From: Greg Kroah-Hartman Date: Mon, 14 Oct 2019 15:04:17 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.4.197~39 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=112c963108664ca8282bf444b7196317a64fcc08;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: iio-adc-ad799x-fix-probe-error-handling.patch iio-adc-axp288-override-ts-pin-bias-current-for-some-models.patch iio-adc-stm32-adc-fix-a-race-when-using-several-adcs-with-dma-and-irq.patch staging-vt6655-fix-memory-leak-in-vt6655_probe.patch --- diff --git a/queue-4.14/iio-adc-ad799x-fix-probe-error-handling.patch b/queue-4.14/iio-adc-ad799x-fix-probe-error-handling.patch new file mode 100644 index 00000000000..469525ddb4b --- /dev/null +++ b/queue-4.14/iio-adc-ad799x-fix-probe-error-handling.patch @@ -0,0 +1,39 @@ +From c62dd44901cfff12acc5792bf3d2dec20bcaf392 Mon Sep 17 00:00:00 2001 +From: Marco Felsch +Date: Tue, 17 Sep 2019 18:09:23 +0200 +Subject: iio: adc: ad799x: fix probe error handling + +From: Marco Felsch + +commit c62dd44901cfff12acc5792bf3d2dec20bcaf392 upstream. + +Since commit 0f7ddcc1bff1 ("iio:adc:ad799x: Write default config on probe +and reset alert status on probe") the error path is wrong since it +leaves the vref regulator on. Fix this by disabling both regulators. + +Fixes: 0f7ddcc1bff1 ("iio:adc:ad799x: Write default config on probe and reset alert status on probe") +Signed-off-by: Marco Felsch +Reviewed-by: Alexandru Ardelean +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/ad799x.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/iio/adc/ad799x.c ++++ b/drivers/iio/adc/ad799x.c +@@ -817,10 +817,10 @@ static int ad799x_probe(struct i2c_clien + + ret = ad799x_write_config(st, st->chip_config->default_config); + if (ret < 0) +- goto error_disable_reg; ++ goto error_disable_vref; + ret = ad799x_read_config(st); + if (ret < 0) +- goto error_disable_reg; ++ goto error_disable_vref; + st->config = ret; + + ret = iio_triggered_buffer_setup(indio_dev, NULL, diff --git a/queue-4.14/iio-adc-axp288-override-ts-pin-bias-current-for-some-models.patch b/queue-4.14/iio-adc-axp288-override-ts-pin-bias-current-for-some-models.patch new file mode 100644 index 00000000000..357d991f40b --- /dev/null +++ b/queue-4.14/iio-adc-axp288-override-ts-pin-bias-current-for-some-models.patch @@ -0,0 +1,92 @@ +From 972917419a0ba25afbf69d5d8c9fa644d676f887 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sun, 15 Sep 2019 20:53:42 +0200 +Subject: iio: adc: axp288: Override TS pin bias current for some models +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +commit 972917419a0ba25afbf69d5d8c9fa644d676f887 upstream. + +Since commit 9bcf15f75cac ("iio: adc: axp288: Fix TS-pin handling") we +preserve the bias current set by the firmware at boot. This fixes issues +we were seeing on various models, but it seems our old hardcoded 80ųA bias +current was working around a firmware bug on at least one model laptop. + +In order to both have our cake and eat it, this commit adds a dmi based +list of models where we need to override the firmware set bias current and +adds the one model we now know needs this to it: The Lenovo Ideapad 100S +(11 inch version). + +Fixes: 9bcf15f75cac ("iio: adc: axp288: Fix TS-pin handling") +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=203829 +Signed-off-by: Hans de Goede +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/axp288_adc.c | 32 ++++++++++++++++++++++++++++++++ + 1 file changed, 32 insertions(+) + +--- a/drivers/iio/adc/axp288_adc.c ++++ b/drivers/iio/adc/axp288_adc.c +@@ -16,6 +16,7 @@ + * + */ + ++#include + #include + #include + #include +@@ -34,6 +35,11 @@ + #define AXP288_ADC_EN_MASK 0xF0 + #define AXP288_ADC_TS_ENABLE 0x01 + ++#define AXP288_ADC_TS_BIAS_MASK GENMASK(5, 4) ++#define AXP288_ADC_TS_BIAS_20UA (0 << 4) ++#define AXP288_ADC_TS_BIAS_40UA (1 << 4) ++#define AXP288_ADC_TS_BIAS_60UA (2 << 4) ++#define AXP288_ADC_TS_BIAS_80UA (3 << 4) + #define AXP288_ADC_TS_CURRENT_ON_OFF_MASK GENMASK(1, 0) + #define AXP288_ADC_TS_CURRENT_OFF (0 << 0) + #define AXP288_ADC_TS_CURRENT_ON_WHEN_CHARGING (1 << 0) +@@ -194,10 +200,36 @@ static int axp288_adc_read_raw(struct ii + return ret; + } + ++/* ++ * We rely on the machine's firmware to correctly setup the TS pin bias current ++ * at boot. This lists systems with broken fw where we need to set it ourselves. ++ */ ++static const struct dmi_system_id axp288_adc_ts_bias_override[] = { ++ { ++ /* Lenovo Ideapad 100S (11 inch) */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad 100S-11IBY"), ++ }, ++ .driver_data = (void *)(uintptr_t)AXP288_ADC_TS_BIAS_80UA, ++ }, ++ {} ++}; ++ + static int axp288_adc_initialize(struct axp288_adc_info *info) + { ++ const struct dmi_system_id *bias_override; + int ret, adc_enable_val; + ++ bias_override = dmi_first_match(axp288_adc_ts_bias_override); ++ if (bias_override) { ++ ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL, ++ AXP288_ADC_TS_BIAS_MASK, ++ (uintptr_t)bias_override->driver_data); ++ if (ret) ++ return ret; ++ } ++ + /* + * Determine if the TS pin is enabled and set the TS current-source + * accordingly. diff --git a/queue-4.14/iio-adc-stm32-adc-fix-a-race-when-using-several-adcs-with-dma-and-irq.patch b/queue-4.14/iio-adc-stm32-adc-fix-a-race-when-using-several-adcs-with-dma-and-irq.patch new file mode 100644 index 00000000000..64160e82dac --- /dev/null +++ b/queue-4.14/iio-adc-stm32-adc-fix-a-race-when-using-several-adcs-with-dma-and-irq.patch @@ -0,0 +1,129 @@ +From dcb10920179ab74caf88a6f2afadecfc2743b910 Mon Sep 17 00:00:00 2001 +From: Fabrice Gasnier +Date: Tue, 17 Sep 2019 14:38:16 +0200 +Subject: iio: adc: stm32-adc: fix a race when using several adcs with dma and irq + +From: Fabrice Gasnier + +commit dcb10920179ab74caf88a6f2afadecfc2743b910 upstream. + +End of conversion may be handled by using IRQ or DMA. There may be a +race when two conversions complete at the same time on several ADCs. +EOC can be read as 'set' for several ADCs, with: +- an ADC configured to use IRQs. EOCIE bit is set. The handler is normally + called in this case. +- an ADC configured to use DMA. EOCIE bit isn't set. EOC triggers the DMA + request instead. It's then automatically cleared by DMA read. But the + handler gets called due to status bit is temporarily set (IRQ triggered + by the other ADC). +So both EOC status bit in CSR and EOCIE control bit must be checked +before invoking the interrupt handler (e.g. call ISR only for +IRQ-enabled ADCs). + +Fixes: 2763ea0585c9 ("iio: adc: stm32: add optional dma support") + +Signed-off-by: Fabrice Gasnier +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/stm32-adc-core.c | 43 ++++++++++++++++++++++++++++++++++++--- + drivers/iio/adc/stm32-adc-core.h | 1 + 2 files changed, 41 insertions(+), 3 deletions(-) + +--- a/drivers/iio/adc/stm32-adc-core.c ++++ b/drivers/iio/adc/stm32-adc-core.c +@@ -72,12 +72,16 @@ + * @eoc1: adc1 end of conversion flag in @csr + * @eoc2: adc2 end of conversion flag in @csr + * @eoc3: adc3 end of conversion flag in @csr ++ * @ier: interrupt enable register offset for each adc ++ * @eocie_msk: end of conversion interrupt enable mask in @ier + */ + struct stm32_adc_common_regs { + u32 csr; + u32 eoc1_msk; + u32 eoc2_msk; + u32 eoc3_msk; ++ u32 ier; ++ u32 eocie_msk; + }; + + struct stm32_adc_priv; +@@ -271,6 +275,8 @@ static const struct stm32_adc_common_reg + .eoc1_msk = STM32F4_EOC1, + .eoc2_msk = STM32F4_EOC2, + .eoc3_msk = STM32F4_EOC3, ++ .ier = STM32F4_ADC_CR1, ++ .eocie_msk = STM32F4_EOCIE, + }; + + /* STM32H7 common registers definitions */ +@@ -278,8 +284,24 @@ static const struct stm32_adc_common_reg + .csr = STM32H7_ADC_CSR, + .eoc1_msk = STM32H7_EOC_MST, + .eoc2_msk = STM32H7_EOC_SLV, ++ .ier = STM32H7_ADC_IER, ++ .eocie_msk = STM32H7_EOCIE, + }; + ++static const unsigned int stm32_adc_offset[STM32_ADC_MAX_ADCS] = { ++ 0, STM32_ADC_OFFSET, STM32_ADC_OFFSET * 2, ++}; ++ ++static unsigned int stm32_adc_eoc_enabled(struct stm32_adc_priv *priv, ++ unsigned int adc) ++{ ++ u32 ier, offset = stm32_adc_offset[adc]; ++ ++ ier = readl_relaxed(priv->common.base + offset + priv->cfg->regs->ier); ++ ++ return ier & priv->cfg->regs->eocie_msk; ++} ++ + /* ADC common interrupt for all instances */ + static void stm32_adc_irq_handler(struct irq_desc *desc) + { +@@ -290,13 +312,28 @@ static void stm32_adc_irq_handler(struct + chained_irq_enter(chip, desc); + status = readl_relaxed(priv->common.base + priv->cfg->regs->csr); + +- if (status & priv->cfg->regs->eoc1_msk) ++ /* ++ * End of conversion may be handled by using IRQ or DMA. There may be a ++ * race here when two conversions complete at the same time on several ++ * ADCs. EOC may be read 'set' for several ADCs, with: ++ * - an ADC configured to use DMA (EOC triggers the DMA request, and ++ * is then automatically cleared by DR read in hardware) ++ * - an ADC configured to use IRQs (EOCIE bit is set. The handler must ++ * be called in this case) ++ * So both EOC status bit in CSR and EOCIE control bit must be checked ++ * before invoking the interrupt handler (e.g. call ISR only for ++ * IRQ-enabled ADCs). ++ */ ++ if (status & priv->cfg->regs->eoc1_msk && ++ stm32_adc_eoc_enabled(priv, 0)) + generic_handle_irq(irq_find_mapping(priv->domain, 0)); + +- if (status & priv->cfg->regs->eoc2_msk) ++ if (status & priv->cfg->regs->eoc2_msk && ++ stm32_adc_eoc_enabled(priv, 1)) + generic_handle_irq(irq_find_mapping(priv->domain, 1)); + +- if (status & priv->cfg->regs->eoc3_msk) ++ if (status & priv->cfg->regs->eoc3_msk && ++ stm32_adc_eoc_enabled(priv, 2)) + generic_handle_irq(irq_find_mapping(priv->domain, 2)); + + chained_irq_exit(chip, desc); +--- a/drivers/iio/adc/stm32-adc-core.h ++++ b/drivers/iio/adc/stm32-adc-core.h +@@ -37,6 +37,7 @@ + * -------------------------------------------------------- + */ + #define STM32_ADC_MAX_ADCS 3 ++#define STM32_ADC_OFFSET 0x100 + #define STM32_ADCX_COMN_OFFSET 0x300 + + /** diff --git a/queue-4.14/series b/queue-4.14/series index c961d37472d..043b280193c 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -36,3 +36,7 @@ usb-legousbtower-fix-deadlock-on-disconnect.patch usb-legousbtower-fix-potential-null-deref-on-disconnect.patch usb-legousbtower-fix-open-after-failed-reset-request.patch usb-legousbtower-fix-use-after-free-on-release.patch +staging-vt6655-fix-memory-leak-in-vt6655_probe.patch +iio-adc-ad799x-fix-probe-error-handling.patch +iio-adc-axp288-override-ts-pin-bias-current-for-some-models.patch +iio-adc-stm32-adc-fix-a-race-when-using-several-adcs-with-dma-and-irq.patch diff --git a/queue-4.14/staging-vt6655-fix-memory-leak-in-vt6655_probe.patch b/queue-4.14/staging-vt6655-fix-memory-leak-in-vt6655_probe.patch new file mode 100644 index 00000000000..33944d4d8dc --- /dev/null +++ b/queue-4.14/staging-vt6655-fix-memory-leak-in-vt6655_probe.patch @@ -0,0 +1,37 @@ +From 80b15db5e1e9c3300de299b2d43d1aafb593e6ac Mon Sep 17 00:00:00 2001 +From: Navid Emamdoost +Date: Fri, 4 Oct 2019 15:03:15 -0500 +Subject: staging: vt6655: Fix memory leak in vt6655_probe + +From: Navid Emamdoost + +commit 80b15db5e1e9c3300de299b2d43d1aafb593e6ac upstream. + +In vt6655_probe, if vnt_init() fails the cleanup code needs to be called +like other error handling cases. The call to device_free_info() is +added. + +Fixes: 67013f2c0e58 ("staging: vt6655: mac80211 conversion add main mac80211 functions") +Signed-off-by: Navid Emamdoost +Cc: stable +Link: https://lore.kernel.org/r/20191004200319.22394-1-navid.emamdoost@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6655/device_main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/staging/vt6655/device_main.c ++++ b/drivers/staging/vt6655/device_main.c +@@ -1668,8 +1668,10 @@ vt6655_probe(struct pci_dev *pcid, const + + priv->hw->max_signal = 100; + +- if (vnt_init(priv)) ++ if (vnt_init(priv)) { ++ device_free_info(priv); + return -ENODEV; ++ } + + device_print_info(priv); + pci_set_drvdata(pcid, priv);