--- /dev/null
+From a34d0a0da1abae46a5f6ebd06fb0ec484ca099d9 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 2 Feb 2017 10:14:51 +0100
+Subject: ath9k_hw: check if the chip failed to wake up
+
+From: Felix Fietkau <nbd@nbd.name>
+
+commit a34d0a0da1abae46a5f6ebd06fb0ec484ca099d9 upstream.
+
+In an RFC patch, Sven Eckelmann and Simon Wunderlich reported:
+
+"QCA 802.11n chips (especially AR9330/AR9340) sometimes end up in a
+state in which a read of AR_CFG always returns 0xdeadbeef.
+This should not happen when when the power_mode of the device is
+ATH9K_PM_AWAKE."
+
+Include the check for the default register state in the existing MAC
+hang check.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Cc: Amit Pundir <amit.pundir@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/hw.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -1603,6 +1603,10 @@ bool ath9k_hw_check_alive(struct ath_hw
+ int count = 50;
+ u32 reg, last_val;
+
++ /* Check if chip failed to wake up */
++ if (REG_READ(ah, AR_CFG) == 0xdeadbeef)
++ return false;
++
+ if (AR_SREV_9300(ah))
+ return !ath9k_hw_detect_mac_hang(ah);
+
--- /dev/null
+From 74c82dae6c474933f2be401976e1530b5f623221 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Sat, 10 Dec 2016 22:56:21 -0800
+Subject: Input: drv260x - fix initializing overdrive voltage
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 74c82dae6c474933f2be401976e1530b5f623221 upstream.
+
+We were accidentally initializing haptics->rated_voltage twice, and did not
+initialize overdrive voltage.
+
+Acked-by: Dan Murphy <dmurphy@ti.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Cc: Amit Pundir <amit.pundir@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/misc/drv260x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/misc/drv260x.c
++++ b/drivers/input/misc/drv260x.c
+@@ -521,7 +521,7 @@ static int drv260x_probe(struct i2c_clie
+ if (!haptics)
+ return -ENOMEM;
+
+- haptics->rated_voltage = DRV260X_DEF_OD_CLAMP_VOLT;
++ haptics->overdrive_voltage = DRV260X_DEF_OD_CLAMP_VOLT;
+ haptics->rated_voltage = DRV260X_DEF_RATED_VOLT;
+
+ if (pdata) {
--- /dev/null
+From 4cfffcfa5106492f5785924ce2e9af49f075999b Mon Sep 17 00:00:00 2001
+From: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
+Date: Wed, 25 Jan 2017 15:08:25 +0100
+Subject: irqchip/mips-gic: Fix local interrupts
+
+From: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
+
+commit 4cfffcfa5106492f5785924ce2e9af49f075999b upstream.
+
+Some local interrupts are not initialised properly at the moment and
+cannot be used since the domain's alloc method is never called for them.
+
+This has been observed earlier and partially fixed in commit
+e875bd66dfb ("irqchip/mips-gic: Fix local interrupts"), but that change
+still relied on the interrupt to be requested by an external driver (eg.
+drivers/clocksource/mips-gic-timer.c).
+
+This does however not solve the issue for interrupts that are not
+referenced by any driver through the device tree and results in
+request_irq() calls returning -ENOSYS. It can be observed when attempting
+to use perf tool to access hardware performance counters.
+
+Fix this by explicitly calling irq_create_fwspec_mapping() for local
+interrupts.
+
+Fixes: e875bd66dfb ("irqchip/mips-gic: Fix local interrupts")
+Signed-off-by: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
+Cc: Paul Burton <paul.burton@imgtec.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Jason Cooper <jason@lakedaemon.net>
+Cc: Marc Zyngier <marc.zyngier@arm.com>
+Cc: linux-mips@linux-mips.org
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Cc: Amit Pundir <amit.pundir@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/irqchip/irq-mips-gic.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+--- a/drivers/irqchip/irq-mips-gic.c
++++ b/drivers/irqchip/irq-mips-gic.c
+@@ -969,6 +969,34 @@ static struct irq_domain_ops gic_ipi_dom
+ .match = gic_ipi_domain_match,
+ };
+
++static void __init gic_map_single_int(struct device_node *node,
++ unsigned int irq)
++{
++ unsigned int linux_irq;
++ struct irq_fwspec local_int_fwspec = {
++ .fwnode = &node->fwnode,
++ .param_count = 3,
++ .param = {
++ [0] = GIC_LOCAL,
++ [1] = irq,
++ [2] = IRQ_TYPE_NONE,
++ },
++ };
++
++ if (!gic_local_irq_is_routable(irq))
++ return;
++
++ linux_irq = irq_create_fwspec_mapping(&local_int_fwspec);
++ WARN_ON(!linux_irq);
++}
++
++static void __init gic_map_interrupts(struct device_node *node)
++{
++ gic_map_single_int(node, GIC_LOCAL_INT_TIMER);
++ gic_map_single_int(node, GIC_LOCAL_INT_PERFCTR);
++ gic_map_single_int(node, GIC_LOCAL_INT_FDC);
++}
++
+ static void __init __gic_init(unsigned long gic_base_addr,
+ unsigned long gic_addrspace_size,
+ unsigned int cpu_vec, unsigned int irqbase,
+@@ -1069,6 +1097,7 @@ static void __init __gic_init(unsigned l
+
+ bitmap_copy(ipi_available, ipi_resrv, GIC_MAX_INTRS);
+ gic_basic_init();
++ gic_map_interrupts(node);
+ }
+
+ void __init gic_init(unsigned long gic_base_addr,
--- /dev/null
+From dbfcef6b0f4012c57bc0b6e0e660d5ed12a5eaed Mon Sep 17 00:00:00 2001
+From: Sahitya Tummala <stummala@codeaurora.org>
+Date: Wed, 1 Feb 2017 20:49:35 -0500
+Subject: jbd2: fix use after free in kjournald2()
+
+From: Sahitya Tummala <stummala@codeaurora.org>
+
+commit dbfcef6b0f4012c57bc0b6e0e660d5ed12a5eaed upstream.
+
+Below is the synchronization issue between unmount and kjournald2
+contexts, which results into use after free issue in kjournald2().
+Fix this issue by using journal->j_state_lock to synchronize the
+wait_event() done in journal_kill_thread() and the wake_up() done
+in kjournald2().
+
+TASK 1:
+umount cmd:
+ |--jbd2_journal_destroy() {
+ |--journal_kill_thread() {
+ write_lock(&journal->j_state_lock);
+ journal->j_flags |= JBD2_UNMOUNT;
+ ...
+ write_unlock(&journal->j_state_lock);
+ wake_up(&journal->j_wait_commit); TASK 2 wakes up here:
+ kjournald2() {
+ ...
+ checks JBD2_UNMOUNT flag and calls goto end-loop;
+ ...
+ end_loop:
+ write_unlock(&journal->j_state_lock);
+ journal->j_task = NULL; --> If this thread gets
+ pre-empted here, then TASK 1 wait_event will
+ exit even before this thread is completely
+ done.
+ wait_event(journal->j_wait_done_commit, journal->j_task == NULL);
+ ...
+ write_lock(&journal->j_state_lock);
+ write_unlock(&journal->j_state_lock);
+ }
+ |--kfree(journal);
+ }
+}
+ wake_up(&journal->j_wait_done_commit); --> this step
+ now results into use after free issue.
+ }
+
+Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: Amit Pundir <amit.pundir@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/jbd2/journal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -276,11 +276,11 @@ loop:
+ goto loop;
+
+ end_loop:
+- write_unlock(&journal->j_state_lock);
+ del_timer_sync(&journal->j_commit_timer);
+ journal->j_task = NULL;
+ wake_up(&journal->j_wait_done_commit);
+ jbd_debug(1, "Journal thread exiting.\n");
++ write_unlock(&journal->j_state_lock);
+ return 0;
+ }
+
--- /dev/null
+From 73fbc1eba7ffa3bf0ad12486232a8a1edb4e4411 Mon Sep 17 00:00:00 2001
+From: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
+Date: Wed, 23 Nov 2016 14:43:49 +0100
+Subject: MIPS: fix mem=X@Y commandline processing
+
+From: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
+
+commit 73fbc1eba7ffa3bf0ad12486232a8a1edb4e4411 upstream.
+
+When a memory offset is specified through the commandline, add the
+memory in range PHYS_OFFSET:Y as reserved memory area.
+Otherwise the bootmem allocator is initialised with low page equal to
+min_low_pfn = PHYS_OFFSET, and in free_all_bootmem will process pages
+starting from min_low_pfn instead of PFN(Y).
+
+Signed-off-by: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/14613/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Cc: Amit Pundir <amit.pundir@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/setup.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -661,6 +661,10 @@ static int __init early_parse_mem(char *
+ start = memparse(p + 1, &p);
+
+ add_memory_region(start, size, BOOT_MEM_RAM);
++
++ if (start && start > PHYS_OFFSET)
++ add_memory_region(PHYS_OFFSET, start - PHYS_OFFSET,
++ BOOT_MEM_RESERVED);
+ return 0;
+ }
+ early_param("mem", early_parse_mem);
--- /dev/null
+From a3078e593b74fe196e69f122f03ff0b32f652c53 Mon Sep 17 00:00:00 2001
+From: Matt Redfearn <matt.redfearn@imgtec.com>
+Date: Mon, 23 Jan 2017 14:08:13 +0000
+Subject: MIPS: Generic: Fix big endian CPUs on generic machine
+
+From: Matt Redfearn <matt.redfearn@imgtec.com>
+
+commit a3078e593b74fe196e69f122f03ff0b32f652c53 upstream.
+
+Big endian CPUs require SWAP_IO_SPACE enabled to swap accesses to little
+endian peripherals.
+
+Without this patch, big endian kernels fail to communicate with little
+endian periperals, such as PCI devices, on QEMU and FPGA based
+platforms.
+
+Signed-off-by: Matt Redfearn <matt.redfearn@imgtec.com>
+Fixes: eed0eabd12ef ("MIPS: generic: Introduce generic DT-based board support")
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Patchwork: https://patchwork.linux-mips.org/patch/15105/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Cc: Amit Pundir <amit.pundir@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -95,6 +95,7 @@ config MIPS_GENERIC
+ select PCI_DRIVERS_GENERIC
+ select PINCTRL
+ select SMP_UP if SMP
++ select SWAP_IO_SPACE
+ select SYS_HAS_CPU_MIPS32_R1
+ select SYS_HAS_CPU_MIPS32_R2
+ select SYS_HAS_CPU_MIPS32_R6
--- /dev/null
+From de96ec2a77c6d06a423c2c495bb4a2f4299f3d9e Mon Sep 17 00:00:00 2001
+From: Paul Burton <paul.burton@imgtec.com>
+Date: Fri, 23 Sep 2016 16:38:27 +0100
+Subject: OF: Prevent unaligned access in of_alias_scan()
+
+From: Paul Burton <paul.burton@imgtec.com>
+
+commit de96ec2a77c6d06a423c2c495bb4a2f4299f3d9e upstream.
+
+When allocating a struct alias_prop, of_alias_scan() only requested that
+it be aligned on a 4 byte boundary. The struct contains pointers which
+leads to us attempting 64 bit writes on 64 bit systems, and if the CPU
+doesn't support unaligned memory accesses then this causes problems -
+for example on some MIPS64r2 CPUs including the "mips64r2-generic" QEMU
+emulated CPU it will trigger an address error exception.
+
+Fix this by requesting alignment for the struct alias_prop allocation
+matching that which the compiler expects, using the __alignof__ keyword.
+
+Signed-off-by: Paul Burton <paul.burton@imgtec.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Grant Likely <grant.likely@secretlab.ca>
+Cc: Frank Rowand <frowand.list@gmail.com>
+Cc: devicetree@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/14306/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Cc: Amit Pundir <amit.pundir@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/of/base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -2109,7 +2109,7 @@ void of_alias_scan(void * (*dt_alloc)(u6
+ continue;
+
+ /* Allocate an alias_prop with enough space for the stem */
+- ap = dt_alloc(sizeof(*ap) + len + 1, 4);
++ ap = dt_alloc(sizeof(*ap) + len + 1, __alignof__(*ap));
+ if (!ap)
+ continue;
+ memset(ap, 0, sizeof(*ap) + len + 1);
--- /dev/null
+From a1b94355ea3fde5e13db7ff37c0272fcde4e29b2 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Fri, 20 Jan 2017 13:25:06 +0000
+Subject: power: supply: bq2415x: check for NULL acpi_id to avoid null pointer dereference
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit a1b94355ea3fde5e13db7ff37c0272fcde4e29b2 upstream.
+
+acpi_match_device can potentially return NULL, so it is prudent to
+check if acpi_id is null before it is dereferenced. Add a check
+and an error message to indicate the failure.
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Pali Rohár <pali.rohar@gmail.com>
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Cc: Amit Pundir <amit.pundir@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/supply/bq2415x_charger.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/power/supply/bq2415x_charger.c
++++ b/drivers/power/supply/bq2415x_charger.c
+@@ -1569,6 +1569,11 @@ static int bq2415x_probe(struct i2c_clie
+ acpi_id =
+ acpi_match_device(client->dev.driver->acpi_match_table,
+ &client->dev);
++ if (!acpi_id) {
++ dev_err(&client->dev, "failed to match device name\n");
++ ret = -ENODEV;
++ goto error_1;
++ }
+ name = kasprintf(GFP_KERNEL, "%s-%d", acpi_id->id, num);
+ }
+ if (!name) {
usb-musb-fix-enumeration-after-resume.patch
usb-musb-call-pm_runtime_-get-put-_sync-before-reading-vbus-registers.patch
usb-musb-fix-external-abort-in-musb_remove-on-omap2430.patch
+mips-generic-fix-big-endian-cpus-on-generic-machine.patch
+input-drv260x-fix-initializing-overdrive-voltage.patch
+power-supply-bq2415x-check-for-null-acpi_id-to-avoid-null-pointer-dereference.patch
+stk-webcam-fix-an-endian-bug-in-stk_camera_read_reg.patch
+mips-fix-mem-x-y-commandline-processing.patch
+of-prevent-unaligned-access-in-of_alias_scan.patch
+irqchip-mips-gic-fix-local-interrupts.patch
+ath9k_hw-check-if-the-chip-failed-to-wake-up.patch
+jbd2-fix-use-after-free-in-kjournald2.patch
revert-perf-tools-decompress-kernel-module-when-reading-dso.patch
perf-fix-sample_max_stack-maximum-check.patch
perf-return-proper-values-for-user-stack-errors.patch
--- /dev/null
+From d08876f524a605d64c7ca32cb8e9f5be3839e82e Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 16 Nov 2016 09:11:54 -0200
+Subject: [media] stk-webcam: fix an endian bug in stk_camera_read_reg()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit d08876f524a605d64c7ca32cb8e9f5be3839e82e upstream.
+
+We pass an int pointer to stk_camera_read_reg() but only write to the
+highest byte. It's a bug on big endian systems and generally a nasty
+thing to do and doesn't match the write function either.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Cc: Amit Pundir <amit.pundir@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/stkwebcam/stk-sensor.c | 6 +++---
+ drivers/media/usb/stkwebcam/stk-webcam.c | 11 ++++++-----
+ drivers/media/usb/stkwebcam/stk-webcam.h | 2 +-
+ 3 files changed, 10 insertions(+), 9 deletions(-)
+
+--- a/drivers/media/usb/stkwebcam/stk-sensor.c
++++ b/drivers/media/usb/stkwebcam/stk-sensor.c
+@@ -228,7 +228,7 @@
+ static int stk_sensor_outb(struct stk_camera *dev, u8 reg, u8 val)
+ {
+ int i = 0;
+- int tmpval = 0;
++ u8 tmpval = 0;
+
+ if (stk_camera_write_reg(dev, STK_IIC_TX_INDEX, reg))
+ return 1;
+@@ -253,7 +253,7 @@ static int stk_sensor_outb(struct stk_ca
+ static int stk_sensor_inb(struct stk_camera *dev, u8 reg, u8 *val)
+ {
+ int i = 0;
+- int tmpval = 0;
++ u8 tmpval = 0;
+
+ if (stk_camera_write_reg(dev, STK_IIC_RX_INDEX, reg))
+ return 1;
+@@ -274,7 +274,7 @@ static int stk_sensor_inb(struct stk_cam
+ if (stk_camera_read_reg(dev, STK_IIC_RX_VALUE, &tmpval))
+ return 1;
+
+- *val = (u8) tmpval;
++ *val = tmpval;
+ return 0;
+ }
+
+--- a/drivers/media/usb/stkwebcam/stk-webcam.c
++++ b/drivers/media/usb/stkwebcam/stk-webcam.c
+@@ -144,7 +144,7 @@ int stk_camera_write_reg(struct stk_came
+ return 0;
+ }
+
+-int stk_camera_read_reg(struct stk_camera *dev, u16 index, int *value)
++int stk_camera_read_reg(struct stk_camera *dev, u16 index, u8 *value)
+ {
+ struct usb_device *udev = dev->udev;
+ unsigned char *buf;
+@@ -163,7 +163,7 @@ int stk_camera_read_reg(struct stk_camer
+ sizeof(u8),
+ 500);
+ if (ret >= 0)
+- memcpy(value, buf, sizeof(u8));
++ *value = *buf;
+
+ kfree(buf);
+ return ret;
+@@ -171,9 +171,10 @@ int stk_camera_read_reg(struct stk_camer
+
+ static int stk_start_stream(struct stk_camera *dev)
+ {
+- int value;
++ u8 value;
+ int i, ret;
+- int value_116, value_117;
++ u8 value_116, value_117;
++
+
+ if (!is_present(dev))
+ return -ENODEV;
+@@ -213,7 +214,7 @@ static int stk_start_stream(struct stk_c
+
+ static int stk_stop_stream(struct stk_camera *dev)
+ {
+- int value;
++ u8 value;
+ int i;
+ if (is_present(dev)) {
+ stk_camera_read_reg(dev, 0x0100, &value);
+--- a/drivers/media/usb/stkwebcam/stk-webcam.h
++++ b/drivers/media/usb/stkwebcam/stk-webcam.h
+@@ -129,7 +129,7 @@ struct stk_camera {
+ #define vdev_to_camera(d) container_of(d, struct stk_camera, vdev)
+
+ int stk_camera_write_reg(struct stk_camera *, u16, u8);
+-int stk_camera_read_reg(struct stk_camera *, u16, int *);
++int stk_camera_read_reg(struct stk_camera *, u16, u8 *);
+
+ int stk_sensor_init(struct stk_camera *);
+ int stk_sensor_configure(struct stk_camera *);
projects / thirdparty / kernel / stable-queue.git / commitdiff
