--- /dev/null
+From 671796dd96b6cd85b75fba9d3007bcf7e5f7c309 Mon Sep 17 00:00:00 2001
+From: Ronald Wahl <ronald.wahl@raritan.com>
+Date: Thu, 7 Aug 2014 14:15:50 +0200
+Subject: carl9170: fix sending URBs with wrong type when using full-speed
+
+From: Ronald Wahl <ronald.wahl@raritan.com>
+
+commit 671796dd96b6cd85b75fba9d3007bcf7e5f7c309 upstream.
+
+The driver assumes that endpoint 4 is always an interrupt endpoint.
+Unfortunately the type differs between high-speed and full-speed
+configurations while in the former case it is indeed an interrupt
+endpoint this is not true for the latter case - here it is a bulk
+endpoint. When sending URBs with the wrong type the kernel will
+generate a warning message including backtrace. In this specific
+case there will be a huge amount of warnings which can bring the system
+to freeze.
+
+To fix this we are now sending URBs to endpoint 4 using the type
+found in the endpoint descriptor.
+
+A side note: The carl9170 firmware currently specifies endpoint 4 as
+interrupt endpoint even in the full-speed configuration but this has
+no relevance because before this firmware is loaded the endpoint type
+is as described above and after the firmware is running the stick is not
+reenumerated and so the old descriptor is used.
+
+Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/carl9170/carl9170.h | 1
+ drivers/net/wireless/ath/carl9170/usb.c | 31 +++++++++++++++++++++++----
+ 2 files changed, 28 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/carl9170/carl9170.h
++++ b/drivers/net/wireless/ath/carl9170/carl9170.h
+@@ -253,6 +253,7 @@ struct ar9170 {
+ atomic_t rx_work_urbs;
+ atomic_t rx_pool_urbs;
+ kernel_ulong_t features;
++ bool usb_ep_cmd_is_bulk;
+
+ /* firmware settings */
+ struct completion fw_load_wait;
+--- a/drivers/net/wireless/ath/carl9170/usb.c
++++ b/drivers/net/wireless/ath/carl9170/usb.c
+@@ -621,9 +621,16 @@ int __carl9170_exec_cmd(struct ar9170 *a
+ goto err_free;
+ }
+
+- usb_fill_int_urb(urb, ar->udev, usb_sndintpipe(ar->udev,
+- AR9170_USB_EP_CMD), cmd, cmd->hdr.len + 4,
+- carl9170_usb_cmd_complete, ar, 1);
++ if (ar->usb_ep_cmd_is_bulk)
++ usb_fill_bulk_urb(urb, ar->udev,
++ usb_sndbulkpipe(ar->udev, AR9170_USB_EP_CMD),
++ cmd, cmd->hdr.len + 4,
++ carl9170_usb_cmd_complete, ar);
++ else
++ usb_fill_int_urb(urb, ar->udev,
++ usb_sndintpipe(ar->udev, AR9170_USB_EP_CMD),
++ cmd, cmd->hdr.len + 4,
++ carl9170_usb_cmd_complete, ar, 1);
+
+ if (free_buf)
+ urb->transfer_flags |= URB_FREE_BUFFER;
+@@ -1032,9 +1039,10 @@ static void carl9170_usb_firmware_step2(
+ static int carl9170_usb_probe(struct usb_interface *intf,
+ const struct usb_device_id *id)
+ {
++ struct usb_endpoint_descriptor *ep;
+ struct ar9170 *ar;
+ struct usb_device *udev;
+- int err;
++ int i, err;
+
+ err = usb_reset_device(interface_to_usbdev(intf));
+ if (err)
+@@ -1050,6 +1058,21 @@ static int carl9170_usb_probe(struct usb
+ ar->intf = intf;
+ ar->features = id->driver_info;
+
++ /* We need to remember the type of endpoint 4 because it differs
++ * between high- and full-speed configuration. The high-speed
++ * configuration specifies it as interrupt and the full-speed
++ * configuration as bulk endpoint. This information is required
++ * later when sending urbs to that endpoint.
++ */
++ for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; ++i) {
++ ep = &intf->cur_altsetting->endpoint[i].desc;
++
++ if (usb_endpoint_num(ep) == AR9170_USB_EP_CMD &&
++ usb_endpoint_dir_out(ep) &&
++ usb_endpoint_type(ep) == USB_ENDPOINT_XFER_BULK)
++ ar->usb_ep_cmd_is_bulk = true;
++ }
++
+ usb_set_intfdata(intf, ar);
+ SET_IEEE80211_DEV(ar->hw, &intf->dev);
+
--- /dev/null
+From c9a3ad25eddfdb898114a9d73cdb4c3472d9dfca Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+Date: Tue, 17 Jun 2014 11:17:09 -0300
+Subject: drm/tilcdc: fix double kfree
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+
+commit c9a3ad25eddfdb898114a9d73cdb4c3472d9dfca upstream.
+
+display_timings_release calls kfree on the display_timings object passed
+to it. Calling kfree after it is wrong. SLUB debug showed the following
+warning:
+
+ =============================================================================
+ BUG kmalloc-64 (Tainted: G W ): Object already free
+ -----------------------------------------------------------------------------
+
+ Disabling lock debugging due to kernel taint
+ INFO: Allocated in of_get_display_timings+0x2c/0x214 age=601 cpu=0
+ pid=884
+ __slab_alloc.constprop.79+0x2e0/0x33c
+ kmem_cache_alloc+0xac/0xdc
+ of_get_display_timings+0x2c/0x214
+ panel_probe+0x7c/0x314 [tilcdc]
+ platform_drv_probe+0x18/0x48
+ [..snip..]
+ INFO: Freed in panel_destroy+0x18/0x3c [tilcdc] age=0 cpu=0 pid=907
+ __slab_free+0x34/0x330
+ panel_destroy+0x18/0x3c [tilcdc]
+ tilcdc_unload+0xd0/0x118 [tilcdc]
+ drm_dev_unregister+0x24/0x98
+ [..snip..]
+
+Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
+Tested-by: Darren Etheridge <detheridge@ti.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/tilcdc/tilcdc_panel.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c
+@@ -286,10 +286,8 @@ static void panel_destroy(struct tilcdc_
+ {
+ struct panel_module *panel_mod = to_panel_module(mod);
+
+- if (panel_mod->timings) {
++ if (panel_mod->timings)
+ display_timings_release(panel_mod->timings);
+- kfree(panel_mod->timings);
+- }
+
+ tilcdc_module_cleanup(mod);
+ kfree(panel_mod->info);
--- /dev/null
+From eb565a2bbadc6a5030a6dbe58db1aa52453e7edf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+Date: Tue, 17 Jun 2014 11:17:08 -0300
+Subject: drm/tilcdc: fix release order on exit
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+
+commit eb565a2bbadc6a5030a6dbe58db1aa52453e7edf upstream.
+
+Unregister resources in the correct order on tilcdc_drm_fini, which is
+the reverse order they were registered during tilcdc_drm_init.
+
+This also means unregistering the driver before releasing its resources.
+
+Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
+Tested-by: Darren Etheridge <detheridge@ti.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/tilcdc/tilcdc_drv.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+@@ -597,10 +597,10 @@ static int __init tilcdc_drm_init(void)
+ static void __exit tilcdc_drm_fini(void)
+ {
+ DBG("fini");
+- tilcdc_tfp410_fini();
+- tilcdc_slave_fini();
+- tilcdc_panel_fini();
+ platform_driver_unregister(&tilcdc_platform_driver);
++ tilcdc_panel_fini();
++ tilcdc_slave_fini();
++ tilcdc_tfp410_fini();
+ }
+
+ late_initcall(tilcdc_drm_init);
--- /dev/null
+From e396900e649b0af31161634d87fe37076f46c12b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+Date: Tue, 17 Jun 2014 11:17:04 -0300
+Subject: drm/tilcdc: panel: fix dangling sysfs connector node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+
+commit e396900e649b0af31161634d87fe37076f46c12b upstream.
+
+Add a drm_sysfs_connector_remove call when we destroy the panel to make
+sure the connector node in sysfs gets deleted.
+
+This is required for proper unload and re-load of this driver as a
+module. Without this, we would get a warning at re-load time like so:
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 0 PID: 824 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x54/0x74()
+ sysfs: cannot create duplicate filename '/class/drm/card0-LVDS-1'
+ Modules linked in: [...]
+ CPU: 0 PID: 824 Comm: modprobe Not tainted 3.15.0-rc4-00027-g6484f96-dirty #81
+ [<c0013bb8>] (unwind_backtrace) from [<c0011824>] (show_stack+0x10/0x14)
+ [<c0011824>] (show_stack) from [<c0034e8c>] (warn_slowpath_common+0x68/0x88)
+ [<c0034e8c>] (warn_slowpath_common) from [<c0034edc>] (warn_slowpath_fmt+0x30/0x40)
+ [<c0034edc>] (warn_slowpath_fmt) from [<c01243f4>] (sysfs_warn_dup+0x54/0x74)
+ [<c01243f4>] (sysfs_warn_dup) from [<c0124708>] (sysfs_do_create_link_sd.isra.2+0xb0/0xb8)
+ [<c0124708>] (sysfs_do_create_link_sd.isra.2) from [<c02ae37c>] (device_add+0x338/0x520)
+ [<c02ae37c>] (device_add) from [<c02ae6e8>] (device_create_groups_vargs+0xa0/0xc4)
+ [<c02ae6e8>] (device_create_groups_vargs) from [<c02ae758>] (device_create+0x24/0x2c)
+ [<c02ae758>] (device_create) from [<c029b4ec>] (drm_sysfs_connector_add+0x64/0x204)
+ [<c029b4ec>] (drm_sysfs_connector_add) from [<bf0b1fec>] (panel_modeset_init+0xb8/0x134 [tilcdc])
+ [<bf0b1fec>] (panel_modeset_init [tilcdc]) from [<bf0b2bf0>] (tilcdc_load+0x214/0x4c0 [tilcdc])
+ [<bf0b2bf0>] (tilcdc_load [tilcdc]) from [<c029955c>] (drm_dev_register+0xa4/0x104)
+ [ .. snip .. ]
+ ---[ end trace b2d09cd9578b0497 ]---
+ [drm:drm_sysfs_connector_add] *ERROR* failed to register connector device: -17
+
+Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
+Tested-by: Darren Etheridge <detheridge@ti.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/tilcdc/tilcdc_panel.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c
+@@ -151,6 +151,7 @@ struct panel_connector {
+ static void panel_connector_destroy(struct drm_connector *connector)
+ {
+ struct panel_connector *panel_connector = to_panel_connector(connector);
++ drm_sysfs_connector_remove(connector);
+ drm_connector_cleanup(connector);
+ kfree(panel_connector);
+ }
--- /dev/null
+From 3a49012224ca9016658a831a327ff6a7fe5bb4f9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+Date: Tue, 17 Jun 2014 11:17:07 -0300
+Subject: drm/tilcdc: panel: fix leak when unloading the module
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+
+commit 3a49012224ca9016658a831a327ff6a7fe5bb4f9 upstream.
+
+The driver did not unregister the allocated framebuffer, which caused
+memory leaks (and memory manager WARNs) when unloading. Also, the
+framebuffer device under /dev still existed after unloading.
+
+Add a call to drm_fbdev_cma_fini when unloading the module to prevent
+both issues.
+
+Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
+Tested-by: Darren Etheridge <detheridge@ti.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/tilcdc/tilcdc_drv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+@@ -116,6 +116,7 @@ static int tilcdc_unload(struct drm_devi
+ struct tilcdc_drm_private *priv = dev->dev_private;
+ struct tilcdc_module *mod, *cur;
+
++ drm_fbdev_cma_fini(priv->fbdev);
+ drm_kms_helper_poll_fini(dev);
+ drm_mode_config_cleanup(dev);
+ drm_vblank_cleanup(dev);
--- /dev/null
+From daa15b4cd1eee58eb1322062a3320b1dbe5dc96e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+Date: Tue, 17 Jun 2014 11:17:05 -0300
+Subject: drm/tilcdc: slave: fix dangling sysfs connector node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+
+commit daa15b4cd1eee58eb1322062a3320b1dbe5dc96e upstream.
+
+Add a drm_sysfs_connector_remove call when we destroy the panel to make
+sure the connector node in sysfs gets deleted.
+
+This is required for proper unload and re-load of this driver as a
+module. Without this, we would get a warning at re-load time like so:
+
+ tda998x 0-0070: found TDA19988
+ ------------[ cut here ]------------
+ WARNING: CPU: 0 PID: 825 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x54/0x74()
+ sysfs: cannot create duplicate filename '/class/drm/card0-HDMI-A-1'
+ Modules linked in: [..]
+ CPU: 0 PID: 825 Comm: modprobe Not tainted 3.15.0-rc4-00027-g9dcdef4 #82
+ [<c0013bb8>] (unwind_backtrace) from [<c0011824>] (show_stack+0x10/0x14)
+ [<c0011824>] (show_stack) from [<c0034e8c>] (warn_slowpath_common+0x68/0x88)
+ [<c0034e8c>] (warn_slowpath_common) from [<c0034edc>] (warn_slowpath_fmt+0x30/0x40)
+ [<c0034edc>] (warn_slowpath_fmt) from [<c01243f4>] (sysfs_warn_dup+0x54/0x74)
+ [<c01243f4>] (sysfs_warn_dup) from [<c0124708>] (sysfs_do_create_link_sd.isra.2+0xb0/0xb8)
+ [<c0124708>] (sysfs_do_create_link_sd.isra.2) from [<c02ae37c>] (device_add+0x338/0x520)
+ [<c02ae37c>] (device_add) from [<c02ae6e8>] (device_create_groups_vargs+0xa0/0xc4)
+ [<c02ae6e8>] (device_create_groups_vargs) from [<c02ae758>] (device_create+0x24/0x2c)
+ [<c02ae758>] (device_create) from [<c029b4ec>] (drm_sysfs_connector_add+0x64/0x204)
+ [<c029b4ec>] (drm_sysfs_connector_add) from [<bf0b1b40>] (slave_modeset_init+0x120/0x1bc [tilcdc])
+ [<bf0b1b40>] (slave_modeset_init [tilcdc]) from [<bf0b2be8>] (tilcdc_load+0x214/0x4c0 [tilcdc])
+ [<bf0b2be8>] (tilcdc_load [tilcdc]) from [<c029955c>] (drm_dev_register+0xa4/0x104)
+ [..snip..]
+ ---[ end trace 4df8d614936ebdee ]---
+ [drm:drm_sysfs_connector_add] *ERROR* failed to register connector device: -17
+
+Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
+Tested-by: Darren Etheridge <detheridge@ti.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/tilcdc/tilcdc_slave.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/tilcdc/tilcdc_slave.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_slave.c
+@@ -142,6 +142,7 @@ struct slave_connector {
+ static void slave_connector_destroy(struct drm_connector *connector)
+ {
+ struct slave_connector *slave_connector = to_slave_connector(connector);
++ drm_sysfs_connector_remove(connector);
+ drm_connector_cleanup(connector);
+ kfree(slave_connector);
+ }
--- /dev/null
+From 16dcbdef404f4e87dab985494381939fe0a2d456 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+Date: Tue, 17 Jun 2014 11:17:06 -0300
+Subject: drm/tilcdc: tfp410: fix dangling sysfs connector node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Guido=20Mart=C3=ADnez?= <guido@vanguardiasur.com.ar>
+
+commit 16dcbdef404f4e87dab985494381939fe0a2d456 upstream.
+
+Add a drm_sysfs_connector_remove call when we destroy the panel to make
+sure the connector node in sysfs gets deleted.
+
+This is required for proper unload and re-load of this driver, otherwise
+we will get a warning about a duplicate filename in sysfs.
+
+Signed-off-by: Guido Martínez <guido@vanguardiasur.com.ar>
+Tested-by: Darren Etheridge <detheridge@ti.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/tilcdc/tilcdc_tfp410.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c
+@@ -168,6 +168,7 @@ struct tfp410_connector {
+ static void tfp410_connector_destroy(struct drm_connector *connector)
+ {
+ struct tfp410_connector *tfp410_connector = to_tfp410_connector(connector);
++ drm_sysfs_connector_remove(connector);
+ drm_connector_cleanup(connector);
+ kfree(tfp410_connector);
+ }
+carl9170-fix-sending-urbs-with-wrong-type-when-using-full-speed.patch
+drm-tilcdc-panel-fix-dangling-sysfs-connector-node.patch
+drm-tilcdc-slave-fix-dangling-sysfs-connector-node.patch
+drm-tilcdc-tfp410-fix-dangling-sysfs-connector-node.patch
+drm-tilcdc-panel-fix-leak-when-unloading-the-module.patch
+drm-tilcdc-fix-release-order-on-exit.patch
+drm-tilcdc-fix-double-kfree.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
