--- /dev/null
+From cd5d38b052384daa2893e9a1d94900d5a20ed4b5 Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <vgupta@synopsys.com>
+Date: Fri, 30 Sep 2016 13:27:25 -0700
+Subject: ARCv2: fix local_save_flags
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+commit cd5d38b052384daa2893e9a1d94900d5a20ed4b5 upstream.
+
+Commit d9676fa152c83b ("ARCv2: Enable LOCKDEP"), changed
+local_save_flags() to not return raw STATUS32 but encoded in the form
+such that it could be fed directly to CLRI/SETI instructions.
+However the STATUS32.E[] was not captured correctly as it corresponds to
+bits [4:1] in the register and not [3:0]
+
+Fixes: d9676fa152c83b ("ARCv2: Enable LOCKDEP")
+Cc: Evgeny Voevodin <evgeny.voevodin@intel.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arc/include/asm/irqflags-arcv2.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arc/include/asm/irqflags-arcv2.h
++++ b/arch/arc/include/asm/irqflags-arcv2.h
+@@ -112,7 +112,7 @@ static inline long arch_local_save_flags
+ */
+ temp = (1 << 5) |
+ ((!!(temp & STATUS_IE_MASK)) << CLRI_STATUS_IE_BIT) |
+- (temp & CLRI_STATUS_E_MASK);
++ ((temp >> 1) & CLRI_STATUS_E_MASK);
+ return temp;
+ }
+
--- /dev/null
+From bc0c7ece6191d89f435e4e4016f74167430c6c21 Mon Sep 17 00:00:00 2001
+From: Yuriy Kolerov <yuriy.kolerov@synopsys.com>
+Date: Mon, 12 Sep 2016 18:55:03 +0300
+Subject: ARCv2: intc: Use kflag if STATUS32.IE must be reset
+
+From: Yuriy Kolerov <yuriy.kolerov@synopsys.com>
+
+commit bc0c7ece6191d89f435e4e4016f74167430c6c21 upstream.
+
+In the end of "arc_init_IRQ" STATUS32.IE flag is going to be affected by
+"flag" instruction but "flag" never touches IE flag on ARCv2. So "kflag"
+instruction must be used instead of "flag".
+
+Signed-off-by: Yuriy Kolerov <yuriy.kolerov@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arc/kernel/intc-arcv2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arc/kernel/intc-arcv2.c
++++ b/arch/arc/kernel/intc-arcv2.c
+@@ -74,7 +74,7 @@ void arc_init_IRQ(void)
+ tmp = read_aux_reg(0xa);
+ tmp |= STATUS_AD_MASK | (irq_prio << 1);
+ tmp &= ~STATUS_IE_MASK;
+- asm volatile("flag %0 \n"::"r"(tmp));
++ asm volatile("kflag %0 \n"::"r"(tmp));
+ }
+
+ static void arcv2_irq_mask(struct irq_data *data)
--- /dev/null
+From 51b275a6fe5601834b717351d6cbdb89bd1f308b Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Sat, 17 Sep 2016 21:43:03 +0200
+Subject: b43: fix debugfs crash
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit 51b275a6fe5601834b717351d6cbdb89bd1f308b upstream.
+
+This patch fixes a crash that happens because b43's
+debugfs code expects file->f_op to be a pointer to
+its own b43_debugfs_fops struct. This is no longer
+the case since commit 9fd4dcece43a
+("debugfs: prevent access to possibly dead file_operations at file open")
+
+Reviewed-by: Nicolai Stange <nicstange@gmail.com>
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/broadcom/b43/debugfs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/b43/debugfs.c
++++ b/drivers/net/wireless/broadcom/b43/debugfs.c
+@@ -524,7 +524,8 @@ static ssize_t b43_debugfs_read(struct f
+ goto out_unlock;
+ }
+
+- dfops = container_of(file->f_op, struct b43_debugfs_fops, fops);
++ dfops = container_of(debugfs_real_fops(file),
++ struct b43_debugfs_fops, fops);
+ if (!dfops->read) {
+ err = -ENOSYS;
+ goto out_unlock;
+@@ -585,7 +586,8 @@ static ssize_t b43_debugfs_write(struct
+ goto out_unlock;
+ }
+
+- dfops = container_of(file->f_op, struct b43_debugfs_fops, fops);
++ dfops = container_of(debugfs_real_fops(file),
++ struct b43_debugfs_fops, fops);
+ if (!dfops->write) {
+ err = -ENOSYS;
+ goto out_unlock;
--- /dev/null
+From 9c4a45b17e094a090e96beb1138e34c2a10c6b8c Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Sat, 17 Sep 2016 21:43:04 +0200
+Subject: b43legacy: fix debugfs crash
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit 9c4a45b17e094a090e96beb1138e34c2a10c6b8c upstream.
+
+This patch fixes a crash that happens because b43legacy's
+debugfs code expects file->f_op to be a pointer to its own
+b43legacy_debugfs_fops struct. This is no longer the case
+since commit 9fd4dcece43a
+("debugfs: prevent access to possibly dead file_operations at file open")
+
+Reviewed-by: Nicolai Stange <nicstange@gmail.com>
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/broadcom/b43legacy/debugfs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/b43legacy/debugfs.c
++++ b/drivers/net/wireless/broadcom/b43legacy/debugfs.c
+@@ -221,7 +221,8 @@ static ssize_t b43legacy_debugfs_read(st
+ goto out_unlock;
+ }
+
+- dfops = container_of(file->f_op, struct b43legacy_debugfs_fops, fops);
++ dfops = container_of(debugfs_real_fops(file),
++ struct b43legacy_debugfs_fops, fops);
+ if (!dfops->read) {
+ err = -ENOSYS;
+ goto out_unlock;
+@@ -287,7 +288,8 @@ static ssize_t b43legacy_debugfs_write(s
+ goto out_unlock;
+ }
+
+- dfops = container_of(file->f_op, struct b43legacy_debugfs_fops, fops);
++ dfops = container_of(debugfs_real_fops(file),
++ struct b43legacy_debugfs_fops, fops);
+ if (!dfops->write) {
+ err = -ENOSYS;
+ goto out_unlock;
--- /dev/null
+From 6ee6d1cb391ca85b419f8d18bdfb1f020a5e859c Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Wed, 21 Sep 2016 18:49:36 +0200
+Subject: carl9170: fix debugfs crashes
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit 6ee6d1cb391ca85b419f8d18bdfb1f020a5e859c upstream.
+
+Ben Greear reported:
+> I see lots of instability as soon as I load up the carl9710 NIC.
+> My application is going to be poking at it's debugfs files...
+>
+> BUG: KASAN: slab-out-of-bounds in carl9170_debugfs_read+0xd5/0x2a0
+> [carl9170] at addr 0xffff8801bc1208b0
+> Read of size 8 by task btserver/5888
+> =======================================================================
+> BUG kmalloc-256 (Tainted: G W ): kasan: bad access detected
+> -----------------------------------------------------------------------
+>
+> INFO: Allocated in seq_open+0x50/0x100 age=2690 cpu=2 pid=772
+>...
+
+This breakage was caused by the introduction of intermediate
+fops in debugfs by commit 9fd4dcece43a
+("debugfs: prevent access to possibly dead file_operations at file open")
+
+Thankfully, the original/real fops are still available in d_fsdata.
+
+Reported-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/carl9170/debug.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/carl9170/debug.c
++++ b/drivers/net/wireless/ath/carl9170/debug.c
+@@ -75,7 +75,8 @@ static ssize_t carl9170_debugfs_read(str
+
+ if (!ar)
+ return -ENODEV;
+- dfops = container_of(file->f_op, struct carl9170_debugfs_fops, fops);
++ dfops = container_of(debugfs_real_fops(file),
++ struct carl9170_debugfs_fops, fops);
+
+ if (!dfops->read)
+ return -ENOSYS;
+@@ -127,7 +128,8 @@ static ssize_t carl9170_debugfs_write(st
+
+ if (!ar)
+ return -ENODEV;
+- dfops = container_of(file->f_op, struct carl9170_debugfs_fops, fops);
++ dfops = container_of(debugfs_real_fops(file),
++ struct carl9170_debugfs_fops, fops);
+
+ if (!dfops->write)
+ return -ENOSYS;
--- /dev/null
+From 86f0e06767dda7863d6d2a8f0b3b857e6ea876a0 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Sat, 17 Sep 2016 21:43:01 +0200
+Subject: debugfs: introduce a public file_operations accessor
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit 86f0e06767dda7863d6d2a8f0b3b857e6ea876a0 upstream.
+
+This patch introduces an accessor which can be used
+by the users of debugfs (drivers, fs, ...) to get the
+original file_operations struct. It also removes the
+REAL_FOPS_DEREF macro in file.c and converts the code
+to use the public version.
+
+Previously, REAL_FOPS_DEREF was only available within
+the file.c of debugfs. But having a public getter
+available for debugfs users is important as some
+drivers (carl9170 and b43) use the pointer of the
+original file_operations in conjunction with container_of()
+within their debugfs implementations.
+
+Reviewed-by: Nicolai Stange <nicstange@gmail.com>
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/debugfs/file.c | 13 +++++--------
+ include/linux/debugfs.h | 17 +++++++++++++++++
+ 2 files changed, 22 insertions(+), 8 deletions(-)
+
+--- a/fs/debugfs/file.c
++++ b/fs/debugfs/file.c
+@@ -97,9 +97,6 @@ EXPORT_SYMBOL_GPL(debugfs_use_file_finis
+
+ #define F_DENTRY(filp) ((filp)->f_path.dentry)
+
+-#define REAL_FOPS_DEREF(dentry) \
+- ((const struct file_operations *)(dentry)->d_fsdata)
+-
+ static int open_proxy_open(struct inode *inode, struct file *filp)
+ {
+ const struct dentry *dentry = F_DENTRY(filp);
+@@ -112,7 +109,7 @@ static int open_proxy_open(struct inode
+ goto out;
+ }
+
+- real_fops = REAL_FOPS_DEREF(dentry);
++ real_fops = debugfs_real_fops(filp);
+ real_fops = fops_get(real_fops);
+ if (!real_fops) {
+ /* Huh? Module did not clean up after itself at exit? */
+@@ -143,7 +140,7 @@ static ret_type full_proxy_ ## name(prot
+ { \
+ const struct dentry *dentry = F_DENTRY(filp); \
+ const struct file_operations *real_fops = \
+- REAL_FOPS_DEREF(dentry); \
++ debugfs_real_fops(filp); \
+ int srcu_idx; \
+ ret_type r; \
+ \
+@@ -176,7 +173,7 @@ static unsigned int full_proxy_poll(stru
+ struct poll_table_struct *wait)
+ {
+ const struct dentry *dentry = F_DENTRY(filp);
+- const struct file_operations *real_fops = REAL_FOPS_DEREF(dentry);
++ const struct file_operations *real_fops = debugfs_real_fops(filp);
+ int srcu_idx;
+ unsigned int r = 0;
+
+@@ -193,7 +190,7 @@ static unsigned int full_proxy_poll(stru
+ static int full_proxy_release(struct inode *inode, struct file *filp)
+ {
+ const struct dentry *dentry = F_DENTRY(filp);
+- const struct file_operations *real_fops = REAL_FOPS_DEREF(dentry);
++ const struct file_operations *real_fops = debugfs_real_fops(filp);
+ const struct file_operations *proxy_fops = filp->f_op;
+ int r = 0;
+
+@@ -241,7 +238,7 @@ static int full_proxy_open(struct inode
+ goto out;
+ }
+
+- real_fops = REAL_FOPS_DEREF(dentry);
++ real_fops = debugfs_real_fops(filp);
+ real_fops = fops_get(real_fops);
+ if (!real_fops) {
+ /* Huh? Module did not cleanup after itself at exit? */
+--- a/include/linux/debugfs.h
++++ b/include/linux/debugfs.h
+@@ -45,6 +45,23 @@ extern struct dentry *arch_debugfs_dir;
+
+ extern struct srcu_struct debugfs_srcu;
+
++/**
++ * debugfs_real_fops - getter for the real file operation
++ * @filp: a pointer to a struct file
++ *
++ * Must only be called under the protection established by
++ * debugfs_use_file_start().
++ */
++static inline const struct file_operations *debugfs_real_fops(struct file *filp)
++ __must_hold(&debugfs_srcu)
++{
++ /*
++ * Neither the pointer to the struct file_operations, nor its
++ * contents ever change -- srcu_dereference() is not needed here.
++ */
++ return filp->f_path.dentry->d_fsdata;
++}
++
+ #if defined(CONFIG_DEBUG_FS)
+
+ struct dentry *debugfs_create_file(const char *name, umode_t mode,
--- /dev/null
+From e16b46f190a22587898b331f9d58583b0b166c9a Mon Sep 17 00:00:00 2001
+From: Kefeng Wang <wangkefeng.wang@huawei.com>
+Date: Wed, 24 Aug 2016 16:33:33 +0800
+Subject: serial: 8250_dw: Check the data->pclk when get apb_pclk
+
+From: Kefeng Wang <wangkefeng.wang@huawei.com>
+
+commit e16b46f190a22587898b331f9d58583b0b166c9a upstream.
+
+It should check the data->pclk, not data->clk when get apb_pclk.
+
+Fixes: c8ed99d4f6a8("serial: 8250_dw: Add support for deferred probing")
+Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
+Tested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_dw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -462,7 +462,7 @@ static int dw8250_probe(struct platform_
+ }
+
+ data->pclk = devm_clk_get(&pdev->dev, "apb_pclk");
+- if (IS_ERR(data->clk) && PTR_ERR(data->clk) == -EPROBE_DEFER) {
++ if (IS_ERR(data->pclk) && PTR_ERR(data->pclk) == -EPROBE_DEFER) {
+ err = -EPROBE_DEFER;
+ goto err_clk;
+ }
--- /dev/null
+From b3965767d86cf4534dfe1affbde0453d3224ed7f Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Wed, 31 Aug 2016 19:46:55 +0300
+Subject: serial: 8250_port: fix runtime PM use in __do_stop_tx_rs485()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit b3965767d86cf4534dfe1affbde0453d3224ed7f upstream.
+
+There are calls to serial8250_rpm_{get|put}() in __do_stop_tx_rs485() that are
+certainly placed in a wrong location. I dunno how it had been tested with
+runtime PM enabled because it is obvious "sleep in atomic context" error.
+
+Besides that serial8250_rpm_get() is called immediately after an IO just
+happened. It implies that the device is already powered on, see implementation
+of serial8250_em485_rts_after_send() and serial8250_clear_fifos() for the
+details.
+
+There is no bug have been seen due to, as I can guess, use of auto suspend mode
+when scheduled transaction to suspend is invoked quite lately than it's needed
+for a few writes to the port. It might be possible to trigger a warning if
+stop_tx_timer fires when device is suspended.
+
+Refactor the code to use runtime PM only in case of timer function.
+
+Fixes: 0c66940d584d ("tty/serial/8250: fix RS485 half-duplex RX")
+Cc: "Matwey V. Kornilov" <matwey@sai.msu.ru>
+Tested-by: Yegor Yefremov <yegorslists@googlemail.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_port.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -1415,12 +1415,8 @@ static void __do_stop_tx_rs485(struct ua
+ if (!(p->port.rs485.flags & SER_RS485_RX_DURING_TX)) {
+ serial8250_clear_fifos(p);
+
+- serial8250_rpm_get(p);
+-
+ p->ier |= UART_IER_RLSI | UART_IER_RDI;
+ serial_port_out(&p->port, UART_IER, p->ier);
+-
+- serial8250_rpm_put(p);
+ }
+ }
+
+@@ -1430,6 +1426,7 @@ static void serial8250_em485_handle_stop
+ struct uart_8250_em485 *em485 = p->em485;
+ unsigned long flags;
+
++ serial8250_rpm_get(p);
+ spin_lock_irqsave(&p->port.lock, flags);
+ if (em485 &&
+ em485->active_timer == &em485->stop_tx_timer) {
+@@ -1437,6 +1434,7 @@ static void serial8250_em485_handle_stop
+ em485->active_timer = NULL;
+ }
+ spin_unlock_irqrestore(&p->port.lock, flags);
++ serial8250_rpm_put(p);
+ }
+
+ static void __stop_tx_rs485(struct uart_8250_port *p)
+@@ -1476,7 +1474,7 @@ static inline void __stop_tx(struct uart
+ unsigned char lsr = serial_in(p, UART_LSR);
+ /*
+ * To provide required timeing and allow FIFO transfer,
+- * __stop_tx_rs485 must be called only when both FIFO and
++ * __stop_tx_rs485() must be called only when both FIFO and
+ * shift register are empty. It is for device driver to enable
+ * interrupt on TEMT.
+ */
+@@ -1485,9 +1483,10 @@ static inline void __stop_tx(struct uart
+
+ del_timer(&em485->start_tx_timer);
+ em485->active_timer = NULL;
++
++ __stop_tx_rs485(p);
+ }
+ __do_stop_tx(p);
+- __stop_tx_rs485(p);
+ }
+
+ static void serial8250_stop_tx(struct uart_port *port)
--- /dev/null
+From 4b75f80003617fe35771a9e27022e8fbd6a41875 Mon Sep 17 00:00:00 2001
+From: Sascha Hauer <s.hauer@pengutronix.de>
+Date: Mon, 26 Sep 2016 15:55:31 +0200
+Subject: serial: imx: Fix DCD reading
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+commit 4b75f80003617fe35771a9e27022e8fbd6a41875 upstream.
+
+The USR2_DCDIN bit is tested for in register usr1. As the name
+suggests the usr2 register should be used instead. This fixes
+reading the Carrier detect status.
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Fixes: 90ebc4838666 ("serial: imx: repair and complete handshaking")
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/imx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -740,12 +740,13 @@ static unsigned int imx_get_hwmctrl(stru
+ {
+ unsigned int tmp = TIOCM_DSR;
+ unsigned usr1 = readl(sport->port.membase + USR1);
++ unsigned usr2 = readl(sport->port.membase + USR2);
+
+ if (usr1 & USR1_RTSS)
+ tmp |= TIOCM_CTS;
+
+ /* in DCE mode DCDIN is always 0 */
+- if (!(usr1 & USR2_DCDIN))
++ if (!(usr2 & USR2_DCDIN))
+ tmp |= TIOCM_CAR;
+
+ if (sport->dte_mode)
projects / thirdparty / kernel / stable-queue.git / commitdiff
