4.9.2-stable review

This is the start of the stable review cycle for the 4.9.2 release. There are 116 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sun Jan 8 21:38:42 UTC 2017. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.2-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 4.9.2-rc1

Mika Kuoppala <[email protected]>
drm/i915: Fix setting of boost freq tunable

Paulo Zanoni <[email protected]>
drm/i915: skip the first 4k of stolen memory on everything >= gen8

Ville Syrjälä <[email protected]>

    drm/i915: Initialize dev_priv->atomic_cdclk_freq at init time

Ville Syrjälä <[email protected]>
drm/i915: Fix cdclk vs. dev_cdclk mess when not recomputing things

Hans de Goede <[email protected]>
drm/i915/dsi: Do not clear DPOUNIT_CLOCK_GATE_DISABLE from vlv_init_display_clock_gating

Hans de Goede <[email protected]>
drm/i915/dsi: Fix chv_exec_gpio disabling the GPIOs it is setting

Thomas Petazzoni <[email protected]>
net: mvpp2: fix dma unmapping of TX buffers for fragments

Al Viro <[email protected]>
sg_write()/bsg_write() is not fit to be called under KERNEL_DS

Ben Hutchings <[email protected]>
kconfig/nconf: Fix hang when editing symbol with a long prompt

Andy Grover <[email protected]>
target/user: Fix use-after-free of tcmu_cmds if they are expired

Dan Williams <[email protected]>
libnvdimm, pfn: fix align attribute

David Daney <[email protected]>
of, numa: Return NUMA_NO_NODE from disable of_node_to_nid() if nid not possible.

Nicholas Piggin <[email protected]>
powerpc/boot: Request no dynamic linker for boot wrapper

Geoff Levand <[email protected]>
powerpc/ps3: Fix system hang with GCC 5 builds

Nicholas Piggin <[email protected]>
powerpc/64e: Convert cmpi to cmpwi in head_64.S

NeilBrown <[email protected]>
SUNRPC: fix refcounting problems with auth_gss messages.

Trond Myklebust <[email protected]>
pNFS: Fix a deadlock between read resends and layoutreturn

Trond Myklebust <[email protected]>
pNFS: Clear NFS_LAYOUT_RETURN_REQUESTED when invalidating the layout stateid

Trond Myklebust <[email protected]>
pNFS: Don't clear the layout stateid if a layout return is outstanding

Trond Myklebust <[email protected]>
pNFS: On error, do not send LAYOUTGET until the LAYOUTRETURN has completed

Al Viro <[email protected]>
nfs_write_end(): fix handling of short copies

Ilya Dryomov <[email protected]>
libceph: verify authorize reply on connect

Alan Stern <[email protected]>
PCI: Check for PME in targeted sleep state

Shiraz Saleem <[email protected]>
i40iw: Use correct src address in memcpy to rdma stats counters

Miklos Szeredi <[email protected]>
bad_inode: add missing i_op initializers

Jingkui Wang <[email protected]>

    Input: drv260x - fix input device's parent assignment

Laurent Pinchart <[email protected]>
v4l: tvp5150: Add missing break in set control handler

Andrey Utkin <[email protected]>
media: solo6x10: fix lockup by avoiding delayed register write

Marek Szyprowski <[email protected]>
s5p-mfc: fix failure path of s5p_mfc_alloc_memdev()

Antti Palosaari <[email protected]>
mn88473: fix chip id check on probe

Antti Palosaari <[email protected]>
mn88472: fix chip id check on probe

Bart Van Assche <[email protected]>
IB/cma: Fix a race condition in iboe_addr_get_sgid()

Bart Van Assche <[email protected]>
IB/rxe: Fix a memory leak in rxe_qp_cleanup()

Bart Van Assche <[email protected]>
IB/multicast: Check ib_find_pkey() return value

Bart Van Assche <[email protected]>
IPoIB: Avoid reading an uninitialized member variable

Bart Van Assche <[email protected]>
IB/mad: Fix an array index check

Steven Rostedt (Red Hat) <[email protected]>
fgraph: Handle a case where a tracer ignores set_graph_notrace

Thomas Gleixner <[email protected]>
x86/smpboot: Make logical package management more robust

Marcos Paulo de Souza <[email protected]>
platform/x86: asus-nb-wmi.c: Add X45U quirk

Steven Rostedt (Red Hat) <[email protected]>
ftrace/x86_32: Set ftrace_stub to weak to prevent gcc from using short jumps to it

Michael S. Tsirkin <[email protected]>
vsock/virtio: fix src/dst cid format

Jan Kara <[email protected]>
fsnotify: Fix possible use-after-free in inode iteration on umount

Jim Mattson <[email protected]>
kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF)

Paul Mackerras <[email protected]>
KVM: PPC: Book3S HV: Don't lose hardware R/C bit updates in H_PROTECT

Paul Mackerras <[email protected]>
KVM: PPC: Book3S HV: Save/restore XER in checkpointed register state

Kevin Barnett <[email protected]>
scsi: aacraid: remove wildcard for series 9 controllers

Konstantin Khlebnikov <[email protected]>
md/raid5: limit request size according to implementation limits

Josh Cartwright <[email protected]>
sc16is7xx: Drop bogus use of IRQF_ONESHOT

Kees Cook <[email protected]>
latent_entropy: fix ARM build error on earlier gcc

Marc Zyngier <[email protected]>
arm64: KVM: pmu: Reset PMSELR_EL0.SEL to a sane value before entering the guest

Heiko Carstens <[email protected]>
s390/kexec: use node 0 when re-adding crash kernel memory

Gerald Schaefer <[email protected]>
s390/vmlogrdr: fix IUCV buffer allocation

Yves-Alexis Perez <[email protected]>
firmware: fix usermode helper fallback loading

Vineet Gupta <[email protected]>
ARC: mm: arc700: Don't assume 2 colours for aliasing VIPT dcache

Wei Fang <[email protected]>
scsi: avoid a permanent stop of the scsi device's request queue

Steffen Maier <[email protected]>
scsi: zfcp: fix rport unblock race with LUN recovery

Steffen Maier <[email protected]>
scsi: zfcp: do not trace pure benign residual HBA responses at default level

Benjamin Block <[email protected]>
scsi: zfcp: fix use-after-"free" in FC ingress path after TMF

Varun Prakash <[email protected]>
iscsi-target: Return error if unable to add network portal

Kashyap Desai <[email protected]>
scsi: megaraid_sas: Do not set MPI2_TYPE_CUDA for JBOD FP path for FW which does not support JBOD sequence map

Kashyap Desai <[email protected]>
scsi: megaraid_sas: For SRIOV enabled firmware, ensure VF driver waits for 30secs before reset

Johan Hovold <[email protected]>
stm class: Fix device leak in open error path

Maciej S. Szmigiero <[email protected]>
vt: fix Scroll Lock LED trigger name

Rabin Vincent <[email protected]>
block: protect iterate_bdevs() against concurrent close

Tomas Winkler <[email protected]>
mei: me: add lewisburg device ids

Alexander Usyskin <[email protected]>
mei: request async autosuspend at the end of enumeration

Russell Currey <[email protected]>
drivers/gpu/drm/ast: Fix infinite loop if read fails

Rex Zhu <[email protected]>
drm/amdgpu: fix init save/restore list in gfx_v8.0

Rex Zhu <[email protected]>
drm/amdgpu: fix enable_cp_power_gating in gfx_v8.0.

Hawking Zhang <[email protected]>
drm/amd/powerplay: bypass fan table setup if no fan connected

Patrik Jakobsson <[email protected]>
drm/gma500: Add compat ioctl

Alex Deucher <[email protected]>

    drm/radeon/si: load the proper firmware on 0x87 oland boards

Alex Deucher <[email protected]>
drm/radeon: add additional pci revision to dpm workaround

Michel Dänzer <[email protected]>
drm/radeon: Hide the HW cursor while it's out of bounds

Michel Dänzer <[email protected]>
drm/radeon: Also call cursor_move_locked when the cursor size changes

Ben Skeggs <[email protected]>
drm/nouveau/fifo/gf100-: protect channel preempt with subdev mutex

Ben Skeggs <[email protected]>

    drm/nouveau/i2c/gk110b,gm10x: use the correct implementation

Ben Skeggs <[email protected]>
drm/nouveau/ttm: wait for bo fence to signal before unmapping vmas

Ben Skeggs <[email protected]>
drm/nouveau/ltc: protect clearing of comptags with mutex

Ben Skeggs <[email protected]>
drm/nouveau/bios: require checksum to match for fast acpi shadow method

Ben Skeggs <[email protected]>
drm/nouveau/kms: lvds panel strap moved again on maxwell

Alexandre Courbot <[email protected]>
drm/nouveau/gr: fallback to legacy paths during firmware lookup

Arindam Nath <[email protected]>
drm/amd/amdgpu: enable GUI idle INT after enabling CGCG

Michel Dänzer <[email protected]>
drm/amdgpu: Also call cursor_move_locked when the cursor size changes

Michel Dänzer <[email protected]>

    drm/amdgpu: Store CRTC relative amdgpu_crtc->cursor_x/y values

Alex Deucher <[email protected]>
drm/amdgpu: add additional pci revision to dpm workaround

Alex Deucher <[email protected]>

    drm/amdgpu/si: load the proper firmware on 0x87 oland boards

Hans de Goede <[email protected]>
ACPI / video: Add force_native quirk for HP Pavilion dv6

Hans de Goede <[email protected]>
ACPI / video: Add force_native quirk for Dell XPS 17 L702X

Ian Abbott <[email protected]>
staging: comedi: ni_mio_common: fix E series ni_ai_insn_read() data

Ian Abbott <[email protected]>
staging: comedi: ni_mio_common: fix M Series ni_ai_insn_read() data mask

Arnd Bergmann <[email protected]>
staging: lustre: ldlm: pl_recalc time handling is wrong

Oleg Drokin <[email protected]>
staging/lustre/osc: Revert erroneous list_for_each_entry_safe use

Vitaly Kuznetsov <[email protected]>
hv: acquire vmbus_connection.channel_mutex in vmbus_free_channels()

Dmitry Shachnev <[email protected]>
docs: sphinx-extensions: make rstFlatTable work with docutils 0.13

Krzysztof Kozlowski <[email protected]>
thermal: hwmon: Properly report critical temperature in sysfs

Boris Brezillon <[email protected]>
clk: bcm2835: Avoid overwriting the div info when disabling a pll_div clk

Alexandre Courbot <[email protected]>
arm64: tegra: Add VDD_GPU regulator to Jetson TX1

Lars-Peter Clausen <[email protected]>
gpio: chardev: Return error for seek operations

Linus Walleij <[email protected]>
gpio: stmpe: fix interrupt handling bug

Thomas Gleixner <[email protected]>
timekeeping_Force_unsigned_clocksource_to_nanoseconds_conversion

Paul Burton <[email protected]>
mmc: sd: Meet alignment requirements for raw_ssr DMA

Linus Walleij <[email protected]>
regulator: stw481x-vmmc: fix ages old enable error

Adrian Hunter <[email protected]>
mmc: sdhci: Fix recovery from tuning timeout

Adrian Hunter <[email protected]>
Revert "mmc: sdhci: Reset cmd and data circuits after tuning failure"

Tobias Klausmann <[email protected]>
ath9k: do not return early to fix rcu unlocking

Vittorio Gambaletta (VittGam) <[email protected]>
ath9k: Really fix LED polarity for some Mini PCI AR9220 MB92 cards.

Matthias Schiffer <[email protected]>
ath9k: fix ath9k_hw_gpio_get() to return 0 or 1 on success

Johannes Berg <[email protected]>
cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts

Jes Sorensen <[email protected]>
rtl8xxxu: Work around issue with 8192eu and 8723bu devices not reconnecting

Thomas Gleixner <[email protected]>
perf/x86/intel/cstate: Prevent hotplug callback leak

Ravi Bangoria <[email protected]>
perf annotate: Don't throw error for zero length symbols

Andi Kleen <[email protected]>
perf/x86: Fix exclusion of BTS and LBR for Goldmont

Larry Finger <[email protected]>
rtlwifi: Fix enter/exit power_save

Mohammed Shafi Shajakhan <[email protected]>
ath10k: fix soft lockup during firmware crash/hw-restart

Larry Finger <[email protected]>
ssb: Fix error routine when fallback SPROM fails

-------------

Diffstat:

 Documentation/sphinx/rstFlatTable.py               |  5 ++
 Documentation/virtual/kvm/api.txt                  |  1 +
 Makefile                                           |  4 +-
 arch/arc/include/asm/cacheflush.h                  |  6 +-
 arch/arc/mm/cache.c                                | 13 ++--
 arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi     | 18 ++++++
 arch/arm64/kvm/hyp/switch.c                        |  8 ++-
 arch/powerpc/boot/ps3-head.S                       |  5 --
 arch/powerpc/boot/ps3.c                            |  8 +--
 arch/powerpc/boot/wrapper                          | 24 +++++++-
 arch/powerpc/include/asm/kvm_host.h                |  1 +
 arch/powerpc/include/uapi/asm/kvm.h                |  1 +
 arch/powerpc/kernel/asm-offsets.c                  |  1 +
 arch/powerpc/kernel/head_64.S                      |  8 +--
 arch/powerpc/kvm/book3s_hv.c                       |  6 ++
 arch/powerpc/kvm/book3s_hv_rm_mmu.c                |  2 +
 arch/powerpc/kvm/book3s_hv_rmhandlers.S            |  4 ++
 arch/s390/kernel/setup.c                           |  2 +-
 arch/x86/entry/entry_32.S                          |  4 +-
 arch/x86/events/core.c                             |  8 ++-
 arch/x86/events/intel/cstate.c                     | 14 ++---
 arch/x86/events/perf_event.h                       |  2 +-
 arch/x86/kernel/apic/apic.c                        | 15 -----
 arch/x86/kernel/cpu/common.c                       | 24 +++-----
 arch/x86/kernel/smpboot.c                          | 51 ++++++----------
 arch/x86/kvm/vmx.c                                 | 11 ++--
 arch/x86/xen/smp.c                                 |  6 --
 block/bsg.c                                        |  3 +
 drivers/acpi/video_detect.c                        | 20 +++++++
 drivers/base/firmware_class.c                      |  7 ++-
 drivers/clk/bcm/clk-bcm2835.c                      |  4 +-
 drivers/gpio/gpio-stmpe.c                          |  2 +-
 drivers/gpio/gpiolib.c                             |  5 +-
 drivers/gpu/drm/amd/amdgpu/dce_v10_0.c             | 15 ++---
 drivers/gpu/drm/amd/amdgpu/dce_v11_0.c             | 15 ++---
 drivers/gpu/drm/amd/amdgpu/dce_v6_0.c              | 14 +++--
 drivers/gpu/drm/amd/amdgpu/dce_v8_0.c              | 15 ++---
 drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c              | 28 +++++----
 drivers/gpu/drm/amd/amdgpu/si_dpm.c                |  2 +
 drivers/gpu/drm/amd/powerplay/smumgr/fiji_smc.c    |  6 ++
 drivers/gpu/drm/amd/powerplay/smumgr/iceland_smc.c |  6 ++
 .../gpu/drm/amd/powerplay/smumgr/polaris10_smc.c   |  6 ++
 drivers/gpu/drm/amd/powerplay/smumgr/tonga_smc.c   |  6 ++
 drivers/gpu/drm/ast/ast_main.c                     |  7 ++-
 drivers/gpu/drm/gma500/psb_drv.c                   |  3 +
 drivers/gpu/drm/i915/i915_gem_stolen.c             |  5 +-
 drivers/gpu/drm/i915/i915_sysfs.c                  |  2 +-
 drivers/gpu/drm/i915/intel_display.c               |  9 ++-
 drivers/gpu/drm/i915/intel_dsi_panel_vbt.c         |  3 +-
 drivers/gpu/drm/i915/intel_runtime_pm.c            | 13 +++-
 drivers/gpu/drm/nouveau/nouveau_bios.c             |  3 +
 drivers/gpu/drm/nouveau/nouveau_bo.c               |  1 +
 drivers/gpu/drm/nouveau/nvkm/engine/device/base.c  |  6 +-
 .../gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c |  9 ++-
 .../gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c |  8 ++-
 drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c     | 50 ++++++++++++++--
 drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h    |  1 +
 drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c  |  7 ++-
 .../gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c  |  1 +
 drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c     |  2 +
 drivers/gpu/drm/radeon/radeon_cursor.c             | 69 +++++++++++++++-------
 drivers/gpu/drm/radeon/radeon_mode.h               |  1 +
 drivers/gpu/drm/radeon/si.c                        |  1 +
 drivers/gpu/drm/radeon/si_dpm.c                    |  1 +
 drivers/hv/channel_mgmt.c                          |  2 +
 drivers/hwtracing/stm/core.c                       |  8 ++-
 drivers/infiniband/core/mad.c                      |  2 +-
 drivers/infiniband/core/multicast.c                |  7 ++-
 drivers/infiniband/hw/i40iw/i40iw_verbs.c          |  2 +-
 drivers/infiniband/sw/rxe/rxe_qp.c                 |  1 +
 drivers/infiniband/ulp/ipoib/ipoib_multicast.c     |  7 ++-
 drivers/input/misc/drv260x.c                       |  1 -
 drivers/md/raid5.c                                 |  9 +++
 drivers/media/dvb-frontends/mn88472.c              | 24 ++++----
 drivers/media/dvb-frontends/mn88473.c              | 24 ++++----
 drivers/media/i2c/tvp5150.c                        |  1 +
 drivers/media/pci/solo6x10/solo6x10.h              |  3 +
 drivers/media/platform/s5p-mfc/s5p_mfc.c           |  1 +
 drivers/misc/mei/client.c                          |  2 +-
 drivers/misc/mei/hw-me-regs.h                      |  2 +
 drivers/misc/mei/pci-me.c                          |  1 +
 drivers/mmc/core/sd.c                              | 12 +++-
 drivers/mmc/host/sdhci.c                           | 24 ++++++--
 drivers/net/ethernet/marvell/mvpp2.c               | 59 +++++++++---------
 drivers/net/wireless/ath/ath10k/core.c             |  2 +-
 drivers/net/wireless/ath/ath10k/mac.c              |  1 -
 drivers/net/wireless/ath/ath9k/hw.c                |  2 +-
 drivers/net/wireless/ath/ath9k/pci.c               |  7 ++-
 drivers/net/wireless/ath/ath9k/xmit.c              |  2 +-
 .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c  |  8 +++
 drivers/net/wireless/realtek/rtlwifi/base.c        |  8 +--
 drivers/net/wireless/realtek/rtlwifi/core.c        |  9 +--
 drivers/net/wireless/realtek/rtlwifi/pci.c         | 14 ++---
 drivers/net/wireless/realtek/rtlwifi/ps.c          | 36 ++++++++---
 drivers/nvdimm/pfn_devs.c                          |  2 +-
 drivers/of/of_numa.c                               |  7 ++-
 drivers/pci/pci.c                                  |  4 ++
 drivers/platform/x86/asus-nb-wmi.c                 |  9 +++
 drivers/regulator/stw481x-vmmc.c                   |  3 +-
 drivers/s390/char/vmlogrdr.c                       |  2 +-
 drivers/s390/scsi/zfcp_dbf.c                       | 17 +++++-
 drivers/s390/scsi/zfcp_dbf.h                       | 41 ++++++++++++-
 drivers/s390/scsi/zfcp_erp.c                       | 61 ++++++++++++++++++-
 drivers/s390/scsi/zfcp_ext.h                       |  4 +-
 drivers/s390/scsi/zfcp_fsf.h                       |  3 +-
 drivers/s390/scsi/zfcp_reqlist.h                   | 30 +++++++++-
 drivers/s390/scsi/zfcp_scsi.c                      | 61 +++++++++++++++++--
 drivers/scsi/aacraid/linit.c                       |  2 -
 drivers/scsi/megaraid/megaraid_sas_fusion.c        |  9 +--
 drivers/scsi/scsi_sysfs.c                          |  4 --
 drivers/scsi/sg.c                                  |  3 +
 drivers/ssb/pci.c                                  |  1 +
 drivers/staging/comedi/drivers/ni_mio_common.c     |  7 +--
 drivers/staging/lustre/lustre/ldlm/ldlm_pool.c     |  8 +--
 drivers/staging/lustre/lustre/osc/osc_page.c       |  5 +-
 drivers/target/iscsi/iscsi_target_configfs.c       |  4 +-
 drivers/target/target_core_user.c                  |  2 -
 drivers/thermal/thermal_hwmon.c                    |  2 +-
 drivers/tty/serial/sc16is7xx.c                     |  2 +-
 drivers/tty/vt/keyboard.c                          |  2 +-
 fs/bad_inode.c                                     | 55 +++++++++++++++--
 fs/block_dev.c                                     |  7 ++-
 fs/nfs/file.c                                      |  2 +-
 fs/nfs/flexfilelayout/flexfilelayout.c             |  4 ++
 fs/nfs/pnfs.c                                      | 31 ++++++----
 fs/nfs/pnfs.h                                      |  1 +
 fs/notify/inode_mark.c                             | 45 +++-----------
 include/net/cfg80211.h                             | 11 ++++
 include/rdma/ib_addr.h                             |  6 +-
 kernel/time/timekeeping.c                          |  4 +-
 kernel/trace/trace_functions_graph.c               | 17 +++++-
 net/ceph/messenger.c                               | 13 ++++
 net/mac80211/mlme.c                                | 21 ++++---
 net/sunrpc/auth_gss/auth_gss.c                     |  7 ++-
 net/vmw_vsock/virtio_transport_common.c            | 14 ++---
 net/wireless/core.h                                |  1 +
 net/wireless/mlme.c                                | 12 ++++
 net/wireless/sme.c                                 | 14 +++++
 scripts/gcc-plugins/latent_entropy_plugin.c        |  4 +-
 scripts/kconfig/nconf.gui.c                        | 15 +++--
 tools/perf/util/annotate.c                         |  3 +-
 141 files changed, 1032 insertions(+), 439 deletions(-)

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Larry Finger <[email protected]>

commit 8052d7245b6089992343c80b38b14dbbd8354651 upstream.

When there is a CRC error in the SPROM read from the device, the code attempts to handle a fallback SPROM. When this also fails, the driver returns zero rather than an error code.

---
 drivers/ssb/pci.c |    1 +
 1 file changed, 1 insertion(+)

@@ -909,6 +909,7 @@ static int ssb_pci_sprom_get(struct ssb_
 			if (err) {
 				ssb_warn("WARNING: Using fallback SPROM failed (err %d)\n",
 					 err);
+				goto out_free;
 			} else {
 				ssb_dbg("Using SPROM revision %d provided by platform\n",
 					sprom->revision);

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mohammed Shafi Shajakhan <[email protected]>

commit c2cac2f74ab4bcf0db0dcf3a612f1e5b52d145c8 upstream.

During firmware crash (or) user requested manual restart the system gets into a soft lock up state because of the below root cause.

During user requested hardware restart / firmware crash the system goes into a soft lockup state as 'napi_synchronize' is called after 'napi_disable' (which sets 'NAPI_STATE_SCHED' bit) and it sleeps into infinite loop as it waits for 'NAPI_STATE_SCHED' to be cleared. This condition is hit because 'ath10k_hif_stop' is called twice as below (resulting in calling 'napi_synchronize' after 'napi_disable')

'ath10k_core_restart' -> 'ath10k_hif_stop' (ATH10K_STATE_ON) -> -> 'ieee80211_restart_hw' -> 'ath10k_start' -> 'ath10k_halt' -> 'ath10k_core_stop' -> 'ath10k_hif_stop' (ATH10K_STATE_RESTARTING)

Fix this by calling 'ath10k_halt' in ath10k_core_restart itself as it makes more sense before informing mac80211 to restart h/w Also remove 'ath10k_halt' in ath10k_start for the state of 'restarting'

---
 drivers/net/wireless/ath/ath10k/core.c |    2 +-
 drivers/net/wireless/ath/ath10k/mac.c  |    1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

@@ -1534,7 +1534,7 @@ static void ath10k_core_restart(struct w
 	switch (ar->state) {
 	case ATH10K_STATE_ON:
 		ar->state = ATH10K_STATE_RESTARTING;
-		ath10k_hif_stop(ar);
+		ath10k_halt(ar);
 		ath10k_scan_finish(ar);
 		ieee80211_restart_hw(ar->hw);
 		break;

@@ -4449,7 +4449,6 @@ static int ath10k_start(struct ieee80211
 		ar->state = ATH10K_STATE_ON;
 		break;
 	case ATH10K_STATE_RESTARTING:
-		ath10k_halt(ar);
 		ar->state = ATH10K_STATE_RESTARTED;
 		break;
 	case ATH10K_STATE_ON:

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Larry Finger <[email protected]>

commit ba9f93f82abafe2552eac942ebb11c2df4f8dd7f upstream.

In commit a5ffbe0a1993 ("rtlwifi: Fix scheduling while atomic bug") and commit a269913c52ad ("rtlwifi: Rework rtl_lps_leave() and rtl_lps_enter() to use work queue"), an error was introduced in the power-save routines due to the fact that leaving PS was delayed by the use of a work queue.

This problem is fixed by detecting if the enter or leave routines are in interrupt mode. If so, the workqueue is used to place the request. If in normal mode, the enter or leave routines are called directly.

---
 drivers/net/wireless/realtek/rtlwifi/base.c |    8 +++---
 drivers/net/wireless/realtek/rtlwifi/core.c |    9 ++-----
 drivers/net/wireless/realtek/rtlwifi/pci.c  |   14 +++-------
 drivers/net/wireless/realtek/rtlwifi/ps.c   |   36 +++++++++++++++++++++-------
 4 files changed, 40 insertions(+), 27 deletions(-)

@@ -1303,12 +1303,13 @@ EXPORT_SYMBOL_GPL(rtl_action_proc);
 
 static void setup_arp_tx(struct rtl_priv *rtlpriv, struct rtl_ps_ctl *ppsc)
 {
+	struct ieee80211_hw *hw = rtlpriv->hw;
+
 	rtlpriv->ra.is_special_data = true;
 	if (rtlpriv->cfg->ops->get_btc_status())
 		rtlpriv->btcoexist.btc_ops->btc_special_packet_notify(
 					rtlpriv, 1);
-	rtlpriv->enter_ps = false;
-	schedule_work(&rtlpriv->works.lps_change_work);
+	rtl_lps_leave(hw);
 	ppsc->last_delaylps_stamp_jiffies = jiffies;
 }
 

@@ -1381,8 +1382,7 @@ u8 rtl_is_special_data(struct ieee80211_
 
 		if (is_tx) {
 			rtlpriv->ra.is_special_data = true;
-			rtlpriv->enter_ps = false;
-			schedule_work(&rtlpriv->works.lps_change_work);
+			rtl_lps_leave(hw);
 			ppsc->last_delaylps_stamp_jiffies = jiffies;
 		}
 

@@ -1150,10 +1150,8 @@ static void rtl_op_bss_info_changed(stru
 		} else {
 			mstatus = RT_MEDIA_DISCONNECT;
 
-			if (mac->link_state == MAC80211_LINKED) {
-				rtlpriv->enter_ps = false;
-				schedule_work(&rtlpriv->works.lps_change_work);
-			}
+			if (mac->link_state == MAC80211_LINKED)
+				rtl_lps_leave(hw);
 			if (ppsc->p2p_ps_info.p2p_ps_mode > P2P_PS_NONE)
 				rtl_p2p_ps_cmd(hw, P2P_PS_DISABLE);
 			mac->link_state = MAC80211_NOLINK;

@@ -1431,8 +1429,7 @@ static void rtl_op_sw_scan_start(struct
 	}
 
 	if (mac->link_state == MAC80211_LINKED) {
-		rtlpriv->enter_ps = false;
-		schedule_work(&rtlpriv->works.lps_change_work);
+		rtl_lps_leave(hw);
 		mac->link_state = MAC80211_LINKED_SCANNING;
 	} else {
 		rtl_ips_nic_on(hw);

@@ -663,11 +663,9 @@ tx_status_ok:
 	}
 
 	if (((rtlpriv->link_info.num_rx_inperiod +
-		rtlpriv->link_info.num_tx_inperiod) > 8) ||
-		(rtlpriv->link_info.num_rx_inperiod > 2)) {
-		rtlpriv->enter_ps = false;
-		schedule_work(&rtlpriv->works.lps_change_work);
-	}
+	      rtlpriv->link_info.num_tx_inperiod) > 8) ||
+	      (rtlpriv->link_info.num_rx_inperiod > 2))
+		rtl_lps_leave(hw);
 }
 
 static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw,

@@ -918,10 +916,8 @@ new_trx_end:
 		}
 		if (((rtlpriv->link_info.num_rx_inperiod +
 		      rtlpriv->link_info.num_tx_inperiod) > 8) ||
-		      (rtlpriv->link_info.num_rx_inperiod > 2)) {
-			rtlpriv->enter_ps = false;
-			schedule_work(&rtlpriv->works.lps_change_work);
-		}
+		      (rtlpriv->link_info.num_rx_inperiod > 2))
+			rtl_lps_leave(hw);
 		skb = new_skb;
 no_new:
 		if (rtlpriv->use_new_trx_flow) {

@@ -407,8 +407,8 @@ void rtl_lps_set_psmode(struct ieee80211
 	}
 }
 
-/*Enter the leisure power save mode.*/
-void rtl_lps_enter(struct ieee80211_hw *hw)
+/* Interrupt safe routine to enter the leisure power save mode.*/
+static void rtl_lps_enter_core(struct ieee80211_hw *hw)
 {
 	struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
 	struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));

@@ -444,10 +444,9 @@ void rtl_lps_enter(struct ieee80211_hw *
 
 	spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag);
 }
-EXPORT_SYMBOL(rtl_lps_enter);
 
-/*Leave the leisure power save mode.*/
-void rtl_lps_leave(struct ieee80211_hw *hw)
+/* Interrupt safe routine to leave the leisure power save mode.*/
+static void rtl_lps_leave_core(struct ieee80211_hw *hw)
 {
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
 	struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));

@@ -477,7 +476,6 @@ void rtl_lps_leave(struct ieee80211_hw *
 	}
 	spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag);
 }
-EXPORT_SYMBOL(rtl_lps_leave);
 
 /* For sw LPS*/
 void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len)

@@ -670,12 +668,34 @@ void rtl_lps_change_work_callback(struct
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
 
 	if (rtlpriv->enter_ps)
-		rtl_lps_enter(hw);
+		rtl_lps_enter_core(hw);
 	else
-		rtl_lps_leave(hw);
+		rtl_lps_leave_core(hw);
 }
 EXPORT_SYMBOL_GPL(rtl_lps_change_work_callback);
 
+void rtl_lps_enter(struct ieee80211_hw *hw)
+{
+	struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+	if (!in_interrupt())
+		return rtl_lps_enter_core(hw);
+	rtlpriv->enter_ps = true;
+	schedule_work(&rtlpriv->works.lps_change_work);
+}
+EXPORT_SYMBOL_GPL(rtl_lps_enter);
+
+void rtl_lps_leave(struct ieee80211_hw *hw)
+{
+	struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+	if (!in_interrupt())
+		return rtl_lps_leave_core(hw);
+	rtlpriv->enter_ps = false;
+	schedule_work(&rtlpriv->works.lps_change_work);
+}
+EXPORT_SYMBOL_GPL(rtl_lps_leave);
+
 void rtl_swlps_wq_callback(void *data)
 {
 	struct rtl_works *rtlworks = container_of_dwork_rtl(data,

Hello, this patch causes a kernel panic with the rtl8192cu driver.

<6>[   20.847025] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
<1>[   21.699551] BUG: unable to handle kernel NULL pointer dereference at
0000000000000048
<1>[   21.699626] IP: [<ffffffffc037de33>] rtl_lps_leave+0x13/0x40 [rtlwifi]
<4>[   21.699681] PGD 20cf47067
<4>[   21.699702] PUD 20cf42067
<4>[   21.699725] PMD 0
<4>[   21.699732]
<4>[   21.699759] Oops: 0000 [#1] PREEMPT SMP
<4>[   21.699794] Modules linked in: rtl8192cu rtl_usb rtl8192c_common rtlwifi
snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec
snd_hwdep snd_hda_core dm_mod thermal
<4>[   21.699985] CPU: 0 PID: 2656 Comm: ntpdate Not tainted 4.9.2 #1
<4>[   21.700036] Hardware name: Gigabyte Technology Co., Ltd. To be filled by
O.E.M./Z77-DS3H, BIOS F11a 11/13/2013
<4>[   21.700118] task: ffff9ce2509ca4c0 task.stack: ffffa41003eac000
<4>[   21.700168] RIP: 0010:[<ffffffffc037de33>]  [<ffffffffc037de33>]
rtl_lps_leave+0x13/0x40 [rtlwifi]
<4>[   21.700250] RSP: 0018:ffffa41003eaf520  EFLAGS: 00010206
<4>[   21.700296] RAX: 0000000080000802 RBX: ffff9ce251371420 RCX: ffff9ce254ff4640
<4>[   21.700356] RDX: 0000000000000806 RSI: ffff9ce25137afb8 RDI: 0000000000000000
<4>[   21.700416] RBP: ffff9ce25137afb8 R08: ffffffffc0382d00 R09: ffff9ce254e38c31
<4>[   21.700475] R10: 0000000000000000 R11: ffff9ce251370700 R12: 0000000000000000
<4>[   21.700535] R13: 0000000000000000 R14: ffff9ce251371420 R15: ffff9ce254e38c00
<4>[   21.700595] FS:  00007f22f6da8700(0000) GS:ffff9ce25f200000(0000)
knlGS:0000000000000000
<4>[   21.700662] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
<4>[   21.700711] CR2: 0000000000000048 CR3: 000000020cf65000 CR4: 00000000001406f0
<4>[   21.700770] Stack:
<4>[   21.700790]  ffffffffc0375088 0000000000000008 ffff9ce251370700
0000000000000001
<4>[   21.700867]  ffffffffc03751c7 0100000000000000 ffffa41003eaf618
ffff9ce252b5a800
<4>[   21.700944]  0000000000000000 ffff9ce251371420 0000000000000000
ffff9ce254e38c00
<4>[   21.701021] Call Trace:
<4>[   21.701048]  [<ffffffffc0375088>] ? setup_arp_tx.isra.20+0x48/0x60 [rtlwifi]
<4>[   21.701110]  [<ffffffffc03751c7>] ? rtl_is_special_data+0x127/0x210 [rtlwifi]
<4>[   21.701171]  [<ffffffffc037e8c7>] ? rtl_get_rate+0x97/0x210 [rtlwifi]
<4>[   21.701228]  [<ffffffff9a87deb6>] ? rate_control_get_rate+0xb6/0x140
<4>[   21.701283]  [<ffffffff9a88cf30>] ? ieee80211_tx_h_rate_ctrl+0x1e0/0x3f0
<4>[   21.701340]  [<ffffffff9a88fcc2>] ? invoke_tx_handlers_early+0x222/0x5a0
<4>[   21.701397]  [<ffffffff9a89186e>] ? ieee80211_tx+0x6e/0x130
<4>[   21.701446]  [<ffffffff9a892661>] ? __ieee80211_subif_start_xmit+0x4d1/0x9d0
<4>[   21.701506]  [<ffffffff9a741874>] ? nf_conntrack_tuple_taken+0x1c4/0x1d0
<4>[   21.701565]  [<ffffffff9a749779>] ? get_unique_tuple+0xe9/0x510
<4>[   21.701617]  [<ffffffff9a892b6c>] ? ieee80211_subif_start_xmit+0xc/0x10
<4>[   21.701675]  [<ffffffff9a6e606a>] ? dev_hard_start_xmit+0x9a/0x210
<4>[   21.701729]  [<ffffffff9a708a46>] ? sch_direct_xmit+0xd6/0x1a0
<4>[   21.701780]  [<ffffffff9a6e66d2>] ? __dev_queue_xmit+0x422/0x620
<4>[   21.701832]  [<ffffffff9a79859f>] ? arp_xmit+0x9f/0xb0
<4>[   21.701878]  [<ffffffff9a798220>] ? arp_create+0x250/0x250
<4>[   21.701926]  [<ffffffff9a7986ee>] ? arp_solicit+0xee/0x240
<4>[   21.701974]  [<ffffffff9a1335cd>] ? mod_timer+0x1ad/0x360
<4>[   21.702022]  [<ffffffff9a6edf12>] ? neigh_probe+0x42/0x60
<4>[   21.702071]  [<ffffffff9a6ef2f2>] ? __neigh_event_send+0x1e2/0x230
<4>[   21.702124]  [<ffffffff9a6ef520>] ? neigh_resolve_output+0x120/0x1b0
<4>[   21.702179]  [<ffffffff9a76ac37>] ? ip_finish_output2+0x127/0x300
<4>[   21.702231]  [<ffffffff9a76c524>] ? ip_output+0x64/0x100
<4>[   21.702277]  [<ffffffff9a76b9b0>] ?
__ip_flush_pending_frames.isra.46+0x80/0x80
<4>[   21.702339]  [<ffffffff9a76ceb5>] ? ip_send_skb+0x15/0x40
<4>[   21.702386]  [<ffffffff9a79308f>] ? udp_send_skb+0x15f/0x240
<4>[   21.702436]  [<ffffffff9a7944e6>] ? udp_sendmsg+0x2b6/0x840
<4>[   21.702485]  [<ffffffff9a0e10ba>] ? __local_bh_enable_ip+0x8a/0x90
<4>[   21.702538]  [<ffffffff9a76ac4a>] ? ip_finish_output2+0x13a/0x300
<4>[   21.702592]  [<ffffffff9a1fda33>] ? rw_copy_check_uvector+0x53/0x110
<4>[   21.702648]  [<ffffffff9a382b37>] ? import_iovec+0x27/0xc0
<4>[   21.702698]  [<ffffffff9a6c8d01>] ? ___sys_sendmsg+0x111/0x2a0
<4>[   21.702749]  [<ffffffff9a20fa50>] ? poll_select_copy_remaining+0x130/0x130
<4>[   21.702808]  [<ffffffff9a7944f5>] ? udp_sendmsg+0x2c5/0x840
<4>[   21.702857]  [<ffffffff9a79b2b1>] ? __ip_dev_find+0x111/0x130
<4>[   21.702908]  [<ffffffff9a764885>] ? __ip_route_output_key_hash+0x2c5/0x870
<4>[   21.702968]  [<ffffffff9a6c94e9>] ? __sys_sendmmsg+0x89/0x160
<4>[   21.703018]  [<ffffffff9a6c8490>] ? SYSC_connect+0x50/0xa0
<4>[   21.703066]  [<ffffffff9a6c626a>] ? sock_alloc_file+0x9a/0x110
<4>[   21.703119]  [<ffffffff9a6c95ce>] ? SyS_sendmmsg+0xe/0x20
<4>[   21.703166]  [<ffffffff9a8c8837>] ? entry_SYSCALL_64_fastpath+0x1a/0xa9
<4>[   21.703222] Code: 05 e9 32 ff ff ff e9 2d fe ff ff 0f 1f 00 66 2e 0f 1f 84
00 00 00 00 00 0f 1f 44 00 00 65 8b 05 24 f4 c8 3f a9 00 ff 1f 00 74 23 <48> 8b
57 48 bf 40 00 00 00 48 8b 35 3d ba b7 da c6 82 ad a2 00
<1>[   21.709488] RIP  [<ffffffffc037de33>] rtl_lps_leave+0x13/0x40 [rtlwifi]
<4>[   21.712533]  RSP <ffffa41003eaf520>
<4>[   21.715589] CR2: 0000000000000048
<4>[   21.735721] ---[ end trace f6ce402401b0b86a ]---

Dmitry

Ick, not good! Does this cause a problem in Linus's tree as well?

thanks,

greg k-h

http://lkml.iu.edu/hypermail/linux/kernel/1701.1/00228.html

OK the pending patch is here and not yet upstream :

    http://marc.info/?l=linux-wireless&m=148234081512703&w=2

It fixes ba9f93f82aba (patch 3/116) so better postpone it until the patch above gets merged.

Willy

Yes, I've reverted this now and will wait for this fixup to hit Linus's tree. Larry, can you remind me to include the original patch in the stable tree when this fixup is merged?

thanks,

greg k-h

Thanks a lot for taking an action.

Dmitry

Linus pulled it now:

commit 60f59ce0278557f7896d5158ae6d12a4855a72cc

Author: Larry Finger <[email protected]>
Date:   Wed Dec 21 11:18:55 2016 -0600

rtlwifi: rtl_usb: Fix missing entry in USB driver's private data

These drivers need to be able to reference "struct ieee80211_hw" from
the driver's private data, and vice versa. The USB driver failed to store the address of ieee80211_hw in the private data. Although this bug has been present for a long time, it was not exposed until commit ba9f93f82aba ("rtlwifi: Fix enter/exit power_save").

Kalle Valo

Thanks will queue these two up now.

greg k-h

Yes, but he is aware that the pacth exists and has asked the wireless maintainer about it. It went to DaveM today.

Larry

The fix is being merged into mainline. The reference is http://marc.info/?l=linux-wireless&m=148234081512703&w=2.

Larry

<snip>

That indeed fixes the issue, thanks!

Dmitry

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andi Kleen <[email protected]>

commit b0c1ef52959582144bbea9a2b37db7f4c9e399f7 upstream.

An earlier patch allowed enabling PT and LBR at the same time on Goldmont. However it also allowed enabling BTS and LBR at the same time, which is still not supported. Fix this by bypassing the check only for PT.

---
 arch/x86/events/core.c       |    8 ++++++--
 arch/x86/events/perf_event.h |    2 +-
 2 files changed, 7 insertions(+), 3 deletions(-)

@@ -365,7 +365,11 @@ int x86_add_exclusive(unsigned int what)
 {
 	int i;
 
-	if (x86_pmu.lbr_pt_coexist)
+	/*
+	 * When lbr_pt_coexist we allow PT to coexist with either LBR or BTS.
+	 * LBR and BTS are still mutually exclusive.
+	 */
+	if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt)
 		return 0;
 
 	if (!atomic_inc_not_zero(&x86_pmu.lbr_exclusive[what])) {

@@ -388,7 +392,7 @@ fail_unlock:
 
 void x86_del_exclusive(unsigned int what)
 {
-	if (x86_pmu.lbr_pt_coexist)
+	if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt)
 		return;
 
 	atomic_dec(&x86_pmu.lbr_exclusive[what]);

@@ -604,7 +604,7 @@ struct x86_pmu {
 	u64		lbr_sel_mask;		   /* LBR_SELECT valid bits */
 	const int	*lbr_sel_map;		   /* lbr_select mappings */
 	bool		lbr_double_abort;	   /* duplicated lbr aborts */
-	bool		lbr_pt_coexist;		   /* LBR may coexist with PT */
+	bool		lbr_pt_coexist;		   /* (LBR|BTS) may coexist with PT */
 
 	/*
 	 * Intel PT/LBR/BTS are exclusive

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ravi Bangoria <[email protected]>

commit edee44be59190bf22d5c6e521f3852b7ff16862f upstream.

'perf report --tui' exits with error when it finds a sample of zero length symbol (i.e. addr == sym->start == sym->end). Actually these are valid samples. Don't exit TUI and show report with such symbols.

---
 tools/perf/util/annotate.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -593,7 +593,8 @@ static int __symbol__inc_addr_samples(st
 
 	pr_debug3("%s: addr=%#" PRIx64 "\n", __func__, map->unmap_ip(map, addr));
 
-	if (addr < sym->start || addr >= sym->end) {
+	if ((addr < sym->start || addr >= sym->end) &&
+	    (addr != sym->end || sym->start != sym->end)) {
 		pr_debug("%s(%d): ERANGE! sym->name=%s, start=%#" PRIx64 ", addr=%#" PRIx64 ", end=%#" PRIx64 "\n",
 		       __func__, __LINE__, sym->name, sym->start, addr, sym->end);
 		return -ERANGE;

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <[email protected]>

commit 834fcd298003c10ce450e66960c78893cb1cc4b5 upstream.

If the pmu registration fails the registered hotplug callbacks are not removed. Wrong in any case, but fatal in case of a modular driver.

Replace the nonsensical state names with proper ones while at it.

---
 arch/x86/events/intel/cstate.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

@@ -594,6 +594,9 @@ static int __init cstate_probe(const str
 
 static inline void cstate_cleanup(void)
 {
+	cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_ONLINE);
+	cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_STARTING);
+
 	if (has_cstate_core)
 		perf_pmu_unregister(&cstate_core_pmu);
 

@@ -606,16 +609,16 @@ static int __init cstate_init(void)
 	int err;
 
 	cpuhp_setup_state(CPUHP_AP_PERF_X86_CSTATE_STARTING,
-			  "AP_PERF_X86_CSTATE_STARTING", cstate_cpu_init,
-			  NULL);
+			  "perf/x86/cstate:starting", cstate_cpu_init, NULL);
 	cpuhp_setup_state(CPUHP_AP_PERF_X86_CSTATE_ONLINE,
-			  "AP_PERF_X86_CSTATE_ONLINE", NULL, cstate_cpu_exit);
+			  "perf/x86/cstate:online", NULL, cstate_cpu_exit);
 
 	if (has_cstate_core) {
 		err = perf_pmu_register(&cstate_core_pmu, cstate_core_pmu.name, -1);
 		if (err) {
 			has_cstate_core = false;
 			pr_info("Failed to register cstate core pmu\n");
+			cstate_cleanup();
 			return err;
 		}
 	}

@@ -629,8 +632,7 @@ static int __init cstate_init(void)
 			return err;
 		}
 	}
-
-	return err;
+	return 0;
 }
 
 static int __init cstate_pmu_init(void)

@@ -655,8 +657,6 @@ module_init(cstate_pmu_init);
 
 static void __exit cstate_pmu_exit(void)
 {
-	cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_ONLINE);
-	cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_STARTING);
 	cstate_cleanup();
 }
 module_exit(cstate_pmu_exit);

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jes Sorensen <[email protected]>

commit c59f13bbead475096bdfebc7ef59c12e180858de upstream.

The H2C MEDIA_STATUS_RPT command for some reason causes 8192eu and 8723bu devices not being able to reconnect.

---
 drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c |    8 ++++++++
 1 file changed, 8 insertions(+)

@@ -4372,6 +4372,13 @@ void rtl8xxxu_gen1_report_connect(struct
 void rtl8xxxu_gen2_report_connect(struct rtl8xxxu_priv *priv,
 				  u8 macid, bool connect)
 {
+#ifdef RTL8XXXU_GEN2_REPORT_CONNECT
+	/*
+	 * Barry Day reports this causes issues with 8192eu and 8723bu
+	 * devices reconnecting. The reason for this is unclear, but
+	 * until it is better understood, leave the code in place but
+	 * disabled, so it is not lost.
+	 */
 	struct h2c_cmd h2c;
 
 	memset(&h2c, 0, sizeof(struct h2c_cmd));

@@ -4383,6 +4390,7 @@ void rtl8xxxu_gen2_report_connect(struct
 		h2c.media_status_rpt.parm &= ~BIT(0);
 
 	rtl8xxxu_gen2_h2c_cmd(priv, &h2c, sizeof(h2c.media_status_rpt));
+#endif
 }
 
 void rtl8xxxu_gen1_init_aggregation(struct rtl8xxxu_priv *priv)

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johannes Berg <[email protected]>

commit e6f462df9acd2a3295e5d34eb29e2823220cf129 upstream.

When mac80211 abandons an association attempt, it may free all the data structures, but inform cfg80211 and userspace about it only by sending the deauth frame it received, in which case cfg80211 has no link to the BSS struct that was used and will not cfg80211_unhold_bss() it.

Fix this by providing a way to inform cfg80211 of this with the BSS entry passed, so that it can clean up properly, and use this ability in the appropriate places in mac80211.

This isn't ideal: some code is more or less duplicated and tracing is missing. However, it's a fairly small change and it's thus easier to backport - cleanups can come later.

---
 include/net/cfg80211.h |   11 +++++++++++
 net/mac80211/mlme.c    |   21 ++++++++++++---------
 net/wireless/core.h    |    1 +
 net/wireless/mlme.c    |   12 ++++++++++++
 net/wireless/sme.c     |   14 ++++++++++++++
 5 files changed, 50 insertions(+), 9 deletions(-)

@@ -4584,6 +4584,17 @@ void cfg80211_rx_assoc_resp(struct net_d
 void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss);
 
 /**
+ * cfg80211_abandon_assoc - notify cfg80211 of abandoned association attempt
+ * @dev: network device
+ * @bss: The BSS entry with which association was abandoned.
+ *
+ * Call this whenever - for reasons reported through other API, like deauth RX,
+ * an association attempt was abandoned.
+ * This function may sleep. The caller must hold the corresponding wdev's mutex.
+ */
+void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss);
+
+/**
  * cfg80211_tx_mlme_mgmt - notification of transmitted deauth/disassoc frame
  * @dev: network device
  * @buf: 802.11 frame (header + body)

@@ -2510,7 +2510,7 @@ static void ieee80211_destroy_auth_data(
 }
 
 static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
-					 bool assoc)
+					 bool assoc, bool abandon)
 {
 	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
 

@@ -2533,6 +2533,9 @@ static void ieee80211_destroy_assoc_data
 		mutex_lock(&sdata->local->mtx);
 		ieee80211_vif_release_channel(sdata);
 		mutex_unlock(&sdata->local->mtx);
+
+		if (abandon)
+			cfg80211_abandon_assoc(sdata->dev, assoc_data->bss);
 	}
 
 	kfree(assoc_data);

@@ -2762,7 +2765,7 @@ static void ieee80211_rx_mgmt_deauth(str
 			   bssid, reason_code,
 			   ieee80211_get_reason_code_string(reason_code));
 
-		ieee80211_destroy_assoc_data(sdata, false);
+		ieee80211_destroy_assoc_data(sdata, false, true);
 
 		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
 		return;

@@ -3167,14 +3170,14 @@ static void ieee80211_rx_mgmt_assoc_resp
 	if (status_code != WLAN_STATUS_SUCCESS) {
 		sdata_info(sdata, "%pM denied association (code=%d)\n",
 			   mgmt->sa, status_code);
-		ieee80211_destroy_assoc_data(sdata, false);
+		ieee80211_destroy_assoc_data(sdata, false, false);
 		event.u.mlme.status = MLME_DENIED;
 		event.u.mlme.reason = status_code;
 		drv_event_callback(sdata->local, sdata, &event);
 	} else {
 		if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
 			/* oops -- internal error -- send timeout for now */
-			ieee80211_destroy_assoc_data(sdata, false);
+			ieee80211_destroy_assoc_data(sdata, false, false);
 			cfg80211_assoc_timeout(sdata->dev, bss);
 			return;
 		}

@@ -3187,7 +3190,7 @@ static void ieee80211_rx_mgmt_assoc_resp
 		 * recalc after assoc_data is NULL but before associated
 		 * is set can cause the interface to go idle
 		 */
-		ieee80211_destroy_assoc_data(sdata, true);
+		ieee80211_destroy_assoc_data(sdata, true, false);
 
 		/* get uapsd queues configuration */
 		uapsd_queues = 0;

@@ -3886,7 +3889,7 @@ void ieee80211_sta_work(struct ieee80211
 				.u.mlme.status = MLME_TIMEOUT,
 			};
 
-			ieee80211_destroy_assoc_data(sdata, false);
+			ieee80211_destroy_assoc_data(sdata, false, false);
 			cfg80211_assoc_timeout(sdata->dev, bss);
 			drv_event_callback(sdata->local, sdata, &event);
 		}

@@ -4025,7 +4028,7 @@ void ieee80211_mgd_quiesce(struct ieee80
 					       WLAN_REASON_DEAUTH_LEAVING,
 					       false, frame_buf);
 		if (ifmgd->assoc_data)
-			ieee80211_destroy_assoc_data(sdata, false);
+			ieee80211_destroy_assoc_data(sdata, false, true);
 		if (ifmgd->auth_data)
 			ieee80211_destroy_auth_data(sdata, false);
 		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,

@@ -4907,7 +4910,7 @@ int ieee80211_mgd_deauth(struct ieee8021
 					       IEEE80211_STYPE_DEAUTH,
 					       req->reason_code, tx,
 					       frame_buf);
-		ieee80211_destroy_assoc_data(sdata, false);
+		ieee80211_destroy_assoc_data(sdata, false, true);
 		ieee80211_report_disconnect(sdata, frame_buf,
 					    sizeof(frame_buf), true,
 					    req->reason_code);

@@ -4982,7 +4985,7 @@ void ieee80211_mgd_stop(struct ieee80211
 	sdata_lock(sdata);
 	if (ifmgd->assoc_data) {
 		struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
-		ieee80211_destroy_assoc_data(sdata, false);
+		ieee80211_destroy_assoc_data(sdata, false, false);
 		cfg80211_assoc_timeout(sdata->dev, bss);
 	}
 	if (ifmgd->auth_data)

@@ -410,6 +410,7 @@ void cfg80211_sme_disassoc(struct wirele
 void cfg80211_sme_deauth(struct wireless_dev *wdev);
 void cfg80211_sme_auth_timeout(struct wireless_dev *wdev);
 void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev);
+void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev);
 
 /* internal helpers */
 bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher);

@@ -149,6 +149,18 @@ void cfg80211_assoc_timeout(struct net_d
 }
 EXPORT_SYMBOL(cfg80211_assoc_timeout);
 
+void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss)
+{
+	struct wireless_dev *wdev = dev->ieee80211_ptr;
+	struct wiphy *wiphy = wdev->wiphy;
+
+	cfg80211_sme_abandon_assoc(wdev);
+
+	cfg80211_unhold_bss(bss_from_pub(bss));
+	cfg80211_put_bss(wiphy, bss);
+}
+EXPORT_SYMBOL(cfg80211_abandon_assoc);
+
 void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
 {
 	struct wireless_dev *wdev = dev->ieee80211_ptr;

@@ -39,6 +39,7 @@ struct cfg80211_conn {
 		CFG80211_CONN_ASSOCIATING,
 		CFG80211_CONN_ASSOC_FAILED,
 		CFG80211_CONN_DEAUTH,
+		CFG80211_CONN_ABANDON,
 		CFG80211_CONN_CONNECTED,
 	} state;
 	u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];

@@ -206,6 +207,8 @@ static int cfg80211_conn_do_work(struct
 		cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
 				     NULL, 0,
 				     WLAN_REASON_DEAUTH_LEAVING, false);
+		/* fall through */
+	case CFG80211_CONN_ABANDON:
 		/* free directly, disconnected event already sent */
 		cfg80211_sme_free(wdev);
 		return 0;

@@ -423,6 +426,17 @@ void cfg80211_sme_assoc_timeout(struct w
 	schedule_work(&rdev->conn_work);
 }
 
+void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev)
+{
+	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
+
+	if (!wdev->conn)
+		return;
+
+	wdev->conn->state = CFG80211_CONN_ABANDON;
+	schedule_work(&rdev->conn_work);
+}
+
 static int cfg80211_sme_get_conn_ies(struct wireless_dev *wdev,
 				     const u8 *ies, size_t ies_len,
 				     const u8 **out_ies, size_t *out_ies_len)

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Matthias Schiffer <[email protected]>

commit 91851cc7a939039bd401adb6ca3da4402bec1d0c upstream.

Commit b2d70d4944c1 ("ath9k: make GPIO API to support both of WMAC and SOC") refactored ath9k_hw_gpio_get() to support both WMAC and SOC GPIOs, changing the return on success from 1 to BIT(gpio). This broke some callers like ath_is_rfkill_set(). This doesn't fix any known bug in mainline at the moment, but should be fixed anyway.

Instead of fixing all callers, change ath9k_hw_gpio_get() back to only return 0 or 1.

---
 drivers/net/wireless/ath/ath9k/hw.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -2792,7 +2792,7 @@ u32 ath9k_hw_gpio_get(struct ath_hw *ah,
 		WARN_ON(1);
 	}
 
-	return val;
+	return !!val;
 }
 EXPORT_SYMBOL(ath9k_hw_gpio_get);
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Vittorio Gambaletta (VittGam) <[email protected]>

commit 79e57dd113d307a6c74773b8aaecf5442068988a upstream.

The active_high LED of my Wistron DNMA-92 is still being recognized as active_low on 4.7.6 mainline. When I was preparing my former commit 0f9edcdd88a9 ("ath9k: Fix LED polarity for some Mini PCI AR9220 MB92 cards.") to fix that I must have somehow messed up with testing, because I tested the final version of that patch before sending it, and it was apparently working; but now it is not working on 4.7.6 mainline.

I initially added the PCI_DEVICE_SUB section for 0x0029/0x2096 above the PCI_VDEVICE section for 0x0029; but then I moved the former below the latter after seeing how 0x002A sections were sorted in the file.

This turned out to be wrong: if a generic PCI_VDEVICE entry (that has both subvendor and subdevice IDs set to PCI_ANY_ID) is put before a more specific one (PCI_DEVICE_SUB), then the generic PCI_VDEVICE entry will match first and will be used.

With this patch, 0x0029/0x2096 has finally got active_high LED on 4.7.6.

While I'm at it, let's fix 0x002A too by also moving its generic definition below its specific ones.

---
 drivers/net/wireless/ath/ath9k/pci.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

@@ -26,7 +26,6 @@ static const struct pci_device_id ath_pc
 	{ PCI_VDEVICE(ATHEROS, 0x0023) }, /* PCI   */
 	{ PCI_VDEVICE(ATHEROS, 0x0024) }, /* PCI-E */
 	{ PCI_VDEVICE(ATHEROS, 0x0027) }, /* PCI   */
-	{ PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI   */
 
 #ifdef CONFIG_ATH9K_PCOEM
 	/* Mini PCI AR9220 MB92 cards: Compex WLM200NX, Wistron DNMA-92 */

@@ -37,7 +36,7 @@ static const struct pci_device_id ath_pc
 	  .driver_data = ATH9K_PCI_LED_ACT_HI },
 #endif
 
-	{ PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
+	{ PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI   */
 
 #ifdef CONFIG_ATH9K_PCOEM
 	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,

@@ -85,7 +84,11 @@ static const struct pci_device_id ath_pc
 			 0x10CF, /* Fujitsu */
 			 0x1536),
 	  .driver_data = ATH9K_PCI_D3_L1_WAR },
+#endif
 
+	{ PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
+
+#ifdef CONFIG_ATH9K_PCOEM
 	/* AR9285 card for Asus */
 	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
 			 0x002B,

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tobias Klausmann <[email protected]>

commit d1f1c0e289e1bc46cd6873ba6dd6c627f459e7fa upstream.

Starting with commit d94a461d7a7d ("ath9k: use ieee80211_tx_status_noskb where possible") the driver uses rcu_read_lock() && rcu_read_unlock(), yet on returning early in ath_tx_edma_tasklet() the unlock is missing leading to stalls and suspicious RCU usage:

===============================
[ INFO: suspicious RCU usage. ]
4.9.0-rc8 #11 Not tainted
-------------------------------
kernel/rcu/tree.c:705 Illegal idle entry in RCU read-side critical section.!

other info that might help us debug this:

RCU used illegally from idle CPU! rcu_scheduler_active = 1, debug_locks = 0 RCU used illegally from extended quiescent state! 1 lock held by swapper/7/0:
#0:
(
rcu_read_lock
){......}
, at:

 [<ffffffffa06ed110>] ath_tx_edma_tasklet+0x0/0x450 [ath9k]

 stack backtrace:
 CPU: 7 PID: 0 Comm: swapper/7 Not tainted 4.9.0-rc8 #11
 Hardware name: Acer Aspire V3-571G/VA50_HC_CR, BIOS V2.21 12/16/2013
  ffff88025efc3f38 ffffffff8132b1e5 ffff88017ede4540 0000000000000001
  ffff88025efc3f68 ffffffff810a25f7 ffff88025efcee60 ffff88017edebdd8
  ffff88025eeb5400 0000000000000091 ffff88025efc3f88 ffffffff810c3cd4
 Call Trace:
  <IRQ>
  [<ffffffff8132b1e5>] dump_stack+0x68/0x93
  [<ffffffff810a25f7>] lockdep_rcu_suspicious+0xd7/0x110
  [<ffffffff810c3cd4>] rcu_eqs_enter_common.constprop.85+0x154/0x200
  [<ffffffff810c5a54>] rcu_irq_exit+0x44/0xa0
  [<ffffffff81058631>] irq_exit+0x61/0xd0
  [<ffffffff81018d25>] do_IRQ+0x65/0x110
  [<ffffffff81672189>] common_interrupt+0x89/0x89
  <EOI>
  [<ffffffff814ffe11>] ? cpuidle_enter_state+0x151/0x200
  [<ffffffff814ffee2>] cpuidle_enter+0x12/0x20
  [<ffffffff8109a6ae>] call_cpuidle+0x1e/0x40
  [<ffffffff8109a8f6>] cpu_startup_entry+0x146/0x220
  [<ffffffff810336f8>] start_secondary+0x148/0x170

---
 drivers/net/wireless/ath/ath9k/xmit.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -2787,7 +2787,7 @@ void ath_tx_edma_tasklet(struct ath_soft
 		fifo_list = &txq->txq_fifo[txq->txq_tailidx];
 		if (list_empty(fifo_list)) {
 			ath_txq_unlock(sc, txq);
-			return;
+			break;
 		}
 
 		bf = list_first_entry(fifo_list, struct ath_buf, list);

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Adrian Hunter <[email protected]>

commit 2ca71c27eeaeddae38efe24a84b20e22708a3d1d upstream.

This reverts commit fe5fb2e3b58f ("mmc: sdhci: Reset cmd and data circuits after tuning failure").

A better fix is available, and it will be applied to older stable releases, so get this out of the way by reverting it.

---
 drivers/mmc/host/sdhci.c |    4 ----
 1 file changed, 4 deletions(-)

@@ -2086,10 +2086,6 @@ static int sdhci_execute_tuning(struct m
 
 		if (!host->tuning_done) {
 			pr_info(DRIVER_NAME ": Timeout waiting for Buffer Read Ready interrupt during tuning procedure, falling back to fixed sampling clock\n");
-
-			sdhci_do_reset(host, SDHCI_RESET_CMD);
-			sdhci_do_reset(host, SDHCI_RESET_DATA);
-
 			ctrl = sdhci_readw(host, SDHCI_HOST_CONTROL2);
 			ctrl &= ~SDHCI_CTRL_TUNED_CLK;
 			ctrl &= ~SDHCI_CTRL_EXEC_TUNING;

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Adrian Hunter <[email protected]>

commit 61e53bd0047d58caee0c7170613045bf96de4458 upstream.

Clearing the tuning bits should reset the tuning circuit. However there is more to do. Reset the command and data lines for good measure, and then for eMMC ensure the card is not still trying to process a tuning command by sending a stop command.

Note the JEDEC eMMC specification says the stop command (CMD12) can be used to stop a tuning command (CMD21) whereas the SD specification is silent on the subject with respect to the SD tuning command (CMD19). Considering that CMD12 is not a valid SDIO command, the stop command is sent only when the tuning command is CMD21 i.e. for eMMC. That addresses cases seen so far which have been on eMMC.

Note that this replaces the commit fe5fb2e3b58f ("mmc: sdhci: Reset cmd and data circuits after tuning failure") which is being reverted for v4.9+.

---
 drivers/mmc/host/sdhci.c |   20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

@@ -2091,7 +2091,27 @@ static int sdhci_execute_tuning(struct m
 			ctrl &= ~SDHCI_CTRL_EXEC_TUNING;
 			sdhci_writew(host, ctrl, SDHCI_HOST_CONTROL2);
 
+			sdhci_do_reset(host, SDHCI_RESET_CMD);
+			sdhci_do_reset(host, SDHCI_RESET_DATA);
+
 			err = -EIO;
+
+			if (cmd.opcode != MMC_SEND_TUNING_BLOCK_HS200)
+				goto out;
+
+			sdhci_writel(host, host->ier, SDHCI_INT_ENABLE);
+			sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE);
+
+			spin_unlock_irqrestore(&host->lock, flags);
+
+			memset(&cmd, 0, sizeof(cmd));
+			cmd.opcode = MMC_STOP_TRANSMISSION;
+			cmd.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC;
+			cmd.busy_timeout = 50;
+			mmc_wait_for_cmd(mmc, &cmd, 0);
+
+			spin_lock_irqsave(&host->lock, flags);
+
 			goto out;
 		}
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Linus Walleij <[email protected]>

commit 295070e9aa015abb9b92cccfbb1e43954e938133 upstream.

The regulator has never been properly enabled, it has been dormant all the time. It's strange that MMC was working at all, but it likely worked by the signals going through the levelshifter and reaching the card anyways.

---
 drivers/regulator/stw481x-vmmc.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -47,7 +47,8 @@ static struct regulator_desc vmmc_regula
 	.volt_table = stw481x_vmmc_voltages,
 	.enable_time = 200, /* FIXME: look this up */
 	.enable_reg = STW_CONF1,
-	.enable_mask = STW_CONF1_PDN_VMMC,
+	.enable_mask = STW_CONF1_PDN_VMMC | STW_CONF1_MMC_LS_STATUS,
+	.enable_val = STW_CONF1_PDN_VMMC,
 	.vsel_reg = STW_CONF1,
 	.vsel_mask = STW_CONF1_VMMC_MASK,
 };

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <[email protected]>

commit 9c1645727b8fa90d07256fdfcc45bf831242a3ab upstream.

The clocksource delta to nanoseconds conversion is using signed math, but the delta is unsigned. This makes the conversion space smaller than necessary and in case of a multiplication overflow the conversion can become negative. The conversion is done with scaled math:

    s64 nsec_delta = ((s64)clkdelta * clk->mult) >> clk->shift;

Shifting a signed integer right obvioulsy preserves the sign, which has interesting consequences:

- Time jumps backwards

- __iter_div_u64_rem() which is used in one of the calling code pathes will take forever to piecewise calculate the seconds/nanoseconds part.

This has been reported by several people with different scenarios:

David observed that when stopping a VM with a debugger:

"It was essentially the stopped by debugger case. I forget exactly why,
but the guest was being explicitly stopped from outside, it wasn't just scheduling lag. I think it was something in the vicinity of 10 minutes stopped."

When lifting the stop the machine went dead.

The stopped by debugger case is not really interesting, but nevertheless it would be a good thing not to die completely.

But this was also observed on a live system by Liav:

"When the OS is too overloaded, delta will get a high enough value for the
msb of the sum delta * tkr->mult + tkr->xtime_nsec to be set, and so after the shift the nsec variable will gain a value similar to 0xffffffffff000000."

Unfortunately this has been reintroduced recently with commit 6bd58f09e1d8 ("time: Add cycles to nanoseconds translation"). It had been fixed a year ago already in commit 35a4933a8959 ("time: Avoid signed overflow in timekeeping_get_ns()").

Though it's not surprising that the issue has been reintroduced because the function itself and the whole call chain uses s64 for the result and the propagation of it. The change in this recent commit is subtle:

s64 nsec;

-  nsec = (d * m + n) >> s:
+  nsec = d * m + n;
+  nsec >>= s;

d being type of cycle_t adds another level of obfuscation.

This wouldn't have happened if the previous change to unsigned computation would have made the 'nsec' variable u64 right away and a follow up patch had cleaned up the whole call chain.

There have been patches submitted which basically did a revert of the above patch leaving everything else unchanged as signed. Back to square one. This spawned a admittedly pointless discussion about potential users which rely on the unsigned behaviour until someone pointed out that it had been fixed before. The changelogs of said patches added further confusion as they made finally false claims about the consequences for eventual users which expect signed results.

Despite delta being cycle_t, aka. u64, it's very well possible to hand in a signed negative value and the signed computation will happily return the correct result. But nobody actually sat down and analyzed the code which was added as user after the propably unintended signed conversion.

Though in sensitive code like this it's better to analyze it proper and make sure that nothing relies on this than hunting the subtle wreckage half a year later. After analyzing all call chains it stands that no caller can hand in a negative value (which actually would work due to the s64 cast) and rely on the signed math to do the right thing.

Change the conversion function to unsigned math. The conversion of all call chains is done in a follow up patch.

This solves the starvation issue, which was caused by the negative result, but it does not solve the underlying problem. It merily procrastinates it. When the timekeeper update is deferred long enough that the unsigned multiplication overflows, then time going backwards is observable again.

It does neither solve the issue of clocksources with a small counter width which will wrap around possibly several times and cause random time stamps to be generated. But those are usually not found on systems used for virtualization, so this is likely a non issue.

I took the liberty to claim authorship for this simply because analyzing all callsites and writing the changelog took substantially more time than just making the simple s/s64/u64/ change and ignore the rest.

---
 kernel/time/timekeeping.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -299,10 +299,10 @@ u32 (*arch_gettimeoffset)(void) = defaul
 static inline u32 arch_gettimeoffset(void) { return 0; }
 #endif
 
-static inline s64 timekeeping_delta_to_ns(struct tk_read_base *tkr,
+static inline u64 timekeeping_delta_to_ns(struct tk_read_base *tkr,
 					  cycle_t delta)
 {
-	s64 nsec;
+	u64 nsec;
 
 	nsec = delta * tkr->mult + tkr->xtime_nsec;
 	nsec >>= tkr->shift;

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Linus Walleij <[email protected]>

commit 1516c6350aa2770b8a5e36d40c3ec5078f92ba70 upstream.

commit 43db289d00c6 ("gpio: stmpe: Rework registers access") reworked the STMPE register access so as to use [STMPE_IDX_*_LSB + i] to access the 8bit register for a certain bank, assuming the CSB and MSB will follow after the enumerator. For this to work the index needs to go from (size-1) to 0 not 0 to (size-1).

However for the GPIO IRQ handler, the status registers we read register MSB + 3 bytes ahead for the 24 bit GPIOs and index registers from MSB upwards and run an index i over the registers UNLESS we are STMPE1600.

This is not working when we get to clearing the interrupt EDGE status register STMPE_IDX_GPEDR_[LCM]SB: it is indexed like all other registers [STMPE_IDX_*_LSB + i] but in this loop we index from 0 to get the right bank index for the calculations, and we need to just add i to the MSB.

Before this, interrupts on the STMPE2401 were broken, this patch fixes it so it works again.

---
 drivers/gpio/gpio-stmpe.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -413,7 +413,7 @@ static irqreturn_t stmpe_gpio_irq(int ir
 		    stmpe->partnum != STMPE1801) {
 			stmpe_reg_write(stmpe, statmsbreg + i, status[i]);
 			stmpe_reg_write(stmpe,
-					stmpe->regs[STMPE_IDX_GPEDR_LSB + i],
+					stmpe->regs[STMPE_IDX_GPEDR_MSB] + i,
 					status[i]);
 		}
 	}

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Lars-Peter Clausen <[email protected]>

commit f4e81c529767b9a33d1b27695c54dc84a14af30d upstream.

The GPIO chardev is used for management tasks (allocating line and event handles) and does neither support read() nor write() operations. Hence it does not make much sense to allow seek operations.

Currently the chardev uses noop_llseek() for its seek implementation. This function does not move the pointer and simply returns the current position (always 0 for the GPIO chardev). noop_llseek() is primarily meant for devices that can not support seek, but where there might be a user that depends on the seek() operation succeeding. For newly added devices that can not support seek operations it is recommended to use no_llseek(), which will return an error. For more information see commit 6038f373a3dc ("llseek: automatically add .llseek fop").

Unfortunately this was overlooked when the GPIO chardev ABI was introduced. But it is highly unlikely that since then userspace applications have appeared that rely on being able to perform non-failing seek operations on a GPIO chardev file descriptor. So it should be safe to change from noop_llseel() to no_seek(). Also use nonseekable_open() in the chardev open() callback to clear the FMODE_SEEK, FMODE_PREAD and FMODE_PWRITE flags from the file. Neither of these should be set on a file that does not support seek operations.

---
 drivers/gpio/gpiolib.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

@@ -986,7 +986,8 @@ static int gpio_chrdev_open(struct inode
 		return -ENODEV;
 	get_device(&gdev->dev);
 	filp->private_data = gdev;
-	return 0;
+
+	return nonseekable_open(inode, filp);
 }
 
 /**

@@ -1011,7 +1012,7 @@ static const struct file_operations gpio
 	.release = gpio_chrdev_release,
 	.open = gpio_chrdev_open,
 	.owner = THIS_MODULE,
-	.llseek = noop_llseek,
+	.llseek = no_llseek,
 	.unlocked_ioctl = gpio_ioctl,
 #ifdef CONFIG_COMPAT
 	.compat_ioctl = gpio_ioctl_compat,

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexandre Courbot <[email protected]>

commit 5e6b9a89afceadb1ee45472098f7d20af260335c upstream.

Add the VDD_GPU regulator (a GPIO-enabled PWM regulator) to the Jetson TX1 board. This addition allows the GPU to be used provided the bootloader properly enabled the GPU node.

[as pointed out by Thierry on IRC, nobody has reported a bug
in the field, but using a new bootloader with a .dtb that has the incorrect data, it will crash on boot]

---
 arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi |   18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

@@ -21,6 +21,10 @@
 		reg = <0x0 0x80000000 0x1 0x0>;
 	};
 
+	gpu@57000000 {
+		vdd-supply = <&vdd_gpu>;
+	};
+
 	/* debug port */
 	serial@70006000 {
 		status = "okay";

@@ -291,4 +295,18 @@
 			clock-frequency = <32768>;
 		};
 	};
+
+	regulators {
+		vdd_gpu: regulator@100 {
+			compatible = "pwm-regulator";
+			reg = <100>;
+			pwms = <&pwm 1 4880>;
+			regulator-name = "VDD_GPU";
+			regulator-min-microvolt = <710000>;
+			regulator-max-microvolt = <1320000>;
+			enable-gpios = <&pmic 6 GPIO_ACTIVE_HIGH>;
+			regulator-ramp-delay = <80>;
+			regulator-enable-ramp-delay = <1000>;
+		};
+	};
 };

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Boris Brezillon <[email protected]>

commit 68af4fa8f39b542a6cde7ac19518d88e9b3099dc upstream.

bcm2835_pll_divider_off() is resetting the divider field in the A2W reg to zero when disabling the clock.

Make sure we preserve this value by reading the previous a2w_reg value first and ORing the result with A2W_PLL_CHANNEL_DISABLE.

---
 drivers/clk/bcm/clk-bcm2835.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -751,7 +751,9 @@ static void bcm2835_pll_divider_off(stru
 	cprman_write(cprman, data->cm_reg,
 		     (cprman_read(cprman, data->cm_reg) &
 		      ~data->load_mask) | data->hold_mask);
-	cprman_write(cprman, data->a2w_reg, A2W_PLL_CHANNEL_DISABLE);
+	cprman_write(cprman, data->a2w_reg,
+		     cprman_read(cprman, data->a2w_reg) |
+		     A2W_PLL_CHANNEL_DISABLE);
 	spin_unlock(&cprman->regs_lock);
 }
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Krzysztof Kozlowski <[email protected]>

commit f37fabb8643eaf8e3b613333a72f683770c85eca upstream.

In the critical sysfs entry the thermal hwmon was returning wrong temperature to the user-space. It was reporting the temperature of the first trip point instead of the temperature of critical trip point.

For example:

	/sys/class/hwmon/hwmon0/temp1_crit:50000
	/sys/class/thermal/thermal_zone0/trip_point_0_temp:50000
	/sys/class/thermal/thermal_zone0/trip_point_0_type:active
	/sys/class/thermal/thermal_zone0/trip_point_3_temp:120000
	/sys/class/thermal/thermal_zone0/trip_point_3_type:critical

Since commit e68b16abd91d ("thermal: add hwmon sysfs I/F") the driver have been registering a sysfs entry if get_crit_temp() callback was provided. However when accessed, it was calling get_trip_temp() instead of the get_crit_temp().

---
 drivers/thermal/thermal_hwmon.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -98,7 +98,7 @@ temp_crit_show(struct device *dev, struc
 	int temperature;
 	int ret;
 
-	ret = tz->ops->get_trip_temp(tz, 0, &temperature);
+	ret = tz->ops->get_crit_temp(tz, &temperature);
 	if (ret)
 		return ret;
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dmitry Shachnev <[email protected]>

commit 217e2bfab22e740227df09f22165e834cddd8a3b upstream.

In docutils 0.13, the return type of get_column_widths method of the Table directive has changed [1], which breaks our flat-table directive and leads to a TypeError when trying to build the docs [2].

This patch adds support for the new return type, while keeping support for older docutils versions too.

[1] https://sourceforge.net/p/docutils/patches/120/
[2] https://sourceforge.net/p/docutils/bugs/303/

---
 Documentation/sphinx/rstFlatTable.py |    5 +++++
 1 file changed, 5 insertions(+)

@@ -157,6 +157,11 @@ class ListTableBuilder(object):
     def buildTableNode(self):
 
         colwidths    = self.directive.get_column_widths(self.max_cols)
+        if isinstance(colwidths, tuple):
+            # Since docutils 0.13, get_column_widths returns a (widths,
+            # colwidths) tuple, where widths is a string (i.e. 'auto').
+            # See https://sourceforge.net/p/docutils/patches/120/.
+            colwidths = colwidths[1]
         stub_columns = self.directive.options.get('stub-columns', 0)
         header_rows  = self.directive.options.get('header-rows', 0)
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Vitaly Kuznetsov <[email protected]>

commit abd1026da4a7700a8db370947f75cd17b6ae6f76 upstream.

"kernel BUG at drivers/hv/channel_mgmt.c:350!" is observed when hv_vmbus module is unloaded. BUG_ON() was introduced in commit 85d9aa705184 ("Drivers: hv: vmbus: add an API vmbus_hvsock_device_unregister()") as vmbus_free_channels() codepath was apparently forgotten.

---
 drivers/hv/channel_mgmt.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -389,6 +389,7 @@ void vmbus_free_channels(void)
 {
 	struct vmbus_channel *channel, *tmp;
 
+	mutex_lock(&vmbus_connection.channel_mutex);
 	list_for_each_entry_safe(channel, tmp, &vmbus_connection.chn_list,
 		listentry) {
 		/* hv_process_channel_removal() needs this */

@@ -396,6 +397,7 @@ void vmbus_free_channels(void)
 
 		vmbus_device_unregister(channel->device_obj);
 	}
+	mutex_unlock(&vmbus_connection.channel_mutex);
 }
 
 /*

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Oleg Drokin <[email protected]>

commit cd15dd6ef4ea11df87f717b8b1b83aaa738ec8af upstream.

I have been having a lot of unexplainable crashes in osc_lru_shrink lately that I could not see a good explanation for and then I found this patch that slip under the radar somehow that incorrectly converted while loop for lru list iteration into list_for_each_entry_safe totally ignoring that in the body of the loop we drop spinlocks guarding this list and move list entries around.
Not sure why it was not showing up right away, perhaps some of the more recent LRU changes committed caused some extra pressure on this code that finally highlighted the breakage.

Reverts: 8adddc36b1fc ("staging: lustre: osc: Use list_for_each_entry_safe")

---
 drivers/staging/lustre/lustre/osc/osc_page.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

@@ -542,7 +542,6 @@ long osc_lru_shrink(const struct lu_env
 	struct cl_object *clobj = NULL;
 	struct cl_page **pvec;
 	struct osc_page *opg;
-	struct osc_page *temp;
 	int maxscan = 0;
 	long count = 0;
 	int index = 0;

@@ -569,13 +568,15 @@ long osc_lru_shrink(const struct lu_env
 
 	spin_lock(&cli->cl_lru_list_lock);
 	maxscan = min(target << 1, atomic_long_read(&cli->cl_lru_in_list));
-	list_for_each_entry_safe(opg, temp, &cli->cl_lru_list, ops_lru) {
+	while (!list_empty(&cli->cl_lru_list)) {
 		struct cl_page *page;
 		bool will_free = false;
 
 		if (--maxscan < 0)
 			break;
 
+		opg = list_entry(cli->cl_lru_list.next, struct osc_page,
+				 ops_lru);
 		page = opg->ops_cl.cpl_page;
 		if (lru_page_busy(cli, page)) {
 			list_move_tail(&opg->ops_lru, &cli->cl_lru_list);

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <[email protected]>

commit b8cb86fd95bb461c3496e1f4b4083b198c963a9c upstream.

James Simmons reports:

This broke when I converted the 32-bit get_seconds() into ktime_get_{real_,}seconds() inconsistently. Either one of those two would have worked, but mixing them does not.

Staying with the original intention of the patch, this changes the ktime_get_seconds() calls into ktime_get_real_seconds(), using real time instead of mononic time.

---
 drivers/staging/lustre/lustre/ldlm/ldlm_pool.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

@@ -356,10 +356,10 @@ static int ldlm_pool_recalc(struct ldlm_
 	u32 recalc_interval_sec;
 	int count;
 
-	recalc_interval_sec = ktime_get_seconds() - pl->pl_recalc_time;
+	recalc_interval_sec = ktime_get_real_seconds() - pl->pl_recalc_time;
 	if (recalc_interval_sec > 0) {
 		spin_lock(&pl->pl_lock);
-		recalc_interval_sec = ktime_get_seconds() - pl->pl_recalc_time;
+		recalc_interval_sec = ktime_get_real_seconds() - pl->pl_recalc_time;
 
 		if (recalc_interval_sec > 0) {
 			/*

@@ -382,7 +382,7 @@ static int ldlm_pool_recalc(struct ldlm_
 				    count);
 	}
 
-	recalc_interval_sec = pl->pl_recalc_time - ktime_get_seconds() +
+	recalc_interval_sec = pl->pl_recalc_time - ktime_get_real_seconds() +
 			      pl->pl_recalc_period;
 	if (recalc_interval_sec <= 0) {
 		/* DEBUG: should be re-removed after LU-4536 is fixed */

@@ -657,7 +657,7 @@ int ldlm_pool_init(struct ldlm_pool *pl,
 
 	spin_lock_init(&pl->pl_lock);
 	atomic_set(&pl->pl_granted, 0);
-	pl->pl_recalc_time = ktime_get_seconds();
+	pl->pl_recalc_time = ktime_get_real_seconds();
 	atomic_set(&pl->pl_lock_volume_factor, 1);
 
 	atomic_set(&pl->pl_grant_rate, 0);

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ian Abbott <[email protected]>

commit 655c4d442d1213b617926cc6d54e2a9a793fb46b upstream.

For NI M Series cards, the Comedi insn_read handler for the AI subdevice is broken due to ANDing the value read from the AI FIFO data register with an incorrect mask. The incorrect mask clears all but the most significant bit of the sample data. It should preserve all the sample data bits. Correct it.

---
 drivers/staging/comedi/drivers/ni_mio_common.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -1832,7 +1832,7 @@ static int ni_ai_insn_read(struct comedi
 			   unsigned int *data)
 {
 	struct ni_private *devpriv = dev->private;
-	unsigned int mask = (s->maxdata + 1) >> 1;
+	unsigned int mask = s->maxdata;
 	int i, n;
 	unsigned int signbits;
 	unsigned int d;

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ian Abbott <[email protected]>

commit 857a661020a2de3a0304edf33ad656abee100891 upstream.

Commit 0557344e2149 ("staging: comedi: ni_mio_common: fix local var for 32-bit read") changed the type of local variable d from unsigned short to unsigned int to fix a bug introduced in
commit 9c340ac934db ("staging: comedi: ni_stc.h: add read/write callbacks to struct ni_private") when reading AI data for NI PCI-6110 and PCI-6111 cards. Unfortunately, other parts of the function rely on the variable being unsigned short when an offset value in local variable signbits is added to d before writing the value to the data array:

			d += signbits;
		  	data[n] = d;

The signbits variable will be non-zero in bipolar mode, and is used to convert the hardware's 2's complement, 16-bit numbers to Comedi's straight binary sample format (with 0 representing the most negative voltage). This breaks because d is now 32 bits wide instead of 16 bits wide, so after the addition of signbits, data[n] ends up being set to values above 65536 for negative voltages. This affects all supported "E series" cards except PCI-6143 (and PXI-6143). Fix it by ANDing the value written to the data[n] with the mask 0xffff.

---
 drivers/staging/comedi/drivers/ni_mio_common.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

@@ -1875,7 +1875,7 @@ static int ni_ai_insn_read(struct comedi
 				return -ETIME;
 			}
 			d += signbits;
-			data[n] = d;
+			data[n] = d & 0xffff;
 		}
 	} else if (devpriv->is_6143) {
 		for (n = 0; n < insn->n; n++) {

@@ -1924,9 +1924,8 @@ static int ni_ai_insn_read(struct comedi
 				data[n] = dl;
 			} else {
 				d = ni_readw(dev, NI_E_AI_FIFO_DATA_REG);
-				/* subtle: needs to be short addition */
 				d += signbits;
-				data[n] = d;
+				data[n] = d & 0xffff;
 			}
 		}
 	}

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hans de Goede <[email protected]>

commit 350fa038c31b056fc509624efb66348ac2c1e3d0 upstream.

The Dell XPS 17 L702X has a non-working acpi_video0 backlight interface and an intel_backlight interface which works fine. Add a force_native quirk for it so that the non-working acpi_video0 interface does not get registered.

Note that there also is an issue with the brightnesskeys on this laptop, they do not generate key-press events in anyway. That is not solved by this patch.

---
 drivers/acpi/video_detect.c |    9 +++++++++
 1 file changed, 9 insertions(+)

@@ -296,6 +296,15 @@ static const struct dmi_system_id video_
 		DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V131"),
 		},
 	},
+	{
+	 /* https://bugzilla.redhat.com/show_bug.cgi?id=1123661 */
+	 .callback = video_detect_force_native,
+	 .ident = "Dell XPS 17 L702X",
+	 .matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+		DMI_MATCH(DMI_PRODUCT_NAME, "Dell System XPS L702X"),
+		},
+	},
 	{ },
 };
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hans de Goede <[email protected]>

commit 6276e53fa8c06a3a5cf7b95b77b079966de9ad66 upstream.

The HP Pavilion dv6 has a non-working acpi_video0 backlight interface and an intel_backlight interface which works fine. Add a force_native quirk for it so that the non-working acpi_video0 interface does not get registered.

Note that there are quite a few HP Pavilion dv6 variants, some woth ATI and some with NVIDIA hybrid gfx, both seem to need this quirk to have working backlight control. There are also some versions with only Intel integrated gfx, these may not need this quirk, but it should not hurt there.

---
 drivers/acpi/video_detect.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

@@ -305,6 +305,17 @@ static const struct dmi_system_id video_
 		DMI_MATCH(DMI_PRODUCT_NAME, "Dell System XPS L702X"),
 		},
 	},
+	{
+	/* https://bugzilla.redhat.com/show_bug.cgi?id=1204476 */
+	/* https://bugs.launchpad.net/ubuntu/+source/linux-lts-trusty/+bug/1416940 */
+	.callback = video_detect_force_native,
+	.ident = "HP Pavilion dv6",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+		DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv6 Notebook PC"),
+		},
+	},
+
 	{ },
 };
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alex Deucher <[email protected]>

commit 5a23f2720589ec4757bc62183902d2518f02026e upstream.

New variant.

---
 drivers/gpu/drm/amd/amdgpu/si_dpm.c |    1 +
 1 file changed, 1 insertion(+)

@@ -7713,6 +7713,7 @@ static int si_dpm_init_microcode(struct
 		    (adev->pdev->revision == 0x80) ||
 		    (adev->pdev->revision == 0x81) ||
 		    (adev->pdev->revision == 0x83) ||
+		    (adev->pdev->revision == 0x87) ||
 		    (adev->pdev->device == 0x6604) ||
 		    (adev->pdev->device == 0x6605))
 			chip_name = "oland_k";

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alex Deucher <[email protected]>

commit ce66cb1e9cbf91fcb216de64a0fe65aa17f97bc1 upstream.

New variant.

---
 drivers/gpu/drm/amd/amdgpu/si_dpm.c |    1 +
 1 file changed, 1 insertion(+)

@@ -3504,6 +3504,7 @@ static void si_apply_state_adjust_rules(
 		    (adev->pdev->revision == 0x80) ||
 		    (adev->pdev->revision == 0x81) ||
 		    (adev->pdev->revision == 0x83) ||
+		    (adev->pdev->revision == 0x87) ||
 		    (adev->pdev->device == 0x6604) ||
 		    (adev->pdev->device == 0x6605)) {
 			max_sclk = 75000;

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Arindam Nath <[email protected]>

commit dd31ae9ac933636c3712b7dd0f6152c1d71f81fe upstream.

GUI idle interrupts should be enabled only after we have enabled coarse grain clock gating (CGCG). This prevents GFX engine generating idle interrupt even though CGCG is not completely enabled.

Most of the time this goes un-noticed, but on some Stoney ASICs this results in GFX engine hang after system resumes from suspend. The issue is not particular to Stoney though and could have occured on any ASIC. The patch fixes this issue.

---
 drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c |   18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

@@ -5891,29 +5891,24 @@ static void gfx_v8_0_update_coarse_grain
 	adev->gfx.rlc.funcs->enter_safe_mode(adev);
 
 	if (enable && (adev->cg_flags & AMD_CG_SUPPORT_GFX_CGCG)) {
-		/* 1 enable cntx_empty_int_enable/cntx_busy_int_enable/
-		 * Cmp_busy/GFX_Idle interrupts
-		 */
-		gfx_v8_0_enable_gui_idle_interrupt(adev, true);
-
 		temp1 = data1 =	RREG32(mmRLC_CGTT_MGCG_OVERRIDE);
 		data1 &= ~RLC_CGTT_MGCG_OVERRIDE__CGCG_MASK;
 		if (temp1 != data1)
 			WREG32(mmRLC_CGTT_MGCG_OVERRIDE, data1);
 
-		/* 2 wait for RLC_SERDES_CU_MASTER & RLC_SERDES_NONCU_MASTER idle */
+		/* : wait for RLC_SERDES_CU_MASTER & RLC_SERDES_NONCU_MASTER idle */
 		gfx_v8_0_wait_for_rlc_serdes(adev);
 
-		/* 3 - clear cgcg override */
+		/* 2 - clear cgcg override */
 		gfx_v8_0_send_serdes_cmd(adev, BPM_REG_CGCG_OVERRIDE, CLE_BPM_SERDES_CMD);
 
 		/* wait for RLC_SERDES_CU_MASTER & RLC_SERDES_NONCU_MASTER idle */
 		gfx_v8_0_wait_for_rlc_serdes(adev);
 
-		/* 4 - write cmd to set CGLS */
+		/* 3 - write cmd to set CGLS */
 		gfx_v8_0_send_serdes_cmd(adev, BPM_REG_CGLS_EN, SET_BPM_SERDES_CMD);
 
-		/* 5 - enable cgcg */
+		/* 4 - enable cgcg */
 		data |= RLC_CGCG_CGLS_CTRL__CGCG_EN_MASK;
 
 		if (adev->cg_flags & AMD_CG_SUPPORT_GFX_CGLS) {

@@ -5931,6 +5926,11 @@ static void gfx_v8_0_update_coarse_grain
 
 		if (temp != data)
 			WREG32(mmRLC_CGCG_CGLS_CTRL, data);
+
+		/* 5 enable cntx_empty_int_enable/cntx_busy_int_enable/
+		 * Cmp_busy/GFX_Idle interrupts
+		 */
+		gfx_v8_0_enable_gui_idle_interrupt(adev, true);
 	} else {
 		/* disable cntx_empty_int_enable & GFX Idle interrupt */
 		gfx_v8_0_enable_gui_idle_interrupt(adev, false);

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexandre Courbot <[email protected]>

commit e137040e0d0376b404fc5155eba44ea07126e3bd upstream.

Look for firmware files using the legacy ("nouveau/nvxx_fucxxxx") path if they cannot be found in the new, "official" path. User setups were broken by the switch, which is bad.

There are only 4 firmware files we may want to look up that way, so hardcode them into the lookup function. All new firmware files should use the standard "nvidia/<chip>/gr/" path.

---
 drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c |   50 +++++++++++++++++++++++--
 1 file changed, 46 insertions(+), 4 deletions(-)

@@ -1756,6 +1756,50 @@ gf100_gr_ = {
 };
 
 int
+gf100_gr_ctor_fw_legacy(struct gf100_gr *gr, const char *fwname,
+			struct gf100_gr_fuc *fuc, int ret)
+{
+	struct nvkm_subdev *subdev = &gr->base.engine.subdev;
+	struct nvkm_device *device = subdev->device;
+	const struct firmware *fw;
+	char f[32];
+
+	/* see if this firmware has a legacy path */
+	if (!strcmp(fwname, "fecs_inst"))
+		fwname = "fuc409c";
+	else if (!strcmp(fwname, "fecs_data"))
+		fwname = "fuc409d";
+	else if (!strcmp(fwname, "gpccs_inst"))
+		fwname = "fuc41ac";
+	else if (!strcmp(fwname, "gpccs_data"))
+		fwname = "fuc41ad";
+	else {
+		/* nope, let's just return the error we got */
+		nvkm_error(subdev, "failed to load %s\n", fwname);
+		return ret;
+	}
+
+	/* yes, try to load from the legacy path */
+	nvkm_debug(subdev, "%s: falling back to legacy path\n", fwname);
+
+	snprintf(f, sizeof(f), "nouveau/nv%02x_%s", device->chipset, fwname);
+	ret = request_firmware(&fw, f, device->dev);
+	if (ret) {
+		snprintf(f, sizeof(f), "nouveau/%s", fwname);
+		ret = request_firmware(&fw, f, device->dev);
+		if (ret) {
+			nvkm_error(subdev, "failed to load %s\n", fwname);
+			return ret;
+		}
+	}
+
+	fuc->size = fw->size;
+	fuc->data = kmemdup(fw->data, fuc->size, GFP_KERNEL);
+	release_firmware(fw);
+	return (fuc->data != NULL) ? 0 : -ENOMEM;
+}
+
+int
 gf100_gr_ctor_fw(struct gf100_gr *gr, const char *fwname,
 		 struct gf100_gr_fuc *fuc)
 {

@@ -1765,10 +1809,8 @@ gf100_gr_ctor_fw(struct gf100_gr *gr, co
 	int ret;
 
 	ret = nvkm_firmware_get(device, fwname, &fw);
-	if (ret) {
-		nvkm_error(subdev, "failed to load %s\n", fwname);
-		return ret;
-	}
+	if (ret)
+		return gf100_gr_ctor_fw_legacy(gr, fwname, fuc, ret);
 
 	fuc->size = fw->size;
 	fuc->data = kmemdup(fw->data, fuc->size, GFP_KERNEL);

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ben Skeggs <[email protected]>

commit 768e847759d551c96e129e194588dbfb11a1d576 upstream.

---
 drivers/gpu/drm/nouveau/nouveau_bios.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -333,6 +333,9 @@ get_fp_strap(struct drm_device *dev, str
 	if (bios->major_version < 5 && bios->data[0x48] & 0x4)
 		return NVReadVgaCrtc5758(dev, 0, 0xf) & 0xf;
 
+	if (drm->device.info.family >= NV_DEVICE_INFO_V0_MAXWELL)
+		return nvif_rd32(device, 0x001800) & 0x0000000f;
+	else
 	if (drm->device.info.family >= NV_DEVICE_INFO_V0_TESLA)
 		return (nvif_rd32(device, NV_PEXTDEV_BOOT_0) >> 24) & 0xf;
 	else

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ben Skeggs <[email protected]>

commit 5dc7f4aa9d84ea94b54a9bfcef095f0289f1ebda upstream.

---
 drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h       |    1 +
 drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c     |    7 +++++--
 drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c |    1 +
 3 files changed, 7 insertions(+), 2 deletions(-)

@@ -12,6 +12,7 @@ struct nvbios_source {
 	bool rw;
 	bool ignore_checksum;
 	bool no_pcir;
+	bool require_checksum;
 };
 
 int nvbios_extend(struct nvkm_bios *, u32 length);

@@ -86,9 +86,12 @@ shadow_image(struct nvkm_bios *bios, int
 		    nvbios_checksum(&bios->data[image.base], image.size)) {
 			nvkm_debug(subdev, "%08x: checksum failed\n",
 				   image.base);
-			if (mthd->func->rw)
+			if (!mthd->func->require_checksum) {
+				if (mthd->func->rw)
+					score += 1;
 				score += 1;
-			score += 1;
+			} else
+				return 0;
 		} else {
 			score += 3;
 		}

@@ -99,6 +99,7 @@ nvbios_acpi_fast = {
 	.init = acpi_init,
 	.read = acpi_read_fast,
 	.rw = false,
+	.require_checksum = true,
 };
 
 const struct nvbios_source

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ben Skeggs <[email protected]>

commit f4e65efc88b64c1dbca275d42a188edccedb56c6 upstream.

---
 drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -47,8 +47,10 @@ nvkm_ltc_tags_clear(struct nvkm_ltc *ltc
 
 	BUG_ON((first > limit) || (limit >= ltc->num_tags));
 
+	mutex_lock(&ltc->subdev.mutex);
 	ltc->func->cbc_clear(ltc, first, limit);
 	ltc->func->cbc_wait(ltc);
+	mutex_unlock(&ltc->subdev.mutex);
 }
 
 int

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ben Skeggs <[email protected]>

commit 10dcab3e7f477bffee88d518aad57d06777cfdf4 upstream.

TTM was changed a while back to allow for pipelining of buffer moves, and part of this was the removal of waiting for a BO to idle before calling move(), placing the responsibility on the driver to do this if required.

That's all well and good, except, we make use of move_notify() to handle mapping/unmapping from the GPU VMM as move() isn't called on all paths.

This commit adds a wait before unmapping from a VMM in move_notify(), to prevent GPU page faults where a buffer is still being accessed.

---
 drivers/gpu/drm/nouveau/nouveau_bo.c |    1 +
 1 file changed, 1 insertion(+)

@@ -1209,6 +1209,7 @@ nouveau_bo_move_ntfy(struct ttm_buffer_o
 			       nvbo->page_shift != vma->vm->mmu->lpg_shift)) {
 			nvkm_vm_map(vma, new_mem->mm_node);
 		} else {
+			WARN_ON(ttm_bo_wait(bo, false, false));
 			nvkm_vm_unmap(vma);
 		}
 	}

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ben Skeggs <[email protected]>

commit 5b3800a6b763874e4a23702fb9628d3bd3315ce9 upstream.

DPAUX registers moved on Kepler, these chipsets were still using the Fermi implementation for some reason.

This fixes detection of hotplug/sink IRQs on DP connectors.

---
 drivers/gpu/drm/nouveau/nvkm/engine/device/base.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

@@ -1851,7 +1851,7 @@ nvf1_chipset = {
 	.fb = gk104_fb_new,
 	.fuse = gf100_fuse_new,
 	.gpio = gk104_gpio_new,
-	.i2c = gf119_i2c_new,
+	.i2c = gk104_i2c_new,
 	.ibus = gk104_ibus_new,
 	.iccsense = gf100_iccsense_new,
 	.imem = nv50_instmem_new,

@@ -1965,7 +1965,7 @@ nv117_chipset = {
 	.fb = gm107_fb_new,
 	.fuse = gm107_fuse_new,
 	.gpio = gk104_gpio_new,
-	.i2c = gf119_i2c_new,
+	.i2c = gk104_i2c_new,
 	.ibus = gk104_ibus_new,
 	.iccsense = gf100_iccsense_new,
 	.imem = nv50_instmem_new,

@@ -1999,7 +1999,7 @@ nv118_chipset = {
 	.fb = gm107_fb_new,
 	.fuse = gm107_fuse_new,
 	.gpio = gk104_gpio_new,
-	.i2c = gf119_i2c_new,
+	.i2c = gk104_i2c_new,
 	.ibus = gk104_ibus_new,
 	.iccsense = gf100_iccsense_new,
 	.imem = nv50_instmem_new,

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ben Skeggs <[email protected]>

commit b27add13f500469127afdf011dbcc9c649e16e54 upstream.

This avoids an issue that occurs when we're attempting to preempt multiple channels simultaneously. HW seems to ignore preempt requests while it's still processing a previous one, which, well, makes sense.

Fixes random "fifo: SCHED_ERROR 0d []" + GPCCS page faults during parallel piglit runs on (at least) GM107.

---
 drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c |    9 ++++++---
 drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c |    8 +++++---
 2 files changed, 11 insertions(+), 6 deletions(-)

@@ -60,6 +60,7 @@ gf100_fifo_gpfifo_engine_fini(struct nvk
 	struct nvkm_gpuobj *inst = chan->base.inst;
 	int ret = 0;
 
+	mutex_lock(&subdev->mutex);
 	nvkm_wr32(device, 0x002634, chan->base.chid);
 	if (nvkm_msec(device, 2000,
 		if (nvkm_rd32(device, 0x002634) == chan->base.chid)

@@ -67,10 +68,12 @@ gf100_fifo_gpfifo_engine_fini(struct nvk
 	) < 0) {
 		nvkm_error(subdev, "channel %d [%s] kick timeout\n",
 			   chan->base.chid, chan->base.object.client->name);
-		ret = -EBUSY;
-		if (suspend)
-			return ret;
+		ret = -ETIMEDOUT;
 	}
+	mutex_unlock(&subdev->mutex);
+
+	if (ret && suspend)
+		return ret;
 
 	if (offset) {
 		nvkm_kmap(inst);

@@ -40,7 +40,9 @@ gk104_fifo_gpfifo_kick(struct gk104_fifo
 	struct nvkm_subdev *subdev = &fifo->base.engine.subdev;
 	struct nvkm_device *device = subdev->device;
 	struct nvkm_client *client = chan->base.object.client;
+	int ret = 0;
 
+	mutex_lock(&subdev->mutex);
 	nvkm_wr32(device, 0x002634, chan->base.chid);
 	if (nvkm_msec(device, 2000,
 		if (!(nvkm_rd32(device, 0x002634) & 0x00100000))

@@ -48,10 +50,10 @@ gk104_fifo_gpfifo_kick(struct gk104_fifo
 	) < 0) {
 		nvkm_error(subdev, "channel %d [%s] kick timeout\n",
 			   chan->base.chid, client->name);
-		return -EBUSY;
+		ret = -ETIMEDOUT;
 	}
-
-	return 0;
+	mutex_unlock(&subdev->mutex);
+	return ret;
 }
 
 static u32

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alex Deucher <[email protected]>

commit 8729675c00a8d13cb2094d617d70a4a4da7d83c5 upstream.

New variant.

---
 drivers/gpu/drm/radeon/si_dpm.c |    1 +
 1 file changed, 1 insertion(+)

@@ -3026,6 +3026,7 @@ static void si_apply_state_adjust_rules(
 		    (rdev->pdev->revision == 0x80) ||
 		    (rdev->pdev->revision == 0x81) ||
 		    (rdev->pdev->revision == 0x83) ||
+		    (rdev->pdev->revision == 0x87) ||
 		    (rdev->pdev->device == 0x6604) ||
 		    (rdev->pdev->device == 0x6605)) {
 			max_sclk = 75000;

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alex Deucher <[email protected]>

commit abb2e3c1ce64c8bba678973800c34ea1dc97c42c upstream.

New variant.

---
 drivers/gpu/drm/radeon/si.c |    1 +
 1 file changed, 1 insertion(+)

@@ -1714,6 +1714,7 @@ static int si_init_microcode(struct rade
 		    (rdev->pdev->revision == 0x80) ||
 		    (rdev->pdev->revision == 0x81) ||
 		    (rdev->pdev->revision == 0x83) ||
+		    (rdev->pdev->revision == 0x87) ||
 		    (rdev->pdev->device == 0x6604) ||
 		    (rdev->pdev->device == 0x6605))
 			new_smc = true;

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Patrik Jakobsson <[email protected]>

commit 0a97c81a9717431e6c57ea845b59c3c345edce67 upstream.

Hook up drm_compat_ioctl to support 32-bit userspace on 64-bit kernels. It turns out that N2600 and N2800 comes with 64-bit enabled. We previously assumed there where no such systems out there.

---
 drivers/gpu/drm/gma500/psb_drv.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -473,6 +473,9 @@ static const struct file_operations psb_
 	.open = drm_open,
 	.release = drm_release,
 	.unlocked_ioctl = psb_unlocked_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl = drm_compat_ioctl,
+#endif
 	.mmap = drm_gem_mmap,
 	.poll = drm_poll,
 	.read = drm_read,

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hawking Zhang <[email protected]>

commit 10e2ca346bf74561ff1b7fff6287716ab976cd8c upstream.

If vBIOS noFan bit is set, the fan table parameters in thermal controller will not get initialized. The driver should avoid to use these uninitialized parameter to do calculation. Otherwise, it may trigger divide 0 error.

---
 drivers/gpu/drm/amd/powerplay/smumgr/fiji_smc.c      |    6 ++++++
 drivers/gpu/drm/amd/powerplay/smumgr/iceland_smc.c   |    6 ++++++
 drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smc.c |    6 ++++++
 drivers/gpu/drm/amd/powerplay/smumgr/tonga_smc.c     |    6 ++++++
 4 files changed, 24 insertions(+)

@@ -1958,6 +1958,12 @@ int fiji_thermal_setup_fan_table(struct
 	int res;
 	uint64_t tmp64;
 
+	if (hwmgr->thermal_controller.fanInfo.bNoFan) {
+		phm_cap_unset(hwmgr->platform_descriptor.platformCaps,
+			PHM_PlatformCaps_MicrocodeFanControl);
+		return 0;
+	}
+
 	if (smu_data->smu7_data.fan_table_start == 0) {
 		phm_cap_unset(hwmgr->platform_descriptor.platformCaps,
 				PHM_PlatformCaps_MicrocodeFanControl);

@@ -2006,6 +2006,12 @@ int iceland_thermal_setup_fan_table(stru
 	if (!phm_cap_enabled(hwmgr->platform_descriptor.platformCaps, PHM_PlatformCaps_MicrocodeFanControl))
 		return 0;
 
+	if (hwmgr->thermal_controller.fanInfo.bNoFan) {
+		phm_cap_unset(hwmgr->platform_descriptor.platformCaps,
+			PHM_PlatformCaps_MicrocodeFanControl);
+		return 0;
+	}
+
 	if (0 == smu7_data->fan_table_start) {
 		phm_cap_unset(hwmgr->platform_descriptor.platformCaps, PHM_PlatformCaps_MicrocodeFanControl);
 		return 0;

@@ -1885,6 +1885,12 @@ int polaris10_thermal_setup_fan_table(st
 	int res;
 	uint64_t tmp64;
 
+	if (hwmgr->thermal_controller.fanInfo.bNoFan) {
+		phm_cap_unset(hwmgr->platform_descriptor.platformCaps,
+			PHM_PlatformCaps_MicrocodeFanControl);
+		return 0;
+	}
+
 	if (smu_data->smu7_data.fan_table_start == 0) {
 		phm_cap_unset(hwmgr->platform_descriptor.platformCaps,
 				PHM_PlatformCaps_MicrocodeFanControl);

@@ -2496,6 +2496,12 @@ int tonga_thermal_setup_fan_table(struct
 					PHM_PlatformCaps_MicrocodeFanControl))
 		return 0;
 
+	if (hwmgr->thermal_controller.fanInfo.bNoFan) {
+		phm_cap_unset(hwmgr->platform_descriptor.platformCaps,
+			PHM_PlatformCaps_MicrocodeFanControl);
+		return 0;
+	}
+
 	if (0 == smu_data->smu7_data.fan_table_start) {
 		phm_cap_unset(hwmgr->platform_descriptor.platformCaps,
 					PHM_PlatformCaps_MicrocodeFanControl);

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rex Zhu <[email protected]>

commit eb584241226958d45aa1f07f4f6a6ea9da98b29e upstream.

the CP_PG_DISABLE bit was reversed.

---
 drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -3994,7 +3994,7 @@ static void cz_enable_sck_slow_down_on_p
 
 static void cz_enable_cp_power_gating(struct amdgpu_device *adev, bool enable)
 {
-	WREG32_FIELD(RLC_PG_CNTL, CP_PG_DISABLE, enable ? 1 : 0);
+	WREG32_FIELD(RLC_PG_CNTL, CP_PG_DISABLE, enable ? 0 : 1);
 }
 
 static void gfx_v8_0_init_pg(struct amdgpu_device *adev)

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rex Zhu <[email protected]>

commit 202e0b227b906cb80a2791f21216a55d9468d61b upstream.

set valid data to mmRLC_SRM_INDEX_CNTL_ADDRx/DATAx.

---
 drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

@@ -3947,8 +3947,12 @@ static int gfx_v8_0_init_save_restore_li
 	temp = mmRLC_SRM_INDEX_CNTL_ADDR_0;
 	data = mmRLC_SRM_INDEX_CNTL_DATA_0;
 	for (i = 0; i < sizeof(unique_indices) / sizeof(int); i++) {
-		amdgpu_mm_wreg(adev, temp + i, unique_indices[i] & 0x3FFFF, false);
-		amdgpu_mm_wreg(adev, data + i, unique_indices[i] >> 20, false);
+		if (unique_indices[i] != 0) {
+			amdgpu_mm_wreg(adev, temp + i,
+					unique_indices[i] & 0x3FFFF, false);
+			amdgpu_mm_wreg(adev, data + i,
+					unique_indices[i] >> 20, false);
+		}
 	}
 	kfree(register_list_format);
 

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Russell Currey <[email protected]>

commit 298360af3dab45659810fdc51aba0c9f4097e4f6 upstream.

ast_get_dram_info() configures a window in order to access BMC memory. A BMC register can be configured to disallow this, and if so, causes an infinite loop in the ast driver which renders the system unusable.

Fix this by erroring out if an error is detected. On powerpc systems with EEH, this leads to the device being fenced and the system continuing to operate.

---
 drivers/gpu/drm/ast/ast_main.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

@@ -223,7 +223,8 @@ static int ast_get_dram_info(struct drm_
 	ast_write32(ast, 0x10000, 0xfc600309);
 
 	do {
-		;
+		if (pci_channel_offline(dev->pdev))
+			return -EIO;
 	} while (ast_read32(ast, 0x10000) != 0x01);
 	data = ast_read32(ast, 0x10004);
 

@@ -428,7 +429,9 @@ int ast_driver_load(struct drm_device *d
 	ast_detect_chip(dev, &need_post);
 
 	if (ast->chip != AST1180) {
-		ast_get_dram_info(dev);
+		ret = ast_get_dram_info(dev);
+		if (ret)
+			goto out_free;
 		ast->vram_size = ast_get_vram_info(dev);
 		DRM_INFO("dram %d %d %d %08x\n", ast->mclk, ast->dram_type, ast->dram_bus_width, ast->vram_size);
 	}

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexander Usyskin <[email protected]>

commit d5f8e166c25750adc147b0adf64a62a91653438a upstream.

pm_runtime_autosuspend can take synchronous or asynchronous paths, Because we are calling pm_runtime_mark_last_busy just before this most of the cases it takes the asynchronous way. However, when the FW or driver resets during already running runtime suspend, the call will result in calling to the driver's rpm callback and results in a deadlock on device_lock.
The simplest fix is to replace pm_runtime_autosuspend with asynchronous pm_request_autosuspend.

---
 drivers/misc/mei/client.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -686,7 +686,7 @@ void mei_host_client_init(struct mei_dev
 
 	pm_runtime_mark_last_busy(dev->dev);
 	dev_dbg(dev->dev, "rpm: autosuspend\n");
-	pm_runtime_autosuspend(dev->dev);
+	pm_request_autosuspend(dev->dev);
 }
 
 /**

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tomas Winkler <[email protected]>

commit 9ff2007bea1f1bfc53ac0bc7ccf8200bb275fd52 upstream.

Add MEI Lewisburg PCH IDs for Purley based workstations.

---
 drivers/misc/mei/hw-me-regs.h |    2 ++
 drivers/misc/mei/pci-me.c     |    1 +
 2 files changed, 3 insertions(+)

@@ -122,6 +122,8 @@
 #define MEI_DEV_ID_SPT_H      0xA13A  /* Sunrise Point H */
 #define MEI_DEV_ID_SPT_H_2    0xA13B  /* Sunrise Point H 2 */
 
+#define MEI_DEV_ID_LBG        0xA1BA  /* Lewisburg (SPT) */
+
 #define MEI_DEV_ID_BXT_M      0x1A9A  /* Broxton M */
 #define MEI_DEV_ID_APL_I      0x5A9A  /* Apollo Lake I */
 

@@ -87,6 +87,7 @@ static const struct pci_device_id mei_me
 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, mei_me_pch8_cfg)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_sps_cfg)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_sps_cfg)},
+	{MEI_PCI_DEVICE(MEI_DEV_ID_LBG, mei_me_pch8_cfg)},
 
 	{MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)},

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rabin Vincent <[email protected]>

commit af309226db916e2c6e08d3eba3fa5c34225200c4 upstream.

If a block device is closed while iterate_bdevs() is handling it, the following NULL pointer dereference occurs because bdev->b_disk is NULL in bdev_get_queue(), which is called from blk_get_backing_dev_info() (in turn called by the mapping_cap_writeback_dirty() call in __filemap_fdatawrite_range()):

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000508
 IP: [<ffffffff81314790>] blk_get_backing_dev_info+0x10/0x20
 PGD 9e62067 PUD 9ee8067 PMD 0
 Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
 Modules linked in:
 CPU: 1 PID: 2422 Comm: sync Not tainted 4.5.0-rc7+ #400
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
 task: ffff880009f4d700 ti: ffff880009f5c000 task.ti: ffff880009f5c000
 RIP: 0010:[<ffffffff81314790>]  [<ffffffff81314790>] blk_get_backing_dev_info+0x10/0x20
 RSP: 0018:ffff880009f5fe68  EFLAGS: 00010246
 RAX: 0000000000000000 RBX: ffff88000ec17a38 RCX: ffffffff81a4e940
 RDX: 7fffffffffffffff RSI: 0000000000000000 RDI: ffff88000ec176c0
 RBP: ffff880009f5fe68 R08: 0000000000000000 R09: 0000000000000000
 R10: 0000000000000001 R11: 0000000000000000 R12: ffff88000ec17860
 R13: ffffffff811b25c0 R14: ffff88000ec178e0 R15: ffff88000ec17a38
 FS:  00007faee505d700(0000) GS:ffff88000fb00000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
 CR2: 0000000000000508 CR3: 0000000009e8a000 CR4: 00000000000006e0
 Stack:
  ffff880009f5feb8 ffffffff8112e7f5 0000000000000000 7fffffffffffffff
  0000000000000000 0000000000000000 7fffffffffffffff 0000000000000001
  ffff88000ec178e0 ffff88000ec17860 ffff880009f5fec8 ffffffff8112e81f
 Call Trace:
  [<ffffffff8112e7f5>] __filemap_fdatawrite_range+0x85/0x90
  [<ffffffff8112e81f>] filemap_fdatawrite+0x1f/0x30
  [<ffffffff811b25d6>] fdatawrite_one_bdev+0x16/0x20
  [<ffffffff811bc402>] iterate_bdevs+0xf2/0x130
  [<ffffffff811b2763>] sys_sync+0x63/0x90
  [<ffffffff815d4272>] entry_SYSCALL_64_fastpath+0x12/0x76
 Code: 0f 1f 44 00 00 48 8b 87 f0 00 00 00 55 48 89 e5 <48> 8b 80 08 05 00 00 5d
 RIP  [<ffffffff81314790>] blk_get_backing_dev_info+0x10/0x20
  RSP <ffff880009f5fe68>
 CR2: 0000000000000508
 ---[ end trace 2487336ceb3de62d ]---

The crash is easily reproducible by running the following command, if an msleep(100) is inserted before the call to func() in iterate_devs():

while :; do head -c1 /dev/nullb0; done > /dev/null & while :; do sync; done

Fix it by holding the bd_mutex across the func() call and only calling func() if the bdev is opened.

---
 fs/block_dev.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

@@ -1950,6 +1950,7 @@ void iterate_bdevs(void (*func)(struct b
 	spin_lock(&blockdev_superblock->s_inode_list_lock);
 	list_for_each_entry(inode, &blockdev_superblock->s_inodes, i_sb_list) {
 		struct address_space *mapping = inode->i_mapping;
+		struct block_device *bdev;
 
 		spin_lock(&inode->i_lock);
 		if (inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW) ||

@@ -1970,8 +1971,12 @@ void iterate_bdevs(void (*func)(struct b
 		 */
 		iput(old_inode);
 		old_inode = inode;
+		bdev = I_BDEV(inode);
 
-		func(I_BDEV(inode), arg);
+		mutex_lock(&bdev->bd_mutex);
+		if (bdev->bd_openers)
+			func(bdev, arg);
+		mutex_unlock(&bdev->bd_mutex);
 
 		spin_lock(&blockdev_superblock->s_inode_list_lock);
 	}

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Maciej S. Szmigiero <[email protected]>

commit 31b5929d533f5183972cf57a7844b456ed996f3c upstream.

There is a disagreement between drivers/tty/vt/keyboard.c and drivers/input/input-leds.c with regard to what is a Scroll Lock LED trigger name: input calls it "kbd-scrolllock", but vt calls it "kbd-scrollock" (two l's).
This prevents Scroll Lock LED trigger from binding to this LED by default.

Since it is a scroLL Lock LED, this interface was introduced only about a year ago and in an Internet search people seem to reference this trigger only to set it to this LED let's simply rename it to "kbd-scrolllock".

Also, it looks like this was supposed to be changed before this code was
merged: https://lkml.org/lkml/2015/6/9/697 but it was done only on the input side.

---
 drivers/tty/vt/keyboard.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -982,7 +982,7 @@ static void kbd_led_trigger_activate(str
 	KBD_LED_TRIGGER((_led_bit) + 8, _name)
 
 static struct kbd_led_trigger kbd_led_triggers[] = {
-	KBD_LED_TRIGGER(VC_SCROLLOCK, "kbd-scrollock"),
+	KBD_LED_TRIGGER(VC_SCROLLOCK, "kbd-scrolllock"),
 	KBD_LED_TRIGGER(VC_NUMLOCK,   "kbd-numlock"),
 	KBD_LED_TRIGGER(VC_CAPSLOCK,  "kbd-capslock"),
 	KBD_LED_TRIGGER(VC_KANALOCK,  "kbd-kanalock"),

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

commit a0ebf519b8a2666438d999c62995618c710573e5 upstream.

Make sure to drop the reference taken by class_find_device() also on allocation errors in open().

---
 drivers/hwtracing/stm/core.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

@@ -361,7 +361,7 @@ static int stm_char_open(struct inode *i
 	struct stm_file *stmf;
 	struct device *dev;
 	unsigned int major = imajor(inode);
-	int err = -ENODEV;
+	int err = -ENOMEM;
 
 	dev = class_find_device(&stm_class, NULL, &major, major_match);
 	if (!dev)

@@ -369,8 +369,9 @@ static int stm_char_open(struct inode *i
 
 	stmf = kzalloc(sizeof(*stmf), GFP_KERNEL);
 	if (!stmf)
-		return -ENOMEM;
+		goto err_put_device;
 
+	err = -ENODEV;
 	stm_output_init(&stmf->output);
 	stmf->stm = to_stm_device(dev);
 

@@ -382,9 +383,10 @@ static int stm_char_open(struct inode *i
 	return nonseekable_open(inode, file);
 
 err_free:
+	kfree(stmf);
+err_put_device:
 	/* matches class_find_device() above */
 	put_device(dev);
-	kfree(stmf);
 
 	return err;
 }

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kashyap Desai <[email protected]>

commit 18e1c7f68a5814442abad849abe6eacbf02ffd7c upstream.

For SRIOV enabled firmware, if there is a OCR(online controller reset) possibility driver set the convert flag to 1, which is not happening if there are outstanding commands even after 180 seconds. As driver does not set convert flag to 1 and still making the OCR to run, VF(Virtual function) driver is directly writing on to the register instead of waiting for 30 seconds. Setting convert flag to 1 will cause VF driver will wait for 30 secs before going for reset.

---
 drivers/scsi/megaraid/megaraid_sas_fusion.c |    1 +
 1 file changed, 1 insertion(+)

@@ -2823,6 +2823,7 @@ int megasas_wait_for_outstanding_fusion(
 		dev_err(&instance->pdev->dev, "pending commands remain after waiting, "
 		       "will reset adapter scsi%d.\n",
 		       instance->host->host_no);
+		*convert = 1;
 		retval = 1;
 	}
 out:

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kashyap Desai <[email protected]>

commit d5573584429254a14708cf8375c47092b5edaf2c upstream.

---
 drivers/scsi/megaraid/megaraid_sas_fusion.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

@@ -2000,6 +2000,8 @@ megasas_build_syspd_fusion(struct megasa
 		io_request->DevHandle = pd_sync->seq[pd_index].devHandle;
 		pRAID_Context->regLockFlags |=
 			(MR_RL_FLAGS_SEQ_NUM_ENABLE|MR_RL_FLAGS_GRANT_DESTINATION_CUDA);
+		pRAID_Context->Type = MPI2_TYPE_CUDA;
+		pRAID_Context->nseg = 0x1;
 	} else if (fusion->fast_path_io) {
 		pRAID_Context->VirtualDiskTgtId = cpu_to_le16(device_id);
 		pRAID_Context->configSeqNum = 0;

@@ -2035,12 +2037,10 @@ megasas_build_syspd_fusion(struct megasa
 		pRAID_Context->timeoutValue =
 			cpu_to_le16((os_timeout_value > timeout_limit) ?
 			timeout_limit : os_timeout_value);
-		if (fusion->adapter_type == INVADER_SERIES) {
-			pRAID_Context->Type = MPI2_TYPE_CUDA;
-			pRAID_Context->nseg = 0x1;
+		if (fusion->adapter_type == INVADER_SERIES)
 			io_request->IoFlags |=
 				cpu_to_le16(MPI25_SAS_DEVICE0_FLAGS_ENABLED_FAST_PATH);
-		}
+
 		cmd->request_desc->SCSIIO.RequestFlags =
 			(MPI2_REQ_DESCRIPT_FLAGS_FP_IO <<
 				MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT);

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Varun Prakash <[email protected]>

commit 83337e544323a8bd7492994d64af339175ac7107 upstream.

If iscsit_tpg_add_network_portal() fails then
return error code instead of 0 to user space.

If iscsi-target returns 0 then user space keeps
on retrying same command infinitely, targetcli or echo hangs till command completes with non zero return value. In some cases it is possible that add network portal command never completes with success even after retrying multiple times,
for example - cxgbit_setup_np() always returns -EINVAL if portal IP does not belong to Chelsio adapter interface.

---
 drivers/target/iscsi/iscsi_target_configfs.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -100,8 +100,10 @@ static ssize_t lio_target_np_driver_stor
 
 		tpg_np_new = iscsit_tpg_add_network_portal(tpg,
 					&np->np_sockaddr, tpg_np, type);
-		if (IS_ERR(tpg_np_new))
+		if (IS_ERR(tpg_np_new)) {
+			rc = PTR_ERR(tpg_np_new);
 			goto out;
+		}
 	} else {
 		tpg_np_new = iscsit_tpg_locate_child_np(tpg_np, type);
 		if (tpg_np_new) {

4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Benjamin Block <[email protected]>

commit dac37e15b7d511e026a9313c8c46794c144103cd upstream.

When SCSI EH invokes zFCP's callbacks for eh_device_reset_handler() and eh_target_reset_handler(), it expects us to relent the ownership over the given scsi_cmnd and all other scsi_cmnds within the same scope - LUN or target - when returning with SUCCESS from the callback ('release' them). SCSI EH can then reuse those commands.

We did not follow this rule to release commands upon SUCCESS; and if later a reply arrived for one of those supposed to be released commands, we would still make use of the scsi_cmnd in our ingress tasklet. This will at least result in undefined behavior or a kernel panic because of a wrong kernel pointer dereference.

To fix this, we NULLify all pointers to scsi_cmnds (struct zfcp_fsf_req *)->data in the matching scope if a TMF was successful. This is done under the locks (struct zfcp_adapter *)->abort_lock and (struct zfcp_reqlist *)->lock to prevent the requests from being removed from the request-hashtable, and the ingress tasklet from making use of the scsi_cmnd-pointer in zfcp_fsf_fcp_cmnd_handler().

For cases where a reply arrives during SCSI EH, but before we get a chance to NULLify the pointer - but before we return from the callback -, we assume that the code is protected from races via the CAS operation in blk_complete_request() that is called in scsi_done().

The following stacktrace shows an example for a crash resulting from the previous behavior:

Unable to handle kernel pointer dereference at virtual kernel address fffffee17a672000
Oops: 0038 [#1] SMP
CPU: 2 PID: 0 Comm: swapper/2 Not tainted
task: 00000003f7ff5be0 ti: 00000003f3d38000 task.ti: 00000003f3d38000
Krnl PSW : 0404d00180000000 00000000001156b0 (smp_vcpu_scheduled+0x18/0x40)
           R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 EA:3
Krnl GPRS: 000000200000007e 0000000000000000 fffffee17a671fd8 0000000300000015
           ffffffff80000000 00000000005dfde8 07000003f7f80e00 000000004fa4e800
           000000036ce8d8f8 000000036ce8d9c0 00000003ece8fe00 ffffffff969c9e93
           00000003fffffffd 000000036ce8da10 00000000003bf134 00000003f3b07918
Krnl Code: 00000000001156a2: a7190000        lghi    %r1,0
           00000000001156a6: a7380015        lhi    %r3,21
          #00000000001156aa: e32050000008    ag    %r2,0(%r5)
          >00000000001156b0: 482022b0        lh    %r2,688(%r2)
           00000000001156b4: ae123000        sigp    %r1,%r2,0(%r3)
           00000000001156b8: b2220020        ipm    %r2
           00000000001156bc: 8820001c        srl    %r2,28
           00000000001156c0: c02700000001    xilf    %r2,1
Call Trace:
([<0000000000000000>] 0x0)
 [<000003ff807bdb8e>] zfcp_fsf_fcp_cmnd_handler+0x3de/0x490 [zfcp]
 [<000003ff807be30a>] zfcp_fsf_req_complete+0x252/0x800 [zfcp]
 [<000003ff807c0a48>] zfcp_fsf_reqid_check+0xe8/0x190 [zfcp]
 [<000003ff807c194e>] zfcp_qdio_int_resp+0x66/0x188 [zfcp]
 [<000003ff80440c64>] qdio_kick_handler+0xdc/0x310 [qdio]
 [<000003ff804463d0>] __tiqdio_inbound_processing+0xf8/0xcd8 [qdio]
 [<0000000000141fd4>] tasklet_action+0x9c/0x170
 [<0000000000141550>] __do_softirq+0xe8/0x258
 [<000000000010ce0a>] do_softirq+0xba/0xc0
 [<000000000014187c>] irq_exit+0xc4/0xe8
 [<000000000046b526>] do_IRQ+0x146/0x1d8
 [<00000000005d6a3c>] io_return+0x0/0x8
 [<00000000005d6422>] vtime_stop_cpu+0x4a/0xa0
([<0000000000000000>] 0x0)
 [<0000000000103d8a>] arch_cpu_idle+0xa2/0xb0
 [<0000000000197f94>] cpu_startup_entry+0x13c/0x1f8
 [<0000000000114782>] smp_start_secondary+0xda/0xe8
 [<00000000005d6efe>] restart_int_handler+0x56/0x6c
 [<0000000000000000>] 0x0

Last Breaking-Event-Address:
[<00000000003bf12e>] arch_spin_lock_wait+0x56/0xb0

---
 drivers/s390/scsi/zfcp_dbf.h     |   11 +++++++
 drivers/s390/scsi/zfcp_reqlist.h |   30 +++++++++++++++++++-
 drivers/s390/scsi/zfcp_scsi.c    |   57 +++++++++++++++++++++++++++++++++++++--
 3 files changed, 95 insertions(+), 3 deletions(-)

@@ -388,4 +388,15 @@ void zfcp_dbf_scsi_devreset(char *tag, s
 	_zfcp_dbf_scsi(tmp_tag, 1, scmnd, NULL);
 }
 
+/**
+ * zfcp_dbf_scsi_nullcmnd() - trace NULLify of SCSI command in dev/tgt-reset.
+ * @scmnd: SCSI command that was NULLified.
+ * @fsf_req: request that owned @scmnd.
+ */
+static inline void zfcp_dbf_scsi_nullcmnd(struct scsi_cmnd *scmnd,
+					  struct zfcp_fsf_req *fsf_req)
+{
+	_zfcp_dbf_scsi("scfc__1", 3, scmnd, fsf_req);
+}
+
 #endif /* ZFCP_DBF_H */