From: Greg Kroah-Hartman Date: Mon, 25 Jul 2016 00:30:51 +0000 (-0700) Subject: 4.6-stable patches X-Git-Tag: v4.6.5~11 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f969d1bae28906ac2ae6b47cbd046594c0503a5e;p=thirdparty%2Fkernel%2Fstable-queue.git 4.6-stable patches added patches: alsa-au88x0-fix-calculation-in-vortex_wtdma_bufshift.patch alsa-ctl-stop-notification-after-disconnection.patch alsa-dummy-fix-a-use-after-free-at-closing.patch alsa-echoaudio-fix-memory-allocation.patch alsa-hda-add-amd-stoney-pci-id-with-proper-driver-caps.patch alsa-hda-add-pci-id-for-kabylake-h.patch alsa-hda-fix-read-before-array-start.patch alsa-hda-fix-the-headset-mic-jack-detection-on-dell-machine.patch alsa-hda-fix-use-after-free-after-module-unload.patch alsa-hda-realtek-add-lenovo-l460-to-docking-unit-fixup.patch alsa-hda-realtek-add-new-pin-definition-in-alc225-pin-quirk-table.patch alsa-hda-realtek-add-two-more-thinkpad-ids-5050-5053-for-tpt460-fixup.patch alsa-hdac_regmap-fix-the-register-access-for-runtime-pm.patch alsa-pcm-free-chmap-at-pcm-free-callback-too.patch alsa-timer-fix-negative-queue-usage-by-racy-accesses.patch alsa-usb-audio-fix-quirks-code-is-not-called.patch arm-dts-armada-38x-fix-mbus_id-for-crypto-sram-on-armada-385-linksys.patch arm-mvebu-fix-hw-i-o-coherency-related-deadlocks.patch arm-sunxi-dt-make-the-chip-inherit-from-allwinner-sun5i-a13.patch hwmon-dell-smm-cache-fan_type-calls-and-change-fan-detection.patch hwmon-dell-smm-disallow-fan_type-calls-on-broken-machines.patch hwmon-dell-smm-restrict-fan-control-and-serial-number-to-cap_sys_admin-by-default.patch iio-accel-kxsd9-fix-the-usage-of-spi_w8r8.patch iio-ad7266-fix-broken-regulator-error-handling.patch iio-ad7266-fix-probe-deferral-for-vref.patch iio-ad7266-fix-support-for-optional-regulators.patch iio-fix-error-handling-in-iio_trigger_attach_poll_func.patch iio-hudmidity-hdc100x-fix-incorrect-shifting-and-scaling.patch iio-humidity-hdc100x-correct-humidity-integration-time-mask.patch iio-humidity-hdc100x-fix-iio_temp-channel-reporting.patch iio-light-apds9960-add-the-missing-dev.parent.patch iio-proximity-as3935-correct-iio_chan_info_raw-output.patch iio-proximity-as3935-fix-buffer-stack-trashing.patch iio-proximity-as3935-remove-triggered-buffer-processing.patch iio-st_pressure-fix-sampling-gains-bring-inline-with-abi.patch ovl-copy-up-underlying-inode-s-i_mode-to-overlay-inode.patch ovl-fix-dentry-leak-for-default_permissions.patch ovl-get_write_access-in-truncate.patch ovl-handle-attr_kill.patch ovl-verify-upper-dentry-in-ovl_remove_and_whiteout.patch staging-iio-accel-fix-error-check.patch tty-vt-fix-soft-lockup-in-fbcon-cursor-blink-timer.patch tty-vt-keyboard-fix-oob-access-in-do_compute_shiftstate.patch xen-balloon-fix-declared-but-not-defined-warning.patch --- diff --git a/queue-4.6/alsa-au88x0-fix-calculation-in-vortex_wtdma_bufshift.patch b/queue-4.6/alsa-au88x0-fix-calculation-in-vortex_wtdma_bufshift.patch new file mode 100644 index 00000000000..683a16579e0 --- /dev/null +++ b/queue-4.6/alsa-au88x0-fix-calculation-in-vortex_wtdma_bufshift.patch @@ -0,0 +1,35 @@ +From 62db7152c924e4c060e42b34a69cd39658e8a0dc Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 29 Jun 2016 15:23:08 +0200 +Subject: ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift() + +From: Takashi Iwai + +commit 62db7152c924e4c060e42b34a69cd39658e8a0dc upstream. + +vortex_wtdma_bufshift() function does calculate the page index +wrongly, first masking then shift, which always results in zero. +The proper computation is to first shift, then mask. + +Reported-by: Dan Carpenter +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/au88x0/au88x0_core.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/sound/pci/au88x0/au88x0_core.c ++++ b/sound/pci/au88x0/au88x0_core.c +@@ -1444,9 +1444,8 @@ static int vortex_wtdma_bufshift(vortex_ + int page, p, pp, delta, i; + + page = +- (hwread(vortex->mmio, VORTEX_WTDMA_STAT + (wtdma << 2)) & +- WT_SUBBUF_MASK) +- >> WT_SUBBUF_SHIFT; ++ (hwread(vortex->mmio, VORTEX_WTDMA_STAT + (wtdma << 2)) ++ >> WT_SUBBUF_SHIFT) & WT_SUBBUF_MASK; + if (dma->nr_periods >= 4) + delta = (page - dma->period_real) & 3; + else { diff --git a/queue-4.6/alsa-ctl-stop-notification-after-disconnection.patch b/queue-4.6/alsa-ctl-stop-notification-after-disconnection.patch new file mode 100644 index 00000000000..fc22d6a07f4 --- /dev/null +++ b/queue-4.6/alsa-ctl-stop-notification-after-disconnection.patch @@ -0,0 +1,37 @@ +From f388cdcdd160687c6650833f286b9c89c50960ff Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 8 Jul 2016 08:05:19 +0200 +Subject: ALSA: ctl: Stop notification after disconnection + +From: Takashi Iwai + +commit f388cdcdd160687c6650833f286b9c89c50960ff upstream. + +snd_ctl_remove() has a notification for the removal event. It's +superfluous when done during the device got disconnected. Although +the notification itself is mostly harmless, it may potentially be +harmful, and should be suppressed. Actually some components PCM may +free ctl elements during the disconnect or free callbacks, thus it's +no theoretical issue. + +This patch adds the check of card->shutdown flag for avoiding +unnecessary notifications after (or during) the disconnect. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/control.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/core/control.c ++++ b/sound/core/control.c +@@ -160,6 +160,8 @@ void snd_ctl_notify(struct snd_card *car + + if (snd_BUG_ON(!card || !id)) + return; ++ if (card->shutdown) ++ return; + read_lock(&card->ctl_files_rwlock); + #if IS_ENABLED(CONFIG_SND_MIXER_OSS) + card->mixer_oss_change_count++; diff --git a/queue-4.6/alsa-dummy-fix-a-use-after-free-at-closing.patch b/queue-4.6/alsa-dummy-fix-a-use-after-free-at-closing.patch new file mode 100644 index 00000000000..6466aa04070 --- /dev/null +++ b/queue-4.6/alsa-dummy-fix-a-use-after-free-at-closing.patch @@ -0,0 +1,72 @@ +From d5dbbe6569481bf12dcbe3e12cff72c5f78d272c Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 24 Jun 2016 15:15:26 +0200 +Subject: ALSA: dummy: Fix a use-after-free at closing + +From: Takashi Iwai + +commit d5dbbe6569481bf12dcbe3e12cff72c5f78d272c upstream. + +syzkaller fuzzer spotted a potential use-after-free case in snd-dummy +driver when hrtimer is used as backend: +> ================================================================== +> BUG: KASAN: use-after-free in rb_erase+0x1b17/0x2010 at addr ffff88005e5b6f68 +> Read of size 8 by task syz-executor/8984 +> ============================================================================= +> BUG kmalloc-192 (Not tainted): kasan: bad access detected +> ----------------------------------------------------------------------------- +> +> Disabling lock debugging due to kernel taint +> INFO: Allocated in 0xbbbbbbbbbbbbbbbb age=18446705582212484632 +> .... +> [< none >] dummy_hrtimer_create+0x49/0x1a0 sound/drivers/dummy.c:464 +> .... +> INFO: Freed in 0xfffd8e09 age=18446705496313138713 cpu=2164287125 pid=-1 +> [< none >] dummy_hrtimer_free+0x68/0x80 sound/drivers/dummy.c:481 +> .... +> Call Trace: +> [] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:333 +> [< inline >] rb_set_parent include/linux/rbtree_augmented.h:111 +> [< inline >] __rb_erase_augmented include/linux/rbtree_augmented.h:218 +> [] rb_erase+0x1b17/0x2010 lib/rbtree.c:427 +> [] timerqueue_del+0x78/0x170 lib/timerqueue.c:86 +> [] __remove_hrtimer+0x90/0x220 kernel/time/hrtimer.c:903 +> [< inline >] remove_hrtimer kernel/time/hrtimer.c:945 +> [] hrtimer_try_to_cancel+0x22a/0x570 kernel/time/hrtimer.c:1046 +> [] hrtimer_cancel+0x22/0x40 kernel/time/hrtimer.c:1066 +> [] dummy_hrtimer_stop+0x91/0xb0 sound/drivers/dummy.c:417 +> [] dummy_pcm_trigger+0x17f/0x1e0 sound/drivers/dummy.c:507 +> [] snd_pcm_do_stop+0x160/0x1b0 sound/core/pcm_native.c:1106 +> [] snd_pcm_action_single+0x76/0x120 sound/core/pcm_native.c:956 +> [] snd_pcm_action+0x231/0x290 sound/core/pcm_native.c:974 +> [< inline >] snd_pcm_stop sound/core/pcm_native.c:1139 +> [] snd_pcm_drop+0x12d/0x1d0 sound/core/pcm_native.c:1784 +> [] snd_pcm_common_ioctl1+0xfae/0x2150 sound/core/pcm_native.c:2805 +> [] snd_pcm_capture_ioctl1+0x2a1/0x5e0 sound/core/pcm_native.c:2976 +> [] snd_pcm_kernel_ioctl+0x11c/0x160 sound/core/pcm_native.c:3020 +> [] snd_pcm_oss_sync+0x3a4/0xa30 sound/core/oss/pcm_oss.c:1693 +> [] snd_pcm_oss_release+0x1ad/0x280 sound/core/oss/pcm_oss.c:2483 +> ..... + +A workaround is to call hrtimer_cancel() in dummy_hrtimer_sync() which +is called certainly before other blocking ops. + +Reported-by: Dmitry Vyukov +Tested-by: Dmitry Vyukov +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/drivers/dummy.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/drivers/dummy.c ++++ b/sound/drivers/dummy.c +@@ -420,6 +420,7 @@ static int dummy_hrtimer_stop(struct snd + + static inline void dummy_hrtimer_sync(struct dummy_hrtimer_pcm *dpcm) + { ++ hrtimer_cancel(&dpcm->timer); + tasklet_kill(&dpcm->tasklet); + } + diff --git a/queue-4.6/alsa-echoaudio-fix-memory-allocation.patch b/queue-4.6/alsa-echoaudio-fix-memory-allocation.patch new file mode 100644 index 00000000000..6f7814f36d9 --- /dev/null +++ b/queue-4.6/alsa-echoaudio-fix-memory-allocation.patch @@ -0,0 +1,39 @@ +From 9c6795a9b3cbb56a9fbfaf43909c5c22999ba317 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Mon, 27 Jun 2016 21:06:51 +0200 +Subject: ALSA: echoaudio: Fix memory allocation + +From: Christophe JAILLET + +commit 9c6795a9b3cbb56a9fbfaf43909c5c22999ba317 upstream. + +'commpage_bak' is allocated with 'sizeof(struct echoaudio)' bytes. +We then copy 'sizeof(struct comm_page)' bytes in it. +On my system, smatch complains because one is 2960 and the other is 3072. + +This would result in memory corruption or a oops. + +Signed-off-by: Christophe JAILLET +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/echoaudio/echoaudio.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/pci/echoaudio/echoaudio.c ++++ b/sound/pci/echoaudio/echoaudio.c +@@ -2200,11 +2200,11 @@ static int snd_echo_resume(struct device + u32 pipe_alloc_mask; + int err; + +- commpage_bak = kmalloc(sizeof(struct echoaudio), GFP_KERNEL); ++ commpage_bak = kmalloc(sizeof(*commpage), GFP_KERNEL); + if (commpage_bak == NULL) + return -ENOMEM; + commpage = chip->comm_page; +- memcpy(commpage_bak, commpage, sizeof(struct comm_page)); ++ memcpy(commpage_bak, commpage, sizeof(*commpage)); + + err = init_hw(chip, chip->pci->device, chip->pci->subsystem_device); + if (err < 0) { diff --git a/queue-4.6/alsa-hda-add-amd-stoney-pci-id-with-proper-driver-caps.patch b/queue-4.6/alsa-hda-add-amd-stoney-pci-id-with-proper-driver-caps.patch new file mode 100644 index 00000000000..e483fd53ba5 --- /dev/null +++ b/queue-4.6/alsa-hda-add-amd-stoney-pci-id-with-proper-driver-caps.patch @@ -0,0 +1,32 @@ +From d716fb03f76411fc7e138692e33b749cada5c094 Mon Sep 17 00:00:00 2001 +From: Awais Belal +Date: Tue, 12 Jul 2016 15:21:28 +0500 +Subject: ALSA: hda: add AMD Stoney PCI ID with proper driver caps + +From: Awais Belal + +commit d716fb03f76411fc7e138692e33b749cada5c094 upstream. + +This allows the device to correctly show up as ATI HDMI +rather than a generic one and allows the driver to use +the available caps. + +Signed-off-by: Awais Belal +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2269,6 +2269,8 @@ static const struct pci_device_id azx_id + .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS }, + { PCI_DEVICE(0x1002, 0x157a), + .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS }, ++ { PCI_DEVICE(0x1002, 0x15b3), ++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS }, + { PCI_DEVICE(0x1002, 0x793b), + .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI }, + { PCI_DEVICE(0x1002, 0x7919), diff --git a/queue-4.6/alsa-hda-add-pci-id-for-kabylake-h.patch b/queue-4.6/alsa-hda-add-pci-id-for-kabylake-h.patch new file mode 100644 index 00000000000..41c5d631b3b --- /dev/null +++ b/queue-4.6/alsa-hda-add-pci-id-for-kabylake-h.patch @@ -0,0 +1,44 @@ +From 6858107e78b4ecb9f244db814ffbdba1b5ce759b Mon Sep 17 00:00:00 2001 +From: Vinod Koul +Date: Wed, 29 Jun 2016 10:27:52 +0530 +Subject: ALSA: hda - Add PCI ID for Kabylake-H + +From: Vinod Koul + +commit 6858107e78b4ecb9f244db814ffbdba1b5ce759b upstream. + +Kabylake-H shows up as PCI ID 0xa2f0. We missed adding this +earlier with other KBL IDs. + +Signed-off-by: Vinod Koul +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -367,9 +367,10 @@ enum { + #define IS_SKL_LP(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d70) + #define IS_KBL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa171) + #define IS_KBL_LP(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d71) ++#define IS_KBL_H(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa2f0) + #define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98) + #define IS_SKL_PLUS(pci) (IS_SKL(pci) || IS_SKL_LP(pci) || IS_BXT(pci)) || \ +- IS_KBL(pci) || IS_KBL_LP(pci) ++ IS_KBL(pci) || IS_KBL_LP(pci) || IS_KBL_H(pci) + + static char *driver_short_names[] = { + [AZX_DRIVER_ICH] = "HDA Intel", +@@ -2190,6 +2191,9 @@ static const struct pci_device_id azx_id + /* Kabylake-LP */ + { PCI_DEVICE(0x8086, 0x9d71), + .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE }, ++ /* Kabylake-H */ ++ { PCI_DEVICE(0x8086, 0xa2f0), ++ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE }, + /* Broxton-P(Apollolake) */ + { PCI_DEVICE(0x8086, 0x5a98), + .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_BROXTON }, diff --git a/queue-4.6/alsa-hda-fix-read-before-array-start.patch b/queue-4.6/alsa-hda-fix-read-before-array-start.patch new file mode 100644 index 00000000000..b6181ac91f2 --- /dev/null +++ b/queue-4.6/alsa-hda-fix-read-before-array-start.patch @@ -0,0 +1,77 @@ +From 81e43960dce1c8e58e682fb3ec26c1d8f83a9afc Mon Sep 17 00:00:00 2001 +From: Bob Copeland +Date: Sat, 25 Jun 2016 07:58:45 -0400 +Subject: ALSA: hda - fix read before array start + +From: Bob Copeland + +commit 81e43960dce1c8e58e682fb3ec26c1d8f83a9afc upstream. + +UBSAN reports the following warning from accessing path->path[-1] +in set_path_power(): + +[ 16.078040] ================================================================================ +[ 16.078124] UBSAN: Undefined behaviour in sound/pci/hda/hda_generic.c:3981:17 +[ 16.078198] index -1 is out of range for type 'hda_nid_t [10]' +[ 16.078270] CPU: 2 PID: 1738 Comm: modprobe Not tainted 4.7.0-rc1-wt+ #47 +[ 16.078274] Hardware name: LENOVO 3443CTO/3443CTO, BIOS G6ET23WW (1.02 ) 08/14/2012 +[ 16.078278] ffff8800cb246000 ffff8800cb3638b8 ffffffff815c4fe3 0000000000000032 +[ 16.078286] ffff8800cb3638e0 ffffffffffffffff ffff8800cb3638d0 ffffffff8162443d +[ 16.078294] ffffffffa0894200 ffff8800cb363920 ffffffff81624af7 0000000000000292 +[ 16.078302] Call Trace: +[ 16.078311] [] dump_stack+0x86/0xd3 +[ 16.078317] [] ubsan_epilogue+0xd/0x40 +[ 16.078324] [] __ubsan_handle_out_of_bounds+0x67/0x70 +[ 16.078335] [] set_path_power+0x1bf/0x230 [snd_hda_codec_generic] +[ 16.078344] [] add_pin_power_ctls+0x8d/0xc0 [snd_hda_codec_generic] +[ 16.078352] [] ? pin_power_down_callback+0x20/0x20 [snd_hda_codec_generic] +[ 16.078360] [] add_all_pin_power_ctls+0x107/0x150 [snd_hda_codec_generic] +[ 16.078370] [] snd_hda_gen_parse_auto_config+0x2d73/0x49e0 [snd_hda_codec_generic] +[ 16.078376] [] ? trace_hardirqs_on_caller+0x1b0/0x2c0 +[ 16.078390] [] alc_parse_auto_config+0x147/0x310 [snd_hda_codec_realtek] +[ 16.078402] [] patch_alc269+0x23a/0x560 [snd_hda_codec_realtek] +[ 16.078417] [] hda_codec_driver_probe+0xa4/0x1a0 [snd_hda_codec] +[ 16.078424] [] driver_probe_device+0x101/0x380 +[ 16.078430] [] __driver_attach+0xb9/0x100 +[ 16.078438] [] ? driver_probe_device+0x380/0x380 +[ 16.078444] [] bus_for_each_dev+0x70/0xc0 +[ 16.078449] [] driver_attach+0x27/0x50 +[ 16.078454] [] bus_add_driver+0x166/0x2c0 +[ 16.078460] [] ? 0xffffffffa0369000 +[ 16.078465] [] driver_register+0x7d/0x130 +[ 16.078477] [] __hda_codec_driver_register+0x6f/0x90 [snd_hda_codec] +[ 16.078488] [] realtek_driver_init+0x1e/0x1000 [snd_hda_codec_realtek] +[ 16.078493] [] do_one_initcall+0x4e/0x1d0 +[ 16.078499] [] ? rcu_read_lock_sched_held+0x6d/0x80 +[ 16.078504] [] ? kmem_cache_alloc_trace+0x391/0x560 +[ 16.078510] [] ? do_init_module+0x28/0x273 +[ 16.078515] [] do_init_module+0x9b/0x273 +[ 16.078522] [] load_module+0x20b2/0x3410 +[ 16.078527] [] ? m_show+0x210/0x210 +[ 16.078533] [] ? kernel_read+0x66/0xe0 +[ 16.078541] [] SYSC_finit_module+0xba/0xc0 +[ 16.078547] [] SyS_finit_module+0xe/0x10 +[ 16.078552] [] entry_SYSCALL_64_fastpath+0x1f/0xbd +[ 16.078556] ================================================================================ + +Fix by checking path->depth before use. + +Signed-off-by: Bob Copeland +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_generic.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/hda_generic.c ++++ b/sound/pci/hda/hda_generic.c +@@ -3977,6 +3977,8 @@ static hda_nid_t set_path_power(struct h + + for (n = 0; n < spec->paths.used; n++) { + path = snd_array_elem(&spec->paths, n); ++ if (!path->depth) ++ continue; + if (path->path[0] == nid || + path->path[path->depth - 1] == nid) { + bool pin_old = path->pin_enabled; diff --git a/queue-4.6/alsa-hda-fix-the-headset-mic-jack-detection-on-dell-machine.patch b/queue-4.6/alsa-hda-fix-the-headset-mic-jack-detection-on-dell-machine.patch new file mode 100644 index 00000000000..1ad49fbfaa9 --- /dev/null +++ b/queue-4.6/alsa-hda-fix-the-headset-mic-jack-detection-on-dell-machine.patch @@ -0,0 +1,38 @@ +From f83c32925d45926cd0e0f18bf28e6039116c4486 Mon Sep 17 00:00:00 2001 +From: Woodrow Shen +Date: Fri, 24 Jun 2016 15:58:34 +0800 +Subject: ALSA: hda - Fix the headset mic jack detection on Dell machine + +From: Woodrow Shen + +commit f83c32925d45926cd0e0f18bf28e6039116c4486 upstream. + +The new Dell laptop with codec 3246 can't detect headset mic when +headset was inserted on the machine. So adding pin configurations +into quirk table makes headset mic work correctly. + +Codec: Realtek ALC3246 +Vendor Id: 0x10ec0256 +Subsystem Id: 0x10280781 + +Signed-off-by: Woodrow Shen +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5832,6 +5832,10 @@ static const struct snd_hda_pin_quirk al + {0x14, 0x90170120}, + {0x21, 0x02211030}), + SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, ++ {0x12, 0x90a60170}, ++ {0x14, 0x90170120}, ++ {0x21, 0x02211030}), ++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC256_STANDARD_PINS), + SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4, + {0x12, 0x90a60130}, diff --git a/queue-4.6/alsa-hda-fix-use-after-free-after-module-unload.patch b/queue-4.6/alsa-hda-fix-use-after-free-after-module-unload.patch new file mode 100644 index 00000000000..215f77f519b --- /dev/null +++ b/queue-4.6/alsa-hda-fix-use-after-free-after-module-unload.patch @@ -0,0 +1,37 @@ +From ab58d8cc870ef3f0771c197700441936898d1f1d Mon Sep 17 00:00:00 2001 +From: Peter Wu +Date: Mon, 11 Jul 2016 19:51:06 +0200 +Subject: ALSA: hda - fix use-after-free after module unload + +From: Peter Wu + +commit ab58d8cc870ef3f0771c197700441936898d1f1d upstream. + +register_vga_switcheroo() sets the PM ops from the hda structure which +is freed later in azx_free. Make sure that these ops are cleared. + +Caught by KASAN, initially noticed due to a general protection fault. + +Fixes: 246efa4a072f ("snd/hda: add runtime suspend/resume on optimus support (v4)") +Signed-off-by: Peter Wu +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -1218,8 +1218,10 @@ static int azx_free(struct azx *chip) + if (use_vga_switcheroo(hda)) { + if (chip->disabled && hda->probe_continued) + snd_hda_unlock_devices(&chip->bus); +- if (hda->vga_switcheroo_registered) ++ if (hda->vga_switcheroo_registered) { + vga_switcheroo_unregister_client(chip->pci); ++ vga_switcheroo_fini_domain_pm_ops(chip->card->dev); ++ } + } + + if (bus->chip_init) { diff --git a/queue-4.6/alsa-hda-realtek-add-lenovo-l460-to-docking-unit-fixup.patch b/queue-4.6/alsa-hda-realtek-add-lenovo-l460-to-docking-unit-fixup.patch new file mode 100644 index 00000000000..260226bf73b --- /dev/null +++ b/queue-4.6/alsa-hda-realtek-add-lenovo-l460-to-docking-unit-fixup.patch @@ -0,0 +1,30 @@ +From 9cd25743765cfe851aed8d655a62d60156aed293 Mon Sep 17 00:00:00 2001 +From: Torsten Hilbrich +Date: Tue, 5 Jul 2016 10:40:22 +0200 +Subject: ALSA: hda/realtek: Add Lenovo L460 to docking unit fixup + +From: Torsten Hilbrich + +commit 9cd25743765cfe851aed8d655a62d60156aed293 upstream. + +This solves the issue that a headphone is not working on the docking +unit. + +Signed-off-by: Torsten Hilbrich +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5651,6 +5651,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x17aa, 0x504a, "ThinkPad X260", ALC292_FIXUP_TPT440_DOCK), + SND_PCI_QUIRK(0x17aa, 0x504b, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE), + SND_PCI_QUIRK(0x17aa, 0x5050, "Thinkpad T560p", ALC292_FIXUP_TPT460), ++ SND_PCI_QUIRK(0x17aa, 0x5051, "Thinkpad L460", ALC292_FIXUP_TPT460), + SND_PCI_QUIRK(0x17aa, 0x5053, "Thinkpad T460", ALC292_FIXUP_TPT460), + SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K), diff --git a/queue-4.6/alsa-hda-realtek-add-new-pin-definition-in-alc225-pin-quirk-table.patch b/queue-4.6/alsa-hda-realtek-add-new-pin-definition-in-alc225-pin-quirk-table.patch new file mode 100644 index 00000000000..3d373a95f42 --- /dev/null +++ b/queue-4.6/alsa-hda-realtek-add-new-pin-definition-in-alc225-pin-quirk-table.patch @@ -0,0 +1,56 @@ +From 8a132099f080d7384bb6ab4cc168f76cb4b47d08 Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Fri, 8 Jul 2016 14:26:57 +0800 +Subject: ALSA: hda/realtek - add new pin definition in alc225 pin quirk table + +From: Hui Wang + +commit 8a132099f080d7384bb6ab4cc168f76cb4b47d08 upstream. + +We have some Dell laptops which can't detect headset mic, the machines +use the codec ALC225, they have some new pin configuration values, +after adding them in the alc225 pin quirk table, they work well. + +Signed-off-by: Hui Wang +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5738,7 +5738,6 @@ static const struct hda_model_fixup alc2 + {} + }; + #define ALC225_STANDARD_PINS \ +- {0x12, 0xb7a60130}, \ + {0x21, 0x04211020} + + #define ALC256_STANDARD_PINS \ +@@ -5763,10 +5762,24 @@ static const struct hda_model_fixup alc2 + static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC225_STANDARD_PINS, ++ {0x12, 0xb7a60130}, + {0x14, 0x901701a0}), + SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC225_STANDARD_PINS, ++ {0x12, 0xb7a60130}, + {0x14, 0x901701b0}), ++ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, ++ ALC225_STANDARD_PINS, ++ {0x12, 0xb7a60150}, ++ {0x14, 0x901701a0}), ++ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, ++ ALC225_STANDARD_PINS, ++ {0x12, 0xb7a60150}, ++ {0x14, 0x901701b0}), ++ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, ++ ALC225_STANDARD_PINS, ++ {0x12, 0xb7a60130}, ++ {0x1b, 0x90170110}), + SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL2_MIC_NO_PRESENCE, + {0x14, 0x90170110}, + {0x21, 0x02211020}), diff --git a/queue-4.6/alsa-hda-realtek-add-two-more-thinkpad-ids-5050-5053-for-tpt460-fixup.patch b/queue-4.6/alsa-hda-realtek-add-two-more-thinkpad-ids-5050-5053-for-tpt460-fixup.patch new file mode 100644 index 00000000000..846e8623501 --- /dev/null +++ b/queue-4.6/alsa-hda-realtek-add-two-more-thinkpad-ids-5050-5053-for-tpt460-fixup.patch @@ -0,0 +1,31 @@ +From 0f087ee3f3b86a4507db4ff1d2d5a3880e4cfd16 Mon Sep 17 00:00:00 2001 +From: Jaroslav Kysela +Date: Fri, 24 Jun 2016 15:13:16 +0200 +Subject: ALSA: hda / realtek - add two more Thinkpad IDs (5050,5053) for tpt460 fixup + +From: Jaroslav Kysela + +commit 0f087ee3f3b86a4507db4ff1d2d5a3880e4cfd16 upstream. + + See: https://bugzilla.redhat.com/show_bug.cgi?id=1349539 + See: https://bugzilla.kernel.org/show_bug.cgi?id=120961 + +Signed-off-by: Jaroslav Kysela +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5650,6 +5650,8 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x17aa, 0x503c, "Thinkpad L450", ALC292_FIXUP_TPT440_DOCK), + SND_PCI_QUIRK(0x17aa, 0x504a, "ThinkPad X260", ALC292_FIXUP_TPT440_DOCK), + SND_PCI_QUIRK(0x17aa, 0x504b, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE), ++ SND_PCI_QUIRK(0x17aa, 0x5050, "Thinkpad T560p", ALC292_FIXUP_TPT460), ++ SND_PCI_QUIRK(0x17aa, 0x5053, "Thinkpad T460", ALC292_FIXUP_TPT460), + SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K), + SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD), diff --git a/queue-4.6/alsa-hdac_regmap-fix-the-register-access-for-runtime-pm.patch b/queue-4.6/alsa-hdac_regmap-fix-the-register-access-for-runtime-pm.patch new file mode 100644 index 00000000000..b2e46d42961 --- /dev/null +++ b/queue-4.6/alsa-hdac_regmap-fix-the-register-access-for-runtime-pm.patch @@ -0,0 +1,49 @@ +From 8198868f0a283eb23e264951632ce61ec2f82228 Mon Sep 17 00:00:00 2001 +From: Jaroslav Kysela +Date: Fri, 17 Jun 2016 13:35:56 +0200 +Subject: ALSA: hdac_regmap - fix the register access for runtime PM + +From: Jaroslav Kysela + +commit 8198868f0a283eb23e264951632ce61ec2f82228 upstream. + +Call path: + + 1) snd_hdac_power_up_pm() + 2) snd_hdac_power_up() + 3) pm_runtime_get_sync() + 4) __pm_runtime_resume() + 5) rpm_resume() + +The rpm_resume() returns 1 when the device is already active. +Because the return value is unmodified, the hdac regmap read/write +functions should allow this value for the retry I/O operation, too. + +Signed-off-by: Jaroslav Kysela +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/hda/hdac_regmap.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/hda/hdac_regmap.c ++++ b/sound/hda/hdac_regmap.c +@@ -444,7 +444,7 @@ int snd_hdac_regmap_write_raw(struct hda + err = reg_raw_write(codec, reg, val); + if (err == -EAGAIN) { + err = snd_hdac_power_up_pm(codec); +- if (!err) ++ if (err >= 0) + err = reg_raw_write(codec, reg, val); + snd_hdac_power_down_pm(codec); + } +@@ -470,7 +470,7 @@ static int __snd_hdac_regmap_read_raw(st + err = reg_raw_read(codec, reg, val, uncached); + if (err == -EAGAIN) { + err = snd_hdac_power_up_pm(codec); +- if (!err) ++ if (err >= 0) + err = reg_raw_read(codec, reg, val, uncached); + snd_hdac_power_down_pm(codec); + } diff --git a/queue-4.6/alsa-pcm-free-chmap-at-pcm-free-callback-too.patch b/queue-4.6/alsa-pcm-free-chmap-at-pcm-free-callback-too.patch new file mode 100644 index 00000000000..1736222c423 --- /dev/null +++ b/queue-4.6/alsa-pcm-free-chmap-at-pcm-free-callback-too.patch @@ -0,0 +1,65 @@ +From a8ff48cb70835f48de5703052760312019afea55 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 8 Jul 2016 08:23:43 +0200 +Subject: ALSA: pcm: Free chmap at PCM free callback, too + +From: Takashi Iwai + +commit a8ff48cb70835f48de5703052760312019afea55 upstream. + +The chmap ctls assigned to PCM streams are freed in the PCM disconnect +callback. However, since the disconnect callback isn't called when +the card gets freed before registering, the chmap ctls may still be +left assigned. They are eventually freed together with other ctls, +but it may cause an Oops at pcm_chmap_ctl_private_free(), as the +function refers to the assigned PCM stream, while the PCM objects have +been already freed beforehand. + +The fix is to free the chmap ctls also at PCM free callback, not only +at PCM disconnect. + +Reported-by: Laxminath Kasam +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/pcm.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/sound/core/pcm.c ++++ b/sound/core/pcm.c +@@ -849,6 +849,14 @@ int snd_pcm_new_internal(struct snd_card + } + EXPORT_SYMBOL(snd_pcm_new_internal); + ++static void free_chmap(struct snd_pcm_str *pstr) ++{ ++ if (pstr->chmap_kctl) { ++ snd_ctl_remove(pstr->pcm->card, pstr->chmap_kctl); ++ pstr->chmap_kctl = NULL; ++ } ++} ++ + static void snd_pcm_free_stream(struct snd_pcm_str * pstr) + { + struct snd_pcm_substream *substream, *substream_next; +@@ -871,6 +879,7 @@ static void snd_pcm_free_stream(struct s + kfree(setup); + } + #endif ++ free_chmap(pstr); + if (pstr->substream_count) + put_device(&pstr->dev); + } +@@ -1135,10 +1144,7 @@ static int snd_pcm_dev_disconnect(struct + for (cidx = 0; cidx < 2; cidx++) { + if (!pcm->internal) + snd_unregister_device(&pcm->streams[cidx].dev); +- if (pcm->streams[cidx].chmap_kctl) { +- snd_ctl_remove(pcm->card, pcm->streams[cidx].chmap_kctl); +- pcm->streams[cidx].chmap_kctl = NULL; +- } ++ free_chmap(&pcm->streams[cidx]); + } + mutex_unlock(&pcm->open_mutex); + mutex_unlock(®ister_mutex); diff --git a/queue-4.6/alsa-timer-fix-negative-queue-usage-by-racy-accesses.patch b/queue-4.6/alsa-timer-fix-negative-queue-usage-by-racy-accesses.patch new file mode 100644 index 00000000000..a8e7eb7714f --- /dev/null +++ b/queue-4.6/alsa-timer-fix-negative-queue-usage-by-racy-accesses.patch @@ -0,0 +1,43 @@ +From 3fa6993fef634e05d200d141a85df0b044572364 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 4 Jul 2016 14:02:15 +0200 +Subject: ALSA: timer: Fix negative queue usage by racy accesses + +From: Takashi Iwai + +commit 3fa6993fef634e05d200d141a85df0b044572364 upstream. + +The user timer tu->qused counter may go to a negative value when +multiple concurrent reads are performed since both the check and the +decrement of tu->qused are done in two individual locked contexts. +This results in bogus read outs, and the endless loop in the +user-space side. + +The fix is to move the decrement of the tu->qused counter into the +same spinlock context as the zero-check of the counter. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/timer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -1954,6 +1954,7 @@ static ssize_t snd_timer_user_read(struc + + qhead = tu->qhead++; + tu->qhead %= tu->queue_size; ++ tu->qused--; + spin_unlock_irq(&tu->qlock); + + if (tu->tread) { +@@ -1967,7 +1968,6 @@ static ssize_t snd_timer_user_read(struc + } + + spin_lock_irq(&tu->qlock); +- tu->qused--; + if (err < 0) + goto _error; + result += unit; diff --git a/queue-4.6/alsa-usb-audio-fix-quirks-code-is-not-called.patch b/queue-4.6/alsa-usb-audio-fix-quirks-code-is-not-called.patch new file mode 100644 index 00000000000..48504098e51 --- /dev/null +++ b/queue-4.6/alsa-usb-audio-fix-quirks-code-is-not-called.patch @@ -0,0 +1,42 @@ +From 76df52969711ae3725a98f26fbbc6a349803dcbf Mon Sep 17 00:00:00 2001 +From: Kazuki Oikawa +Date: Mon, 18 Jul 2016 01:16:15 +0900 +Subject: ALSA: usb-audio: Fix quirks code is not called + +From: Kazuki Oikawa + +commit 76df52969711ae3725a98f26fbbc6a349803dcbf upstream. + +snd_usb_{set_interface,ctl_msg}_quirk checks chip->usb_id to need +calling a quirks code. But existed code path that not calling +dev_set_drvdata in usb_audio_probe. + +Fixes: 79289e24194a ("ALSA: usb-audio: Refer to chip->usb_id for quirks and MIDI creation") +Signed-off-by: Kazuki Oikawa +Reviewed-by: Takashi Sakamoto +Tested-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/card.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -552,7 +552,6 @@ static int usb_audio_probe(struct usb_in + goto __error; + } + chip = usb_chip[i]; +- dev_set_drvdata(&dev->dev, chip); + atomic_inc(&chip->active); /* avoid autopm */ + break; + } +@@ -578,6 +577,7 @@ static int usb_audio_probe(struct usb_in + goto __error; + } + } ++ dev_set_drvdata(&dev->dev, chip); + + /* + * For devices with more than one control interface, we assume the diff --git a/queue-4.6/arm-dts-armada-38x-fix-mbus_id-for-crypto-sram-on-armada-385-linksys.patch b/queue-4.6/arm-dts-armada-38x-fix-mbus_id-for-crypto-sram-on-armada-385-linksys.patch new file mode 100644 index 00000000000..2fa8e53a304 --- /dev/null +++ b/queue-4.6/arm-dts-armada-38x-fix-mbus_id-for-crypto-sram-on-armada-385-linksys.patch @@ -0,0 +1,43 @@ +From 929e604efa3dc0522214e0dc18984be23993e9f0 Mon Sep 17 00:00:00 2001 +From: Thomas Petazzoni +Date: Thu, 16 Jun 2016 15:42:27 +0200 +Subject: ARM: dts: armada-38x: fix MBUS_ID for crypto SRAM on Armada 385 Linksys + +From: Thomas Petazzoni + +commit 929e604efa3dc0522214e0dc18984be23993e9f0 upstream. + +When the support for the Marvell crypto engine was added in the Device +Tree of the various Armada 385 Device Tree files in commit +d716f2e837ac6 ("ARM: mvebu: define crypto SRAM ranges for all armada-38x +boards"), a typo was made in the MBus window attributes for the Armada +385 Linksys board: 0x09/0x05 are used instead of 0x19/0x15. This commit +fixes this typo, which makes the CESA engines operational on Armada 385 +Linksys boards. + +Reported-by: Terry Stockert +Cc: Terry Stockert +Cc: Imre Kaloz +Cc: Boris Brezillon +Fixes: d716f2e837ac6 ("ARM: mvebu: define crypto SRAM ranges for all armada-38x boards") +Signed-off-by: Thomas Petazzoni +Signed-off-by: Gregory CLEMENT +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/armada-385-linksys.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/armada-385-linksys.dtsi ++++ b/arch/arm/boot/dts/armada-385-linksys.dtsi +@@ -58,8 +58,8 @@ + soc { + ranges = ; ++ MBUS_ID(0x09, 0x19) 0 0xf1100000 0x10000 ++ MBUS_ID(0x09, 0x15) 0 0xf1110000 0x10000>; + + internal-regs { + diff --git a/queue-4.6/arm-mvebu-fix-hw-i-o-coherency-related-deadlocks.patch b/queue-4.6/arm-mvebu-fix-hw-i-o-coherency-related-deadlocks.patch new file mode 100644 index 00000000000..c818c31f861 --- /dev/null +++ b/queue-4.6/arm-mvebu-fix-hw-i-o-coherency-related-deadlocks.patch @@ -0,0 +1,73 @@ +From c5379ba8fccd99d5f99632c789f0393d84a57805 Mon Sep 17 00:00:00 2001 +From: Thomas Petazzoni +Date: Thu, 16 Jun 2016 15:42:25 +0200 +Subject: ARM: mvebu: fix HW I/O coherency related deadlocks + +From: Thomas Petazzoni + +commit c5379ba8fccd99d5f99632c789f0393d84a57805 upstream. + +Until now, our understanding for HW I/O coherency to work on the +Cortex-A9 based Marvell SoC was that only the PCIe regions should be +mapped strongly-ordered. However, we were still encountering some +deadlocks, especially when testing the CESA crypto engine. After +checking with the HW designers, it was concluded that all the MMIO +registers should be mapped as strongly ordered for the HW I/O coherency +mechanism to work properly. + +This fixes some easy to reproduce deadlocks with the CESA crypto engine +driver (dmcrypt on a sufficiently large disk partition). + +Tested-by: Terry Stockert +Tested-by: Romain Perier +Cc: Terry Stockert +Cc: Romain Perier +Signed-off-by: Thomas Petazzoni +Signed-off-by: Gregory CLEMENT +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-mvebu/coherency.c | 22 ++++++++-------------- + 1 file changed, 8 insertions(+), 14 deletions(-) + +--- a/arch/arm/mach-mvebu/coherency.c ++++ b/arch/arm/mach-mvebu/coherency.c +@@ -162,22 +162,16 @@ exit: + } + + /* +- * This ioremap hook is used on Armada 375/38x to ensure that PCIe +- * memory areas are mapped as MT_UNCACHED instead of MT_DEVICE. This +- * is needed as a workaround for a deadlock issue between the PCIe +- * interface and the cache controller. ++ * This ioremap hook is used on Armada 375/38x to ensure that all MMIO ++ * areas are mapped as MT_UNCACHED instead of MT_DEVICE. This is ++ * needed for the HW I/O coherency mechanism to work properly without ++ * deadlock. + */ + static void __iomem * +-armada_pcie_wa_ioremap_caller(phys_addr_t phys_addr, size_t size, +- unsigned int mtype, void *caller) ++armada_wa_ioremap_caller(phys_addr_t phys_addr, size_t size, ++ unsigned int mtype, void *caller) + { +- struct resource pcie_mem; +- +- mvebu_mbus_get_pcie_mem_aperture(&pcie_mem); +- +- if (pcie_mem.start <= phys_addr && (phys_addr + size) <= pcie_mem.end) +- mtype = MT_UNCACHED; +- ++ mtype = MT_UNCACHED; + return __arm_ioremap_caller(phys_addr, size, mtype, caller); + } + +@@ -186,7 +180,7 @@ static void __init armada_375_380_cohere + struct device_node *cache_dn; + + coherency_cpu_base = of_iomap(np, 0); +- arch_ioremap_caller = armada_pcie_wa_ioremap_caller; ++ arch_ioremap_caller = armada_wa_ioremap_caller; + + /* + * We should switch the PL310 to I/O coherency mode only if diff --git a/queue-4.6/arm-sunxi-dt-make-the-chip-inherit-from-allwinner-sun5i-a13.patch b/queue-4.6/arm-sunxi-dt-make-the-chip-inherit-from-allwinner-sun5i-a13.patch new file mode 100644 index 00000000000..e85c07cd087 --- /dev/null +++ b/queue-4.6/arm-sunxi-dt-make-the-chip-inherit-from-allwinner-sun5i-a13.patch @@ -0,0 +1,34 @@ +From 5fc39d347267bd029fcc9099c70e2fe2d53130e9 Mon Sep 17 00:00:00 2001 +From: Boris Brezillon +Date: Wed, 15 Jun 2016 13:20:19 +0200 +Subject: ARM: sunxi/dt: make the CHIP inherit from allwinner,sun5i-a13 + +From: Boris Brezillon + +commit 5fc39d347267bd029fcc9099c70e2fe2d53130e9 upstream. + +The sun4i-timer driver registers its sched_clock only if the machine is +compatible with "allwinner,sun5i-a13", "allwinner,sun5i-a10s" or +"allwinner,sun4i-a10". +Add the missing "allwinner,sun5i-a13" string to the machine compatible. + +Signed-off-by: Boris Brezillon +Fixes: 465a225fb2af ("ARM: sun5i: Add C.H.I.P DTS") +Signed-off-by: Maxime Ripard +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/sun5i-r8-chip.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/sun5i-r8-chip.dts ++++ b/arch/arm/boot/dts/sun5i-r8-chip.dts +@@ -52,7 +52,7 @@ + + / { + model = "NextThing C.H.I.P."; +- compatible = "nextthing,chip", "allwinner,sun5i-r8"; ++ compatible = "nextthing,chip", "allwinner,sun5i-r8", "allwinner,sun5i-a13"; + + aliases { + i2c0 = &i2c0; diff --git a/queue-4.6/hwmon-dell-smm-cache-fan_type-calls-and-change-fan-detection.patch b/queue-4.6/hwmon-dell-smm-cache-fan_type-calls-and-change-fan-detection.patch new file mode 100644 index 00000000000..44b9ce54913 --- /dev/null +++ b/queue-4.6/hwmon-dell-smm-cache-fan_type-calls-and-change-fan-detection.patch @@ -0,0 +1,85 @@ +From 5ce91714b0d8c0a3ff9b858966721f508351cf4c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pali=20Roh=C3=A1r?= +Date: Sat, 18 Jun 2016 00:54:47 +0200 +Subject: hwmon: (dell-smm) Cache fan_type() calls and change fan detection +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +commit 5ce91714b0d8c0a3ff9b858966721f508351cf4c upstream. + +On more Dell machines (e.g. Dell Precision M3800) fan_type() call is too +expensive (CPU is too long in SMM mode) and cause kernel to hang. This is +bug in Dell SMM or BIOS. + +This patch caches type for each fan (as it should not change) and changes +the way how fan presense is detected. First it try function fan_status() +as was before commit f989e55452c7 ("i8k: Add support for fan labels"). And +if that fails fallback to fan_type(). *_status() functions can fail in case +fan is not currently accessible (e.g. present on GPU which is currently +turned off). + +Reported-by: Tolga Cakir +Signed-off-by: Pali Rohár +Link: https://bugzilla.kernel.org/show_bug.cgi?id=112021 +Tested-by: Tolga Cakir +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/dell-smm-hwmon.c | 25 ++++++++++++++++++++----- + 1 file changed, 20 insertions(+), 5 deletions(-) + +--- a/drivers/hwmon/dell-smm-hwmon.c ++++ b/drivers/hwmon/dell-smm-hwmon.c +@@ -237,7 +237,7 @@ static int i8k_get_fan_speed(int fan) + /* + * Read the fan type. + */ +-static int i8k_get_fan_type(int fan) ++static int _i8k_get_fan_type(int fan) + { + struct smm_regs regs = { .eax = I8K_SMM_GET_FAN_TYPE, }; + +@@ -248,6 +248,17 @@ static int i8k_get_fan_type(int fan) + return i8k_smm(®s) ? : regs.eax & 0xff; + } + ++static int i8k_get_fan_type(int fan) ++{ ++ /* I8K_SMM_GET_FAN_TYPE SMM call is expensive, so cache values */ ++ static int types[2] = { INT_MIN, INT_MIN }; ++ ++ if (types[fan] == INT_MIN) ++ types[fan] = _i8k_get_fan_type(fan); ++ ++ return types[fan]; ++} ++ + /* + * Read the fan nominal rpm for specific fan speed. + */ +@@ -777,13 +788,17 @@ static int __init i8k_init_hwmon(void) + if (err >= 0) + i8k_hwmon_flags |= I8K_HWMON_HAVE_TEMP4; + +- /* First fan attributes, if fan type is OK */ +- err = i8k_get_fan_type(0); ++ /* First fan attributes, if fan status or type is OK */ ++ err = i8k_get_fan_status(0); ++ if (err < 0) ++ err = i8k_get_fan_type(0); + if (err >= 0) + i8k_hwmon_flags |= I8K_HWMON_HAVE_FAN1; + +- /* Second fan attributes, if fan type is OK */ +- err = i8k_get_fan_type(1); ++ /* Second fan attributes, if fan status or type is OK */ ++ err = i8k_get_fan_status(1); ++ if (err < 0) ++ err = i8k_get_fan_type(1); + if (err >= 0) + i8k_hwmon_flags |= I8K_HWMON_HAVE_FAN2; + diff --git a/queue-4.6/hwmon-dell-smm-disallow-fan_type-calls-on-broken-machines.patch b/queue-4.6/hwmon-dell-smm-disallow-fan_type-calls-on-broken-machines.patch new file mode 100644 index 00000000000..231875fa8b0 --- /dev/null +++ b/queue-4.6/hwmon-dell-smm-disallow-fan_type-calls-on-broken-machines.patch @@ -0,0 +1,128 @@ +From 2744d2fde00dc8bcc3679eb72c81a63058e90faa Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pali=20Roh=C3=A1r?= +Date: Sat, 18 Jun 2016 00:54:46 +0200 +Subject: hwmon: (dell-smm) Disallow fan_type() calls on broken machines +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +commit 2744d2fde00dc8bcc3679eb72c81a63058e90faa upstream. + +Some Dell machines have especially broken SMM or BIOS which cause that once +fan_type() is called then CPU fan speed going randomly up and down. And for +fixing this behaviour reboot is required. + +So this patch creates fan_type blacklist of affected Dell machines and +disallow fan_type() call on them to prevent that erratic behaviour. + +Old blacklist which disabled loading driver on some machines added in +commits a4b45b25f18d ("hwmon: (dell-smm) Blacklist Dell Studio XPS 8100") +and 6220f4ebd7b4 ("hwmon: (dell-smm) Blacklist Dell Studio XPS 8000") were +moved to FAN_TYPE blacklist. + +Reported-by: Jan C Peters +Signed-off-by: Pali Rohár +Link: https://bugzilla.kernel.org/show_bug.cgi?id=100121 +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/dell-smm-hwmon.c | 36 +++++++++++++++++++++++++----------- + 1 file changed, 25 insertions(+), 11 deletions(-) + +--- a/drivers/hwmon/dell-smm-hwmon.c ++++ b/drivers/hwmon/dell-smm-hwmon.c +@@ -72,6 +72,7 @@ static u32 i8k_hwmon_flags; + static uint i8k_fan_mult = I8K_FAN_MULT; + static uint i8k_pwm_mult; + static uint i8k_fan_max = I8K_FAN_HIGH; ++static bool disallow_fan_type_call; + + #define I8K_HWMON_HAVE_TEMP1 (1 << 0) + #define I8K_HWMON_HAVE_TEMP2 (1 << 1) +@@ -240,6 +241,9 @@ static int i8k_get_fan_type(int fan) + { + struct smm_regs regs = { .eax = I8K_SMM_GET_FAN_TYPE, }; + ++ if (disallow_fan_type_call) ++ return -EINVAL; ++ + regs.ebx = fan & 0xff; + return i8k_smm(®s) ? : regs.eax & 0xff; + } +@@ -721,6 +725,9 @@ static struct attribute *i8k_attrs[] = { + static umode_t i8k_is_visible(struct kobject *kobj, struct attribute *attr, + int index) + { ++ if (disallow_fan_type_call && ++ (index == 9 || index == 12)) ++ return 0; + if (index >= 0 && index <= 1 && + !(i8k_hwmon_flags & I8K_HWMON_HAVE_TEMP1)) + return 0; +@@ -932,12 +939,14 @@ static struct dmi_system_id i8k_dmi_tabl + + MODULE_DEVICE_TABLE(dmi, i8k_dmi_table); + +-static struct dmi_system_id i8k_blacklist_dmi_table[] __initdata = { ++/* ++ * On some machines once I8K_SMM_GET_FAN_TYPE is issued then CPU fan speed ++ * randomly going up and down due to bug in Dell SMM or BIOS. Here is blacklist ++ * of affected Dell machines for which we disallow I8K_SMM_GET_FAN_TYPE call. ++ * See bug: https://bugzilla.kernel.org/show_bug.cgi?id=100121 ++ */ ++static struct dmi_system_id i8k_blacklist_fan_type_dmi_table[] __initdata = { + { +- /* +- * CPU fan speed going up and down on Dell Studio XPS 8000 +- * for unknown reasons. +- */ + .ident = "Dell Studio XPS 8000", + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."), +@@ -945,16 +954,19 @@ static struct dmi_system_id i8k_blacklis + }, + }, + { +- /* +- * CPU fan speed going up and down on Dell Studio XPS 8100 +- * for unknown reasons. +- */ + .ident = "Dell Studio XPS 8100", + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Studio XPS 8100"), + }, + }, ++ { ++ .ident = "Dell Inspiron 580", ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Inspiron 580 "), ++ }, ++ }, + { } + }; + +@@ -969,8 +981,7 @@ static int __init i8k_probe(void) + /* + * Get DMI information + */ +- if (!dmi_check_system(i8k_dmi_table) || +- dmi_check_system(i8k_blacklist_dmi_table)) { ++ if (!dmi_check_system(i8k_dmi_table)) { + if (!ignore_dmi && !force) + return -ENODEV; + +@@ -981,6 +992,9 @@ static int __init i8k_probe(void) + i8k_get_dmi_data(DMI_BIOS_VERSION)); + } + ++ if (dmi_check_system(i8k_blacklist_fan_type_dmi_table)) ++ disallow_fan_type_call = true; ++ + strlcpy(bios_version, i8k_get_dmi_data(DMI_BIOS_VERSION), + sizeof(bios_version)); + strlcpy(bios_machineid, i8k_get_dmi_data(DMI_PRODUCT_SERIAL), diff --git a/queue-4.6/hwmon-dell-smm-restrict-fan-control-and-serial-number-to-cap_sys_admin-by-default.patch b/queue-4.6/hwmon-dell-smm-restrict-fan-control-and-serial-number-to-cap_sys_admin-by-default.patch new file mode 100644 index 00000000000..bc3648b66f6 --- /dev/null +++ b/queue-4.6/hwmon-dell-smm-restrict-fan-control-and-serial-number-to-cap_sys_admin-by-default.patch @@ -0,0 +1,97 @@ +From 7613663cc186f8f3c50279390ddc60286758001c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pali=20Roh=C3=A1r?= +Date: Sat, 18 Jun 2016 00:54:45 +0200 +Subject: hwmon: (dell-smm) Restrict fan control and serial number to CAP_SYS_ADMIN by default +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +commit 7613663cc186f8f3c50279390ddc60286758001c upstream. + +For security reasons ordinary user must not be able to control fan speed +via /proc/i8k by default. Some malicious software running under "nobody" +user could be able to turn fan off and cause HW problems. So this patch +changes default value of "restricted" parameter to 1. + +Also restrict reading of DMI_PRODUCT_SERIAL from /proc/i8k via "restricted" +parameter. It is because non root user cannot read DMI_PRODUCT_SERIAL from +sysfs file /sys/class/dmi/id/product_serial. + +Old non secure behaviour of file /proc/i8k can be achieved by loading this +module with "restricted" parameter set to 0. + +Note that this patch has effects only for kernels compiled with CONFIG_I8K +and only for file /proc/i8k. Hwmon interface provided by this driver was +not changed and root access for setting fan speed was needed also before. + +Reported-by: Mario Limonciello +Signed-off-by: Pali Rohár +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/dell-smm-hwmon.c | 19 ++++++++++++------- + 1 file changed, 12 insertions(+), 7 deletions(-) + +--- a/drivers/hwmon/dell-smm-hwmon.c ++++ b/drivers/hwmon/dell-smm-hwmon.c +@@ -66,6 +66,7 @@ + + static DEFINE_MUTEX(i8k_mutex); + static char bios_version[4]; ++static char bios_machineid[16]; + static struct device *i8k_hwmon_dev; + static u32 i8k_hwmon_flags; + static uint i8k_fan_mult = I8K_FAN_MULT; +@@ -94,13 +95,13 @@ module_param(ignore_dmi, bool, 0); + MODULE_PARM_DESC(ignore_dmi, "Continue probing hardware even if DMI data does not match"); + + #if IS_ENABLED(CONFIG_I8K) +-static bool restricted; ++static bool restricted = true; + module_param(restricted, bool, 0); +-MODULE_PARM_DESC(restricted, "Allow fan control if SYS_ADMIN capability set"); ++MODULE_PARM_DESC(restricted, "Restrict fan control and serial number to CAP_SYS_ADMIN (default: 1)"); + + static bool power_status; + module_param(power_status, bool, 0600); +-MODULE_PARM_DESC(power_status, "Report power status in /proc/i8k"); ++MODULE_PARM_DESC(power_status, "Report power status in /proc/i8k (default: 0)"); + #endif + + static uint fan_mult; +@@ -392,9 +393,11 @@ i8k_ioctl_unlocked(struct file *fp, unsi + break; + + case I8K_MACHINE_ID: +- memset(buff, 0, 16); +- strlcpy(buff, i8k_get_dmi_data(DMI_PRODUCT_SERIAL), +- sizeof(buff)); ++ if (restricted && !capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ ++ memset(buff, 0, sizeof(buff)); ++ strlcpy(buff, bios_machineid, sizeof(buff)); + break; + + case I8K_FN_STATUS: +@@ -511,7 +514,7 @@ static int i8k_proc_show(struct seq_file + seq_printf(seq, "%s %s %s %d %d %d %d %d %d %d\n", + I8K_PROC_FMT, + bios_version, +- i8k_get_dmi_data(DMI_PRODUCT_SERIAL), ++ (restricted && !capable(CAP_SYS_ADMIN)) ? "-1" : bios_machineid, + cpu_temp, + left_fan, right_fan, left_speed, right_speed, + ac_power, fn_key); +@@ -980,6 +983,8 @@ static int __init i8k_probe(void) + + strlcpy(bios_version, i8k_get_dmi_data(DMI_BIOS_VERSION), + sizeof(bios_version)); ++ strlcpy(bios_machineid, i8k_get_dmi_data(DMI_PRODUCT_SERIAL), ++ sizeof(bios_machineid)); + + /* + * Get SMM Dell signature diff --git a/queue-4.6/iio-accel-kxsd9-fix-the-usage-of-spi_w8r8.patch b/queue-4.6/iio-accel-kxsd9-fix-the-usage-of-spi_w8r8.patch new file mode 100644 index 00000000000..de3d35dcb3c --- /dev/null +++ b/queue-4.6/iio-accel-kxsd9-fix-the-usage-of-spi_w8r8.patch @@ -0,0 +1,42 @@ +From 0c1f91b98552da49d9d8eed32b3132a58d2f4598 Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Fri, 17 Jun 2016 15:22:24 +0200 +Subject: iio: accel: kxsd9: fix the usage of spi_w8r8() + +From: Linus Walleij + +commit 0c1f91b98552da49d9d8eed32b3132a58d2f4598 upstream. + +These two spi_w8r8() calls return a value with is used by the code +following the error check. The dubious use was caused by a cleanup +patch. + +Fixes: d34dbee8ac8e ("staging:iio:accel:kxsd9 cleanup and conversion to iio_chan_spec.") +Signed-off-by: Linus Walleij +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/accel/kxsd9.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/iio/accel/kxsd9.c ++++ b/drivers/iio/accel/kxsd9.c +@@ -81,7 +81,7 @@ static int kxsd9_write_scale(struct iio_ + + mutex_lock(&st->buf_lock); + ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C)); +- if (ret) ++ if (ret < 0) + goto error_ret; + st->tx[0] = KXSD9_WRITE(KXSD9_REG_CTRL_C); + st->tx[1] = (ret & ~KXSD9_FS_MASK) | i; +@@ -163,7 +163,7 @@ static int kxsd9_read_raw(struct iio_dev + break; + case IIO_CHAN_INFO_SCALE: + ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C)); +- if (ret) ++ if (ret < 0) + goto error_ret; + *val2 = kxsd9_micro_scales[ret & KXSD9_FS_MASK]; + ret = IIO_VAL_INT_PLUS_MICRO; diff --git a/queue-4.6/iio-ad7266-fix-broken-regulator-error-handling.patch b/queue-4.6/iio-ad7266-fix-broken-regulator-error-handling.patch new file mode 100644 index 00000000000..4a1ca15d47c --- /dev/null +++ b/queue-4.6/iio-ad7266-fix-broken-regulator-error-handling.patch @@ -0,0 +1,32 @@ +From 6b7f4e25f3309f106a5c7ff42c8231494cf285d3 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Mon, 20 Jun 2016 13:53:32 +0100 +Subject: iio:ad7266: Fix broken regulator error handling + +From: Mark Brown + +commit 6b7f4e25f3309f106a5c7ff42c8231494cf285d3 upstream. + +All regulator_get() variants return either a pointer to a regulator or an +ERR_PTR() so testing for NULL makes no sense and may lead to bugs if we +use NULL as a valid regulator. Fix this by using IS_ERR() as expected. + +Signed-off-by: Mark Brown +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/ad7266.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/ad7266.c ++++ b/drivers/iio/adc/ad7266.c +@@ -397,7 +397,7 @@ static int ad7266_probe(struct spi_devic + st = iio_priv(indio_dev); + + st->reg = devm_regulator_get(&spi->dev, "vref"); +- if (!IS_ERR_OR_NULL(st->reg)) { ++ if (!IS_ERR(st->reg)) { + ret = regulator_enable(st->reg); + if (ret) + return ret; diff --git a/queue-4.6/iio-ad7266-fix-probe-deferral-for-vref.patch b/queue-4.6/iio-ad7266-fix-probe-deferral-for-vref.patch new file mode 100644 index 00000000000..86fc1d84c94 --- /dev/null +++ b/queue-4.6/iio-ad7266-fix-probe-deferral-for-vref.patch @@ -0,0 +1,35 @@ +From 68b356eb3d9f5e38910fb62e22a78e2a18d544ae Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Mon, 20 Jun 2016 13:53:34 +0100 +Subject: iio:ad7266: Fix probe deferral for vref + +From: Mark Brown + +commit 68b356eb3d9f5e38910fb62e22a78e2a18d544ae upstream. + +Currently the ad7266 driver treats any failure to get vref as though the +regulator were not present but this means that if probe deferral is +triggered the driver will act as though the regulator were not present. +Instead only use the internal reference if we explicitly got -ENODEV which +is what is returned for absent regulators. + +Signed-off-by: Mark Brown +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/ad7266.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/iio/adc/ad7266.c ++++ b/drivers/iio/adc/ad7266.c +@@ -408,6 +408,9 @@ static int ad7266_probe(struct spi_devic + + st->vref_mv = ret / 1000; + } else { ++ /* Any other error indicates that the regulator does exist */ ++ if (PTR_ERR(st->reg) != -ENODEV) ++ return PTR_ERR(st->reg); + /* Use internal reference */ + st->vref_mv = 2500; + } diff --git a/queue-4.6/iio-ad7266-fix-support-for-optional-regulators.patch b/queue-4.6/iio-ad7266-fix-support-for-optional-regulators.patch new file mode 100644 index 00000000000..c4680ba78e2 --- /dev/null +++ b/queue-4.6/iio-ad7266-fix-support-for-optional-regulators.patch @@ -0,0 +1,38 @@ +From e5511c816e5ac4909bdd38e85ac344e2b9b8e984 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Mon, 20 Jun 2016 13:53:33 +0100 +Subject: iio:ad7266: Fix support for optional regulators + +From: Mark Brown + +commit e5511c816e5ac4909bdd38e85ac344e2b9b8e984 upstream. + +The ad7266 driver attempts to support deciding between the use of internal +and external power supplies by checking to see if an error is returned when +requesting the regulator. This doesn't work with the current code since the +driver uses a normal regulator_get() which is for non-optional supplies +and so assumes that if a regulator is not provided by the platform then +this is a bug in the platform integration and so substitutes a dummy +regulator. Use regulator_get_optional() instead which indicates to the +framework that the regulator may be absent and provides a dummy regulator +instead. + +Signed-off-by: Mark Brown +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/ad7266.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/ad7266.c ++++ b/drivers/iio/adc/ad7266.c +@@ -396,7 +396,7 @@ static int ad7266_probe(struct spi_devic + + st = iio_priv(indio_dev); + +- st->reg = devm_regulator_get(&spi->dev, "vref"); ++ st->reg = devm_regulator_get_optional(&spi->dev, "vref"); + if (!IS_ERR(st->reg)) { + ret = regulator_enable(st->reg); + if (ret) diff --git a/queue-4.6/iio-fix-error-handling-in-iio_trigger_attach_poll_func.patch b/queue-4.6/iio-fix-error-handling-in-iio_trigger_attach_poll_func.patch new file mode 100644 index 00000000000..e5bc7ca32ff --- /dev/null +++ b/queue-4.6/iio-fix-error-handling-in-iio_trigger_attach_poll_func.patch @@ -0,0 +1,68 @@ +From 99543823357966ac938d9a310947e731b67338e6 Mon Sep 17 00:00:00 2001 +From: Crestez Dan Leonard +Date: Tue, 3 May 2016 15:27:09 +0300 +Subject: iio: Fix error handling in iio_trigger_attach_poll_func + +From: Crestez Dan Leonard + +commit 99543823357966ac938d9a310947e731b67338e6 upstream. + +When attaching a pollfunc iio_trigger_attach_poll_func will allocate a +virtual irq and call the driver's set_trigger_state function. Fix error +handling to undo previous steps if any fails. + +In particular this fixes handling errors from a driver's +set_trigger_state function. When using triggered buffers a failure to +enable the trigger used to make the buffer unusable. + +Signed-off-by: Crestez Dan Leonard +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/industrialio-trigger.c | 23 ++++++++++++++++++----- + 1 file changed, 18 insertions(+), 5 deletions(-) + +--- a/drivers/iio/industrialio-trigger.c ++++ b/drivers/iio/industrialio-trigger.c +@@ -210,22 +210,35 @@ static int iio_trigger_attach_poll_func( + + /* Prevent the module from being removed whilst attached to a trigger */ + __module_get(pf->indio_dev->info->driver_module); ++ ++ /* Get irq number */ + pf->irq = iio_trigger_get_irq(trig); ++ if (pf->irq < 0) ++ goto out_put_module; ++ ++ /* Request irq */ + ret = request_threaded_irq(pf->irq, pf->h, pf->thread, + pf->type, pf->name, + pf); +- if (ret < 0) { +- module_put(pf->indio_dev->info->driver_module); +- return ret; +- } ++ if (ret < 0) ++ goto out_put_irq; + ++ /* Enable trigger in driver */ + if (trig->ops && trig->ops->set_trigger_state && notinuse) { + ret = trig->ops->set_trigger_state(trig, true); + if (ret < 0) +- module_put(pf->indio_dev->info->driver_module); ++ goto out_free_irq; + } + + return ret; ++ ++out_free_irq: ++ free_irq(pf->irq, pf); ++out_put_irq: ++ iio_trigger_put_irq(trig, pf->irq); ++out_put_module: ++ module_put(pf->indio_dev->info->driver_module); ++ return ret; + } + + static int iio_trigger_detach_poll_func(struct iio_trigger *trig, diff --git a/queue-4.6/iio-hudmidity-hdc100x-fix-incorrect-shifting-and-scaling.patch b/queue-4.6/iio-hudmidity-hdc100x-fix-incorrect-shifting-and-scaling.patch new file mode 100644 index 00000000000..a68668723a5 --- /dev/null +++ b/queue-4.6/iio-hudmidity-hdc100x-fix-incorrect-shifting-and-scaling.patch @@ -0,0 +1,65 @@ +From 94bef000f1d4aa111f4ddda1482cf3b30ad069ce Mon Sep 17 00:00:00 2001 +From: Matt Ranostay +Date: Sun, 29 May 2016 19:52:02 -0700 +Subject: iio: hudmidity: hdc100x: fix incorrect shifting and scaling + +From: Matt Ranostay + +commit 94bef000f1d4aa111f4ddda1482cf3b30ad069ce upstream. + +Shifting sensor data to the right 2 bits was incorrect and caused the +scaling values + offsets to be invalid. + +Reported-by: Alison Schofield +Signed-off-by: Matt Ranostay +Tested-by: Alison Schofield +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/humidity/hdc100x.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/iio/humidity/hdc100x.c ++++ b/drivers/iio/humidity/hdc100x.c +@@ -164,14 +164,14 @@ static int hdc100x_get_measurement(struc + dev_err(&client->dev, "cannot read high byte measurement"); + return ret; + } +- val = ret << 6; ++ val = ret << 8; + + ret = i2c_smbus_read_byte(client); + if (ret < 0) { + dev_err(&client->dev, "cannot read low byte measurement"); + return ret; + } +- val |= ret >> 2; ++ val |= ret; + + return val; + } +@@ -212,17 +212,17 @@ static int hdc100x_read_raw(struct iio_d + case IIO_CHAN_INFO_SCALE: + if (chan->type == IIO_TEMP) { + *val = 165000; +- *val2 = 65536 >> 2; ++ *val2 = 65536; + return IIO_VAL_FRACTIONAL; + } else { +- *val = 0; +- *val2 = 10000; +- return IIO_VAL_INT_PLUS_MICRO; ++ *val = 100; ++ *val2 = 65536; ++ return IIO_VAL_FRACTIONAL; + } + break; + case IIO_CHAN_INFO_OFFSET: +- *val = -3971; +- *val2 = 879096; ++ *val = -15887; ++ *val2 = 515151; + return IIO_VAL_INT_PLUS_MICRO; + default: + return -EINVAL; diff --git a/queue-4.6/iio-humidity-hdc100x-correct-humidity-integration-time-mask.patch b/queue-4.6/iio-humidity-hdc100x-correct-humidity-integration-time-mask.patch new file mode 100644 index 00000000000..e0cf5582281 --- /dev/null +++ b/queue-4.6/iio-humidity-hdc100x-correct-humidity-integration-time-mask.patch @@ -0,0 +1,35 @@ +From 0e35cf5ce00d873d6e529d2b2cd7598d52438051 Mon Sep 17 00:00:00 2001 +From: Alison Schofield +Date: Fri, 20 May 2016 10:06:41 -0700 +Subject: iio: humidity: hdc100x: correct humidity integration time mask + +From: Alison Schofield + +commit 0e35cf5ce00d873d6e529d2b2cd7598d52438051 upstream. + +Apply the correct mask to enable all available humidity integration +times. Currently, the driver defaults to 6500 and all is okay with that. +However, if 3850 is selected we get a stuck bit and can't change back +to 6500 or select 2500. (Verified with HDC1008) + +Signed-off-by: Alison Schofield +Cc: Daniel Baluta +Reviewed-by: Matt Ranostay +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/humidity/hdc100x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/humidity/hdc100x.c ++++ b/drivers/iio/humidity/hdc100x.c +@@ -55,7 +55,7 @@ static const struct { + }, + { /* IIO_HUMIDITYRELATIVE channel */ + .shift = 8, +- .mask = 2, ++ .mask = 3, + }, + }; + diff --git a/queue-4.6/iio-humidity-hdc100x-fix-iio_temp-channel-reporting.patch b/queue-4.6/iio-humidity-hdc100x-fix-iio_temp-channel-reporting.patch new file mode 100644 index 00000000000..15c2e0a32fd --- /dev/null +++ b/queue-4.6/iio-humidity-hdc100x-fix-iio_temp-channel-reporting.patch @@ -0,0 +1,32 @@ +From 09bc0ddaab6cab0fa95a67d5535ec772e2671193 Mon Sep 17 00:00:00 2001 +From: Matt Ranostay +Date: Thu, 26 May 2016 19:55:06 -0700 +Subject: iio: humidity: hdc100x: fix IIO_TEMP channel reporting + +From: Matt Ranostay + +commit 09bc0ddaab6cab0fa95a67d5535ec772e2671193 upstream. + +IIO_TEMP channel was being incorrectly reported back as Celsius when it +should have been milliCelsius. This is via an incorrect scale value being +returned to userspace. + +Signed-off-by: Matt Ranostay +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/humidity/hdc100x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/humidity/hdc100x.c ++++ b/drivers/iio/humidity/hdc100x.c +@@ -211,7 +211,7 @@ static int hdc100x_read_raw(struct iio_d + return IIO_VAL_INT_PLUS_MICRO; + case IIO_CHAN_INFO_SCALE: + if (chan->type == IIO_TEMP) { +- *val = 165; ++ *val = 165000; + *val2 = 65536 >> 2; + return IIO_VAL_FRACTIONAL; + } else { diff --git a/queue-4.6/iio-light-apds9960-add-the-missing-dev.parent.patch b/queue-4.6/iio-light-apds9960-add-the-missing-dev.parent.patch new file mode 100644 index 00000000000..125360a05b3 --- /dev/null +++ b/queue-4.6/iio-light-apds9960-add-the-missing-dev.parent.patch @@ -0,0 +1,32 @@ +From 590b92a30242dd3f73de3d9a51d9924f1ab33e93 Mon Sep 17 00:00:00 2001 +From: Yong Li +Date: Thu, 5 May 2016 16:10:49 +0800 +Subject: iio: light apds9960: Add the missing dev.parent + +From: Yong Li + +commit 590b92a30242dd3f73de3d9a51d9924f1ab33e93 upstream. + +Without this, the iio:deviceX is missing in the /sys/bus/i2c/devices/0-0039 +Some userspace tools use this path to identify a specific instance of the +device. + +Signed-off-by: Yong Li +Reviewed-By: Matt Ranostay +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/light/apds9960.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/light/apds9960.c ++++ b/drivers/iio/light/apds9960.c +@@ -1006,6 +1006,7 @@ static int apds9960_probe(struct i2c_cli + + iio_device_attach_buffer(indio_dev, buffer); + ++ indio_dev->dev.parent = &client->dev; + indio_dev->info = &apds9960_info; + indio_dev->name = APDS9960_DRV_NAME; + indio_dev->channels = apds9960_channels; diff --git a/queue-4.6/iio-proximity-as3935-correct-iio_chan_info_raw-output.patch b/queue-4.6/iio-proximity-as3935-correct-iio_chan_info_raw-output.patch new file mode 100644 index 00000000000..4e58b960f7a --- /dev/null +++ b/queue-4.6/iio-proximity-as3935-correct-iio_chan_info_raw-output.patch @@ -0,0 +1,55 @@ +From 5138806f16c74c7cb8ac3e408a859c79eb7c9567 Mon Sep 17 00:00:00 2001 +From: Matt Ranostay +Date: Sat, 21 May 2016 20:01:01 -0700 +Subject: iio: proximity: as3935: correct IIO_CHAN_INFO_RAW output + +From: Matt Ranostay + +commit 5138806f16c74c7cb8ac3e408a859c79eb7c9567 upstream. + +IIO_CHAN_INFO_RAW was returning processed data which was incorrect. +This also adds the IIO_CHAN_INFO_SCALE value to convert to a processed value. + +Signed-off-by: Matt Ranostay +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 | 2 +- + drivers/iio/proximity/as3935.c | 10 ++++++++-- + 2 files changed, 9 insertions(+), 3 deletions(-) + +--- a/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 ++++ b/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 +@@ -1,4 +1,4 @@ +-What /sys/bus/iio/devices/iio:deviceX/in_proximity_raw ++What /sys/bus/iio/devices/iio:deviceX/in_proximity_input + Date: March 2014 + KernelVersion: 3.15 + Contact: Matt Ranostay +--- a/drivers/iio/proximity/as3935.c ++++ b/drivers/iio/proximity/as3935.c +@@ -72,7 +72,8 @@ static const struct iio_chan_spec as3935 + .type = IIO_PROXIMITY, + .info_mask_separate = + BIT(IIO_CHAN_INFO_RAW) | +- BIT(IIO_CHAN_INFO_PROCESSED), ++ BIT(IIO_CHAN_INFO_PROCESSED) | ++ BIT(IIO_CHAN_INFO_SCALE), + .scan_index = 0, + .scan_type = { + .sign = 'u', +@@ -181,7 +182,12 @@ static int as3935_read_raw(struct iio_de + /* storm out of range */ + if (*val == AS3935_DATA_MASK) + return -EINVAL; +- *val *= 1000; ++ ++ if (m == IIO_CHAN_INFO_PROCESSED) ++ *val *= 1000; ++ break; ++ case IIO_CHAN_INFO_SCALE: ++ *val = 1000; + break; + default: + return -EINVAL; diff --git a/queue-4.6/iio-proximity-as3935-fix-buffer-stack-trashing.patch b/queue-4.6/iio-proximity-as3935-fix-buffer-stack-trashing.patch new file mode 100644 index 00000000000..68626cfa112 --- /dev/null +++ b/queue-4.6/iio-proximity-as3935-fix-buffer-stack-trashing.patch @@ -0,0 +1,44 @@ +From 37b1ba2c68cfbe37f5f45bb91bcfaf2b016ae6a1 Mon Sep 17 00:00:00 2001 +From: Matt Ranostay +Date: Sat, 21 May 2016 20:01:03 -0700 +Subject: iio: proximity: as3935: fix buffer stack trashing + +From: Matt Ranostay + +commit 37b1ba2c68cfbe37f5f45bb91bcfaf2b016ae6a1 upstream. + +Buffer wasn't of a valid size to allow the timestamp, and correct padding. +This patchset also moves the buffer off the stack, and onto the heap. + +Cc: george.mccollister@gmail.com +Signed-off-by: Matt Ranostay +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/proximity/as3935.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/iio/proximity/as3935.c ++++ b/drivers/iio/proximity/as3935.c +@@ -64,6 +64,7 @@ struct as3935_state { + struct delayed_work work; + + u32 tune_cap; ++ u8 buffer[16]; /* 8-bit data + 56-bit padding + 64-bit timestamp */ + u8 buf[2] ____cacheline_aligned; + }; + +@@ -212,9 +213,10 @@ static irqreturn_t as3935_trigger_handle + ret = as3935_read(st, AS3935_DATA, &val); + if (ret) + goto err_read; +- val &= AS3935_DATA_MASK; + +- iio_push_to_buffers_with_timestamp(indio_dev, &val, pf->timestamp); ++ st->buffer[0] = val & AS3935_DATA_MASK; ++ iio_push_to_buffers_with_timestamp(indio_dev, &st->buffer, ++ pf->timestamp); + err_read: + iio_trigger_notify_done(indio_dev->trig); + diff --git a/queue-4.6/iio-proximity-as3935-remove-triggered-buffer-processing.patch b/queue-4.6/iio-proximity-as3935-remove-triggered-buffer-processing.patch new file mode 100644 index 00000000000..184513f1eb3 --- /dev/null +++ b/queue-4.6/iio-proximity-as3935-remove-triggered-buffer-processing.patch @@ -0,0 +1,31 @@ +From 7d0643634ea567969bf3f3ed6193a9d6fc75653b Mon Sep 17 00:00:00 2001 +From: Matt Ranostay +Date: Sat, 21 May 2016 20:01:02 -0700 +Subject: iio: proximity: as3935: remove triggered buffer processing + +From: Matt Ranostay + +commit 7d0643634ea567969bf3f3ed6193a9d6fc75653b upstream. + +Triggered buffers shouldn't return processed data, and the respective +conversion was overflowing the defined .realbits for the channel. + +Cc: george.mccollister@gmail.com +Signed-off-by: Matt Ranostay +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/proximity/as3935.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/iio/proximity/as3935.c ++++ b/drivers/iio/proximity/as3935.c +@@ -213,7 +213,6 @@ static irqreturn_t as3935_trigger_handle + if (ret) + goto err_read; + val &= AS3935_DATA_MASK; +- val *= 1000; + + iio_push_to_buffers_with_timestamp(indio_dev, &val, pf->timestamp); + err_read: diff --git a/queue-4.6/iio-st_pressure-fix-sampling-gains-bring-inline-with-abi.patch b/queue-4.6/iio-st_pressure-fix-sampling-gains-bring-inline-with-abi.patch new file mode 100644 index 00000000000..0e772fd28d6 --- /dev/null +++ b/queue-4.6/iio-st_pressure-fix-sampling-gains-bring-inline-with-abi.patch @@ -0,0 +1,220 @@ +From d43a41152f8e9e4c0d19850884d1fada076dee10 Mon Sep 17 00:00:00 2001 +From: Gregor Boirie +Date: Tue, 19 Apr 2016 11:18:33 +0200 +Subject: iio:st_pressure: fix sampling gains (bring inline with ABI) + +From: Gregor Boirie + +commit d43a41152f8e9e4c0d19850884d1fada076dee10 upstream. + +Temperature channels report scaled samples in Celsius although expected as +milli degree Celsius in Documentation/ABI/testing/sysfs-bus-iio. +Gains are not implemented at all for LPS001WP pressure and temperature +channels. + +This patch ensures that proper offsets and scales are exposed to userpace +for both pressure and temperature channels. +Also fix a NULL pointer exception when userspace reads content of sysfs +scale attribute when gains are not defined. + +Signed-off-by: Gregor Boirie +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/pressure/st_pressure_core.c | 80 ++++++++++++++++++++------------ + 1 file changed, 50 insertions(+), 30 deletions(-) + +--- a/drivers/iio/pressure/st_pressure_core.c ++++ b/drivers/iio/pressure/st_pressure_core.c +@@ -28,15 +28,21 @@ + #include + #include "st_pressure.h" + ++#define MCELSIUS_PER_CELSIUS 1000 ++ ++/* Default pressure sensitivity */ + #define ST_PRESS_LSB_PER_MBAR 4096UL + #define ST_PRESS_KPASCAL_NANO_SCALE (100000000UL / \ + ST_PRESS_LSB_PER_MBAR) ++ ++/* Default temperature sensitivity */ + #define ST_PRESS_LSB_PER_CELSIUS 480UL +-#define ST_PRESS_CELSIUS_NANO_SCALE (1000000000UL / \ +- ST_PRESS_LSB_PER_CELSIUS) ++#define ST_PRESS_MILLI_CELSIUS_OFFSET 42500UL ++ + #define ST_PRESS_NUMBER_DATA_CHANNELS 1 + + /* FULLSCALE */ ++#define ST_PRESS_FS_AVL_1100MB 1100 + #define ST_PRESS_FS_AVL_1260MB 1260 + + #define ST_PRESS_1_OUT_XL_ADDR 0x28 +@@ -54,9 +60,6 @@ + #define ST_PRESS_LPS331AP_PW_MASK 0x80 + #define ST_PRESS_LPS331AP_FS_ADDR 0x23 + #define ST_PRESS_LPS331AP_FS_MASK 0x30 +-#define ST_PRESS_LPS331AP_FS_AVL_1260_VAL 0x00 +-#define ST_PRESS_LPS331AP_FS_AVL_1260_GAIN ST_PRESS_KPASCAL_NANO_SCALE +-#define ST_PRESS_LPS331AP_FS_AVL_TEMP_GAIN ST_PRESS_CELSIUS_NANO_SCALE + #define ST_PRESS_LPS331AP_BDU_ADDR 0x20 + #define ST_PRESS_LPS331AP_BDU_MASK 0x04 + #define ST_PRESS_LPS331AP_DRDY_IRQ_ADDR 0x22 +@@ -65,9 +68,14 @@ + #define ST_PRESS_LPS331AP_IHL_IRQ_ADDR 0x22 + #define ST_PRESS_LPS331AP_IHL_IRQ_MASK 0x80 + #define ST_PRESS_LPS331AP_MULTIREAD_BIT true +-#define ST_PRESS_LPS331AP_TEMP_OFFSET 42500 + + /* CUSTOM VALUES FOR LPS001WP SENSOR */ ++ ++/* LPS001WP pressure resolution */ ++#define ST_PRESS_LPS001WP_LSB_PER_MBAR 16UL ++/* LPS001WP temperature resolution */ ++#define ST_PRESS_LPS001WP_LSB_PER_CELSIUS 64UL ++ + #define ST_PRESS_LPS001WP_WAI_EXP 0xba + #define ST_PRESS_LPS001WP_ODR_ADDR 0x20 + #define ST_PRESS_LPS001WP_ODR_MASK 0x30 +@@ -76,6 +84,8 @@ + #define ST_PRESS_LPS001WP_ODR_AVL_13HZ_VAL 0x03 + #define ST_PRESS_LPS001WP_PW_ADDR 0x20 + #define ST_PRESS_LPS001WP_PW_MASK 0x40 ++#define ST_PRESS_LPS001WP_FS_AVL_PRESS_GAIN \ ++ (100000000UL / ST_PRESS_LPS001WP_LSB_PER_MBAR) + #define ST_PRESS_LPS001WP_BDU_ADDR 0x20 + #define ST_PRESS_LPS001WP_BDU_MASK 0x04 + #define ST_PRESS_LPS001WP_MULTIREAD_BIT true +@@ -92,11 +102,6 @@ + #define ST_PRESS_LPS25H_ODR_AVL_25HZ_VAL 0x04 + #define ST_PRESS_LPS25H_PW_ADDR 0x20 + #define ST_PRESS_LPS25H_PW_MASK 0x80 +-#define ST_PRESS_LPS25H_FS_ADDR 0x00 +-#define ST_PRESS_LPS25H_FS_MASK 0x00 +-#define ST_PRESS_LPS25H_FS_AVL_1260_VAL 0x00 +-#define ST_PRESS_LPS25H_FS_AVL_1260_GAIN ST_PRESS_KPASCAL_NANO_SCALE +-#define ST_PRESS_LPS25H_FS_AVL_TEMP_GAIN ST_PRESS_CELSIUS_NANO_SCALE + #define ST_PRESS_LPS25H_BDU_ADDR 0x20 + #define ST_PRESS_LPS25H_BDU_MASK 0x04 + #define ST_PRESS_LPS25H_DRDY_IRQ_ADDR 0x23 +@@ -105,7 +110,6 @@ + #define ST_PRESS_LPS25H_IHL_IRQ_ADDR 0x22 + #define ST_PRESS_LPS25H_IHL_IRQ_MASK 0x80 + #define ST_PRESS_LPS25H_MULTIREAD_BIT true +-#define ST_PRESS_LPS25H_TEMP_OFFSET 42500 + #define ST_PRESS_LPS25H_OUT_XL_ADDR 0x28 + #define ST_TEMP_LPS25H_OUT_L_ADDR 0x2b + +@@ -157,7 +161,9 @@ static const struct iio_chan_spec st_pre + .storagebits = 16, + .endianness = IIO_LE, + }, +- .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), ++ .info_mask_separate = ++ BIT(IIO_CHAN_INFO_RAW) | ++ BIT(IIO_CHAN_INFO_SCALE), + .modified = 0, + }, + { +@@ -173,7 +179,7 @@ static const struct iio_chan_spec st_pre + }, + .info_mask_separate = + BIT(IIO_CHAN_INFO_RAW) | +- BIT(IIO_CHAN_INFO_OFFSET), ++ BIT(IIO_CHAN_INFO_SCALE), + .modified = 0, + }, + IIO_CHAN_SOFT_TIMESTAMP(1) +@@ -208,11 +214,14 @@ static const struct st_sensor_settings s + .addr = ST_PRESS_LPS331AP_FS_ADDR, + .mask = ST_PRESS_LPS331AP_FS_MASK, + .fs_avl = { ++ /* ++ * Pressure and temperature sensitivity values ++ * as defined in table 3 of LPS331AP datasheet. ++ */ + [0] = { + .num = ST_PRESS_FS_AVL_1260MB, +- .value = ST_PRESS_LPS331AP_FS_AVL_1260_VAL, +- .gain = ST_PRESS_LPS331AP_FS_AVL_1260_GAIN, +- .gain2 = ST_PRESS_LPS331AP_FS_AVL_TEMP_GAIN, ++ .gain = ST_PRESS_KPASCAL_NANO_SCALE, ++ .gain2 = ST_PRESS_LSB_PER_CELSIUS, + }, + }, + }, +@@ -254,7 +263,17 @@ static const struct st_sensor_settings s + .value_off = ST_SENSORS_DEFAULT_POWER_OFF_VALUE, + }, + .fs = { +- .addr = 0, ++ .fs_avl = { ++ /* ++ * Pressure and temperature resolution values ++ * as defined in table 3 of LPS001WP datasheet. ++ */ ++ [0] = { ++ .num = ST_PRESS_FS_AVL_1100MB, ++ .gain = ST_PRESS_LPS001WP_FS_AVL_PRESS_GAIN, ++ .gain2 = ST_PRESS_LPS001WP_LSB_PER_CELSIUS, ++ }, ++ }, + }, + .bdu = { + .addr = ST_PRESS_LPS001WP_BDU_ADDR, +@@ -291,14 +310,15 @@ static const struct st_sensor_settings s + .value_off = ST_SENSORS_DEFAULT_POWER_OFF_VALUE, + }, + .fs = { +- .addr = ST_PRESS_LPS25H_FS_ADDR, +- .mask = ST_PRESS_LPS25H_FS_MASK, + .fs_avl = { ++ /* ++ * Pressure and temperature sensitivity values ++ * as defined in table 3 of LPS25H datasheet. ++ */ + [0] = { + .num = ST_PRESS_FS_AVL_1260MB, +- .value = ST_PRESS_LPS25H_FS_AVL_1260_VAL, +- .gain = ST_PRESS_LPS25H_FS_AVL_1260_GAIN, +- .gain2 = ST_PRESS_LPS25H_FS_AVL_TEMP_GAIN, ++ .gain = ST_PRESS_KPASCAL_NANO_SCALE, ++ .gain2 = ST_PRESS_LSB_PER_CELSIUS, + }, + }, + }, +@@ -354,26 +374,26 @@ static int st_press_read_raw(struct iio_ + + return IIO_VAL_INT; + case IIO_CHAN_INFO_SCALE: +- *val = 0; +- + switch (ch->type) { + case IIO_PRESSURE: ++ *val = 0; + *val2 = press_data->current_fullscale->gain; +- break; ++ return IIO_VAL_INT_PLUS_NANO; + case IIO_TEMP: ++ *val = MCELSIUS_PER_CELSIUS; + *val2 = press_data->current_fullscale->gain2; +- break; ++ return IIO_VAL_FRACTIONAL; + default: + err = -EINVAL; + goto read_error; + } + +- return IIO_VAL_INT_PLUS_NANO; + case IIO_CHAN_INFO_OFFSET: + switch (ch->type) { + case IIO_TEMP: +- *val = 425; +- *val2 = 10; ++ *val = ST_PRESS_MILLI_CELSIUS_OFFSET * ++ press_data->current_fullscale->gain2; ++ *val2 = MCELSIUS_PER_CELSIUS; + break; + default: + err = -EINVAL; diff --git a/queue-4.6/ovl-copy-up-underlying-inode-s-i_mode-to-overlay-inode.patch b/queue-4.6/ovl-copy-up-underlying-inode-s-i_mode-to-overlay-inode.patch new file mode 100644 index 00000000000..bed1f8f024f --- /dev/null +++ b/queue-4.6/ovl-copy-up-underlying-inode-s-i_mode-to-overlay-inode.patch @@ -0,0 +1,55 @@ +From 07a2daab49c549a37b5b744cbebb6e3f445f12bc Mon Sep 17 00:00:00 2001 +From: Vivek Goyal +Date: Fri, 1 Jul 2016 16:34:25 -0400 +Subject: ovl: Copy up underlying inode's ->i_mode to overlay inode + +From: Vivek Goyal + +commit 07a2daab49c549a37b5b744cbebb6e3f445f12bc upstream. + +Right now when a new overlay inode is created, we initialize overlay +inode's ->i_mode from underlying inode ->i_mode but we retain only +file type bits (S_IFMT) and discard permission bits. + +This patch changes it and retains permission bits too. This should allow +overlay to do permission checks on overlay inode itself in task context. + +[SzM] It also fixes clearing suid/sgid bits on write. + +Signed-off-by: Vivek Goyal +Reported-by: Eryu Guan +Signed-off-by: Miklos Szeredi +Fixes: 4bacc9c9234c ("overlayfs: Make f_path always point to the overlay and f_inode to the underlay") +Signed-off-by: Greg Kroah-Hartman + +--- + fs/overlayfs/inode.c | 3 +-- + fs/overlayfs/overlayfs.h | 1 + + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/overlayfs/inode.c ++++ b/fs/overlayfs/inode.c +@@ -423,12 +423,11 @@ struct inode *ovl_new_inode(struct super + if (!inode) + return NULL; + +- mode &= S_IFMT; +- + inode->i_ino = get_next_ino(); + inode->i_mode = mode; + inode->i_flags |= S_NOATIME | S_NOCMTIME; + ++ mode &= S_IFMT; + switch (mode) { + case S_IFDIR: + inode->i_private = oe; +--- a/fs/overlayfs/overlayfs.h ++++ b/fs/overlayfs/overlayfs.h +@@ -185,6 +185,7 @@ static inline void ovl_copyattr(struct i + { + to->i_uid = from->i_uid; + to->i_gid = from->i_gid; ++ to->i_mode = from->i_mode; + } + + /* dir.c */ diff --git a/queue-4.6/ovl-fix-dentry-leak-for-default_permissions.patch b/queue-4.6/ovl-fix-dentry-leak-for-default_permissions.patch new file mode 100644 index 00000000000..27277dcd2e2 --- /dev/null +++ b/queue-4.6/ovl-fix-dentry-leak-for-default_permissions.patch @@ -0,0 +1,45 @@ +From a4859d75944a726533ab86d24bb5ffd1b2b7d6cc Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Wed, 29 Jun 2016 08:26:59 +0200 +Subject: ovl: fix dentry leak for default_permissions + +From: Miklos Szeredi + +commit a4859d75944a726533ab86d24bb5ffd1b2b7d6cc upstream. + +When using the 'default_permissions' mount option, ovl_permission() on +non-directories was missing a dput(alias), resulting in "BUG Dentry still +in use". + +Signed-off-by: Miklos Szeredi +Fixes: 8d3095f4ad47 ("ovl: default permissions") +Signed-off-by: Greg Kroah-Hartman + +--- + fs/overlayfs/inode.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/fs/overlayfs/inode.c ++++ b/fs/overlayfs/inode.c +@@ -121,16 +121,18 @@ int ovl_permission(struct inode *inode, + + err = vfs_getattr(&realpath, &stat); + if (err) +- return err; ++ goto out_dput; + ++ err = -ESTALE; + if ((stat.mode ^ inode->i_mode) & S_IFMT) +- return -ESTALE; ++ goto out_dput; + + inode->i_mode = stat.mode; + inode->i_uid = stat.uid; + inode->i_gid = stat.gid; + +- return generic_permission(inode, mask); ++ err = generic_permission(inode, mask); ++ goto out_dput; + } + + /* Careful in RCU walk mode */ diff --git a/queue-4.6/ovl-get_write_access-in-truncate.patch b/queue-4.6/ovl-get_write_access-in-truncate.patch new file mode 100644 index 00000000000..fbcc3862b29 --- /dev/null +++ b/queue-4.6/ovl-get_write_access-in-truncate.patch @@ -0,0 +1,86 @@ +From 03bea60409328de54e4ff7ec41672e12a9cb0908 Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Wed, 29 Jun 2016 16:03:55 +0200 +Subject: ovl: get_write_access() in truncate + +From: Miklos Szeredi + +commit 03bea60409328de54e4ff7ec41672e12a9cb0908 upstream. + +When truncating a file we should check write access on the underlying +inode. And we should do so on the lower file as well (before copy-up) for +consistency. + +Original patch and test case by Aihua Zhang. + + - - >o >o - - test.c - - >o >o - - +#include +#include +#include + +int main(int argc, char *argv[]) +{ + int ret; + + ret = truncate(argv[0], 4096); + if (ret != -1) { + fprintf(stderr, "truncate(argv[0]) should have failed\n"); + return 1; + } + if (errno != ETXTBSY) { + perror("truncate(argv[0])"); + return 1; + } + + return 0; +} + - - >o >o - - >o >o - - >o >o - - + +Reported-by: Aihua Zhang +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/overlayfs/inode.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +--- a/fs/overlayfs/inode.c ++++ b/fs/overlayfs/inode.c +@@ -59,16 +59,37 @@ int ovl_setattr(struct dentry *dentry, s + if (err) + goto out; + ++ if (attr->ia_valid & ATTR_SIZE) { ++ struct inode *realinode = d_inode(ovl_dentry_real(dentry)); ++ ++ err = -ETXTBSY; ++ if (atomic_read(&realinode->i_writecount) < 0) ++ goto out_drop_write; ++ } ++ + err = ovl_copy_up(dentry); + if (!err) { ++ struct inode *winode = NULL; ++ + upperdentry = ovl_dentry_upper(dentry); + ++ if (attr->ia_valid & ATTR_SIZE) { ++ winode = d_inode(upperdentry); ++ err = get_write_access(winode); ++ if (err) ++ goto out_drop_write; ++ } ++ + inode_lock(upperdentry->d_inode); + err = notify_change(upperdentry, attr, NULL); + if (!err) + ovl_copyattr(upperdentry->d_inode, dentry->d_inode); + inode_unlock(upperdentry->d_inode); ++ ++ if (winode) ++ put_write_access(winode); + } ++out_drop_write: + ovl_drop_write(dentry); + out: + return err; diff --git a/queue-4.6/ovl-handle-attr_kill.patch b/queue-4.6/ovl-handle-attr_kill.patch new file mode 100644 index 00000000000..c2486fe2427 --- /dev/null +++ b/queue-4.6/ovl-handle-attr_kill.patch @@ -0,0 +1,41 @@ +From b99c2d913810e56682a538c9f2394d76fca808f8 Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Mon, 4 Jul 2016 16:49:48 +0200 +Subject: ovl: handle ATTR_KILL* + +From: Miklos Szeredi + +commit b99c2d913810e56682a538c9f2394d76fca808f8 upstream. + +Before 4bacc9c9234c ("overlayfs: Make f_path...") file->f_path pointed to +the underlying file, hence suid/sgid removal on write worked fine. + +After that patch file->f_path pointed to the overlay file, and the file +mode bits weren't copied to overlay_inode->i_mode. So the suid/sgid +removal simply stopped working. + +The fix is to copy the mode bits, but then ovl_setattr() needs to clear +ATTR_MODE to avoid the BUG() in notify_change(). So do this first, then in +the next patch copy the mode. + +Reported-by: Eryu Guan +Signed-off-by: Miklos Szeredi +Fixes: 4bacc9c9234c ("overlayfs: Make f_path always point to the overlay and f_inode to the underlay") +Signed-off-by: Greg Kroah-Hartman + +--- + fs/overlayfs/inode.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/overlayfs/inode.c ++++ b/fs/overlayfs/inode.c +@@ -80,6 +80,9 @@ int ovl_setattr(struct dentry *dentry, s + goto out_drop_write; + } + ++ if (attr->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) ++ attr->ia_valid &= ~ATTR_MODE; ++ + inode_lock(upperdentry->d_inode); + err = notify_change(upperdentry, attr, NULL); + if (!err) diff --git a/queue-4.6/ovl-verify-upper-dentry-in-ovl_remove_and_whiteout.patch b/queue-4.6/ovl-verify-upper-dentry-in-ovl_remove_and_whiteout.patch new file mode 100644 index 00000000000..9c57a61c6a6 --- /dev/null +++ b/queue-4.6/ovl-verify-upper-dentry-in-ovl_remove_and_whiteout.patch @@ -0,0 +1,108 @@ +From cfc9fde0b07c3b44b570057c5f93dda59dca1c94 Mon Sep 17 00:00:00 2001 +From: Maxim Patlasov +Date: Thu, 21 Jul 2016 18:24:26 -0700 +Subject: ovl: verify upper dentry in ovl_remove_and_whiteout() + +From: Maxim Patlasov + +commit cfc9fde0b07c3b44b570057c5f93dda59dca1c94 upstream. + +The upper dentry may become stale before we call ovl_lock_rename_workdir. +For example, someone could (mistakenly or maliciously) manually unlink(2) +it directly from upperdir. + +To ensure it is not stale, let's lookup it after ovl_lock_rename_workdir +and and check if it matches the upper dentry. + +Essentially, it is the same problem and similar solution as in +commit 11f3710417d0 ("ovl: verify upper dentry before unlink and rename"). + +Signed-off-by: Maxim Patlasov +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/overlayfs/dir.c | 56 +++++++++++++++++++++++------------------------------ + 1 file changed, 25 insertions(+), 31 deletions(-) + +--- a/fs/overlayfs/dir.c ++++ b/fs/overlayfs/dir.c +@@ -511,6 +511,7 @@ static int ovl_remove_and_whiteout(struc + struct dentry *upper; + struct dentry *opaquedir = NULL; + int err; ++ int flags = 0; + + if (WARN_ON(!workdir)) + return -EROFS; +@@ -540,46 +541,39 @@ static int ovl_remove_and_whiteout(struc + if (err) + goto out_dput; + ++ upper = lookup_one_len(dentry->d_name.name, upperdir, ++ dentry->d_name.len); ++ err = PTR_ERR(upper); ++ if (IS_ERR(upper)) ++ goto out_unlock; ++ ++ err = -ESTALE; ++ if ((opaquedir && upper != opaquedir) || ++ (!opaquedir && ovl_dentry_upper(dentry) && ++ upper != ovl_dentry_upper(dentry))) { ++ goto out_dput_upper; ++ } ++ + whiteout = ovl_whiteout(workdir, dentry); + err = PTR_ERR(whiteout); + if (IS_ERR(whiteout)) +- goto out_unlock; ++ goto out_dput_upper; + +- upper = ovl_dentry_upper(dentry); +- if (!upper) { +- upper = lookup_one_len(dentry->d_name.name, upperdir, +- dentry->d_name.len); +- err = PTR_ERR(upper); +- if (IS_ERR(upper)) +- goto kill_whiteout; +- +- err = ovl_do_rename(wdir, whiteout, udir, upper, 0); +- dput(upper); +- if (err) +- goto kill_whiteout; +- } else { +- int flags = 0; +- +- if (opaquedir) +- upper = opaquedir; +- err = -ESTALE; +- if (upper->d_parent != upperdir) +- goto kill_whiteout; +- +- if (is_dir) +- flags |= RENAME_EXCHANGE; +- +- err = ovl_do_rename(wdir, whiteout, udir, upper, flags); +- if (err) +- goto kill_whiteout; ++ if (d_is_dir(upper)) ++ flags = RENAME_EXCHANGE; ++ ++ err = ovl_do_rename(wdir, whiteout, udir, upper, flags); ++ if (err) ++ goto kill_whiteout; ++ if (flags) ++ ovl_cleanup(wdir, upper); + +- if (is_dir) +- ovl_cleanup(wdir, upper); +- } + ovl_dentry_version_inc(dentry->d_parent); + out_d_drop: + d_drop(dentry); + dput(whiteout); ++out_dput_upper: ++ dput(upper); + out_unlock: + unlock_rename(workdir, upperdir); + out_dput: diff --git a/queue-4.6/series b/queue-4.6/series index 5ef32596d73..4cbe8b5e73e 100644 --- a/queue-4.6/series +++ b/queue-4.6/series @@ -142,3 +142,47 @@ drm-vmwgfx-fix-corner-case-screen-target-management.patch drm-vmwgfx-fix-error-paths-when-mapping-framebuffer.patch memory-omap-gpmc-fix-omap-gpmc-extradelay-timing.patch pci-fix-unaligned-accesses-in-vc-code.patch +xen-balloon-fix-declared-but-not-defined-warning.patch +iio-fix-error-handling-in-iio_trigger_attach_poll_func.patch +iio-st_pressure-fix-sampling-gains-bring-inline-with-abi.patch +iio-light-apds9960-add-the-missing-dev.parent.patch +iio-proximity-as3935-correct-iio_chan_info_raw-output.patch +iio-proximity-as3935-remove-triggered-buffer-processing.patch +iio-proximity-as3935-fix-buffer-stack-trashing.patch +iio-humidity-hdc100x-correct-humidity-integration-time-mask.patch +iio-humidity-hdc100x-fix-iio_temp-channel-reporting.patch +iio-hudmidity-hdc100x-fix-incorrect-shifting-and-scaling.patch +staging-iio-accel-fix-error-check.patch +iio-accel-kxsd9-fix-the-usage-of-spi_w8r8.patch +iio-ad7266-fix-broken-regulator-error-handling.patch +iio-ad7266-fix-support-for-optional-regulators.patch +iio-ad7266-fix-probe-deferral-for-vref.patch +tty-vt-fix-soft-lockup-in-fbcon-cursor-blink-timer.patch +tty-vt-keyboard-fix-oob-access-in-do_compute_shiftstate.patch +hwmon-dell-smm-restrict-fan-control-and-serial-number-to-cap_sys_admin-by-default.patch +hwmon-dell-smm-disallow-fan_type-calls-on-broken-machines.patch +hwmon-dell-smm-cache-fan_type-calls-and-change-fan-detection.patch +alsa-dummy-fix-a-use-after-free-at-closing.patch +alsa-hdac_regmap-fix-the-register-access-for-runtime-pm.patch +alsa-hda-fix-the-headset-mic-jack-detection-on-dell-machine.patch +alsa-hda-realtek-add-two-more-thinkpad-ids-5050-5053-for-tpt460-fixup.patch +alsa-au88x0-fix-calculation-in-vortex_wtdma_bufshift.patch +alsa-echoaudio-fix-memory-allocation.patch +alsa-timer-fix-negative-queue-usage-by-racy-accesses.patch +alsa-hda-realtek-add-lenovo-l460-to-docking-unit-fixup.patch +alsa-hda-add-pci-id-for-kabylake-h.patch +alsa-hda-fix-read-before-array-start.patch +alsa-usb-audio-fix-quirks-code-is-not-called.patch +alsa-hda-realtek-add-new-pin-definition-in-alc225-pin-quirk-table.patch +alsa-pcm-free-chmap-at-pcm-free-callback-too.patch +alsa-ctl-stop-notification-after-disconnection.patch +alsa-hda-fix-use-after-free-after-module-unload.patch +alsa-hda-add-amd-stoney-pci-id-with-proper-driver-caps.patch +arm-sunxi-dt-make-the-chip-inherit-from-allwinner-sun5i-a13.patch +arm-dts-armada-38x-fix-mbus_id-for-crypto-sram-on-armada-385-linksys.patch +arm-mvebu-fix-hw-i-o-coherency-related-deadlocks.patch +ovl-fix-dentry-leak-for-default_permissions.patch +ovl-get_write_access-in-truncate.patch +ovl-copy-up-underlying-inode-s-i_mode-to-overlay-inode.patch +ovl-handle-attr_kill.patch +ovl-verify-upper-dentry-in-ovl_remove_and_whiteout.patch diff --git a/queue-4.6/staging-iio-accel-fix-error-check.patch b/queue-4.6/staging-iio-accel-fix-error-check.patch new file mode 100644 index 00000000000..846a4e02a80 --- /dev/null +++ b/queue-4.6/staging-iio-accel-fix-error-check.patch @@ -0,0 +1,31 @@ +From ef3149eb3ddb7f9125e11c90f8330e371b55cffd Mon Sep 17 00:00:00 2001 +From: Luis de Bethencourt +Date: Wed, 22 Jun 2016 20:43:30 +0100 +Subject: staging: iio: accel: fix error check + +From: Luis de Bethencourt + +commit ef3149eb3ddb7f9125e11c90f8330e371b55cffd upstream. + +sca3000_read_ctrl_reg() returns a negative number on failure, check for +this instead of zero. + +Signed-off-by: Luis de Bethencourt +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/iio/accel/sca3000_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/iio/accel/sca3000_core.c ++++ b/drivers/staging/iio/accel/sca3000_core.c +@@ -594,7 +594,7 @@ static ssize_t sca3000_read_frequency(st + goto error_ret_mut; + ret = sca3000_read_ctrl_reg(st, SCA3000_REG_CTRL_SEL_OUT_CTRL); + mutex_unlock(&st->lock); +- if (ret) ++ if (ret < 0) + goto error_ret; + val = ret; + if (base_freq > 0) diff --git a/queue-4.6/tty-vt-fix-soft-lockup-in-fbcon-cursor-blink-timer.patch b/queue-4.6/tty-vt-fix-soft-lockup-in-fbcon-cursor-blink-timer.patch new file mode 100644 index 00000000000..b11cd5af38e --- /dev/null +++ b/queue-4.6/tty-vt-fix-soft-lockup-in-fbcon-cursor-blink-timer.patch @@ -0,0 +1,51 @@ +From 1b45996d2ebf9680ccd0db875fc668aa025f40fd Mon Sep 17 00:00:00 2001 +From: David Daney +Date: Tue, 17 May 2016 11:41:04 -0700 +Subject: tty: vt: Fix soft lockup in fbcon cursor blink timer. + +From: David Daney + +commit 1b45996d2ebf9680ccd0db875fc668aa025f40fd upstream. + +We are getting somewhat random soft lockups with this signature: + +[ 86.992215] [] el1_irq+0xa0/0x10c +[ 86.997082] [] cursor_timer_handler+0x30/0x54 +[ 87.002991] [] call_timer_fn+0x54/0x1a8 +[ 87.008378] [] run_timer_softirq+0x1c4/0x2bc +[ 87.014200] [] __do_softirq+0x114/0x344 +[ 87.019590] [] irq_exit+0x74/0x98 +[ 87.024458] [] __handle_domain_irq+0x98/0xfc +[ 87.030278] [] gic_handle_irq+0x94/0x190 + +This is caused by the vt visual_init() function calling into +fbcon_init() with a vc_cur_blink_ms value of zero. This is a +transient condition, as it is later set to a non-zero value. But, if +the timer happens to expire while the blink rate is zero, it goes into +an endless loop, and we get soft lockup. + +The fix is to initialize vc_cur_blink_ms before calling the con_init() +function. + +Signed-off-by: David Daney +Acked-by: Pavel Machek +Tested-by: Ming Lei +Acked-by: Scot Doyle +Tested-by: Henrique de Moraes Holschuh +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/vt/vt.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -750,6 +750,7 @@ static void visual_init(struct vc_data * + vc->vc_complement_mask = 0; + vc->vc_can_do_color = 0; + vc->vc_panic_force_write = false; ++ vc->vc_cur_blink_ms = DEFAULT_CURSOR_BLINK_MS; + vc->vc_sw->con_init(vc, init); + if (!vc->vc_complement_mask) + vc->vc_complement_mask = vc->vc_can_do_color ? 0x7700 : 0x0800; diff --git a/queue-4.6/tty-vt-keyboard-fix-oob-access-in-do_compute_shiftstate.patch b/queue-4.6/tty-vt-keyboard-fix-oob-access-in-do_compute_shiftstate.patch new file mode 100644 index 00000000000..2b16932b296 --- /dev/null +++ b/queue-4.6/tty-vt-keyboard-fix-oob-access-in-do_compute_shiftstate.patch @@ -0,0 +1,79 @@ +From 510cccb5b0c8868a2b302a0ab524da7912da648b Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Mon, 27 Jun 2016 14:12:34 -0700 +Subject: tty/vt/keyboard: fix OOB access in do_compute_shiftstate() + +From: Dmitry Torokhov + +commit 510cccb5b0c8868a2b302a0ab524da7912da648b upstream. + +The size of individual keymap in drivers/tty/vt/keyboard.c is NR_KEYS, +which is currently 256, whereas number of keys/buttons in input device (and +therefor in key_down) is much larger - KEY_CNT - 768, and that can cause +out-of-bound access when we do + + sym = U(key_maps[0][k]); + +with large 'k'. + +To fix it we should not attempt iterating beyond smaller of NR_KEYS and +KEY_CNT. + +Also while at it let's switch to for_each_set_bit() instead of open-coding +it. + +Reported-by: Sasha Levin +Reviewed-by: Guenter Roeck +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/vt/keyboard.c | 30 +++++++++--------------------- + 1 file changed, 9 insertions(+), 21 deletions(-) + +--- a/drivers/tty/vt/keyboard.c ++++ b/drivers/tty/vt/keyboard.c +@@ -366,34 +366,22 @@ static void to_utf8(struct vc_data *vc, + + static void do_compute_shiftstate(void) + { +- unsigned int i, j, k, sym, val; ++ unsigned int k, sym, val; + + shift_state = 0; + memset(shift_down, 0, sizeof(shift_down)); + +- for (i = 0; i < ARRAY_SIZE(key_down); i++) { +- +- if (!key_down[i]) ++ for_each_set_bit(k, key_down, min(NR_KEYS, KEY_CNT)) { ++ sym = U(key_maps[0][k]); ++ if (KTYP(sym) != KT_SHIFT && KTYP(sym) != KT_SLOCK) + continue; + +- k = i * BITS_PER_LONG; +- +- for (j = 0; j < BITS_PER_LONG; j++, k++) { +- +- if (!test_bit(k, key_down)) +- continue; +- +- sym = U(key_maps[0][k]); +- if (KTYP(sym) != KT_SHIFT && KTYP(sym) != KT_SLOCK) +- continue; +- +- val = KVAL(sym); +- if (val == KVAL(K_CAPSSHIFT)) +- val = KVAL(K_SHIFT); ++ val = KVAL(sym); ++ if (val == KVAL(K_CAPSSHIFT)) ++ val = KVAL(K_SHIFT); + +- shift_down[val]++; +- shift_state |= (1 << val); +- } ++ shift_down[val]++; ++ shift_state |= BIT(val); + } + } + diff --git a/queue-4.6/xen-balloon-fix-declared-but-not-defined-warning.patch b/queue-4.6/xen-balloon-fix-declared-but-not-defined-warning.patch new file mode 100644 index 00000000000..2a072f443c9 --- /dev/null +++ b/queue-4.6/xen-balloon-fix-declared-but-not-defined-warning.patch @@ -0,0 +1,75 @@ +From 842775f1509054ea969f1787f38d6a0ec2ccfaba Mon Sep 17 00:00:00 2001 +From: Ross Lagerwall +Date: Tue, 10 May 2016 10:27:54 +0100 +Subject: xen/balloon: Fix declared-but-not-defined warning + +From: Ross Lagerwall + +commit 842775f1509054ea969f1787f38d6a0ec2ccfaba upstream. + +Fix a declared-but-not-defined warning when building with +XEN_BALLOON_MEMORY_HOTPLUG=n. This fixes a regression introduced by +commit dfd74a1edfab ("xen/balloon: Fix crash when ballooning on x86 32 +bit PAE"). + +Signed-off-by: Ross Lagerwall +Acked-by: Juergen Gross +Signed-off-by: David Vrabel +Cc: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/balloon.c | 28 +++++++++++++--------------- + 1 file changed, 13 insertions(+), 15 deletions(-) + +--- a/drivers/xen/balloon.c ++++ b/drivers/xen/balloon.c +@@ -151,8 +151,6 @@ static DECLARE_WAIT_QUEUE_HEAD(balloon_w + static void balloon_process(struct work_struct *work); + static DECLARE_DELAYED_WORK(balloon_worker, balloon_process); + +-static void release_memory_resource(struct resource *resource); +- + /* When ballooning out (allocating memory to return to Xen) we don't really + want the kernel to try too hard since that can trigger the oom killer. */ + #define GFP_BALLOON \ +@@ -248,6 +246,19 @@ static enum bp_state update_schedule(enu + } + + #ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG ++static void release_memory_resource(struct resource *resource) ++{ ++ if (!resource) ++ return; ++ ++ /* ++ * No need to reset region to identity mapped since we now ++ * know that no I/O can be in this region ++ */ ++ release_resource(resource); ++ kfree(resource); ++} ++ + static struct resource *additional_memory_resource(phys_addr_t size) + { + struct resource *res; +@@ -286,19 +297,6 @@ static struct resource *additional_memor + return res; + } + +-static void release_memory_resource(struct resource *resource) +-{ +- if (!resource) +- return; +- +- /* +- * No need to reset region to identity mapped since we now +- * know that no I/O can be in this region +- */ +- release_resource(resource); +- kfree(resource); +-} +- + static enum bp_state reserve_additional_memory(void) + { + long credit;