--- /dev/null
+From e8fd0adf105e132fd84545997bbef3d5edc2c9c1 Mon Sep 17 00:00:00 2001
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+Date: Tue, 13 Mar 2018 16:20:05 +0100
+Subject: ARM: dts: at91: at91sam9g25: fix mux-mask pinctrl property
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+commit e8fd0adf105e132fd84545997bbef3d5edc2c9c1 upstream.
+
+There are only 19 PIOB pins having primary names PB0-PB18. Not all of them
+have a 'C' function. So the pinctrl property mask ends up being the same as the
+other SoC of the at91sam9x5 series.
+
+Reported-by: Marek Sieranski <marek.sieranski@microchip.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Cc: <stable@vger.kernel.org> # v3.8+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/at91sam9g25.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/at91sam9g25.dtsi
++++ b/arch/arm/boot/dts/at91sam9g25.dtsi
+@@ -21,7 +21,7 @@
+ atmel,mux-mask = <
+ /* A B C */
+ 0xffffffff 0xffe0399f 0xc000001c /* pioA */
+- 0x0007ffff 0x8000fe3f 0x00000000 /* pioB */
++ 0x0007ffff 0x00047e3f 0x00000000 /* pioB */
+ 0x80000000 0x07c0ffff 0xb83fffff /* pioC */
+ 0x003fffff 0x003f8000 0x00000000 /* pioD */
+ >;
--- /dev/null
+From 9a06757dcc8509c162ac00488c8c82fc98e04227 Mon Sep 17 00:00:00 2001
+From: Santiago Esteban <Santiago.Esteban@microchip.com>
+Date: Thu, 18 Jan 2018 15:38:47 +0100
+Subject: ARM: dts: at91: sama5d4: fix pinctrl compatible string
+
+From: Santiago Esteban <Santiago.Esteban@microchip.com>
+
+commit 9a06757dcc8509c162ac00488c8c82fc98e04227 upstream.
+
+The compatible string is incorrect. Add atmel,sama5d3-pinctrl since
+it's the appropriate compatible string. Remove the
+atmel,at91rm9200-pinctrl compatible string, this fallback is
+useless, there are too many changes.
+
+Signed-off-by: Santiago Esteban <Santiago.Esteban@microchip.com>
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Cc: stable@vger.kernel.org #v3.18
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/sama5d4.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/sama5d4.dtsi
++++ b/arch/arm/boot/dts/sama5d4.dtsi
+@@ -1379,7 +1379,7 @@
+ pinctrl@fc06a000 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+- compatible = "atmel,at91sam9x5-pinctrl", "atmel,at91rm9200-pinctrl", "simple-bus";
++ compatible = "atmel,sama5d3-pinctrl", "atmel,at91sam9x5-pinctrl", "simple-bus";
+ ranges = <0xfc068000 0xfc068000 0x100
+ 0xfc06a000 0xfc06a000 0x4000>;
+ /* WARNING: revisit as pin spec has changed */
--- /dev/null
+From 6f4870753f29edf7dc39444246f9e39987b8b158 Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Fri, 2 Mar 2018 17:07:42 +0100
+Subject: ARM: dts: exynos: Fix IOMMU support for GScaler devices on Exynos5250
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+commit 6f4870753f29edf7dc39444246f9e39987b8b158 upstream.
+
+The proper name for the property, which assign given device to IOMMU is
+'iommus', not 'iommu'. Fix incorrect name and let all GScaler devices
+to be properly handled when IOMMU support is enabled.
+
+Reported-by: Andrzej Hajda <a.hajda@samsung.com>
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Fixes: 6cbfdd73a94f ("ARM: dts: add sysmmu nodes for exynos5250")
+Cc: <stable@vger.kernel.org> # v4.8+
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/exynos5250.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/boot/dts/exynos5250.dtsi
++++ b/arch/arm/boot/dts/exynos5250.dtsi
+@@ -655,7 +655,7 @@
+ power-domains = <&pd_gsc>;
+ clocks = <&clock CLK_GSCL0>;
+ clock-names = "gscl";
+- iommu = <&sysmmu_gsc0>;
++ iommus = <&sysmmu_gsc0>;
+ };
+
+ gsc_1: gsc@13e10000 {
+@@ -665,7 +665,7 @@
+ power-domains = <&pd_gsc>;
+ clocks = <&clock CLK_GSCL1>;
+ clock-names = "gscl";
+- iommu = <&sysmmu_gsc1>;
++ iommus = <&sysmmu_gsc1>;
+ };
+
+ gsc_2: gsc@13e20000 {
+@@ -675,7 +675,7 @@
+ power-domains = <&pd_gsc>;
+ clocks = <&clock CLK_GSCL2>;
+ clock-names = "gscl";
+- iommu = <&sysmmu_gsc2>;
++ iommus = <&sysmmu_gsc2>;
+ };
+
+ gsc_3: gsc@13e30000 {
+@@ -685,7 +685,7 @@
+ power-domains = <&pd_gsc>;
+ clocks = <&clock CLK_GSCL3>;
+ clock-names = "gscl";
+- iommu = <&sysmmu_gsc3>;
++ iommus = <&sysmmu_gsc3>;
+ };
+
+ hdmi: hdmi@14530000 {
--- /dev/null
+From 0629a01920c0f8a3f825361b24863d760610884a Mon Sep 17 00:00:00 2001
+From: Sean Wang <sean.wang@mediatek.com>
+Date: Fri, 23 Feb 2018 18:16:26 +0800
+Subject: arm: dts: mt7623: fix USB initialization fails on bananapi-r2
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+commit 0629a01920c0f8a3f825361b24863d760610884a upstream.
+
+Fix that USB initialization fails as below runtime log is present during
+booting on bananapi-r2 board by adding missing regulators the USB device
+requires. Current regulators USB device uses are being updated with the
+correct ones to reflect real configurations which are all from fixed
+regulators rather than MT6323 one's output.
+
+xhci-mtk 1a1c0000.usb: 1a1c0000.usb supply vbus not found, using dummy regulator
+xhci-mtk 1a240000.usb: 1a240000.usb supply vbus not found, using dummy regulator
+
+Cc: stable@vger.kernel.org
+Fixes: f4ff257cd160 ("arm: dts: mt7623: add support for Bananapi R2 (BPI-R2) board")
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+[mb: update kernel log in commit message]
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts | 24 ++++++++++++++++++++++--
+ 1 file changed, 22 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts
++++ b/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts
+@@ -39,6 +39,24 @@
+ };
+ };
+
++ reg_3p3v: regulator-3p3v {
++ compatible = "regulator-fixed";
++ regulator-name = "fixed-3.3V";
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
++ regulator-boot-on;
++ regulator-always-on;
++ };
++
++ reg_5v: regulator-5v {
++ compatible = "regulator-fixed";
++ regulator-name = "fixed-5V";
++ regulator-min-microvolt = <5000000>;
++ regulator-max-microvolt = <5000000>;
++ regulator-boot-on;
++ regulator-always-on;
++ };
++
+ gpio_keys {
+ compatible = "gpio-keys";
+ pinctrl-names = "default";
+@@ -468,12 +486,14 @@
+ };
+
+ &usb1 {
+- vusb33-supply = <&mt6323_vusb_reg>;
++ vusb33-supply = <®_3p3v>;
++ vbus-supply = <®_5v>;
+ status = "okay";
+ };
+
+ &usb2 {
+- vusb33-supply = <&mt6323_vusb_reg>;
++ vusb33-supply = <®_3p3v>;
++ vbus-supply = <®_5v>;
+ status = "okay";
+ };
+
--- /dev/null
+From a7480dbcf983c31d8111f864c848e8a75116a87d Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Wed, 21 Mar 2018 10:45:05 +0100
+Subject: ARM: EXYNOS: Fix coupled CPU idle freeze on Exynos4210
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+commit a7480dbcf983c31d8111f864c848e8a75116a87d upstream.
+
+Since commit 04c8b0f82c7d ("irqchip/gic: Make locking a BL_SWITCHER only
+feature") coupled CPU idle freezes from time to time on Exynos4210. Later
+commit 313c8c16ee62 ("PM / CPU: replace raw_notifier with atomic_notifier")
+changed the context in which the CPU idle code is executed, what results
+in fully reproducible freeze all the time. However, almost the same coupled
+CPU idle code works fine on Exynos3250 regardless of the changes made in
+the mentioned commits.
+
+It turned out that the IPI call used on Exynos4210 is conflicting with the
+change done in the first mentioned commit in GIC. Fix this by using the
+same code path as for Exynos3250, instead of the IPI call for
+synchronization with second CPU core, call dsb_sev() directly.
+
+Tested on Exynos4210-based Trats and Origen boards.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+CC: <stable@vger.kernel.org> # v4.13+
+Acked-by: Marc Zyngier <marc.zyngier@arm.com>
+Acked-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-exynos/pm.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/arch/arm/mach-exynos/pm.c
++++ b/arch/arm/mach-exynos/pm.c
+@@ -271,11 +271,7 @@ abort:
+ goto fail;
+
+ call_firmware_op(cpu_boot, 1);
+-
+- if (soc_is_exynos3250())
+- dsb_sev();
+- else
+- arch_send_wakeup_ipi_mask(cpumask_of(1));
++ dsb_sev();
+ }
+ }
+ fail:
--- /dev/null
+From c04ffa71ff491220cac28f55237c9aad379a8656 Mon Sep 17 00:00:00 2001
+From: Jerome Brunet <jbrunet@baylibre.com>
+Date: Fri, 2 Mar 2018 14:44:36 +0100
+Subject: ARM64: dts: meson: reduce odroid-c2 eMMC maximum rate
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+commit c04ffa71ff491220cac28f55237c9aad379a8656 upstream.
+
+Different modules maybe installed by the user on the eMMC connector
+of the odroid-c2. While the red modules are working without an issue,
+it seems some black modules (apparently Samsung based) are having
+issue at 200MHz
+
+While the tuning algorithm introduced in v4.14 enables high speed modes
+on every other tested designs, it seems a problem remains for this
+particular combination of board and eMMC module.
+
+Lowering the maximum frequency of the eMMC on this board until we can
+figure out a better solution.
+
+Fixes: d341ca88eead ("mmc: meson-gx: rework tuning function")
+Suggested-by: Ellie Reeves <ellierevves@gmail.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+@@ -310,7 +310,7 @@
+ pinctrl-names = "default", "clk-gate";
+
+ bus-width = <8>;
+- max-frequency = <200000000>;
++ max-frequency = <100000000>;
+ non-removable;
+ disable-wp;
+ cap-mmc-highspeed;
--- /dev/null
+From 7d8b44c54e0c7c8f688e3a07f17e6083f849f01f Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Fri, 23 Mar 2018 14:57:09 +0000
+Subject: KVM: arm/arm64: vgic-its: Fix potential overrun in vgic_copy_lpi_list
+
+From: Marc Zyngier <marc.zyngier@arm.com>
+
+commit 7d8b44c54e0c7c8f688e3a07f17e6083f849f01f upstream.
+
+vgic_copy_lpi_list() parses the LPI list and picks LPIs targeting
+a given vcpu. We allocate the array containing the intids before taking
+the lpi_list_lock, which means we can have an array size that is not
+equal to the number of LPIs.
+
+This is particularly obvious when looking at the path coming from
+vgic_enable_lpis, which is not a command, and thus can run in parallel
+with commands:
+
+vcpu 0: vcpu 1:
+vgic_enable_lpis
+ its_sync_lpi_pending_table
+ vgic_copy_lpi_list
+ intids = kmalloc_array(irq_count)
+ MAPI(lpi targeting vcpu 0)
+ list_for_each_entry(lpi_list_head)
+ intids[i++] = irq->intid;
+
+At that stage, we will happily overrun the intids array. Boo. An easy
+fix is is to break once the array is full. The MAPI command will update
+the config anyway, and we won't miss a thing. We also make sure that
+lpi_list_count is read exactly once, so that further updates of that
+value will not affect the array bound check.
+
+Cc: stable@vger.kernel.org
+Fixes: ccb1d791ab9e ("KVM: arm64: vgic-its: Fix pending table sync")
+Reviewed-by: Andre Przywara <andre.przywara@arm.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ virt/kvm/arm/vgic/vgic-its.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/virt/kvm/arm/vgic/vgic-its.c
++++ b/virt/kvm/arm/vgic/vgic-its.c
+@@ -316,21 +316,24 @@ static int vgic_copy_lpi_list(struct kvm
+ struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
+ struct vgic_irq *irq;
+ u32 *intids;
+- int irq_count = dist->lpi_list_count, i = 0;
++ int irq_count, i = 0;
+
+ /*
+- * We use the current value of the list length, which may change
+- * after the kmalloc. We don't care, because the guest shouldn't
+- * change anything while the command handling is still running,
+- * and in the worst case we would miss a new IRQ, which one wouldn't
+- * expect to be covered by this command anyway.
++ * There is an obvious race between allocating the array and LPIs
++ * being mapped/unmapped. If we ended up here as a result of a
++ * command, we're safe (locks are held, preventing another
++ * command). If coming from another path (such as enabling LPIs),
++ * we must be careful not to overrun the array.
+ */
++ irq_count = READ_ONCE(dist->lpi_list_count);
+ intids = kmalloc_array(irq_count, sizeof(intids[0]), GFP_KERNEL);
+ if (!intids)
+ return -ENOMEM;
+
+ spin_lock(&dist->lpi_list_lock);
+ list_for_each_entry(irq, &dist->lpi_list_head, lpi_list) {
++ if (i == irq_count)
++ break;
+ /* We don't need to "get" the IRQ, as we hold the list lock. */
+ if (irq->target_vcpu != vcpu)
+ continue;
--- /dev/null
+From 57e6b6f2303e596a6493078b53be14b789e7b79f Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Sun, 25 Feb 2018 06:55:32 -0500
+Subject: media: atomisp_fops.c: disable atomisp_compat_ioctl32
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+commit 57e6b6f2303e596a6493078b53be14b789e7b79f upstream.
+
+The atomisp_compat_ioctl32() code has problems. This patch disables the
+compat_ioctl32 support until those issues have been fixed.
+
+Contact Sakari or me for more details.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Cc: <stable@vger.kernel.org> # for v4.12 and up
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/atomisp/pci/atomisp2/atomisp_fops.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_fops.c
++++ b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_fops.c
+@@ -1279,7 +1279,10 @@ const struct v4l2_file_operations atomis
+ .mmap = atomisp_mmap,
+ .unlocked_ioctl = video_ioctl2,
+ #ifdef CONFIG_COMPAT
++ /*
++ * There are problems with this code. Disable this for now.
+ .compat_ioctl32 = atomisp_compat_ioctl32,
++ */
+ #endif
+ .poll = atomisp_poll,
+ };
+@@ -1291,7 +1294,10 @@ const struct v4l2_file_operations atomis
+ .mmap = atomisp_file_mmap,
+ .unlocked_ioctl = video_ioctl2,
+ #ifdef CONFIG_COMPAT
++ /*
++ * There are problems with this code. Disable this for now.
+ .compat_ioctl32 = atomisp_compat_ioctl32,
++ */
+ #endif
+ .poll = atomisp_poll,
+ };
--- /dev/null
+From 8d4068810d9926250dd2435719a080b889eb44c3 Mon Sep 17 00:00:00 2001
+From: Sean Young <sean@mess.org>
+Date: Tue, 6 Mar 2018 08:57:57 -0500
+Subject: media: rc: oops in ir_timer_keyup after device unplug
+
+From: Sean Young <sean@mess.org>
+
+commit 8d4068810d9926250dd2435719a080b889eb44c3 upstream.
+
+If there is IR in the raw kfifo when ir_raw_event_unregister() is called,
+then kthread_stop() causes ir_raw_event_thread to be scheduled, decode
+some scancodes and re-arm timer_keyup. The timer_keyup then fires when
+the rc device is long gone.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/rc/rc-main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/rc/rc-main.c
++++ b/drivers/media/rc/rc-main.c
+@@ -1929,12 +1929,12 @@ void rc_unregister_device(struct rc_dev
+ if (!dev)
+ return;
+
+- del_timer_sync(&dev->timer_keyup);
+- del_timer_sync(&dev->timer_repeat);
+-
+ if (dev->driver_type == RC_DRIVER_IR_RAW)
+ ir_raw_event_unregister(dev);
+
++ del_timer_sync(&dev->timer_keyup);
++ del_timer_sync(&dev->timer_repeat);
++
+ rc_free_rx_device(dev);
+
+ mutex_lock(&dev->lock);
--- /dev/null
+From 03703ed1debf777ea845aa9b50ba2e80a5e7dd3c Mon Sep 17 00:00:00 2001
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+Date: Fri, 2 Feb 2018 05:08:59 -0500
+Subject: media: vb2: core: Finish buffers at the end of the stream
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+commit 03703ed1debf777ea845aa9b50ba2e80a5e7dd3c upstream.
+
+If buffers were prepared or queued and the buffers were released without
+starting the queue, the finish mem op (corresponding to the prepare mem
+op) was never called to the buffers.
+
+Before commit a136f59c0a1f there was no need to do this as in such a case
+the prepare mem op had not been called yet. Address the problem by
+explicitly calling finish mem op when the queue is stopped if the buffer
+is in either prepared or queued state.
+
+Fixes: a136f59c0a1f ("[media] vb2: Move buffer cache synchronisation to prepare from queue")
+
+Cc: stable@vger.kernel.org # for v4.13 and up
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Tested-by: Devin Heitmueller <dheitmueller@kernellabs.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/common/videobuf2/videobuf2-core.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/media/common/videobuf2/videobuf2-core.c
++++ b/drivers/media/common/videobuf2/videobuf2-core.c
+@@ -1696,6 +1696,15 @@ static void __vb2_queue_cancel(struct vb
+ for (i = 0; i < q->num_buffers; ++i) {
+ struct vb2_buffer *vb = q->bufs[i];
+
++ if (vb->state == VB2_BUF_STATE_PREPARED ||
++ vb->state == VB2_BUF_STATE_QUEUED) {
++ unsigned int plane;
++
++ for (plane = 0; plane < vb->num_planes; ++plane)
++ call_void_memop(vb, finish,
++ vb->planes[plane].mem_priv);
++ }
++
+ if (vb->state != VB2_BUF_STATE_DEQUEUED) {
+ vb->state = VB2_BUF_STATE_PREPARED;
+ call_void_vb_qop(vb, buf_finish, vb);
--- /dev/null
+From ed356f110403f6acc64dcbbbfdc38662ab9b06c2 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Mon, 12 Feb 2018 06:45:32 -0500
+Subject: media: vivid: check if the cec_adapter is valid
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+commit ed356f110403f6acc64dcbbbfdc38662ab9b06c2 upstream.
+
+If CEC is not enabled for the vivid driver, then the adap pointer is NULL
+and 'adap->phys_addr' will fail.
+
+Cc: <stable@vger.kernel.org> # for v4.12 and up
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/vivid/vivid-vid-common.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/platform/vivid/vivid-vid-common.c
++++ b/drivers/media/platform/vivid/vivid-vid-common.c
+@@ -874,7 +874,8 @@ int vidioc_g_edid(struct file *file, voi
+ return -EINVAL;
+ if (edid->start_block + edid->blocks > dev->edid_blocks)
+ edid->blocks = dev->edid_blocks - edid->start_block;
+- cec_set_edid_phys_addr(dev->edid, dev->edid_blocks * 128, adap->phys_addr);
++ if (adap)
++ cec_set_edid_phys_addr(dev->edid, dev->edid_blocks * 128, adap->phys_addr);
+ memcpy(edid->edid, dev->edid + edid->start_block * 128, edid->blocks * 128);
+ return 0;
+ }
--- /dev/null
+From 639fa43d59e5a41ca8c55592cd5c1021fea2ab83 Mon Sep 17 00:00:00 2001
+From: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Date: Mon, 26 Mar 2018 09:29:17 -0400
+Subject: media: vsp1: Fix BRx conditional path in WPF
+
+From: Kieran Bingham <kieran.bingham@ideasonboard.com>
+
+commit 639fa43d59e5a41ca8c55592cd5c1021fea2ab83 upstream.
+
+When a BRx is provided by a pipeline, the WPF must determine the master
+layer. Currently the condition to check this identifies pipe->bru ||
+pipe->num_inputs > 1.
+
+The code then moves on to dereference pipe->bru, thus the check fails
+static analysers on the possibility that pipe->num_inputs could be
+greater than 1 without pipe->bru being set.
+
+The reality is that the pipeline must have a BRx to support more than
+one input, thus this could never cause a fault - however it also
+identifies that the num_inputs > 1 check is redundant.
+
+Remove the redundant check - and always configure the master layer
+appropriately when we have a BRx configured in our pipeline.
+
+Fixes: 6134148f6098 ("v4l: vsp1: Add support for the BRS entity")
+
+Cc: stable@vger.kernel.org
+Suggested-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/vsp1/vsp1_wpf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/vsp1/vsp1_wpf.c
++++ b/drivers/media/platform/vsp1/vsp1_wpf.c
+@@ -452,7 +452,7 @@ static void wpf_configure(struct vsp1_en
+ : VI6_WPF_SRCRPF_RPF_ACT_SUB(input->entity.index);
+ }
+
+- if (pipe->bru || pipe->num_inputs > 1)
++ if (pipe->bru)
+ srcrpf |= pipe->bru->type == VSP1_ENTITY_BRU
+ ? VI6_WPF_SRCRPF_VIRACT_MST
+ : VI6_WPF_SRCRPF_VIRACT2_MST;
usb-musb-gadget-misplaced-out-of-bounds-check.patch
phy-allwinner-sun4i-usb-poll-vbus-changes-on-a23-a33-when-driving-vbus.patch
usb-gadget-udc-core-update-usb_ep_queue-documentation.patch
+arm64-dts-meson-reduce-odroid-c2-emmc-maximum-rate.patch
+kvm-arm-arm64-vgic-its-fix-potential-overrun-in-vgic_copy_lpi_list.patch
+arm-exynos-fix-coupled-cpu-idle-freeze-on-exynos4210.patch
+arm-dts-mt7623-fix-usb-initialization-fails-on-bananapi-r2.patch
+arm-dts-at91-at91sam9g25-fix-mux-mask-pinctrl-property.patch
+arm-dts-exynos-fix-iommu-support-for-gscaler-devices-on-exynos5250.patch
+arm-dts-at91-sama5d4-fix-pinctrl-compatible-string.patch
+spi-atmel-init-fifos-before-spi-enable.patch
+spi-fix-scatterlist-elements-size-in-spi_map_buf.patch
+spi-fix-unregistration-of-controller-with-fixed-spi-bus-number.patch
+media-rc-oops-in-ir_timer_keyup-after-device-unplug.patch
+media-atomisp_fops.c-disable-atomisp_compat_ioctl32.patch
+media-vivid-check-if-the-cec_adapter-is-valid.patch
+media-vb2-core-finish-buffers-at-the-end-of-the-stream.patch
+media-vsp1-fix-brx-conditional-path-in-wpf.patch
--- /dev/null
+From 9581329eff9db72ab4fbb46a594fd7fdda3c51b0 Mon Sep 17 00:00:00 2001
+From: Eugen Hristev <eugen.hristev@microchip.com>
+Date: Tue, 27 Feb 2018 12:25:07 +0200
+Subject: spi: atmel: init FIFOs before spi enable
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+commit 9581329eff9db72ab4fbb46a594fd7fdda3c51b0 upstream.
+
+The datasheet recommends initializing FIFOs before
+SPI enable. If we do not do it like this, there may be
+a strange behavior. We noticed that DMA does not work properly
+with FIFOs if we do not clear them beforehand or enable them
+before SPIEN.
+
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-atmel.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/spi/spi-atmel.c
++++ b/drivers/spi/spi-atmel.c
+@@ -1512,6 +1512,11 @@ static void atmel_spi_init(struct atmel_
+ {
+ spi_writel(as, CR, SPI_BIT(SWRST));
+ spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */
++
++ /* It is recommended to enable FIFOs first thing after reset */
++ if (as->fifo_size)
++ spi_writel(as, CR, SPI_BIT(FIFOEN));
++
+ if (as->caps.has_wdrbt) {
+ spi_writel(as, MR, SPI_BIT(WDRBT) | SPI_BIT(MODFDIS)
+ | SPI_BIT(MSTR));
+@@ -1522,9 +1527,6 @@ static void atmel_spi_init(struct atmel_
+ if (as->use_pdc)
+ spi_writel(as, PTCR, SPI_BIT(RXTDIS) | SPI_BIT(TXTDIS));
+ spi_writel(as, CR, SPI_BIT(SPIEN));
+-
+- if (as->fifo_size)
+- spi_writel(as, CR, SPI_BIT(FIFOEN));
+ }
+
+ static int atmel_spi_probe(struct platform_device *pdev)
--- /dev/null
+From ce99319a182fe766be67f96338386f3ec73e321c Mon Sep 17 00:00:00 2001
+From: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Date: Fri, 2 Mar 2018 15:55:09 +0100
+Subject: spi: Fix scatterlist elements size in spi_map_buf
+
+From: Maxime Chevallier <maxime.chevallier@bootlin.com>
+
+commit ce99319a182fe766be67f96338386f3ec73e321c upstream.
+
+When SPI transfers can be offloaded using DMA, the SPI core need to
+build a scatterlist to make sure that the buffer to be transferred is
+dma-able.
+
+This patch fixes the scatterlist entry size computation in the case
+where the maximum acceptable scatterlist entry supported by the DMA
+controller is less than PAGE_SIZE, when the buffer is vmalloced.
+
+For each entry, the actual size is given by the minimum between the
+desc_len (which is the max buffer size supported by the DMA controller)
+and the remaining buffer length until we cross a page boundary.
+
+Fixes: 65598c13fd66 ("spi: Fix per-page mapping of unaligned vmalloc-ed buffer")
+Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -779,8 +779,14 @@ static int spi_map_buf(struct spi_contro
+ for (i = 0; i < sgs; i++) {
+
+ if (vmalloced_buf || kmap_buf) {
+- min = min_t(size_t,
+- len, desc_len - offset_in_page(buf));
++ /*
++ * Next scatterlist entry size is the minimum between
++ * the desc_len and the remaining buffer length that
++ * fits in a page.
++ */
++ min = min_t(size_t, desc_len,
++ min_t(size_t, len,
++ PAGE_SIZE - offset_in_page(buf)));
+ if (vmalloced_buf)
+ vm_page = vmalloc_to_page(buf);
+ else
--- /dev/null
+From 613bd1ea387bb48b7c9a71a0bb451ac15cfbbc01 Mon Sep 17 00:00:00 2001
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Date: Tue, 20 Mar 2018 10:27:50 +0200
+Subject: spi: Fix unregistration of controller with fixed SPI bus number
+
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+
+commit 613bd1ea387bb48b7c9a71a0bb451ac15cfbbc01 upstream.
+
+Commit 9b61e302210e (spi: Pick spi bus number from Linux idr or spi alias)
+ceased to unregister SPI buses with fixed bus numbers. Moreover this is
+visible only if CONFIG_SPI_DEBUG=y is set or when trying to re-register
+the same SPI controller.
+
+rmmod spi_pxa2xx_platform (with CONFIG_SPI_DEBUG=y):
+[ 26.788362] spi_master spi1: attempting to delete unregistered controller [spi1]
+
+modprobe spi_pxa2xx_platform:
+[ 37.883137] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:19.0/pxa2xx-spi.12/spi_master/spi1'
+[ 37.894984] CPU: 1 PID: 1467 Comm: modprobe Not tainted 4.16.0-rc4+ #21
+[ 37.902384] Call Trace:
+...
+[ 38.122680] kobject_add_internal failed for spi1 with -EEXIST, don't try to register things with the same name in the same directory.
+[ 38.136154] WARNING: CPU: 1 PID: 1467 at lib/kobject.c:238 kobject_add_internal+0x2a5/0x2f0
+...
+[ 38.513817] pxa2xx-spi pxa2xx-spi.12: problem registering spi master
+[ 38.521036] pxa2xx-spi: probe of pxa2xx-spi.12 failed with error -17
+
+Fix this by not returning immediately from spi_unregister_controller() if
+idr_find() doesn't find controller with given ID/bus number. It finds
+only those controllers that were registered with dynamic SPI bus
+numbers. Only conditional cleanup between dynamic and fixed bus numbers
+is to remove allocated IDR.
+
+Fixes: 9b61e302210e (spi: Pick spi bus number from Linux idr or spi alias)
+Cc: stable@vger.kernel.org
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2260,12 +2260,6 @@ void spi_unregister_controller(struct sp
+ mutex_lock(&board_lock);
+ found = idr_find(&spi_master_idr, id);
+ mutex_unlock(&board_lock);
+- if (found != ctlr) {
+- dev_dbg(&ctlr->dev,
+- "attempting to delete unregistered controller [%s]\n",
+- dev_name(&ctlr->dev));
+- return;
+- }
+ if (ctlr->queued) {
+ if (spi_destroy_queue(ctlr))
+ dev_err(&ctlr->dev, "queue remove failed\n");
+@@ -2278,7 +2272,8 @@ void spi_unregister_controller(struct sp
+ device_unregister(&ctlr->dev);
+ /* free bus id */
+ mutex_lock(&board_lock);
+- idr_remove(&spi_master_idr, id);
++ if (found == ctlr)
++ idr_remove(&spi_master_idr, id);
+ mutex_unlock(&board_lock);
+ }
+ EXPORT_SYMBOL_GPL(spi_unregister_controller);
projects / thirdparty / kernel / stable-queue.git / commitdiff
