From: Greg Kroah-Hartman Date: Mon, 14 Oct 2019 15:04:35 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.4.197~38 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a2fe06e03a823b03449b70e0a2322d31fc24e669;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: gpio-eic-sprd-fix-the-incorrect-eic-offset-when-toggling.patch iio-adc-ad799x-fix-probe-error-handling.patch iio-adc-axp288-override-ts-pin-bias-current-for-some-models.patch iio-adc-hx711-fix-bug-in-sampling-of-data.patch iio-adc-stm32-adc-fix-a-race-when-using-several-adcs-with-dma-and-irq.patch staging-fbtft-fix-memory-leak-in-fbtft_framebuffer_alloc.patch staging-vt6655-fix-memory-leak-in-vt6655_probe.patch --- diff --git a/queue-4.19/gpio-eic-sprd-fix-the-incorrect-eic-offset-when-toggling.patch b/queue-4.19/gpio-eic-sprd-fix-the-incorrect-eic-offset-when-toggling.patch new file mode 100644 index 00000000000..d00fe911a26 --- /dev/null +++ b/queue-4.19/gpio-eic-sprd-fix-the-incorrect-eic-offset-when-toggling.patch @@ -0,0 +1,42 @@ +From e91aafcb51f3c5001ae76c3ee027beb0b8506447 Mon Sep 17 00:00:00 2001 +From: Bruce Chen +Date: Mon, 16 Sep 2019 17:56:56 +0800 +Subject: gpio: eic: sprd: Fix the incorrect EIC offset when toggling + +From: Bruce Chen + +commit e91aafcb51f3c5001ae76c3ee027beb0b8506447 upstream. + +When toggling the level trigger to emulate the edge trigger, the +EIC offset is incorrect without adding the corresponding bank index, +thus fix it. + +Fixes: 7bf0d7f62282 ("gpio: eic: Add edge trigger emulation for EIC") +Cc: stable@vger.kernel.org +Signed-off-by: Bruce Chen +Signed-off-by: Baolin Wang +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/gpio-eic-sprd.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/gpio/gpio-eic-sprd.c ++++ b/drivers/gpio/gpio-eic-sprd.c +@@ -529,11 +529,12 @@ static void sprd_eic_handle_one_type(str + } + + for_each_set_bit(n, ®, SPRD_EIC_PER_BANK_NR) { +- girq = irq_find_mapping(chip->irq.domain, +- bank * SPRD_EIC_PER_BANK_NR + n); ++ u32 offset = bank * SPRD_EIC_PER_BANK_NR + n; ++ ++ girq = irq_find_mapping(chip->irq.domain, offset); + + generic_handle_irq(girq); +- sprd_eic_toggle_trigger(chip, girq, n); ++ sprd_eic_toggle_trigger(chip, girq, offset); + } + } + } diff --git a/queue-4.19/iio-adc-ad799x-fix-probe-error-handling.patch b/queue-4.19/iio-adc-ad799x-fix-probe-error-handling.patch new file mode 100644 index 00000000000..241c193ac3a --- /dev/null +++ b/queue-4.19/iio-adc-ad799x-fix-probe-error-handling.patch @@ -0,0 +1,39 @@ +From c62dd44901cfff12acc5792bf3d2dec20bcaf392 Mon Sep 17 00:00:00 2001 +From: Marco Felsch +Date: Tue, 17 Sep 2019 18:09:23 +0200 +Subject: iio: adc: ad799x: fix probe error handling + +From: Marco Felsch + +commit c62dd44901cfff12acc5792bf3d2dec20bcaf392 upstream. + +Since commit 0f7ddcc1bff1 ("iio:adc:ad799x: Write default config on probe +and reset alert status on probe") the error path is wrong since it +leaves the vref regulator on. Fix this by disabling both regulators. + +Fixes: 0f7ddcc1bff1 ("iio:adc:ad799x: Write default config on probe and reset alert status on probe") +Signed-off-by: Marco Felsch +Reviewed-by: Alexandru Ardelean +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/ad799x.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/iio/adc/ad799x.c ++++ b/drivers/iio/adc/ad799x.c +@@ -814,10 +814,10 @@ static int ad799x_probe(struct i2c_clien + + ret = ad799x_write_config(st, st->chip_config->default_config); + if (ret < 0) +- goto error_disable_reg; ++ goto error_disable_vref; + ret = ad799x_read_config(st); + if (ret < 0) +- goto error_disable_reg; ++ goto error_disable_vref; + st->config = ret; + + ret = iio_triggered_buffer_setup(indio_dev, NULL, diff --git a/queue-4.19/iio-adc-axp288-override-ts-pin-bias-current-for-some-models.patch b/queue-4.19/iio-adc-axp288-override-ts-pin-bias-current-for-some-models.patch new file mode 100644 index 00000000000..ea82568d6c7 --- /dev/null +++ b/queue-4.19/iio-adc-axp288-override-ts-pin-bias-current-for-some-models.patch @@ -0,0 +1,92 @@ +From 972917419a0ba25afbf69d5d8c9fa644d676f887 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sun, 15 Sep 2019 20:53:42 +0200 +Subject: iio: adc: axp288: Override TS pin bias current for some models +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +commit 972917419a0ba25afbf69d5d8c9fa644d676f887 upstream. + +Since commit 9bcf15f75cac ("iio: adc: axp288: Fix TS-pin handling") we +preserve the bias current set by the firmware at boot. This fixes issues +we were seeing on various models, but it seems our old hardcoded 80ųA bias +current was working around a firmware bug on at least one model laptop. + +In order to both have our cake and eat it, this commit adds a dmi based +list of models where we need to override the firmware set bias current and +adds the one model we now know needs this to it: The Lenovo Ideapad 100S +(11 inch version). + +Fixes: 9bcf15f75cac ("iio: adc: axp288: Fix TS-pin handling") +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=203829 +Signed-off-by: Hans de Goede +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/axp288_adc.c | 32 ++++++++++++++++++++++++++++++++ + 1 file changed, 32 insertions(+) + +--- a/drivers/iio/adc/axp288_adc.c ++++ b/drivers/iio/adc/axp288_adc.c +@@ -16,6 +16,7 @@ + * + */ + ++#include + #include + #include + #include +@@ -34,6 +35,11 @@ + #define AXP288_ADC_EN_MASK 0xF0 + #define AXP288_ADC_TS_ENABLE 0x01 + ++#define AXP288_ADC_TS_BIAS_MASK GENMASK(5, 4) ++#define AXP288_ADC_TS_BIAS_20UA (0 << 4) ++#define AXP288_ADC_TS_BIAS_40UA (1 << 4) ++#define AXP288_ADC_TS_BIAS_60UA (2 << 4) ++#define AXP288_ADC_TS_BIAS_80UA (3 << 4) + #define AXP288_ADC_TS_CURRENT_ON_OFF_MASK GENMASK(1, 0) + #define AXP288_ADC_TS_CURRENT_OFF (0 << 0) + #define AXP288_ADC_TS_CURRENT_ON_WHEN_CHARGING (1 << 0) +@@ -186,10 +192,36 @@ static int axp288_adc_read_raw(struct ii + return ret; + } + ++/* ++ * We rely on the machine's firmware to correctly setup the TS pin bias current ++ * at boot. This lists systems with broken fw where we need to set it ourselves. ++ */ ++static const struct dmi_system_id axp288_adc_ts_bias_override[] = { ++ { ++ /* Lenovo Ideapad 100S (11 inch) */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad 100S-11IBY"), ++ }, ++ .driver_data = (void *)(uintptr_t)AXP288_ADC_TS_BIAS_80UA, ++ }, ++ {} ++}; ++ + static int axp288_adc_initialize(struct axp288_adc_info *info) + { ++ const struct dmi_system_id *bias_override; + int ret, adc_enable_val; + ++ bias_override = dmi_first_match(axp288_adc_ts_bias_override); ++ if (bias_override) { ++ ret = regmap_update_bits(info->regmap, AXP288_ADC_TS_PIN_CTRL, ++ AXP288_ADC_TS_BIAS_MASK, ++ (uintptr_t)bias_override->driver_data); ++ if (ret) ++ return ret; ++ } ++ + /* + * Determine if the TS pin is enabled and set the TS current-source + * accordingly. diff --git a/queue-4.19/iio-adc-hx711-fix-bug-in-sampling-of-data.patch b/queue-4.19/iio-adc-hx711-fix-bug-in-sampling-of-data.patch new file mode 100644 index 00000000000..55a812960c9 --- /dev/null +++ b/queue-4.19/iio-adc-hx711-fix-bug-in-sampling-of-data.patch @@ -0,0 +1,75 @@ +From 4043ecfb5fc4355a090111e14faf7945ff0fdbd5 Mon Sep 17 00:00:00 2001 +From: Andreas Klinger +Date: Mon, 9 Sep 2019 14:37:21 +0200 +Subject: iio: adc: hx711: fix bug in sampling of data + +From: Andreas Klinger + +commit 4043ecfb5fc4355a090111e14faf7945ff0fdbd5 upstream. + +Fix bug in sampling function hx711_cycle() when interrupt occures while +PD_SCK is high. If PD_SCK is high for at least 60 us power down mode of +the sensor is entered which in turn leads to a wrong measurement. + +Switch off interrupts during a PD_SCK high period and move query of DOUT +to the latest point of time which is at the end of PD_SCK low period. + +This bug exists in the driver since it's initial addition. The more +interrupts on the system the higher is the probability that it happens. + +Fixes: c3b2fdd0ea7e ("iio: adc: hx711: Add IIO driver for AVIA HX711") +Signed-off-by: Andreas Klinger +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/hx711.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/iio/adc/hx711.c ++++ b/drivers/iio/adc/hx711.c +@@ -109,14 +109,14 @@ struct hx711_data { + + static int hx711_cycle(struct hx711_data *hx711_data) + { +- int val; ++ unsigned long flags; + + /* + * if preempted for more then 60us while PD_SCK is high: + * hx711 is going in reset + * ==> measuring is false + */ +- preempt_disable(); ++ local_irq_save(flags); + gpiod_set_value(hx711_data->gpiod_pd_sck, 1); + + /* +@@ -126,7 +126,6 @@ static int hx711_cycle(struct hx711_data + */ + ndelay(hx711_data->data_ready_delay_ns); + +- val = gpiod_get_value(hx711_data->gpiod_dout); + /* + * here we are not waiting for 0.2 us as suggested by the datasheet, + * because the oscilloscope showed in a test scenario +@@ -134,7 +133,7 @@ static int hx711_cycle(struct hx711_data + * and 0.56 us for PD_SCK low on TI Sitara with 800 MHz + */ + gpiod_set_value(hx711_data->gpiod_pd_sck, 0); +- preempt_enable(); ++ local_irq_restore(flags); + + /* + * make it a square wave for addressing cases with capacitance on +@@ -142,7 +141,8 @@ static int hx711_cycle(struct hx711_data + */ + ndelay(hx711_data->data_ready_delay_ns); + +- return val; ++ /* sample as late as possible */ ++ return gpiod_get_value(hx711_data->gpiod_dout); + } + + static int hx711_read(struct hx711_data *hx711_data) diff --git a/queue-4.19/iio-adc-stm32-adc-fix-a-race-when-using-several-adcs-with-dma-and-irq.patch b/queue-4.19/iio-adc-stm32-adc-fix-a-race-when-using-several-adcs-with-dma-and-irq.patch new file mode 100644 index 00000000000..2201cde62c0 --- /dev/null +++ b/queue-4.19/iio-adc-stm32-adc-fix-a-race-when-using-several-adcs-with-dma-and-irq.patch @@ -0,0 +1,129 @@ +From dcb10920179ab74caf88a6f2afadecfc2743b910 Mon Sep 17 00:00:00 2001 +From: Fabrice Gasnier +Date: Tue, 17 Sep 2019 14:38:16 +0200 +Subject: iio: adc: stm32-adc: fix a race when using several adcs with dma and irq + +From: Fabrice Gasnier + +commit dcb10920179ab74caf88a6f2afadecfc2743b910 upstream. + +End of conversion may be handled by using IRQ or DMA. There may be a +race when two conversions complete at the same time on several ADCs. +EOC can be read as 'set' for several ADCs, with: +- an ADC configured to use IRQs. EOCIE bit is set. The handler is normally + called in this case. +- an ADC configured to use DMA. EOCIE bit isn't set. EOC triggers the DMA + request instead. It's then automatically cleared by DMA read. But the + handler gets called due to status bit is temporarily set (IRQ triggered + by the other ADC). +So both EOC status bit in CSR and EOCIE control bit must be checked +before invoking the interrupt handler (e.g. call ISR only for +IRQ-enabled ADCs). + +Fixes: 2763ea0585c9 ("iio: adc: stm32: add optional dma support") + +Signed-off-by: Fabrice Gasnier +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/stm32-adc-core.c | 43 ++++++++++++++++++++++++++++++++++++--- + drivers/iio/adc/stm32-adc-core.h | 1 + 2 files changed, 41 insertions(+), 3 deletions(-) + +--- a/drivers/iio/adc/stm32-adc-core.c ++++ b/drivers/iio/adc/stm32-adc-core.c +@@ -54,12 +54,16 @@ + * @eoc1: adc1 end of conversion flag in @csr + * @eoc2: adc2 end of conversion flag in @csr + * @eoc3: adc3 end of conversion flag in @csr ++ * @ier: interrupt enable register offset for each adc ++ * @eocie_msk: end of conversion interrupt enable mask in @ier + */ + struct stm32_adc_common_regs { + u32 csr; + u32 eoc1_msk; + u32 eoc2_msk; + u32 eoc3_msk; ++ u32 ier; ++ u32 eocie_msk; + }; + + struct stm32_adc_priv; +@@ -268,6 +272,8 @@ static const struct stm32_adc_common_reg + .eoc1_msk = STM32F4_EOC1, + .eoc2_msk = STM32F4_EOC2, + .eoc3_msk = STM32F4_EOC3, ++ .ier = STM32F4_ADC_CR1, ++ .eocie_msk = STM32F4_EOCIE, + }; + + /* STM32H7 common registers definitions */ +@@ -275,8 +281,24 @@ static const struct stm32_adc_common_reg + .csr = STM32H7_ADC_CSR, + .eoc1_msk = STM32H7_EOC_MST, + .eoc2_msk = STM32H7_EOC_SLV, ++ .ier = STM32H7_ADC_IER, ++ .eocie_msk = STM32H7_EOCIE, + }; + ++static const unsigned int stm32_adc_offset[STM32_ADC_MAX_ADCS] = { ++ 0, STM32_ADC_OFFSET, STM32_ADC_OFFSET * 2, ++}; ++ ++static unsigned int stm32_adc_eoc_enabled(struct stm32_adc_priv *priv, ++ unsigned int adc) ++{ ++ u32 ier, offset = stm32_adc_offset[adc]; ++ ++ ier = readl_relaxed(priv->common.base + offset + priv->cfg->regs->ier); ++ ++ return ier & priv->cfg->regs->eocie_msk; ++} ++ + /* ADC common interrupt for all instances */ + static void stm32_adc_irq_handler(struct irq_desc *desc) + { +@@ -287,13 +309,28 @@ static void stm32_adc_irq_handler(struct + chained_irq_enter(chip, desc); + status = readl_relaxed(priv->common.base + priv->cfg->regs->csr); + +- if (status & priv->cfg->regs->eoc1_msk) ++ /* ++ * End of conversion may be handled by using IRQ or DMA. There may be a ++ * race here when two conversions complete at the same time on several ++ * ADCs. EOC may be read 'set' for several ADCs, with: ++ * - an ADC configured to use DMA (EOC triggers the DMA request, and ++ * is then automatically cleared by DR read in hardware) ++ * - an ADC configured to use IRQs (EOCIE bit is set. The handler must ++ * be called in this case) ++ * So both EOC status bit in CSR and EOCIE control bit must be checked ++ * before invoking the interrupt handler (e.g. call ISR only for ++ * IRQ-enabled ADCs). ++ */ ++ if (status & priv->cfg->regs->eoc1_msk && ++ stm32_adc_eoc_enabled(priv, 0)) + generic_handle_irq(irq_find_mapping(priv->domain, 0)); + +- if (status & priv->cfg->regs->eoc2_msk) ++ if (status & priv->cfg->regs->eoc2_msk && ++ stm32_adc_eoc_enabled(priv, 1)) + generic_handle_irq(irq_find_mapping(priv->domain, 1)); + +- if (status & priv->cfg->regs->eoc3_msk) ++ if (status & priv->cfg->regs->eoc3_msk && ++ stm32_adc_eoc_enabled(priv, 2)) + generic_handle_irq(irq_find_mapping(priv->domain, 2)); + + chained_irq_exit(chip, desc); +--- a/drivers/iio/adc/stm32-adc-core.h ++++ b/drivers/iio/adc/stm32-adc-core.h +@@ -25,6 +25,7 @@ + * -------------------------------------------------------- + */ + #define STM32_ADC_MAX_ADCS 3 ++#define STM32_ADC_OFFSET 0x100 + #define STM32_ADCX_COMN_OFFSET 0x300 + + /** diff --git a/queue-4.19/series b/queue-4.19/series index 21681006925..3160357d8a1 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -39,3 +39,10 @@ usb-legousbtower-fix-open-after-failed-reset-request.patch usb-legousbtower-fix-use-after-free-on-release.patch mei-me-add-comet-point-lake-lp-device-ids.patch mei-avoid-fw-version-request-on-ibex-peak-and-earlier.patch +gpio-eic-sprd-fix-the-incorrect-eic-offset-when-toggling.patch +staging-fbtft-fix-memory-leak-in-fbtft_framebuffer_alloc.patch +staging-vt6655-fix-memory-leak-in-vt6655_probe.patch +iio-adc-hx711-fix-bug-in-sampling-of-data.patch +iio-adc-ad799x-fix-probe-error-handling.patch +iio-adc-axp288-override-ts-pin-bias-current-for-some-models.patch +iio-adc-stm32-adc-fix-a-race-when-using-several-adcs-with-dma-and-irq.patch diff --git a/queue-4.19/staging-fbtft-fix-memory-leak-in-fbtft_framebuffer_alloc.patch b/queue-4.19/staging-fbtft-fix-memory-leak-in-fbtft_framebuffer_alloc.patch new file mode 100644 index 00000000000..fea0cc48885 --- /dev/null +++ b/queue-4.19/staging-fbtft-fix-memory-leak-in-fbtft_framebuffer_alloc.patch @@ -0,0 +1,55 @@ +From 5bdea6060618cfcf1459dca137e89aee038ac8b9 Mon Sep 17 00:00:00 2001 +From: Navid Emamdoost +Date: Sun, 29 Sep 2019 22:09:45 -0500 +Subject: Staging: fbtft: fix memory leak in fbtft_framebuffer_alloc + +From: Navid Emamdoost + +commit 5bdea6060618cfcf1459dca137e89aee038ac8b9 upstream. + +In fbtft_framebuffer_alloc the error handling path should take care of +releasing frame buffer after it is allocated via framebuffer_alloc, too. +Therefore, in two failure cases the goto destination is changed to +address this issue. + +Fixes: c296d5f9957c ("staging: fbtft: core support") +Signed-off-by: Navid Emamdoost +Reviewed-by: Dan Carpenter +Cc: stable +Link: https://lore.kernel.org/r/20190930030949.28615-1-navid.emamdoost@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/fbtft/fbtft-core.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/staging/fbtft/fbtft-core.c ++++ b/drivers/staging/fbtft/fbtft-core.c +@@ -819,7 +819,7 @@ struct fb_info *fbtft_framebuffer_alloc( + if (par->gamma.curves && gamma) { + if (fbtft_gamma_parse_str(par, par->gamma.curves, gamma, + strlen(gamma))) +- goto alloc_fail; ++ goto release_framebuf; + } + + /* Transmit buffer */ +@@ -836,7 +836,7 @@ struct fb_info *fbtft_framebuffer_alloc( + if (txbuflen > 0) { + txbuf = devm_kzalloc(par->info->device, txbuflen, GFP_KERNEL); + if (!txbuf) +- goto alloc_fail; ++ goto release_framebuf; + par->txbuf.buf = txbuf; + par->txbuf.len = txbuflen; + } +@@ -872,6 +872,9 @@ struct fb_info *fbtft_framebuffer_alloc( + + return info; + ++release_framebuf: ++ framebuffer_release(info); ++ + alloc_fail: + vfree(vmem); + diff --git a/queue-4.19/staging-vt6655-fix-memory-leak-in-vt6655_probe.patch b/queue-4.19/staging-vt6655-fix-memory-leak-in-vt6655_probe.patch new file mode 100644 index 00000000000..6ce265288a1 --- /dev/null +++ b/queue-4.19/staging-vt6655-fix-memory-leak-in-vt6655_probe.patch @@ -0,0 +1,37 @@ +From 80b15db5e1e9c3300de299b2d43d1aafb593e6ac Mon Sep 17 00:00:00 2001 +From: Navid Emamdoost +Date: Fri, 4 Oct 2019 15:03:15 -0500 +Subject: staging: vt6655: Fix memory leak in vt6655_probe + +From: Navid Emamdoost + +commit 80b15db5e1e9c3300de299b2d43d1aafb593e6ac upstream. + +In vt6655_probe, if vnt_init() fails the cleanup code needs to be called +like other error handling cases. The call to device_free_info() is +added. + +Fixes: 67013f2c0e58 ("staging: vt6655: mac80211 conversion add main mac80211 functions") +Signed-off-by: Navid Emamdoost +Cc: stable +Link: https://lore.kernel.org/r/20191004200319.22394-1-navid.emamdoost@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6655/device_main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/staging/vt6655/device_main.c ++++ b/drivers/staging/vt6655/device_main.c +@@ -1755,8 +1755,10 @@ vt6655_probe(struct pci_dev *pcid, const + + priv->hw->max_signal = 100; + +- if (vnt_init(priv)) ++ if (vnt_init(priv)) { ++ device_free_info(priv); + return -ENODEV; ++ } + + device_print_info(priv); + pci_set_drvdata(pcid, priv);