--- /dev/null
+From 1de67a3dee7a279ebe4d892b359fe3696938ec15 Mon Sep 17 00:00:00 2001
+From: Christian Eggers <ceggers@arri.de>
+Date: Fri, 9 Oct 2020 13:03:19 +0200
+Subject: i2c: imx: Check for I2SR_IAL after every byte
+
+From: Christian Eggers <ceggers@arri.de>
+
+commit 1de67a3dee7a279ebe4d892b359fe3696938ec15 upstream.
+
+Arbitration Lost (IAL) can happen after every single byte transfer. If
+arbitration is lost, the I2C hardware will autonomously switch from
+master mode to slave. If a transfer is not aborted in this state,
+consecutive transfers will not be executed by the hardware and will
+timeout.
+
+Signed-off-by: Christian Eggers <ceggers@arri.de>
+Tested (not extensively) on Vybrid VF500 (Toradex VF50):
+Tested-by: Krzysztof Kozlowski <krzk@kernel.org>
+Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-imx.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-imx.c
++++ b/drivers/i2c/busses/i2c-imx.c
+@@ -470,6 +470,16 @@ static int i2c_imx_trx_complete(struct i
+ dev_dbg(&i2c_imx->adapter.dev, "<%s> Timeout\n", __func__);
+ return -ETIMEDOUT;
+ }
++
++ /* check for arbitration lost */
++ if (i2c_imx->i2csr & I2SR_IAL) {
++ dev_dbg(&i2c_imx->adapter.dev, "<%s> Arbitration lost\n", __func__);
++ i2c_imx_clear_irq(i2c_imx, I2SR_IAL);
++
++ i2c_imx->i2csr = 0;
++ return -EAGAIN;
++ }
++
+ dev_dbg(&i2c_imx->adapter.dev, "<%s> TRX complete\n", __func__);
+ i2c_imx->i2csr = 0;
+ return 0;
--- /dev/null
+From 384a9565f70a876c2e78e58c5ca0bbf0547e4f6d Mon Sep 17 00:00:00 2001
+From: Christian Eggers <ceggers@arri.de>
+Date: Fri, 9 Oct 2020 13:03:18 +0200
+Subject: i2c: imx: Fix reset of I2SR_IAL flag
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian Eggers <ceggers@arri.de>
+
+commit 384a9565f70a876c2e78e58c5ca0bbf0547e4f6d upstream.
+
+According to the "VFxxx Controller Reference Manual" (and the comment
+block starting at line 97), Vybrid requires writing a one for clearing
+an interrupt flag. Syncing the method for clearing I2SR_IIF in
+i2c_imx_isr().
+
+Signed-off-by: Christian Eggers <ceggers@arri.de>
+Fixes: 4b775022f6fd ("i2c: imx: add struct to hold more configurable quirks")
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-imx.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-imx.c
++++ b/drivers/i2c/busses/i2c-imx.c
+@@ -414,6 +414,19 @@ static void i2c_imx_dma_free(struct imx_
+ dma->chan_using = NULL;
+ }
+
++static void i2c_imx_clear_irq(struct imx_i2c_struct *i2c_imx, unsigned int bits)
++{
++ unsigned int temp;
++
++ /*
++ * i2sr_clr_opcode is the value to clear all interrupts. Here we want to
++ * clear only <bits>, so we write ~i2sr_clr_opcode with just <bits>
++ * toggled. This is required because i.MX needs W0C and Vybrid uses W1C.
++ */
++ temp = ~i2c_imx->hwdata->i2sr_clr_opcode ^ bits;
++ imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2SR);
++}
++
+ static int i2c_imx_bus_busy(struct imx_i2c_struct *i2c_imx, int for_busy)
+ {
+ unsigned long orig_jiffies = jiffies;
+@@ -426,8 +439,7 @@ static int i2c_imx_bus_busy(struct imx_i
+
+ /* check for arbitration lost */
+ if (temp & I2SR_IAL) {
+- temp &= ~I2SR_IAL;
+- imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2SR);
++ i2c_imx_clear_irq(i2c_imx, I2SR_IAL);
+ return -EAGAIN;
+ }
+
+@@ -599,9 +611,7 @@ static irqreturn_t i2c_imx_isr(int irq,
+ if (temp & I2SR_IIF) {
+ /* save status register */
+ i2c_imx->i2csr = temp;
+- temp &= ~I2SR_IIF;
+- temp |= (i2c_imx->hwdata->i2sr_clr_opcode & I2SR_IIF);
+- imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2SR);
++ i2c_imx_clear_irq(i2c_imx, I2SR_IIF);
+ wake_up(&i2c_imx->queue);
+ return IRQ_HANDLED;
+ }
coredump-fix-core_pattern-parse-error.patch
mm-list_lru-set-shrinker-map-bit-when-child-nr_items-is-not-zero.patch
mm-swapfile-do-not-sleep-with-a-spin-lock-held.patch
+speakup-reject-setting-the-speakup-line-discipline-outside-of-speakup.patch
+i2c-imx-fix-reset-of-i2sr_ial-flag.patch
+i2c-imx-check-for-i2sr_ial-after-every-byte.patch
+spi-bcm2835-release-the-dma-channel-if-probe-fails-after-dma_init.patch
--- /dev/null
+From f0992098cadb4c9c6a00703b66cafe604e178fea Mon Sep 17 00:00:00 2001
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Date: Sun, 29 Nov 2020 20:35:23 +0100
+Subject: speakup: Reject setting the speakup line discipline outside of speakup
+
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+
+commit f0992098cadb4c9c6a00703b66cafe604e178fea upstream.
+
+Speakup exposing a line discipline allows userland to try to use it,
+while it is deemed to be useless, and thus uselessly exposes potential
+bugs. One of them is simply that in such a case if the line sends data,
+spk_ttyio_receive_buf2 is called and crashes since spk_ttyio_synth
+is NULL.
+
+This change restricts the use of the speakup line discipline to
+speakup drivers, thus avoiding such kind of issues altogether.
+
+Cc: stable@vger.kernel.org
+Reported-by: Shisong Qin <qinshisong1205@gmail.com>
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Tested-by: Shisong Qin <qinshisong1205@gmail.com>
+Link: https://lore.kernel.org/r/20201129193523.hm3f6n5xrn6fiyyc@function
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/staging/speakup/spk_ttyio.c | 37 ++++++++++++++++++++++--------------
+ 1 file changed, 23 insertions(+), 14 deletions(-)
+
+--- a/drivers/staging/speakup/spk_ttyio.c
++++ b/drivers/staging/speakup/spk_ttyio.c
+@@ -47,27 +47,20 @@ static int spk_ttyio_ldisc_open(struct t
+ {
+ struct spk_ldisc_data *ldisc_data;
+
++ if (tty != speakup_tty)
++ /* Somebody tried to use this line discipline outside speakup */
++ return -ENODEV;
++
+ if (!tty->ops->write)
+ return -EOPNOTSUPP;
+
+- mutex_lock(&speakup_tty_mutex);
+- if (speakup_tty) {
+- mutex_unlock(&speakup_tty_mutex);
+- return -EBUSY;
+- }
+- speakup_tty = tty;
+-
+ ldisc_data = kmalloc(sizeof(struct spk_ldisc_data), GFP_KERNEL);
+- if (!ldisc_data) {
+- speakup_tty = NULL;
+- mutex_unlock(&speakup_tty_mutex);
++ if (!ldisc_data)
+ return -ENOMEM;
+- }
+
+ init_completion(&ldisc_data->completion);
+ ldisc_data->buf_free = true;
+- speakup_tty->disc_data = ldisc_data;
+- mutex_unlock(&speakup_tty_mutex);
++ tty->disc_data = ldisc_data;
+
+ return 0;
+ }
+@@ -189,9 +182,25 @@ static int spk_ttyio_initialise_ldisc(st
+
+ tty_unlock(tty);
+
++ mutex_lock(&speakup_tty_mutex);
++ speakup_tty = tty;
+ ret = tty_set_ldisc(tty, N_SPEAKUP);
+ if (ret)
+- pr_err("speakup: Failed to set N_SPEAKUP on tty\n");
++ speakup_tty = NULL;
++ mutex_unlock(&speakup_tty_mutex);
++
++ if (!ret)
++ /* Success */
++ return 0;
++
++ pr_err("speakup: Failed to set N_SPEAKUP on tty\n");
++
++ tty_lock(tty);
++ if (tty->ops->close)
++ tty->ops->close(tty, NULL);
++ tty_unlock(tty);
++
++ tty_kclose(tty);
+
+ return ret;
+ }
--- /dev/null
+From foo@baz Wed Dec 9 12:02:52 PM CET 2020
+From: Lukas Wunner <lukas@wunner.de>
+Date: Sun, 6 Dec 2020 14:10:00 +0100
+Subject: spi: bcm2835: Release the DMA channel if probe fails after dma_init
+To: Greg Kroah-Hartman <gregkh@linuxfoundation.com>
+Cc: Mark Brown <broonie@kernel.org>, Sudip Mukherjee <sudipm.mukherjee@gmail.com>, stable@vger.kernel.org
+Message-ID: <298055a3252640ac67dbf1dbf1452678133fa515.1607260117.git.lukas@wunner.de>
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+[ Upstream commit 666224b43b4bd4612ce3b758c038f9bc5c5e3fcb ]
+
+The DMA channel was not released if either devm_request_irq() or
+devm_spi_register_controller() failed.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Link: https://lore.kernel.org/r/20191212135550.4634-3-peter.ujfalusi@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+[lukas: backport to 5.4-stable]
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-bcm2835.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -1310,21 +1310,22 @@ static int bcm2835_spi_probe(struct plat
+ dev_name(&pdev->dev), ctlr);
+ if (err) {
+ dev_err(&pdev->dev, "could not request IRQ: %d\n", err);
+- goto out_clk_disable;
++ goto out_dma_release;
+ }
+
+ err = spi_register_controller(ctlr);
+ if (err) {
+ dev_err(&pdev->dev, "could not register SPI controller: %d\n",
+ err);
+- goto out_clk_disable;
++ goto out_dma_release;
+ }
+
+ bcm2835_debugfs_create(bs, dev_name(&pdev->dev));
+
+ return 0;
+
+-out_clk_disable:
++out_dma_release:
++ bcm2835_dma_release(ctlr, bs);
+ clk_disable_unprepare(bs->clk);
+ return err;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
