheduler now,
it'll take us years and years to get rid of it again. We should be
moving towards LESS moving parts in the legacy path, not more.

We can keep having this discussion every few years, but I think we'd
both prefer to make some actual progress here.


ok Jens, I give up


It's perfectly fine to
add an interface for a single queue interface for an IO scheduler for
blk-mq, since we don't care too much about scalability there. And that
won't take years, that should be a few weeks. Retrofitting BFQ on top of
that should not be hard either. That can co-exist with a real multiqueue
scheduler as well, something that's geared towards some fairness for
faster devices.



AFAICT this solution is good, for many practical reasons.  I don't
have the expertise to make such an infrastructure well on my own.  At
least not in an acceptable amount of time, because working on this
nice stuff is unfortunately not my job (although Linaro is now
supporting me for BFQ).

Then, assuming that this solution may be of general interest, and that
BFQ benefits convinced you a little bit too, may I get significant
collaboration/help on implementing this infrastructure?


Of course, I already offered to help with this.


If so, Jens
and all possibly interested parties, could we have a sort of short
kick-off technical meeting during KS/LPC?


I'm not a huge fan of setting up a BoF to discuss something technical,
when there's no code to discuss yet. We need some actual meat on the
bone in the shape of code, and that's much better dealt with in email.
Timing is pretty advanced at this point, otherwise I'd offer to cook
something up that we COULD discuss, but I will not have time to do that
for KS.

If you are at LPC, why don't the two of us sit down and talk about it
Wednesday or Thursday? I'd like to try and understand what parts of
blk-mq you aren't up to speed on, and how we can best get a simple
framework going that will allow us to entertain single queue scheduling
within blk-mq.

--
Jens Axboe

[PATCH 4.8 052/125] ath10k: fix sending frame in management path in push txq logic

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Ashok Raj Nagarajan 

commit e4fd726f21cdae0dc9cea6cbfcb7e27f21393f88 upstream.

In the wake tx queue path, we are not checking if the frame to be sent
takes management path or not. For eg. QOS null func frame coming here will
take the management path. Since we are not incrementing the descriptor
counter (num_pending_mgmt_tx) w.r.t tx management, on tx completion it is
possible to see negative values.

When the above counter reaches a negative value, we will not be sending a
probe response out.

if (is_presp &&
ar->hw_params.max_probe_resp_desc_thres < htt->num_pending_mgmt_tx)

For IPQ4019, max_probe_resp_desc_thres (u32) is 24 is compared against
num_pending_mgmt_tx (int) and the above condtions comes true if the counter
is negative and we drop the probe response.

To avoid this, check on the wake tx queue path as well for the tx path of
the frame and increment the appropriate counters

Fixes: cac085524cf1 "ath10k: move mgmt descriptor limit handle under mgmt_tx"
Signed-off-by: Ashok Raj Nagarajan 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/ath/ath10k/mac.c |   20 
 1 file changed, 20 insertions(+)

--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -3777,7 +3777,9 @@ int ath10k_mac_tx_push_txq(struct ieee80
enum ath10k_hw_txrx_mode txmode;
enum ath10k_mac_tx_path txpath;
struct sk_buff *skb;
+   struct ieee80211_hdr *hdr;
size_t skb_len;
+   bool is_mgmt, is_presp;
int ret;
 
spin_lock_bh(>htt.tx_lock);
@@ -3801,6 +3803,22 @@ int ath10k_mac_tx_push_txq(struct ieee80
skb_len = skb->len;
txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb);
txpath = ath10k_mac_tx_h_get_txpath(ar, skb, txmode);
+   is_mgmt = (txpath == ATH10K_MAC_TX_HTT_MGMT);
+
+   if (is_mgmt) {
+   hdr = (struct ieee80211_hdr *)skb->data;
+   is_presp = ieee80211_is_probe_resp(hdr->frame_control);
+
+   spin_lock_bh(>htt.tx_lock);
+   ret = ath10k_htt_tx_mgmt_inc_pending(htt, is_mgmt, is_presp);
+
+   if (ret) {
+   ath10k_htt_tx_dec_pending(htt);
+   spin_unlock_bh(>htt.tx_lock);
+   return ret;
+   }
+   spin_unlock_bh(>htt.tx_lock);
+   }
 
ret = ath10k_mac_tx(ar, vif, sta, txmode, txpath, skb);
if (unlikely(ret)) {
@@ -3808,6 +3826,8 @@ int ath10k_mac_tx_push_txq(struct ieee80
 
spin_lock_bh(>htt.tx_lock);
ath10k_htt_tx_dec_pending(htt);
+   if (is_mgmt)
+   ath10k_htt_tx_mgmt_dec_pending(htt);
spin_unlock_bh(>htt.tx_lock);
 
return ret;

[PATCH 4.8 053/125] ath10k: fix reporting channel survey data

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Ashok Raj Nagarajan 

commit 77eb3d693182b4eaa88c6ba406fbb92b1f1bd636 upstream.

When user requests for survey dump data, driver is providing wrong survey
information. This information we sent is the survey data that we have
collected during previous user request.

This issue occurs because we request survey dump for wrong channel. With
this change, we correctly display the correct and current survey
information to userspace.

Fixes: fa7937e3d5c2 ("ath10k: update bss channel survey information")
Signed-off-by: Ashok Raj Nagarajan 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/ath/ath10k/mac.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -6558,7 +6558,7 @@ static int ath10k_get_survey(struct ieee
goto exit;
}
 
-   ath10k_mac_update_bss_chan_survey(ar, survey->channel);
+   ath10k_mac_update_bss_chan_survey(ar, >channels[idx]);
 
spin_lock_bh(>data_lock);
memcpy(survey, ar_survey, sizeof(*survey));

[PATCH 4.8 059/125] crypto: ccp - Fix return value check in ccp_dmaengine_register()

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Wei Yongjun 

commit 7514e3688811e610640ec2201ca14dfebfe13442 upstream.

Fix the retrn value check which testing the wrong variable
in ccp_dmaengine_register().

Fixes: 58ea8abf4904 ("crypto: ccp - Register the CCP as a DMA resource")
Signed-off-by: Wei Yongjun 
Acked-by: Gary R Hook 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/crypto/ccp/ccp-dmaengine.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/crypto/ccp/ccp-dmaengine.c
+++ b/drivers/crypto/ccp/ccp-dmaengine.c
@@ -650,7 +650,7 @@ int ccp_dmaengine_register(struct ccp_de
dma_desc_cache_name = devm_kasprintf(ccp->dev, GFP_KERNEL,
 "%s-dmaengine-desc-cache",
 ccp->name);
-   if (!dma_cmd_cache_name)
+   if (!dma_desc_cache_name)
return -ENOMEM;
ccp->dma_desc_cache = kmem_cache_create(dma_desc_cache_name,
sizeof(struct ccp_dma_desc),

[PATCH 4.8 060/125] hwrng: omap - Only fail if pm_runtime_get_sync returns < 0

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Dave Gerlach 

commit ad8529fde9e3601180a839867a8ab041109aebb5 upstream.

Currently omap-rng checks the return value of pm_runtime_get_sync and
reports failure if anything is returned, however it should be checking
if ret < 0 as pm_runtime_get_sync return 0 on success but also can return
1 if the device was already active which is not a failure case. Only
values < 0 are actual failures.

Fixes: 61dc0a446e5d ("hwrng: omap - Fix assumption that runtime_get_sync will 
always succeed")
Signed-off-by: Dave Gerlach 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/char/hw_random/omap-rng.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/char/hw_random/omap-rng.c
+++ b/drivers/char/hw_random/omap-rng.c
@@ -385,7 +385,7 @@ static int omap_rng_probe(struct platfor
 
pm_runtime_enable(>dev);
ret = pm_runtime_get_sync(>dev);
-   if (ret) {
+   if (ret < 0) {
dev_err(>dev, "Failed to runtime_get device: %d\n", ret);
pm_runtime_put_noidle(>dev);
goto err_ioremap;
@@ -443,7 +443,7 @@ static int __maybe_unused omap_rng_resum
int ret;
 
ret = pm_runtime_get_sync(dev);
-   if (ret) {
+   if (ret < 0) {
dev_err(dev, "Failed to runtime_get device: %d\n", ret);
pm_runtime_put_noidle(dev);
return ret;

[PATCH 4.8 008/125] drm/amdgpu/dce11: disable hpd on local panels

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Alex Deucher 

commit 3a9d993ee9809c217f4322623a9b78c8d17fdd1f upstream.

Otherwise we can get a hotplug interrupt storm when
we turn the panel off if hpd interrupts were enabled
by the bios.

bug:
https://bugs.freedesktop.org/show_bug.cgi?id=97471

Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/gpu/drm/amd/amdgpu/dce_v11_0.c |   23 +--
 1 file changed, 13 insertions(+), 10 deletions(-)

--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -443,16 +443,6 @@ static void dce_v11_0_hpd_init(struct am
list_for_each_entry(connector, >mode_config.connector_list, head) {
struct amdgpu_connector *amdgpu_connector = 
to_amdgpu_connector(connector);
 
-   if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
-   connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
-   /* don't try to enable hpd on eDP or LVDS avoid 
breaking the
-* aux dp channel on imac and help (but not completely 
fix)
-* https://bugzilla.redhat.com/show_bug.cgi?id=726143
-* also avoid interrupt storms during dpms.
-*/
-   continue;
-   }
-
switch (amdgpu_connector->hpd.hpd) {
case AMDGPU_HPD_1:
idx = 0;
@@ -476,6 +466,19 @@ static void dce_v11_0_hpd_init(struct am
continue;
}
 
+   if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
+   connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
+   /* don't try to enable hpd on eDP or LVDS avoid 
breaking the
+* aux dp channel on imac and help (but not completely 
fix)
+* https://bugzilla.redhat.com/show_bug.cgi?id=726143
+* also avoid interrupt storms during dpms.
+*/
+   tmp = RREG32(mmDC_HPD_INT_CONTROL + hpd_offsets[idx]);
+   tmp = REG_SET_FIELD(tmp, DC_HPD_INT_CONTROL, 
DC_HPD_INT_EN, 0);
+   WREG32(mmDC_HPD_INT_CONTROL + hpd_offsets[idx], tmp);
+   continue;
+   }
+
tmp = RREG32(mmDC_HPD_CONTROL + hpd_offsets[idx]);
tmp = REG_SET_FIELD(tmp, DC_HPD_CONTROL, DC_HPD_EN, 1);
WREG32(mmDC_HPD_CONTROL + hpd_offsets[idx], tmp);

[PATCH 4.8 055/125] crypto: marvell - Dont overwrite default creq->state during initialization

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Romain Perier 

commit 57cfda1ac74e58767f6305bd1ea3449177425460 upstream.

Currently, in mv_cesa_{md5,sha1,sha256}_init creq->state is initialized
before the call to mv_cesa_ahash_init. This is wrong because this
function fills creq with zero by using memset, so its 'state' that
contains the default DIGEST is overwritten. This commit fixes the issue
by initializing creq->state just after the call to mv_cesa_ahash_init.

Fixes: commit b0ef51067cb4 ("crypto: marvell/cesa - initialize hash...")
Signed-off-by: Romain Perier 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/crypto/marvell/hash.c |   15 +--
 1 file changed, 9 insertions(+), 6 deletions(-)

--- a/drivers/crypto/marvell/hash.c
+++ b/drivers/crypto/marvell/hash.c
@@ -805,13 +805,14 @@ static int mv_cesa_md5_init(struct ahash
struct mv_cesa_op_ctx tmpl = { };
 
mv_cesa_set_op_cfg(, CESA_SA_DESC_CFG_MACM_MD5);
+
+   mv_cesa_ahash_init(req, , true);
+
creq->state[0] = MD5_H0;
creq->state[1] = MD5_H1;
creq->state[2] = MD5_H2;
creq->state[3] = MD5_H3;
 
-   mv_cesa_ahash_init(req, , true);
-
return 0;
 }
 
@@ -873,14 +874,15 @@ static int mv_cesa_sha1_init(struct ahas
struct mv_cesa_op_ctx tmpl = { };
 
mv_cesa_set_op_cfg(, CESA_SA_DESC_CFG_MACM_SHA1);
+
+   mv_cesa_ahash_init(req, , false);
+
creq->state[0] = SHA1_H0;
creq->state[1] = SHA1_H1;
creq->state[2] = SHA1_H2;
creq->state[3] = SHA1_H3;
creq->state[4] = SHA1_H4;
 
-   mv_cesa_ahash_init(req, , false);
-
return 0;
 }
 
@@ -942,6 +944,9 @@ static int mv_cesa_sha256_init(struct ah
struct mv_cesa_op_ctx tmpl = { };
 
mv_cesa_set_op_cfg(, CESA_SA_DESC_CFG_MACM_SHA256);
+
+   mv_cesa_ahash_init(req, , false);
+
creq->state[0] = SHA256_H0;
creq->state[1] = SHA256_H1;
creq->state[2] = SHA256_H2;
@@ -951,8 +956,6 @@ static int mv_cesa_sha256_init(struct ah
creq->state[6] = SHA256_H6;
creq->state[7] = SHA256_H7;
 
-   mv_cesa_ahash_init(req, , false);
-
return 0;
 }
 

[PATCH 4.8 059/125] crypto: ccp - Fix return value check in ccp_dmaengine_register()

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Wei Yongjun 

commit 7514e3688811e610640ec2201ca14dfebfe13442 upstream.

Fix the retrn value check which testing the wrong variable
in ccp_dmaengine_register().

Fixes: 58ea8abf4904 ("crypto: ccp - Register the CCP as a DMA resource")
Signed-off-by: Wei Yongjun 
Acked-by: Gary R Hook 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/crypto/ccp/ccp-dmaengine.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/crypto/ccp/ccp-dmaengine.c
+++ b/drivers/crypto/ccp/ccp-dmaengine.c
@@ -650,7 +650,7 @@ int ccp_dmaengine_register(struct ccp_de
dma_desc_cache_name = devm_kasprintf(ccp->dev, GFP_KERNEL,
 "%s-dmaengine-desc-cache",
 ccp->name);
-   if (!dma_cmd_cache_name)
+   if (!dma_desc_cache_name)
return -ENOMEM;
ccp->dma_desc_cache = kmem_cache_create(dma_desc_cache_name,
sizeof(struct ccp_dma_desc),

[PATCH 4.8 060/125] hwrng: omap - Only fail if pm_runtime_get_sync returns < 0

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Dave Gerlach 

commit ad8529fde9e3601180a839867a8ab041109aebb5 upstream.

Currently omap-rng checks the return value of pm_runtime_get_sync and
reports failure if anything is returned, however it should be checking
if ret < 0 as pm_runtime_get_sync return 0 on success but also can return
1 if the device was already active which is not a failure case. Only
values < 0 are actual failures.

Fixes: 61dc0a446e5d ("hwrng: omap - Fix assumption that runtime_get_sync will 
always succeed")
Signed-off-by: Dave Gerlach 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/char/hw_random/omap-rng.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/char/hw_random/omap-rng.c
+++ b/drivers/char/hw_random/omap-rng.c
@@ -385,7 +385,7 @@ static int omap_rng_probe(struct platfor
 
pm_runtime_enable(>dev);
ret = pm_runtime_get_sync(>dev);
-   if (ret) {
+   if (ret < 0) {
dev_err(>dev, "Failed to runtime_get device: %d\n", ret);
pm_runtime_put_noidle(>dev);
goto err_ioremap;
@@ -443,7 +443,7 @@ static int __maybe_unused omap_rng_resum
int ret;
 
ret = pm_runtime_get_sync(dev);
-   if (ret) {
+   if (ret < 0) {
dev_err(dev, "Failed to runtime_get device: %d\n", ret);
pm_runtime_put_noidle(dev);
return ret;

[PATCH 4.8 008/125] drm/amdgpu/dce11: disable hpd on local panels

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Alex Deucher 

commit 3a9d993ee9809c217f4322623a9b78c8d17fdd1f upstream.

Otherwise we can get a hotplug interrupt storm when
we turn the panel off if hpd interrupts were enabled
by the bios.

bug:
https://bugs.freedesktop.org/show_bug.cgi?id=97471

Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/gpu/drm/amd/amdgpu/dce_v11_0.c |   23 +--
 1 file changed, 13 insertions(+), 10 deletions(-)

--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -443,16 +443,6 @@ static void dce_v11_0_hpd_init(struct am
list_for_each_entry(connector, >mode_config.connector_list, head) {
struct amdgpu_connector *amdgpu_connector = 
to_amdgpu_connector(connector);
 
-   if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
-   connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
-   /* don't try to enable hpd on eDP or LVDS avoid 
breaking the
-* aux dp channel on imac and help (but not completely 
fix)
-* https://bugzilla.redhat.com/show_bug.cgi?id=726143
-* also avoid interrupt storms during dpms.
-*/
-   continue;
-   }
-
switch (amdgpu_connector->hpd.hpd) {
case AMDGPU_HPD_1:
idx = 0;
@@ -476,6 +466,19 @@ static void dce_v11_0_hpd_init(struct am
continue;
}
 
+   if (connector->connector_type == DRM_MODE_CONNECTOR_eDP ||
+   connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
+   /* don't try to enable hpd on eDP or LVDS avoid 
breaking the
+* aux dp channel on imac and help (but not completely 
fix)
+* https://bugzilla.redhat.com/show_bug.cgi?id=726143
+* also avoid interrupt storms during dpms.
+*/
+   tmp = RREG32(mmDC_HPD_INT_CONTROL + hpd_offsets[idx]);
+   tmp = REG_SET_FIELD(tmp, DC_HPD_INT_CONTROL, 
DC_HPD_INT_EN, 0);
+   WREG32(mmDC_HPD_INT_CONTROL + hpd_offsets[idx], tmp);
+   continue;
+   }
+
tmp = RREG32(mmDC_HPD_CONTROL + hpd_offsets[idx]);
tmp = REG_SET_FIELD(tmp, DC_HPD_CONTROL, DC_HPD_EN, 1);
WREG32(mmDC_HPD_CONTROL + hpd_offsets[idx], tmp);

[PATCH 4.8 055/125] crypto: marvell - Dont overwrite default creq->state during initialization

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Romain Perier 

commit 57cfda1ac74e58767f6305bd1ea3449177425460 upstream.

Currently, in mv_cesa_{md5,sha1,sha256}_init creq->state is initialized
before the call to mv_cesa_ahash_init. This is wrong because this
function fills creq with zero by using memset, so its 'state' that
contains the default DIGEST is overwritten. This commit fixes the issue
by initializing creq->state just after the call to mv_cesa_ahash_init.

Fixes: commit b0ef51067cb4 ("crypto: marvell/cesa - initialize hash...")
Signed-off-by: Romain Perier 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/crypto/marvell/hash.c |   15 +--
 1 file changed, 9 insertions(+), 6 deletions(-)

--- a/drivers/crypto/marvell/hash.c
+++ b/drivers/crypto/marvell/hash.c
@@ -805,13 +805,14 @@ static int mv_cesa_md5_init(struct ahash
struct mv_cesa_op_ctx tmpl = { };
 
mv_cesa_set_op_cfg(, CESA_SA_DESC_CFG_MACM_MD5);
+
+   mv_cesa_ahash_init(req, , true);
+
creq->state[0] = MD5_H0;
creq->state[1] = MD5_H1;
creq->state[2] = MD5_H2;
creq->state[3] = MD5_H3;
 
-   mv_cesa_ahash_init(req, , true);
-
return 0;
 }
 
@@ -873,14 +874,15 @@ static int mv_cesa_sha1_init(struct ahas
struct mv_cesa_op_ctx tmpl = { };
 
mv_cesa_set_op_cfg(, CESA_SA_DESC_CFG_MACM_SHA1);
+
+   mv_cesa_ahash_init(req, , false);
+
creq->state[0] = SHA1_H0;
creq->state[1] = SHA1_H1;
creq->state[2] = SHA1_H2;
creq->state[3] = SHA1_H3;
creq->state[4] = SHA1_H4;
 
-   mv_cesa_ahash_init(req, , false);
-
return 0;
 }
 
@@ -942,6 +944,9 @@ static int mv_cesa_sha256_init(struct ah
struct mv_cesa_op_ctx tmpl = { };
 
mv_cesa_set_op_cfg(, CESA_SA_DESC_CFG_MACM_SHA256);
+
+   mv_cesa_ahash_init(req, , false);
+
creq->state[0] = SHA256_H0;
creq->state[1] = SHA256_H1;
creq->state[2] = SHA256_H2;
@@ -951,8 +956,6 @@ static int mv_cesa_sha256_init(struct ah
creq->state[6] = SHA256_H6;
creq->state[7] = SHA256_H7;
 
-   mv_cesa_ahash_init(req, , false);
-
return 0;
 }
 

[PATCH 4.8 078/125] power: bq24257: Fix use of uninitialized pointer bq->charger

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Georges Savoundararadj 

commit 0610735928ee47870e083d5901caa371089216f1 upstream.

bq->charger is initialized in bq24257_power_supply_init.
Therefore, bq24257_power_supply_init should be called before the
registration of the IRQ handler bq24257_irq_handler_thread that calls
power_supply_changed(bq->charger).

Signed-off-by: Georges Savoundararadj 
Cc: Aurelien Chanot 
Cc: Andreas Dannenberg 
Cc: Sebastian Reichel 
Cc: David Woodhouse 
Fixes: 2219a935963e ("power_supply: Add TI BQ24257 charger driver")
Signed-off-by: Sebastian Reichel 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/power/bq24257_charger.c |   12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

--- a/drivers/power/bq24257_charger.c
+++ b/drivers/power/bq24257_charger.c
@@ -1068,6 +1068,12 @@ static int bq24257_probe(struct i2c_clie
return ret;
}
 
+   ret = bq24257_power_supply_init(bq);
+   if (ret < 0) {
+   dev_err(dev, "Failed to register power supply\n");
+   return ret;
+   }
+
ret = devm_request_threaded_irq(dev, client->irq, NULL,
bq24257_irq_handler_thread,
IRQF_TRIGGER_FALLING |
@@ -1078,12 +1084,6 @@ static int bq24257_probe(struct i2c_clie
return ret;
}
 
-   ret = bq24257_power_supply_init(bq);
-   if (ret < 0) {
-   dev_err(dev, "Failed to register power supply\n");
-   return ret;
-   }
-
ret = sysfs_create_group(>charger->dev.kobj, _attr_group);
if (ret < 0) {
dev_err(dev, "Can't create sysfs entries\n");

[PATCH 4.8 050/125] mwifiex: fix failed to reconnect after interface disabled/enabled

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Amitkumar Karwar 

commit c8ccf3ade7851054f82bf88f5fcd393a394038a3 upstream.

Recent patch "mwifiex: fix NULL pointer" skips extended scan event
handling when suspend is in progress. It created a problem for scan
after interface disabled/enabled case.

This patch solves the problem by checking netif_running() status.

Fixes:16d25da94f3d654 ("mwifiex: fix NULL pointer dereference during suspend")
Signed-off-by: Amitkumar Karwar 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/marvell/mwifiex/sta_event.c |6 +-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/marvell/mwifiex/sta_event.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_event.c
@@ -708,7 +708,11 @@ int mwifiex_process_sta_event(struct mwi
 
case EVENT_EXT_SCAN_REPORT:
mwifiex_dbg(adapter, EVENT, "event: EXT_SCAN Report\n");
-   if (adapter->ext_scan && !priv->scan_aborting)
+   /* We intend to skip this event during suspend, but handle
+* it in interface disabled case
+*/
+   if (adapter->ext_scan && (!priv->scan_aborting ||
+ !netif_running(priv->netdev)))
ret = mwifiex_handle_event_ext_scan_report(priv,
adapter->event_skb->data);
 

[PATCH 1/4] proc: just list_del() struct pde_opener

[Alexey Dobriyan]

list_del_init() is too much, structure will be freed in three lines anyway.

Signed-off-by: Alexey Dobriyan 
---

 fs/proc/inode.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -152,7 +152,7 @@ static void close_pdeo(struct proc_dir_entry *pde, struct 
pde_opener *pdeo)
file = pdeo->file;
pde->proc_fops->release(file_inode(file), file);
spin_lock(>pde_unload_lock);
-   list_del_init(>lh);
+   list_del(>lh);
if (pdeo->c)
complete(pdeo->c);
kfree(pdeo);

[PATCH 4.8 062/125] ASoC: dapm: Fix possible uninitialized variable in snd_soc_dapm_get_volsw()

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Chen-Yu Tsai 

commit 01ad5e7de67b408d9b48b437b06a9938ddf460b5 upstream.

If soc_dapm_read() fails, val will be uninitialized, and bogus values
will be written later:

ret = soc_dapm_read(dapm, reg, );
val = (val >> shift) & mask;

However, the compiler does not give a warning. Return on error before
val is really used to avoid this.

This is similar to the commit 6912831623c5 ("ASoC: dapm: Fix
uninitialized variable in snd_soc_dapm_get_enum_double()")

Fixes: ce0fc93ae56e (ASoC: Add DAPM support at the component level)
Signed-off-by: Chen-Yu Tsai 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/soc/soc-dapm.c |3 +++
 1 file changed, 3 insertions(+)

--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -3049,6 +3049,9 @@ int snd_soc_dapm_get_volsw(struct snd_kc
}
mutex_unlock(>dapm_mutex);
 
+   if (ret)
+   return ret;
+
if (invert)
ucontrol->value.integer.value[0] = max - val;
else

[PATCH 4.8 067/125] iio: ad5755: fix off-by-one on devnr limit check

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Colin Ian King 

commit 9d47964bfd471f0dd4c89f28556aec68bffa0020 upstream.

The comparison for devnr limits is off-by-one, the current check
allows 0 to AD5755_NUM_CHANNELS and the limit should be in fact
0 to AD5755_NUM_CHANNELS - 1.  This can lead to an out of bounds
write to pdata->dac[devnr]. Fix this by replacing > with >= on the
comparison.

Signed-off-by: Colin Ian King 
Fixes: c947459979c6 ("iio: ad5755: add support for dt bindings")
Signed-off-by: Jonathan Cameron 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/iio/dac/ad5755.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/iio/dac/ad5755.c
+++ b/drivers/iio/dac/ad5755.c
@@ -655,7 +655,7 @@ static struct ad5755_platform_data *ad57
 
devnr = 0;
for_each_child_of_node(np, pp) {
-   if (devnr > AD5755_NUM_CHANNELS) {
+   if (devnr >= AD5755_NUM_CHANNELS) {
dev_err(dev,
"There is to many channels defined in DT\n");
goto error_out;

[PATCH 4.8 047/125] i40e: remove a stray unlock

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

commit be0cb0a66a1d426f7cd9b170c008725044ae147a upstream.

We shifted the locking around a bit but forgot to delete this unlock so
now it can unlock twice.

Fixes: cd3be169a5ff ('i40e: Move the mutex lock in i40e_client_unregister')
Signed-off-by: Dan Carpenter 
Tested-by: Andrew Bowers 
Signed-off-by: Jeff Kirsher 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/ethernet/intel/i40e/i40e_client.c |1 -
 1 file changed, 1 deletion(-)

--- a/drivers/net/ethernet/intel/i40e/i40e_client.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_client.c
@@ -1009,7 +1009,6 @@ int i40e_unregister_client(struct i40e_c
if (!i40e_client_is_registered(client)) {
pr_info("i40e: Client %s has not been registered\n",
client->name);
-   mutex_unlock(_client_mutex);
ret = -ENODEV;
goto out;
}

[PATCH 4.8 078/125] power: bq24257: Fix use of uninitialized pointer bq->charger

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Georges Savoundararadj 

commit 0610735928ee47870e083d5901caa371089216f1 upstream.

bq->charger is initialized in bq24257_power_supply_init.
Therefore, bq24257_power_supply_init should be called before the
registration of the IRQ handler bq24257_irq_handler_thread that calls
power_supply_changed(bq->charger).

Signed-off-by: Georges Savoundararadj 
Cc: Aurelien Chanot 
Cc: Andreas Dannenberg 
Cc: Sebastian Reichel 
Cc: David Woodhouse 
Fixes: 2219a935963e ("power_supply: Add TI BQ24257 charger driver")
Signed-off-by: Sebastian Reichel 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/power/bq24257_charger.c |   12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

--- a/drivers/power/bq24257_charger.c
+++ b/drivers/power/bq24257_charger.c
@@ -1068,6 +1068,12 @@ static int bq24257_probe(struct i2c_clie
return ret;
}
 
+   ret = bq24257_power_supply_init(bq);
+   if (ret < 0) {
+   dev_err(dev, "Failed to register power supply\n");
+   return ret;
+   }
+
ret = devm_request_threaded_irq(dev, client->irq, NULL,
bq24257_irq_handler_thread,
IRQF_TRIGGER_FALLING |
@@ -1078,12 +1084,6 @@ static int bq24257_probe(struct i2c_clie
return ret;
}
 
-   ret = bq24257_power_supply_init(bq);
-   if (ret < 0) {
-   dev_err(dev, "Failed to register power supply\n");
-   return ret;
-   }
-
ret = sysfs_create_group(>charger->dev.kobj, _attr_group);
if (ret < 0) {
dev_err(dev, "Can't create sysfs entries\n");

[PATCH 4.8 050/125] mwifiex: fix failed to reconnect after interface disabled/enabled

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Amitkumar Karwar 

commit c8ccf3ade7851054f82bf88f5fcd393a394038a3 upstream.

Recent patch "mwifiex: fix NULL pointer" skips extended scan event
handling when suspend is in progress. It created a problem for scan
after interface disabled/enabled case.

This patch solves the problem by checking netif_running() status.

Fixes:16d25da94f3d654 ("mwifiex: fix NULL pointer dereference during suspend")
Signed-off-by: Amitkumar Karwar 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/marvell/mwifiex/sta_event.c |6 +-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/marvell/mwifiex/sta_event.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_event.c
@@ -708,7 +708,11 @@ int mwifiex_process_sta_event(struct mwi
 
case EVENT_EXT_SCAN_REPORT:
mwifiex_dbg(adapter, EVENT, "event: EXT_SCAN Report\n");
-   if (adapter->ext_scan && !priv->scan_aborting)
+   /* We intend to skip this event during suspend, but handle
+* it in interface disabled case
+*/
+   if (adapter->ext_scan && (!priv->scan_aborting ||
+ !netif_running(priv->netdev)))
ret = mwifiex_handle_event_ext_scan_report(priv,
adapter->event_skb->data);
 

[PATCH 1/4] proc: just list_del() struct pde_opener

[Alexey Dobriyan]

list_del_init() is too much, structure will be freed in three lines anyway.

Signed-off-by: Alexey Dobriyan 
---

 fs/proc/inode.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -152,7 +152,7 @@ static void close_pdeo(struct proc_dir_entry *pde, struct 
pde_opener *pdeo)
file = pdeo->file;
pde->proc_fops->release(file_inode(file), file);
spin_lock(>pde_unload_lock);
-   list_del_init(>lh);
+   list_del(>lh);
if (pdeo->c)
complete(pdeo->c);
kfree(pdeo);

[PATCH 4.8 062/125] ASoC: dapm: Fix possible uninitialized variable in snd_soc_dapm_get_volsw()

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Chen-Yu Tsai 

commit 01ad5e7de67b408d9b48b437b06a9938ddf460b5 upstream.

If soc_dapm_read() fails, val will be uninitialized, and bogus values
will be written later:

ret = soc_dapm_read(dapm, reg, );
val = (val >> shift) & mask;

However, the compiler does not give a warning. Return on error before
val is really used to avoid this.

This is similar to the commit 6912831623c5 ("ASoC: dapm: Fix
uninitialized variable in snd_soc_dapm_get_enum_double()")

Fixes: ce0fc93ae56e (ASoC: Add DAPM support at the component level)
Signed-off-by: Chen-Yu Tsai 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/soc/soc-dapm.c |3 +++
 1 file changed, 3 insertions(+)

--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -3049,6 +3049,9 @@ int snd_soc_dapm_get_volsw(struct snd_kc
}
mutex_unlock(>dapm_mutex);
 
+   if (ret)
+   return ret;
+
if (invert)
ucontrol->value.integer.value[0] = max - val;
else

[PATCH 4.8 067/125] iio: ad5755: fix off-by-one on devnr limit check

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Colin Ian King 

commit 9d47964bfd471f0dd4c89f28556aec68bffa0020 upstream.

The comparison for devnr limits is off-by-one, the current check
allows 0 to AD5755_NUM_CHANNELS and the limit should be in fact
0 to AD5755_NUM_CHANNELS - 1.  This can lead to an out of bounds
write to pdata->dac[devnr]. Fix this by replacing > with >= on the
comparison.

Signed-off-by: Colin Ian King 
Fixes: c947459979c6 ("iio: ad5755: add support for dt bindings")
Signed-off-by: Jonathan Cameron 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/iio/dac/ad5755.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/iio/dac/ad5755.c
+++ b/drivers/iio/dac/ad5755.c
@@ -655,7 +655,7 @@ static struct ad5755_platform_data *ad57
 
devnr = 0;
for_each_child_of_node(np, pp) {
-   if (devnr > AD5755_NUM_CHANNELS) {
+   if (devnr >= AD5755_NUM_CHANNELS) {
dev_err(dev,
"There is to many channels defined in DT\n");
goto error_out;

[PATCH 4.8 047/125] i40e: remove a stray unlock

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Dan Carpenter 

commit be0cb0a66a1d426f7cd9b170c008725044ae147a upstream.

We shifted the locking around a bit but forgot to delete this unlock so
now it can unlock twice.

Fixes: cd3be169a5ff ('i40e: Move the mutex lock in i40e_client_unregister')
Signed-off-by: Dan Carpenter 
Tested-by: Andrew Bowers 
Signed-off-by: Jeff Kirsher 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/ethernet/intel/i40e/i40e_client.c |1 -
 1 file changed, 1 deletion(-)

--- a/drivers/net/ethernet/intel/i40e/i40e_client.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_client.c
@@ -1009,7 +1009,6 @@ int i40e_unregister_client(struct i40e_c
if (!i40e_client_is_registered(client)) {
pr_info("i40e: Client %s has not been registered\n",
client->name);
-   mutex_unlock(_client_mutex);
ret = -ENODEV;
goto out;
}

[PATCH 4.8 081/125] mm/hugetlb: improve locking in dissolve_free_huge_pages()

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Gerald Schaefer 

commit eb03aa008561004257900983193d024e57abdd96 upstream.

For every pfn aligned to minimum_order, dissolve_free_huge_pages() will
call dissolve_free_huge_page() which takes the hugetlb spinlock, even if
the page is not huge at all or a hugepage that is in-use.

Improve this by doing the PageHuge() and page_count() checks already in
dissolve_free_huge_pages() before calling dissolve_free_huge_page().  In
dissolve_free_huge_page(), when holding the spinlock, those checks need
to be revalidated.

Link: http://lkml.kernel.org/r/20160926172811.94033-4-gerald.schae...@de.ibm.com
Signed-off-by: Gerald Schaefer 
Acked-by: Michal Hocko 
Acked-by: Naoya Horiguchi 
Cc: "Kirill A . Shutemov" 
Cc: Vlastimil Babka 
Cc: Mike Kravetz 
Cc: "Aneesh Kumar K . V" 
Cc: Martin Schwidefsky 
Cc: Heiko Carstens 
Cc: Rui Teng 
Cc: Dave Hansen 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 mm/hugetlb.c |   12 +---
 1 file changed, 9 insertions(+), 3 deletions(-)

--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1476,14 +1476,20 @@ out:
 int dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
 {
unsigned long pfn;
+   struct page *page;
int rc = 0;
 
if (!hugepages_supported())
return rc;
 
-   for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order)
-   if (rc = dissolve_free_huge_page(pfn_to_page(pfn)))
-   break;
+   for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order) {
+   page = pfn_to_page(pfn);
+   if (PageHuge(page) && !page_count(page)) {
+   rc = dissolve_free_huge_page(page);
+   if (rc)
+   break;
+   }
+   }
 
return rc;
 }

[PATCH 4.8 079/125] dmaengine: ipu: remove bogus NO_IRQ reference

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Arnd Bergmann 

commit 86c7e6836479c4045a9a81ed5ea76c51d719f9c1 upstream.

A workaround for a warning introduced a use of the NO_IRQ
macro that should have been gone for a long time.

It is clear from the code that the value cannot actually
be used, but apparently there was a configuration at
some point that caused a warning, so instead of just
reverting that patch, this rearranges the code in a way that
the warning cannot reappear.

Signed-off-by: Arnd Bergmann 
Fixes: 6ef41cf6f721 ("dmaengine :ipu: change ipu_irq_handler() to remove 
compile warning")
Signed-off-by: Vinod Koul 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/dma/ipu/ipu_irq.c |9 -
 1 file changed, 4 insertions(+), 5 deletions(-)

--- a/drivers/dma/ipu/ipu_irq.c
+++ b/drivers/dma/ipu/ipu_irq.c
@@ -286,22 +286,21 @@ static void ipu_irq_handler(struct irq_d
raw_spin_unlock(_lock);
while ((line = ffs(status))) {
struct ipu_irq_map *map;
-   unsigned int irq = NO_IRQ;
+   unsigned int irq;
 
line--;
status &= ~(1UL << line);
 
raw_spin_lock(_lock);
map = src2map(32 * i + line);
-   if (map)
-   irq = map->irq;
-   raw_spin_unlock(_lock);
-
if (!map) {
+   raw_spin_unlock(_lock);
pr_err("IPU: Interrupt on unmapped source %u 
bank %d\n",
   line, i);
continue;
}
+   irq = map->irq;
+   raw_spin_unlock(_lock);
generic_handle_irq(irq);
}
}

[PATCH 4.8 048/125] i40e: fix broken i40e_config_rss_aq function

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Jacob Keller 

commit 776b2e15f8af7900409456292efd45af6de97172 upstream.

X722 hardware requires using the admin queue to configure RSS. This
function was previously re-written in commit e69ff813af35 ("i40e: rework
the functions to configure RSS with similar parameters").
However, the previous refactor did not work correctly for a few reasons

(a) it does not check whether seed is NULL before using it, resulting in
a NULL pointer dereference

[  402.954721] BUG: unable to handle kernel NULL pointer dereference at 
  (null)
[  402.955568] IP: [] 
i40e_config_rss_aq.constprop.65+0x2f/0x1c0 [i40e]
[  402.956402] PGD ad610067 PUD accc0067 PMD 0
[  402.957235] Oops:  [#1] SMP
[  402.958064] Modules linked in: ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 
xt_conntrack ip_set nfnetlink ebtable_filter ebtable_
broute bridge stp llc ebtable_nat ebtables ip6table_mangle ip6table_raw 
ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv
6 ip6table_security ip6table_filter ip6_tables iptable_mangle iptable_raw 
iptable_nat nf_conntrack_ipv4_ nf_defrag_ipv4_ nf_nat_ip
v4_ nf_nat nf_conntrack iptable_security intel_rapl i86_kg_temp_thermal 
coretemp kvm_intel kvm irqbypass crct10dif_clMl crc32_
pclMl ghash_clMlni_intel iTCO_wdt iTCO_vendor_support shpchp sb_edac dcdbas 
pcspkr joydev ipmi_devintf wmi edac_core ipmi_ssif
 acpi_ad acpi_ower_meter ipmi_si ipmi_msghandler mei_me nfsd lpc_ich mei 
ioatdma tpm_tis auth_rpcgss tpm nfs_acl lockd grace s
unrpc ifs nngag200 i2c_algo_bit drm_kms_helper ttm drm iigbe bnx2x i40e dca 
mdio ptp pps_core libcrc32c fjes crc32c_intel
[  402.965563] CPU: 22 PID: 2461 Conm: ethtool Not tainted 
4.6.0-rc7_1.2-ABNidQ+ #20
[  402.966719] Hardware name: Dell Inc. PowerEdge R720/0C4Y3R, BIOS 2.5.2 
01/28/2015
[  402.967862] task: 880219b51dc0 ti: 8800b3408000 task.ti: 
8800b3408000
[  402.969046] RIP: 0010:[]  [] 
i40e_config_rss_aq.constprop.65+0x2f/0x1c0 [i40e]
[  402.970339] RSP: 0018:8800b340ba90  EFLAGS: 00010246
[  402.971616] RAX:  RBX: 88042ec14000 RCX: 0200
[  402.972961] RDX: 880428eb9200 RSI:  RDI: 88042ec14000
[  402.974312] RBP: 8800b340baf8 R08: 880237ada8f0 R09: 880428eb9200
[  402.975709] R10: 880428eb9200 R11:  R12: 88042ec2e000
[  402.977104] R13: 88042ec2e000 R14: 88042ec14000 R15: 88022ea00800
[  402.978541] FS:  7f84fd054700() GS:880237ac() 
knlGS:
[  402.980003] CS:  0010 DS:  ES:  CR0: 80050033
[  402.981508] CR2:  CR3: 3289e000 CR4: 000406e0
[  402.983028] Stack:
[  402.984578]  02000200  88023ffeda68 
88023ffef000
[  402.986187]  0268 8800b340bbf8 88023ffedd80 
88ce4f1d
[  402.987844]  88042ec14000 88022ea00800 88042ec2e000 
88042ec14000
[  402.989509] Call Trace:
[  402.991200]  [] i40e_config_rss+0x11f/0x1c0 [i40e]
[  402.992924]  [] i40e_set_rifh+0ic0/0x130 [i40e]
[  402.994684]  [] ethtool_set_rifh+0x1f7/0x300
[  402.996446]  [] ? cred_has_capability+0io6b/0x100
[  402.998203]  [] ? selinux_capable+0x12/0x20
[  402.68]  [] ? security_capable+0x4b/0x70
[  403.001707]  [] dev_ethtool+0x1423/0x2290
[  403.003461]  [] dev_ioctl+0x191/0io630
[  403.005186]  [] ? lru_cache_add+0x3a/0i80
[  403.006942]  [] ? _raw_spin_unlock+0ie/0x20
[  403.008691]  [] sock_do_ioctl+0x45/0i50
[  403.010421]  [] sock_ioctl+0x209/0x2d0
[  403.012173]  [] do_vfs_ioctl+0u4/0io6c0
[  403.013911]  [] SyS_ioctl+0x79/0x90
[  403.015710]  [] entry_SYSCALL_64_fastpath+0x1a/0u4
[  403.017500] Code: 90 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 89 fb 48 83 
ec 40 4c 8b a7 e0 05 00 00 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 <48> 8b 
06 41 0f b7 bc 24 f2 0f 00 00 48 89 45 9c 48 8b 46 08 48
[  403.021454] RIP  [] 
i40e_config_rss_aq.constprop.65+0x2f/0x1c0 [i40e]
[  403.023395]  RSP 
[  403.025271] CR2: 
[  403.027169] ---[ end trace 64561b528cf61cf0 ]---

(b) it does not even bother to use the passed in *lut parameter which
defines the requested lookup table. Instead it uses its own round robin
table.

Fix these issues by re-writing it to be similar to i40e_config_rss_reg
and i40e_get_rss_aq.

Fixes: e69ff813af35 ("i40e: rework the functions to configure RSS with similar 
parameters", 2015-10-21)
Signed-off-by: Jacob Keller 
Tested-by: Andrew Bowers 
Signed-off-by: Jeff Kirsher 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/ethernet/intel/i40e/i40e_main.c |   57 +++-
 1 file changed, 23 insertions(+), 34 deletions(-)

--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -7990,45 

[PATCH 4.8 041/125] scsi: cxlflash: Remove the device cleanly in the system shutdown path

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Uma Krishnan 

commit babf985d1e1b0677cb264acd01319d2b9c8f4327 upstream.

Commit 704c4b0ddc03 ("cxlflash: Shutdown notify support for CXL Flash
cards") was recently introduced to notify the AFU when a system is going
down. Due to the position of the cxlflash driver in the device stack,
cxlflash devices are _always_ removed during a reboot/shutdown. This can
lead to a crash if the cxlflash shutdown hook is invoked _after_ the
shutdown hook for the owning virtual PHB. Furthermore, the current
implementation of shutdown/remove hooks for cxlflash are not tolerant to
being invoked when the device is not enabled. This can also lead to a
crash in situations where the remove hook is invoked after the device
has been removed via the vPHBs shutdown hook. An example of this
scenario would be an EEH reset failure while a reboot/shutdown is in
progress.

To solve both problems, the shutdown hook for cxlflash is updated to
simply remove the device. This path already includes the AFU
notification and thus this solution will continue to perform the
original intent. At the same time, the remove hook is updated to protect
against being called when the device is not enabled.

Fixes: 704c4b0ddc03 ("cxlflash: Shutdown notify support for CXL Flash
cards")
Signed-off-by: Uma Krishnan 
Acked-by: Matthew R. Ochs 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/scsi/cxlflash/main.c |   18 ++
 1 file changed, 6 insertions(+), 12 deletions(-)

--- a/drivers/scsi/cxlflash/main.c
+++ b/drivers/scsi/cxlflash/main.c
@@ -823,17 +823,6 @@ static void notify_shutdown(struct cxlfl
 }
 
 /**
- * cxlflash_shutdown() - shutdown handler
- * @pdev:  PCI device associated with the host.
- */
-static void cxlflash_shutdown(struct pci_dev *pdev)
-{
-   struct cxlflash_cfg *cfg = pci_get_drvdata(pdev);
-
-   notify_shutdown(cfg, false);
-}
-
-/**
  * cxlflash_remove() - PCI entry point to tear down host
  * @pdev:  PCI device associated with the host.
  *
@@ -844,6 +833,11 @@ static void cxlflash_remove(struct pci_d
struct cxlflash_cfg *cfg = pci_get_drvdata(pdev);
ulong lock_flags;
 
+   if (!pci_is_enabled(pdev)) {
+   pr_debug("%s: Device is disabled\n", __func__);
+   return;
+   }
+
/* If a Task Management Function is active, wait for it to complete
 * before continuing with remove.
 */
@@ -2685,7 +2679,7 @@ static struct pci_driver cxlflash_driver
.id_table = cxlflash_pci_table,
.probe = cxlflash_probe,
.remove = cxlflash_remove,
-   .shutdown = cxlflash_shutdown,
+   .shutdown = cxlflash_remove,
.err_handler = _err_handler,
 };
 

[PATCH 4.8 061/125] ASoC: topology: Fix error return code in soc_tplg_dapm_widget_create()

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Wei Yongjun 

commit 8ae3ea48df0d746b663057cf0b972a18d0777b7b upstream.

Fix to return error code -ENOMEM instead of 0 when failed to create
widget, as done elsewhere in this function.

Fixes: 8a9782346dcc ("ASoC: topology: Add topology core")
Signed-off-by: Wei Yongjun 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/soc/soc-topology.c |1 +
 1 file changed, 1 insertion(+)

--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -1475,6 +1475,7 @@ widget:
if (widget == NULL) {
dev_err(tplg->dev, "ASoC: failed to create widget %s 
controls\n",
w->name);
+   ret = -ENOMEM;
goto hdr_err;
}
 

[BUG] Integer overflow in sort() function

[Michał Wysoczański]

Hello,

There is possible integer overflow in kernel sort() function leading to page
fault. sort() function accepts number of items and item size as two 64-bit
arguments (size_t) but internal calculations are done using 32-bit integers:

void sort(void *base, size_t num, size_t size,
  int (*cmp_func)(const void *, const void *),
  void (*swap_func)(void *, void *, int size))
{
/* pre-scale counters for performance */
int i = (num/2 - 1) * size, n = num * size, c, r;

As these values are later used for iterations over buffer being sorted
and there is no checking for overflow some combinations of num
and size args will lead to page fault.
Here is sample code to reproduce this issue:

=
#include 
#include 
#include 

#define SORT_ITEMS_COUNT 16000

struct sort_item {
uint64_t buf[2];
};

static int sort_test_cmp(const void *a,
const void *b)
{
const struct sort_item *p1 = a;
const struct sort_item *p2 = b;
return p1->buf[0] > p2->buf[0] ? 1 : -1;
}

static void sort_test(void)
{
struct sort_item *items;

items = vmalloc(sizeof(*items) * SORT_ITEMS_COUNT);
if (!items)
return;
sort(items, SORT_ITEMS_COUNT, sizeof(*items),
sort_test_cmp, NULL);
vfree(items);
}

static int __init sorttest_init_module(void)
{
sort_test();
return 0;
}
module_init(sorttest_init_module);

static void __exit sorttest_exit_module(void)
{
}
module_exit(sorttest_exit_module);

MODULE_LICENSE("GPL");
=

And kernel BUG report:

[ 1668.230986] BUG: unable to handle kernel paging request at c8ffb8968ff0
[ 1668.240094] IP: [] sort_test_cmp+0x8/0x1c [sorttest]
[ 1668.248565] PGD 0 [ 1668.250620]
[ 1668.253415] Oops:  [#1] SMP
[ 1668.258019] Modules linked in: sorttest(OE+) xt_CHECKSUM
ipt_MASQUERADE nf_nat_masquerade_ipv4 tun nls_utf8 isofs loop
rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache ip6t_rpfilter
ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_conntrack
ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables
ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6
ip6table_mangle ip6table_security ip6table_raw ip6table_filter
ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4
nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw
iptable_filter dm_mirror dm_region_hash dm_log dm_mod sb_edac
edac_core x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm
irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel
aesni_intel iTCO_wdt lrw ipmi_devintf iTCO_vendor_support gf128mul
ipmi_ssif mei_me ioatdma glue_helper ablk_helper shpchp mei ipmi_si
i2c_i801 cryptd pcspkr ipmi_msghandler lpc_ich sg i2c_smbus wmi
mfd_core nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables ext4
jbd2 mbcache sd_mod mgag200 drm_kms_helper isci syscopyarea
sysfillrect sysimgblt fb_sys_fops ttm libsas igb drm ptp ahci libahci
scsi_transport_sas pps_core dca libata crc32c_intel i2c_algo_bit nvme
i2c_core nvme_core [last unloaded: sorttest]
[ 1668.394028] CPU: 23 PID: 6109 Comm: insmod Tainted: G   OEL
 4.9.0-rc2 #1
[ 1668.403491] Hardware name: Intel Corporation S2600CP/S2600CP, BIOS
SE5C600.86B.02.06.0002.101320150901 10/13/2015
[ 1668.416075] task: 88042a151600 task.stack: c90004b2c000
[ 1668.423814] RIP: 0010:[]  []
sort_test_cmp+0x8/0x1c [sorttest]
[ 1668.434980] RSP: 0018:c90004b2fc00  EFLAGS: 00010246
[ 1668.442059] RAX:  RBX: 98967ff0 RCX: 0010
[ 1668.451186] RDX: 98967ff0 RSI: c8ffb8968ff0 RDI: c9006c4b4ff0
[ 1668.460307] RBP: c90004b2fc70 R08: 4c4b3ff0 R09: 8163
[ 1668.469439] R10:  R11:  R12: c8ffb8968ff0
[ 1668.478564] R13: c9006c4b4ff0 R14: c90020001000 R15: 0010
[ 1668.487684] FS:  7f93cadc0740() GS:88042edc()
knlGS:
[ 1668.497876] CS:  0010 DS:  ES:  CR0: 80050033
[ 1668.505440] CR2: c8ffb8968ff0 CR3: 00042a467000 CR4: 000406e0
[ 1668.514563] Stack:
[ 1668.517955]  81363372 989686b02000 98967fe0ffe0
024002c22b110400
[ 1668.527424]  813632a0 98967ff0 98968000
00104c4b3ff0
[ 1668.536888]  a077a000 c90020001000 a0064000
c90004b2fe80
[ 1668.546353] Call Trace:
[ 1668.550246]  [] ? sort+0xa2/0x240
[ 1668.556865]  [] ? u64_swap+0x20/0x20
[ 1668.563769]  [] ? 0xa077a000
[ 1668.570664]  [] ? 0xa0064000
[ 1668.577551]  [] sorttest_init_module+0x33/0x1000 [sorttest]
[ 1668.586677]  [] do_one_initcall+0x50/0x190
[ 1668.594156]  [] ? kmem_cache_alloc_trace+0x14b/0x1b0
[ 1668.602605]  [] do_init_module+0x60/0x1f1
[ 1668.609985]  [] load_module+0x15ab/0x1aa0
[ 1668.617366]  [] ? __symbol_put+0x60/0x60
[ 1668.624647]  [] ? ima_post_read_file+0x3d/0x80
[ 1668.632511]  [] ? 

[PATCH 4.8 066/125] ASoC: sst-bxt-da7219_max98357a: fix obsoleted initializers for array

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Takashi Sakamoto 

commit 43d443dc257c00ef3a3f940b6abfb7537c4fcbe8 upstream.

Sparse reports below warnings.

bxt_da7219_max98357a.c:250:9: warning: obsolete array initializer, use C99 
syntax
bxt_da7219_max98357a.c:275:9: warning: obsolete array initializer, use C99 
syntax
bxt_da7219_max98357a.c:290:9: warning: obsolete array initializer, use C99 
syntax
bxt_da7219_max98357a.c:304:9: warning: obsolete array initializer, use C99 
syntax
bxt_da7219_max98357a.c:317:9: warning: obsolete array initializer, use C99 
syntax

There's no need to use obsoleted way. This commit fixes it.

Fixes: 723bad3fef8b (ASoC: Intel: Add Broxton-P Dialog Maxim machine driver)
Signed-off-by: Takashi Sakamoto 
Acked-by: Vinod Koul 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/soc/intel/boards/bxt_da7219_max98357a.c |   12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

--- a/sound/soc/intel/boards/bxt_da7219_max98357a.c
+++ b/sound/soc/intel/boards/bxt_da7219_max98357a.c
@@ -255,7 +255,7 @@ static struct snd_soc_ops broxton_da7219
 /* broxton digital audio interface glue - connects codec <--> CPU */
 static struct snd_soc_dai_link broxton_dais[] = {
/* Front End DAI links */
-   [BXT_DPCM_AUDIO_PB]
+   [BXT_DPCM_AUDIO_PB] =
{
.name = "Bxt Audio Port",
.stream_name = "Audio",
@@ -271,7 +271,7 @@ static struct snd_soc_dai_link broxton_d
.dpcm_playback = 1,
.ops = _da7219_fe_ops,
},
-   [BXT_DPCM_AUDIO_CP]
+   [BXT_DPCM_AUDIO_CP] =
{
.name = "Bxt Audio Capture Port",
.stream_name = "Audio Record",
@@ -286,7 +286,7 @@ static struct snd_soc_dai_link broxton_d
.dpcm_capture = 1,
.ops = _da7219_fe_ops,
},
-   [BXT_DPCM_AUDIO_REF_CP]
+   [BXT_DPCM_AUDIO_REF_CP] =
{
.name = "Bxt Audio Reference cap",
.stream_name = "Refcap",
@@ -300,7 +300,7 @@ static struct snd_soc_dai_link broxton_d
.nonatomic = 1,
.dynamic = 1,
},
-   [BXT_DPCM_AUDIO_HDMI1_PB]
+   [BXT_DPCM_AUDIO_HDMI1_PB] =
{
.name = "Bxt HDMI Port1",
.stream_name = "Hdmi1",
@@ -313,7 +313,7 @@ static struct snd_soc_dai_link broxton_d
.nonatomic = 1,
.dynamic = 1,
},
-   [BXT_DPCM_AUDIO_HDMI2_PB]
+   [BXT_DPCM_AUDIO_HDMI2_PB] =
{
.name = "Bxt HDMI Port2",
.stream_name = "Hdmi2",
@@ -326,7 +326,7 @@ static struct snd_soc_dai_link broxton_d
.nonatomic = 1,
.dynamic = 1,
},
-   [BXT_DPCM_AUDIO_HDMI3_PB]
+   [BXT_DPCM_AUDIO_HDMI3_PB] =
{
.name = "Bxt HDMI Port3",
.stream_name = "Hdmi3",

[PATCH] proc: make struct pid_entry::len unsigned

[Alexey Dobriyan]

"unsigned int" is better on x86_64 because it most of the time it
autoexpands to 64-bit value while "int" requires MOVSX instruction.

Signed-off-by: Alexey Dobriyan 
---

 fs/proc/base.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -106,7 +106,7 @@
 
 struct pid_entry {
const char *name;
-   int len;
+   unsigned int len;
umode_t mode;
const struct inode_operations *iop;
const struct file_operations *fop;

[PATCH 4.8 049/125] mwifiex: correct aid value during tdls setup

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Xinming Hu 

commit b64db1b252e9974a43a51ba083fa7d03e4716167 upstream.

AID gets updated during TDLS setup, but modified value isn't reflected
in "priv->assoc_rsp_buf". This causes TDLS setup failure. The problem is
fixed here.

Fixes: 4aff53ef18e4a4 ("mwifiex: parsing aid while receiving..")
Signed-off-by: Xinming Hu 
Signed-off-by: Amitkumar Karwar 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/marvell/mwifiex/join.c |3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/net/wireless/marvell/mwifiex/join.c
+++ b/drivers/net/wireless/marvell/mwifiex/join.c
@@ -669,9 +669,8 @@ int mwifiex_ret_802_11_associate(struct
priv->assoc_rsp_size = min(le16_to_cpu(resp->size) - S_DS_GEN,
   sizeof(priv->assoc_rsp_buf));
 
-   memcpy(priv->assoc_rsp_buf, >params, priv->assoc_rsp_size);
-
assoc_rsp->a_id = cpu_to_le16(aid);
+   memcpy(priv->assoc_rsp_buf, >params, priv->assoc_rsp_size);
 
if (status_code) {
priv->adapter->dbg.num_cmd_assoc_failure++;

[PATCH 4.8 061/125] ASoC: topology: Fix error return code in soc_tplg_dapm_widget_create()

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Wei Yongjun 

commit 8ae3ea48df0d746b663057cf0b972a18d0777b7b upstream.

Fix to return error code -ENOMEM instead of 0 when failed to create
widget, as done elsewhere in this function.

Fixes: 8a9782346dcc ("ASoC: topology: Add topology core")
Signed-off-by: Wei Yongjun 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/soc/soc-topology.c |1 +
 1 file changed, 1 insertion(+)

--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -1475,6 +1475,7 @@ widget:
if (widget == NULL) {
dev_err(tplg->dev, "ASoC: failed to create widget %s 
controls\n",
w->name);
+   ret = -ENOMEM;
goto hdr_err;
}
 

[BUG] Integer overflow in sort() function

[Michał Wysoczański]

Hello,

There is possible integer overflow in kernel sort() function leading to page
fault. sort() function accepts number of items and item size as two 64-bit
arguments (size_t) but internal calculations are done using 32-bit integers:

void sort(void *base, size_t num, size_t size,
  int (*cmp_func)(const void *, const void *),
  void (*swap_func)(void *, void *, int size))
{
/* pre-scale counters for performance */
int i = (num/2 - 1) * size, n = num * size, c, r;

As these values are later used for iterations over buffer being sorted
and there is no checking for overflow some combinations of num
and size args will lead to page fault.
Here is sample code to reproduce this issue:

=
#include 
#include 
#include 

#define SORT_ITEMS_COUNT 16000

struct sort_item {
uint64_t buf[2];
};

static int sort_test_cmp(const void *a,
const void *b)
{
const struct sort_item *p1 = a;
const struct sort_item *p2 = b;
return p1->buf[0] > p2->buf[0] ? 1 : -1;
}

static void sort_test(void)
{
struct sort_item *items;

items = vmalloc(sizeof(*items) * SORT_ITEMS_COUNT);
if (!items)
return;
sort(items, SORT_ITEMS_COUNT, sizeof(*items),
sort_test_cmp, NULL);
vfree(items);
}

static int __init sorttest_init_module(void)
{
sort_test();
return 0;
}
module_init(sorttest_init_module);

static void __exit sorttest_exit_module(void)
{
}
module_exit(sorttest_exit_module);

MODULE_LICENSE("GPL");
=

And kernel BUG report:

[ 1668.230986] BUG: unable to handle kernel paging request at c8ffb8968ff0
[ 1668.240094] IP: [] sort_test_cmp+0x8/0x1c [sorttest]
[ 1668.248565] PGD 0 [ 1668.250620]
[ 1668.253415] Oops:  [#1] SMP
[ 1668.258019] Modules linked in: sorttest(OE+) xt_CHECKSUM
ipt_MASQUERADE nf_nat_masquerade_ipv4 tun nls_utf8 isofs loop
rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache ip6t_rpfilter
ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_conntrack
ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables
ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6
ip6table_mangle ip6table_security ip6table_raw ip6table_filter
ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4
nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw
iptable_filter dm_mirror dm_region_hash dm_log dm_mod sb_edac
edac_core x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm
irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel
aesni_intel iTCO_wdt lrw ipmi_devintf iTCO_vendor_support gf128mul
ipmi_ssif mei_me ioatdma glue_helper ablk_helper shpchp mei ipmi_si
i2c_i801 cryptd pcspkr ipmi_msghandler lpc_ich sg i2c_smbus wmi
mfd_core nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables ext4
jbd2 mbcache sd_mod mgag200 drm_kms_helper isci syscopyarea
sysfillrect sysimgblt fb_sys_fops ttm libsas igb drm ptp ahci libahci
scsi_transport_sas pps_core dca libata crc32c_intel i2c_algo_bit nvme
i2c_core nvme_core [last unloaded: sorttest]
[ 1668.394028] CPU: 23 PID: 6109 Comm: insmod Tainted: G   OEL
 4.9.0-rc2 #1
[ 1668.403491] Hardware name: Intel Corporation S2600CP/S2600CP, BIOS
SE5C600.86B.02.06.0002.101320150901 10/13/2015
[ 1668.416075] task: 88042a151600 task.stack: c90004b2c000
[ 1668.423814] RIP: 0010:[]  []
sort_test_cmp+0x8/0x1c [sorttest]
[ 1668.434980] RSP: 0018:c90004b2fc00  EFLAGS: 00010246
[ 1668.442059] RAX:  RBX: 98967ff0 RCX: 0010
[ 1668.451186] RDX: 98967ff0 RSI: c8ffb8968ff0 RDI: c9006c4b4ff0
[ 1668.460307] RBP: c90004b2fc70 R08: 4c4b3ff0 R09: 8163
[ 1668.469439] R10:  R11:  R12: c8ffb8968ff0
[ 1668.478564] R13: c9006c4b4ff0 R14: c90020001000 R15: 0010
[ 1668.487684] FS:  7f93cadc0740() GS:88042edc()
knlGS:
[ 1668.497876] CS:  0010 DS:  ES:  CR0: 80050033
[ 1668.505440] CR2: c8ffb8968ff0 CR3: 00042a467000 CR4: 000406e0
[ 1668.514563] Stack:
[ 1668.517955]  81363372 989686b02000 98967fe0ffe0
024002c22b110400
[ 1668.527424]  813632a0 98967ff0 98968000
00104c4b3ff0
[ 1668.536888]  a077a000 c90020001000 a0064000
c90004b2fe80
[ 1668.546353] Call Trace:
[ 1668.550246]  [] ? sort+0xa2/0x240
[ 1668.556865]  [] ? u64_swap+0x20/0x20
[ 1668.563769]  [] ? 0xa077a000
[ 1668.570664]  [] ? 0xa0064000
[ 1668.577551]  [] sorttest_init_module+0x33/0x1000 [sorttest]
[ 1668.586677]  [] do_one_initcall+0x50/0x190
[ 1668.594156]  [] ? kmem_cache_alloc_trace+0x14b/0x1b0
[ 1668.602605]  [] do_init_module+0x60/0x1f1
[ 1668.609985]  [] load_module+0x15ab/0x1aa0
[ 1668.617366]  [] ? __symbol_put+0x60/0x60
[ 1668.624647]  [] ? ima_post_read_file+0x3d/0x80
[ 1668.632511]  [] ? 

[PATCH 4.8 066/125] ASoC: sst-bxt-da7219_max98357a: fix obsoleted initializers for array

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Takashi Sakamoto 

commit 43d443dc257c00ef3a3f940b6abfb7537c4fcbe8 upstream.

Sparse reports below warnings.

bxt_da7219_max98357a.c:250:9: warning: obsolete array initializer, use C99 
syntax
bxt_da7219_max98357a.c:275:9: warning: obsolete array initializer, use C99 
syntax
bxt_da7219_max98357a.c:290:9: warning: obsolete array initializer, use C99 
syntax
bxt_da7219_max98357a.c:304:9: warning: obsolete array initializer, use C99 
syntax
bxt_da7219_max98357a.c:317:9: warning: obsolete array initializer, use C99 
syntax

There's no need to use obsoleted way. This commit fixes it.

Fixes: 723bad3fef8b (ASoC: Intel: Add Broxton-P Dialog Maxim machine driver)
Signed-off-by: Takashi Sakamoto 
Acked-by: Vinod Koul 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/soc/intel/boards/bxt_da7219_max98357a.c |   12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

--- a/sound/soc/intel/boards/bxt_da7219_max98357a.c
+++ b/sound/soc/intel/boards/bxt_da7219_max98357a.c
@@ -255,7 +255,7 @@ static struct snd_soc_ops broxton_da7219
 /* broxton digital audio interface glue - connects codec <--> CPU */
 static struct snd_soc_dai_link broxton_dais[] = {
/* Front End DAI links */
-   [BXT_DPCM_AUDIO_PB]
+   [BXT_DPCM_AUDIO_PB] =
{
.name = "Bxt Audio Port",
.stream_name = "Audio",
@@ -271,7 +271,7 @@ static struct snd_soc_dai_link broxton_d
.dpcm_playback = 1,
.ops = _da7219_fe_ops,
},
-   [BXT_DPCM_AUDIO_CP]
+   [BXT_DPCM_AUDIO_CP] =
{
.name = "Bxt Audio Capture Port",
.stream_name = "Audio Record",
@@ -286,7 +286,7 @@ static struct snd_soc_dai_link broxton_d
.dpcm_capture = 1,
.ops = _da7219_fe_ops,
},
-   [BXT_DPCM_AUDIO_REF_CP]
+   [BXT_DPCM_AUDIO_REF_CP] =
{
.name = "Bxt Audio Reference cap",
.stream_name = "Refcap",
@@ -300,7 +300,7 @@ static struct snd_soc_dai_link broxton_d
.nonatomic = 1,
.dynamic = 1,
},
-   [BXT_DPCM_AUDIO_HDMI1_PB]
+   [BXT_DPCM_AUDIO_HDMI1_PB] =
{
.name = "Bxt HDMI Port1",
.stream_name = "Hdmi1",
@@ -313,7 +313,7 @@ static struct snd_soc_dai_link broxton_d
.nonatomic = 1,
.dynamic = 1,
},
-   [BXT_DPCM_AUDIO_HDMI2_PB]
+   [BXT_DPCM_AUDIO_HDMI2_PB] =
{
.name = "Bxt HDMI Port2",
.stream_name = "Hdmi2",
@@ -326,7 +326,7 @@ static struct snd_soc_dai_link broxton_d
.nonatomic = 1,
.dynamic = 1,
},
-   [BXT_DPCM_AUDIO_HDMI3_PB]
+   [BXT_DPCM_AUDIO_HDMI3_PB] =
{
.name = "Bxt HDMI Port3",
.stream_name = "Hdmi3",

[PATCH] proc: make struct pid_entry::len unsigned

[Alexey Dobriyan]

"unsigned int" is better on x86_64 because it most of the time it
autoexpands to 64-bit value while "int" requires MOVSX instruction.

Signed-off-by: Alexey Dobriyan 
---

 fs/proc/base.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -106,7 +106,7 @@
 
 struct pid_entry {
const char *name;
-   int len;
+   unsigned int len;
umode_t mode;
const struct inode_operations *iop;
const struct file_operations *fop;

[PATCH 4.8 049/125] mwifiex: correct aid value during tdls setup

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Xinming Hu 

commit b64db1b252e9974a43a51ba083fa7d03e4716167 upstream.

AID gets updated during TDLS setup, but modified value isn't reflected
in "priv->assoc_rsp_buf". This causes TDLS setup failure. The problem is
fixed here.

Fixes: 4aff53ef18e4a4 ("mwifiex: parsing aid while receiving..")
Signed-off-by: Xinming Hu 
Signed-off-by: Amitkumar Karwar 
Signed-off-by: Kalle Valo 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/marvell/mwifiex/join.c |3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/net/wireless/marvell/mwifiex/join.c
+++ b/drivers/net/wireless/marvell/mwifiex/join.c
@@ -669,9 +669,8 @@ int mwifiex_ret_802_11_associate(struct
priv->assoc_rsp_size = min(le16_to_cpu(resp->size) - S_DS_GEN,
   sizeof(priv->assoc_rsp_buf));
 
-   memcpy(priv->assoc_rsp_buf, >params, priv->assoc_rsp_size);
-
assoc_rsp->a_id = cpu_to_le16(aid);
+   memcpy(priv->assoc_rsp_buf, >params, priv->assoc_rsp_size);
 
if (status_code) {
priv->adapter->dbg.num_cmd_assoc_failure++;

[PATCH 4.8 081/125] mm/hugetlb: improve locking in dissolve_free_huge_pages()

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Gerald Schaefer 

commit eb03aa008561004257900983193d024e57abdd96 upstream.

For every pfn aligned to minimum_order, dissolve_free_huge_pages() will
call dissolve_free_huge_page() which takes the hugetlb spinlock, even if
the page is not huge at all or a hugepage that is in-use.

Improve this by doing the PageHuge() and page_count() checks already in
dissolve_free_huge_pages() before calling dissolve_free_huge_page().  In
dissolve_free_huge_page(), when holding the spinlock, those checks need
to be revalidated.

Link: http://lkml.kernel.org/r/20160926172811.94033-4-gerald.schae...@de.ibm.com
Signed-off-by: Gerald Schaefer 
Acked-by: Michal Hocko 
Acked-by: Naoya Horiguchi 
Cc: "Kirill A . Shutemov" 
Cc: Vlastimil Babka 
Cc: Mike Kravetz 
Cc: "Aneesh Kumar K . V" 
Cc: Martin Schwidefsky 
Cc: Heiko Carstens 
Cc: Rui Teng 
Cc: Dave Hansen 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 mm/hugetlb.c |   12 +---
 1 file changed, 9 insertions(+), 3 deletions(-)

--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1476,14 +1476,20 @@ out:
 int dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
 {
unsigned long pfn;
+   struct page *page;
int rc = 0;
 
if (!hugepages_supported())
return rc;
 
-   for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order)
-   if (rc = dissolve_free_huge_page(pfn_to_page(pfn)))
-   break;
+   for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order) {
+   page = pfn_to_page(pfn);
+   if (PageHuge(page) && !page_count(page)) {
+   rc = dissolve_free_huge_page(page);
+   if (rc)
+   break;
+   }
+   }
 
return rc;
 }

[PATCH 4.8 079/125] dmaengine: ipu: remove bogus NO_IRQ reference

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Arnd Bergmann 

commit 86c7e6836479c4045a9a81ed5ea76c51d719f9c1 upstream.

A workaround for a warning introduced a use of the NO_IRQ
macro that should have been gone for a long time.

It is clear from the code that the value cannot actually
be used, but apparently there was a configuration at
some point that caused a warning, so instead of just
reverting that patch, this rearranges the code in a way that
the warning cannot reappear.

Signed-off-by: Arnd Bergmann 
Fixes: 6ef41cf6f721 ("dmaengine :ipu: change ipu_irq_handler() to remove 
compile warning")
Signed-off-by: Vinod Koul 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/dma/ipu/ipu_irq.c |9 -
 1 file changed, 4 insertions(+), 5 deletions(-)

--- a/drivers/dma/ipu/ipu_irq.c
+++ b/drivers/dma/ipu/ipu_irq.c
@@ -286,22 +286,21 @@ static void ipu_irq_handler(struct irq_d
raw_spin_unlock(_lock);
while ((line = ffs(status))) {
struct ipu_irq_map *map;
-   unsigned int irq = NO_IRQ;
+   unsigned int irq;
 
line--;
status &= ~(1UL << line);
 
raw_spin_lock(_lock);
map = src2map(32 * i + line);
-   if (map)
-   irq = map->irq;
-   raw_spin_unlock(_lock);
-
if (!map) {
+   raw_spin_unlock(_lock);
pr_err("IPU: Interrupt on unmapped source %u 
bank %d\n",
   line, i);
continue;
}
+   irq = map->irq;
+   raw_spin_unlock(_lock);
generic_handle_irq(irq);
}
}

[PATCH 4.8 048/125] i40e: fix broken i40e_config_rss_aq function

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Jacob Keller 

commit 776b2e15f8af7900409456292efd45af6de97172 upstream.

X722 hardware requires using the admin queue to configure RSS. This
function was previously re-written in commit e69ff813af35 ("i40e: rework
the functions to configure RSS with similar parameters").
However, the previous refactor did not work correctly for a few reasons

(a) it does not check whether seed is NULL before using it, resulting in
a NULL pointer dereference

[  402.954721] BUG: unable to handle kernel NULL pointer dereference at 
  (null)
[  402.955568] IP: [] 
i40e_config_rss_aq.constprop.65+0x2f/0x1c0 [i40e]
[  402.956402] PGD ad610067 PUD accc0067 PMD 0
[  402.957235] Oops:  [#1] SMP
[  402.958064] Modules linked in: ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 
xt_conntrack ip_set nfnetlink ebtable_filter ebtable_
broute bridge stp llc ebtable_nat ebtables ip6table_mangle ip6table_raw 
ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv
6 ip6table_security ip6table_filter ip6_tables iptable_mangle iptable_raw 
iptable_nat nf_conntrack_ipv4_ nf_defrag_ipv4_ nf_nat_ip
v4_ nf_nat nf_conntrack iptable_security intel_rapl i86_kg_temp_thermal 
coretemp kvm_intel kvm irqbypass crct10dif_clMl crc32_
pclMl ghash_clMlni_intel iTCO_wdt iTCO_vendor_support shpchp sb_edac dcdbas 
pcspkr joydev ipmi_devintf wmi edac_core ipmi_ssif
 acpi_ad acpi_ower_meter ipmi_si ipmi_msghandler mei_me nfsd lpc_ich mei 
ioatdma tpm_tis auth_rpcgss tpm nfs_acl lockd grace s
unrpc ifs nngag200 i2c_algo_bit drm_kms_helper ttm drm iigbe bnx2x i40e dca 
mdio ptp pps_core libcrc32c fjes crc32c_intel
[  402.965563] CPU: 22 PID: 2461 Conm: ethtool Not tainted 
4.6.0-rc7_1.2-ABNidQ+ #20
[  402.966719] Hardware name: Dell Inc. PowerEdge R720/0C4Y3R, BIOS 2.5.2 
01/28/2015
[  402.967862] task: 880219b51dc0 ti: 8800b3408000 task.ti: 
8800b3408000
[  402.969046] RIP: 0010:[]  [] 
i40e_config_rss_aq.constprop.65+0x2f/0x1c0 [i40e]
[  402.970339] RSP: 0018:8800b340ba90  EFLAGS: 00010246
[  402.971616] RAX:  RBX: 88042ec14000 RCX: 0200
[  402.972961] RDX: 880428eb9200 RSI:  RDI: 88042ec14000
[  402.974312] RBP: 8800b340baf8 R08: 880237ada8f0 R09: 880428eb9200
[  402.975709] R10: 880428eb9200 R11:  R12: 88042ec2e000
[  402.977104] R13: 88042ec2e000 R14: 88042ec14000 R15: 88022ea00800
[  402.978541] FS:  7f84fd054700() GS:880237ac() 
knlGS:
[  402.980003] CS:  0010 DS:  ES:  CR0: 80050033
[  402.981508] CR2:  CR3: 3289e000 CR4: 000406e0
[  402.983028] Stack:
[  402.984578]  02000200  88023ffeda68 
88023ffef000
[  402.986187]  0268 8800b340bbf8 88023ffedd80 
88ce4f1d
[  402.987844]  88042ec14000 88022ea00800 88042ec2e000 
88042ec14000
[  402.989509] Call Trace:
[  402.991200]  [] i40e_config_rss+0x11f/0x1c0 [i40e]
[  402.992924]  [] i40e_set_rifh+0ic0/0x130 [i40e]
[  402.994684]  [] ethtool_set_rifh+0x1f7/0x300
[  402.996446]  [] ? cred_has_capability+0io6b/0x100
[  402.998203]  [] ? selinux_capable+0x12/0x20
[  402.68]  [] ? security_capable+0x4b/0x70
[  403.001707]  [] dev_ethtool+0x1423/0x2290
[  403.003461]  [] dev_ioctl+0x191/0io630
[  403.005186]  [] ? lru_cache_add+0x3a/0i80
[  403.006942]  [] ? _raw_spin_unlock+0ie/0x20
[  403.008691]  [] sock_do_ioctl+0x45/0i50
[  403.010421]  [] sock_ioctl+0x209/0x2d0
[  403.012173]  [] do_vfs_ioctl+0u4/0io6c0
[  403.013911]  [] SyS_ioctl+0x79/0x90
[  403.015710]  [] entry_SYSCALL_64_fastpath+0x1a/0u4
[  403.017500] Code: 90 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 89 fb 48 83 
ec 40 4c 8b a7 e0 05 00 00 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 <48> 8b 
06 41 0f b7 bc 24 f2 0f 00 00 48 89 45 9c 48 8b 46 08 48
[  403.021454] RIP  [] 
i40e_config_rss_aq.constprop.65+0x2f/0x1c0 [i40e]
[  403.023395]  RSP 
[  403.025271] CR2: 
[  403.027169] ---[ end trace 64561b528cf61cf0 ]---

(b) it does not even bother to use the passed in *lut parameter which
defines the requested lookup table. Instead it uses its own round robin
table.

Fix these issues by re-writing it to be similar to i40e_config_rss_reg
and i40e_get_rss_aq.

Fixes: e69ff813af35 ("i40e: rework the functions to configure RSS with similar 
parameters", 2015-10-21)
Signed-off-by: Jacob Keller 
Tested-by: Andrew Bowers 
Signed-off-by: Jeff Kirsher 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/ethernet/intel/i40e/i40e_main.c |   57 +++-
 1 file changed, 23 insertions(+), 34 deletions(-)

--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -7990,45 +7990,34 @@ static int i40e_setup_misc_vector(struct
 static int i40e_config_rss_aq(struct i40e_vsi *vsi, const u8 *seed,
  

[PATCH 4.8 041/125] scsi: cxlflash: Remove the device cleanly in the system shutdown path

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Uma Krishnan 

commit babf985d1e1b0677cb264acd01319d2b9c8f4327 upstream.

Commit 704c4b0ddc03 ("cxlflash: Shutdown notify support for CXL Flash
cards") was recently introduced to notify the AFU when a system is going
down. Due to the position of the cxlflash driver in the device stack,
cxlflash devices are _always_ removed during a reboot/shutdown. This can
lead to a crash if the cxlflash shutdown hook is invoked _after_ the
shutdown hook for the owning virtual PHB. Furthermore, the current
implementation of shutdown/remove hooks for cxlflash are not tolerant to
being invoked when the device is not enabled. This can also lead to a
crash in situations where the remove hook is invoked after the device
has been removed via the vPHBs shutdown hook. An example of this
scenario would be an EEH reset failure while a reboot/shutdown is in
progress.

To solve both problems, the shutdown hook for cxlflash is updated to
simply remove the device. This path already includes the AFU
notification and thus this solution will continue to perform the
original intent. At the same time, the remove hook is updated to protect
against being called when the device is not enabled.

Fixes: 704c4b0ddc03 ("cxlflash: Shutdown notify support for CXL Flash
cards")
Signed-off-by: Uma Krishnan 
Acked-by: Matthew R. Ochs 
Signed-off-by: Martin K. Petersen 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/scsi/cxlflash/main.c |   18 ++
 1 file changed, 6 insertions(+), 12 deletions(-)

--- a/drivers/scsi/cxlflash/main.c
+++ b/drivers/scsi/cxlflash/main.c
@@ -823,17 +823,6 @@ static void notify_shutdown(struct cxlfl
 }
 
 /**
- * cxlflash_shutdown() - shutdown handler
- * @pdev:  PCI device associated with the host.
- */
-static void cxlflash_shutdown(struct pci_dev *pdev)
-{
-   struct cxlflash_cfg *cfg = pci_get_drvdata(pdev);
-
-   notify_shutdown(cfg, false);
-}
-
-/**
  * cxlflash_remove() - PCI entry point to tear down host
  * @pdev:  PCI device associated with the host.
  *
@@ -844,6 +833,11 @@ static void cxlflash_remove(struct pci_d
struct cxlflash_cfg *cfg = pci_get_drvdata(pdev);
ulong lock_flags;
 
+   if (!pci_is_enabled(pdev)) {
+   pr_debug("%s: Device is disabled\n", __func__);
+   return;
+   }
+
/* If a Task Management Function is active, wait for it to complete
 * before continuing with remove.
 */
@@ -2685,7 +2679,7 @@ static struct pci_driver cxlflash_driver
.id_table = cxlflash_pci_table,
.probe = cxlflash_probe,
.remove = cxlflash_remove,
-   .shutdown = cxlflash_shutdown,
+   .shutdown = cxlflash_remove,
.err_handler = _err_handler,
 };
 

[PATCH 4.8 065/125] ASoC: sst-bxt-rt298: fix obsoleted initializers for array

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Takashi Sakamoto 

commit 5919a3898136aae4d2cb4b18b44f70f7b185aa47 upstream.

Sparse reports below warnings.

bxt_rt298.c:275:9: warning: obsolete array initializer, use C99 syntax
bxt_rt298.c:290:9: warning: obsolete array initializer, use C99 syntax
bxt_rt298.c:304:9: warning: obsolete array initializer, use C99 syntax
bxt_rt298.c:317:9: warning: obsolete array initializer, use C99 syntax
bxt_rt298.c:331:9: warning: obsolete array initializer, use C99 syntax
bxt_rt298.c:344:9: warning: obsolete array initializer, use C99 syntax
bxt_rt298.c:357:9: warning: obsolete array initializer, use C99 syntax

There's no need to use obsoleted way. This commit fixes it.

Fixes: 76016322ec56 (ASoC: Intel: Add Broxton-P machine driver)
Signed-off-by: Takashi Sakamoto 
Acked-by: Vinod Koul 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/soc/intel/boards/bxt_rt298.c |   14 +++---
 1 file changed, 7 insertions(+), 7 deletions(-)

--- a/sound/soc/intel/boards/bxt_rt298.c
+++ b/sound/soc/intel/boards/bxt_rt298.c
@@ -271,7 +271,7 @@ static const struct snd_soc_ops broxton_
 /* broxton digital audio interface glue - connects codec <--> CPU */
 static struct snd_soc_dai_link broxton_rt298_dais[] = {
/* Front End DAI links */
-   [BXT_DPCM_AUDIO_PB]
+   [BXT_DPCM_AUDIO_PB] =
{
.name = "Bxt Audio Port",
.stream_name = "Audio",
@@ -286,7 +286,7 @@ static struct snd_soc_dai_link broxton_r
.dpcm_playback = 1,
.ops = _rt286_fe_ops,
},
-   [BXT_DPCM_AUDIO_CP]
+   [BXT_DPCM_AUDIO_CP] =
{
.name = "Bxt Audio Capture Port",
.stream_name = "Audio Record",
@@ -300,7 +300,7 @@ static struct snd_soc_dai_link broxton_r
.dpcm_capture = 1,
.ops = _rt286_fe_ops,
},
-   [BXT_DPCM_AUDIO_REF_CP]
+   [BXT_DPCM_AUDIO_REF_CP] =
{
.name = "Bxt Audio Reference cap",
.stream_name = "refcap",
@@ -313,7 +313,7 @@ static struct snd_soc_dai_link broxton_r
.nonatomic = 1,
.dynamic = 1,
},
-   [BXT_DPCM_AUDIO_DMIC_CP]
+   [BXT_DPCM_AUDIO_DMIC_CP] =
{
.name = "Bxt Audio DMIC cap",
.stream_name = "dmiccap",
@@ -327,7 +327,7 @@ static struct snd_soc_dai_link broxton_r
.dynamic = 1,
.ops = _dmic_ops,
},
-   [BXT_DPCM_AUDIO_HDMI1_PB]
+   [BXT_DPCM_AUDIO_HDMI1_PB] =
{
.name = "Bxt HDMI Port1",
.stream_name = "Hdmi1",
@@ -340,7 +340,7 @@ static struct snd_soc_dai_link broxton_r
.nonatomic = 1,
.dynamic = 1,
},
-   [BXT_DPCM_AUDIO_HDMI2_PB]
+   [BXT_DPCM_AUDIO_HDMI2_PB] =
{
.name = "Bxt HDMI Port2",
.stream_name = "Hdmi2",
@@ -353,7 +353,7 @@ static struct snd_soc_dai_link broxton_r
.nonatomic = 1,
.dynamic = 1,
},
-   [BXT_DPCM_AUDIO_HDMI3_PB]
+   [BXT_DPCM_AUDIO_HDMI3_PB] =
{
.name = "Bxt HDMI Port3",
.stream_name = "Hdmi3",

[PATCH 4.8 076/125] IB/qib: Remove qpt_mask global

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Dennis Dalessandro 

commit 84b3adc2430eafd2eb703570075c3c141ea0ff13 upstream.

There is no need to have a global qpt_mask as that does not support the
multiple chip model which qib has. Instead rely on the value which
exists already in the device data (dd).

Fixes: 898fa52b4ac3 "IB/qib: Remove qpn, qp tables and related variables from 
qib"
Reviewed-by: Mike Marciniszyn 
Signed-off-by: Dennis Dalessandro 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/infiniband/hw/qib/qib.h   |1 -
 drivers/infiniband/hw/qib/qib_qp.c|   13 +++--
 drivers/infiniband/hw/qib/qib_verbs.c |2 --
 3 files changed, 3 insertions(+), 13 deletions(-)

--- a/drivers/infiniband/hw/qib/qib.h
+++ b/drivers/infiniband/hw/qib/qib.h
@@ -1131,7 +1131,6 @@ extern spinlock_t qib_devs_lock;
 extern struct qib_devdata *qib_lookup(int unit);
 extern u32 qib_cpulist_count;
 extern unsigned long *qib_cpulist;
-extern u16 qpt_mask;
 extern unsigned qib_cc_table_size;
 
 int qib_init(struct qib_devdata *, int);
--- a/drivers/infiniband/hw/qib/qib_qp.c
+++ b/drivers/infiniband/hw/qib/qib_qp.c
@@ -41,14 +41,6 @@
 
 #include "qib.h"
 
-/*
- * mask field which was present in now deleted qib_qpn_table
- * is not present in rvt_qpn_table. Defining the same field
- * as qpt_mask here instead of adding the mask field to
- * rvt_qpn_table.
- */
-u16 qpt_mask;
-
 static inline unsigned mk_qpn(struct rvt_qpn_table *qpt,
  struct rvt_qpn_map *map, unsigned off)
 {
@@ -57,7 +49,7 @@ static inline unsigned mk_qpn(struct rvt
 
 static inline unsigned find_next_offset(struct rvt_qpn_table *qpt,
struct rvt_qpn_map *map, unsigned off,
-   unsigned n)
+   unsigned n, u16 qpt_mask)
 {
if (qpt_mask) {
off++;
@@ -179,6 +171,7 @@ int qib_alloc_qpn(struct rvt_dev_info *r
struct qib_ibdev *verbs_dev = container_of(rdi, struct qib_ibdev, rdi);
struct qib_devdata *dd = container_of(verbs_dev, struct qib_devdata,
  verbs_dev);
+   u16 qpt_mask = dd->qpn_mask;
 
if (type == IB_QPT_SMI || type == IB_QPT_GSI) {
unsigned n;
@@ -215,7 +208,7 @@ int qib_alloc_qpn(struct rvt_dev_info *r
goto bail;
}
offset = find_next_offset(qpt, map, offset,
-   dd->n_krcv_queues);
+   dd->n_krcv_queues, qpt_mask);
qpn = mk_qpn(qpt, map, offset);
/*
 * This test differs from alloc_pidmap().
--- a/drivers/infiniband/hw/qib/qib_verbs.c
+++ b/drivers/infiniband/hw/qib/qib_verbs.c
@@ -1606,8 +1606,6 @@ int qib_register_ib_device(struct qib_de
/* Only need to initialize non-zero fields. */
setup_timer(>mem_timer, mem_timer, (unsigned long)dev);
 
-   qpt_mask = dd->qpn_mask;
-
INIT_LIST_HEAD(>piowait);
INIT_LIST_HEAD(>dmawait);
INIT_LIST_HEAD(>txwait);

[PATCH 4.8 076/125] IB/qib: Remove qpt_mask global

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Dennis Dalessandro 

commit 84b3adc2430eafd2eb703570075c3c141ea0ff13 upstream.

There is no need to have a global qpt_mask as that does not support the
multiple chip model which qib has. Instead rely on the value which
exists already in the device data (dd).

Fixes: 898fa52b4ac3 "IB/qib: Remove qpn, qp tables and related variables from 
qib"
Reviewed-by: Mike Marciniszyn 
Signed-off-by: Dennis Dalessandro 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/infiniband/hw/qib/qib.h   |1 -
 drivers/infiniband/hw/qib/qib_qp.c|   13 +++--
 drivers/infiniband/hw/qib/qib_verbs.c |2 --
 3 files changed, 3 insertions(+), 13 deletions(-)

--- a/drivers/infiniband/hw/qib/qib.h
+++ b/drivers/infiniband/hw/qib/qib.h
@@ -1131,7 +1131,6 @@ extern spinlock_t qib_devs_lock;
 extern struct qib_devdata *qib_lookup(int unit);
 extern u32 qib_cpulist_count;
 extern unsigned long *qib_cpulist;
-extern u16 qpt_mask;
 extern unsigned qib_cc_table_size;
 
 int qib_init(struct qib_devdata *, int);
--- a/drivers/infiniband/hw/qib/qib_qp.c
+++ b/drivers/infiniband/hw/qib/qib_qp.c
@@ -41,14 +41,6 @@
 
 #include "qib.h"
 
-/*
- * mask field which was present in now deleted qib_qpn_table
- * is not present in rvt_qpn_table. Defining the same field
- * as qpt_mask here instead of adding the mask field to
- * rvt_qpn_table.
- */
-u16 qpt_mask;
-
 static inline unsigned mk_qpn(struct rvt_qpn_table *qpt,
  struct rvt_qpn_map *map, unsigned off)
 {
@@ -57,7 +49,7 @@ static inline unsigned mk_qpn(struct rvt
 
 static inline unsigned find_next_offset(struct rvt_qpn_table *qpt,
struct rvt_qpn_map *map, unsigned off,
-   unsigned n)
+   unsigned n, u16 qpt_mask)
 {
if (qpt_mask) {
off++;
@@ -179,6 +171,7 @@ int qib_alloc_qpn(struct rvt_dev_info *r
struct qib_ibdev *verbs_dev = container_of(rdi, struct qib_ibdev, rdi);
struct qib_devdata *dd = container_of(verbs_dev, struct qib_devdata,
  verbs_dev);
+   u16 qpt_mask = dd->qpn_mask;
 
if (type == IB_QPT_SMI || type == IB_QPT_GSI) {
unsigned n;
@@ -215,7 +208,7 @@ int qib_alloc_qpn(struct rvt_dev_info *r
goto bail;
}
offset = find_next_offset(qpt, map, offset,
-   dd->n_krcv_queues);
+   dd->n_krcv_queues, qpt_mask);
qpn = mk_qpn(qpt, map, offset);
/*
 * This test differs from alloc_pidmap().
--- a/drivers/infiniband/hw/qib/qib_verbs.c
+++ b/drivers/infiniband/hw/qib/qib_verbs.c
@@ -1606,8 +1606,6 @@ int qib_register_ib_device(struct qib_de
/* Only need to initialize non-zero fields. */
setup_timer(>mem_timer, mem_timer, (unsigned long)dev);
 
-   qpt_mask = dd->qpn_mask;
-
INIT_LIST_HEAD(>piowait);
INIT_LIST_HEAD(>dmawait);
INIT_LIST_HEAD(>txwait);

[PATCH 4.8 065/125] ASoC: sst-bxt-rt298: fix obsoleted initializers for array

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Takashi Sakamoto 

commit 5919a3898136aae4d2cb4b18b44f70f7b185aa47 upstream.

Sparse reports below warnings.

bxt_rt298.c:275:9: warning: obsolete array initializer, use C99 syntax
bxt_rt298.c:290:9: warning: obsolete array initializer, use C99 syntax
bxt_rt298.c:304:9: warning: obsolete array initializer, use C99 syntax
bxt_rt298.c:317:9: warning: obsolete array initializer, use C99 syntax
bxt_rt298.c:331:9: warning: obsolete array initializer, use C99 syntax
bxt_rt298.c:344:9: warning: obsolete array initializer, use C99 syntax
bxt_rt298.c:357:9: warning: obsolete array initializer, use C99 syntax

There's no need to use obsoleted way. This commit fixes it.

Fixes: 76016322ec56 (ASoC: Intel: Add Broxton-P machine driver)
Signed-off-by: Takashi Sakamoto 
Acked-by: Vinod Koul 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman 

---
 sound/soc/intel/boards/bxt_rt298.c |   14 +++---
 1 file changed, 7 insertions(+), 7 deletions(-)

--- a/sound/soc/intel/boards/bxt_rt298.c
+++ b/sound/soc/intel/boards/bxt_rt298.c
@@ -271,7 +271,7 @@ static const struct snd_soc_ops broxton_
 /* broxton digital audio interface glue - connects codec <--> CPU */
 static struct snd_soc_dai_link broxton_rt298_dais[] = {
/* Front End DAI links */
-   [BXT_DPCM_AUDIO_PB]
+   [BXT_DPCM_AUDIO_PB] =
{
.name = "Bxt Audio Port",
.stream_name = "Audio",
@@ -286,7 +286,7 @@ static struct snd_soc_dai_link broxton_r
.dpcm_playback = 1,
.ops = _rt286_fe_ops,
},
-   [BXT_DPCM_AUDIO_CP]
+   [BXT_DPCM_AUDIO_CP] =
{
.name = "Bxt Audio Capture Port",
.stream_name = "Audio Record",
@@ -300,7 +300,7 @@ static struct snd_soc_dai_link broxton_r
.dpcm_capture = 1,
.ops = _rt286_fe_ops,
},
-   [BXT_DPCM_AUDIO_REF_CP]
+   [BXT_DPCM_AUDIO_REF_CP] =
{
.name = "Bxt Audio Reference cap",
.stream_name = "refcap",
@@ -313,7 +313,7 @@ static struct snd_soc_dai_link broxton_r
.nonatomic = 1,
.dynamic = 1,
},
-   [BXT_DPCM_AUDIO_DMIC_CP]
+   [BXT_DPCM_AUDIO_DMIC_CP] =
{
.name = "Bxt Audio DMIC cap",
.stream_name = "dmiccap",
@@ -327,7 +327,7 @@ static struct snd_soc_dai_link broxton_r
.dynamic = 1,
.ops = _dmic_ops,
},
-   [BXT_DPCM_AUDIO_HDMI1_PB]
+   [BXT_DPCM_AUDIO_HDMI1_PB] =
{
.name = "Bxt HDMI Port1",
.stream_name = "Hdmi1",
@@ -340,7 +340,7 @@ static struct snd_soc_dai_link broxton_r
.nonatomic = 1,
.dynamic = 1,
},
-   [BXT_DPCM_AUDIO_HDMI2_PB]
+   [BXT_DPCM_AUDIO_HDMI2_PB] =
{
.name = "Bxt HDMI Port2",
.stream_name = "Hdmi2",
@@ -353,7 +353,7 @@ static struct snd_soc_dai_link broxton_r
.nonatomic = 1,
.dynamic = 1,
},
-   [BXT_DPCM_AUDIO_HDMI3_PB]
+   [BXT_DPCM_AUDIO_HDMI3_PB] =
{
.name = "Bxt HDMI Port3",
.stream_name = "Hdmi3",

[PATCH 4.8 080/125] mm/hugetlb: check for reserved hugepages during memory offline

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Gerald Schaefer 

commit 082d5b6b60e9f25e1511557fcfcb21eedd267446 upstream.

In dissolve_free_huge_pages(), free hugepages will be dissolved without
making sure that there are enough of them left to satisfy hugepage
reservations.

Fix this by adding a return value to dissolve_free_huge_pages() and
checking h->free_huge_pages vs.  h->resv_huge_pages.  Note that this may
lead to the situation where dissolve_free_huge_page() returns an error
and all free hugepages that were dissolved before that error are lost,
while the memory block still cannot be set offline.

Fixes: c8721bbb ("mm: memory-hotplug: enable memory hotplug to handle hugepage")
Link: http://lkml.kernel.org/r/20160926172811.94033-3-gerald.schae...@de.ibm.com
Signed-off-by: Gerald Schaefer 
Acked-by: Michal Hocko 
Acked-by: Naoya Horiguchi 
Cc: "Kirill A . Shutemov" 
Cc: Vlastimil Babka 
Cc: Mike Kravetz 
Cc: "Aneesh Kumar K . V" 
Cc: Martin Schwidefsky 
Cc: Heiko Carstens 
Cc: Rui Teng 
Cc: Dave Hansen 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 include/linux/hugetlb.h |6 +++---
 mm/hugetlb.c|   26 +-
 mm/memory_hotplug.c |4 +++-
 3 files changed, 27 insertions(+), 9 deletions(-)

--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -450,8 +450,8 @@ static inline pgoff_t basepage_index(str
return __basepage_index(page);
 }
 
-extern void dissolve_free_huge_pages(unsigned long start_pfn,
-unsigned long end_pfn);
+extern int dissolve_free_huge_pages(unsigned long start_pfn,
+   unsigned long end_pfn);
 static inline bool hugepage_migration_supported(struct hstate *h)
 {
 #ifdef CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION
@@ -518,7 +518,7 @@ static inline pgoff_t basepage_index(str
 {
return page->index;
 }
-#define dissolve_free_huge_pages(s, e) do {} while (0)
+#define dissolve_free_huge_pages(s, e) 0
 #define hugepage_migration_supported(h)false
 
 static inline spinlock_t *huge_pte_lockptr(struct hstate *h,
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1437,22 +1437,32 @@ static int free_pool_huge_page(struct hs
 
 /*
  * Dissolve a given free hugepage into free buddy pages. This function does
- * nothing for in-use (including surplus) hugepages.
+ * nothing for in-use (including surplus) hugepages. Returns -EBUSY if the
+ * number of free hugepages would be reduced below the number of reserved
+ * hugepages.
  */
-static void dissolve_free_huge_page(struct page *page)
+static int dissolve_free_huge_page(struct page *page)
 {
+   int rc = 0;
+
spin_lock(_lock);
if (PageHuge(page) && !page_count(page)) {
struct page *head = compound_head(page);
struct hstate *h = page_hstate(head);
int nid = page_to_nid(head);
+   if (h->free_huge_pages - h->resv_huge_pages == 0) {
+   rc = -EBUSY;
+   goto out;
+   }
list_del(>lru);
h->free_huge_pages--;
h->free_huge_pages_node[nid]--;
h->max_huge_pages--;
update_and_free_page(h, head);
}
+out:
spin_unlock(_lock);
+   return rc;
 }
 
 /*
@@ -1460,16 +1470,22 @@ static void dissolve_free_huge_page(stru
  * make specified memory blocks removable from the system.
  * Note that this will dissolve a free gigantic hugepage completely, if any
  * part of it lies within the given range.
+ * Also note that if dissolve_free_huge_page() returns with an error, all
+ * free hugepages that were dissolved before that error are lost.
  */
-void dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
+int dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
 {
unsigned long pfn;
+   int rc = 0;
 
if (!hugepages_supported())
-   return;
+   return rc;
 
for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order)
-   dissolve_free_huge_page(pfn_to_page(pfn));
+   if (rc = dissolve_free_huge_page(pfn_to_page(pfn)))
+   break;
+
+   return rc;
 }
 
 /*
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1945,7 +1945,9 @@ repeat:
 * dissolve free hugepages in the memory block before doing offlining
 * actually in order to make hugetlbfs's object counting 

[PATCH 4.8 080/125] mm/hugetlb: check for reserved hugepages during memory offline

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Gerald Schaefer 

commit 082d5b6b60e9f25e1511557fcfcb21eedd267446 upstream.

In dissolve_free_huge_pages(), free hugepages will be dissolved without
making sure that there are enough of them left to satisfy hugepage
reservations.

Fix this by adding a return value to dissolve_free_huge_pages() and
checking h->free_huge_pages vs.  h->resv_huge_pages.  Note that this may
lead to the situation where dissolve_free_huge_page() returns an error
and all free hugepages that were dissolved before that error are lost,
while the memory block still cannot be set offline.

Fixes: c8721bbb ("mm: memory-hotplug: enable memory hotplug to handle hugepage")
Link: http://lkml.kernel.org/r/20160926172811.94033-3-gerald.schae...@de.ibm.com
Signed-off-by: Gerald Schaefer 
Acked-by: Michal Hocko 
Acked-by: Naoya Horiguchi 
Cc: "Kirill A . Shutemov" 
Cc: Vlastimil Babka 
Cc: Mike Kravetz 
Cc: "Aneesh Kumar K . V" 
Cc: Martin Schwidefsky 
Cc: Heiko Carstens 
Cc: Rui Teng 
Cc: Dave Hansen 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 

---
 include/linux/hugetlb.h |6 +++---
 mm/hugetlb.c|   26 +-
 mm/memory_hotplug.c |4 +++-
 3 files changed, 27 insertions(+), 9 deletions(-)

--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -450,8 +450,8 @@ static inline pgoff_t basepage_index(str
return __basepage_index(page);
 }
 
-extern void dissolve_free_huge_pages(unsigned long start_pfn,
-unsigned long end_pfn);
+extern int dissolve_free_huge_pages(unsigned long start_pfn,
+   unsigned long end_pfn);
 static inline bool hugepage_migration_supported(struct hstate *h)
 {
 #ifdef CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION
@@ -518,7 +518,7 @@ static inline pgoff_t basepage_index(str
 {
return page->index;
 }
-#define dissolve_free_huge_pages(s, e) do {} while (0)
+#define dissolve_free_huge_pages(s, e) 0
 #define hugepage_migration_supported(h)false
 
 static inline spinlock_t *huge_pte_lockptr(struct hstate *h,
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1437,22 +1437,32 @@ static int free_pool_huge_page(struct hs
 
 /*
  * Dissolve a given free hugepage into free buddy pages. This function does
- * nothing for in-use (including surplus) hugepages.
+ * nothing for in-use (including surplus) hugepages. Returns -EBUSY if the
+ * number of free hugepages would be reduced below the number of reserved
+ * hugepages.
  */
-static void dissolve_free_huge_page(struct page *page)
+static int dissolve_free_huge_page(struct page *page)
 {
+   int rc = 0;
+
spin_lock(_lock);
if (PageHuge(page) && !page_count(page)) {
struct page *head = compound_head(page);
struct hstate *h = page_hstate(head);
int nid = page_to_nid(head);
+   if (h->free_huge_pages - h->resv_huge_pages == 0) {
+   rc = -EBUSY;
+   goto out;
+   }
list_del(>lru);
h->free_huge_pages--;
h->free_huge_pages_node[nid]--;
h->max_huge_pages--;
update_and_free_page(h, head);
}
+out:
spin_unlock(_lock);
+   return rc;
 }
 
 /*
@@ -1460,16 +1470,22 @@ static void dissolve_free_huge_page(stru
  * make specified memory blocks removable from the system.
  * Note that this will dissolve a free gigantic hugepage completely, if any
  * part of it lies within the given range.
+ * Also note that if dissolve_free_huge_page() returns with an error, all
+ * free hugepages that were dissolved before that error are lost.
  */
-void dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
+int dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
 {
unsigned long pfn;
+   int rc = 0;
 
if (!hugepages_supported())
-   return;
+   return rc;
 
for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order)
-   dissolve_free_huge_page(pfn_to_page(pfn));
+   if (rc = dissolve_free_huge_page(pfn_to_page(pfn)))
+   break;
+
+   return rc;
 }
 
 /*
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1945,7 +1945,9 @@ repeat:
 * dissolve free hugepages in the memory block before doing offlining
 * actually in order to make hugetlbfs's object counting consistent.
 */
-   dissolve_free_huge_pages(start_pfn, end_pfn);
+   ret = dissolve_free_huge_pages(start_pfn, end_pfn);
+   if (ret)
+   goto failed_removal;
/* check again */
offlined_pages = check_pages_isolated(start_pfn, end_pfn);
if (offlined_pages < 0) {

[PATCH 4.8 092/125] clk: divider: Fix clk_divider_round_rate() to use clk_readl()

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Geert Uytterhoeven 

commit 2cf9a57811bddb6fa6b0f8d7376da164d5534813 upstream.

clk-divider uses clk_readl()/clk_writel() everywhere, except in
clk_divider_round_rate(), where plain readl() is used. Change this to
clk_readl(), as it makes a difference on powerpc.

Fixes: e6d5e7d90be92cee ("clk-divider: Fix READ_ONLY when divider > 1")
Signed-off-by: Geert Uytterhoeven 
Reviewed-by: James Hogan 
Signed-off-by: Stephen Boyd 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/clk/clk-divider.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/clk/clk-divider.c
+++ b/drivers/clk/clk-divider.c
@@ -352,7 +352,7 @@ static long clk_divider_round_rate(struc
 
/* if read only, just return current value */
if (divider->flags & CLK_DIVIDER_READ_ONLY) {
-   bestdiv = readl(divider->reg) >> divider->shift;
+   bestdiv = clk_readl(divider->reg) >> divider->shift;
bestdiv &= div_mask(divider->width);
bestdiv = _get_div(divider->table, bestdiv, divider->flags,
divider->width);

[PATCH 4.8 093/125] perf data: Fix building in 32 bit platform with libbabeltrace

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Wang Nan 

commit f2c8852e6e990fcab0d9e68de9d86e5fbea0b5dc upstream.

On ARM32 building it report following error when we build with
libbabeltrace:

  util/data-convert-bt.c: In function 'add_bpf_output_values':
  util/data-convert-bt.c:440:3: error: format '%lu' expects argument of type 
'long unsigned int', but argument 5 has type 'unsigned int' [-Werror=format]
  cc1: all warnings being treated as errors

Fix it by changing %lu to %zu.

Signed-off-by: Wang Nan 
Cc: Jiri Olsa 
Cc: Zefan Li 
Cc: pi3or...@163.com
Fixes: 6122d57e9f7c ("perf data: Support converting data from 
bpf_perf_event_output()")
Link: 
http://lkml.kernel.org/r/1475035126-146587-1-git-send-email-wangn...@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Greg Kroah-Hartman 

---
 tools/perf/util/data-convert-bt.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/tools/perf/util/data-convert-bt.c
+++ b/tools/perf/util/data-convert-bt.c
@@ -437,7 +437,7 @@ add_bpf_output_values(struct bt_ctf_even
int ret;
 
if (nr_elements * sizeof(u32) != raw_size)
-   pr_warning("Incorrect raw_size (%u) in bpf output event, skip 
%lu bytes\n",
+   pr_warning("Incorrect raw_size (%u) in bpf output event, skip 
%zu bytes\n",
   raw_size, nr_elements * sizeof(u32) - raw_size);
 
len_type = bt_ctf_event_class_get_field_by_name(event_class, "raw_len");

[PATCH 4.8 095/125] perf powerpc: Fix build-test failure

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Ravi Bangoria 

commit 25b8592e912f085ce2ff736a2927584ddeab238c upstream.

'make -C tools/perf build-test' is failing with below log for poewrpc.

  In file included from 
/tmp/tmp.3eEwmGlYaF/perf-4.8.0-rc4/tools/perf/perf.h:15:0,
   from util/cpumap.h:8,
   from util/env.c:1:
  /tmp/tmp.3eEwmGlYaF/perf-4.8.0-rc4/tools/perf/perf-sys.h:23:56:
  fatal error: ../../arch/powerpc/include/uapi/asm/unistd.h: No such file or 
directory
  compilation terminated.

I bisected it and found it's failing from commit ad430729ae00 ("Remove:
kernel unistd*h files from perf's MANIFEST, not used").

Header file '../../arch/powerpc/include/uapi/asm/unistd.h' is included
only for powerpc in tools/perf/perf-sys.h.

By looking closly at commit history, I found little weird thing:

Commit f2d9cae9ea9e ("perf powerpc: Use uapi/unistd.h to fix build
error") replaced 'asm/unistd.h' with 'uapi/asm/unistd.h'

Commit d2709c7ce4c5 ("perf: Make perf build for x86 with UAPI
disintegration applied") removes all arch specific 'uapi/asm/unistd.h'
for all archs and adds generic .

Commit f0b9abfb0446 ("Merge branch 'linus' into perf/core") again
includes 'uapi/asm/unistd.h' for powerpc. Don't know how exactly this
happened as this change is not part of commit also.

Signed-off-by: Ravi Bangoria 
Cc: Alexander Shishkin 
Cc: Peter Zijlstra 
Link: 
http://lkml.kernel.org/r/1472630591-5089-1-git-send-email-ravi.bango...@linux.vnet.ibm.com
Fixes: ad430729ae00 ("Remove: kernel unistd*h files from perf's MANIFEST, not 
used")
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Greg Kroah-Hartman 

---
 tools/perf/perf-sys.h |1 -
 1 file changed, 1 deletion(-)

--- a/tools/perf/perf-sys.h
+++ b/tools/perf/perf-sys.h
@@ -20,7 +20,6 @@
 #endif
 
 #ifdef __powerpc__
-#include "../../arch/powerpc/include/uapi/asm/unistd.h"
 #define CPUINFO_PROC   {"cpu"}
 #endif
 

[PATCH 4.8 092/125] clk: divider: Fix clk_divider_round_rate() to use clk_readl()

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Geert Uytterhoeven 

commit 2cf9a57811bddb6fa6b0f8d7376da164d5534813 upstream.

clk-divider uses clk_readl()/clk_writel() everywhere, except in
clk_divider_round_rate(), where plain readl() is used. Change this to
clk_readl(), as it makes a difference on powerpc.

Fixes: e6d5e7d90be92cee ("clk-divider: Fix READ_ONLY when divider > 1")
Signed-off-by: Geert Uytterhoeven 
Reviewed-by: James Hogan 
Signed-off-by: Stephen Boyd 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/clk/clk-divider.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/clk/clk-divider.c
+++ b/drivers/clk/clk-divider.c
@@ -352,7 +352,7 @@ static long clk_divider_round_rate(struc
 
/* if read only, just return current value */
if (divider->flags & CLK_DIVIDER_READ_ONLY) {
-   bestdiv = readl(divider->reg) >> divider->shift;
+   bestdiv = clk_readl(divider->reg) >> divider->shift;
bestdiv &= div_mask(divider->width);
bestdiv = _get_div(divider->table, bestdiv, divider->flags,
divider->width);

[PATCH 4.8 093/125] perf data: Fix building in 32 bit platform with libbabeltrace

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Wang Nan 

commit f2c8852e6e990fcab0d9e68de9d86e5fbea0b5dc upstream.

On ARM32 building it report following error when we build with
libbabeltrace:

  util/data-convert-bt.c: In function 'add_bpf_output_values':
  util/data-convert-bt.c:440:3: error: format '%lu' expects argument of type 
'long unsigned int', but argument 5 has type 'unsigned int' [-Werror=format]
  cc1: all warnings being treated as errors

Fix it by changing %lu to %zu.

Signed-off-by: Wang Nan 
Cc: Jiri Olsa 
Cc: Zefan Li 
Cc: pi3or...@163.com
Fixes: 6122d57e9f7c ("perf data: Support converting data from 
bpf_perf_event_output()")
Link: 
http://lkml.kernel.org/r/1475035126-146587-1-git-send-email-wangn...@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Greg Kroah-Hartman 

---
 tools/perf/util/data-convert-bt.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/tools/perf/util/data-convert-bt.c
+++ b/tools/perf/util/data-convert-bt.c
@@ -437,7 +437,7 @@ add_bpf_output_values(struct bt_ctf_even
int ret;
 
if (nr_elements * sizeof(u32) != raw_size)
-   pr_warning("Incorrect raw_size (%u) in bpf output event, skip 
%lu bytes\n",
+   pr_warning("Incorrect raw_size (%u) in bpf output event, skip 
%zu bytes\n",
   raw_size, nr_elements * sizeof(u32) - raw_size);
 
len_type = bt_ctf_event_class_get_field_by_name(event_class, "raw_len");

[PATCH 4.8 095/125] perf powerpc: Fix build-test failure

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Ravi Bangoria 

commit 25b8592e912f085ce2ff736a2927584ddeab238c upstream.

'make -C tools/perf build-test' is failing with below log for poewrpc.

  In file included from 
/tmp/tmp.3eEwmGlYaF/perf-4.8.0-rc4/tools/perf/perf.h:15:0,
   from util/cpumap.h:8,
   from util/env.c:1:
  /tmp/tmp.3eEwmGlYaF/perf-4.8.0-rc4/tools/perf/perf-sys.h:23:56:
  fatal error: ../../arch/powerpc/include/uapi/asm/unistd.h: No such file or 
directory
  compilation terminated.

I bisected it and found it's failing from commit ad430729ae00 ("Remove:
kernel unistd*h files from perf's MANIFEST, not used").

Header file '../../arch/powerpc/include/uapi/asm/unistd.h' is included
only for powerpc in tools/perf/perf-sys.h.

By looking closly at commit history, I found little weird thing:

Commit f2d9cae9ea9e ("perf powerpc: Use uapi/unistd.h to fix build
error") replaced 'asm/unistd.h' with 'uapi/asm/unistd.h'

Commit d2709c7ce4c5 ("perf: Make perf build for x86 with UAPI
disintegration applied") removes all arch specific 'uapi/asm/unistd.h'
for all archs and adds generic .

Commit f0b9abfb0446 ("Merge branch 'linus' into perf/core") again
includes 'uapi/asm/unistd.h' for powerpc. Don't know how exactly this
happened as this change is not part of commit also.

Signed-off-by: Ravi Bangoria 
Cc: Alexander Shishkin 
Cc: Peter Zijlstra 
Link: 
http://lkml.kernel.org/r/1472630591-5089-1-git-send-email-ravi.bango...@linux.vnet.ibm.com
Fixes: ad430729ae00 ("Remove: kernel unistd*h files from perf's MANIFEST, not 
used")
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Greg Kroah-Hartman 

---
 tools/perf/perf-sys.h |1 -
 1 file changed, 1 deletion(-)

--- a/tools/perf/perf-sys.h
+++ b/tools/perf/perf-sys.h
@@ -20,7 +20,6 @@
 #endif
 
 #ifdef __powerpc__
-#include "../../arch/powerpc/include/uapi/asm/unistd.h"
 #define CPUINFO_PROC   {"cpu"}
 #endif
 

[PATCH 4.8 083/125] s390/cio: fix accidental interrupt enabling during resume

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Sebastian Ott 

commit d53c51f26145657aa7c55fa396f93677e613548d upstream.

Since commit 9f3d6d7 chsc_get_channel_measurement_chars is called with
interrupts disabled during resume from hibernate. Since this function
used spin_unlock_irq, interrupts have been enabled accidentally. Fix
this by using the irqsave variant.

Since we can't guarantee the IRQ-enablement state for all (future/
external) callers, change the locking in related functions to prevent
similar bugs in the future.

Fixes: 9f3d6d7 ("s390/cio: update measurement characteristics")
Signed-off-by: Sebastian Ott 
Reviewed-by: Peter Oberparleiter 
Signed-off-by: Martin Schwidefsky 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/s390/cio/chsc.c |   20 
 1 file changed, 12 insertions(+), 8 deletions(-)

--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -95,12 +95,13 @@ struct chsc_ssd_area {
 int chsc_get_ssd_info(struct subchannel_id schid, struct chsc_ssd_info *ssd)
 {
struct chsc_ssd_area *ssd_area;
+   unsigned long flags;
int ccode;
int ret;
int i;
int mask;
 
-   spin_lock_irq(_page_lock);
+   spin_lock_irqsave(_page_lock, flags);
memset(chsc_page, 0, PAGE_SIZE);
ssd_area = chsc_page;
ssd_area->request.length = 0x0010;
@@ -144,7 +145,7 @@ int chsc_get_ssd_info(struct subchannel_
ssd->fla[i] = ssd_area->fla[i];
}
 out:
-   spin_unlock_irq(_page_lock);
+   spin_unlock_irqrestore(_page_lock, flags);
return ret;
 }
 
@@ -832,9 +833,10 @@ int __chsc_do_secm(struct channel_subsys
u32 fmt : 4;
u32 : 16;
} __attribute__ ((packed)) *secm_area;
+   unsigned long flags;
int ret, ccode;
 
-   spin_lock_irq(_page_lock);
+   spin_lock_irqsave(_page_lock, flags);
memset(chsc_page, 0, PAGE_SIZE);
secm_area = chsc_page;
secm_area->request.length = 0x0050;
@@ -864,7 +866,7 @@ int __chsc_do_secm(struct channel_subsys
CIO_CRW_EVENT(2, "chsc: secm failed (rc=%04x)\n",
  secm_area->response.code);
 out:
-   spin_unlock_irq(_page_lock);
+   spin_unlock_irqrestore(_page_lock, flags);
return ret;
 }
 
@@ -992,6 +994,7 @@ chsc_initialize_cmg_chars(struct channel
 
 int chsc_get_channel_measurement_chars(struct channel_path *chp)
 {
+   unsigned long flags;
int ccode, ret;
 
struct {
@@ -1021,7 +1024,7 @@ int chsc_get_channel_measurement_chars(s
if (!css_chsc_characteristics.scmc || !css_chsc_characteristics.secm)
return -EINVAL;
 
-   spin_lock_irq(_page_lock);
+   spin_lock_irqsave(_page_lock, flags);
memset(chsc_page, 0, PAGE_SIZE);
scmc_area = chsc_page;
scmc_area->request.length = 0x0010;
@@ -1053,7 +1056,7 @@ int chsc_get_channel_measurement_chars(s
chsc_initialize_cmg_chars(chp, scmc_area->cmcv,
  (struct cmg_chars *) _area->data);
 out:
-   spin_unlock_irq(_page_lock);
+   spin_unlock_irqrestore(_page_lock, flags);
return ret;
 }
 
@@ -1134,6 +1137,7 @@ struct css_chsc_char css_chsc_characteri
 int __init
 chsc_determine_css_characteristics(void)
 {
+   unsigned long flags;
int result;
struct {
struct chsc_header request;
@@ -1146,7 +1150,7 @@ chsc_determine_css_characteristics(void)
u32 chsc_char[508];
} __attribute__ ((packed)) *scsc_area;
 
-   spin_lock_irq(_page_lock);
+   spin_lock_irqsave(_page_lock, flags);
memset(chsc_page, 0, PAGE_SIZE);
scsc_area = chsc_page;
scsc_area->request.length = 0x0010;
@@ -1168,7 +1172,7 @@ chsc_determine_css_characteristics(void)
CIO_CRW_EVENT(2, "chsc: scsc failed (rc=%04x)\n",
  scsc_area->response.code);
 exit:
-   spin_unlock_irq(_page_lock);
+   spin_unlock_irqrestore(_page_lock, flags);
return result;
 }
 

[PATCH 4.8 101/125] iwlwifi: mvm: fix pending frames tracking on tx resp

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Liad Kaufman 

commit 7585c354637bb003ce612dd22f5047c015545ef4 upstream.

In iwl_mvm_rx_tx_cmd_single(), when checking if a given TID is
aggregated, the driver doesn't check whether or not the queue
itself can be aggregated. For example, a management queue might
be marked as aggregated if TID 0 is aggregated on a (different)
data queue.

Make sure that mgmt frames are sent with TID IWL_TID_NON_QOS,
and in this way make sure no mixups of this sort happen.

Fixes: commit 24afba7690e4 ("iwlwifi: mvm: support bss dynamic alloc/dealloc of 
queues")
Signed-off-by: Liad Kaufman 
Signed-off-by: Luca Coelho 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/intel/iwlwifi/mvm/tx.c |6 +-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -903,9 +903,13 @@ static int iwl_mvm_tx_mpdu(struct iwl_mv
tid = IWL_MAX_TID_COUNT;
}
 
-   if (iwl_mvm_is_dqa_supported(mvm))
+   if (iwl_mvm_is_dqa_supported(mvm)) {
txq_id = mvmsta->tid_data[tid].txq_id;
 
+   if (ieee80211_is_mgmt(fc))
+   tx_cmd->tid_tspec = IWL_TID_NON_QOS;
+   }
+
/* Copy MAC header from skb into command buffer */
memcpy(tx_cmd->hdr, hdr, hdrlen);
 

Re: [PATCH v10 10/19] vfio iommu: Add blocking notifier to notify DMA_UNMAP

[Alex Williamson]

On Sat, 29 Oct 2016 16:07:05 +0530
Kirti Wankhede  wrote:

> On 10/29/2016 2:03 AM, Alex Williamson wrote:
> > On Sat, 29 Oct 2016 01:32:35 +0530
> > Kirti Wankhede  wrote:
> >   
> >> On 10/28/2016 6:10 PM, Alex Williamson wrote:  
> >>> On Fri, 28 Oct 2016 15:33:58 +0800
> >>> Jike Song  wrote:
> >>> 
> ...
> >  
> > +/*
> > + * This function finds pfn in domain->external_addr_space->pfn_list 
> > for given
> > + * iova range. If pfn exist, notify pfn to registered notifier list. On
> > + * receiving notifier callback, vendor driver should invalidate the 
> > mapping and
> > + * call vfio_unpin_pages() to unpin this pfn. With that vfio_pfn for 
> > this pfn
> > + * gets removed from rb tree of pfn_list. That re-arranges rb tree, so 
> > while
> > + * searching for next vfio_pfn in rb tree, start search from first 
> > node again.
> > + * If any vendor driver doesn't unpin that pfn, vfio_pfn would not get 
> > removed
> > + * from rb tree and so in next search vfio_pfn would be same as 
> > previous
> > + * vfio_pfn. In that case, exit from loop.
> > + */
> > +static void vfio_notifier_call_chain(struct vfio_iommu *iommu,
> > +struct vfio_iommu_type1_dma_unmap 
> > *unmap)
> > +{
> > +   struct vfio_domain *domain = iommu->external_domain;
> > +   struct rb_node *n;
> > +   struct vfio_pfn *vpfn = NULL, *prev_vpfn;
> > +
> > +   do {
> > +   prev_vpfn = vpfn;
> > +   mutex_lock(>external_addr_space->pfn_list_lock);
> > +
> > +   n = rb_first(>external_addr_space->pfn_list);
> > +
> > +   for (; n; n = rb_next(n), vpfn = NULL) {
> > +   vpfn = rb_entry(n, struct vfio_pfn, node);
> > +
> > +   if ((vpfn->iova >= unmap->iova) &&
> > +   (vpfn->iova < unmap->iova + unmap->size))
> > +   break;
> > +   }
> > +
> > +   
> > mutex_unlock(>external_addr_space->pfn_list_lock);
> > +
> > +   /* Notify any listeners about DMA_UNMAP */
> > +   if (vpfn)
> > +   blocking_notifier_call_chain(>notifier,
> > +   
> > VFIO_IOMMU_NOTIFY_DMA_UNMAP,
> > +   >pfn);  
> 
>  Hi Kirti, 
> 
>  The information carried by notifier is only a pfn.
> 
>  Since your pin/unpin interfaces design, it's the vendor driver who should
>  guarantee pin/unpin same times. To achieve that, the vendor driver must
>  cache it's iova->pfn mapping on its side, to avoid pinning a same page
>  for multiple times.
> 
>  With the notifier carrying only a pfn, to find the iova by this pfn,
>  the vendor driver must *also* keep a reverse-mapping. That's a bit
>  too much.
> 
>  Since the vendor could also suffer from IOMMU-compatible problem,
>  which means a local cache is always helpful, so I'd like to have the
>  iova carried to the notifier.
> 
>  What'd you say?
> >>>
> >>> I agree, the pfn is not unique, multiple guest pfns (iovas) might be
> >>> backed by the same host pfn.  DMA_UNMAP calls are based on iova, the
> >>> notifier through to the vendor driver must be based on the same.
> >>
> >> Host pfn should be unique, right?  
> > 
> > Let's say a user does a malloc of a single page and does 100 calls to
> > MAP_DMA populating 100 pages of IOVA space all backed by the same
> > malloc'd page.  This is valid, I have unit tests that do essentially
> > this.  Those will all have the same pfn.  The user then does an
> > UNMAP_DMA to a single one of those IOVA pages.  Did the user unmap
> > everything matching that pfn?  Of course not, they only unmapped that
> > one IOVA page.  There is no guarantee of a 1:1 mapping of pfn to IOVA.
> > UNMAP_DMA works based on IOVA.  Invalidation broadcasts to the vendor
> > driver MUST therefore also work based on IOVA.  This is not an academic
> > problem, address space aliases exist in real VMs, imagine a virtual
> > IOMMU.  Thanks,
> >   
> 
> 
> So struct vfio_iommu_type1_dma_unmap should be passed as argument to
> notifier callback:
> 
> if (unmapped && iommu->external_domain)
> -   vfio_notifier_call_chain(iommu, unmap);
> +   blocking_notifier_call_chain(>notifier,
> +   VFIO_IOMMU_NOTIFY_DMA_UNMAP,
> +unmap);
> 
> Then vendor driver should find pfns he has pinned from this range of
> iovas, then invalidate and unpin pfns. Right?

That seems like a valid choice.  It's probably better than calling 

[PATCH 4.8 104/125] iwlwifi: mvm: support BAR in reorder buffer

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Sara Sharon 

commit 9a73a7d24d51eaf9e43c771c53cf7b594e5b5334 upstream.

On default queue we will not receive frame release notification,
but the BAR itself.
Upon receiving the BAR driver should look at the NSSN and adjust
window accordingly.

Fixes: b915c10174fb ("iwlwifi: mvm: add reorder buffer per queue")
Signed-off-by: Sara Sharon 
Signed-off-by: Luca Coelho 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c |   12 +---
 1 file changed, 9 insertions(+), 3 deletions(-)

--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -598,9 +598,10 @@ static bool iwl_mvm_reorder(struct iwl_m
 
mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 
-   /* not a data packet */
-   if (!ieee80211_is_data_qos(hdr->frame_control) ||
-   is_multicast_ether_addr(hdr->addr1))
+   /* not a data packet or a bar */
+   if (!ieee80211_is_back_req(hdr->frame_control) &&
+   (!ieee80211_is_data_qos(hdr->frame_control) ||
+is_multicast_ether_addr(hdr->addr1)))
return false;
 
if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
@@ -624,6 +625,11 @@ static bool iwl_mvm_reorder(struct iwl_m
 
spin_lock_bh(>lock);
 
+   if (ieee80211_is_back_req(hdr->frame_control)) {
+   iwl_mvm_release_frames(mvm, sta, napi, buffer, nssn);
+   goto drop;
+   }
+
/*
 * If there was a significant jump in the nssn - adjust.
 * If the SN is smaller than the NSSN it might need to first go into

[PATCH 4.8 100/125] iwlwifi: check for valid ethernet address provided by OEM

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Haim Dreyfuss 

commit a6c934b364948cd4de5bd9ab055bb65206ec70f3 upstream.

In 9000 family products we added an option to let the OEM fuse the
mac address via registers. If these registers are zeroed we use the OTP
address instead. Make sure that the address provided by the OEM is valid
and, if not, fall back to the OTP address as well.

Fixes: commit 17c867bfe89b ("iwlwifi: add support for getting HW address from 
CSR")
Signed-off-by: Haim Dreyfuss 
Signed-off-by: Luca Coelho 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c |   15 ++-
 1 file changed, 10 insertions(+), 5 deletions(-)

--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -564,11 +564,16 @@ static void iwl_set_hw_address_from_csr(
__le32 mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_STRAP));
__le32 mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_STRAP));
 
-   /* If OEM did not fuse address - get it from OTP */
-   if (!mac_addr0 && !mac_addr1) {
-   mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP));
-   mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP));
-   }
+   iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
+   /*
+* If the OEM fused a valid address, use it instead of the one in the
+* OTP
+*/
+   if (is_valid_ether_addr(data->hw_addr))
+   return;
+
+   mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP));
+   mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP));
 
iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
 }

[PATCH 4.8 094/125] perf hists browser: Fix event group display

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Namhyung Kim 

commit d9ea48bc4e7cc297ca1073fa3f90ed80d964b7b4 upstream.

Milian reported that the event group on TUI shows duplicated overhead.
This was due to a bug on calculating hpp->buf position.  The
hpp_advance() was called from __hpp__slsmg_color_printf() on TUI but
it's already called from the hpp__call_print_fn macro in __hpp__fmt().
The end result is that the print function returns number of bytes it
printed but the buffer advanced twice of the length.

This is generally not a problem since it doesn't need to access the
buffer again.  But with event group, overhead needs to be printed
multiple times and hist_entry__snprintf_alignment() tries to fill the
space with buffer after it printed.  So it (brokenly) showed the last
overhead again.

The bug was there from the beginning, but I think it's only revealed
when the alignment function was added.

Reported-by: Milian Wolff 
Signed-off-by: Namhyung Kim 
Cc: Andi Kleen 
Cc: Jiri Olsa 
Cc: Peter Zijlstra 
Fixes: 89fee7094323 ("perf hists: Do column alignment on the format iterator")
Link: http://lkml.kernel.org/r/20160912061958.16656-2-namhy...@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Greg Kroah-Hartman 

---
 tools/perf/ui/browsers/hists.c |1 -
 1 file changed, 1 deletion(-)

--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -1091,7 +1091,6 @@ static int __hpp__slsmg_color_printf(str
ret = scnprintf(hpp->buf, hpp->size, fmt, len, percent);
ui_browser__printf(arg->b, "%s", hpp->buf);
 
-   advance_hpp(hpp, ret);
return ret;
 }
 

[PATCH 4.8 083/125] s390/cio: fix accidental interrupt enabling during resume

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Sebastian Ott 

commit d53c51f26145657aa7c55fa396f93677e613548d upstream.

Since commit 9f3d6d7 chsc_get_channel_measurement_chars is called with
interrupts disabled during resume from hibernate. Since this function
used spin_unlock_irq, interrupts have been enabled accidentally. Fix
this by using the irqsave variant.

Since we can't guarantee the IRQ-enablement state for all (future/
external) callers, change the locking in related functions to prevent
similar bugs in the future.

Fixes: 9f3d6d7 ("s390/cio: update measurement characteristics")
Signed-off-by: Sebastian Ott 
Reviewed-by: Peter Oberparleiter 
Signed-off-by: Martin Schwidefsky 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/s390/cio/chsc.c |   20 
 1 file changed, 12 insertions(+), 8 deletions(-)

--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -95,12 +95,13 @@ struct chsc_ssd_area {
 int chsc_get_ssd_info(struct subchannel_id schid, struct chsc_ssd_info *ssd)
 {
struct chsc_ssd_area *ssd_area;
+   unsigned long flags;
int ccode;
int ret;
int i;
int mask;
 
-   spin_lock_irq(_page_lock);
+   spin_lock_irqsave(_page_lock, flags);
memset(chsc_page, 0, PAGE_SIZE);
ssd_area = chsc_page;
ssd_area->request.length = 0x0010;
@@ -144,7 +145,7 @@ int chsc_get_ssd_info(struct subchannel_
ssd->fla[i] = ssd_area->fla[i];
}
 out:
-   spin_unlock_irq(_page_lock);
+   spin_unlock_irqrestore(_page_lock, flags);
return ret;
 }
 
@@ -832,9 +833,10 @@ int __chsc_do_secm(struct channel_subsys
u32 fmt : 4;
u32 : 16;
} __attribute__ ((packed)) *secm_area;
+   unsigned long flags;
int ret, ccode;
 
-   spin_lock_irq(_page_lock);
+   spin_lock_irqsave(_page_lock, flags);
memset(chsc_page, 0, PAGE_SIZE);
secm_area = chsc_page;
secm_area->request.length = 0x0050;
@@ -864,7 +866,7 @@ int __chsc_do_secm(struct channel_subsys
CIO_CRW_EVENT(2, "chsc: secm failed (rc=%04x)\n",
  secm_area->response.code);
 out:
-   spin_unlock_irq(_page_lock);
+   spin_unlock_irqrestore(_page_lock, flags);
return ret;
 }
 
@@ -992,6 +994,7 @@ chsc_initialize_cmg_chars(struct channel
 
 int chsc_get_channel_measurement_chars(struct channel_path *chp)
 {
+   unsigned long flags;
int ccode, ret;
 
struct {
@@ -1021,7 +1024,7 @@ int chsc_get_channel_measurement_chars(s
if (!css_chsc_characteristics.scmc || !css_chsc_characteristics.secm)
return -EINVAL;
 
-   spin_lock_irq(_page_lock);
+   spin_lock_irqsave(_page_lock, flags);
memset(chsc_page, 0, PAGE_SIZE);
scmc_area = chsc_page;
scmc_area->request.length = 0x0010;
@@ -1053,7 +1056,7 @@ int chsc_get_channel_measurement_chars(s
chsc_initialize_cmg_chars(chp, scmc_area->cmcv,
  (struct cmg_chars *) _area->data);
 out:
-   spin_unlock_irq(_page_lock);
+   spin_unlock_irqrestore(_page_lock, flags);
return ret;
 }
 
@@ -1134,6 +1137,7 @@ struct css_chsc_char css_chsc_characteri
 int __init
 chsc_determine_css_characteristics(void)
 {
+   unsigned long flags;
int result;
struct {
struct chsc_header request;
@@ -1146,7 +1150,7 @@ chsc_determine_css_characteristics(void)
u32 chsc_char[508];
} __attribute__ ((packed)) *scsc_area;
 
-   spin_lock_irq(_page_lock);
+   spin_lock_irqsave(_page_lock, flags);
memset(chsc_page, 0, PAGE_SIZE);
scsc_area = chsc_page;
scsc_area->request.length = 0x0010;
@@ -1168,7 +1172,7 @@ chsc_determine_css_characteristics(void)
CIO_CRW_EVENT(2, "chsc: scsc failed (rc=%04x)\n",
  scsc_area->response.code);
 exit:
-   spin_unlock_irq(_page_lock);
+   spin_unlock_irqrestore(_page_lock, flags);
return result;
 }
 

[PATCH 4.8 101/125] iwlwifi: mvm: fix pending frames tracking on tx resp

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Liad Kaufman 

commit 7585c354637bb003ce612dd22f5047c015545ef4 upstream.

In iwl_mvm_rx_tx_cmd_single(), when checking if a given TID is
aggregated, the driver doesn't check whether or not the queue
itself can be aggregated. For example, a management queue might
be marked as aggregated if TID 0 is aggregated on a (different)
data queue.

Make sure that mgmt frames are sent with TID IWL_TID_NON_QOS,
and in this way make sure no mixups of this sort happen.

Fixes: commit 24afba7690e4 ("iwlwifi: mvm: support bss dynamic alloc/dealloc of 
queues")
Signed-off-by: Liad Kaufman 
Signed-off-by: Luca Coelho 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/intel/iwlwifi/mvm/tx.c |6 +-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -903,9 +903,13 @@ static int iwl_mvm_tx_mpdu(struct iwl_mv
tid = IWL_MAX_TID_COUNT;
}
 
-   if (iwl_mvm_is_dqa_supported(mvm))
+   if (iwl_mvm_is_dqa_supported(mvm)) {
txq_id = mvmsta->tid_data[tid].txq_id;
 
+   if (ieee80211_is_mgmt(fc))
+   tx_cmd->tid_tspec = IWL_TID_NON_QOS;
+   }
+
/* Copy MAC header from skb into command buffer */
memcpy(tx_cmd->hdr, hdr, hdrlen);
 

Re: [PATCH v10 10/19] vfio iommu: Add blocking notifier to notify DMA_UNMAP

[Alex Williamson]

On Sat, 29 Oct 2016 16:07:05 +0530
Kirti Wankhede  wrote:

> On 10/29/2016 2:03 AM, Alex Williamson wrote:
> > On Sat, 29 Oct 2016 01:32:35 +0530
> > Kirti Wankhede  wrote:
> >   
> >> On 10/28/2016 6:10 PM, Alex Williamson wrote:  
> >>> On Fri, 28 Oct 2016 15:33:58 +0800
> >>> Jike Song  wrote:
> >>> 
> ...
> >  
> > +/*
> > + * This function finds pfn in domain->external_addr_space->pfn_list 
> > for given
> > + * iova range. If pfn exist, notify pfn to registered notifier list. On
> > + * receiving notifier callback, vendor driver should invalidate the 
> > mapping and
> > + * call vfio_unpin_pages() to unpin this pfn. With that vfio_pfn for 
> > this pfn
> > + * gets removed from rb tree of pfn_list. That re-arranges rb tree, so 
> > while
> > + * searching for next vfio_pfn in rb tree, start search from first 
> > node again.
> > + * If any vendor driver doesn't unpin that pfn, vfio_pfn would not get 
> > removed
> > + * from rb tree and so in next search vfio_pfn would be same as 
> > previous
> > + * vfio_pfn. In that case, exit from loop.
> > + */
> > +static void vfio_notifier_call_chain(struct vfio_iommu *iommu,
> > +struct vfio_iommu_type1_dma_unmap 
> > *unmap)
> > +{
> > +   struct vfio_domain *domain = iommu->external_domain;
> > +   struct rb_node *n;
> > +   struct vfio_pfn *vpfn = NULL, *prev_vpfn;
> > +
> > +   do {
> > +   prev_vpfn = vpfn;
> > +   mutex_lock(>external_addr_space->pfn_list_lock);
> > +
> > +   n = rb_first(>external_addr_space->pfn_list);
> > +
> > +   for (; n; n = rb_next(n), vpfn = NULL) {
> > +   vpfn = rb_entry(n, struct vfio_pfn, node);
> > +
> > +   if ((vpfn->iova >= unmap->iova) &&
> > +   (vpfn->iova < unmap->iova + unmap->size))
> > +   break;
> > +   }
> > +
> > +   
> > mutex_unlock(>external_addr_space->pfn_list_lock);
> > +
> > +   /* Notify any listeners about DMA_UNMAP */
> > +   if (vpfn)
> > +   blocking_notifier_call_chain(>notifier,
> > +   
> > VFIO_IOMMU_NOTIFY_DMA_UNMAP,
> > +   >pfn);  
> 
>  Hi Kirti, 
> 
>  The information carried by notifier is only a pfn.
> 
>  Since your pin/unpin interfaces design, it's the vendor driver who should
>  guarantee pin/unpin same times. To achieve that, the vendor driver must
>  cache it's iova->pfn mapping on its side, to avoid pinning a same page
>  for multiple times.
> 
>  With the notifier carrying only a pfn, to find the iova by this pfn,
>  the vendor driver must *also* keep a reverse-mapping. That's a bit
>  too much.
> 
>  Since the vendor could also suffer from IOMMU-compatible problem,
>  which means a local cache is always helpful, so I'd like to have the
>  iova carried to the notifier.
> 
>  What'd you say?
> >>>
> >>> I agree, the pfn is not unique, multiple guest pfns (iovas) might be
> >>> backed by the same host pfn.  DMA_UNMAP calls are based on iova, the
> >>> notifier through to the vendor driver must be based on the same.
> >>
> >> Host pfn should be unique, right?  
> > 
> > Let's say a user does a malloc of a single page and does 100 calls to
> > MAP_DMA populating 100 pages of IOVA space all backed by the same
> > malloc'd page.  This is valid, I have unit tests that do essentially
> > this.  Those will all have the same pfn.  The user then does an
> > UNMAP_DMA to a single one of those IOVA pages.  Did the user unmap
> > everything matching that pfn?  Of course not, they only unmapped that
> > one IOVA page.  There is no guarantee of a 1:1 mapping of pfn to IOVA.
> > UNMAP_DMA works based on IOVA.  Invalidation broadcasts to the vendor
> > driver MUST therefore also work based on IOVA.  This is not an academic
> > problem, address space aliases exist in real VMs, imagine a virtual
> > IOMMU.  Thanks,
> >   
> 
> 
> So struct vfio_iommu_type1_dma_unmap should be passed as argument to
> notifier callback:
> 
> if (unmapped && iommu->external_domain)
> -   vfio_notifier_call_chain(iommu, unmap);
> +   blocking_notifier_call_chain(>notifier,
> +   VFIO_IOMMU_NOTIFY_DMA_UNMAP,
> +unmap);
> 
> Then vendor driver should find pfns he has pinned from this range of
> iovas, then invalidate and unpin pfns. Right?

That seems like a valid choice.  It's probably better than calling the
notifier for each page of iova.  Thanks,

Alex

[PATCH 4.8 104/125] iwlwifi: mvm: support BAR in reorder buffer

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Sara Sharon 

commit 9a73a7d24d51eaf9e43c771c53cf7b594e5b5334 upstream.

On default queue we will not receive frame release notification,
but the BAR itself.
Upon receiving the BAR driver should look at the NSSN and adjust
window accordingly.

Fixes: b915c10174fb ("iwlwifi: mvm: add reorder buffer per queue")
Signed-off-by: Sara Sharon 
Signed-off-by: Luca Coelho 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c |   12 +---
 1 file changed, 9 insertions(+), 3 deletions(-)

--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -598,9 +598,10 @@ static bool iwl_mvm_reorder(struct iwl_m
 
mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 
-   /* not a data packet */
-   if (!ieee80211_is_data_qos(hdr->frame_control) ||
-   is_multicast_ether_addr(hdr->addr1))
+   /* not a data packet or a bar */
+   if (!ieee80211_is_back_req(hdr->frame_control) &&
+   (!ieee80211_is_data_qos(hdr->frame_control) ||
+is_multicast_ether_addr(hdr->addr1)))
return false;
 
if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
@@ -624,6 +625,11 @@ static bool iwl_mvm_reorder(struct iwl_m
 
spin_lock_bh(>lock);
 
+   if (ieee80211_is_back_req(hdr->frame_control)) {
+   iwl_mvm_release_frames(mvm, sta, napi, buffer, nssn);
+   goto drop;
+   }
+
/*
 * If there was a significant jump in the nssn - adjust.
 * If the SN is smaller than the NSSN it might need to first go into

[PATCH 4.8 100/125] iwlwifi: check for valid ethernet address provided by OEM

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Haim Dreyfuss 

commit a6c934b364948cd4de5bd9ab055bb65206ec70f3 upstream.

In 9000 family products we added an option to let the OEM fuse the
mac address via registers. If these registers are zeroed we use the OTP
address instead. Make sure that the address provided by the OEM is valid
and, if not, fall back to the OTP address as well.

Fixes: commit 17c867bfe89b ("iwlwifi: add support for getting HW address from 
CSR")
Signed-off-by: Haim Dreyfuss 
Signed-off-by: Luca Coelho 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c |   15 ++-
 1 file changed, 10 insertions(+), 5 deletions(-)

--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -564,11 +564,16 @@ static void iwl_set_hw_address_from_csr(
__le32 mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_STRAP));
__le32 mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_STRAP));
 
-   /* If OEM did not fuse address - get it from OTP */
-   if (!mac_addr0 && !mac_addr1) {
-   mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP));
-   mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP));
-   }
+   iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
+   /*
+* If the OEM fused a valid address, use it instead of the one in the
+* OTP
+*/
+   if (is_valid_ether_addr(data->hw_addr))
+   return;
+
+   mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP));
+   mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP));
 
iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
 }

[PATCH 4.8 094/125] perf hists browser: Fix event group display

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Namhyung Kim 

commit d9ea48bc4e7cc297ca1073fa3f90ed80d964b7b4 upstream.

Milian reported that the event group on TUI shows duplicated overhead.
This was due to a bug on calculating hpp->buf position.  The
hpp_advance() was called from __hpp__slsmg_color_printf() on TUI but
it's already called from the hpp__call_print_fn macro in __hpp__fmt().
The end result is that the print function returns number of bytes it
printed but the buffer advanced twice of the length.

This is generally not a problem since it doesn't need to access the
buffer again.  But with event group, overhead needs to be printed
multiple times and hist_entry__snprintf_alignment() tries to fill the
space with buffer after it printed.  So it (brokenly) showed the last
overhead again.

The bug was there from the beginning, but I think it's only revealed
when the alignment function was added.

Reported-by: Milian Wolff 
Signed-off-by: Namhyung Kim 
Cc: Andi Kleen 
Cc: Jiri Olsa 
Cc: Peter Zijlstra 
Fixes: 89fee7094323 ("perf hists: Do column alignment on the format iterator")
Link: http://lkml.kernel.org/r/20160912061958.16656-2-namhy...@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Greg Kroah-Hartman 

---
 tools/perf/ui/browsers/hists.c |1 -
 1 file changed, 1 deletion(-)

--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -1091,7 +1091,6 @@ static int __hpp__slsmg_color_printf(str
ret = scnprintf(hpp->buf, hpp->size, fmt, len, percent);
ui_browser__printf(arg->b, "%s", hpp->buf);
 
-   advance_hpp(hpp, ret);
return ret;
 }
 

[PATCH 4.8 075/125] IB/rdmavt: Correct sparse annotation

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Mike Marciniszyn 

commit eefa1d8961584c5b76afded94960ca4344bc638b upstream.

The __must_hold() is sufficent to correct the sparse
context imbalance inside a function.

Per Documentation/sparse.txt:
__must_hold - The specified lock is held on function entry and exit.

Fixes: Commit c0a67f6ba356 ("IB/rdmavt: Annotate rvt_reset_qp()")
Reviewed-by: Dennis Dalessandro 
Signed-off-by: Mike Marciniszyn 
Signed-off-by: Dennis Dalessandro 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/infiniband/sw/rdmavt/qp.c |9 +++--
 1 file changed, 3 insertions(+), 6 deletions(-)

--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -501,12 +501,9 @@ static void rvt_remove_qp(struct rvt_dev
  */
 static void rvt_reset_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp,
  enum ib_qp_type type)
-   __releases(>s_lock)
-   __releases(>s_hlock)
-   __releases(>r_lock)
-   __acquires(>r_lock)
-   __acquires(>s_hlock)
-   __acquires(>s_lock)
+   __must_hold(>r_lock)
+   __must_hold(>s_hlock)
+   __must_hold(>s_lock)
 {
if (qp->state != IB_QPS_RESET) {
qp->state = IB_QPS_RESET;

[PATCH 4.8 046/125] spi: spi-fsl-dspi: Drop extra spi_master_put in device remove function

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Wei Yongjun 

commit 6999aeabbb703a81a204cb6f9f8f151759a99ac4 upstream.

The call sequence spi_alloc_master/spi_register_master/spi_unregister_master
is complete; it reduces the device reference count to zero, which and results
in device memory being freed. The subsequent call to spi_master_put is
unnecessary and results in an access to free memory. Drop it.

Fixes: 9298bc727385 ("spi: spi-fsl-dspi: Remove spi-bitbang")
Signed-off-by: Wei Yongjun 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/spi/spi-fsl-dspi.c |1 -
 1 file changed, 1 deletion(-)

--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -760,7 +760,6 @@ static int dspi_remove(struct platform_d
/* Disconnect from the SPI framework */
clk_disable_unprepare(dspi->clk);
spi_unregister_master(dspi->master);
-   spi_master_put(dspi->master);
 
return 0;
 }

[PATCH 4.8 102/125] iwlwifi: mvm: call a different txq_enable function

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Sara Sharon 

commit ca3b9c6b6d4db9a8ba5fc8b95664e75468c59f9f upstream.

Since the SCD_QUEUE_CFG command was introduced the driver
calls iwl_trans_txq_enable_cfg() with a NULL for scd_cfg
parameter.
This makes the transport avoid writing to the SCD pointers,
since it can cause races with firmware, which is also accessing
the registers.
The transport only updates the write pointer in that case.
Fix a wrong call to iwl_trans_txq_enable() which caused a
scd_cfg parameter to be sent to transport, resulting with an
access to SCD registers.

Fixes: 58f2cc57dc6a ("iwlwifi: mvm: support dqa-mode scd queue redirection")
Signed-off-by: Sara Sharon 
Signed-off-by: Luca Coelho 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/intel/iwlwifi/mvm/sta.c |4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -576,9 +576,7 @@ static int iwl_mvm_scd_queue_redirect(st
ret);
 
/* Make sure the SCD wrptr is correctly set before reconfiguring */
-   iwl_trans_txq_enable(mvm->trans, queue, iwl_mvm_ac_to_tx_fifo[ac],
-cmd.sta_id, tid, LINK_QUAL_AGG_FRAME_LIMIT_DEF,
-ssn, wdg_timeout);
+   iwl_trans_txq_enable_cfg(mvm->trans, queue, ssn, NULL, wdg_timeout);
 
/* TODO: Work-around SCD bug when moving back by multiples of 0x40 */
 

[PATCH 4.8 098/125] perf symbols: Check symbol_conf.allow_aliases for kallsyms loading too

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Arnaldo Carvalho de Melo 

commit c97b40e4d15f13a36cd037d598e45cbe9e1e5757 upstream.

We can allow aliases to be kept, but we were checking this just when
loading vmlinux files, be consistent, do it for any symbol table loading
code that calls symbol__fixup_duplicate() by making this function check
.allow_aliases instead.

Cc: Adrian Hunter 
Cc: David Ahern 
Cc: Jiri Olsa 
Cc: Masami Hiramatsu 
Cc: Namhyung Kim 
Cc: Wang Nan 
Fixes: 680d926a8cb0 ("perf symbols: Allow symbol alias when loading map for 
symbol name")
Link: http://lkml.kernel.org/n/tip-z0avp0s6cfjckc4xj3pdf...@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Greg Kroah-Hartman 

---
 tools/perf/util/symbol-elf.c |3 +--
 tools/perf/util/symbol.c |3 +++
 2 files changed, 4 insertions(+), 2 deletions(-)

--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -1113,8 +1113,7 @@ new_symbol:
 * For misannotated, zeroed, ASM function sizes.
 */
if (nr > 0) {
-   if (!symbol_conf.allow_aliases)
-   symbols__fixup_duplicate(>symbols[map->type]);
+   symbols__fixup_duplicate(>symbols[map->type]);
symbols__fixup_end(>symbols[map->type]);
if (kmap) {
/*
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -152,6 +152,9 @@ void symbols__fixup_duplicate(struct rb_
struct rb_node *nd;
struct symbol *curr, *next;
 
+   if (symbol_conf.allow_aliases)
+   return;
+
nd = rb_first(symbols);
 
while (nd) {

[PATCH 4.8 099/125] perf symbols: Fixup symbol sizes before picking best ones

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Arnaldo Carvalho de Melo 

commit 432746f8e0b6a82ba832b771afe31abd51af6752 upstream.

When we call symbol__fixup_duplicate() we use algorithms to pick the
"best" symbols for cases where there are various functions/aliases to an
address, and those check zero size symbols, which, before calling
symbol__fixup_end() are _all_ symbols in a just parsed kallsyms file.

So first fixup the end, then fixup the duplicates.

Found while trying to figure out why 'perf test vmlinux' failed, see the
output of 'perf test -v vmlinux' to see cases where the symbols picked
as best for vmlinux don't match the ones picked for kallsyms.

Cc: Anton Blanchard 
Cc: Adrian Hunter 
Cc: David Ahern 
Cc: Jiri Olsa 
Cc: Masami Hiramatsu 
Cc: Namhyung Kim 
Cc: Wang Nan 
Fixes: 694bf407b061 ("perf symbols: Add some heuristics for choosing the best 
duplicate symbol")
Link: http://lkml.kernel.org/n/tip-rxqvdgr0mqjdxee0kf8i2...@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Greg Kroah-Hartman 

---
 tools/perf/util/symbol-elf.c |2 +-
 tools/perf/util/symbol.c |2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -1113,8 +1113,8 @@ new_symbol:
 * For misannotated, zeroed, ASM function sizes.
 */
if (nr > 0) {
-   symbols__fixup_duplicate(>symbols[map->type]);
symbols__fixup_end(>symbols[map->type]);
+   symbols__fixup_duplicate(>symbols[map->type]);
if (kmap) {
/*
 * We need to fixup this here too because we create new
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1237,8 +1237,8 @@ int __dso__load_kallsyms(struct dso *dso
if (kallsyms__delta(map, filename, ))
return -1;
 
-   symbols__fixup_duplicate(>symbols[map->type]);
symbols__fixup_end(>symbols[map->type]);
+   symbols__fixup_duplicate(>symbols[map->type]);
 
if (dso->kernel == DSO_TYPE_GUEST_KERNEL)
dso->symtab_type = DSO_BINARY_TYPE__GUEST_KALLSYMS;

[PATCH 4.8 075/125] IB/rdmavt: Correct sparse annotation

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Mike Marciniszyn 

commit eefa1d8961584c5b76afded94960ca4344bc638b upstream.

The __must_hold() is sufficent to correct the sparse
context imbalance inside a function.

Per Documentation/sparse.txt:
__must_hold - The specified lock is held on function entry and exit.

Fixes: Commit c0a67f6ba356 ("IB/rdmavt: Annotate rvt_reset_qp()")
Reviewed-by: Dennis Dalessandro 
Signed-off-by: Mike Marciniszyn 
Signed-off-by: Dennis Dalessandro 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/infiniband/sw/rdmavt/qp.c |9 +++--
 1 file changed, 3 insertions(+), 6 deletions(-)

--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -501,12 +501,9 @@ static void rvt_remove_qp(struct rvt_dev
  */
 static void rvt_reset_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp,
  enum ib_qp_type type)
-   __releases(>s_lock)
-   __releases(>s_hlock)
-   __releases(>r_lock)
-   __acquires(>r_lock)
-   __acquires(>s_hlock)
-   __acquires(>s_lock)
+   __must_hold(>r_lock)
+   __must_hold(>s_hlock)
+   __must_hold(>s_lock)
 {
if (qp->state != IB_QPS_RESET) {
qp->state = IB_QPS_RESET;

[PATCH 4.8 046/125] spi: spi-fsl-dspi: Drop extra spi_master_put in device remove function

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Wei Yongjun 

commit 6999aeabbb703a81a204cb6f9f8f151759a99ac4 upstream.

The call sequence spi_alloc_master/spi_register_master/spi_unregister_master
is complete; it reduces the device reference count to zero, which and results
in device memory being freed. The subsequent call to spi_master_put is
unnecessary and results in an access to free memory. Drop it.

Fixes: 9298bc727385 ("spi: spi-fsl-dspi: Remove spi-bitbang")
Signed-off-by: Wei Yongjun 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/spi/spi-fsl-dspi.c |1 -
 1 file changed, 1 deletion(-)

--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -760,7 +760,6 @@ static int dspi_remove(struct platform_d
/* Disconnect from the SPI framework */
clk_disable_unprepare(dspi->clk);
spi_unregister_master(dspi->master);
-   spi_master_put(dspi->master);
 
return 0;
 }

[PATCH 4.8 102/125] iwlwifi: mvm: call a different txq_enable function

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Sara Sharon 

commit ca3b9c6b6d4db9a8ba5fc8b95664e75468c59f9f upstream.

Since the SCD_QUEUE_CFG command was introduced the driver
calls iwl_trans_txq_enable_cfg() with a NULL for scd_cfg
parameter.
This makes the transport avoid writing to the SCD pointers,
since it can cause races with firmware, which is also accessing
the registers.
The transport only updates the write pointer in that case.
Fix a wrong call to iwl_trans_txq_enable() which caused a
scd_cfg parameter to be sent to transport, resulting with an
access to SCD registers.

Fixes: 58f2cc57dc6a ("iwlwifi: mvm: support dqa-mode scd queue redirection")
Signed-off-by: Sara Sharon 
Signed-off-by: Luca Coelho 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/net/wireless/intel/iwlwifi/mvm/sta.c |4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -576,9 +576,7 @@ static int iwl_mvm_scd_queue_redirect(st
ret);
 
/* Make sure the SCD wrptr is correctly set before reconfiguring */
-   iwl_trans_txq_enable(mvm->trans, queue, iwl_mvm_ac_to_tx_fifo[ac],
-cmd.sta_id, tid, LINK_QUAL_AGG_FRAME_LIMIT_DEF,
-ssn, wdg_timeout);
+   iwl_trans_txq_enable_cfg(mvm->trans, queue, ssn, NULL, wdg_timeout);
 
/* TODO: Work-around SCD bug when moving back by multiples of 0x40 */
 

[PATCH 4.8 098/125] perf symbols: Check symbol_conf.allow_aliases for kallsyms loading too

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Arnaldo Carvalho de Melo 

commit c97b40e4d15f13a36cd037d598e45cbe9e1e5757 upstream.

We can allow aliases to be kept, but we were checking this just when
loading vmlinux files, be consistent, do it for any symbol table loading
code that calls symbol__fixup_duplicate() by making this function check
.allow_aliases instead.

Cc: Adrian Hunter 
Cc: David Ahern 
Cc: Jiri Olsa 
Cc: Masami Hiramatsu 
Cc: Namhyung Kim 
Cc: Wang Nan 
Fixes: 680d926a8cb0 ("perf symbols: Allow symbol alias when loading map for 
symbol name")
Link: http://lkml.kernel.org/n/tip-z0avp0s6cfjckc4xj3pdf...@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Greg Kroah-Hartman 

---
 tools/perf/util/symbol-elf.c |3 +--
 tools/perf/util/symbol.c |3 +++
 2 files changed, 4 insertions(+), 2 deletions(-)

--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -1113,8 +1113,7 @@ new_symbol:
 * For misannotated, zeroed, ASM function sizes.
 */
if (nr > 0) {
-   if (!symbol_conf.allow_aliases)
-   symbols__fixup_duplicate(>symbols[map->type]);
+   symbols__fixup_duplicate(>symbols[map->type]);
symbols__fixup_end(>symbols[map->type]);
if (kmap) {
/*
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -152,6 +152,9 @@ void symbols__fixup_duplicate(struct rb_
struct rb_node *nd;
struct symbol *curr, *next;
 
+   if (symbol_conf.allow_aliases)
+   return;
+
nd = rb_first(symbols);
 
while (nd) {

[PATCH 4.8 099/125] perf symbols: Fixup symbol sizes before picking best ones

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Arnaldo Carvalho de Melo 

commit 432746f8e0b6a82ba832b771afe31abd51af6752 upstream.

When we call symbol__fixup_duplicate() we use algorithms to pick the
"best" symbols for cases where there are various functions/aliases to an
address, and those check zero size symbols, which, before calling
symbol__fixup_end() are _all_ symbols in a just parsed kallsyms file.

So first fixup the end, then fixup the duplicates.

Found while trying to figure out why 'perf test vmlinux' failed, see the
output of 'perf test -v vmlinux' to see cases where the symbols picked
as best for vmlinux don't match the ones picked for kallsyms.

Cc: Anton Blanchard 
Cc: Adrian Hunter 
Cc: David Ahern 
Cc: Jiri Olsa 
Cc: Masami Hiramatsu 
Cc: Namhyung Kim 
Cc: Wang Nan 
Fixes: 694bf407b061 ("perf symbols: Add some heuristics for choosing the best 
duplicate symbol")
Link: http://lkml.kernel.org/n/tip-rxqvdgr0mqjdxee0kf8i2...@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Greg Kroah-Hartman 

---
 tools/perf/util/symbol-elf.c |2 +-
 tools/perf/util/symbol.c |2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -1113,8 +1113,8 @@ new_symbol:
 * For misannotated, zeroed, ASM function sizes.
 */
if (nr > 0) {
-   symbols__fixup_duplicate(>symbols[map->type]);
symbols__fixup_end(>symbols[map->type]);
+   symbols__fixup_duplicate(>symbols[map->type]);
if (kmap) {
/*
 * We need to fixup this here too because we create new
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1237,8 +1237,8 @@ int __dso__load_kallsyms(struct dso *dso
if (kallsyms__delta(map, filename, ))
return -1;
 
-   symbols__fixup_duplicate(>symbols[map->type]);
symbols__fixup_end(>symbols[map->type]);
+   symbols__fixup_duplicate(>symbols[map->type]);
 
if (dso->kernel == DSO_TYPE_GUEST_KERNEL)
dso->symtab_type = DSO_BINARY_TYPE__GUEST_KALLSYMS;

[PATCH 4.8 115/125] ARM: pxa: fix GPIO double shifts

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Robert Jarzmik 

commit ca26475bf02ed8562b9b46f91d3e8b52ec312541 upstream.

The commit 9bf448c66d4b ("ARM: pxa: use generic gpio operation instead of
gpio register") from Oct 17, 2011, leads to the following static checker
warning:
  arch/arm/mach-pxa/spitz_pm.c:172 spitz_charger_wakeup()
  warn: double left shift '!gpio_get_value(SPITZ_GPIO_KEY_INT)
<< (1 << ((SPITZ_GPIO_KEY_INT) & 31))'

As Dan reported, the value is shifted three times :
 - once by gpio_get_value(), which returns either 0 or BIT(gpio)
 - once by the shift operation '<<'
 - a last time by GPIO_bit(gpio) which is BIT(gpio)

Therefore the calculation lead to a chained or operator of :
 - (1 << gpio) << (1 << gpio) = (2^gpio)^gpio = 2 ^ (gpio * gpio)

It is be sheer luck the former statement works, only because each gpio
used is strictly smaller than 6, and therefore 2^(gpio^2) never
overflows a 32 bits value, and because it is used as a boolean value to
check a gpio activation.

As the xxx_charger_wakeup() functions are used as a true/false detection
mechanism, take that opportunity to change their prototypes from integer
return value to boolean one.

Fixes: 9bf448c66d4b ("ARM: pxa: use generic gpio operation instead of
gpio register")
Reported-by: Dan Carpenter 
Cc: Joe Perches 
Signed-off-by: Robert Jarzmik 
Signed-off-by: Greg Kroah-Hartman 

---
 arch/arm/mach-pxa/corgi_pm.c   |   13 -
 arch/arm/mach-pxa/sharpsl_pm.c |2 +-
 arch/arm/mach-pxa/sharpsl_pm.h |2 +-
 arch/arm/mach-pxa/spitz_pm.c   |9 +++--
 4 files changed, 9 insertions(+), 17 deletions(-)

--- a/arch/arm/mach-pxa/corgi_pm.c
+++ b/arch/arm/mach-pxa/corgi_pm.c
@@ -131,16 +131,11 @@ static int corgi_should_wakeup(unsigned
return is_resume;
 }
 
-static unsigned long corgi_charger_wakeup(void)
+static bool corgi_charger_wakeup(void)
 {
-   unsigned long ret;
-
-   ret = (!gpio_get_value(CORGI_GPIO_AC_IN) << GPIO_bit(CORGI_GPIO_AC_IN))
-   | (!gpio_get_value(CORGI_GPIO_KEY_INT)
-   << GPIO_bit(CORGI_GPIO_KEY_INT))
-   | (!gpio_get_value(CORGI_GPIO_WAKEUP)
-   << GPIO_bit(CORGI_GPIO_WAKEUP));
-   return ret;
+   return !gpio_get_value(CORGI_GPIO_AC_IN) ||
+   !gpio_get_value(CORGI_GPIO_KEY_INT) ||
+   !gpio_get_value(CORGI_GPIO_WAKEUP);
 }
 
 unsigned long corgipm_read_devdata(int type)
--- a/arch/arm/mach-pxa/sharpsl_pm.c
+++ b/arch/arm/mach-pxa/sharpsl_pm.c
@@ -744,7 +744,7 @@ static int sharpsl_off_charge_battery(vo
time = RCNR;
while (1) {
/* Check if any wakeup event had occurred */
-   if (sharpsl_pm.machinfo->charger_wakeup() != 0)
+   if (sharpsl_pm.machinfo->charger_wakeup())
return 0;
/* Check for timeout */
if ((RCNR - time) > SHARPSL_WAIT_CO_TIME)
--- a/arch/arm/mach-pxa/sharpsl_pm.h
+++ b/arch/arm/mach-pxa/sharpsl_pm.h
@@ -34,7 +34,7 @@ struct sharpsl_charger_machinfo {
 #define SHARPSL_STATUS_LOCK 5
 #define SHARPSL_STATUS_CHRGFULL 6
 #define SHARPSL_STATUS_FATAL7
-   unsigned long (*charger_wakeup)(void);
+   bool (*charger_wakeup)(void);
int (*should_wakeup)(unsigned int resume_on_alarm);
void (*backlight_limit)(int);
int (*backlight_get_status) (void);
--- a/arch/arm/mach-pxa/spitz_pm.c
+++ b/arch/arm/mach-pxa/spitz_pm.c
@@ -165,13 +165,10 @@ static int spitz_should_wakeup(unsigned
return is_resume;
 }
 
-static unsigned long spitz_charger_wakeup(void)
+static bool spitz_charger_wakeup(void)
 {
-   unsigned long ret;
-   ret = ((!gpio_get_value(SPITZ_GPIO_KEY_INT)
-   << GPIO_bit(SPITZ_GPIO_KEY_INT))
-   | gpio_get_value(SPITZ_GPIO_SYNC));
-   return ret;
+   return !gpio_get_value(SPITZ_GPIO_KEY_INT) ||
+   gpio_get_value(SPITZ_GPIO_SYNC);
 }
 
 unsigned long spitzpm_read_devdata(int type)

[PATCH 4.8 072/125] staging: ks7010: fix wait_for_completion_interruptible_timeout return handling

[Greg Kroah-Hartman]

4.8-stable review patch.  If anyone has any objections, please let me know.

--

From: Nicholas Mc Guire 

commit 9d29f14db1095f52ca00b8162b242d6fce07d19f upstream.

wait_for_completion_interruptible_timeout return 0 on timeout and
-ERESTARTSYS if interrupted. The check for
!wait_for_completion_interruptible_timeout() would report an interrupt
as timeout. Further, while HZ/50 will work most of the time it could
fail for HZ < 50, so this is switched to msecs_to_jiffies(20).

Fixes: 13a9930d15b4 ("staging: ks7010: add driver from Nanonote 
extra-repository")

Signed-off-by: Nicholas Mc Guire 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/staging/ks7010/ks_hostif.c |8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/staging/ks7010/ks_hostif.c
+++ b/drivers/staging/ks7010/ks_hostif.c
@@ -74,11 +74,15 @@ void ks_wlan_hw_wakeup_task(struct work_
struct ks_wlan_private *priv =
container_of(work, struct ks_wlan_private, ks_wlan_wakeup_task);
int ps_status = atomic_read(>psstatus.status);
+   long time_left;
 
if (ps_status == PS_SNOOZE) {
ks_wlan_hw_wakeup_request(priv);
-   if 
(!wait_for_completion_interruptible_timeout(>psstatus.wakeup_wait, HZ / 
50)) { /* 20ms timeout */
-   DPRINTK(1, "wake up timeout !!!\n");
+   time_left = wait_for_completion_interruptible_timeout(
+   >psstatus.wakeup_wait,
+   msecs_to_jiffies(20));
+   if (time_left <= 0) {
+   DPRINTK(1, "wake up timeout or interrupted !!!\n");
schedule_work(>ks_wlan_wakeup_task);
return;
}