--- /dev/null
+From 7ecd0bde5bfea524a843ad8fa8cb66ccbce68779 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <fabio.estevam@freescale.com>
+Date: Wed, 14 Jan 2015 11:11:03 -0200
+Subject: ARM: dts: imx25: Fix PWM "per" clocks
+
+From: Fabio Estevam <fabio.estevam@freescale.com>
+
+commit 7ecd0bde5bfea524a843ad8fa8cb66ccbce68779 upstream.
+
+Currently PWM functionality is broken on mx25 due to the wrong assignment of the
+PWM "per" clock.
+
+According to Documentation/devicetree/bindings/clock/imx25-clock.txt:
+ pwm_ipg_per 52
+
+,so update the pwm "per" to use 'pwm_ipg_per' instead of 'per10' clock.
+
+With this change PWM can work fine on mx25.
+
+Reported-by: Carlos Soto <csotoalonso@gmail.com>
+Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx25.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/boot/dts/imx25.dtsi
++++ b/arch/arm/boot/dts/imx25.dtsi
+@@ -335,7 +335,7 @@
+ compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
+ #pwm-cells = <2>;
+ reg = <0x53fa0000 0x4000>;
+- clocks = <&clks 106>, <&clks 36>;
++ clocks = <&clks 106>, <&clks 52>;
+ clock-names = "ipg", "per";
+ interrupts = <36>;
+ };
+@@ -354,7 +354,7 @@
+ compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
+ #pwm-cells = <2>;
+ reg = <0x53fa8000 0x4000>;
+- clocks = <&clks 107>, <&clks 36>;
++ clocks = <&clks 107>, <&clks 52>;
+ clock-names = "ipg", "per";
+ interrupts = <41>;
+ };
+@@ -394,7 +394,7 @@
+ pwm4: pwm@53fc8000 {
+ compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
+ reg = <0x53fc8000 0x4000>;
+- clocks = <&clks 108>, <&clks 36>;
++ clocks = <&clks 108>, <&clks 52>;
+ clock-names = "ipg", "per";
+ interrupts = <42>;
+ };
+@@ -439,7 +439,7 @@
+ compatible = "fsl,imx25-pwm", "fsl,imx27-pwm";
+ #pwm-cells = <2>;
+ reg = <0x53fe0000 0x4000>;
+- clocks = <&clks 105>, <&clks 36>;
++ clocks = <&clks 105>, <&clks 52>;
+ clock-names = "ipg", "per";
+ interrupts = <26>;
+ };
--- /dev/null
+From 38bdf45f4aa5cb6186d50a29e6cbbd9d486a1519 Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Sun, 18 Jan 2015 09:46:10 -0600
+Subject: bus: mvebu-mbus: fix support of MBus window 13
+
+From: Andrew Lunn <andrew@lunn.ch>
+
+commit 38bdf45f4aa5cb6186d50a29e6cbbd9d486a1519 upstream.
+
+On Armada XP, 375 and 38x the MBus window 13 has the remap capability,
+like windows 0 to 7. However, the mvebu-mbus driver isn't currently
+taking into account this special case, which means that when window 13
+is actually used, the remap registers are left to 0, making the device
+using this MBus window unavailable.
+
+As a minimal fix for stable, don't use window 13. A full fix will
+follow later.
+
+Fixes: fddddb52a6c ("bus: introduce an Marvell EBU MBus driver")
+Reviewed-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bus/mvebu-mbus.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/bus/mvebu-mbus.c
++++ b/drivers/bus/mvebu-mbus.c
+@@ -209,12 +209,25 @@ static void mvebu_mbus_disable_window(st
+ }
+
+ /* Checks whether the given window number is available */
++
++/* On Armada XP, 375 and 38x the MBus window 13 has the remap
++ * capability, like windows 0 to 7. However, the mvebu-mbus driver
++ * isn't currently taking into account this special case, which means
++ * that when window 13 is actually used, the remap registers are left
++ * to 0, making the device using this MBus window unavailable. The
++ * quick fix for stable is to not use window 13. A follow up patch
++ * will correctly handle this window.
++*/
+ static int mvebu_mbus_window_is_free(struct mvebu_mbus_state *mbus,
+ const int win)
+ {
+ void __iomem *addr = mbus->mbuswins_base +
+ mbus->soc->win_cfg_offset(win);
+ u32 ctrl = readl(addr + WIN_CTRL_OFF);
++
++ if (win == 13)
++ return false;
++
+ return !(ctrl & WIN_CTRL_ENABLE);
+ }
+
drm-i915-fix-mutex-owner-inspection-race-under-debug_mutexes.patch
ipr-wait-for-aborted-command-responses.patch
dm-cache-share-cache-metadata-object-across-inactive-and-active-dm-tables.patch
+time-settimeofday-validate-the-values-of-tv-from-user.patch
+time-adjtimex-validate-the-adj_frequency-values.patch
+arm-dts-imx25-fix-pwm-per-clocks.patch
+bus-mvebu-mbus-fix-support-of-mbus-window-13.patch
--- /dev/null
+From 5e5aeb4367b450a28f447f6d5ab57d8f2ab16a5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sasha.levin@oracle.com>
+Date: Wed, 3 Dec 2014 19:25:05 -0500
+Subject: time: adjtimex: Validate the ADJ_FREQUENCY values
+
+From: Sasha Levin <sasha.levin@oracle.com>
+
+commit 5e5aeb4367b450a28f447f6d5ab57d8f2ab16a5f upstream.
+
+Verify that the frequency value from userspace is valid and makes sense.
+
+Unverified values can cause overflows later on.
+
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
+[jstultz: Fix up bug for negative values and drop redunent cap check]
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/time/ntp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/kernel/time/ntp.c
++++ b/kernel/time/ntp.c
+@@ -631,6 +631,13 @@ int ntp_validate_timex(struct timex *txc
+ if ((txc->modes & ADJ_SETOFFSET) && (!capable(CAP_SYS_TIME)))
+ return -EPERM;
+
++ if (txc->modes & ADJ_FREQUENCY) {
++ if (LONG_MIN / PPM_SCALE > txc->freq)
++ return -EINVAL;
++ if (LONG_MAX / PPM_SCALE < txc->freq)
++ return -EINVAL;
++ }
++
+ return 0;
+ }
+
--- /dev/null
+From 6ada1fc0e1c4775de0e043e1bd3ae9d065491aa5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sasha.levin@oracle.com>
+Date: Wed, 3 Dec 2014 19:22:48 -0500
+Subject: time: settimeofday: Validate the values of tv from user
+
+From: Sasha Levin <sasha.levin@oracle.com>
+
+commit 6ada1fc0e1c4775de0e043e1bd3ae9d065491aa5 upstream.
+
+An unvalidated user input is multiplied by a constant, which can result in
+an undefined behaviour for large values. While this is validated later,
+we should avoid triggering undefined behaviour.
+
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
+[jstultz: include trivial milisecond->microsecond correction noticed
+by Andy]
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/time.h | 13 +++++++++++++
+ kernel/time.c | 4 ++++
+ 2 files changed, 17 insertions(+)
+
+--- a/include/linux/time.h
++++ b/include/linux/time.h
+@@ -173,6 +173,19 @@ extern void getboottime(struct timespec
+ extern void monotonic_to_bootbased(struct timespec *ts);
+ extern void get_monotonic_boottime(struct timespec *ts);
+
++static inline bool timeval_valid(const struct timeval *tv)
++{
++ /* Dates before 1970 are bogus */
++ if (tv->tv_sec < 0)
++ return false;
++
++ /* Can't have more microseconds then a second */
++ if (tv->tv_usec < 0 || tv->tv_usec >= USEC_PER_SEC)
++ return false;
++
++ return true;
++}
++
+ extern struct timespec timespec_trunc(struct timespec t, unsigned gran);
+ extern int timekeeping_valid_for_hres(void);
+ extern u64 timekeeping_max_deferment(void);
+--- a/kernel/time.c
++++ b/kernel/time.c
+@@ -195,6 +195,10 @@ SYSCALL_DEFINE2(settimeofday, struct tim
+ if (tv) {
+ if (copy_from_user(&user_tv, tv, sizeof(*tv)))
+ return -EFAULT;
++
++ if (!timeval_valid(&user_tv))
++ return -EINVAL;
++
+ new_ts.tv_sec = user_tv.tv_sec;
+ new_ts.tv_nsec = user_tv.tv_usec * NSEC_PER_USEC;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
