[PATCH AUTOSEL for 4.9 03/50] PCI: mvebu: Handle changes to the bridge windows while enabled

[Levin, Alexander (Sasha Levin)]

From: Jason Gunthorpe 

[ Upstream commit d9bf28e2650fe3eeefed7e34841aea07d10c6543 ]

The PCI core will write to the bridge window config multiple times while
they are enabled.  This can lead to mbus failures like this:

 mvebu_mbus: cannot add window '4:e8', conflicts with another window
 mvebu-pcie mbus:pex@e000: Could not create MBus window at [mem 
0xe000-0xe00f]: -22

For me this is happening during a hotplug cycle.  The PCI core is not
changing the values, just writing them twice while active.

The patch addresses the general case of any change to an active window, but
not atomically.  The code is slightly refactored so io and mem can share
more of the window logic.

Signed-off-by: Jason Gunthorpe 
Signed-off-by: Bjorn Helgaas 
Acked-by: Jason Cooper 
Signed-off-by: Sasha Levin 
---
 drivers/pci/host/pci-mvebu.c | 101 +--
 1 file changed, 60 insertions(+), 41 deletions(-)

diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c
index 45a89d969700..90e0b6f134ad 100644
--- a/drivers/pci/host/pci-mvebu.c
+++ b/drivers/pci/host/pci-mvebu.c
@@ -133,6 +133,12 @@ struct mvebu_pcie {
int nports;
 };
 
+struct mvebu_pcie_window {
+   phys_addr_t base;
+   phys_addr_t remap;
+   size_t size;
+};
+
 /* Structure representing one PCIe interface */
 struct mvebu_pcie_port {
char *name;
@@ -150,10 +156,8 @@ struct mvebu_pcie_port {
struct mvebu_sw_pci_bridge bridge;
struct device_node *dn;
struct mvebu_pcie *pcie;
-   phys_addr_t memwin_base;
-   size_t memwin_size;
-   phys_addr_t iowin_base;
-   size_t iowin_size;
+   struct mvebu_pcie_window memwin;
+   struct mvebu_pcie_window iowin;
u32 saved_pcie_stat;
 };
 
@@ -379,23 +383,45 @@ static void mvebu_pcie_add_windows(struct mvebu_pcie_port 
*port,
}
 }
 
+static void mvebu_pcie_set_window(struct mvebu_pcie_port *port,
+ unsigned int target, unsigned int attribute,
+ const struct mvebu_pcie_window *desired,
+ struct mvebu_pcie_window *cur)
+{
+   if (desired->base == cur->base && desired->remap == cur->remap &&
+   desired->size == cur->size)
+   return;
+
+   if (cur->size != 0) {
+   mvebu_pcie_del_windows(port, cur->base, cur->size);
+   cur->size = 0;
+   cur->base = 0;
+
+   /*
+* If something tries to change the window while it is enabled
+* the change will not be done atomically. That would be
+* difficult to do in the general case.
+*/
+   }
+
+   if (desired->size == 0)
+   return;
+
+   mvebu_pcie_add_windows(port, target, attribute, desired->base,
+  desired->size, desired->remap);
+   *cur = *desired;
+}
+
 static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port)
 {
-   phys_addr_t iobase;
+   struct mvebu_pcie_window desired = {};
 
/* Are the new iobase/iolimit values invalid? */
if (port->bridge.iolimit < port->bridge.iobase ||
port->bridge.iolimitupper < port->bridge.iobaseupper ||
!(port->bridge.command & PCI_COMMAND_IO)) {
-
-   /* If a window was configured, remove it */
-   if (port->iowin_base) {
-   mvebu_pcie_del_windows(port, port->iowin_base,
-  port->iowin_size);
-   port->iowin_base = 0;
-   port->iowin_size = 0;
-   }
-
+   mvebu_pcie_set_window(port, port->io_target, port->io_attr,
+ &desired, &port->iowin);
return;
}
 
@@ -412,32 +438,27 @@ static void mvebu_pcie_handle_iobase_change(struct 
mvebu_pcie_port *port)
 * specifications. iobase is the bus address, port->iowin_base
 * is the CPU address.
 */
-   iobase = ((port->bridge.iobase & 0xF0) << 8) |
-   (port->bridge.iobaseupper << 16);
-   port->iowin_base = port->pcie->io.start + iobase;
-   port->iowin_size = ((0xFFF | ((port->bridge.iolimit & 0xF0) << 8) |
-   (port->bridge.iolimitupper << 16)) -
-   iobase) + 1;
-
-   mvebu_pcie_add_windows(port, port->io_target, port->io_attr,
-  port->iowin_base, port->iowin_size,
-  iobase);
+   desired.remap = ((port->bridge.iobase & 0xF0) << 8) |
+   (port->bridge.iobaseupper << 16);
+   desired.base = port->pcie->io.start + desired.remap;
+   desired.size = ((0xFFF | ((port->bridge.iolimit & 0xF0) << 8) |
+(port->bridge.iolimitupper << 16)) -
+   desired.remap) +
+  1;
+
+

[PATCH AUTOSEL for 4.9 04/50] sched/core: Add missing update_rq_clock() call in sched_move_task()

[Levin, Alexander (Sasha Levin)]

From: Peter Zijlstra 

[ Upstream commit 1b1d62254df0fe42a711eb71948f915918987790 ]

Bug was noticed via this warning:

  WARNING: CPU: 6 PID: 1 at kernel/sched/sched.h:804 
detach_task_cfs_rq+0x8e8/0xb80
  rq->clock_update_flags < RQCF_ACT_SKIP
  Modules linked in:
  CPU: 6 PID: 1 Comm: systemd Not tainted 4.10.0-rc5-00140-g0874170baf55-dirty 
#1
  Hardware name: Supermicro SYS-4048B-TRFT/X10QBi, BIOS 1.0 04/11/2014
  Call Trace:
   dump_stack+0x4d/0x65
   __warn+0xcb/0xf0
   warn_slowpath_fmt+0x5f/0x80
   detach_task_cfs_rq+0x8e8/0xb80
   ? allocate_cgrp_cset_links+0x59/0x80
   task_change_group_fair+0x27/0x150
   sched_change_group+0x48/0xf0
   sched_move_task+0x53/0x150
   cpu_cgroup_attach+0x36/0x70
   cgroup_taskset_migrate+0x175/0x300
   cgroup_migrate+0xab/0xd0
   cgroup_attach_task+0xf0/0x190
   __cgroup_procs_write+0x1ed/0x2f0
   cgroup_procs_write+0x14/0x20
   cgroup_file_write+0x3f/0x100
   kernfs_fop_write+0x104/0x180
   __vfs_write+0x37/0x140
   vfs_write+0xb8/0x1b0
   SyS_write+0x55/0xc0
   do_syscall_64+0x61/0x170
   entry_SYSCALL64_slow_path+0x25/0x25

Reported-by: Ingo Molnar 
Reported-by: Borislav Petkov 
Signed-off-by: Peter Zijlstra (Intel) 
Cc: Linus Torvalds 
Cc: Mike Galbraith 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Signed-off-by: Ingo Molnar 
Signed-off-by: Sasha Levin 
---
 kernel/sched/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 02e7ad860b52..78181c03d9c7 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -7961,6 +7961,7 @@ void sched_move_task(struct task_struct *tsk)
struct rq *rq;
 
rq = task_rq_lock(tsk, &rf);
+   update_rq_clock(rq);
 
running = task_current(rq, tsk);
queued = task_on_rq_queued(tsk);
-- 
2.11.0

[PATCH AUTOSEL for 4.9 08/50] EDAC, amd64: Add x86cpuid sanity check during init

[Levin, Alexander (Sasha Levin)]

From: Yazen Ghannam 

[ Upstream commit 1bd9900b8301fc505f032c90ea487824cf824e99 ]

Match one of the devices in amd64_cpuids[] before loading the module.
This is an additional sanity check against users trying to load
amd64_edac_mod on unsupported systems.

Signed-off-by: Yazen Ghannam 
Cc: linux-edac 
Link: 
http://lkml.kernel.org/r/1485537863-2707-9-git-send-email-yazen.ghan...@amd.com
[ Get rid of err_ret label, make it a bit more readable this way. ]
Signed-off-by: Borislav Petkov 

Signed-off-by: Sasha Levin 
---
 drivers/edac/amd64_edac.c | 6 --
 drivers/edac/amd64_edac.h | 1 +
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index ee181c53626f..431e5d7de215 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -2984,8 +2984,11 @@ static int __init amd64_edac_init(void)
int err = -ENODEV;
int i;
 
+   if (!x86_match_cpu(amd64_cpuids))
+   return -ENODEV;
+
if (amd_cache_northbridges() < 0)
-   goto err_ret;
+   return -ENODEV;
 
opstate_init();
 
@@ -3025,7 +3028,6 @@ err_free:
kfree(ecc_stngs);
ecc_stngs = NULL;
 
-err_ret:
return err;
 }
 
diff --git a/drivers/edac/amd64_edac.h b/drivers/edac/amd64_edac.h
index c08870479054..dcb5f9481735 100644
--- a/drivers/edac/amd64_edac.h
+++ b/drivers/edac/amd64_edac.h
@@ -16,6 +16,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include "edac_core.h"
 #include "mce_amd.h"
-- 
2.11.0

[PATCH AUTOSEL for 4.9 19/50] crypto: vmx - disable preemption to enable vsx in aes_ctr.c

[Levin, Alexander (Sasha Levin)]

From: Li Zhong 

[ Upstream commit 7dede913fc2ab9c0d3bff3a49e26fa9e858b0c13 ]

Some preemptible check warnings were reported from enable_kernel_vsx(). This
patch disables preemption in aes_ctr.c before enabling vsx, and they are now
consistent with other files in the same directory.

Signed-off-by: Li Zhong 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin 
---
 drivers/crypto/vmx/aes_ctr.c | 6 ++
 1 file changed, 6 insertions(+)

diff --git a/drivers/crypto/vmx/aes_ctr.c b/drivers/crypto/vmx/aes_ctr.c
index 38ed10d761d0..7cf6d31c1123 100644
--- a/drivers/crypto/vmx/aes_ctr.c
+++ b/drivers/crypto/vmx/aes_ctr.c
@@ -80,11 +80,13 @@ static int p8_aes_ctr_setkey(struct crypto_tfm *tfm, const 
u8 *key,
int ret;
struct p8_aes_ctr_ctx *ctx = crypto_tfm_ctx(tfm);
 
+   preempt_disable();
pagefault_disable();
enable_kernel_vsx();
ret = aes_p8_set_encrypt_key(key, keylen * 8, &ctx->enc_key);
disable_kernel_vsx();
pagefault_enable();
+   preempt_enable();
 
ret += crypto_blkcipher_setkey(ctx->fallback, key, keylen);
return ret;
@@ -99,11 +101,13 @@ static void p8_aes_ctr_final(struct p8_aes_ctr_ctx *ctx,
u8 *dst = walk->dst.virt.addr;
unsigned int nbytes = walk->nbytes;
 
+   preempt_disable();
pagefault_disable();
enable_kernel_vsx();
aes_p8_encrypt(ctrblk, keystream, &ctx->enc_key);
disable_kernel_vsx();
pagefault_enable();
+   preempt_enable();
 
crypto_xor(keystream, src, nbytes);
memcpy(dst, keystream, nbytes);
@@ -132,6 +136,7 @@ static int p8_aes_ctr_crypt(struct blkcipher_desc *desc,
blkcipher_walk_init(&walk, dst, src, nbytes);
ret = blkcipher_walk_virt_block(desc, &walk, AES_BLOCK_SIZE);
while ((nbytes = walk.nbytes) >= AES_BLOCK_SIZE) {
+   preempt_disable();
pagefault_disable();
enable_kernel_vsx();
aes_p8_ctr32_encrypt_blocks(walk.src.virt.addr,
@@ -143,6 +148,7 @@ static int p8_aes_ctr_crypt(struct blkcipher_desc *desc,
walk.iv);
disable_kernel_vsx();
pagefault_enable();
+   preempt_enable();
 
/* We need to update IV mostly for last bytes/round */
inc = (nbytes & AES_BLOCK_MASK) / AES_BLOCK_SIZE;
-- 
2.11.0

[PATCH AUTOSEL for 4.9 18/50] arm64: dma-mapping: Only swizzle DMA ops for IOMMU_DOMAIN_DMA

[Levin, Alexander (Sasha Levin)]

From: Will Deacon 

[ Upstream commit 4a8d8a14c0d08c2437cb80c05e88f6cc1ca3fb2c ]

The arm64 DMA-mapping implementation sets the DMA ops to the IOMMU DMA
ops if we detect that an IOMMU is present for the master and the DMA
ranges are valid.

In the case when the IOMMU domain for the device is not of type
IOMMU_DOMAIN_DMA, then we have no business swizzling the ops, since
we're not in control of the underlying address space. This patch leaves
the DMA ops alone for masters attached to non-DMA IOMMU domains.

Reviewed-by: Robin Murphy 
Signed-off-by: Will Deacon 
Signed-off-by: Sasha Levin 
---
 arch/arm64/mm/dma-mapping.c | 17 -
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index b5bf46ce873b..cab3574ab7d9 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -836,14 +836,21 @@ static bool do_iommu_attach(struct device *dev, const 
struct iommu_ops *ops,
 * then the IOMMU core will have already configured a group for this
 * device, and allocated the default domain for that group.
 */
-   if (!domain || iommu_dma_init_domain(domain, dma_base, size, dev)) {
-   pr_warn("Failed to set up IOMMU for device %s; retaining 
platform DMA ops\n",
-   dev_name(dev));
-   return false;
+   if (!domain)
+   goto out_err;
+
+   if (domain->type == IOMMU_DOMAIN_DMA) {
+   if (iommu_dma_init_domain(domain, dma_base, size, dev))
+   goto out_err;
+
+   dev->archdata.dma_ops = &iommu_dma_ops;
}
 
-   dev->archdata.dma_ops = &iommu_dma_ops;
return true;
+out_err:
+   pr_warn("Failed to set up IOMMU for device %s; retaining platform DMA 
ops\n",
+dev_name(dev));
+   return false;
 }
 
 static void queue_iommu_attach(struct device *dev, const struct iommu_ops *ops,
-- 
2.11.0

[PATCH AUTOSEL for 4.9 14/50] pinctrl: baytrail: Fix debugfs offset output

[Levin, Alexander (Sasha Levin)]

From: Alexander Stein 

[ Upstream commit 3655a1ca6bd8e7300f2bb196208d5139aa6b2eda ]

Apparently each GPIO pad's register are 16 bytes, so multiply the pad_map
by that. The same is done in byt_gpio_reg the only other place where
pad_map is used.

Signed-off-by: Alexander Stein 
Signed-off-by: Linus Walleij 
Signed-off-by: Sasha Levin 
---
 drivers/pinctrl/intel/pinctrl-baytrail.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c 
b/drivers/pinctrl/intel/pinctrl-baytrail.c
index 5419de8e20b1..0a965026b134 100644
--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -1466,7 +1466,7 @@ static void byt_gpio_dbg_show(struct seq_file *s, struct 
gpio_chip *chip)
   val & BYT_INPUT_EN ? "  " : "in",
   val & BYT_OUTPUT_EN ? "   " : "out",
   val & BYT_LEVEL ? "hi" : "lo",
-  comm->pad_map[i], comm->pad_map[i] * 32,
+  comm->pad_map[i], comm->pad_map[i] * 16,
   conf0 & 0x7,
   conf0 & BYT_TRIG_NEG ? " fall" : " ",
   conf0 & BYT_TRIG_POS ? " rise" : " ",
-- 
2.11.0

[PATCH AUTOSEL for 4.9 27/50] dt-bindings: Add vendor prefix for LEGO

[Levin, Alexander (Sasha Levin)]

From: David Lechner 

[ Upstream commit 7dcc31e2e68a386a29070384b51683ece80982bf ]

Add a vendor prefix for LEGO Systems A/S

Acked-by: Rob Herring 
Signed-off-by: David Lechner 
Signed-off-by: Sekhar Nori 
Signed-off-by: Sasha Levin 
---
 Documentation/devicetree/bindings/vendor-prefixes.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt 
b/Documentation/devicetree/bindings/vendor-prefixes.txt
index bceb7502..f949a22bcd74 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -154,6 +154,7 @@ kosagi  Sutajio Ko-Usagi PTE Ltd.
 kyoKyocera Corporation
 lacie  LaCie
 lantiq Lantiq Semiconductor
+lego   LEGO Systems A/S
 lenovo Lenovo Group Ltd.
 lg LG Corporation
 linux  Linux-specific binding
-- 
2.11.0

[PATCH AUTOSEL for 4.9 17/50] ARM: omap2plus_defconfig: Fix probe errors on UARTs 5 and 6

[Levin, Alexander (Sasha Levin)]

From: Tony Lindgren 

[ Upstream commit 4cd6a59f5c1a9b0cca0da09fbba42b9450ffc899 ]

We have more than four uarts on some SoCs and that can cause
noise with errors while booting.

Signed-off-by: Tony Lindgren 
Signed-off-by: Sasha Levin 
---
 arch/arm/configs/omap2plus_defconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/configs/omap2plus_defconfig 
b/arch/arm/configs/omap2plus_defconfig
index 53e1a884a1ea..66d71963761d 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -216,6 +216,7 @@ CONFIG_SERIO=m
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=32
+CONFIG_SERIAL_8250_RUNTIME_UARTS=6
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_MANY_PORTS=y
 CONFIG_SERIAL_8250_SHARE_IRQ=y
-- 
2.11.0

[PATCH AUTOSEL for 4.9 22/50] iio: pressure: ms5611: claim direct mode during oversampling changes

[Levin, Alexander (Sasha Levin)]

From: Alison Schofield 

[ Upstream commit 3bc1abcddb24f55b9c251e03caa4f9bd22ff748b ]

Driver was checking for direct mode before changing oversampling
ratios, but was not locking it.  Use the claim/release helper
functions to guarantee the device stays in direct mode while the
oversampling ratios are being updated.  Continue to use the drivers
private state lock to protect against conflicting direct mode access
of the state data.

Signed-off-by: Alison Schofield 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Sasha Levin 
---
 drivers/iio/pressure/ms5611_core.c | 12 +++-
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/iio/pressure/ms5611_core.c 
b/drivers/iio/pressure/ms5611_core.c
index a74ed1f0c880..8cc7156b5ace 100644
--- a/drivers/iio/pressure/ms5611_core.c
+++ b/drivers/iio/pressure/ms5611_core.c
@@ -308,6 +308,7 @@ static int ms5611_write_raw(struct iio_dev *indio_dev,
 {
struct ms5611_state *st = iio_priv(indio_dev);
const struct ms5611_osr *osr = NULL;
+   int ret;
 
if (mask != IIO_CHAN_INFO_OVERSAMPLING_RATIO)
return -EINVAL;
@@ -321,12 +322,11 @@ static int ms5611_write_raw(struct iio_dev *indio_dev,
if (!osr)
return -EINVAL;
 
-   mutex_lock(&st->lock);
+   ret = iio_device_claim_direct_mode(indio_dev);
+   if (ret)
+   return ret;
 
-   if (iio_buffer_enabled(indio_dev)) {
-   mutex_unlock(&st->lock);
-   return -EBUSY;
-   }
+   mutex_lock(&st->lock);
 
if (chan->type == IIO_TEMP)
st->temp_osr = osr;
@@ -334,6 +334,8 @@ static int ms5611_write_raw(struct iio_dev *indio_dev,
st->pressure_osr = osr;
 
mutex_unlock(&st->lock);
+   iio_device_release_direct_mode(indio_dev);
+
return 0;
 }
 
-- 
2.11.0

[PATCH AUTOSEL for 4.9 09/50] PM / OPP: Error out on failing to add static OPPs for v1 bindings

[Levin, Alexander (Sasha Levin)]

From: Viresh Kumar 

[ Upstream commit 04a86a84c42ca18f37ab446127dc619b41dd3b23 ]

The code adding static OPPs for V2 bindings already does so. Make the V1
bindings specific code behave the same.

Signed-off-by: Viresh Kumar 
Reviewed-by: Stephen Boyd 
Signed-off-by: Rafael J. Wysocki 
Signed-off-by: Sasha Levin 
---
 drivers/base/power/opp/of.c | 12 
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/base/power/opp/of.c b/drivers/base/power/opp/of.c
index 5552211e6fcd..b52c617947ad 100644
--- a/drivers/base/power/opp/of.c
+++ b/drivers/base/power/opp/of.c
@@ -386,7 +386,7 @@ static int _of_add_opp_table_v1(struct device *dev)
 {
const struct property *prop;
const __be32 *val;
-   int nr;
+   int nr, ret;
 
prop = of_find_property(dev->of_node, "operating-points", NULL);
if (!prop)
@@ -409,9 +409,13 @@ static int _of_add_opp_table_v1(struct device *dev)
unsigned long freq = be32_to_cpup(val++) * 1000;
unsigned long volt = be32_to_cpup(val++);
 
-   if (_opp_add_v1(dev, freq, volt, false))
-   dev_warn(dev, "%s: Failed to add OPP %ld\n",
-__func__, freq);
+   ret = _opp_add_v1(dev, freq, volt, false);
+   if (ret) {
+   dev_err(dev, "%s: Failed to add OPP %ld (%d)\n",
+   __func__, freq, ret);
+   dev_pm_opp_of_remove_table(dev);
+   return ret;
+   }
nr -= 2;
}
 
-- 
2.11.0

[PATCH AUTOSEL for 4.9 32/50] netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev family

[Levin, Alexander (Sasha Levin)]

From: Liping Zhang 

[ Upstream commit f169fd695b192dd7b23aff8e69d25a1bc881bbfa ]

After adding the following nft rule, then ping 224.0.0.1:
  # nft add rule netdev t c pkttype host counter

The warning complain message will be printed out again and again:
  WARNING: CPU: 0 PID: 10182 at net/netfilter/nft_meta.c:163 \
   nft_meta_get_eval+0x3fe/0x460 [nft_meta]
  [...]
  Call Trace:
  
  dump_stack+0x85/0xc2
  __warn+0xcb/0xf0
  warn_slowpath_null+0x1d/0x20
  nft_meta_get_eval+0x3fe/0x460 [nft_meta]
  nft_do_chain+0xff/0x5e0 [nf_tables]

So we should deal with PACKET_LOOPBACK in netdev family too. For ipv4,
convert it to PACKET_BROADCAST/MULTICAST according to the destination
address's type; For ipv6, convert it to PACKET_MULTICAST directly.

Signed-off-by: Liping Zhang 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Sasha Levin 
---
 net/netfilter/nft_meta.c | 28 +++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 6c1e0246706e..7c3395513ff0 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -159,8 +159,34 @@ void nft_meta_get_eval(const struct nft_expr *expr,
else
*dest = PACKET_BROADCAST;
break;
+   case NFPROTO_NETDEV:
+   switch (skb->protocol) {
+   case htons(ETH_P_IP): {
+   int noff = skb_network_offset(skb);
+   struct iphdr *iph, _iph;
+
+   iph = skb_header_pointer(skb, noff,
+sizeof(_iph), &_iph);
+   if (!iph)
+   goto err;
+
+   if (ipv4_is_multicast(iph->daddr))
+   *dest = PACKET_MULTICAST;
+   else
+   *dest = PACKET_BROADCAST;
+
+   break;
+   }
+   case htons(ETH_P_IPV6):
+   *dest = PACKET_MULTICAST;
+   break;
+   default:
+   WARN_ON_ONCE(1);
+   goto err;
+   }
+   break;
default:
-   WARN_ON(1);
+   WARN_ON_ONCE(1);
goto err;
}
break;
-- 
2.11.0

[PATCH AUTOSEL for 4.4 01/25] [media] adv7604: Initialize drive strength to default when using DT

[Levin, Alexander (Sasha Levin)]

From: Lars-Peter Clausen 

[ Upstream commit da8892d410db224d9a24104529794e6e37e0c100 ]

The adv7604 driver platform data contains fields for configuring the drive
strength of the output pins. When probing the driver through DT these
fields are not explicitly initialized, which means they are left at 0. This
is a reserved setting for the drive strength configuration though and can
cause signal integrity issues.

Whether these signal integrity issues are visible depends on the PCB
specifics (e.g. the higher the load capacitance for the output the more
visible the issue). But it has been observed on existing solutions at high
pixel clock rates.

Initialize the drive strength settings to the power-on-reset value of the
device when probing through devicetree to avoid this issue.

Fixes: 0e158be0162b ("adv7604: Add DT support")

Signed-off-by: Lars-Peter Clausen 
Reviewed-by: Laurent Pinchart 
Tested-by: Niklas Söderlund 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin 
---
 drivers/media/i2c/adv7604.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
index 01adcdc52346..a9e2722f5e22 100644
--- a/drivers/media/i2c/adv7604.c
+++ b/drivers/media/i2c/adv7604.c
@@ -2856,6 +2856,9 @@ static int adv76xx_parse_dt(struct adv76xx_state *state)
state->pdata.alt_data_sat = 1;
state->pdata.op_format_mode_sel = ADV7604_OP_FORMAT_MODE0;
state->pdata.bus_order = ADV7604_BUS_ORDER_RGB;
+   state->pdata.dr_str_data = ADV76XX_DR_STR_MEDIUM_HIGH;
+   state->pdata.dr_str_clk = ADV76XX_DR_STR_MEDIUM_HIGH;
+   state->pdata.dr_str_sync = ADV76XX_DR_STR_MEDIUM_HIGH;
 
return 0;
 }
-- 
2.11.0

[PATCH AUTOSEL for 4.4 09/25] iommu/arm-smmu-v3: Clear prior settings when updating STEs

[Levin, Alexander (Sasha Levin)]

From: Nate Watterson 

[ Upstream commit 810871c57011eb3e89e6768932757f169d666cd2 ]

To prevent corruption of the stage-1 context pointer field when
updating STEs, rebuild the entire containing dword instead of
clearing individual fields.

Signed-off-by: Nate Watterson 
Signed-off-by: Will Deacon 
Signed-off-by: Sasha Levin 
---
 drivers/iommu/arm-smmu-v3.c | 10 ++
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index 00df3832faab..64f1eb8fdcbc 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -1033,13 +1033,8 @@ static void arm_smmu_write_strtab_ent(struct 
arm_smmu_device *smmu, u32 sid,
}
}
 
-   /* Nuke the existing Config, as we're going to rewrite it */
-   val &= ~(STRTAB_STE_0_CFG_MASK << STRTAB_STE_0_CFG_SHIFT);
-
-   if (ste->valid)
-   val |= STRTAB_STE_0_V;
-   else
-   val &= ~STRTAB_STE_0_V;
+   /* Nuke the existing STE_0 value, as we're going to rewrite it */
+   val = ste->valid ? STRTAB_STE_0_V : 0;
 
if (ste->bypass) {
val |= disable_bypass ? STRTAB_STE_0_CFG_ABORT
@@ -1068,7 +1063,6 @@ static void arm_smmu_write_strtab_ent(struct 
arm_smmu_device *smmu, u32 sid,
val |= (ste->s1_cfg->cdptr_dma & STRTAB_STE_0_S1CTXPTR_MASK
<< STRTAB_STE_0_S1CTXPTR_SHIFT) |
STRTAB_STE_0_CFG_S1_TRANS;
-
}
 
if (ste->s2_cfg) {
-- 
2.11.0

[PATCH AUTOSEL for 4.9 45/50] s390/qeth: fix retrieval of vipa and proxy-arp addresses

[Levin, Alexander (Sasha Levin)]

From: Ursula Braun 

[ Upstream commit e48b9eaaa29a0a7d5da2df136b07eefa0180d584 ]

qeth devices in layer3 mode need a separate handling of vipa and proxy-arp
addresses. vipa and proxy-arp addresses processed by qeth can be read from
userspace. Introduced with commit 5f78e29ceebf ("qeth: optimize IP handling
in rx_mode callback") the retrieval of vipa and proxy-arp addresses is
broken, if more than one vipa or proxy-arp address are set.

The qeth code used local variable "int i" for 2 different purposes. This
patch now spends 2 separate local variables of type "int".
While touching these functions hash_for_each_safe() is converted to
hash_for_each(), since there is no removal of hash entries.

Signed-off-by: Ursula Braun 
Reviewed-by: Julian Wiedmann 
Reference-ID: RQM 3524
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/s390/net/qeth_l3_sys.c | 30 --
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c
index 0e00a5ce0f00..cffe42f5775d 100644
--- a/drivers/s390/net/qeth_l3_sys.c
+++ b/drivers/s390/net/qeth_l3_sys.c
@@ -692,15 +692,15 @@ static ssize_t qeth_l3_dev_vipa_add_show(char *buf, 
struct qeth_card *card,
enum qeth_prot_versions proto)
 {
struct qeth_ipaddr *ipaddr;
-   struct hlist_node  *tmp;
char addr_str[40];
+   int str_len = 0;
int entry_len; /* length of 1 entry string, differs between v4 and v6 */
-   int i = 0;
+   int i;
 
entry_len = (proto == QETH_PROT_IPV4)? 12 : 40;
entry_len += 2; /* \n + terminator */
spin_lock_bh(&card->ip_lock);
-   hash_for_each_safe(card->ip_htable, i, tmp, ipaddr, hnode) {
+   hash_for_each(card->ip_htable, i, ipaddr, hnode) {
if (ipaddr->proto != proto)
continue;
if (ipaddr->type != QETH_IP_TYPE_VIPA)
@@ -708,16 +708,17 @@ static ssize_t qeth_l3_dev_vipa_add_show(char *buf, 
struct qeth_card *card,
/* String must not be longer than PAGE_SIZE. So we check if
 * string length gets near PAGE_SIZE. Then we can savely display
 * the next IPv6 address (worst case, compared to IPv4) */
-   if ((PAGE_SIZE - i) <= entry_len)
+   if ((PAGE_SIZE - str_len) <= entry_len)
break;
qeth_l3_ipaddr_to_string(proto, (const u8 *)&ipaddr->u,
addr_str);
-   i += snprintf(buf + i, PAGE_SIZE - i, "%s\n", addr_str);
+   str_len += snprintf(buf + str_len, PAGE_SIZE - str_len, "%s\n",
+   addr_str);
}
spin_unlock_bh(&card->ip_lock);
-   i += snprintf(buf + i, PAGE_SIZE - i, "\n");
+   str_len += snprintf(buf + str_len, PAGE_SIZE - str_len, "\n");
 
-   return i;
+   return str_len;
 }
 
 static ssize_t qeth_l3_dev_vipa_add4_show(struct device *dev,
@@ -854,15 +855,15 @@ static ssize_t qeth_l3_dev_rxip_add_show(char *buf, 
struct qeth_card *card,
   enum qeth_prot_versions proto)
 {
struct qeth_ipaddr *ipaddr;
-   struct hlist_node *tmp;
char addr_str[40];
+   int str_len = 0;
int entry_len; /* length of 1 entry string, differs between v4 and v6 */
-   int i = 0;
+   int i;
 
entry_len = (proto == QETH_PROT_IPV4)? 12 : 40;
entry_len += 2; /* \n + terminator */
spin_lock_bh(&card->ip_lock);
-   hash_for_each_safe(card->ip_htable, i, tmp, ipaddr, hnode) {
+   hash_for_each(card->ip_htable, i, ipaddr, hnode) {
if (ipaddr->proto != proto)
continue;
if (ipaddr->type != QETH_IP_TYPE_RXIP)
@@ -870,16 +871,17 @@ static ssize_t qeth_l3_dev_rxip_add_show(char *buf, 
struct qeth_card *card,
/* String must not be longer than PAGE_SIZE. So we check if
 * string length gets near PAGE_SIZE. Then we can savely display
 * the next IPv6 address (worst case, compared to IPv4) */
-   if ((PAGE_SIZE - i) <= entry_len)
+   if ((PAGE_SIZE - str_len) <= entry_len)
break;
qeth_l3_ipaddr_to_string(proto, (const u8 *)&ipaddr->u,
addr_str);
-   i += snprintf(buf + i, PAGE_SIZE - i, "%s\n", addr_str);
+   str_len += snprintf(buf + str_len, PAGE_SIZE - str_len, "%s\n",
+   addr_str);
}
spin_unlock_bh(&card->ip_lock);
-   i += snprintf(buf + i, PAGE_SIZE - i, "\n");
+   str_len += snprintf(buf + str_len, PAGE_SIZE - str_len, "\n");
 
-   return i;
+   return str_len;
 }
 
 static ssize_t qeth_l3_dev_rxip_add4_show(struct device *dev,
-- 
2.11.0

[PATCH AUTOSEL for 4.4 05/25] ARM: dts: imx53-qsb-common: fix FEC pinmux config

[Levin, Alexander (Sasha Levin)]

From: Patrick Bruenn 

[ Upstream commit 8b649e426336d7d4800ff9c82858328f4215ba01 ]

The pinmux configuration in device tree was different from manual
muxing in /board/freescale/mx53loco/mx53loco.c
All pins were configured as NO_PAD_CTL(1 << 31), which was fine as the
bootloader already did the correct pinmuxing for us.
But recently u-boot is migrating to reuse device tree files from the
kernel tree, so it seems to be better to have the correct pinmuxing in
our files, too.

Signed-off-by: Patrick Bruenn 
Signed-off-by: Shawn Guo 
Signed-off-by: Sasha Levin 
---
 arch/arm/boot/dts/imx53-qsb-common.dtsi | 20 ++--
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/arch/arm/boot/dts/imx53-qsb-common.dtsi 
b/arch/arm/boot/dts/imx53-qsb-common.dtsi
index 53fd75c8ffcf..2eeafbf5235f 100644
--- a/arch/arm/boot/dts/imx53-qsb-common.dtsi
+++ b/arch/arm/boot/dts/imx53-qsb-common.dtsi
@@ -215,16 +215,16 @@
 
pinctrl_fec: fecgrp {
fsl,pins = <
-   MX53_PAD_FEC_MDC__FEC_MDC   
0x8000
-   MX53_PAD_FEC_MDIO__FEC_MDIO 
0x8000
-   MX53_PAD_FEC_REF_CLK__FEC_TX_CLK
0x8000
-   MX53_PAD_FEC_RX_ER__FEC_RX_ER   
0x8000
-   MX53_PAD_FEC_CRS_DV__FEC_RX_DV  
0x8000
-   MX53_PAD_FEC_RXD1__FEC_RDATA_1  
0x8000
-   MX53_PAD_FEC_RXD0__FEC_RDATA_0  
0x8000
-   MX53_PAD_FEC_TX_EN__FEC_TX_EN   
0x8000
-   MX53_PAD_FEC_TXD1__FEC_TDATA_1  
0x8000
-   MX53_PAD_FEC_TXD0__FEC_TDATA_0  
0x8000
+   MX53_PAD_FEC_MDC__FEC_MDC   0x4
+   MX53_PAD_FEC_MDIO__FEC_MDIO 0x1fc
+   MX53_PAD_FEC_REF_CLK__FEC_TX_CLK0x180
+   MX53_PAD_FEC_RX_ER__FEC_RX_ER   0x180
+   MX53_PAD_FEC_CRS_DV__FEC_RX_DV  0x180
+   MX53_PAD_FEC_RXD1__FEC_RDATA_1  0x180
+   MX53_PAD_FEC_RXD0__FEC_RDATA_0  0x180
+   MX53_PAD_FEC_TX_EN__FEC_TX_EN   0x4
+   MX53_PAD_FEC_TXD1__FEC_TDATA_1  0x4
+   MX53_PAD_FEC_TXD0__FEC_TDATA_0  0x4
>;
};
 
-- 
2.11.0

[PATCH AUTOSEL for 4.4 07/25] drm: drm_minor_register(): Clean up debugfs on failure

[Levin, Alexander (Sasha Levin)]

From: Noralf Trønnes 

[ Upstream commit a67834f8bfa1e2f48bb27d07b9a552ba7c3af82a ]

Call drm_debugfs_cleanup() in case drm_debugfs_init() fails to
cover for failure in the drm_driver.debugfs_init callback.

Signed-off-by: Noralf Trønnes 
Signed-off-by: Daniel Vetter 
Link: 
http://patchwork.freedesktop.org/patch/msgid/20170126225621.12314-3-nor...@tronnes.org
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/drm_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 7dd6728dd092..ccc2044af831 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -312,7 +312,7 @@ static int drm_minor_register(struct drm_device *dev, 
unsigned int type)
ret = drm_debugfs_init(minor, minor->index, drm_debugfs_root);
if (ret) {
DRM_ERROR("DRM: Failed to initialize /sys/kernel/debug/dri.\n");
-   return ret;
+   goto err_debugfs;
}
 
ret = device_add(minor->kdev);
-- 
2.11.0

[PATCH AUTOSEL for 4.4 06/25] dt-bindings: clockgen: Add compatible string for LS1012A

[Levin, Alexander (Sasha Levin)]

From: Harninder Rai 

[ Upstream commit 73447f68d7b2bc1df870da88b0e21d2bc1afc025 ]

Signed-off-by: Harninder Rai 
Signed-off-by: Bhaskar Upadhaya 
Acked-by: Rob Herring 
Signed-off-by: Shawn Guo 
Signed-off-by: Sasha Levin 
---
 Documentation/devicetree/bindings/clock/qoriq-clock.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Documentation/devicetree/bindings/clock/qoriq-clock.txt 
b/Documentation/devicetree/bindings/clock/qoriq-clock.txt
index 16a3ec433119..1bd2c76396f4 100644
--- a/Documentation/devicetree/bindings/clock/qoriq-clock.txt
+++ b/Documentation/devicetree/bindings/clock/qoriq-clock.txt
@@ -31,6 +31,7 @@ Required properties:
* "fsl,t4240-clockgen"
* "fsl,b4420-clockgen"
* "fsl,b4860-clockgen"
+   * "fsl,ls1012a-clockgen"
* "fsl,ls1021a-clockgen"
Chassis-version clock strings include:
* "fsl,qoriq-clockgen-1.0": for chassis 1.0 clocks
-- 
2.11.0

[PATCH AUTOSEL for 4.4 16/25] phy: increase size of MII_BUS_ID_SIZE and bus_id

[Levin, Alexander (Sasha Levin)]

From: Volodymyr Bendiuga 

[ Upstream commit 4567d686f5c6d955e57a3afa1741944c1e7f4033 ]

Some bus names are pretty long and do not fit into
17 chars. Increase therefore MII_BUS_ID_SIZE and
phy_fixup.bus_id to larger number. Now mii_bus.id
can host larger name.

Signed-off-by: Volodymyr Bendiuga 
Signed-off-by: Magnus Öberg 
Reviewed-by: Andrew Lunn 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 include/linux/phy.h | 8 ++--
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/include/linux/phy.h b/include/linux/phy.h
index b64825d6ad26..5bc4b9d563a9 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -136,11 +136,7 @@ static inline const char *phy_modes(phy_interface_t 
interface)
 /* Used when trying to connect to a specific phy (mii bus id:phy device id) */
 #define PHY_ID_FMT "%s:%02x"
 
-/*
- * Need to be a little smaller than phydev->dev.bus_id to leave room
- * for the ":%02x"
- */
-#define MII_BUS_ID_SIZE(20 - 3)
+#define MII_BUS_ID_SIZE61
 
 /* Or MII_ADDR_C45 into regnum for read/write on mii_bus to enable the 21 bit
IEEE 802.3ae clause 45 addressing mode used by 10GIGE phy chips. */
@@ -599,7 +595,7 @@ struct phy_driver {
 /* A Structure for boards to register fixups with the PHY Lib */
 struct phy_fixup {
struct list_head list;
-   char bus_id[20];
+   char bus_id[MII_BUS_ID_SIZE + 3];
u32 phy_uid;
u32 phy_uid_mask;
int (*run)(struct phy_device *phydev);
-- 
2.11.0

[PATCH AUTOSEL for 3.18 04/15] drm: drm_minor_register(): Clean up debugfs on failure

[Levin, Alexander (Sasha Levin)]

From: Noralf Trønnes 

[ Upstream commit a67834f8bfa1e2f48bb27d07b9a552ba7c3af82a ]

Call drm_debugfs_cleanup() in case drm_debugfs_init() fails to
cover for failure in the drm_driver.debugfs_init callback.

Signed-off-by: Noralf Trønnes 
Signed-off-by: Daniel Vetter 
Link: 
http://patchwork.freedesktop.org/patch/msgid/20170126225621.12314-3-nor...@tronnes.org
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/drm_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index bc3da32d4585..72a71fa72653 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -320,7 +320,7 @@ static int drm_minor_register(struct drm_device *dev, 
unsigned int type)
ret = drm_debugfs_init(minor, minor->index, drm_debugfs_root);
if (ret) {
DRM_ERROR("DRM: Failed to initialize /sys/kernel/debug/dri.\n");
-   return ret;
+   goto err_debugfs;
}
 
ret = device_add(minor->kdev);
-- 
2.11.0

[PATCH AUTOSEL for 4.4 11/25] ARM: omap2plus_defconfig: Fix probe errors on UARTs 5 and 6

[Levin, Alexander (Sasha Levin)]

From: Tony Lindgren 

[ Upstream commit 4cd6a59f5c1a9b0cca0da09fbba42b9450ffc899 ]

We have more than four uarts on some SoCs and that can cause
noise with errors while booting.

Signed-off-by: Tony Lindgren 
Signed-off-by: Sasha Levin 
---
 arch/arm/configs/omap2plus_defconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/configs/omap2plus_defconfig 
b/arch/arm/configs/omap2plus_defconfig
index c5e1943e5427..09ebd37e01e0 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -221,6 +221,7 @@ CONFIG_SERIO=m
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=32
+CONFIG_SERIAL_8250_RUNTIME_UARTS=6
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_MANY_PORTS=y
 CONFIG_SERIAL_8250_SHARE_IRQ=y
-- 
2.11.0

[PATCH AUTOSEL for 4.4 13/25] iio: trigger: free trigger resource correctly

[Levin, Alexander (Sasha Levin)]

From: Alison Schofield 

[ Upstream commit 10e840dfb0b7fc345082dd9e5fff3c1c02e7690e ]

These stand-alone trigger drivers were using iio_trigger_put()
where they should have been using iio_trigger_free().  The
iio_trigger_put() adds a module_put which is bad since they
never did a module_get.

In the sysfs driver, module_get/put's are used as triggers are
added & removed. This extra module_put() occurs on an error path
in the probe routine (probably rare).

In the bfin-timer & interrupt trigger drivers, the module resources
are not explicitly managed, so it's doing a put on something that
was never get'd.  It occurs on the probe error path and on the
remove path (not so rare).

Tested with the sysfs trigger driver.
The bfin & interrupt drivers were build tested & inspected only.

Signed-off-by: Alison Schofield 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Sasha Levin 
---
 drivers/iio/trigger/iio-trig-interrupt.c  | 8 
 drivers/iio/trigger/iio-trig-sysfs.c  | 2 +-
 drivers/staging/iio/trigger/iio-trig-bfin-timer.c | 4 ++--
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/iio/trigger/iio-trig-interrupt.c 
b/drivers/iio/trigger/iio-trig-interrupt.c
index 572bc6f02ca8..e18f12b74610 100644
--- a/drivers/iio/trigger/iio-trig-interrupt.c
+++ b/drivers/iio/trigger/iio-trig-interrupt.c
@@ -58,7 +58,7 @@ static int iio_interrupt_trigger_probe(struct platform_device 
*pdev)
trig_info = kzalloc(sizeof(*trig_info), GFP_KERNEL);
if (!trig_info) {
ret = -ENOMEM;
-   goto error_put_trigger;
+   goto error_free_trigger;
}
iio_trigger_set_drvdata(trig, trig_info);
trig_info->irq = irq;
@@ -83,8 +83,8 @@ error_release_irq:
free_irq(irq, trig);
 error_free_trig_info:
kfree(trig_info);
-error_put_trigger:
-   iio_trigger_put(trig);
+error_free_trigger:
+   iio_trigger_free(trig);
 error_ret:
return ret;
 }
@@ -99,7 +99,7 @@ static int iio_interrupt_trigger_remove(struct 
platform_device *pdev)
iio_trigger_unregister(trig);
free_irq(trig_info->irq, trig);
kfree(trig_info);
-   iio_trigger_put(trig);
+   iio_trigger_free(trig);
 
return 0;
 }
diff --git a/drivers/iio/trigger/iio-trig-sysfs.c 
b/drivers/iio/trigger/iio-trig-sysfs.c
index 3dfab2bc6d69..202e8b89caf2 100644
--- a/drivers/iio/trigger/iio-trig-sysfs.c
+++ b/drivers/iio/trigger/iio-trig-sysfs.c
@@ -174,7 +174,7 @@ static int iio_sysfs_trigger_probe(int id)
return 0;
 
 out2:
-   iio_trigger_put(t->trig);
+   iio_trigger_free(t->trig);
 free_t:
kfree(t);
 out1:
diff --git a/drivers/staging/iio/trigger/iio-trig-bfin-timer.c 
b/drivers/staging/iio/trigger/iio-trig-bfin-timer.c
index 035dd456d7d6..737747354db6 100644
--- a/drivers/staging/iio/trigger/iio-trig-bfin-timer.c
+++ b/drivers/staging/iio/trigger/iio-trig-bfin-timer.c
@@ -259,7 +259,7 @@ out_free_irq:
 out1:
iio_trigger_unregister(st->trig);
 out:
-   iio_trigger_put(st->trig);
+   iio_trigger_free(st->trig);
return ret;
 }
 
@@ -272,7 +272,7 @@ static int iio_bfin_tmr_trigger_remove(struct 
platform_device *pdev)
peripheral_free(st->t->pin);
free_irq(st->irq, st);
iio_trigger_unregister(st->trig);
-   iio_trigger_put(st->trig);
+   iio_trigger_free(st->trig);
 
return 0;
 }
-- 
2.11.0

[PATCH AUTOSEL for 4.4 25/25] net: dsa: select NET_SWITCHDEV

[Levin, Alexander (Sasha Levin)]

From: Vivien Didelot 

[ Upstream commit 3a89eaa65db68bf53bf92dedc60084f810e1779a ]

The support for DSA Ethernet switch chips depends on TCP/IP networking,
thus explicit that HAVE_NET_DSA depends on INET.

DSA uses SWITCHDEV, thus select it instead of depending on it.

Signed-off-by: Vivien Didelot 
Reviewed-by: Andrew Lunn 
Reviewed-by: Florian Fainelli 
Tested-by: Randy Dunlap 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 net/dsa/Kconfig | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/dsa/Kconfig b/net/dsa/Kconfig
index ff7736f7ff42..fc0c09e770e6 100644
--- a/net/dsa/Kconfig
+++ b/net/dsa/Kconfig
@@ -1,12 +1,13 @@
 config HAVE_NET_DSA
def_bool y
-   depends on NETDEVICES && !S390
+   depends on INET && NETDEVICES && !S390
 
 # Drivers must select NET_DSA and the appropriate tagging format
 
 config NET_DSA
tristate "Distributed Switch Architecture"
-   depends on HAVE_NET_DSA && NET_SWITCHDEV
+   depends on HAVE_NET_DSA
+   select NET_SWITCHDEV
select PHYLIB
---help---
  Say Y if you want to enable support for the hardware switches 
supported
-- 
2.11.0

[PATCH AUTOSEL for 4.4 23/25] IB/ipoib: Change list_del to list_del_init in the tx object

[Levin, Alexander (Sasha Levin)]

From: Feras Daoud 

[ Upstream commit 27d41d29c7f093f6f77843624fbb080c1b4a8b9c ]

Since ipoib_cm_tx_start function and ipoib_cm_tx_reap function
belong to different work queues, they can run in parallel.
In this case if ipoib_cm_tx_reap calls list_del and release the
lock, ipoib_cm_tx_start may acquire it and call list_del_init
on the already deleted object.
Changing list_del to list_del_init in ipoib_cm_tx_reap fixes the problem.

Fixes: 839fcaba355a ("IPoIB: Connected mode experimental support")
Signed-off-by: Feras Daoud 
Signed-off-by: Erez Shitrit 
Reviewed-by: Alex Vesker 
Signed-off-by: Leon Romanovsky 
Reviewed-by: Yuval Shaia 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin 
---
 drivers/infiniband/ulp/ipoib/ipoib_cm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c 
b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 2018d24344de..f74b11542603 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1373,7 +1373,7 @@ static void ipoib_cm_tx_reap(struct work_struct *work)
 
while (!list_empty(&priv->cm.reap_list)) {
p = list_entry(priv->cm.reap_list.next, typeof(*p), list);
-   list_del(&p->list);
+   list_del_init(&p->list);
spin_unlock_irqrestore(&priv->lock, flags);
netif_tx_unlock_bh(dev);
ipoib_cm_tx_destroy(p);
-- 
2.11.0

[PATCH AUTOSEL for 3.18 05/15] ARM: omap2plus_defconfig: Fix probe errors on UARTs 5 and 6

[Levin, Alexander (Sasha Levin)]

From: Tony Lindgren 

[ Upstream commit 4cd6a59f5c1a9b0cca0da09fbba42b9450ffc899 ]

We have more than four uarts on some SoCs and that can cause
noise with errors while booting.

Signed-off-by: Tony Lindgren 
Signed-off-by: Sasha Levin 
---
 arch/arm/configs/omap2plus_defconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/configs/omap2plus_defconfig 
b/arch/arm/configs/omap2plus_defconfig
index a0e51bb68b2d..85128b297ec1 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -169,6 +169,7 @@ CONFIG_INPUT_TWL4030_PWRBUTTON=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=32
+CONFIG_SERIAL_8250_RUNTIME_UARTS=6
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_MANY_PORTS=y
 CONFIG_SERIAL_8250_SHARE_IRQ=y
-- 
2.11.0

[PATCH AUTOSEL for 3.18 01/15] video: fbdev: pmag-ba-fb: Remove bad `__init' annotation

[Levin, Alexander (Sasha Levin)]

From: "Maciej W. Rozycki" 

[ Upstream commit 879e5a0df626f39cbb3c61bb90373e56d67012c4 ]

Fix:

WARNING: drivers/video/fbdev/pmag-ba-fb.o(.text+0x308): Section mismatch in 
reference from the function pmagbafb_probe() to the function 
.init.text:pmagbafb_erase_cursor()
The function pmagbafb_probe()
references the function __init pmagbafb_erase_cursor().
This is often because pmagbafb_probe lacks a __init
annotation or the annotation of pmagbafb_erase_cursor is wrong.

-- a fallout from a missed update from commit 9625b51350cc ("VIDEO:
PMAG-BA: Fix section mismatch") and then commit 48c68c4f1b54 ("Drivers:
video: remove __dev* attributes.")

Signed-off-by: Maciej W. Rozycki 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Sasha Levin 
---
 drivers/video/fbdev/pmag-ba-fb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/pmag-ba-fb.c b/drivers/video/fbdev/pmag-ba-fb.c
index 914a52ba8477..77837665ce89 100644
--- a/drivers/video/fbdev/pmag-ba-fb.c
+++ b/drivers/video/fbdev/pmag-ba-fb.c
@@ -129,7 +129,7 @@ static struct fb_ops pmagbafb_ops = {
 /*
  * Turn the hardware cursor off.
  */
-static void __init pmagbafb_erase_cursor(struct fb_info *info)
+static void pmagbafb_erase_cursor(struct fb_info *info)
 {
struct pmagbafb_par *par = info->par;
 
-- 
2.11.0

[PATCH AUTOSEL for 3.18 15/15] IB/ipoib: Change list_del to list_del_init in the tx object

[Levin, Alexander (Sasha Levin)]

From: Feras Daoud 

[ Upstream commit 27d41d29c7f093f6f77843624fbb080c1b4a8b9c ]

Since ipoib_cm_tx_start function and ipoib_cm_tx_reap function
belong to different work queues, they can run in parallel.
In this case if ipoib_cm_tx_reap calls list_del and release the
lock, ipoib_cm_tx_start may acquire it and call list_del_init
on the already deleted object.
Changing list_del to list_del_init in ipoib_cm_tx_reap fixes the problem.

Fixes: 839fcaba355a ("IPoIB: Connected mode experimental support")
Signed-off-by: Feras Daoud 
Signed-off-by: Erez Shitrit 
Reviewed-by: Alex Vesker 
Signed-off-by: Leon Romanovsky 
Reviewed-by: Yuval Shaia 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin 
---
 drivers/infiniband/ulp/ipoib/ipoib_cm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c 
b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index cdf0a78e0c99..d88f8dbe62d9 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1362,7 +1362,7 @@ static void ipoib_cm_tx_reap(struct work_struct *work)
 
while (!list_empty(&priv->cm.reap_list)) {
p = list_entry(priv->cm.reap_list.next, typeof(*p), list);
-   list_del(&p->list);
+   list_del_init(&p->list);
spin_unlock_irqrestore(&priv->lock, flags);
netif_tx_unlock_bh(dev);
ipoib_cm_tx_destroy(p);
-- 
2.11.0

[PATCH AUTOSEL for 3.18 03/15] ARM: dts: imx53-qsb-common: fix FEC pinmux config

[Levin, Alexander (Sasha Levin)]

From: Patrick Bruenn 

[ Upstream commit 8b649e426336d7d4800ff9c82858328f4215ba01 ]

The pinmux configuration in device tree was different from manual
muxing in /board/freescale/mx53loco/mx53loco.c
All pins were configured as NO_PAD_CTL(1 << 31), which was fine as the
bootloader already did the correct pinmuxing for us.
But recently u-boot is migrating to reuse device tree files from the
kernel tree, so it seems to be better to have the correct pinmuxing in
our files, too.

Signed-off-by: Patrick Bruenn 
Signed-off-by: Shawn Guo 
Signed-off-by: Sasha Levin 
---
 arch/arm/boot/dts/imx53-qsb-common.dtsi | 20 ++--
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/arch/arm/boot/dts/imx53-qsb-common.dtsi 
b/arch/arm/boot/dts/imx53-qsb-common.dtsi
index 1f55187ed9ce..53e81589368a 100644
--- a/arch/arm/boot/dts/imx53-qsb-common.dtsi
+++ b/arch/arm/boot/dts/imx53-qsb-common.dtsi
@@ -215,16 +215,16 @@
 
pinctrl_fec: fecgrp {
fsl,pins = <
-   MX53_PAD_FEC_MDC__FEC_MDC   
0x8000
-   MX53_PAD_FEC_MDIO__FEC_MDIO 
0x8000
-   MX53_PAD_FEC_REF_CLK__FEC_TX_CLK
0x8000
-   MX53_PAD_FEC_RX_ER__FEC_RX_ER   
0x8000
-   MX53_PAD_FEC_CRS_DV__FEC_RX_DV  
0x8000
-   MX53_PAD_FEC_RXD1__FEC_RDATA_1  
0x8000
-   MX53_PAD_FEC_RXD0__FEC_RDATA_0  
0x8000
-   MX53_PAD_FEC_TX_EN__FEC_TX_EN   
0x8000
-   MX53_PAD_FEC_TXD1__FEC_TDATA_1  
0x8000
-   MX53_PAD_FEC_TXD0__FEC_TDATA_0  
0x8000
+   MX53_PAD_FEC_MDC__FEC_MDC   0x4
+   MX53_PAD_FEC_MDIO__FEC_MDIO 0x1fc
+   MX53_PAD_FEC_REF_CLK__FEC_TX_CLK0x180
+   MX53_PAD_FEC_RX_ER__FEC_RX_ER   0x180
+   MX53_PAD_FEC_CRS_DV__FEC_RX_DV  0x180
+   MX53_PAD_FEC_RXD1__FEC_RDATA_1  0x180
+   MX53_PAD_FEC_RXD0__FEC_RDATA_0  0x180
+   MX53_PAD_FEC_TX_EN__FEC_TX_EN   0x4
+   MX53_PAD_FEC_TXD1__FEC_TDATA_1  0x4
+   MX53_PAD_FEC_TXD0__FEC_TDATA_0  0x4
>;
};
 
-- 
2.11.0

[PATCH AUTOSEL for 3.18 14/15] Input: mpr121 - set missing event capability

[Levin, Alexander (Sasha Levin)]

From: Akinobu Mita 

[ Upstream commit 9723ddc8fe0d76ce41fe0dc16afb241ec7d0a29d ]

This driver reports misc scan input events on the sensor's status
register changes.  But the event capability for them was not set in the
device initialization, so these events were ignored.

This change adds the missing event capability.

Signed-off-by: Akinobu Mita 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin 
---
 drivers/input/keyboard/mpr121_touchkey.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/input/keyboard/mpr121_touchkey.c 
b/drivers/input/keyboard/mpr121_touchkey.c
index 3dbc7e611791..671d202a94fa 100644
--- a/drivers/input/keyboard/mpr121_touchkey.c
+++ b/drivers/input/keyboard/mpr121_touchkey.c
@@ -235,6 +235,7 @@ static int mpr_touchkey_probe(struct i2c_client *client,
input_dev->id.bustype = BUS_I2C;
input_dev->dev.parent = &client->dev;
input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP);
+   input_set_capability(input_dev, EV_MSC, MSC_SCAN);
 
input_dev->keycode = mpr121->keycodes;
input_dev->keycodesize = sizeof(mpr121->keycodes[0]);
-- 
2.11.0

[PATCH AUTOSEL for 4.4 14/25] dt-bindings: Add LEGO MINDSTORMS EV3 compatible specification

[Levin, Alexander (Sasha Levin)]

From: David Lechner 

[ Upstream commit 21078ab174c99885ca83a5c32db0d33b1617745e ]

This adds the board level device tree specification for LEGO MINDSTORMS EV3

Acked-by: Rob Herring 
Signed-off-by: David Lechner 
Signed-off-by: Sekhar Nori 
Signed-off-by: Sasha Levin 
---
 Documentation/devicetree/bindings/arm/davinci.txt | 4 
 1 file changed, 4 insertions(+)

diff --git a/Documentation/devicetree/bindings/arm/davinci.txt 
b/Documentation/devicetree/bindings/arm/davinci.txt
index cfaeda4274e6..e6f4b50da1f9 100644
--- a/Documentation/devicetree/bindings/arm/davinci.txt
+++ b/Documentation/devicetree/bindings/arm/davinci.txt
@@ -9,6 +9,10 @@ EnBW AM1808 based CMC board
 Required root node properties:
 - compatible = "enbw,cmc", "ti,da850;
 
+LEGO MINDSTORMS EV3 (AM1808 based)
+Required root node properties:
+- compatible = "lego,ev3", "ti,da850";
+
 Generic DaVinci Boards
 --
 
-- 
2.11.0

[PATCH AUTOSEL for 4.9 48/50] IB/rxe: Fix reference leaks in memory key invalidation code

[Levin, Alexander (Sasha Levin)]

From: Bart Van Assche 

[ Upstream commit ab17654476a11a1ed7d89f1104e2acdb7ed1c9ed ]

Signed-off-by: Bart Van Assche 
Reviewed-by: Leon Romanovsky 
Reviewed-by: Andrew Boyer 
Cc: Moni Shoua 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin 
---
 drivers/infiniband/sw/rxe/rxe_req.c  | 1 +
 drivers/infiniband/sw/rxe/rxe_resp.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/infiniband/sw/rxe/rxe_req.c 
b/drivers/infiniband/sw/rxe/rxe_req.c
index 9f46be52335e..9d084780ac91 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -633,6 +633,7 @@ next_wqe:
goto exit;
}
rmr->state = RXE_MEM_STATE_FREE;
+   rxe_drop_ref(rmr);
wqe->state = wqe_state_done;
wqe->status = IB_WC_SUCCESS;
} else if (wqe->wr.opcode == IB_WR_REG_MR) {
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c 
b/drivers/infiniband/sw/rxe/rxe_resp.c
index 69ed4e0d7a0d..7705820cdac6 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -893,6 +893,7 @@ static enum resp_states do_complete(struct rxe_qp *qp,
return RESPST_ERROR;
}
rmr->state = RXE_MEM_STATE_FREE;
+   rxe_drop_ref(rmr);
}
 
wc->qp  = &qp->ibqp;
-- 
2.11.0

[PATCH AUTOSEL for 3.18 11/15] usb: hcd: initialize hcd->flags to 0 when rm hcd

[Levin, Alexander (Sasha Levin)]

From: William wu 

[ Upstream commit 76b8db0d480e8045e1a1902fc9ab143b3b9ef115 ]

On some platforms(e.g. rk3399 board), we can call hcd_add/remove
consecutively without calling usb_put_hcd/usb_create_hcd in between,
so hcd->flags can be stale.

If the HC dies due to whatever reason then without this patch we get
the below error on next hcd_add.

[173.296154] xhci-hcd xhci-hcd.2.auto: HC died; cleaning up
[173.296209] xhci-hcd xhci-hcd.2.auto: xHCI Host Controller
[173.296762] xhci-hcd xhci-hcd.2.auto: new USB bus registered, assigned bus 
number 6
[173.296931] usb usb6: We don't know the algorithms for LPM for this host, 
disabling LPM.
[173.297179] usb usb6: New USB device found, idVendor=1d6b, idProduct=0003
[173.297203] usb usb6: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[173.297222] usb usb6: Product: xHCI Host Controller
[173.297240] usb usb6: Manufacturer: Linux 4.4.21 xhci-hcd
[173.297257] usb usb6: SerialNumber: xhci-hcd.2.auto
[173.298680] hub 6-0:1.0: USB hub found
[173.298749] hub 6-0:1.0: 1 port detected
[173.299382] rockchip-dwc3 usb@fe80: USB HOST connected
[173.395418] hub 5-0:1.0: activate --> -19
[173.603447] irq 228: nobody cared (try booting with the "irqpoll" option)
[173.603493] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.21 #9
[173.603513] Hardware name: Google Kevin (DT)
[173.603531] Call trace:
[173.603568] [] dump_backtrace+0x0/0x160
[173.603596] [] show_stack+0x20/0x28
[173.603623] [] dump_stack+0x90/0xb0
[173.603650] [] __report_bad_irq+0x48/0xe8
[173.603674] [] note_interrupt+0x1e8/0x28c
[173.603698] [] handle_irq_event_percpu+0x1d4/0x25c
[173.603722] [] handle_irq_event+0x4c/0x7c
[173.603748] [] handle_fasteoi_irq+0xb4/0x124
[173.603777] [] generic_handle_irq+0x30/0x44
[173.603804] [] __handle_domain_irq+0x90/0xbc
[173.603827] [] gic_handle_irq+0xcc/0x188
...
[173.604500] [] el1_irq+0x80/0xf8
[173.604530] [] cpu_startup_entry+0x38/0x3cc
[173.604558] [] rest_init+0x8c/0x94
[173.604585] [] start_kernel+0x3d0/0x3fc
[173.604607] [<00b16000>] 0xb16000
[173.604622] handlers:
[173.604648] [] usb_hcd_irq
[173.604673] Disabling IRQ #228

Signed-off-by: William wu 
Acked-by: Roger Quadros 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 drivers/usb/core/hcd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 826b8fb9eb59..d7203fd67f2a 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2927,6 +2927,7 @@ void usb_remove_hcd(struct usb_hcd *hcd)
}
 
usb_put_invalidate_rhdev(hcd);
+   hcd->flags = 0;
 }
 EXPORT_SYMBOL_GPL(usb_remove_hcd);
 
-- 
2.11.0

[PATCH AUTOSEL for 4.4 10/25] powerpc/corenet: explicitly disable the SDHC controller on kmcoge4

[Levin, Alexander (Sasha Levin)]

From: Valentin Longchamp 

[ Upstream commit a674c7d470bb47e82f4eb1fa944eadeac2f6bbaf ]

It is not implemented on the kmcoge4 hardware and if not disabled it
leads to error messages with the corenet32_smp_defconfig.

Signed-off-by: Valentin Longchamp 
Signed-off-by: Scott Wood 
Signed-off-by: Sasha Levin 
---
 arch/powerpc/boot/dts/fsl/kmcoge4.dts | 4 
 1 file changed, 4 insertions(+)

diff --git a/arch/powerpc/boot/dts/fsl/kmcoge4.dts 
b/arch/powerpc/boot/dts/fsl/kmcoge4.dts
index 6858ec9ef295..1a953d9edf1e 100644
--- a/arch/powerpc/boot/dts/fsl/kmcoge4.dts
+++ b/arch/powerpc/boot/dts/fsl/kmcoge4.dts
@@ -83,6 +83,10 @@
};
};
 
+   sdhc@114000 {
+   status = "disabled";
+   };
+
i2c@119000 {
status = "disabled";
};
-- 
2.11.0

[PATCH AUTOSEL for 3.18 13/15] Input: mpr121 - handle multiple bits change of status register

[Levin, Alexander (Sasha Levin)]

From: Akinobu Mita 

[ Upstream commit 08fea55e37f58371bffc5336a59e55d1f155955a ]

This driver reports input events on their interrupts which are triggered
by the sensor's status register changes.  But only single bit change is
reported in the interrupt handler.  So if there are multiple bits are
changed at almost the same time, other press or release events are ignored.

This fixes it by detecting all changed bits in the status register.

Signed-off-by: Akinobu Mita 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin 
---
 drivers/input/keyboard/mpr121_touchkey.c | 23 ++-
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/drivers/input/keyboard/mpr121_touchkey.c 
b/drivers/input/keyboard/mpr121_touchkey.c
index 009c82256e89..3dbc7e611791 100644
--- a/drivers/input/keyboard/mpr121_touchkey.c
+++ b/drivers/input/keyboard/mpr121_touchkey.c
@@ -87,7 +87,8 @@ static irqreturn_t mpr_touchkey_interrupt(int irq, void 
*dev_id)
struct mpr121_touchkey *mpr121 = dev_id;
struct i2c_client *client = mpr121->client;
struct input_dev *input = mpr121->input_dev;
-   unsigned int key_num, key_val, pressed;
+   unsigned long bit_changed;
+   unsigned int key_num;
int reg;
 
reg = i2c_smbus_read_byte_data(client, ELE_TOUCH_STATUS_1_ADDR);
@@ -105,18 +106,22 @@ static irqreturn_t mpr_touchkey_interrupt(int irq, void 
*dev_id)
 
reg &= TOUCH_STATUS_MASK;
/* use old press bit to figure out which bit changed */
-   key_num = ffs(reg ^ mpr121->statusbits) - 1;
-   pressed = reg & (1 << key_num);
+   bit_changed = reg ^ mpr121->statusbits;
mpr121->statusbits = reg;
+   for_each_set_bit(key_num, &bit_changed, mpr121->keycount) {
+   unsigned int key_val, pressed;
 
-   key_val = mpr121->keycodes[key_num];
+   pressed = reg & BIT(key_num);
+   key_val = mpr121->keycodes[key_num];
 
-   input_event(input, EV_MSC, MSC_SCAN, key_num);
-   input_report_key(input, key_val, pressed);
-   input_sync(input);
+   input_event(input, EV_MSC, MSC_SCAN, key_num);
+   input_report_key(input, key_val, pressed);
+
+   dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val,
+   pressed ? "pressed" : "released");
 
-   dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val,
-   pressed ? "pressed" : "released");
+   }
+   input_sync(input);
 
 out:
return IRQ_HANDLED;
-- 
2.11.0

[PATCH AUTOSEL for 3.18 08/15] dt-bindings: Add vendor prefix for LEGO

[Levin, Alexander (Sasha Levin)]

From: David Lechner 

[ Upstream commit 7dcc31e2e68a386a29070384b51683ece80982bf ]

Add a vendor prefix for LEGO Systems A/S

Acked-by: Rob Herring 
Signed-off-by: David Lechner 
Signed-off-by: Sekhar Nori 
Signed-off-by: Sasha Levin 
---
 Documentation/devicetree/bindings/vendor-prefixes.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt 
b/Documentation/devicetree/bindings/vendor-prefixes.txt
index a344ec2713a5..356ffd64fc9e 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -83,6 +83,7 @@ karo  Ka-Ro electronics GmbH
 keymileKeymile GmbH
 lacie  LaCie
 lantiq Lantiq Semiconductor
+lego   LEGO Systems A/S
 lenovo Lenovo Group Ltd.
 lg LG Corporation
 linux  Linux-specific binding
-- 
2.11.0

[PATCH AUTOSEL for 3.18 07/15] dt-bindings: Add LEGO MINDSTORMS EV3 compatible specification

[Levin, Alexander (Sasha Levin)]

From: David Lechner 

[ Upstream commit 21078ab174c99885ca83a5c32db0d33b1617745e ]

This adds the board level device tree specification for LEGO MINDSTORMS EV3

Acked-by: Rob Herring 
Signed-off-by: David Lechner 
Signed-off-by: Sekhar Nori 
Signed-off-by: Sasha Levin 
---
 Documentation/devicetree/bindings/arm/davinci.txt | 4 
 1 file changed, 4 insertions(+)

diff --git a/Documentation/devicetree/bindings/arm/davinci.txt 
b/Documentation/devicetree/bindings/arm/davinci.txt
index cfaeda4274e6..e6f4b50da1f9 100644
--- a/Documentation/devicetree/bindings/arm/davinci.txt
+++ b/Documentation/devicetree/bindings/arm/davinci.txt
@@ -9,6 +9,10 @@ EnBW AM1808 based CMC board
 Required root node properties:
 - compatible = "enbw,cmc", "ti,da850;
 
+LEGO MINDSTORMS EV3 (AM1808 based)
+Required root node properties:
+- compatible = "lego,ev3", "ti,da850";
+
 Generic DaVinci Boards
 --
 
-- 
2.11.0

[PATCH AUTOSEL for 3.18 10/15] serial: sh-sci: Fix register offsets for the IRDA serial port

[Levin, Alexander (Sasha Levin)]

From: Laurent Pinchart 

[ Upstream commit a752ba18af8285e3eeda572f40dddaebff0c3621 ]

Even though most of its registers are 8-bit wide, the IRDA has two
16-bit registers that make it a 16-bit peripheral and not a 8-bit
peripheral with addresses shifted by one. Fix the registers offset in
the driver and the platform data regshift value.

Signed-off-by: Laurent Pinchart 
Reviewed-by: Geert Uytterhoeven 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 arch/sh/kernel/cpu/sh3/setup-sh770x.c |  1 -
 drivers/tty/serial/sh-sci.c   | 17 -
 2 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/arch/sh/kernel/cpu/sh3/setup-sh770x.c 
b/arch/sh/kernel/cpu/sh3/setup-sh770x.c
index 538c10db3537..8dc315b212c2 100644
--- a/arch/sh/kernel/cpu/sh3/setup-sh770x.c
+++ b/arch/sh/kernel/cpu/sh3/setup-sh770x.c
@@ -165,7 +165,6 @@ static struct plat_sci_port scif2_platform_data = {
.scscr  = SCSCR_TE | SCSCR_RE,
.type   = PORT_IRDA,
.ops= &sh770x_sci_port_ops,
-   .regshift   = 1,
 };
 
 static struct resource scif2_resources[] = {
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index f6c7f043c176..118d998f6ff6 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -171,18 +171,17 @@ static struct plat_sci_reg 
sci_regmap[SCIx_NR_REGTYPES][SCIx_NR_REGS] = {
},
 
/*
-* Common definitions for legacy IrDA ports, dependent on
-* regshift value.
+* Common definitions for legacy IrDA ports.
 */
[SCIx_IRDA_REGTYPE] = {
[SCSMR] = { 0x00,  8 },
-   [SCBRR] = { 0x01,  8 },
-   [SCSCR] = { 0x02,  8 },
-   [SCxTDR]= { 0x03,  8 },
-   [SCxSR] = { 0x04,  8 },
-   [SCxRDR]= { 0x05,  8 },
-   [SCFCR] = { 0x06,  8 },
-   [SCFDR] = { 0x07, 16 },
+   [SCBRR] = { 0x02,  8 },
+   [SCSCR] = { 0x04,  8 },
+   [SCxTDR]= { 0x06,  8 },
+   [SCxSR] = { 0x08, 16 },
+   [SCxRDR]= { 0x0a,  8 },
+   [SCFCR] = { 0x0c,  8 },
+   [SCFDR] = { 0x0e, 16 },
[SCTFDR]= sci_reg_invalid,
[SCRFDR]= sci_reg_invalid,
[SCSPTR]= sci_reg_invalid,
-- 
2.11.0

[PATCH AUTOSEL for 3.18 06/15] iio: trigger: free trigger resource correctly

[Levin, Alexander (Sasha Levin)]

From: Alison Schofield 

[ Upstream commit 10e840dfb0b7fc345082dd9e5fff3c1c02e7690e ]

These stand-alone trigger drivers were using iio_trigger_put()
where they should have been using iio_trigger_free().  The
iio_trigger_put() adds a module_put which is bad since they
never did a module_get.

In the sysfs driver, module_get/put's are used as triggers are
added & removed. This extra module_put() occurs on an error path
in the probe routine (probably rare).

In the bfin-timer & interrupt trigger drivers, the module resources
are not explicitly managed, so it's doing a put on something that
was never get'd.  It occurs on the probe error path and on the
remove path (not so rare).

Tested with the sysfs trigger driver.
The bfin & interrupt drivers were build tested & inspected only.

Signed-off-by: Alison Schofield 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Sasha Levin 
---
 drivers/iio/trigger/iio-trig-interrupt.c  | 8 
 drivers/iio/trigger/iio-trig-sysfs.c  | 2 +-
 drivers/staging/iio/trigger/iio-trig-bfin-timer.c | 4 ++--
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/iio/trigger/iio-trig-interrupt.c 
b/drivers/iio/trigger/iio-trig-interrupt.c
index 572bc6f02ca8..e18f12b74610 100644
--- a/drivers/iio/trigger/iio-trig-interrupt.c
+++ b/drivers/iio/trigger/iio-trig-interrupt.c
@@ -58,7 +58,7 @@ static int iio_interrupt_trigger_probe(struct platform_device 
*pdev)
trig_info = kzalloc(sizeof(*trig_info), GFP_KERNEL);
if (!trig_info) {
ret = -ENOMEM;
-   goto error_put_trigger;
+   goto error_free_trigger;
}
iio_trigger_set_drvdata(trig, trig_info);
trig_info->irq = irq;
@@ -83,8 +83,8 @@ error_release_irq:
free_irq(irq, trig);
 error_free_trig_info:
kfree(trig_info);
-error_put_trigger:
-   iio_trigger_put(trig);
+error_free_trigger:
+   iio_trigger_free(trig);
 error_ret:
return ret;
 }
@@ -99,7 +99,7 @@ static int iio_interrupt_trigger_remove(struct 
platform_device *pdev)
iio_trigger_unregister(trig);
free_irq(trig_info->irq, trig);
kfree(trig_info);
-   iio_trigger_put(trig);
+   iio_trigger_free(trig);
 
return 0;
 }
diff --git a/drivers/iio/trigger/iio-trig-sysfs.c 
b/drivers/iio/trigger/iio-trig-sysfs.c
index 254c7e906127..61ffbec048a7 100644
--- a/drivers/iio/trigger/iio-trig-sysfs.c
+++ b/drivers/iio/trigger/iio-trig-sysfs.c
@@ -173,7 +173,7 @@ static int iio_sysfs_trigger_probe(int id)
return 0;
 
 out2:
-   iio_trigger_put(t->trig);
+   iio_trigger_free(t->trig);
 free_t:
kfree(t);
 out1:
diff --git a/drivers/staging/iio/trigger/iio-trig-bfin-timer.c 
b/drivers/staging/iio/trigger/iio-trig-bfin-timer.c
index a21b7c514776..b412f567a9c1 100644
--- a/drivers/staging/iio/trigger/iio-trig-bfin-timer.c
+++ b/drivers/staging/iio/trigger/iio-trig-bfin-timer.c
@@ -258,7 +258,7 @@ out_free_irq:
 out1:
iio_trigger_unregister(st->trig);
 out:
-   iio_trigger_put(st->trig);
+   iio_trigger_free(st->trig);
return ret;
 }
 
@@ -271,7 +271,7 @@ static int iio_bfin_tmr_trigger_remove(struct 
platform_device *pdev)
peripheral_free(st->t->pin);
free_irq(st->irq, st);
iio_trigger_unregister(st->trig);
-   iio_trigger_put(st->trig);
+   iio_trigger_free(st->trig);
 
return 0;
 }
-- 
2.11.0

[PATCH AUTOSEL for 4.4 20/25] IPsec: do not ignore crypto err in ah4 input

[Levin, Alexander (Sasha Levin)]

From: Gilad Ben-Yossef 

[ Upstream commit ebd89a2d0675f1325c2be5b7576fd8cb7e8defd0 ]

ah4 input processing uses the asynchronous hash crypto API which
supplies an error code as part of the operation completion but
the error code was being ignored.

Treat a crypto API error indication as a verification failure.

While a crypto API reported error would almost certainly result
in a memcpy of the digest failing anyway and thus the security
risk seems minor, performing a memory compare on what might be
uninitialized memory is wrong.

Signed-off-by: Gilad Ben-Yossef 
Signed-off-by: Steffen Klassert 
Signed-off-by: Sasha Levin 
---
 net/ipv4/ah4.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index f2a71025a770..22377c8ff14b 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -270,6 +270,9 @@ static void ah_input_done(struct crypto_async_request 
*base, int err)
int ihl = ip_hdrlen(skb);
int ah_hlen = (ah->hdrlen + 2) << 2;
 
+   if (err)
+   goto out;
+
work_iph = AH_SKB_CB(skb)->tmp;
auth_data = ah_tmp_auth(work_iph, ihl);
icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len);
-- 
2.11.0

[PATCH AUTOSEL for 4.4 22/25] Input: mpr121 - set missing event capability

[Levin, Alexander (Sasha Levin)]

From: Akinobu Mita 

[ Upstream commit 9723ddc8fe0d76ce41fe0dc16afb241ec7d0a29d ]

This driver reports misc scan input events on the sensor's status
register changes.  But the event capability for them was not set in the
device initialization, so these events were ignored.

This change adds the missing event capability.

Signed-off-by: Akinobu Mita 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin 
---
 drivers/input/keyboard/mpr121_touchkey.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/input/keyboard/mpr121_touchkey.c 
b/drivers/input/keyboard/mpr121_touchkey.c
index 088a9f7c954e..aaf43befffaa 100644
--- a/drivers/input/keyboard/mpr121_touchkey.c
+++ b/drivers/input/keyboard/mpr121_touchkey.c
@@ -236,6 +236,7 @@ static int mpr_touchkey_probe(struct i2c_client *client,
input_dev->id.bustype = BUS_I2C;
input_dev->dev.parent = &client->dev;
input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP);
+   input_set_capability(input_dev, EV_MSC, MSC_SCAN);
 
input_dev->keycode = mpr121->keycodes;
input_dev->keycodesize = sizeof(mpr121->keycodes[0]);
-- 
2.11.0

[PATCH AUTOSEL for 4.4 24/25] s390/qeth: issue STARTLAN as first IPA command

[Levin, Alexander (Sasha Levin)]

From: Julian Wiedmann 

[ Upstream commit 1034051045d125579ab1e8fcd5a724eeb0e70149 ]

STARTLAN needs to be the first IPA command after MPC initialization
completes.
So move the qeth_send_startlan() call from the layer disciplines
into the core path, right after the MPC handshake.
While at it, replace the magic LAN OFFLINE return code
with the existing enum.

Signed-off-by: Julian Wiedmann 
Reviewed-by: Thomas Richter 
Reviewed-by: Ursula Braun 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/s390/net/qeth_core.h  |  1 -
 drivers/s390/net/qeth_core_main.c | 21 +
 drivers/s390/net/qeth_l2_main.c   | 15 ---
 drivers/s390/net/qeth_l3_main.c   | 15 ---
 4 files changed, 17 insertions(+), 35 deletions(-)

diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index 741f3ee81cfe..5006cb6ce62d 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -909,7 +909,6 @@ void qeth_clear_thread_running_bit(struct qeth_card *, 
unsigned long);
 int qeth_core_hardsetup_card(struct qeth_card *);
 void qeth_print_status_message(struct qeth_card *);
 int qeth_init_qdio_queues(struct qeth_card *);
-int qeth_send_startlan(struct qeth_card *);
 int qeth_send_ipa_cmd(struct qeth_card *, struct qeth_cmd_buffer *,
  int (*reply_cb)
  (struct qeth_card *, struct qeth_reply *, unsigned long),
diff --git a/drivers/s390/net/qeth_core_main.c 
b/drivers/s390/net/qeth_core_main.c
index d10bf3da8e5f..e5b9506698b1 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -2955,7 +2955,7 @@ int qeth_send_ipa_cmd(struct qeth_card *card, struct 
qeth_cmd_buffer *iob,
 }
 EXPORT_SYMBOL_GPL(qeth_send_ipa_cmd);
 
-int qeth_send_startlan(struct qeth_card *card)
+static int qeth_send_startlan(struct qeth_card *card)
 {
int rc;
struct qeth_cmd_buffer *iob;
@@ -2968,7 +2968,6 @@ int qeth_send_startlan(struct qeth_card *card)
rc = qeth_send_ipa_cmd(card, iob, NULL, NULL);
return rc;
 }
-EXPORT_SYMBOL_GPL(qeth_send_startlan);
 
 static int qeth_default_setadapterparms_cb(struct qeth_card *card,
struct qeth_reply *reply, unsigned long data)
@@ -5080,6 +5079,20 @@ retriable:
goto out;
}
 
+   rc = qeth_send_startlan(card);
+   if (rc) {
+   QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc);
+   if (rc == IPA_RC_LAN_OFFLINE) {
+   dev_warn(&card->gdev->dev,
+   "The LAN is offline\n");
+   card->lan_online = 0;
+   } else {
+   rc = -ENODEV;
+   goto out;
+   }
+   } else
+   card->lan_online = 1;
+
card->options.ipa4.supported_funcs = 0;
card->options.ipa6.supported_funcs = 0;
card->options.adp.supported_funcs = 0;
@@ -5091,14 +5104,14 @@ retriable:
if (qeth_is_supported(card, IPA_SETADAPTERPARMS)) {
rc = qeth_query_setadapterparms(card);
if (rc < 0) {
-   QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc);
+   QETH_DBF_TEXT_(SETUP, 2, "7err%d", rc);
goto out;
}
}
if (qeth_adp_supported(card, IPA_SETADP_SET_DIAG_ASSIST)) {
rc = qeth_query_setdiagass(card);
if (rc < 0) {
-   QETH_DBF_TEXT_(SETUP, 2, "7err%d", rc);
+   QETH_DBF_TEXT_(SETUP, 2, "8err%d", rc);
goto out;
}
}
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index bf1e0e39334d..58bcb3c9a86a 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -1203,21 +1203,6 @@ static int __qeth_l2_set_online(struct ccwgroup_device 
*gdev, int recovery_mode)
/* softsetup */
QETH_DBF_TEXT(SETUP, 2, "softsetp");
 
-   rc = qeth_send_startlan(card);
-   if (rc) {
-   QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
-   if (rc == 0xe080) {
-   dev_warn(&card->gdev->dev,
-   "The LAN is offline\n");
-   card->lan_online = 0;
-   goto contin;
-   }
-   rc = -ENODEV;
-   goto out_remove;
-   } else
-   card->lan_online = 1;
-
-contin:
if ((card->info.type == QETH_CARD_TYPE_OSD) ||
(card->info.type == QETH_CARD_TYPE_OSX)) {
if (qeth_l2_start_ipassists(card))
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 285fe0b2c753..bf3c1b2301db 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -3298,21 +3298,6 @@ static int __qeth_l3_set_online(struct ccwgroup_device 
*gdev, int recovery_mode)
/* softset

[PATCH AUTOSEL for 4.4 12/25] crypto: vmx - disable preemption to enable vsx in aes_ctr.c

[Levin, Alexander (Sasha Levin)]

From: Li Zhong 

[ Upstream commit 7dede913fc2ab9c0d3bff3a49e26fa9e858b0c13 ]

Some preemptible check warnings were reported from enable_kernel_vsx(). This
patch disables preemption in aes_ctr.c before enabling vsx, and they are now
consistent with other files in the same directory.

Signed-off-by: Li Zhong 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin 
---
 drivers/crypto/vmx/aes_ctr.c | 6 ++
 1 file changed, 6 insertions(+)

diff --git a/drivers/crypto/vmx/aes_ctr.c b/drivers/crypto/vmx/aes_ctr.c
index 72f138985e18..d83ab4bac8b1 100644
--- a/drivers/crypto/vmx/aes_ctr.c
+++ b/drivers/crypto/vmx/aes_ctr.c
@@ -80,11 +80,13 @@ static int p8_aes_ctr_setkey(struct crypto_tfm *tfm, const 
u8 *key,
int ret;
struct p8_aes_ctr_ctx *ctx = crypto_tfm_ctx(tfm);
 
+   preempt_disable();
pagefault_disable();
enable_kernel_altivec();
enable_kernel_vsx();
ret = aes_p8_set_encrypt_key(key, keylen * 8, &ctx->enc_key);
pagefault_enable();
+   preempt_enable();
 
ret += crypto_blkcipher_setkey(ctx->fallback, key, keylen);
return ret;
@@ -99,11 +101,13 @@ static void p8_aes_ctr_final(struct p8_aes_ctr_ctx *ctx,
u8 *dst = walk->dst.virt.addr;
unsigned int nbytes = walk->nbytes;
 
+   preempt_disable();
pagefault_disable();
enable_kernel_altivec();
enable_kernel_vsx();
aes_p8_encrypt(ctrblk, keystream, &ctx->enc_key);
pagefault_enable();
+   preempt_enable();
 
crypto_xor(keystream, src, nbytes);
memcpy(dst, keystream, nbytes);
@@ -132,6 +136,7 @@ static int p8_aes_ctr_crypt(struct blkcipher_desc *desc,
blkcipher_walk_init(&walk, dst, src, nbytes);
ret = blkcipher_walk_virt_block(desc, &walk, AES_BLOCK_SIZE);
while ((nbytes = walk.nbytes) >= AES_BLOCK_SIZE) {
+   preempt_disable();
pagefault_disable();
enable_kernel_altivec();
enable_kernel_vsx();
@@ -143,6 +148,7 @@ static int p8_aes_ctr_crypt(struct blkcipher_desc *desc,
&ctx->enc_key,
walk.iv);
pagefault_enable();
+   preempt_enable();
 
/* We need to update IV mostly for last bytes/round */
inc = (nbytes & AES_BLOCK_MASK) / AES_BLOCK_SIZE;
-- 
2.11.0

[PATCH AUTOSEL for 4.4 21/25] Input: mpr121 - handle multiple bits change of status register

[Levin, Alexander (Sasha Levin)]

From: Akinobu Mita 

[ Upstream commit 08fea55e37f58371bffc5336a59e55d1f155955a ]

This driver reports input events on their interrupts which are triggered
by the sensor's status register changes.  But only single bit change is
reported in the interrupt handler.  So if there are multiple bits are
changed at almost the same time, other press or release events are ignored.

This fixes it by detecting all changed bits in the status register.

Signed-off-by: Akinobu Mita 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin 
---
 drivers/input/keyboard/mpr121_touchkey.c | 23 ++-
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/drivers/input/keyboard/mpr121_touchkey.c 
b/drivers/input/keyboard/mpr121_touchkey.c
index 0fd612dd76ed..088a9f7c954e 100644
--- a/drivers/input/keyboard/mpr121_touchkey.c
+++ b/drivers/input/keyboard/mpr121_touchkey.c
@@ -87,7 +87,8 @@ static irqreturn_t mpr_touchkey_interrupt(int irq, void 
*dev_id)
struct mpr121_touchkey *mpr121 = dev_id;
struct i2c_client *client = mpr121->client;
struct input_dev *input = mpr121->input_dev;
-   unsigned int key_num, key_val, pressed;
+   unsigned long bit_changed;
+   unsigned int key_num;
int reg;
 
reg = i2c_smbus_read_byte_data(client, ELE_TOUCH_STATUS_1_ADDR);
@@ -105,18 +106,22 @@ static irqreturn_t mpr_touchkey_interrupt(int irq, void 
*dev_id)
 
reg &= TOUCH_STATUS_MASK;
/* use old press bit to figure out which bit changed */
-   key_num = ffs(reg ^ mpr121->statusbits) - 1;
-   pressed = reg & (1 << key_num);
+   bit_changed = reg ^ mpr121->statusbits;
mpr121->statusbits = reg;
+   for_each_set_bit(key_num, &bit_changed, mpr121->keycount) {
+   unsigned int key_val, pressed;
 
-   key_val = mpr121->keycodes[key_num];
+   pressed = reg & BIT(key_num);
+   key_val = mpr121->keycodes[key_num];
 
-   input_event(input, EV_MSC, MSC_SCAN, key_num);
-   input_report_key(input, key_val, pressed);
-   input_sync(input);
+   input_event(input, EV_MSC, MSC_SCAN, key_num);
+   input_report_key(input, key_val, pressed);
+
+   dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val,
+   pressed ? "pressed" : "released");
 
-   dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val,
-   pressed ? "pressed" : "released");
+   }
+   input_sync(input);
 
 out:
return IRQ_HANDLED;
-- 
2.11.0

[PATCH AUTOSEL for 4.4 18/25] usb: hcd: initialize hcd->flags to 0 when rm hcd

[Levin, Alexander (Sasha Levin)]

From: William wu 

[ Upstream commit 76b8db0d480e8045e1a1902fc9ab143b3b9ef115 ]

On some platforms(e.g. rk3399 board), we can call hcd_add/remove
consecutively without calling usb_put_hcd/usb_create_hcd in between,
so hcd->flags can be stale.

If the HC dies due to whatever reason then without this patch we get
the below error on next hcd_add.

[173.296154] xhci-hcd xhci-hcd.2.auto: HC died; cleaning up
[173.296209] xhci-hcd xhci-hcd.2.auto: xHCI Host Controller
[173.296762] xhci-hcd xhci-hcd.2.auto: new USB bus registered, assigned bus 
number 6
[173.296931] usb usb6: We don't know the algorithms for LPM for this host, 
disabling LPM.
[173.297179] usb usb6: New USB device found, idVendor=1d6b, idProduct=0003
[173.297203] usb usb6: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[173.297222] usb usb6: Product: xHCI Host Controller
[173.297240] usb usb6: Manufacturer: Linux 4.4.21 xhci-hcd
[173.297257] usb usb6: SerialNumber: xhci-hcd.2.auto
[173.298680] hub 6-0:1.0: USB hub found
[173.298749] hub 6-0:1.0: 1 port detected
[173.299382] rockchip-dwc3 usb@fe80: USB HOST connected
[173.395418] hub 5-0:1.0: activate --> -19
[173.603447] irq 228: nobody cared (try booting with the "irqpoll" option)
[173.603493] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.21 #9
[173.603513] Hardware name: Google Kevin (DT)
[173.603531] Call trace:
[173.603568] [] dump_backtrace+0x0/0x160
[173.603596] [] show_stack+0x20/0x28
[173.603623] [] dump_stack+0x90/0xb0
[173.603650] [] __report_bad_irq+0x48/0xe8
[173.603674] [] note_interrupt+0x1e8/0x28c
[173.603698] [] handle_irq_event_percpu+0x1d4/0x25c
[173.603722] [] handle_irq_event+0x4c/0x7c
[173.603748] [] handle_fasteoi_irq+0xb4/0x124
[173.603777] [] generic_handle_irq+0x30/0x44
[173.603804] [] __handle_domain_irq+0x90/0xbc
[173.603827] [] gic_handle_irq+0xcc/0x188
...
[173.604500] [] el1_irq+0x80/0xf8
[173.604530] [] cpu_startup_entry+0x38/0x3cc
[173.604558] [] rest_init+0x8c/0x94
[173.604585] [] start_kernel+0x3d0/0x3fc
[173.604607] [<00b16000>] 0xb16000
[173.604622] handlers:
[173.604648] [] usb_hcd_irq
[173.604673] Disabling IRQ #228

Signed-off-by: William wu 
Acked-by: Roger Quadros 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 drivers/usb/core/hcd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 5c0952995280..87a83d925eea 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2997,6 +2997,7 @@ void usb_remove_hcd(struct usb_hcd *hcd)
}
 
usb_put_invalidate_rhdev(hcd);
+   hcd->flags = 0;
 }
 EXPORT_SYMBOL_GPL(usb_remove_hcd);
 
-- 
2.11.0

[PATCH AUTOSEL for 4.4 04/25] xen/netback: set default upper limit of tx/rx queues to 8

[Levin, Alexander (Sasha Levin)]

From: Juergen Gross 

[ Upstream commit 56dd5af9bc23d0d5d23bb207c477715b4c2216c5 ]

The default for the maximum number of tx/rx queues of one interface is
the number of cpus of the system today. As each queue pair reserves 512
grant pages this default consumes a ridiculous number of grants for
large guests.

Limit the queue number to 8 as default. This value can be modified
via a module parameter if required.

Signed-off-by: Juergen Gross 
Reviewed-by: Boris Ostrovsky 
Signed-off-by: Boris Ostrovsky 
Signed-off-by: Sasha Levin 
---
 drivers/net/xen-netback/netback.c | 6 --
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/xen-netback/netback.c 
b/drivers/net/xen-netback/netback.c
index 72ee1c305cc4..02db20b26749 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -67,6 +67,7 @@ module_param(rx_drain_timeout_msecs, uint, 0444);
 unsigned int rx_stall_timeout_msecs = 6;
 module_param(rx_stall_timeout_msecs, uint, 0444);
 
+#define MAX_QUEUES_DEFAULT 8
 unsigned int xenvif_max_queues;
 module_param_named(max_queues, xenvif_max_queues, uint, 0644);
 MODULE_PARM_DESC(max_queues,
@@ -2157,11 +2158,12 @@ static int __init netback_init(void)
if (!xen_domain())
return -ENODEV;
 
-   /* Allow as many queues as there are CPUs if user has not
+   /* Allow as many queues as there are CPUs but max. 8 if user has not
 * specified a value.
 */
if (xenvif_max_queues == 0)
-   xenvif_max_queues = num_online_cpus();
+   xenvif_max_queues = min_t(unsigned int, MAX_QUEUES_DEFAULT,
+ num_online_cpus());
 
if (fatal_skb_slots < XEN_NETBK_LEGACY_SLOTS_MAX) {
pr_info("fatal_skb_slots too small (%d), bump it to 
XEN_NETBK_LEGACY_SLOTS_MAX (%d)\n",
-- 
2.11.0

[PATCH AUTOSEL for 3.18 09/15] phy: increase size of MII_BUS_ID_SIZE and bus_id

[Levin, Alexander (Sasha Levin)]

From: Volodymyr Bendiuga 

[ Upstream commit 4567d686f5c6d955e57a3afa1741944c1e7f4033 ]

Some bus names are pretty long and do not fit into
17 chars. Increase therefore MII_BUS_ID_SIZE and
phy_fixup.bus_id to larger number. Now mii_bus.id
can host larger name.

Signed-off-by: Volodymyr Bendiuga 
Signed-off-by: Magnus Öberg 
Reviewed-by: Andrew Lunn 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 include/linux/phy.h | 8 ++--
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/include/linux/phy.h b/include/linux/phy.h
index fbdacd1278e3..bc79f855fc32 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -135,11 +135,7 @@ static inline const char *phy_modes(phy_interface_t 
interface)
 /* Used when trying to connect to a specific phy (mii bus id:phy device id) */
 #define PHY_ID_FMT "%s:%02x"
 
-/*
- * Need to be a little smaller than phydev->dev.bus_id to leave room
- * for the ":%02x"
- */
-#define MII_BUS_ID_SIZE(20 - 3)
+#define MII_BUS_ID_SIZE61
 
 /* Or MII_ADDR_C45 into regnum for read/write on mii_bus to enable the 21 bit
IEEE 802.3ae clause 45 addressing mode used by 10GIGE phy chips. */
@@ -573,7 +569,7 @@ struct phy_driver {
 /* A Structure for boards to register fixups with the PHY Lib */
 struct phy_fixup {
struct list_head list;
-   char bus_id[20];
+   char bus_id[MII_BUS_ID_SIZE + 3];
u32 phy_uid;
u32 phy_uid_mask;
int (*run)(struct phy_device *phydev);
-- 
2.11.0

[PATCH AUTOSEL for 3.18 12/15] IPsec: do not ignore crypto err in ah4 input

[Levin, Alexander (Sasha Levin)]

From: Gilad Ben-Yossef 

[ Upstream commit ebd89a2d0675f1325c2be5b7576fd8cb7e8defd0 ]

ah4 input processing uses the asynchronous hash crypto API which
supplies an error code as part of the operation completion but
the error code was being ignored.

Treat a crypto API error indication as a verification failure.

While a crypto API reported error would almost certainly result
in a memcpy of the digest failing anyway and thus the security
risk seems minor, performing a memory compare on what might be
uninitialized memory is wrong.

Signed-off-by: Gilad Ben-Yossef 
Signed-off-by: Steffen Klassert 
Signed-off-by: Sasha Levin 
---
 net/ipv4/ah4.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index ac9a32ec3ee4..0157f09c0de9 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -270,6 +270,9 @@ static void ah_input_done(struct crypto_async_request 
*base, int err)
int ihl = ip_hdrlen(skb);
int ah_hlen = (ah->hdrlen + 2) << 2;
 
+   if (err)
+   goto out;
+
work_iph = AH_SKB_CB(skb)->tmp;
auth_data = ah_tmp_auth(work_iph, ihl);
icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len);
-- 
2.11.0

[PATCH AUTOSEL for 4.9 31/50] usb: hcd: initialize hcd->flags to 0 when rm hcd

[Levin, Alexander (Sasha Levin)]

From: William wu 

[ Upstream commit 76b8db0d480e8045e1a1902fc9ab143b3b9ef115 ]

On some platforms(e.g. rk3399 board), we can call hcd_add/remove
consecutively without calling usb_put_hcd/usb_create_hcd in between,
so hcd->flags can be stale.

If the HC dies due to whatever reason then without this patch we get
the below error on next hcd_add.

[173.296154] xhci-hcd xhci-hcd.2.auto: HC died; cleaning up
[173.296209] xhci-hcd xhci-hcd.2.auto: xHCI Host Controller
[173.296762] xhci-hcd xhci-hcd.2.auto: new USB bus registered, assigned bus 
number 6
[173.296931] usb usb6: We don't know the algorithms for LPM for this host, 
disabling LPM.
[173.297179] usb usb6: New USB device found, idVendor=1d6b, idProduct=0003
[173.297203] usb usb6: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[173.297222] usb usb6: Product: xHCI Host Controller
[173.297240] usb usb6: Manufacturer: Linux 4.4.21 xhci-hcd
[173.297257] usb usb6: SerialNumber: xhci-hcd.2.auto
[173.298680] hub 6-0:1.0: USB hub found
[173.298749] hub 6-0:1.0: 1 port detected
[173.299382] rockchip-dwc3 usb@fe80: USB HOST connected
[173.395418] hub 5-0:1.0: activate --> -19
[173.603447] irq 228: nobody cared (try booting with the "irqpoll" option)
[173.603493] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.21 #9
[173.603513] Hardware name: Google Kevin (DT)
[173.603531] Call trace:
[173.603568] [] dump_backtrace+0x0/0x160
[173.603596] [] show_stack+0x20/0x28
[173.603623] [] dump_stack+0x90/0xb0
[173.603650] [] __report_bad_irq+0x48/0xe8
[173.603674] [] note_interrupt+0x1e8/0x28c
[173.603698] [] handle_irq_event_percpu+0x1d4/0x25c
[173.603722] [] handle_irq_event+0x4c/0x7c
[173.603748] [] handle_fasteoi_irq+0xb4/0x124
[173.603777] [] generic_handle_irq+0x30/0x44
[173.603804] [] __handle_domain_irq+0x90/0xbc
[173.603827] [] gic_handle_irq+0xcc/0x188
...
[173.604500] [] el1_irq+0x80/0xf8
[173.604530] [] cpu_startup_entry+0x38/0x3cc
[173.604558] [] rest_init+0x8c/0x94
[173.604585] [] start_kernel+0x3d0/0x3fc
[173.604607] [<00b16000>] 0xb16000
[173.604622] handlers:
[173.604648] [] usb_hcd_irq
[173.604673] Disabling IRQ #228

Signed-off-by: William wu 
Acked-by: Roger Quadros 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 drivers/usb/core/hcd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 882fc4e08284..fcc7aa248ce7 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -3023,6 +3023,7 @@ void usb_remove_hcd(struct usb_hcd *hcd)
}
 
usb_put_invalidate_rhdev(hcd);
+   hcd->flags = 0;
 }
 EXPORT_SYMBOL_GPL(usb_remove_hcd);
 
-- 
2.11.0

[PATCH AUTOSEL for 4.4 17/25] serial: sh-sci: Fix register offsets for the IRDA serial port

[Levin, Alexander (Sasha Levin)]

From: Laurent Pinchart 

[ Upstream commit a752ba18af8285e3eeda572f40dddaebff0c3621 ]

Even though most of its registers are 8-bit wide, the IRDA has two
16-bit registers that make it a 16-bit peripheral and not a 8-bit
peripheral with addresses shifted by one. Fix the registers offset in
the driver and the platform data regshift value.

Signed-off-by: Laurent Pinchart 
Reviewed-by: Geert Uytterhoeven 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 arch/sh/kernel/cpu/sh3/setup-sh770x.c |  1 -
 drivers/tty/serial/sh-sci.c   | 17 -
 2 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/arch/sh/kernel/cpu/sh3/setup-sh770x.c 
b/arch/sh/kernel/cpu/sh3/setup-sh770x.c
index 538c10db3537..8dc315b212c2 100644
--- a/arch/sh/kernel/cpu/sh3/setup-sh770x.c
+++ b/arch/sh/kernel/cpu/sh3/setup-sh770x.c
@@ -165,7 +165,6 @@ static struct plat_sci_port scif2_platform_data = {
.scscr  = SCSCR_TE | SCSCR_RE,
.type   = PORT_IRDA,
.ops= &sh770x_sci_port_ops,
-   .regshift   = 1,
 };
 
 static struct resource scif2_resources[] = {
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 235e150d7b81..80d0ffe7abc1 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -163,18 +163,17 @@ static const struct plat_sci_reg 
sci_regmap[SCIx_NR_REGTYPES][SCIx_NR_REGS] = {
},
 
/*
-* Common definitions for legacy IrDA ports, dependent on
-* regshift value.
+* Common definitions for legacy IrDA ports.
 */
[SCIx_IRDA_REGTYPE] = {
[SCSMR] = { 0x00,  8 },
-   [SCBRR] = { 0x01,  8 },
-   [SCSCR] = { 0x02,  8 },
-   [SCxTDR]= { 0x03,  8 },
-   [SCxSR] = { 0x04,  8 },
-   [SCxRDR]= { 0x05,  8 },
-   [SCFCR] = { 0x06,  8 },
-   [SCFDR] = { 0x07, 16 },
+   [SCBRR] = { 0x02,  8 },
+   [SCSCR] = { 0x04,  8 },
+   [SCxTDR]= { 0x06,  8 },
+   [SCxSR] = { 0x08, 16 },
+   [SCxRDR]= { 0x0a,  8 },
+   [SCFCR] = { 0x0c,  8 },
+   [SCFDR] = { 0x0e, 16 },
[SCTFDR]= sci_reg_invalid,
[SCRFDR]= sci_reg_invalid,
[SCSPTR]= sci_reg_invalid,
-- 
2.11.0

[PATCH AUTOSEL for 3.18 02/15] xen/netback: set default upper limit of tx/rx queues to 8

[Levin, Alexander (Sasha Levin)]

From: Juergen Gross 

[ Upstream commit 56dd5af9bc23d0d5d23bb207c477715b4c2216c5 ]

The default for the maximum number of tx/rx queues of one interface is
the number of cpus of the system today. As each queue pair reserves 512
grant pages this default consumes a ridiculous number of grants for
large guests.

Limit the queue number to 8 as default. This value can be modified
via a module parameter if required.

Signed-off-by: Juergen Gross 
Reviewed-by: Boris Ostrovsky 
Signed-off-by: Boris Ostrovsky 
Signed-off-by: Sasha Levin 
---
 drivers/net/xen-netback/netback.c | 6 --
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/xen-netback/netback.c 
b/drivers/net/xen-netback/netback.c
index 7a85ff54a39f..50b7731025c1 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -67,6 +67,7 @@ module_param(rx_drain_timeout_msecs, uint, 0444);
 unsigned int rx_stall_timeout_msecs = 6;
 module_param(rx_stall_timeout_msecs, uint, 0444);
 
+#define MAX_QUEUES_DEFAULT 8
 unsigned int xenvif_max_queues;
 module_param_named(max_queues, xenvif_max_queues, uint, 0644);
 MODULE_PARM_DESC(max_queues,
@@ -2189,11 +2190,12 @@ static int __init netback_init(void)
if (!xen_domain())
return -ENODEV;
 
-   /* Allow as many queues as there are CPUs if user has not
+   /* Allow as many queues as there are CPUs but max. 8 if user has not
 * specified a value.
 */
if (xenvif_max_queues == 0)
-   xenvif_max_queues = num_online_cpus();
+   xenvif_max_queues = min_t(unsigned int, MAX_QUEUES_DEFAULT,
+ num_online_cpus());
 
if (fatal_skb_slots < XEN_NETBK_LEGACY_SLOTS_MAX) {
pr_info("fatal_skb_slots too small (%d), bump it to 
XEN_NETBK_LEGACY_SLOTS_MAX (%d)\n",
-- 
2.11.0

[PATCH AUTOSEL for 4.4 15/25] dt-bindings: Add vendor prefix for LEGO

[Levin, Alexander (Sasha Levin)]

From: David Lechner 

[ Upstream commit 7dcc31e2e68a386a29070384b51683ece80982bf ]

Add a vendor prefix for LEGO Systems A/S

Acked-by: Rob Herring 
Signed-off-by: David Lechner 
Signed-off-by: Sekhar Nori 
Signed-off-by: Sasha Levin 
---
 Documentation/devicetree/bindings/vendor-prefixes.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt 
b/Documentation/devicetree/bindings/vendor-prefixes.txt
index 98dc17507a84..0e89f04b7916 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -126,6 +126,7 @@ keymile Keymile GmbH
 kinetic Kinetic Technologies
 lacie  LaCie
 lantiq Lantiq Semiconductor
+lego   LEGO Systems A/S
 lenovo Lenovo Group Ltd.
 lg LG Corporation
 linux  Linux-specific binding
-- 
2.11.0

[PATCH AUTOSEL for 4.4 19/25] netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev family

[Levin, Alexander (Sasha Levin)]

From: Liping Zhang 

[ Upstream commit f169fd695b192dd7b23aff8e69d25a1bc881bbfa ]

After adding the following nft rule, then ping 224.0.0.1:
  # nft add rule netdev t c pkttype host counter

The warning complain message will be printed out again and again:
  WARNING: CPU: 0 PID: 10182 at net/netfilter/nft_meta.c:163 \
   nft_meta_get_eval+0x3fe/0x460 [nft_meta]
  [...]
  Call Trace:
  
  dump_stack+0x85/0xc2
  __warn+0xcb/0xf0
  warn_slowpath_null+0x1d/0x20
  nft_meta_get_eval+0x3fe/0x460 [nft_meta]
  nft_do_chain+0xff/0x5e0 [nf_tables]

So we should deal with PACKET_LOOPBACK in netdev family too. For ipv4,
convert it to PACKET_BROADCAST/MULTICAST according to the destination
address's type; For ipv6, convert it to PACKET_MULTICAST directly.

Signed-off-by: Liping Zhang 
Signed-off-by: Pablo Neira Ayuso 
Signed-off-by: Sasha Levin 
---
 net/netfilter/nft_meta.c | 28 +++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 9dfaf4d55ee0..a97a5bf716be 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -151,8 +151,34 @@ void nft_meta_get_eval(const struct nft_expr *expr,
else
*dest = PACKET_BROADCAST;
break;
+   case NFPROTO_NETDEV:
+   switch (skb->protocol) {
+   case htons(ETH_P_IP): {
+   int noff = skb_network_offset(skb);
+   struct iphdr *iph, _iph;
+
+   iph = skb_header_pointer(skb, noff,
+sizeof(_iph), &_iph);
+   if (!iph)
+   goto err;
+
+   if (ipv4_is_multicast(iph->daddr))
+   *dest = PACKET_MULTICAST;
+   else
+   *dest = PACKET_BROADCAST;
+
+   break;
+   }
+   case htons(ETH_P_IPV6):
+   *dest = PACKET_MULTICAST;
+   break;
+   default:
+   WARN_ON_ONCE(1);
+   goto err;
+   }
+   break;
default:
-   WARN_ON(1);
+   WARN_ON_ONCE(1);
goto err;
}
break;
-- 
2.11.0

[PATCH AUTOSEL for 4.9 28/50] phy: increase size of MII_BUS_ID_SIZE and bus_id

[Levin, Alexander (Sasha Levin)]

From: Volodymyr Bendiuga 

[ Upstream commit 4567d686f5c6d955e57a3afa1741944c1e7f4033 ]

Some bus names are pretty long and do not fit into
17 chars. Increase therefore MII_BUS_ID_SIZE and
phy_fixup.bus_id to larger number. Now mii_bus.id
can host larger name.

Signed-off-by: Volodymyr Bendiuga 
Signed-off-by: Magnus Öberg 
Reviewed-by: Andrew Lunn 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 include/linux/phy.h | 8 ++--
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/include/linux/phy.h b/include/linux/phy.h
index 8431c8c0c320..a04d69ab7c34 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -142,11 +142,7 @@ static inline const char *phy_modes(phy_interface_t 
interface)
 /* Used when trying to connect to a specific phy (mii bus id:phy device id) */
 #define PHY_ID_FMT "%s:%02x"
 
-/*
- * Need to be a little smaller than phydev->dev.bus_id to leave room
- * for the ":%02x"
- */
-#define MII_BUS_ID_SIZE(20 - 3)
+#define MII_BUS_ID_SIZE61
 
 /* Or MII_ADDR_C45 into regnum for read/write on mii_bus to enable the 21 bit
IEEE 802.3ae clause 45 addressing mode used by 10GIGE phy chips. */
@@ -602,7 +598,7 @@ struct phy_driver {
 /* A Structure for boards to register fixups with the PHY Lib */
 struct phy_fixup {
struct list_head list;
-   char bus_id[20];
+   char bus_id[MII_BUS_ID_SIZE + 3];
u32 phy_uid;
u32 phy_uid_mask;
int (*run)(struct phy_device *phydev);
-- 
2.11.0

[PATCH AUTOSEL for 4.9 15/50] powerpc/corenet: explicitly disable the SDHC controller on kmcoge4

[Levin, Alexander (Sasha Levin)]

From: Valentin Longchamp 

[ Upstream commit a674c7d470bb47e82f4eb1fa944eadeac2f6bbaf ]

It is not implemented on the kmcoge4 hardware and if not disabled it
leads to error messages with the corenet32_smp_defconfig.

Signed-off-by: Valentin Longchamp 
Signed-off-by: Scott Wood 
Signed-off-by: Sasha Levin 
---
 arch/powerpc/boot/dts/fsl/kmcoge4.dts | 4 
 1 file changed, 4 insertions(+)

diff --git a/arch/powerpc/boot/dts/fsl/kmcoge4.dts 
b/arch/powerpc/boot/dts/fsl/kmcoge4.dts
index ae70a24094b0..e103c0f3f650 100644
--- a/arch/powerpc/boot/dts/fsl/kmcoge4.dts
+++ b/arch/powerpc/boot/dts/fsl/kmcoge4.dts
@@ -83,6 +83,10 @@
};
};
 
+   sdhc@114000 {
+   status = "disabled";
+   };
+
i2c@119000 {
status = "disabled";
};
-- 
2.11.0

[PATCH AUTOSEL for 4.4 08/25] KVM: PPC: Book 3S: XICS: correct the real mode ICP rejecting counter

[Levin, Alexander (Sasha Levin)]

From: Li Zhong 

[ Upstream commit 37451bc95dee0e666927d6ffdda302dbbaaae6fa ]

Some counters are added in Commit 6e0365b78273 ("KVM: PPC: Book3S HV:
Add ICP real mode counters"), to provide some performance statistics to
determine whether further optimizing is needed for real mode functions.

The n_reject counter counts how many times ICP rejects an irq because of
priority in real mode. The redelivery of an lsi that is still asserted
after eoi doesn't fall into this category, so the increasement there is
removed.

Also, it needs to be increased in icp_rm_deliver_irq() if it rejects
another one.

Signed-off-by: Li Zhong 
Signed-off-by: Paul Mackerras 
Signed-off-by: Sasha Levin 
---
 arch/powerpc/kvm/book3s_hv_rm_xics.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/kvm/book3s_hv_rm_xics.c 
b/arch/powerpc/kvm/book3s_hv_rm_xics.c
index 24f58076d49e..1d2bc84338bf 100644
--- a/arch/powerpc/kvm/book3s_hv_rm_xics.c
+++ b/arch/powerpc/kvm/book3s_hv_rm_xics.c
@@ -280,6 +280,7 @@ static void icp_rm_deliver_irq(struct kvmppc_xics *xics, 
struct kvmppc_icp *icp,
 */
if (reject && reject != XICS_IPI) {
arch_spin_unlock(&ics->lock);
+   icp->n_reject++;
new_irq = reject;
goto again;
}
@@ -611,10 +612,8 @@ int kvmppc_rm_h_eoi(struct kvm_vcpu *vcpu, unsigned long 
xirr)
state = &ics->irq_state[src];
 
/* Still asserted, resend it */
-   if (state->asserted) {
-   icp->n_reject++;
+   if (state->asserted)
icp_rm_deliver_irq(xics, icp, irq);
-   }
 
if (!hlist_empty(&vcpu->kvm->irq_ack_notifier_list)) {
icp->rm_action |= XICS_RM_NOTIFY_EOI;
-- 
2.11.0

[PATCH AUTOSEL for 4.9 47/50] wcn36xx: Don't use the destroyed hal_mutex

[Levin, Alexander (Sasha Levin)]

From: Bjorn Andersson 

[ Upstream commit d53628882255481b710641dd0118fbd80af6e983 ]

ieee80211_unregister_hw() might invoke operations to stop the interface,
that uses the hal_mutex. So don't destroy it until after we're done
using it.

Signed-off-by: Bjorn Andersson 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin 
---
 drivers/net/wireless/ath/wcn36xx/main.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/wcn36xx/main.c 
b/drivers/net/wireless/ath/wcn36xx/main.c
index e1d59da2ad20..ca8797c65312 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -1165,11 +1165,12 @@ static int wcn36xx_remove(struct platform_device *pdev)
wcn36xx_dbg(WCN36XX_DBG_MAC, "platform remove\n");
 
release_firmware(wcn->nv);
-   mutex_destroy(&wcn->hal_mutex);
 
ieee80211_unregister_hw(hw);
iounmap(wcn->dxe_base);
iounmap(wcn->ccu_base);
+
+   mutex_destroy(&wcn->hal_mutex);
ieee80211_free_hw(hw);
 
return 0;
-- 
2.11.0

[PATCH AUTOSEL for 4.9 46/50] s390/qeth: issue STARTLAN as first IPA command

[Levin, Alexander (Sasha Levin)]

From: Julian Wiedmann 

[ Upstream commit 1034051045d125579ab1e8fcd5a724eeb0e70149 ]

STARTLAN needs to be the first IPA command after MPC initialization
completes.
So move the qeth_send_startlan() call from the layer disciplines
into the core path, right after the MPC handshake.
While at it, replace the magic LAN OFFLINE return code
with the existing enum.

Signed-off-by: Julian Wiedmann 
Reviewed-by: Thomas Richter 
Reviewed-by: Ursula Braun 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 drivers/s390/net/qeth_core.h  |  1 -
 drivers/s390/net/qeth_core_main.c | 21 +
 drivers/s390/net/qeth_l2_main.c   | 15 ---
 drivers/s390/net/qeth_l3_main.c   | 15 ---
 4 files changed, 17 insertions(+), 35 deletions(-)

diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index f3756ca6f349..d55e6438bb5e 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -921,7 +921,6 @@ void qeth_clear_thread_running_bit(struct qeth_card *, 
unsigned long);
 int qeth_core_hardsetup_card(struct qeth_card *);
 void qeth_print_status_message(struct qeth_card *);
 int qeth_init_qdio_queues(struct qeth_card *);
-int qeth_send_startlan(struct qeth_card *);
 int qeth_send_ipa_cmd(struct qeth_card *, struct qeth_cmd_buffer *,
  int (*reply_cb)
  (struct qeth_card *, struct qeth_reply *, unsigned long),
diff --git a/drivers/s390/net/qeth_core_main.c 
b/drivers/s390/net/qeth_core_main.c
index e8c48309ebe9..21ef8023430f 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -2944,7 +2944,7 @@ int qeth_send_ipa_cmd(struct qeth_card *card, struct 
qeth_cmd_buffer *iob,
 }
 EXPORT_SYMBOL_GPL(qeth_send_ipa_cmd);
 
-int qeth_send_startlan(struct qeth_card *card)
+static int qeth_send_startlan(struct qeth_card *card)
 {
int rc;
struct qeth_cmd_buffer *iob;
@@ -2957,7 +2957,6 @@ int qeth_send_startlan(struct qeth_card *card)
rc = qeth_send_ipa_cmd(card, iob, NULL, NULL);
return rc;
 }
-EXPORT_SYMBOL_GPL(qeth_send_startlan);
 
 static int qeth_default_setadapterparms_cb(struct qeth_card *card,
struct qeth_reply *reply, unsigned long data)
@@ -5091,6 +5090,20 @@ retriable:
goto out;
}
 
+   rc = qeth_send_startlan(card);
+   if (rc) {
+   QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc);
+   if (rc == IPA_RC_LAN_OFFLINE) {
+   dev_warn(&card->gdev->dev,
+   "The LAN is offline\n");
+   card->lan_online = 0;
+   } else {
+   rc = -ENODEV;
+   goto out;
+   }
+   } else
+   card->lan_online = 1;
+
card->options.ipa4.supported_funcs = 0;
card->options.ipa6.supported_funcs = 0;
card->options.adp.supported_funcs = 0;
@@ -5102,14 +5115,14 @@ retriable:
if (qeth_is_supported(card, IPA_SETADAPTERPARMS)) {
rc = qeth_query_setadapterparms(card);
if (rc < 0) {
-   QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc);
+   QETH_DBF_TEXT_(SETUP, 2, "7err%d", rc);
goto out;
}
}
if (qeth_adp_supported(card, IPA_SETADP_SET_DIAG_ASSIST)) {
rc = qeth_query_setdiagass(card);
if (rc < 0) {
-   QETH_DBF_TEXT_(SETUP, 2, "7err%d", rc);
+   QETH_DBF_TEXT_(SETUP, 2, "8err%d", rc);
goto out;
}
}
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 5d010aa89852..8530477caab8 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -1204,21 +1204,6 @@ static int __qeth_l2_set_online(struct ccwgroup_device 
*gdev, int recovery_mode)
/* softsetup */
QETH_DBF_TEXT(SETUP, 2, "softsetp");
 
-   rc = qeth_send_startlan(card);
-   if (rc) {
-   QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
-   if (rc == 0xe080) {
-   dev_warn(&card->gdev->dev,
-   "The LAN is offline\n");
-   card->lan_online = 0;
-   goto contin;
-   }
-   rc = -ENODEV;
-   goto out_remove;
-   } else
-   card->lan_online = 1;
-
-contin:
if ((card->info.type == QETH_CARD_TYPE_OSD) ||
(card->info.type == QETH_CARD_TYPE_OSX)) {
rc = qeth_l2_start_ipassists(card);
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 171be5ec2ece..03a2619166ca 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -3230,21 +3230,6 @@ static int __qeth_l3_set_online(struct ccwgroup_device 
*gdev, int recovery_mode)
/* softse

[PATCH AUTOSEL for 4.9 50/50] net: dsa: select NET_SWITCHDEV

[Levin, Alexander (Sasha Levin)]

From: Vivien Didelot 

[ Upstream commit 3a89eaa65db68bf53bf92dedc60084f810e1779a ]

The support for DSA Ethernet switch chips depends on TCP/IP networking,
thus explicit that HAVE_NET_DSA depends on INET.

DSA uses SWITCHDEV, thus select it instead of depending on it.

Signed-off-by: Vivien Didelot 
Reviewed-by: Andrew Lunn 
Reviewed-by: Florian Fainelli 
Tested-by: Randy Dunlap 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin 
---
 net/dsa/Kconfig | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/dsa/Kconfig b/net/dsa/Kconfig
index 96e47c539bee..39bb5b3a82f2 100644
--- a/net/dsa/Kconfig
+++ b/net/dsa/Kconfig
@@ -1,12 +1,13 @@
 config HAVE_NET_DSA
def_bool y
-   depends on NETDEVICES && !S390
+   depends on INET && NETDEVICES && !S390
 
 # Drivers must select NET_DSA and the appropriate tagging format
 
 config NET_DSA
tristate "Distributed Switch Architecture"
-   depends on HAVE_NET_DSA && NET_SWITCHDEV
+   depends on HAVE_NET_DSA
+   select NET_SWITCHDEV
select PHYLIB
---help---
  Say Y if you want to enable support for the hardware switches 
supported
-- 
2.11.0

[PATCH AUTOSEL for 4.9 21/50] iio: trigger: free trigger resource correctly

[Levin, Alexander (Sasha Levin)]

From: Alison Schofield 

[ Upstream commit 10e840dfb0b7fc345082dd9e5fff3c1c02e7690e ]

These stand-alone trigger drivers were using iio_trigger_put()
where they should have been using iio_trigger_free().  The
iio_trigger_put() adds a module_put which is bad since they
never did a module_get.

In the sysfs driver, module_get/put's are used as triggers are
added & removed. This extra module_put() occurs on an error path
in the probe routine (probably rare).

In the bfin-timer & interrupt trigger drivers, the module resources
are not explicitly managed, so it's doing a put on something that
was never get'd.  It occurs on the probe error path and on the
remove path (not so rare).

Tested with the sysfs trigger driver.
The bfin & interrupt drivers were build tested & inspected only.

Signed-off-by: Alison Schofield 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Sasha Levin 
---
 drivers/iio/trigger/iio-trig-interrupt.c  | 8 
 drivers/iio/trigger/iio-trig-sysfs.c  | 2 +-
 drivers/staging/iio/trigger/iio-trig-bfin-timer.c | 4 ++--
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/iio/trigger/iio-trig-interrupt.c 
b/drivers/iio/trigger/iio-trig-interrupt.c
index 572bc6f02ca8..e18f12b74610 100644
--- a/drivers/iio/trigger/iio-trig-interrupt.c
+++ b/drivers/iio/trigger/iio-trig-interrupt.c
@@ -58,7 +58,7 @@ static int iio_interrupt_trigger_probe(struct platform_device 
*pdev)
trig_info = kzalloc(sizeof(*trig_info), GFP_KERNEL);
if (!trig_info) {
ret = -ENOMEM;
-   goto error_put_trigger;
+   goto error_free_trigger;
}
iio_trigger_set_drvdata(trig, trig_info);
trig_info->irq = irq;
@@ -83,8 +83,8 @@ error_release_irq:
free_irq(irq, trig);
 error_free_trig_info:
kfree(trig_info);
-error_put_trigger:
-   iio_trigger_put(trig);
+error_free_trigger:
+   iio_trigger_free(trig);
 error_ret:
return ret;
 }
@@ -99,7 +99,7 @@ static int iio_interrupt_trigger_remove(struct 
platform_device *pdev)
iio_trigger_unregister(trig);
free_irq(trig_info->irq, trig);
kfree(trig_info);
-   iio_trigger_put(trig);
+   iio_trigger_free(trig);
 
return 0;
 }
diff --git a/drivers/iio/trigger/iio-trig-sysfs.c 
b/drivers/iio/trigger/iio-trig-sysfs.c
index 3dfab2bc6d69..202e8b89caf2 100644
--- a/drivers/iio/trigger/iio-trig-sysfs.c
+++ b/drivers/iio/trigger/iio-trig-sysfs.c
@@ -174,7 +174,7 @@ static int iio_sysfs_trigger_probe(int id)
return 0;
 
 out2:
-   iio_trigger_put(t->trig);
+   iio_trigger_free(t->trig);
 free_t:
kfree(t);
 out1:
diff --git a/drivers/staging/iio/trigger/iio-trig-bfin-timer.c 
b/drivers/staging/iio/trigger/iio-trig-bfin-timer.c
index 38dca69a06eb..ce500a509aa2 100644
--- a/drivers/staging/iio/trigger/iio-trig-bfin-timer.c
+++ b/drivers/staging/iio/trigger/iio-trig-bfin-timer.c
@@ -260,7 +260,7 @@ out_free_irq:
 out1:
iio_trigger_unregister(st->trig);
 out:
-   iio_trigger_put(st->trig);
+   iio_trigger_free(st->trig);
return ret;
 }
 
@@ -273,7 +273,7 @@ static int iio_bfin_tmr_trigger_remove(struct 
platform_device *pdev)
peripheral_free(st->t->pin);
free_irq(st->irq, st);
iio_trigger_unregister(st->trig);
-   iio_trigger_put(st->trig);
+   iio_trigger_free(st->trig);
 
return 0;
 }
-- 
2.11.0

[PATCH AUTOSEL for 4.4 03/25] PCI: mvebu: Handle changes to the bridge windows while enabled

[Levin, Alexander (Sasha Levin)]

From: Jason Gunthorpe 

[ Upstream commit d9bf28e2650fe3eeefed7e34841aea07d10c6543 ]

The PCI core will write to the bridge window config multiple times while
they are enabled.  This can lead to mbus failures like this:

 mvebu_mbus: cannot add window '4:e8', conflicts with another window
 mvebu-pcie mbus:pex@e000: Could not create MBus window at [mem 
0xe000-0xe00f]: -22

For me this is happening during a hotplug cycle.  The PCI core is not
changing the values, just writing them twice while active.

The patch addresses the general case of any change to an active window, but
not atomically.  The code is slightly refactored so io and mem can share
more of the window logic.

Signed-off-by: Jason Gunthorpe 
Signed-off-by: Bjorn Helgaas 
Acked-by: Jason Cooper 
Signed-off-by: Sasha Levin 
---
 drivers/pci/host/pci-mvebu.c | 101 +--
 1 file changed, 60 insertions(+), 41 deletions(-)

diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c
index 53b79c5f0559..379d08f76146 100644
--- a/drivers/pci/host/pci-mvebu.c
+++ b/drivers/pci/host/pci-mvebu.c
@@ -131,6 +131,12 @@ struct mvebu_pcie {
int nports;
 };
 
+struct mvebu_pcie_window {
+   phys_addr_t base;
+   phys_addr_t remap;
+   size_t size;
+};
+
 /* Structure representing one PCIe interface */
 struct mvebu_pcie_port {
char *name;
@@ -148,10 +154,8 @@ struct mvebu_pcie_port {
struct mvebu_sw_pci_bridge bridge;
struct device_node *dn;
struct mvebu_pcie *pcie;
-   phys_addr_t memwin_base;
-   size_t memwin_size;
-   phys_addr_t iowin_base;
-   size_t iowin_size;
+   struct mvebu_pcie_window memwin;
+   struct mvebu_pcie_window iowin;
u32 saved_pcie_stat;
 };
 
@@ -377,23 +381,45 @@ static void mvebu_pcie_add_windows(struct mvebu_pcie_port 
*port,
}
 }
 
+static void mvebu_pcie_set_window(struct mvebu_pcie_port *port,
+ unsigned int target, unsigned int attribute,
+ const struct mvebu_pcie_window *desired,
+ struct mvebu_pcie_window *cur)
+{
+   if (desired->base == cur->base && desired->remap == cur->remap &&
+   desired->size == cur->size)
+   return;
+
+   if (cur->size != 0) {
+   mvebu_pcie_del_windows(port, cur->base, cur->size);
+   cur->size = 0;
+   cur->base = 0;
+
+   /*
+* If something tries to change the window while it is enabled
+* the change will not be done atomically. That would be
+* difficult to do in the general case.
+*/
+   }
+
+   if (desired->size == 0)
+   return;
+
+   mvebu_pcie_add_windows(port, target, attribute, desired->base,
+  desired->size, desired->remap);
+   *cur = *desired;
+}
+
 static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port)
 {
-   phys_addr_t iobase;
+   struct mvebu_pcie_window desired = {};
 
/* Are the new iobase/iolimit values invalid? */
if (port->bridge.iolimit < port->bridge.iobase ||
port->bridge.iolimitupper < port->bridge.iobaseupper ||
!(port->bridge.command & PCI_COMMAND_IO)) {
-
-   /* If a window was configured, remove it */
-   if (port->iowin_base) {
-   mvebu_pcie_del_windows(port, port->iowin_base,
-  port->iowin_size);
-   port->iowin_base = 0;
-   port->iowin_size = 0;
-   }
-
+   mvebu_pcie_set_window(port, port->io_target, port->io_attr,
+ &desired, &port->iowin);
return;
}
 
@@ -410,32 +436,27 @@ static void mvebu_pcie_handle_iobase_change(struct 
mvebu_pcie_port *port)
 * specifications. iobase is the bus address, port->iowin_base
 * is the CPU address.
 */
-   iobase = ((port->bridge.iobase & 0xF0) << 8) |
-   (port->bridge.iobaseupper << 16);
-   port->iowin_base = port->pcie->io.start + iobase;
-   port->iowin_size = ((0xFFF | ((port->bridge.iolimit & 0xF0) << 8) |
-   (port->bridge.iolimitupper << 16)) -
-   iobase) + 1;
-
-   mvebu_pcie_add_windows(port, port->io_target, port->io_attr,
-  port->iowin_base, port->iowin_size,
-  iobase);
+   desired.remap = ((port->bridge.iobase & 0xF0) << 8) |
+   (port->bridge.iobaseupper << 16);
+   desired.base = port->pcie->io.start + desired.remap;
+   desired.size = ((0xFFF | ((port->bridge.iolimit & 0xF0) << 8) |
+(port->bridge.iolimitupper << 16)) -
+   desired.remap) +
+  1;
+
+

[PATCH AUTOSEL for 4.4 02/25] video: fbdev: pmag-ba-fb: Remove bad `__init' annotation

[Levin, Alexander (Sasha Levin)]

From: "Maciej W. Rozycki" 

[ Upstream commit 879e5a0df626f39cbb3c61bb90373e56d67012c4 ]

Fix:

WARNING: drivers/video/fbdev/pmag-ba-fb.o(.text+0x308): Section mismatch in 
reference from the function pmagbafb_probe() to the function 
.init.text:pmagbafb_erase_cursor()
The function pmagbafb_probe()
references the function __init pmagbafb_erase_cursor().
This is often because pmagbafb_probe lacks a __init
annotation or the annotation of pmagbafb_erase_cursor is wrong.

-- a fallout from a missed update from commit 9625b51350cc ("VIDEO:
PMAG-BA: Fix section mismatch") and then commit 48c68c4f1b54 ("Drivers:
video: remove __dev* attributes.")

Signed-off-by: Maciej W. Rozycki 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Sasha Levin 
---
 drivers/video/fbdev/pmag-ba-fb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/pmag-ba-fb.c b/drivers/video/fbdev/pmag-ba-fb.c
index 914a52ba8477..77837665ce89 100644
--- a/drivers/video/fbdev/pmag-ba-fb.c
+++ b/drivers/video/fbdev/pmag-ba-fb.c
@@ -129,7 +129,7 @@ static struct fb_ops pmagbafb_ops = {
 /*
  * Turn the hardware cursor off.
  */
-static void __init pmagbafb_erase_cursor(struct fb_info *info)
+static void pmagbafb_erase_cursor(struct fb_info *info)
 {
struct pmagbafb_par *par = info->par;
 
-- 
2.11.0

[PATCH AUTOSEL for 4.9 49/50] clk: mvebu: adjust AP806 CPU clock frequencies to production chip

[Levin, Alexander (Sasha Levin)]

From: Thomas Petazzoni 

[ Upstream commit 0c70ffc5f300e7c3a1a76ca0530860574afc890b ]

This commit adjusts the list of possible "Sample At Reset" values that
define the CPU clock frequency of the AP806 (part of Marvell Armada
7K/8K) to the values that have been validated with the production
chip. Earlier values were preliminary.

Signed-off-by: Thomas Petazzoni 
Signed-off-by: Stephen Boyd 
Signed-off-by: Sasha Levin 
---
 drivers/clk/mvebu/ap806-system-controller.c | 28 +++-
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/drivers/clk/mvebu/ap806-system-controller.c 
b/drivers/clk/mvebu/ap806-system-controller.c
index 02023baf86c9..962e0c5f6f4d 100644
--- a/drivers/clk/mvebu/ap806-system-controller.c
+++ b/drivers/clk/mvebu/ap806-system-controller.c
@@ -55,21 +55,39 @@ static int ap806_syscon_clk_probe(struct platform_device 
*pdev)
 
freq_mode = reg & AP806_SAR_CLKFREQ_MODE_MASK;
switch (freq_mode) {
-   case 0x0 ... 0x5:
+   case 0x0:
+   case 0x1:
cpuclk_freq = 2000;
break;
-   case 0x6 ... 0xB:
+   case 0x6:
+   case 0x7:
cpuclk_freq = 1800;
break;
-   case 0xC ... 0x11:
+   case 0x4:
+   case 0xB:
+   case 0xD:
cpuclk_freq = 1600;
break;
-   case 0x12 ... 0x16:
+   case 0x1a:
cpuclk_freq = 1400;
break;
-   case 0x17 ... 0x19:
+   case 0x14:
+   case 0x17:
cpuclk_freq = 1300;
break;
+   case 0x19:
+   cpuclk_freq = 1200;
+   break;
+   case 0x13:
+   case 0x1d:
+   cpuclk_freq = 1000;
+   break;
+   case 0x1c:
+   cpuclk_freq = 800;
+   break;
+   case 0x1b:
+   cpuclk_freq = 600;
+   break;
default:
dev_err(&pdev->dev, "invalid SAR value\n");
return -EINVAL;
-- 
2.11.0

[PATCH AUTOSEL for 4.9 44/50] ARM: dts: STiH410-family: fix wrong parent clock frequency

[Levin, Alexander (Sasha Levin)]

From: Patrice Chotard 

[ Upstream commit b9ec866d223f38eb0bf2a7c836e10031ee17f7af ]

The clock parent was lower than child clock which is not correct.
In some use case, it leads to division by zero.

Signed-off-by: Gabriel Fernandez 
Signed-off-by: Sasha Levin 
---
 arch/arm/boot/dts/stih410.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/stih410.dtsi b/arch/arm/boot/dts/stih410.dtsi
index a3ef7341c051..4d329b2908be 100644
--- a/arch/arm/boot/dts/stih410.dtsi
+++ b/arch/arm/boot/dts/stih410.dtsi
@@ -131,7 +131,7 @@
 <&clk_s_d2_quadfs 0>;
 
assigned-clock-rates = <29700>,
-  <10800>,
+  <29700>,
   <0>,
   <4>,
   <4>;
-- 
2.11.0

[PATCH AUTOSEL for 4.9 43/50] regulator: core: Don't use regulators as supplies until the parent is bound

[Levin, Alexander (Sasha Levin)]

From: Jon Hunter 

[ Upstream commit 66d228a2bf03b163ddaeca5f24f1ff89a84ad668 ]

When regulators are successfully registered, we check to see if the
regulator is a supply for any other registered regulator and if so
add the new regulator as the supply for the existing regulator(s).

Some devices, such as Power Management ICs, may register a series of
regulators when probed and there are cases where one of the regulators
may fail to register and defer the probing of the parent device. In this
case any successfully registered regulators would be unregistered so
that they can be re-registered at some time later when the probe is
attempted again. However, if one of the regulators that was registered
was added as a supply to another registered regulator (that did not
belong to the same parent device), then this supply regulator was
unregister again because the parent device is probe deferred, then a
regulator could be holding an invalid reference to a supply regulator
that has been unregistered. This will lead to a system crash if that
regulator is then used.

Although it would be possible to check when unregistering a regulator
if any other regulator in the system is using it as a supply, it still
may not be possible to remove it as a supply if this other regulator is
in use. Therefore, fix this by preventing any regulator from adding
another regulator as a supply if the parent device for the supply
regulator has not been bound and if the parent device for the supply
and the regulator are different. This will allow a parent device that is
registering regulators to be probe deferred and ensure that none of the
regulators it has registered are used as supplies for any other
regulator from another device.

Signed-off-by: Jon Hunter 
Signed-off-by: Mark Brown 
Signed-off-by: Sasha Levin 
---
 drivers/regulator/core.c | 13 +
 1 file changed, 13 insertions(+)

diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 9403245503de..e6941404c7dc 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1552,6 +1552,19 @@ static int regulator_resolve_supply(struct regulator_dev 
*rdev)
}
}
 
+   /*
+* If the supply's parent device is not the same as the
+* regulator's parent device, then ensure the parent device
+* is bound before we resolve the supply, in case the parent
+* device get probe deferred and unregisters the supply.
+*/
+   if (r->dev.parent && r->dev.parent != rdev->dev.parent) {
+   if (!device_is_bound(r->dev.parent)) {
+   put_device(&r->dev);
+   return -EPROBE_DEFER;
+   }
+   }
+
/* Recursively resolve the supply of the supply */
ret = regulator_resolve_supply(r);
if (ret < 0) {
-- 
2.11.0

[PATCH AUTOSEL for 4.9 41/50] sched/cputime, powerpc32: Fix stale scaled stime on context switch

[Levin, Alexander (Sasha Levin)]

From: Frederic Weisbecker 

[ Upstream commit 90d08ba2b9b4be4aeca6a5b5a4b09fbcde30194d ]

On context switch with powerpc32, the cputime is accumulated in the
thread_info struct. So the switching-in task must move forward its
start time snapshot to the current time in order to later compute the
delta spent in system mode.

This is what we do for the normal cputime by initializing the starttime
field to the value of the previous task's starttime which got freshly
updated.

But we are missing the update of the scaled cputime start time. As a
result we may be accounting too much scaled cputime later.

Fix this by initializing the scaled cputime the same way we do for
normal cputime.

Signed-off-by: Frederic Weisbecker 
Acked-by: Thomas Gleixner 
Cc: Benjamin Herrenschmidt 
Cc: Christian Borntraeger 
Cc: Fenghua Yu 
Cc: Heiko Carstens 
Cc: Linus Torvalds 
Cc: Martin Schwidefsky 
Cc: Michael Ellerman 
Cc: Paul Mackerras 
Cc: Peter Zijlstra 
Cc: Rik van Riel 
Cc: Stanislaw Gruszka 
Cc: Tony Luck 
Cc: Wanpeng Li 
Link: 
http://lkml.kernel.org/r/1483636310-6557-2-git-send-email-fweis...@gmail.com
Signed-off-by: Ingo Molnar 
Signed-off-by: Sasha Levin 
---
 arch/powerpc/kernel/time.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index bc3f7d0d7b79..f1d7e996e673 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -407,6 +407,7 @@ void arch_vtime_task_switch(struct task_struct *prev)
struct cpu_accounting_data *acct = get_accounting(current);
 
acct->starttime = get_accounting(prev)->starttime;
+   acct->startspurr = get_accounting(prev)->startspurr;
acct->system_time = 0;
acct->user_time = 0;
 }
-- 
2.11.0

[PATCH AUTOSEL for 4.9 42/50] IB/ipoib: Change list_del to list_del_init in the tx object

[Levin, Alexander (Sasha Levin)]

From: Feras Daoud 

[ Upstream commit 27d41d29c7f093f6f77843624fbb080c1b4a8b9c ]

Since ipoib_cm_tx_start function and ipoib_cm_tx_reap function
belong to different work queues, they can run in parallel.
In this case if ipoib_cm_tx_reap calls list_del and release the
lock, ipoib_cm_tx_start may acquire it and call list_del_init
on the already deleted object.
Changing list_del to list_del_init in ipoib_cm_tx_reap fixes the problem.

Fixes: 839fcaba355a ("IPoIB: Connected mode experimental support")
Signed-off-by: Feras Daoud 
Signed-off-by: Erez Shitrit 
Reviewed-by: Alex Vesker 
Signed-off-by: Leon Romanovsky 
Reviewed-by: Yuval Shaia 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin 
---
 drivers/infiniband/ulp/ipoib/ipoib_cm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c 
b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 0616a65f0d78..75761667be59 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1392,7 +1392,7 @@ static void ipoib_cm_tx_reap(struct work_struct *work)
 
while (!list_empty(&priv->cm.reap_list)) {
p = list_entry(priv->cm.reap_list.next, typeof(*p), list);
-   list_del(&p->list);
+   list_del_init(&p->list);
spin_unlock_irqrestore(&priv->lock, flags);
netif_tx_unlock_bh(dev);
ipoib_cm_tx_destroy(p);
-- 
2.11.0

[PATCH AUTOSEL for 4.9 12/50] KVM: PPC: Book 3S: XICS: correct the real mode ICP rejecting counter

[Levin, Alexander (Sasha Levin)]

From: Li Zhong 

[ Upstream commit 37451bc95dee0e666927d6ffdda302dbbaaae6fa ]

Some counters are added in Commit 6e0365b78273 ("KVM: PPC: Book3S HV:
Add ICP real mode counters"), to provide some performance statistics to
determine whether further optimizing is needed for real mode functions.

The n_reject counter counts how many times ICP rejects an irq because of
priority in real mode. The redelivery of an lsi that is still asserted
after eoi doesn't fall into this category, so the increasement there is
removed.

Also, it needs to be increased in icp_rm_deliver_irq() if it rejects
another one.

Signed-off-by: Li Zhong 
Signed-off-by: Paul Mackerras 
Signed-off-by: Sasha Levin 
---
 arch/powerpc/kvm/book3s_hv_rm_xics.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/kvm/book3s_hv_rm_xics.c 
b/arch/powerpc/kvm/book3s_hv_rm_xics.c
index a0ea63ac2b52..a8e3498a853f 100644
--- a/arch/powerpc/kvm/book3s_hv_rm_xics.c
+++ b/arch/powerpc/kvm/book3s_hv_rm_xics.c
@@ -376,6 +376,7 @@ static void icp_rm_deliver_irq(struct kvmppc_xics *xics, 
struct kvmppc_icp *icp,
 */
if (reject && reject != XICS_IPI) {
arch_spin_unlock(&ics->lock);
+   icp->n_reject++;
new_irq = reject;
goto again;
}
@@ -707,10 +708,8 @@ int kvmppc_rm_h_eoi(struct kvm_vcpu *vcpu, unsigned long 
xirr)
state = &ics->irq_state[src];
 
/* Still asserted, resend it */
-   if (state->asserted) {
-   icp->n_reject++;
+   if (state->asserted)
icp_rm_deliver_irq(xics, icp, irq);
-   }
 
if (!hlist_empty(&vcpu->kvm->irq_ack_notifier_list)) {
icp->rm_action |= XICS_RM_NOTIFY_EOI;
-- 
2.11.0

[PATCH AUTOSEL for 4.9 29/50] serial: sh-sci: Fix register offsets for the IRDA serial port

[Levin, Alexander (Sasha Levin)]

From: Laurent Pinchart 

[ Upstream commit a752ba18af8285e3eeda572f40dddaebff0c3621 ]

Even though most of its registers are 8-bit wide, the IRDA has two
16-bit registers that make it a 16-bit peripheral and not a 8-bit
peripheral with addresses shifted by one. Fix the registers offset in
the driver and the platform data regshift value.

Signed-off-by: Laurent Pinchart 
Reviewed-by: Geert Uytterhoeven 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin 
---
 arch/sh/kernel/cpu/sh3/setup-sh770x.c |  1 -
 drivers/tty/serial/sh-sci.c   | 17 -
 2 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/arch/sh/kernel/cpu/sh3/setup-sh770x.c 
b/arch/sh/kernel/cpu/sh3/setup-sh770x.c
index 538c10db3537..8dc315b212c2 100644
--- a/arch/sh/kernel/cpu/sh3/setup-sh770x.c
+++ b/arch/sh/kernel/cpu/sh3/setup-sh770x.c
@@ -165,7 +165,6 @@ static struct plat_sci_port scif2_platform_data = {
.scscr  = SCSCR_TE | SCSCR_RE,
.type   = PORT_IRDA,
.ops= &sh770x_sci_port_ops,
-   .regshift   = 1,
 };
 
 static struct resource scif2_resources[] = {
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 7e97a1ccab23..15eaea53b3df 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -193,18 +193,17 @@ static const struct plat_sci_reg 
sci_regmap[SCIx_NR_REGTYPES][SCIx_NR_REGS] = {
},
 
/*
-* Common definitions for legacy IrDA ports, dependent on
-* regshift value.
+* Common definitions for legacy IrDA ports.
 */
[SCIx_IRDA_REGTYPE] = {
[SCSMR] = { 0x00,  8 },
-   [SCBRR] = { 0x01,  8 },
-   [SCSCR] = { 0x02,  8 },
-   [SCxTDR]= { 0x03,  8 },
-   [SCxSR] = { 0x04,  8 },
-   [SCxRDR]= { 0x05,  8 },
-   [SCFCR] = { 0x06,  8 },
-   [SCFDR] = { 0x07, 16 },
+   [SCBRR] = { 0x02,  8 },
+   [SCSCR] = { 0x04,  8 },
+   [SCxTDR]= { 0x06,  8 },
+   [SCxSR] = { 0x08, 16 },
+   [SCxRDR]= { 0x0a,  8 },
+   [SCFCR] = { 0x0c,  8 },
+   [SCFDR] = { 0x0e, 16 },
[SCTFDR]= sci_reg_invalid,
[SCRFDR]= sci_reg_invalid,
[SCSPTR]= sci_reg_invalid,
-- 
2.11.0

[PATCH AUTOSEL for 4.9 39/50] Input: mpr121 - handle multiple bits change of status register

[Levin, Alexander (Sasha Levin)]

From: Akinobu Mita 

[ Upstream commit 08fea55e37f58371bffc5336a59e55d1f155955a ]

This driver reports input events on their interrupts which are triggered
by the sensor's status register changes.  But only single bit change is
reported in the interrupt handler.  So if there are multiple bits are
changed at almost the same time, other press or release events are ignored.

This fixes it by detecting all changed bits in the status register.

Signed-off-by: Akinobu Mita 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin 
---
 drivers/input/keyboard/mpr121_touchkey.c | 23 ++-
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/drivers/input/keyboard/mpr121_touchkey.c 
b/drivers/input/keyboard/mpr121_touchkey.c
index 0fd612dd76ed..088a9f7c954e 100644
--- a/drivers/input/keyboard/mpr121_touchkey.c
+++ b/drivers/input/keyboard/mpr121_touchkey.c
@@ -87,7 +87,8 @@ static irqreturn_t mpr_touchkey_interrupt(int irq, void 
*dev_id)
struct mpr121_touchkey *mpr121 = dev_id;
struct i2c_client *client = mpr121->client;
struct input_dev *input = mpr121->input_dev;
-   unsigned int key_num, key_val, pressed;
+   unsigned long bit_changed;
+   unsigned int key_num;
int reg;
 
reg = i2c_smbus_read_byte_data(client, ELE_TOUCH_STATUS_1_ADDR);
@@ -105,18 +106,22 @@ static irqreturn_t mpr_touchkey_interrupt(int irq, void 
*dev_id)
 
reg &= TOUCH_STATUS_MASK;
/* use old press bit to figure out which bit changed */
-   key_num = ffs(reg ^ mpr121->statusbits) - 1;
-   pressed = reg & (1 << key_num);
+   bit_changed = reg ^ mpr121->statusbits;
mpr121->statusbits = reg;
+   for_each_set_bit(key_num, &bit_changed, mpr121->keycount) {
+   unsigned int key_val, pressed;
 
-   key_val = mpr121->keycodes[key_num];
+   pressed = reg & BIT(key_num);
+   key_val = mpr121->keycodes[key_num];
 
-   input_event(input, EV_MSC, MSC_SCAN, key_num);
-   input_report_key(input, key_val, pressed);
-   input_sync(input);
+   input_event(input, EV_MSC, MSC_SCAN, key_num);
+   input_report_key(input, key_val, pressed);
+
+   dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val,
+   pressed ? "pressed" : "released");
 
-   dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val,
-   pressed ? "pressed" : "released");
+   }
+   input_sync(input);
 
 out:
return IRQ_HANDLED;
-- 
2.11.0

[PATCH AUTOSEL for 4.9 38/50] s390/topology: make "topology=off" parameter work

[Levin, Alexander (Sasha Levin)]

From: Heiko Carstens 

[ Upstream commit 68cc795d1933285705ced6d841ef66c00ce98cbe ]

The "topology=off" kernel parameter is supposed to prevent the kernel
to use hardware topology information to generate scheduling domains
etc.
For an unknown reason I implemented this in a very odd way back then:
instead of simply clearing the MACHINE_HAS_TOPOLOGY flag within the
lowcore I added a second variable which indicated that topology
information should not be used. This is more than suboptimal since it
partially doesn't work.  For the fake NUMA case topology information
is still considered and scheduling domains will be created based on
this.
To fix this and to simplify the code get rid of the extra variable and
implement the "topology=off" case like it is done for other features.

Signed-off-by: Heiko Carstens 
Signed-off-by: Martin Schwidefsky 
Signed-off-by: Sasha Levin 
---
 arch/s390/kernel/early.c| 12 
 arch/s390/kernel/topology.c | 11 ++-
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
index 2374c5b46bbc..0c196861bc38 100644
--- a/arch/s390/kernel/early.c
+++ b/arch/s390/kernel/early.c
@@ -363,6 +363,18 @@ static inline void save_vector_registers(void)
 #endif
 }
 
+static int __init topology_setup(char *str)
+{
+   bool enabled;
+   int rc;
+
+   rc = kstrtobool(str, &enabled);
+   if (!rc && !enabled)
+   S390_lowcore.machine_flags &= ~MACHINE_HAS_TOPOLOGY;
+   return rc;
+}
+early_param("topology", topology_setup);
+
 static int __init disable_vector_extension(char *str)
 {
S390_lowcore.machine_flags &= ~MACHINE_FLAG_VX;
diff --git a/arch/s390/kernel/topology.c b/arch/s390/kernel/topology.c
index 8705ee66c087..239f29508f0b 100644
--- a/arch/s390/kernel/topology.c
+++ b/arch/s390/kernel/topology.c
@@ -37,7 +37,6 @@ static void set_topology_timer(void);
 static void topology_work_fn(struct work_struct *work);
 static struct sysinfo_15_1_x *tl_info;
 
-static bool topology_enabled = true;
 static DECLARE_WORK(topology_work, topology_work_fn);
 
 /*
@@ -56,7 +55,7 @@ static cpumask_t cpu_group_map(struct mask_info *info, 
unsigned int cpu)
cpumask_t mask;
 
cpumask_copy(&mask, cpumask_of(cpu));
-   if (!topology_enabled || !MACHINE_HAS_TOPOLOGY)
+   if (!MACHINE_HAS_TOPOLOGY)
return mask;
for (; info; info = info->next) {
if (cpumask_test_cpu(cpu, &info->mask))
@@ -71,7 +70,7 @@ static cpumask_t cpu_thread_map(unsigned int cpu)
int i;
 
cpumask_copy(&mask, cpumask_of(cpu));
-   if (!topology_enabled || !MACHINE_HAS_TOPOLOGY)
+   if (!MACHINE_HAS_TOPOLOGY)
return mask;
cpu -= cpu % (smp_cpu_mtid + 1);
for (i = 0; i <= smp_cpu_mtid; i++)
@@ -413,12 +412,6 @@ static const struct cpumask *cpu_drawer_mask(int cpu)
return &per_cpu(cpu_topology, cpu).drawer_mask;
 }
 
-static int __init early_parse_topology(char *p)
-{
-   return kstrtobool(p, &topology_enabled);
-}
-early_param("topology", early_parse_topology);
-
 static struct sched_domain_topology_level s390_topology[] = {
{ cpu_thread_mask, cpu_smt_flags, SD_INIT_NAME(SMT) },
{ cpu_coregroup_mask, cpu_core_flags, SD_INIT_NAME(MC) },
-- 
2.11.0

[PATCH AUTOSEL for 4.9 37/50] EDAC, amd64: Save and return err code from probe_one_instance()

[Levin, Alexander (Sasha Levin)]

From: Yazen Ghannam 

[ Upstream commit 2287c63643f0f52d9d5452b9dc4079aec0889fe8 ]

We should save the return code from probe_one_instance() so that it can
be returned from the module init function. Otherwise, we'll be returning
the -ENOMEM from above.

Signed-off-by: Yazen Ghannam 
Cc: linux-edac 
Link: 
http://lkml.kernel.org/r/1484322741-41884-1-git-send-email-yazen.ghan...@amd.com
Signed-off-by: Borislav Petkov 
Signed-off-by: Sasha Levin 
---
 drivers/edac/amd64_edac.c | 6 --
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 431e5d7de215..6e197c1c213d 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -3001,14 +3001,16 @@ static int __init amd64_edac_init(void)
if (!msrs)
goto err_free;
 
-   for (i = 0; i < amd_nb_num(); i++)
-   if (probe_one_instance(i)) {
+   for (i = 0; i < amd_nb_num(); i++) {
+   err = probe_one_instance(i);
+   if (err) {
/* unwind properly */
while (--i >= 0)
remove_one_instance(i);
 
goto err_pci;
}
+   }
 
setup_pci_device();
 
-- 
2.11.0

[PATCH AUTOSEL for 4.9 30/50] libertas: fix improper return value

[Levin, Alexander (Sasha Levin)]

From: Pan Bian 

[ Upstream commit 259010c509b6f28b3b851ae45238cf526f52e185 ]

Function lbs_cmd_802_11_sleep_params() always return 0, even if the call
to lbs_cmd_with_response() fails. In this case, the parameter @sp will
keep uninitialized. Because the return value is 0, its caller (say
lbs_sleepparams_read()) will not detect the error, and will copy the
uninitialized stack memory to user sapce, resulting in stack information
leak. To avoid the bug, this patch returns variable ret (which takes
the return value of lbs_cmd_with_response()) instead of 0.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188451

Signed-off-by: Pan Bian 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin 
---
 drivers/net/wireless/marvell/libertas/cmd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/marvell/libertas/cmd.c 
b/drivers/net/wireless/marvell/libertas/cmd.c
index 301170cccfff..033ff881c751 100644
--- a/drivers/net/wireless/marvell/libertas/cmd.c
+++ b/drivers/net/wireless/marvell/libertas/cmd.c
@@ -305,7 +305,7 @@ int lbs_cmd_802_11_sleep_params(struct lbs_private *priv, 
uint16_t cmd_action,
}
 
lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
-   return 0;
+   return ret;
 }
 
 static int lbs_wait_for_ds_awake(struct lbs_private *priv)
-- 
2.11.0

[PATCH AUTOSEL for 4.9 40/50] Input: mpr121 - set missing event capability

[Levin, Alexander (Sasha Levin)]

From: Akinobu Mita 

[ Upstream commit 9723ddc8fe0d76ce41fe0dc16afb241ec7d0a29d ]

This driver reports misc scan input events on the sensor's status
register changes.  But the event capability for them was not set in the
device initialization, so these events were ignored.

This change adds the missing event capability.

Signed-off-by: Akinobu Mita 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin 
---
 drivers/input/keyboard/mpr121_touchkey.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/input/keyboard/mpr121_touchkey.c 
b/drivers/input/keyboard/mpr121_touchkey.c
index 088a9f7c954e..aaf43befffaa 100644
--- a/drivers/input/keyboard/mpr121_touchkey.c
+++ b/drivers/input/keyboard/mpr121_touchkey.c
@@ -236,6 +236,7 @@ static int mpr_touchkey_probe(struct i2c_client *client,
input_dev->id.bustype = BUS_I2C;
input_dev->dev.parent = &client->dev;
input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP);
+   input_set_capability(input_dev, EV_MSC, MSC_SCAN);
 
input_dev->keycode = mpr121->keycodes;
input_dev->keycodesize = sizeof(mpr121->keycodes[0]);
-- 
2.11.0

[PATCH AUTOSEL for 4.9 36/50] IPsec: do not ignore crypto err in ah4 input

[Levin, Alexander (Sasha Levin)]

From: Gilad Ben-Yossef 

[ Upstream commit ebd89a2d0675f1325c2be5b7576fd8cb7e8defd0 ]

ah4 input processing uses the asynchronous hash crypto API which
supplies an error code as part of the operation completion but
the error code was being ignored.

Treat a crypto API error indication as a verification failure.

While a crypto API reported error would almost certainly result
in a memcpy of the digest failing anyway and thus the security
risk seems minor, performing a memory compare on what might be
uninitialized memory is wrong.

Signed-off-by: Gilad Ben-Yossef 
Signed-off-by: Steffen Klassert 
Signed-off-by: Sasha Levin 
---
 net/ipv4/ah4.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index f2a71025a770..22377c8ff14b 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -270,6 +270,9 @@ static void ah_input_done(struct crypto_async_request 
*base, int err)
int ihl = ip_hdrlen(skb);
int ah_hlen = (ah->hdrlen + 2) << 2;
 
+   if (err)
+   goto out;
+
work_iph = AH_SKB_CB(skb)->tmp;
auth_data = ah_tmp_auth(work_iph, ihl);
icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len);
-- 
2.11.0

[PATCH AUTOSEL for 4.9 25/50] ASoC: sunxi: Add bindings for sun8i to SPDIF

[Levin, Alexander (Sasha Levin)]

From: Marcus Cooper 

[ Upstream commit cb5c978f9a56c459d5f13901efcfe44b97c4182d ]

The H3 SoC uses the same SPDIF block as found in earlier SoCs, but the
transmit fifo is at a different address.

Signed-off-by: Marcus Cooper 
Acked-by: Maxime Ripard 
Signed-off-by: Mark Brown 
Signed-off-by: Sasha Levin 
---
 Documentation/devicetree/bindings/sound/sunxi,sun4i-spdif.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Documentation/devicetree/bindings/sound/sunxi,sun4i-spdif.txt 
b/Documentation/devicetree/bindings/sound/sunxi,sun4i-spdif.txt
index 0230c4d20506..fe0a65e6d629 100644
--- a/Documentation/devicetree/bindings/sound/sunxi,sun4i-spdif.txt
+++ b/Documentation/devicetree/bindings/sound/sunxi,sun4i-spdif.txt
@@ -10,6 +10,7 @@ Required properties:
   - compatible : should be one of the following:
 - "allwinner,sun4i-a10-spdif": for the Allwinner A10 SoC
 - "allwinner,sun6i-a31-spdif": for the Allwinner A31 SoC
+- "allwinner,sun8i-h3-spdif": for the Allwinner H3 SoC
 
   - reg: Offset and length of the register set for the 
device.
 
-- 
2.11.0

[PATCH AUTOSEL for 4.9 34/50] rt2800usb: mark tx failure on timeout

[Levin, Alexander (Sasha Levin)]

From: Stanislaw Gruszka 

[ Upstream commit 1701221696764b6861d0ee66850812a8900b9b9b ]

If we do not get TX status in reasonable time, we most likely fail to
send frame hence mark it as so.

Signed-off-by: Stanislaw Gruszka 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin 
---
 drivers/net/wireless/ralink/rt2x00/rt2800usb.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c 
b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
index 4b0bb6b4f6f1..c636e6065548 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c
@@ -646,10 +646,9 @@ static void rt2800usb_txdone_nostatus(struct rt2x00_dev 
*rt2x00dev)
!test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
break;
 
-   if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags))
+   if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags) ||
+   rt2800usb_entry_txstatus_timeout(entry))
rt2x00lib_txdone_noinfo(entry, TXDONE_FAILURE);
-   else if (rt2800usb_entry_txstatus_timeout(entry))
-   rt2x00lib_txdone_noinfo(entry, TXDONE_UNKNOWN);
else
break;
}
-- 
2.11.0

[PATCH AUTOSEL for 4.9 35/50] apparmor: fix undefined reference to `aa_g_hash_policy'

[Levin, Alexander (Sasha Levin)]

From: John Johansen 

[ Upstream commit 3ccb76c5dfe0d25c1d0168d5b726d0b43d19a485 ]

The kernel build bot turned up a bad config combination when
CONFIG_SECURITY_APPARMOR is y and CONFIG_SECURITY_APPARMOR_HASH is n,
resulting in the build error
   security/built-in.o: In function `aa_unpack':
   (.text+0x841e2): undefined reference to `aa_g_hash_policy'

Signed-off-by: John Johansen 
Signed-off-by: Sasha Levin 
---
 security/apparmor/lsm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 41b8cb115801..7d3a98b2d55a 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -671,9 +671,9 @@ enum profile_mode aa_g_profile_mode = APPARMOR_ENFORCE;
 module_param_call(mode, param_set_mode, param_get_mode,
  &aa_g_profile_mode, S_IRUSR | S_IWUSR);
 
-#ifdef CONFIG_SECURITY_APPARMOR_HASH
 /* whether policy verification hashing is enabled */
 bool aa_g_hash_policy = IS_ENABLED(CONFIG_SECURITY_APPARMOR_HASH_DEFAULT);
+#ifdef CONFIG_SECURITY_APPARMOR_HASH
 module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | S_IWUSR);
 #endif
 
-- 
2.11.0

[PATCH AUTOSEL for 4.9 33/50] brcmfmac: setup wiphy bands after registering it first

[Levin, Alexander (Sasha Levin)]

From: Rafał Miłecki 

[ Upstream commit ab99063f873749b3c3b1e5d44038559883465e74 ]

During bands setup we disable all channels that firmware doesn't support
in the current regulatory setup. If we do this before wiphy_register
it will result in copying set flags (including IEEE80211_CHAN_DISABLED)
to the orig_flags which is supposed to be persistent. We don't want this
as regulatory change may result in enabling some channels. We shouldn't
mess with orig_flags then (by changing them or ignoring them) so it's
better to just take care of their proper values.

This patch cleanups code a bit (by taking orig_flags more seriously) and
allows further improvements like disabling really unavailable channels.
We will need that e.g. if some frequencies should be disabled for good
due to hardware setup (design).

Signed-off-by: Rafał Miłecki 
Acked-by: Arend van Spriel 
Signed-off-by: Kalle Valo 
Signed-off-by: Sasha Levin 
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 9 +++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 27960b0bfbcd..425a89c635d0 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -6572,8 +6572,7 @@ static int brcmf_setup_wiphy(struct wiphy *wiphy, struct 
brcmf_if *ifp)
wiphy->bands[NL80211_BAND_5GHZ] = band;
}
}
-   err = brcmf_setup_wiphybands(wiphy);
-   return err;
+   return 0;
 }
 
 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
@@ -6938,6 +6937,12 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct 
brcmf_pub *drvr,
goto priv_out;
}
 
+   err = brcmf_setup_wiphybands(wiphy);
+   if (err) {
+   brcmf_err("Setting wiphy bands failed (%d)\n", err);
+   goto wiphy_unreg_out;
+   }
+
/* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
 * setup 40MHz in 2GHz band and enable OBSS scanning.
 */
-- 
2.11.0

[PATCH AUTOSEL for 4.9 26/50] dt-bindings: Add LEGO MINDSTORMS EV3 compatible specification

[Levin, Alexander (Sasha Levin)]

From: David Lechner 

[ Upstream commit 21078ab174c99885ca83a5c32db0d33b1617745e ]

This adds the board level device tree specification for LEGO MINDSTORMS EV3

Acked-by: Rob Herring 
Signed-off-by: David Lechner 
Signed-off-by: Sekhar Nori 
Signed-off-by: Sasha Levin 
---
 Documentation/devicetree/bindings/arm/davinci.txt | 4 
 1 file changed, 4 insertions(+)

diff --git a/Documentation/devicetree/bindings/arm/davinci.txt 
b/Documentation/devicetree/bindings/arm/davinci.txt
index f0841ce725b5..715622c36260 100644
--- a/Documentation/devicetree/bindings/arm/davinci.txt
+++ b/Documentation/devicetree/bindings/arm/davinci.txt
@@ -13,6 +13,10 @@ EnBW AM1808 based CMC board
 Required root node properties:
 - compatible = "enbw,cmc", "ti,da850;
 
+LEGO MINDSTORMS EV3 (AM1808 based)
+Required root node properties:
+- compatible = "lego,ev3", "ti,da850";
+
 Generic DaVinci Boards
 --
 
-- 
2.11.0

[PATCH AUTOSEL for 4.9 11/50] drm: drm_minor_register(): Clean up debugfs on failure

[Levin, Alexander (Sasha Levin)]

From: Noralf Trønnes 

[ Upstream commit a67834f8bfa1e2f48bb27d07b9a552ba7c3af82a ]

Call drm_debugfs_cleanup() in case drm_debugfs_init() fails to
cover for failure in the drm_driver.debugfs_init callback.

Signed-off-by: Noralf Trønnes 
Signed-off-by: Daniel Vetter 
Link: 
http://patchwork.freedesktop.org/patch/msgid/20170126225621.12314-3-nor...@tronnes.org
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/drm_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 362b8cd68a24..80a903bd317d 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -218,7 +218,7 @@ static int drm_minor_register(struct drm_device *dev, 
unsigned int type)
ret = drm_debugfs_init(minor, minor->index, drm_debugfs_root);
if (ret) {
DRM_ERROR("DRM: Failed to initialize /sys/kernel/debug/dri.\n");
-   return ret;
+   goto err_debugfs;
}
 
ret = device_add(minor->kdev);
-- 
2.11.0

[PATCH AUTOSEL for 4.9 20/50] drm: mali-dp: fix Lx_CONTROL register fields clobber

[Levin, Alexander (Sasha Levin)]

From: Mihail Atanassov 

[ Upstream commit c7ffa59cf03c38b91d6ef01e42c1b52fd7a4f285 ]

When updating the rotation fields, one of the assignments zeroes out the
rest of the register fields, which include settings for chroma siting,
inverse gamma, AMBA AXI caching, and alpha blending.

Signed-off-by: Mihail Atanassov 
Signed-off-by: Liviu Dudau 
Signed-off-by: Sasha Levin 
---
 drivers/gpu/drm/arm/malidp_planes.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/arm/malidp_planes.c 
b/drivers/gpu/drm/arm/malidp_planes.c
index afe0480d95c9..8b009b549e45 100644
--- a/drivers/gpu/drm/arm/malidp_planes.c
+++ b/drivers/gpu/drm/arm/malidp_planes.c
@@ -182,7 +182,8 @@ static void malidp_de_plane_update(struct drm_plane *plane,
 
/* setup the rotation and axis flip bits */
if (plane->state->rotation & DRM_ROTATE_MASK)
-   val = ilog2(plane->state->rotation & DRM_ROTATE_MASK) << 
LAYER_ROT_OFFSET;
+   val |= ilog2(plane->state->rotation & DRM_ROTATE_MASK) <<
+  LAYER_ROT_OFFSET;
if (plane->state->rotation & DRM_REFLECT_X)
val |= LAYER_H_FLIP;
if (plane->state->rotation & DRM_REFLECT_Y)
-- 
2.11.0

[PATCH AUTOSEL for 4.9 24/50] iio: proximity: sx9500: claim direct mode during raw proximity reads

[Levin, Alexander (Sasha Levin)]

From: Alison Schofield 

[ Upstream commit 6b2e7589b82ff534dd5c6d67dd83c53f13691bec ]

Driver was checking for direct mode but not locking it.  Use the
claim/release helper functions to guarantee the device stays in
direct mode during raw reads of proximity data.

Signed-off-by: Alison Schofield 
Reviewed-by: Vlad Dogaru 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Sasha Levin 
---
 drivers/iio/proximity/sx9500.c | 10 +++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/iio/proximity/sx9500.c b/drivers/iio/proximity/sx9500.c
index 1f06282ec793..9ea147f1a50d 100644
--- a/drivers/iio/proximity/sx9500.c
+++ b/drivers/iio/proximity/sx9500.c
@@ -387,14 +387,18 @@ static int sx9500_read_raw(struct iio_dev *indio_dev,
   int *val, int *val2, long mask)
 {
struct sx9500_data *data = iio_priv(indio_dev);
+   int ret;
 
switch (chan->type) {
case IIO_PROXIMITY:
switch (mask) {
case IIO_CHAN_INFO_RAW:
-   if (iio_buffer_enabled(indio_dev))
-   return -EBUSY;
-   return sx9500_read_proximity(data, chan, val);
+   ret = iio_device_claim_direct_mode(indio_dev);
+   if (ret)
+   return ret;
+   ret = sx9500_read_proximity(data, chan, val);
+   iio_device_release_direct_mode(indio_dev);
+   return ret;
case IIO_CHAN_INFO_SAMP_FREQ:
return sx9500_read_samp_freq(data, val, val2);
default:
-- 
2.11.0

[PATCH AUTOSEL for 4.9 10/50] clk: samsung: exynos5433: Add IDs for PHYCLK_MIPIDPHY0_* clocks

[Levin, Alexander (Sasha Levin)]

From: Marek Szyprowski 

[ Upstream commit 5ccb58968bf7f46dbd128df88f71838a5a9750b8 ]

Add missing identifiers for phyclk_mipidphy0_bitclkdiv8_phy and
phyclk_mipidphy0_rxclkesc0_phy clocks. Access to those clocks is needed
to setup initial clock configuration for display subsystem in device tree
in order to avoid dependency on the configuration left by the bootloader.

Signed-off-by: Marek Szyprowski 
Acked-by: Krzysztof Kozlowski 
Acked-by: Chanwoo Choi 
Signed-off-by: Sylwester Nawrocki 
Signed-off-by: Sasha Levin 
---
 drivers/clk/samsung/clk-exynos5433.c   | 6 --
 include/dt-bindings/clock/exynos5433.h | 5 -
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/clk/samsung/clk-exynos5433.c 
b/drivers/clk/samsung/clk-exynos5433.c
index ea1608682d7f..2fe057326552 100644
--- a/drivers/clk/samsung/clk-exynos5433.c
+++ b/drivers/clk/samsung/clk-exynos5433.c
@@ -2559,8 +2559,10 @@ static const struct samsung_fixed_rate_clock 
disp_fixed_clks[] __initconst = {
FRATE(0, "phyclk_mipidphy1_bitclkdiv8_phy", NULL, 0, 18800),
FRATE(0, "phyclk_mipidphy1_rxclkesc0_phy", NULL, 0, 1),
/* PHY clocks from MIPI_DPHY0 */
-   FRATE(0, "phyclk_mipidphy0_bitclkdiv8_phy", NULL, 0, 18800),
-   FRATE(0, "phyclk_mipidphy0_rxclkesc0_phy", NULL, 0, 1),
+   FRATE(CLK_PHYCLK_MIPIDPHY0_BITCLKDIV8_PHY, 
"phyclk_mipidphy0_bitclkdiv8_phy",
+   NULL, 0, 18800),
+   FRATE(CLK_PHYCLK_MIPIDPHY0_RXCLKESC0_PHY, 
"phyclk_mipidphy0_rxclkesc0_phy",
+   NULL, 0, 1),
/* PHY clocks from HDMI_PHY */
FRATE(CLK_PHYCLK_HDMIPHY_TMDS_CLKO_PHY, "phyclk_hdmiphy_tmds_clko_phy",
NULL, 0, 3),
diff --git a/include/dt-bindings/clock/exynos5433.h 
b/include/dt-bindings/clock/exynos5433.h
index 4fa6bb2136e3..be39d23e6a32 100644
--- a/include/dt-bindings/clock/exynos5433.h
+++ b/include/dt-bindings/clock/exynos5433.h
@@ -771,7 +771,10 @@
 
 #define CLK_PCLK_DECON 113
 
-#define DISP_NR_CLK114
+#define CLK_PHYCLK_MIPIDPHY0_BITCLKDIV8_PHY114
+#define CLK_PHYCLK_MIPIDPHY0_RXCLKESC0_PHY 115
+
+#define DISP_NR_CLK116
 
 /* CMU_AUD */
 #define CLK_MOUT_AUD_PLL_USER  1
-- 
2.11.0

[PATCH AUTOSEL for 4.9 23/50] iio: magnetometer: mag3110: claim direct mode during raw writes

[Levin, Alexander (Sasha Levin)]

From: Alison Schofield 

[ Upstream commit 80dea21f95a4672cce545f48dc2ca500b69a2584 ]

Driver was checking for direct mode but not locking it.  Use
claim/release helper functions to guarantee the device stays
in direct mode during raw writes.

Signed-off-by: Alison Schofield 
Acked-by: Peter Meerwald-Stadler 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Sasha Levin 
---
 drivers/iio/magnetometer/mag3110.c | 30 --
 1 file changed, 20 insertions(+), 10 deletions(-)

diff --git a/drivers/iio/magnetometer/mag3110.c 
b/drivers/iio/magnetometer/mag3110.c
index f2b3bd7bf862..b4f643fb3b1e 100644
--- a/drivers/iio/magnetometer/mag3110.c
+++ b/drivers/iio/magnetometer/mag3110.c
@@ -222,29 +222,39 @@ static int mag3110_write_raw(struct iio_dev *indio_dev,
 int val, int val2, long mask)
 {
struct mag3110_data *data = iio_priv(indio_dev);
-   int rate;
+   int rate, ret;
 
-   if (iio_buffer_enabled(indio_dev))
-   return -EBUSY;
+   ret = iio_device_claim_direct_mode(indio_dev);
+   if (ret)
+   return ret;
 
switch (mask) {
case IIO_CHAN_INFO_SAMP_FREQ:
rate = mag3110_get_samp_freq_index(data, val, val2);
-   if (rate < 0)
-   return -EINVAL;
+   if (rate < 0) {
+   ret = -EINVAL;
+   break;
+   }
 
data->ctrl_reg1 &= ~MAG3110_CTRL_DR_MASK;
data->ctrl_reg1 |= rate << MAG3110_CTRL_DR_SHIFT;
-   return i2c_smbus_write_byte_data(data->client,
+   ret = i2c_smbus_write_byte_data(data->client,
MAG3110_CTRL_REG1, data->ctrl_reg1);
+   break;
case IIO_CHAN_INFO_CALIBBIAS:
-   if (val < -1 || val > 1)
-   return -EINVAL;
-   return i2c_smbus_write_word_swapped(data->client,
+   if (val < -1 || val > 1) {
+   ret = -EINVAL;
+   break;
+   }
+   ret = i2c_smbus_write_word_swapped(data->client,
MAG3110_OFF_X + 2 * chan->scan_index, val << 1);
+   break;
default:
-   return -EINVAL;
+   ret = -EINVAL;
+   break;
}
+   iio_device_release_direct_mode(indio_dev);
+   return ret;
 }
 
 static irqreturn_t mag3110_trigger_handler(int irq, void *p)
-- 
2.11.0

[PATCH AUTOSEL for 4.9 16/50] cxl: Force psl data-cache flush during device shutdown

[Levin, Alexander (Sasha Levin)]

From: Vaibhav Jain 

[ Upstream commit d7b1946c7925a270062b2e0718aa57b42ba619c0 ]

This change adds a force psl data cache flush during device shutdown
callback. This should reduce a possibility of psl holding a dirty
cache line while the CAPP is being reinitialized, which may result in
a UE [load/store] machine check error.

Signed-off-by: Vaibhav Jain 
Reviewed-by: Andrew Donnellan 
Acked-by: Frederic Barrat 
Signed-off-by: Michael Ellerman 
Signed-off-by: Sasha Levin 
---
 drivers/misc/cxl/pci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
index fa4fe02cfef4..eef202d4399b 100644
--- a/drivers/misc/cxl/pci.c
+++ b/drivers/misc/cxl/pci.c
@@ -1620,6 +1620,9 @@ static void cxl_pci_remove_adapter(struct cxl *adapter)
cxl_sysfs_adapter_remove(adapter);
cxl_debugfs_adapter_remove(adapter);
 
+   /* Flush adapter datacache as its about to be removed */
+   cxl_data_cache_flush(adapter);
+
cxl_deconfigure_adapter(adapter);
 
device_unregister(&adapter->dev);
-- 
2.11.0

[PATCH AUTOSEL for 4.9 02/50] video: fbdev: pmag-ba-fb: Remove bad `__init' annotation

[Levin, Alexander (Sasha Levin)]

From: "Maciej W. Rozycki" 

[ Upstream commit 879e5a0df626f39cbb3c61bb90373e56d67012c4 ]

Fix:

WARNING: drivers/video/fbdev/pmag-ba-fb.o(.text+0x308): Section mismatch in 
reference from the function pmagbafb_probe() to the function 
.init.text:pmagbafb_erase_cursor()
The function pmagbafb_probe()
references the function __init pmagbafb_erase_cursor().
This is often because pmagbafb_probe lacks a __init
annotation or the annotation of pmagbafb_erase_cursor is wrong.

-- a fallout from a missed update from commit 9625b51350cc ("VIDEO:
PMAG-BA: Fix section mismatch") and then commit 48c68c4f1b54 ("Drivers:
video: remove __dev* attributes.")

Signed-off-by: Maciej W. Rozycki 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Sasha Levin 
---
 drivers/video/fbdev/pmag-ba-fb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/pmag-ba-fb.c b/drivers/video/fbdev/pmag-ba-fb.c
index 5872bc4af3ce..df02fb4b7fd1 100644
--- a/drivers/video/fbdev/pmag-ba-fb.c
+++ b/drivers/video/fbdev/pmag-ba-fb.c
@@ -129,7 +129,7 @@ static struct fb_ops pmagbafb_ops = {
 /*
  * Turn the hardware cursor off.
  */
-static void __init pmagbafb_erase_cursor(struct fb_info *info)
+static void pmagbafb_erase_cursor(struct fb_info *info)
 {
struct pmagbafb_par *par = info->par;
 
-- 
2.11.0

[PATCH AUTOSEL for 4.9 01/50] [media] adv7604: Initialize drive strength to default when using DT

[Levin, Alexander (Sasha Levin)]

From: Lars-Peter Clausen 

[ Upstream commit da8892d410db224d9a24104529794e6e37e0c100 ]

The adv7604 driver platform data contains fields for configuring the drive
strength of the output pins. When probing the driver through DT these
fields are not explicitly initialized, which means they are left at 0. This
is a reserved setting for the drive strength configuration though and can
cause signal integrity issues.

Whether these signal integrity issues are visible depends on the PCB
specifics (e.g. the higher the load capacitance for the output the more
visible the issue). But it has been observed on existing solutions at high
pixel clock rates.

Initialize the drive strength settings to the power-on-reset value of the
device when probing through devicetree to avoid this issue.

Fixes: 0e158be0162b ("adv7604: Add DT support")

Signed-off-by: Lars-Peter Clausen 
Reviewed-by: Laurent Pinchart 
Tested-by: Niklas Söderlund 
Signed-off-by: Hans Verkuil 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Sasha Levin 
---
 drivers/media/i2c/adv7604.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
index 4003831de712..7b1935ab03c8 100644
--- a/drivers/media/i2c/adv7604.c
+++ b/drivers/media/i2c/adv7604.c
@@ -3118,6 +3118,9 @@ static int adv76xx_parse_dt(struct adv76xx_state *state)
state->pdata.blank_data = 1;
state->pdata.op_format_mode_sel = ADV7604_OP_FORMAT_MODE0;
state->pdata.bus_order = ADV7604_BUS_ORDER_RGB;
+   state->pdata.dr_str_data = ADV76XX_DR_STR_MEDIUM_HIGH;
+   state->pdata.dr_str_clk = ADV76XX_DR_STR_MEDIUM_HIGH;
+   state->pdata.dr_str_sync = ADV76XX_DR_STR_MEDIUM_HIGH;
 
return 0;
 }
-- 
2.11.0

[PATCH AUTOSEL for 4.9 13/50] iommu/arm-smmu-v3: Clear prior settings when updating STEs

[Levin, Alexander (Sasha Levin)]

From: Nate Watterson 

[ Upstream commit 810871c57011eb3e89e6768932757f169d666cd2 ]

To prevent corruption of the stage-1 context pointer field when
updating STEs, rebuild the entire containing dword instead of
clearing individual fields.

Signed-off-by: Nate Watterson 
Signed-off-by: Will Deacon 
Signed-off-by: Sasha Levin 
---
 drivers/iommu/arm-smmu-v3.c | 10 ++
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index e6f9b2d745ca..d3d975ae24b7 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -1040,13 +1040,8 @@ static void arm_smmu_write_strtab_ent(struct 
arm_smmu_device *smmu, u32 sid,
}
}
 
-   /* Nuke the existing Config, as we're going to rewrite it */
-   val &= ~(STRTAB_STE_0_CFG_MASK << STRTAB_STE_0_CFG_SHIFT);
-
-   if (ste->valid)
-   val |= STRTAB_STE_0_V;
-   else
-   val &= ~STRTAB_STE_0_V;
+   /* Nuke the existing STE_0 value, as we're going to rewrite it */
+   val = ste->valid ? STRTAB_STE_0_V : 0;
 
if (ste->bypass) {
val |= disable_bypass ? STRTAB_STE_0_CFG_ABORT
@@ -1081,7 +1076,6 @@ static void arm_smmu_write_strtab_ent(struct 
arm_smmu_device *smmu, u32 sid,
val |= (ste->s1_cfg->cdptr_dma & STRTAB_STE_0_S1CTXPTR_MASK
<< STRTAB_STE_0_S1CTXPTR_SHIFT) |
STRTAB_STE_0_CFG_S1_TRANS;
-
}
 
if (ste->s2_cfg) {
-- 
2.11.0

[PATCH AUTOSEL for 4.9 07/50] dt-bindings: clockgen: Add compatible string for LS1012A

[Levin, Alexander (Sasha Levin)]

From: Harninder Rai 

[ Upstream commit 73447f68d7b2bc1df870da88b0e21d2bc1afc025 ]

Signed-off-by: Harninder Rai 
Signed-off-by: Bhaskar Upadhaya 
Acked-by: Rob Herring 
Signed-off-by: Shawn Guo 
Signed-off-by: Sasha Levin 
---
 Documentation/devicetree/bindings/clock/qoriq-clock.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Documentation/devicetree/bindings/clock/qoriq-clock.txt 
b/Documentation/devicetree/bindings/clock/qoriq-clock.txt
index 16a3ec433119..1bd2c76396f4 100644
--- a/Documentation/devicetree/bindings/clock/qoriq-clock.txt
+++ b/Documentation/devicetree/bindings/clock/qoriq-clock.txt
@@ -31,6 +31,7 @@ Required properties:
* "fsl,t4240-clockgen"
* "fsl,b4420-clockgen"
* "fsl,b4860-clockgen"
+   * "fsl,ls1012a-clockgen"
* "fsl,ls1021a-clockgen"
Chassis-version clock strings include:
* "fsl,qoriq-clockgen-1.0": for chassis 1.0 clocks
-- 
2.11.0

[PATCH AUTOSEL for 4.9 06/50] ARM: dts: imx53-qsb-common: fix FEC pinmux config

[Levin, Alexander (Sasha Levin)]

From: Patrick Bruenn 

[ Upstream commit 8b649e426336d7d4800ff9c82858328f4215ba01 ]

The pinmux configuration in device tree was different from manual
muxing in /board/freescale/mx53loco/mx53loco.c
All pins were configured as NO_PAD_CTL(1 << 31), which was fine as the
bootloader already did the correct pinmuxing for us.
But recently u-boot is migrating to reuse device tree files from the
kernel tree, so it seems to be better to have the correct pinmuxing in
our files, too.

Signed-off-by: Patrick Bruenn 
Signed-off-by: Shawn Guo 
Signed-off-by: Sasha Levin 
---
 arch/arm/boot/dts/imx53-qsb-common.dtsi | 20 ++--
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/arch/arm/boot/dts/imx53-qsb-common.dtsi 
b/arch/arm/boot/dts/imx53-qsb-common.dtsi
index c05e7cfd0cbc..40b3e31935d0 100644
--- a/arch/arm/boot/dts/imx53-qsb-common.dtsi
+++ b/arch/arm/boot/dts/imx53-qsb-common.dtsi
@@ -215,16 +215,16 @@
 
pinctrl_fec: fecgrp {
fsl,pins = <
-   MX53_PAD_FEC_MDC__FEC_MDC   
0x8000
-   MX53_PAD_FEC_MDIO__FEC_MDIO 
0x8000
-   MX53_PAD_FEC_REF_CLK__FEC_TX_CLK
0x8000
-   MX53_PAD_FEC_RX_ER__FEC_RX_ER   
0x8000
-   MX53_PAD_FEC_CRS_DV__FEC_RX_DV  
0x8000
-   MX53_PAD_FEC_RXD1__FEC_RDATA_1  
0x8000
-   MX53_PAD_FEC_RXD0__FEC_RDATA_0  
0x8000
-   MX53_PAD_FEC_TX_EN__FEC_TX_EN   
0x8000
-   MX53_PAD_FEC_TXD1__FEC_TDATA_1  
0x8000
-   MX53_PAD_FEC_TXD0__FEC_TDATA_0  
0x8000
+   MX53_PAD_FEC_MDC__FEC_MDC   0x4
+   MX53_PAD_FEC_MDIO__FEC_MDIO 0x1fc
+   MX53_PAD_FEC_REF_CLK__FEC_TX_CLK0x180
+   MX53_PAD_FEC_RX_ER__FEC_RX_ER   0x180
+   MX53_PAD_FEC_CRS_DV__FEC_RX_DV  0x180
+   MX53_PAD_FEC_RXD1__FEC_RDATA_1  0x180
+   MX53_PAD_FEC_RXD0__FEC_RDATA_0  0x180
+   MX53_PAD_FEC_TX_EN__FEC_TX_EN   0x4
+   MX53_PAD_FEC_TXD1__FEC_TDATA_1  0x4
+   MX53_PAD_FEC_TXD0__FEC_TDATA_0  0x4
>;
};
 
-- 
2.11.0

[PATCH AUTOSEL for 4.9 05/50] xen/netback: set default upper limit of tx/rx queues to 8

[Levin, Alexander (Sasha Levin)]

From: Juergen Gross 

[ Upstream commit 56dd5af9bc23d0d5d23bb207c477715b4c2216c5 ]

The default for the maximum number of tx/rx queues of one interface is
the number of cpus of the system today. As each queue pair reserves 512
grant pages this default consumes a ridiculous number of grants for
large guests.

Limit the queue number to 8 as default. This value can be modified
via a module parameter if required.

Signed-off-by: Juergen Gross 
Reviewed-by: Boris Ostrovsky 
Signed-off-by: Boris Ostrovsky 
Signed-off-by: Sasha Levin 
---
 drivers/net/xen-netback/netback.c | 6 --
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/xen-netback/netback.c 
b/drivers/net/xen-netback/netback.c
index d9b5b73c35a0..a7bdb1ffac2e 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -67,6 +67,7 @@ module_param(rx_drain_timeout_msecs, uint, 0444);
 unsigned int rx_stall_timeout_msecs = 6;
 module_param(rx_stall_timeout_msecs, uint, 0444);
 
+#define MAX_QUEUES_DEFAULT 8
 unsigned int xenvif_max_queues;
 module_param_named(max_queues, xenvif_max_queues, uint, 0644);
 MODULE_PARM_DESC(max_queues,
@@ -1626,11 +1627,12 @@ static int __init netback_init(void)
if (!xen_domain())
return -ENODEV;
 
-   /* Allow as many queues as there are CPUs if user has not
+   /* Allow as many queues as there are CPUs but max. 8 if user has not
 * specified a value.
 */
if (xenvif_max_queues == 0)
-   xenvif_max_queues = num_online_cpus();
+   xenvif_max_queues = min_t(unsigned int, MAX_QUEUES_DEFAULT,
+ num_online_cpus());
 
if (fatal_skb_slots < XEN_NETBK_LEGACY_SLOTS_MAX) {
pr_info("fatal_skb_slots too small (%d), bump it to 
XEN_NETBK_LEGACY_SLOTS_MAX (%d)\n",
-- 
2.11.0

Re: [PATCH 4/4] percpu: add tracepoint support for percpu memory

[Levin, Alexander (Sasha Levin)]

On Mon, Jun 19, 2017 at 07:28:32PM -0400, Dennis Zhou wrote:
>Add support for tracepoints to the following events: chunk allocation,
>chunk free, area allocation, area free, and area allocation failure.
>This should let us replay percpu memory requests and evaluate
>corresponding decisions.

This patch breaks boot for me:

[0.00] DEBUG_LOCKS_WARN_ON(unlikely(early_boot_irqs_disabled))
[0.00] [ cut here ]
[0.00] WARNING: CPU: 0 PID: 0 at kernel/locking/lockdep.c:2741 
trace_hardirqs_on_caller.cold.58+0x47/0x4e
[0.00] Modules linked in:
[0.00] CPU: 0 PID: 0 Comm: swapper Not tainted 
4.12.0-rc6-next-20170621+ #155
[0.00] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 
1.10.1-1ubuntu1 04/01/2014
[0.00] task: b7831180 task.stack: b780
[0.00] RIP: 0010:trace_hardirqs_on_caller.cold.58+0x47/0x4e
[0.00] RSP: :b78079d0 EFLAGS: 00010086 ORIG_RAX: 

[0.00] RAX: 0037 RBX: 0003 RCX: 
[0.00] RDX:  RSI: 0001 RDI: 16f00ef6
[0.00] RBP: b78079e0 R08:  R09: b7831180
[0.00] R10:  R11: b24e96ce R12: b6b39b87
[0.00] R13: 001f0001 R14: b85603a0 R15: 2000
[0.00] FS:  () GS:b81be000() 
knlGS:
[0.00] CS:  0010 DS:  ES:  CR0: 80050033
[0.00] CR2: 88007fbff000 CR3: 6b828000 CR4: 000406b0
[0.00] Call Trace:
[0.00]  trace_hardirqs_on+0xd/0x10
[0.00]  _raw_spin_unlock_irq+0x27/0x50
[0.00]  pcpu_setup_first_chunk+0x19c2/0x1c27
[0.00]  ? pcpu_free_alloc_info+0x4b/0x4b
[0.00]  ? vprintk_emit+0x403/0x480
[0.00]  ? __down_trylock_console_sem+0xb7/0xc0
[0.00]  ? __down_trylock_console_sem+0x6e/0xc0
[0.00]  ? vprintk_emit+0x362/0x480
[0.00]  ? vprintk_default+0x28/0x30
[0.00]  ? printk+0xb2/0xdd
[0.00]  ? snapshot_ioctl.cold.1+0x19/0x19
[0.00]  ? __alloc_bootmem_node_nopanic+0x88/0x96
[0.00]  pcpu_embed_first_chunk+0x7b0/0x8ef
[0.00]  ? pcpup_populate_pte+0xb/0xb
[0.00]  setup_per_cpu_areas+0x105/0x6d9
[0.00]  ? find_last_bit+0xa6/0xd0
[0.00]  start_kernel+0x25e/0x78f
[0.00]  ? thread_stack_cache_init+0xb/0xb
[0.00]  ? early_idt_handler_common+0x3b/0x52
[0.00]  ? early_idt_handler_array+0x120/0x120
[0.00]  ? early_idt_handler_array+0x120/0x120
[0.00]  x86_64_start_reservations+0x24/0x26
[0.00]  x86_64_start_kernel+0x143/0x166
[0.00]  secondary_startup_64+0x9f/0x9f
[0.00] Code: c6 a0 49 c6 b6 48 c7 c7 e0 49 c6 b6 e8 43 34 00 00 0f ff 
e9 ed 71 ce ff 48 c7 c6 c0 79 c6 b6 48 c7 c7 e0 49 c6 b6 e8 29 34 00 00 <0f> ff 
e9 d3 71 ce ff 48 c7 c6 20 7c c6 b6 48 c7 c7 e0 49 c6 b6 
[0.00] random: print_oops_end_marker+0x30/0x50 get_random_bytes called 
with crng_init=0
[0.00] ---[ end trace f68728a0d3053b52 ]---
[0.00] BUG: unable to handle kernel paging request at 
[0.00] IP: native_write_msr+0x6/0x30
[0.00] PGD 0 
[0.00] P4D 0 
[0.00] 
[0.00] Oops:  [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN
[0.00] Modules linked in:
[0.00] CPU: 0 PID: 0 Comm: swapper Tainted: GW   
4.12.0-rc6-next-20170621+ #155
[0.00] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 
1.10.1-1ubuntu1 04/01/2014
[0.00] task: b7831180 task.stack: b780
[0.00] RIP: 0010:native_write_msr+0x6/0x30
[0.00] RSP: :b7807dc8 EFLAGS: 00010202
[0.00] RAX: 3ea15d43 RBX: 88003ea15d40 RCX: 4b564d02
[0.00] RDX:  RSI: 3ea15d43 RDI: 4b564d02
[0.00] RBP: b7807df0 R08: 0040 R09: 
[0.00] R10: 7100 R11: 7ffd6f00 R12: 
[0.00] R13: 16f00fc3 R14: b7807eb8 R15: dc00
[0.00] FS:  () GS:88003ea0() 
knlGS:
[0.00] CS:  0010 DS:  ES:  CR0: 80050033
[0.00] CR2:  CR3: 6b828000 CR4: 000406b0
[0.00] Call Trace:
[0.00]  ? kvm_guest_cpu_init+0x155/0x220
[0.00]  kvm_smp_prepare_boot_cpu+0x9/0x10
[0.00]  start_kernel+0x28c/0x78f
[0.00]  ? thread_stack_cache_init+0xb/0xb
[0.00]  ? early_idt_handler_common+0x3b/0x52
[0.00]  ? early_idt_handler_array+0x120/0x120
[0.00]  ? early_idt_handler_array+0x120/0x120
[0.00]  x86_64_start_reservations+0x24/0x26
[0.00]  x86_64_start_kernel+0x143/0x166
[0.

Stable/distro kernel testing in Plumbers 2017

[Levin, Alexander (Sasha Levin)]

Hi all,

We were hoping to discuss the state of -stable/distro kernel testing 
in the Testing & Fuzzing MC in Plumbers 2017.

Mainly we want to understand what sort of testing is being done, how 
bug reports are being addressed, and what improvments can we make to 
improve the process.

The format is pretty open, we can do a BoF type of discussion and 
talks as part of the MC if anyone is interested in doing any.

It would be great to know who is interested in this, and would be able 
to attend Plumbers (https://www.linuxplumbersconf.org/2017/).

-- 

Thanks,
Sasha

Re: [PATCH 4.9 031/108] jump label: pass kbuild_cflags when checking for asm goto support

[Levin, Alexander (Sasha Levin)]

On Tue, Jun 27, 2017 at 01:33:42PM +0200, Greg Kroah-Hartman wrote:
>On Mon, Jun 19, 2017 at 06:29:18PM +0300, Gleb Fotengauer-Malinovskiy wrote:
>> On Thu, Jun 15, 2017 at 07:52:37PM +0200, Greg Kroah-Hartman wrote:
>> > 4.9-stable review patch.  If anyone has any objections, please let me know.
>> >
>> > --
>> >
>> > From: David Lin 
>> >
>> >
>> > [ Upstream commit 35f860f9ba6aac56cc38e8b18916d833a83f1157 ]
>>
>> This commit introduced a regression which was fixed in
>> 7292ae3d5a18fb922be496e6bb687647193569b4.
>> Backport the fix too, please.
>>
>> As long as there is no gcc-plugin support in 4.4, 35f860f9ba6a does not
>> break anything there, AFAICS.
>
>Thanks for letting me know, now queued up.

Hey Greg,

I've also queued this up in the pull request I sent a few days ago, you'll
end up seeing a conflict when you look at that branch.

-- 

Thanks,
Sasha

Re: [PATCH 00/17] v3 net generic subsystem refcount conversions

[Levin, Alexander (Sasha Levin)]

On Mon, Jul 03, 2017 at 02:28:56AM -0700, Eric Dumazet wrote:
>On Fri, 2017-06-30 at 13:07 +0300, Elena Reshetova wrote:
>> Changes in v3:
>> Rebased on top of the net-next tree.
>>
>> Changes in v2:
>> No changes in patches apart from rebases, but now by
>> default refcount_t = atomic_t (*) and uses all atomic standard operations
>> unless CONFIG_REFCOUNT_FULL is enabled. This is a compromise for the
>> systems that are critical on performance (such as net) and cannot accept even
>> slight delay on the refcounter operations.
>>
>> This series, for core network subsystem components, replaces atomic_t 
>> reference
>> counters with the new refcount_t type and API (see include/linux/refcount.h).
>> By doing this we prevent intentional or accidental
>> underflows or overflows that can led to use-after-free vulnerabilities.
>> These patches contain only generic net pieces. Other changes will be sent 
>> separately.
>>
>> The patches are fully independent and can be cherry-picked separately.
>> The big patches, such as conversions for sock structure, need a very detailed
>> look from maintainers: refcount managing is quite complex in them and while
>> it seems that they would benefit from the change, extra checking is needed.
>> The biggest corner issue is the fact that refcount_inc() does not increment
>> from zero.
>>
>> If there are no objections to the patches, please merge them via respective 
>> trees.
>>
>> * The respective change is currently merged into -next as
>>   "locking/refcount: Create unchecked atomic_t implementation".
>>
>> Elena Reshetova (17):
>>   net: convert inet_peer.refcnt from atomic_t to refcount_t
>>   net: convert neighbour.refcnt from atomic_t to refcount_t
>>   net: convert neigh_params.refcnt from atomic_t to refcount_t
>>   net: convert nf_bridge_info.use from atomic_t to refcount_t
>>   net: convert sk_buff.users from atomic_t to refcount_t
>>   net: convert sk_buff_fclones.fclone_ref from atomic_t to refcount_t
>>   net: convert sock.sk_wmem_alloc from atomic_t to refcount_t
>>   net: convert sock.sk_refcnt from atomic_t to refcount_t
>>   net: convert ip_mc_list.refcnt from atomic_t to refcount_t
>>   net: convert in_device.refcnt from atomic_t to refcount_t
>>   net: convert netpoll_info.refcnt from atomic_t to refcount_t
>>   net: convert unix_address.refcnt from atomic_t to refcount_t
>>   net: convert fib_rule.refcnt from atomic_t to refcount_t
>>   net: convert inet_frag_queue.refcnt from atomic_t to refcount_t
>>   net: convert net.passive from atomic_t to refcount_t
>>   net: convert netlbl_lsm_cache.refcount from atomic_t to refcount_t
>>   net: convert packet_fanout.sk_ref from atomic_t to refcount_t
>
>
>Can you take a look at this please ?
>
>[   64.601749] [ cut here ]
>[   64.601757] WARNING: CPU: 0 PID: 6476 at lib/refcount.c:184 
>refcount_sub_and_test+0x75/0xa0
>[   64.601758] Modules linked in: w1_therm wire cdc_acm ehci_pci ehci_hcd 
>mlx4_en ib_uverbs mlx4_ib ib_core mlx4_core
>[   64.601769] CPU: 0 PID: 6476 Comm: ip Tainted: GW   
>4.12.0-smp-DEV #274
>[   64.601770] Hardware name: Intel RML,PCH/Iota_QC_19, BIOS 2.40.0 06/22/2016
>[   64.601771] task: 8837bf482040 task.stack: 8837bdc08000
>[   64.601773] RIP: 0010:refcount_sub_and_test+0x75/0xa0
>[   64.601774] RSP: 0018:8837bdc0f5c0 EFLAGS: 00010286
>[   64.601776] RAX: 0026 RBX: 0001 RCX: 
>
>[   64.601777] RDX: 0026 RSI: 0096 RDI: 
>ed06f7b81eae
>[   64.601778] RBP: 8837bdc0f5d0 R08: 0004 R09: 
>fbfff4a54c25
>[   64.601779] R10: cbc500e5 R11: a52a6128 R12: 
>881febcf6f24
>[   64.601779] R13: 881fbf4eaf00 R14: 881febcf6f80 R15: 
>8837d7a4ed00
>[   64.601781] FS:  7ff5a2f6b700() GS:881fff80() 
>knlGS:
>[   64.601782] CS:  0010 DS:  ES:  CR0: 80050033
>[   64.601783] CR2: 7ffcdc70d000 CR3: 001f9c91e000 CR4: 
>001406f0
>[   64.601783] Call Trace:
>[   64.601786]  refcount_dec_and_test+0x11/0x20
>[   64.601790]  fib_nl_delrule+0xc39/0x1630
[snip]

I'm seeing a similar one coming from sctp:

refcount_t: underflow; use-after-free.
[ cut here ]
WARNING: CPU: 3 PID: 15570 at lib/refcount.c:186 
refcount_sub_and_test.cold.13+0x18/0x21 lib/refcount.c:186
Kernel panic - not syncing: panic_on_warn set ...

CPU: 3 PID: 15570 Comm: syz-executor0 Not tainted 4.12.0-next-20170706+ #186
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.1-1ubuntu1 
04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:16 [inline]
 dump_stack+0x11d/0x1ef lib/dump_stack.c:52
 panic+0x1bc/0x3ad kernel/panic.c:180
 __warn.cold.6+0x2f/0x2f kernel/panic.c:541
 report_bug+0x20d/0x2d0 lib/bug.c:183
 fixup_bug+0x3f/0x90 arch/x86/kernel/traps.c:190
 do_trap_no_signal arch/x86/kernel/traps.c:224 [inline]
 do_trap+0x132/0x390 arch/x86/kernel/traps.c:273
 do_error_trap+0x133/0x38

block: hung task writing to device

[Levin, Alexander (Sasha Levin)]

Hi all,

syzkaller seems to be hitting a lockup with the reproducer below:

INFO: task syzkaller490361:8788 blocked for more than 120 seconds.
 Not tainted 4.12.0-next-20170706+ #186
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syzkaller490361 D18312  8788   5843 0x00080004
Call Trace:
__schedule+0x853/0x1fc0
schedule+0x110/0x460
io_schedule+0x1c/0x70
blk_mq_get_tag+0x670/0xeb0
blk_mq_get_driver_tag+0x4ae/0xa00
blk_mq_sched_insert_request+0x69f/0x8d0
blk_mq_make_request+0x737/0x2540
generic_make_request+0x486/0xef0
submit_bio+0xb0/0x550
submit_bio_wait+0x145/0x1f0
blkdev_issue_flush+0x150/0x210
ext4_sync_file+0xe65/0x1330
vfs_fsync_range+0x10a/0x250
ext4_file_write_iter+0x90c/0x1130
do_iter_readv_writev+0x584/0x8e0
do_iter_write+0x15a/0x540
vfs_writev+0x1e8/0x350
do_writev+0x108/0x2d0
SyS_writev+0x27/0x30
do_syscall_64+0x267/0x740
entry_SYSCALL64_slow_path+0x25/0x25
RIP: 0033:0x4425d9
RSP: 002b:7fff9ff9e6e8 EFLAGS: 0246 ORIG_RAX: 0014
RAX: ffda RBX:  RCX: 004425d9
RDX: 0001 RSI: 2000dfa0 RDI: 0003
RBP: 7fff9ff9e70c R08: 7fff9ff9e70c R09: 7fff9ff9e70c
R10: 7fff9ff9e70c R11: 0246 R12: 0007721b
R13:  R14: 7fff9ff9e710 R15: 016d
INFO: task syzkaller490361:8793 blocked for more than 120 seconds.
 Not tainted 4.12.0-next-20170706+ #186
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syzkaller490361 D18312  8793   5845 0x00080004
Call Trace:
__schedule+0x853/0x1fc0
schedule+0x110/0x460
jbd2_log_wait_commit+0x346/0x520
jbd2_complete_transaction+0x162/0x1b0
ext4_sync_file+0x1093/0x1330
vfs_fsync_range+0x10a/0x250
ext4_file_write_iter+0x90c/0x1130
do_iter_readv_writev+0x584/0x8e0
do_iter_write+0x15a/0x540
vfs_writev+0x1e8/0x350
do_writev+0x108/0x2d0
SyS_writev+0x27/0x30
do_syscall_64+0x267/0x740
entry_SYSCALL64_slow_path+0x25/0x25
RIP: 0033:0x4425d9
RSP: 002b:7fff9ff9e6e8 EFLAGS: 0246 ORIG_RAX: 0014
RAX: ffda RBX:  RCX: 004425d9
RDX: 0001 RSI: 2000dfa0 RDI: 0003
RBP: 7fff9ff9e70c R08: 7fff9ff9e70c R09: 7fff9ff9e70c
R10: 7fff9ff9e70c R11: 0246 R12: 00077226
R13:  R14: 7fff9ff9e710 R15: 017c
INFO: task syzkaller490361:8794 blocked for more than 120 seconds.
 Not tainted 4.12.0-next-20170706+ #186
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syzkaller490361 D19944  8794   5836 0x00080004
Call Trace:
__schedule+0x853/0x1fc0
schedule+0x110/0x460
io_schedule+0x1c/0x70
wbt_wait+0xa37/0x1030
blk_mq_make_request+0x3d8/0x2540
generic_make_request+0x486/0xef0
submit_bio+0xb0/0x550
submit_bio_wait+0x145/0x1f0
blkdev_issue_flush+0x150/0x210
ext4_sync_file+0xe65/0x1330
vfs_fsync_range+0x10a/0x250
ext4_file_write_iter+0x90c/0x1130
do_iter_readv_writev+0x584/0x8e0
do_iter_write+0x15a/0x540
vfs_writev+0x1e8/0x350
do_writev+0x108/0x2d0
SyS_writev+0x27/0x30
do_syscall_64+0x267/0x740
entry_SYSCALL64_slow_path+0x25/0x25
RIP: 0033:0x4425d9
RSP: 002b:7fff9ff9e6e8 EFLAGS: 0246 ORIG_RAX: 0014
RAX: ffda RBX:  RCX: 004425d9
RDX: 0001 RSI: 2000dfa0 RDI: 0003
RBP: 7fff9ff9e70c R08: 7fff9ff9e70c R09: 7fff9ff9e70c
R10: 7fff9ff9e70c R11: 0246 R12: 00077235
R13:  R14: 7fff9ff9e710 R15: 016e
INFO: task syzkaller490361:8795 blocked for more than 120 seconds.
 Not tainted 4.12.0-next-20170706+ #186
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syzkaller490361 D18312  8795   5844 0x00080004
Call Trace:
__schedule+0x853/0x1fc0
schedule+0x110/0x460
jbd2_log_wait_commit+0x346/0x520
jbd2_complete_transaction+0x162/0x1b0
ext4_sync_file+0x1093/0x1330
vfs_fsync_range+0x10a/0x250
ext4_file_write_iter+0x90c/0x1130
do_iter_readv_writev+0x584/0x8e0
do_iter_write+0x15a/0x540
vfs_writev+0x1e8/0x350
do_writev+0x108/0x2d0
SyS_writev+0x27/0x30
do_syscall_64+0x267/0x740
entry_SYSCALL64_slow_path+0x25/0x25
RIP: 0033:0x4425d9
RSP: 002b:7fff9ff9e6e8 EFLAGS: 0246 ORIG_RAX: 0014
RAX: ffda RBX:  RCX: 004425d9
RDX: 0001 RSI: 2000dfa0 RDI: 0003
RBP: 7fff9ff9e70c R08: 7fff9ff9e70c R09: 7fff9ff9e70c
R10: 7fff9ff9e70c R11: 0246 R12: 00077235
R13:  R14: 7fff9ff9e710 R15: 0164
INFO: task syzkaller490361:8797 blocked for more than 120 seconds.
 Not tainted 4.12.0-next-20170706+ #186
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syzkaller490361 D20216  8797   5842 0x00080004
Call Trace:
__schedule+0x853/0x1fc0
schedule+0x110/0x460
io_schedule+0x1c/0x70
wbt_wait+0xa37/0x1030
blk_mq_make_request+0x3d8/0x2540
generic_

Re: block: hung task writing to device

[Levin, Alexander (Sasha Levin)]

On Sat, Jul 08, 2017 at 07:29:20PM -0600, Jens Axboe wrote:
>On 07/08/2017 01:06 PM, Levin, Alexander (Sasha Levin) wrote:
>> Hi all,
>>
>> syzkaller seems to be hitting a lockup with the reproducer below:
>
>Thanks for the reproducer, but this is missing a lot of detail that we
>need to debug this issue. Is this a regression since 4.12? What storage
>device is this? Is the device using an IO scheduler?

I've started seeing this while testing on -next, so this regression started 
after v4.12.

The fuzzer runs in qemu, the block device is the result of the "-hda" parameter 
to qemu. As far as I can tell this results the creation of an ATA device.

>dmesg after boot and .config would be helpful, too.

Attached boot dmesg and config.

-- 

Thanks,
Sasha


bootlog.txt.gz
Description: bootlog.txt.gz


config-sasha.gz
Description: config-sasha.gz

[PATCH] mm: kill kmemcheck again

[Levin, Alexander (Sasha Levin)]

2 Years ago I proposed to kill kmemcheck:

> As discussed on LSF/MM, kill kmemcheck.
>
> KASan is a replacement that is able to work without the limitation of
> kmemcheck (single CPU, slow). KASan is already upstream.
>
> We are also not aware of any users of kmemcheck (or users who don't consider
> KASan as a suitable replacement).

The only objection was that since KASAN wasn't supported by all GCC
versions provided by distros at that time we should hold off for 2
years, and try again.

Now that 2 years have passed, and all distros provide gcc that supports
KASAN, kill kmemcheck again for the very same reasons.

Cc: Steven Rostedt (VMware) 
Cc: David S. Miller 
Signed-off-by: Sasha Levin 
---
 Documentation/admin-guide/kernel-parameters.txt |   7 -
 Documentation/dev-tools/index.rst   |   1 -
 Documentation/dev-tools/kmemcheck.rst   | 733 
 MAINTAINERS |  10 -
 arch/arm/include/asm/dma-iommu.h|   1 -
 arch/arm/include/asm/pgalloc.h  |   2 +-
 arch/arm64/include/asm/pgalloc.h|   2 +-
 arch/openrisc/include/asm/dma-mapping.h |   1 -
 arch/powerpc/include/asm/pgalloc.h  |   2 +-
 arch/sh/kernel/dwarf.c  |   4 +-
 arch/sh/kernel/process.c|   2 +-
 arch/sparc/mm/init_64.c |   4 +-
 arch/unicore32/include/asm/pgalloc.h|   2 +-
 arch/x86/Kconfig|   3 +-
 arch/x86/Makefile   |   5 -
 arch/x86/include/asm/dma-mapping.h  |   1 -
 arch/x86/include/asm/kmemcheck.h|  42 --
 arch/x86/include/asm/pgtable.h  |   5 -
 arch/x86/include/asm/pgtable_types.h|  13 -
 arch/x86/include/asm/string_32.h|   9 -
 arch/x86/include/asm/string_64.h|   8 -
 arch/x86/include/asm/xor.h  |   4 +-
 arch/x86/kernel/cpu/intel.c |  15 -
 arch/x86/kernel/espfix_64.c |   2 +-
 arch/x86/kernel/traps.c |   5 -
 arch/x86/mm/Makefile|   2 -
 arch/x86/mm/fault.c |   6 -
 arch/x86/mm/init.c  |   8 +-
 arch/x86/mm/init_64.c   |   2 +-
 arch/x86/mm/kmemcheck/Makefile  |   1 -
 arch/x86/mm/kmemcheck/error.c   | 227 
 arch/x86/mm/kmemcheck/error.h   |  15 -
 arch/x86/mm/kmemcheck/kmemcheck.c   | 658 -
 arch/x86/mm/kmemcheck/opcode.c  | 106 
 arch/x86/mm/kmemcheck/opcode.h  |   9 -
 arch/x86/mm/kmemcheck/pte.c |  22 -
 arch/x86/mm/kmemcheck/pte.h |  10 -
 arch/x86/mm/kmemcheck/selftest.c|  70 ---
 arch/x86/mm/kmemcheck/selftest.h|   6 -
 arch/x86/mm/kmemcheck/shadow.c  | 173 --
 arch/x86/mm/kmemcheck/shadow.h  |  18 -
 arch/x86/mm/pageattr.c  |  10 +-
 arch/x86/mm/pgtable.c   |   2 +-
 arch/x86/platform/efi/efi_64.c  |   2 +-
 crypto/xor.c|   7 +-
 drivers/char/random.c   |   1 -
 drivers/misc/c2port/core.c  |   2 -
 fs/dcache.c |   2 -
 include/linux/c2port.h  |   4 -
 include/linux/dma-mapping.h |   8 +-
 include/linux/filter.h  |   2 -
 include/linux/gfp.h |   9 -
 include/linux/interrupt.h   |  15 -
 include/linux/kmemcheck.h   | 171 --
 include/linux/mm_types.h|   8 -
 include/linux/net.h |   3 -
 include/linux/ring_buffer.h |   3 -
 include/linux/skbuff.h  |   3 -
 include/linux/slab.h|   6 -
 include/linux/thread_info.h |   5 +-
 include/net/inet_sock.h |   3 -
 include/net/inet_timewait_sock.h|   3 -
 include/net/sock.h  |   2 -
 include/trace/events/mmflags.h  |   1 -
 init/do_mounts.c|   3 +-
 init/main.c |   1 -
 kernel/bpf/core.c   |   6 -
 kernel/fork.c   |  12 +-
 kernel/locking/lockdep.c|   3 -
 kernel/signal.c |   3 +-
 kernel/softirq.c|  10 -
 kernel/sysctl.c |  10 -
 kernel/trace/ring_buffer.c  |   3 -
 lib/Kconfig.debug 

Re: [PATCH] mm: kill kmemcheck again

[Levin, Alexander (Sasha Levin)]

I stupidly forgot to Cc Pekka and Vegard, now Cc'ed.

On Wed, Sep 27, 2017 at 11:27:40AM +0000, Levin, Alexander (Sasha Levin) wrote:
>2 Years ago I proposed to kill kmemcheck:
>
>> As discussed on LSF/MM, kill kmemcheck.
>>
>> KASan is a replacement that is able to work without the limitation of
>> kmemcheck (single CPU, slow). KASan is already upstream.
>>
>> We are also not aware of any users of kmemcheck (or users who don't consider
>> KASan as a suitable replacement).
>
>The only objection was that since KASAN wasn't supported by all GCC
>versions provided by distros at that time we should hold off for 2
>years, and try again.
>
>Now that 2 years have passed, and all distros provide gcc that supports
>KASAN, kill kmemcheck again for the very same reasons.
>
>Cc: Steven Rostedt (VMware) 
>Cc: David S. Miller 
>Signed-off-by: Sasha Levin 
>---
> Documentation/admin-guide/kernel-parameters.txt |   7 -
> Documentation/dev-tools/index.rst   |   1 -
> Documentation/dev-tools/kmemcheck.rst   | 733 
> MAINTAINERS |  10 -
> arch/arm/include/asm/dma-iommu.h|   1 -
> arch/arm/include/asm/pgalloc.h  |   2 +-
> arch/arm64/include/asm/pgalloc.h|   2 +-
> arch/openrisc/include/asm/dma-mapping.h |   1 -
> arch/powerpc/include/asm/pgalloc.h  |   2 +-
> arch/sh/kernel/dwarf.c  |   4 +-
> arch/sh/kernel/process.c|   2 +-
> arch/sparc/mm/init_64.c |   4 +-
> arch/unicore32/include/asm/pgalloc.h|   2 +-
> arch/x86/Kconfig|   3 +-
> arch/x86/Makefile   |   5 -
> arch/x86/include/asm/dma-mapping.h  |   1 -
> arch/x86/include/asm/kmemcheck.h|  42 --
> arch/x86/include/asm/pgtable.h  |   5 -
> arch/x86/include/asm/pgtable_types.h|  13 -
> arch/x86/include/asm/string_32.h|   9 -
> arch/x86/include/asm/string_64.h|   8 -
> arch/x86/include/asm/xor.h  |   4 +-
> arch/x86/kernel/cpu/intel.c |  15 -
> arch/x86/kernel/espfix_64.c |   2 +-
> arch/x86/kernel/traps.c |   5 -
> arch/x86/mm/Makefile|   2 -
> arch/x86/mm/fault.c |   6 -
> arch/x86/mm/init.c  |   8 +-
> arch/x86/mm/init_64.c   |   2 +-
> arch/x86/mm/kmemcheck/Makefile  |   1 -
> arch/x86/mm/kmemcheck/error.c   | 227 
> arch/x86/mm/kmemcheck/error.h   |  15 -
> arch/x86/mm/kmemcheck/kmemcheck.c   | 658 -
> arch/x86/mm/kmemcheck/opcode.c  | 106 
> arch/x86/mm/kmemcheck/opcode.h  |   9 -
> arch/x86/mm/kmemcheck/pte.c |  22 -
> arch/x86/mm/kmemcheck/pte.h |  10 -
> arch/x86/mm/kmemcheck/selftest.c|  70 ---
> arch/x86/mm/kmemcheck/selftest.h|   6 -
> arch/x86/mm/kmemcheck/shadow.c  | 173 --
> arch/x86/mm/kmemcheck/shadow.h  |  18 -
> arch/x86/mm/pageattr.c  |  10 +-
> arch/x86/mm/pgtable.c   |   2 +-
> arch/x86/platform/efi/efi_64.c  |   2 +-
> crypto/xor.c|   7 +-
> drivers/char/random.c   |   1 -
> drivers/misc/c2port/core.c  |   2 -
> fs/dcache.c |   2 -
> include/linux/c2port.h  |   4 -
> include/linux/dma-mapping.h |   8 +-
> include/linux/filter.h  |   2 -
> include/linux/gfp.h |   9 -
> include/linux/interrupt.h   |  15 -
> include/linux/kmemcheck.h   | 171 --
> include/linux/mm_types.h|   8 -
> include/linux/net.h |   3 -
> include/linux/ring_buffer.h |   3 -
> include/linux/skbuff.h  |   3 -
> include/linux/slab.h|   6 -
> include/linux/thread_info.h |   5 +-
> include/net/inet_sock.h |   3 -
> include/net/inet_timewait_sock.h|   3 -
> include/net/sock.h  |   2 -
> include/trace/events/mmflags.h  |   1 -
> init/do_mount

Re: [PATCH] mm: kill kmemcheck again

[Levin, Alexander (Sasha Levin)]

On Wed, Sep 27, 2017 at 05:02:07PM +0200, Michal Hocko wrote:
>This is just too large to review manually. How have you generated the
>patch?

Manualy. Note that most of it (~95%) is the result of 'rm 
arch/x86/mm/kmemcheck'.

Otherwise, I just removed all uses of __GFP_NOWARN/SLAB_NOWARN, and calls to
various annotations throughout the code.

I'm not sure about i386 breakage, will take a look, doesn't seem to be too 
obvious.

-- 

Thanks,
Sasha

Re: [PATCH] mm: kill kmemcheck again

[Levin, Alexander (Sasha Levin)]

On Wed, Sep 27, 2017 at 12:36:27PM -0500, Eric W. Biederman wrote:
>"Levin, Alexander (Sasha Levin)"  writes:
>
>> On Wed, Sep 27, 2017 at 05:02:07PM +0200, Michal Hocko wrote:
>>>This is just too large to review manually. How have you generated the
>>>patch?
>>
>> Manualy. Note that most of it (~95%) is the result of 'rm 
>> arch/x86/mm/kmemcheck'.
>>
>> Otherwise, I just removed all uses of __GFP_NOWARN/SLAB_NOWARN, and calls to
>> various annotations throughout the code.
>
>Do you mean GFP_NOTRACK? GFP_NOWARN has a different meaning.

uh, yes, thanks Eric!

__GFP_NOTRACK and SLAB_NOTRACK.

-- 

Thanks,
Sasha