--- /dev/null
+From 56de1377ad92f72ee4e5cb0faf7a9b6048fdf0bf Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@ingics.com>
+Date: Wed, 30 Jul 2014 11:13:52 +0800
+Subject: hwmon: (ads1015) Fix off-by-one for valid channel index checking
+
+From: Axel Lin <axel.lin@ingics.com>
+
+commit 56de1377ad92f72ee4e5cb0faf7a9b6048fdf0bf upstream.
+
+Current code uses channel as array index, so the valid channel value is
+0 .. ADS1015_CHANNELS - 1.
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/ads1015.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/ads1015.c
++++ b/drivers/hwmon/ads1015.c
+@@ -198,7 +198,7 @@ static int ads1015_get_channels_config_o
+ }
+
+ channel = be32_to_cpup(property);
+- if (channel > ADS1015_CHANNELS) {
++ if (channel >= ADS1015_CHANNELS) {
+ dev_err(&client->dev,
+ "invalid channel index %d on %s\n",
+ channel, node->full_name);
--- /dev/null
+From e981429557cbe10c780fab1c1a237cb832757652 Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@ingics.com>
+Date: Tue, 5 Aug 2014 09:59:49 +0800
+Subject: hwmon: (ads1015) Fix out-of-bounds array access
+
+From: Axel Lin <axel.lin@ingics.com>
+
+commit e981429557cbe10c780fab1c1a237cb832757652 upstream.
+
+Current code uses data_rate as array index in ads1015_read_adc() and uses pga
+as array index in ads1015_reg_to_mv, so we must make sure both data_rate and
+pga settings are in valid value range.
+Return -EINVAL if the setting is out-of-range.
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/ads1015.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/hwmon/ads1015.c
++++ b/drivers/hwmon/ads1015.c
+@@ -212,6 +212,7 @@ static int ads1015_get_channels_config_o
+ dev_err(&client->dev,
+ "invalid gain on %s\n",
+ node->full_name);
++ return -EINVAL;
+ }
+ }
+
+@@ -222,6 +223,7 @@ static int ads1015_get_channels_config_o
+ dev_err(&client->dev,
+ "invalid data_rate on %s\n",
+ node->full_name);
++ return -EINVAL;
+ }
+ }
+
--- /dev/null
+From cf44819c98db11163f58f08b822d626c7a8f5188 Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@ingics.com>
+Date: Thu, 31 Jul 2014 09:43:19 +0800
+Subject: hwmon: (amc6821) Fix possible race condition bug
+
+From: Axel Lin <axel.lin@ingics.com>
+
+commit cf44819c98db11163f58f08b822d626c7a8f5188 upstream.
+
+Ensure mutex lock protects the read-modify-write period to prevent possible
+race condition bug.
+In additional, update data->valid should also be protected by the mutex lock.
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/amc6821.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/hwmon/amc6821.c
++++ b/drivers/hwmon/amc6821.c
+@@ -360,11 +360,13 @@ static ssize_t set_pwm1_enable(
+ if (config)
+ return config;
+
++ mutex_lock(&data->update_lock);
+ config = i2c_smbus_read_byte_data(client, AMC6821_REG_CONF1);
+ if (config < 0) {
+ dev_err(&client->dev,
+ "Error reading configuration register, aborting.\n");
+- return config;
++ count = config;
++ goto unlock;
+ }
+
+ switch (val) {
+@@ -381,14 +383,15 @@ static ssize_t set_pwm1_enable(
+ config |= AMC6821_CONF1_FDRC1;
+ break;
+ default:
+- return -EINVAL;
++ count = -EINVAL;
++ goto unlock;
+ }
+- mutex_lock(&data->update_lock);
+ if (i2c_smbus_write_byte_data(client, AMC6821_REG_CONF1, config)) {
+ dev_err(&client->dev,
+ "Configuration register write error, aborting.\n");
+ count = -EIO;
+ }
++unlock:
+ mutex_unlock(&data->update_lock);
+ return count;
+ }
+@@ -493,8 +496,9 @@ static ssize_t set_temp_auto_point_temp(
+ return -EINVAL;
+ }
+
+- data->valid = 0;
+ mutex_lock(&data->update_lock);
++ data->valid = 0;
++
+ switch (ix) {
+ case 0:
+ ptemp[0] = clamp_val(val / 1000, 0,
+@@ -658,13 +662,14 @@ static ssize_t set_fan1_div(
+ if (config)
+ return config;
+
++ mutex_lock(&data->update_lock);
+ config = i2c_smbus_read_byte_data(client, AMC6821_REG_CONF4);
+ if (config < 0) {
+ dev_err(&client->dev,
+ "Error reading configuration register, aborting.\n");
+- return config;
++ count = config;
++ goto EXIT;
+ }
+- mutex_lock(&data->update_lock);
+ switch (val) {
+ case 2:
+ config &= ~AMC6821_CONF4_PSPR;
--- /dev/null
+From d58e47d787c09fe5c61af3c6ce7d784762f29c3d Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@ingics.com>
+Date: Wed, 6 Aug 2014 08:02:44 +0800
+Subject: hwmon: (dme1737) Prevent overflow problem when writing large limits
+
+From: Axel Lin <axel.lin@ingics.com>
+
+commit d58e47d787c09fe5c61af3c6ce7d784762f29c3d upstream.
+
+On platforms with sizeof(int) < sizeof(long), writing a temperature
+limit larger than MAXINT will result in unpredictable limit values
+written to the chip. Avoid auto-conversion from long to int to fix
+the problem.
+
+Voltage limits, fan minimum speed, pwm frequency, pwm ramp rate, and
+other attributes have the same problem, fix them as well.
+
+Zone temperature limits are signed, but were cached as u8, causing
+unepected values to be reported for negative temperatures. Cache as
+s8 to fix the problem.
+
+vrm is an u8, so the written value needs to be limited to [0, 255].
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+[Guenter Roeck: Fix zone temperature cache]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/dme1737.c | 33 ++++++++++++++++++---------------
+ 1 file changed, 18 insertions(+), 15 deletions(-)
+
+--- a/drivers/hwmon/dme1737.c
++++ b/drivers/hwmon/dme1737.c
+@@ -247,8 +247,8 @@ struct dme1737_data {
+ u8 pwm_acz[3];
+ u8 pwm_freq[6];
+ u8 pwm_rr[2];
+- u8 zone_low[3];
+- u8 zone_abs[3];
++ s8 zone_low[3];
++ s8 zone_abs[3];
+ u8 zone_hyst[2];
+ u32 alarms;
+ };
+@@ -277,7 +277,7 @@ static inline int IN_FROM_REG(int reg, i
+ return (reg * nominal + (3 << (res - 3))) / (3 << (res - 2));
+ }
+
+-static inline int IN_TO_REG(int val, int nominal)
++static inline int IN_TO_REG(long val, int nominal)
+ {
+ return clamp_val((val * 192 + nominal / 2) / nominal, 0, 255);
+ }
+@@ -293,7 +293,7 @@ static inline int TEMP_FROM_REG(int reg,
+ return (reg * 1000) >> (res - 8);
+ }
+
+-static inline int TEMP_TO_REG(int val)
++static inline int TEMP_TO_REG(long val)
+ {
+ return clamp_val((val < 0 ? val - 500 : val + 500) / 1000, -128, 127);
+ }
+@@ -308,7 +308,7 @@ static inline int TEMP_RANGE_FROM_REG(in
+ return TEMP_RANGE[(reg >> 4) & 0x0f];
+ }
+
+-static int TEMP_RANGE_TO_REG(int val, int reg)
++static int TEMP_RANGE_TO_REG(long val, int reg)
+ {
+ int i;
+
+@@ -331,7 +331,7 @@ static inline int TEMP_HYST_FROM_REG(int
+ return (((ix == 1) ? reg : reg >> 4) & 0x0f) * 1000;
+ }
+
+-static inline int TEMP_HYST_TO_REG(int val, int ix, int reg)
++static inline int TEMP_HYST_TO_REG(long val, int ix, int reg)
+ {
+ int hyst = clamp_val((val + 500) / 1000, 0, 15);
+
+@@ -347,7 +347,7 @@ static inline int FAN_FROM_REG(int reg,
+ return (reg == 0 || reg == 0xffff) ? 0 : 90000 * 60 / reg;
+ }
+
+-static inline int FAN_TO_REG(int val, int tpc)
++static inline int FAN_TO_REG(long val, int tpc)
+ {
+ if (tpc) {
+ return clamp_val(val / tpc, 0, 0xffff);
+@@ -379,7 +379,7 @@ static inline int FAN_TYPE_FROM_REG(int
+ return (edge > 0) ? 1 << (edge - 1) : 0;
+ }
+
+-static inline int FAN_TYPE_TO_REG(int val, int reg)
++static inline int FAN_TYPE_TO_REG(long val, int reg)
+ {
+ int edge = (val == 4) ? 3 : val;
+
+@@ -402,7 +402,7 @@ static int FAN_MAX_FROM_REG(int reg)
+ return 1000 + i * 500;
+ }
+
+-static int FAN_MAX_TO_REG(int val)
++static int FAN_MAX_TO_REG(long val)
+ {
+ int i;
+
+@@ -460,7 +460,7 @@ static inline int PWM_ACZ_FROM_REG(int r
+ return acz[(reg >> 5) & 0x07];
+ }
+
+-static inline int PWM_ACZ_TO_REG(int val, int reg)
++static inline int PWM_ACZ_TO_REG(long val, int reg)
+ {
+ int acz = (val == 4) ? 2 : val - 1;
+
+@@ -476,7 +476,7 @@ static inline int PWM_FREQ_FROM_REG(int
+ return PWM_FREQ[reg & 0x0f];
+ }
+
+-static int PWM_FREQ_TO_REG(int val, int reg)
++static int PWM_FREQ_TO_REG(long val, int reg)
+ {
+ int i;
+
+@@ -510,7 +510,7 @@ static inline int PWM_RR_FROM_REG(int re
+ return (rr & 0x08) ? PWM_RR[rr & 0x07] : 0;
+ }
+
+-static int PWM_RR_TO_REG(int val, int ix, int reg)
++static int PWM_RR_TO_REG(long val, int ix, int reg)
+ {
+ int i;
+
+@@ -528,7 +528,7 @@ static inline int PWM_RR_EN_FROM_REG(int
+ return PWM_RR_FROM_REG(reg, ix) ? 1 : 0;
+ }
+
+-static inline int PWM_RR_EN_TO_REG(int val, int ix, int reg)
++static inline int PWM_RR_EN_TO_REG(long val, int ix, int reg)
+ {
+ int en = (ix == 1) ? 0x80 : 0x08;
+
+@@ -1481,13 +1481,16 @@ static ssize_t set_vrm(struct device *de
+ const char *buf, size_t count)
+ {
+ struct dme1737_data *data = dev_get_drvdata(dev);
+- long val;
++ unsigned long val;
+ int err;
+
+- err = kstrtol(buf, 10, &val);
++ err = kstrtoul(buf, 10, &val);
+ if (err)
+ return err;
+
++ if (val > 255)
++ return -EINVAL;
++
+ data->vrm = val;
+ return count;
+ }
--- /dev/null
+From 2565fb05d1e9fc0831f7b1c083bcfcb1cba1f020 Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@ingics.com>
+Date: Sat, 2 Aug 2014 13:36:38 +0800
+Subject: hwmon: (gpio-fan) Prevent overflow problem when writing large limits
+
+From: Axel Lin <axel.lin@ingics.com>
+
+commit 2565fb05d1e9fc0831f7b1c083bcfcb1cba1f020 upstream.
+
+On platforms with sizeof(int) < sizeof(unsigned long), writing a rpm value
+larger than MAXINT will result in unpredictable limit values written to the
+chip. Avoid auto-conversion from unsigned long to int to fix the problem.
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/gpio-fan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/gpio-fan.c
++++ b/drivers/hwmon/gpio-fan.c
+@@ -173,7 +173,7 @@ static int get_fan_speed_index(struct gp
+ return -ENODEV;
+ }
+
+-static int rpm_to_speed_index(struct gpio_fan_data *fan_data, int rpm)
++static int rpm_to_speed_index(struct gpio_fan_data *fan_data, unsigned long rpm)
+ {
+ struct gpio_fan_speed *speed = fan_data->speed;
+ int i;
--- /dev/null
+From 1074d683a51f1aded3562add9ef313e75d557327 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Tue, 29 Jul 2014 20:48:59 -0700
+Subject: hwmon: (lm78) Fix overflow problems seen when writing large temperature limits
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 1074d683a51f1aded3562add9ef313e75d557327 upstream.
+
+On platforms with sizeof(int) < sizeof(long), writing a temperature
+limit larger than MAXINT will result in unpredictable limit values
+written to the chip. Avoid auto-conversion from long to int to fix
+the problem.
+
+Cc: Axel Lin <axel.lin@ingics.com>
+Reviewed-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/lm78.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/lm78.c
++++ b/drivers/hwmon/lm78.c
+@@ -108,7 +108,7 @@ static inline int FAN_FROM_REG(u8 val, i
+ * TEMP: mC (-128C to +127C)
+ * REG: 1C/bit, two's complement
+ */
+-static inline s8 TEMP_TO_REG(int val)
++static inline s8 TEMP_TO_REG(long val)
+ {
+ int nval = clamp_val(val, -128000, 127000) ;
+ return nval < 0 ? (nval - 500) / 1000 : (nval + 500) / 1000;
--- /dev/null
+From 3248c3b771ddd9d31695da17ba350eb6e1b80a53 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Tue, 29 Jul 2014 22:23:12 -0700
+Subject: hwmon: (lm85) Fix various errors on attribute writes
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 3248c3b771ddd9d31695da17ba350eb6e1b80a53 upstream.
+
+Temperature limit register writes did not account for negative numbers.
+As a result, writing -127000 resulted in -126000 written into the
+temperature limit register. This problem affected temp[1-3]_min,
+temp[1-3]_max, temp[1-3]_auto_temp_crit, and temp[1-3]_auto_temp_min.
+
+When writing pwm[1-3]_freq, a long variable was auto-converted into an int
+without range check. Wiring values larger than MAXINT resulted in unexpected
+register values.
+
+When writing temp[1-3]_auto_temp_max, an unsigned long variable was
+auto-converted into an int without range check. Writing values larger than
+MAXINT resulted in unexpected register values.
+
+vrm is an u8, so the written value needs to be limited to [0, 255].
+
+Cc: Axel Lin <axel.lin@ingics.com>
+Reviewed-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/lm85.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwmon/lm85.c
++++ b/drivers/hwmon/lm85.c
+@@ -158,7 +158,7 @@ static inline u16 FAN_TO_REG(unsigned lo
+
+ /* Temperature is reported in .001 degC increments */
+ #define TEMP_TO_REG(val) \
+- clamp_val(SCALE(val, 1000, 1), -127, 127)
++ DIV_ROUND_CLOSEST(clamp_val((val), -127000, 127000), 1000)
+ #define TEMPEXT_FROM_REG(val, ext) \
+ SCALE(((val) << 4) + (ext), 16, 1000)
+ #define TEMP_FROM_REG(val) ((val) * 1000)
+@@ -192,7 +192,7 @@ static const int lm85_range_map[] = {
+ 13300, 16000, 20000, 26600, 32000, 40000, 53300, 80000
+ };
+
+-static int RANGE_TO_REG(int range)
++static int RANGE_TO_REG(long range)
+ {
+ int i;
+
+@@ -214,7 +214,7 @@ static const int adm1027_freq_map[8] = {
+ 11, 15, 22, 29, 35, 44, 59, 88
+ };
+
+-static int FREQ_TO_REG(const int *map, int freq)
++static int FREQ_TO_REG(const int *map, unsigned long freq)
+ {
+ int i;
+
+@@ -463,6 +463,9 @@ static ssize_t store_vrm_reg(struct devi
+ if (err)
+ return err;
+
++ if (val > 255)
++ return -EINVAL;
++
+ data->vrm = val;
+ return count;
+ }
--- /dev/null
+From cc336546ddca8c22de83720632431c16a5f9fe9a Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@ingics.com>
+Date: Thu, 31 Jul 2014 22:27:04 +0800
+Subject: hwmon: (sis5595) Prevent overflow problem when writing large limits
+
+From: Axel Lin <axel.lin@ingics.com>
+
+commit cc336546ddca8c22de83720632431c16a5f9fe9a upstream.
+
+On platforms with sizeof(int) < sizeof(long), writing a temperature
+limit larger than MAXINT will result in unpredictable limit values
+written to the chip. Avoid auto-conversion from long to int to fix
+the problem.
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/sis5595.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/sis5595.c
++++ b/drivers/hwmon/sis5595.c
+@@ -159,7 +159,7 @@ static inline int TEMP_FROM_REG(s8 val)
+ {
+ return val * 830 + 52120;
+ }
+-static inline s8 TEMP_TO_REG(int val)
++static inline s8 TEMP_TO_REG(long val)
+ {
+ int nval = clamp_val(val, -54120, 157530) ;
+ return nval < 0 ? (nval - 5212 - 415) / 830 : (nval - 5212 + 415) / 830;
arm-8097-1-unistd.h-relocate-comments-back-to-place.patch
arm-omap3-fix-choice-of-omap3_restore_es-function-in-omap34xx-rev3.1.2-case.patch
drm-omapdrm-fix-compiler-errors.patch
+hwmon-sis5595-prevent-overflow-problem-when-writing-large-limits.patch
+hwmon-amc6821-fix-possible-race-condition-bug.patch
+hwmon-lm78-fix-overflow-problems-seen-when-writing-large-temperature-limits.patch
+hwmon-gpio-fan-prevent-overflow-problem-when-writing-large-limits.patch
+hwmon-ads1015-fix-off-by-one-for-valid-channel-index-checking.patch
+hwmon-lm85-fix-various-errors-on-attribute-writes.patch
+hwmon-ads1015-fix-out-of-bounds-array-access.patch
+hwmon-dme1737-prevent-overflow-problem-when-writing-large-limits.patch
+tpm-add-missing-tpm_do_selftest-to-st33-i2c-driver.patch
--- /dev/null
+From f07a5e9a331045e976a3d317ba43d14859d9407c Mon Sep 17 00:00:00 2001
+From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Date: Sat, 9 Nov 2013 11:17:00 -0700
+Subject: tpm: Add missing tpm_do_selftest to ST33 I2C driver
+
+From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+
+commit f07a5e9a331045e976a3d317ba43d14859d9407c upstream.
+
+Most device drivers do call 'tpm_do_selftest' which executes a
+TPM_ContinueSelfTest. tpm_i2c_stm_st33 is just pointlessly different,
+I think it is bug.
+
+These days we have the general assumption that the TPM is usable by
+the kernel immediately after the driver is finished, so we can no
+longer defer the mandatory self test to userspace.
+
+Reported-by: Richard Marciel <rmaciel@linux.vnet.ibm.com>
+Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/tpm/tpm_i2c_stm_st33.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/char/tpm/tpm_i2c_stm_st33.c
++++ b/drivers/char/tpm/tpm_i2c_stm_st33.c
+@@ -715,6 +715,7 @@ tpm_st33_i2c_probe(struct i2c_client *cl
+ }
+
+ tpm_get_timeouts(chip);
++ tpm_do_selftest(chip);
+
+ dev_info(chip->dev, "TPM I2C Initialized\n");
+ return 0;
projects / thirdparty / kernel / stable-queue.git / commitdiff
