From 169a29209b9acc6af33a9a23d1ea46c5b05ecee1 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 25 Oct 2016 20:58:05 +0200 Subject: [PATCH] 4.8-stable patches added patches: ath10k-fix-copy-engine-5-destination-ring-stuck.patch clk-imx6-fix-i.mx6dl-clock-tree-to-reflect-reality.patch clk-imx6-initialize-gpu-clocks.patch mei-fix-return-value-on-disconnection.patch mei-me-add-kaby-point-device-ids.patch mmc-block-don-t-use-cmd23-with-very-old-mmc-cards.patch mmc-sdhci-cast-unsigned-int-to-unsigned-long-long-to-avoid-unexpeted-error.patch pci-mark-atheros-ar9580-to-avoid-bus-reset.patch pci-tegra-fix-argument-order-in-tegra_pcie_phy_disable.patch pm-devfreq-event-remove-duplicate-devfreq_event_get_drvdata.patch regulator-tps65910-work-around-silicon-erratum-swcz010.patch rtlwifi-fix-missing-country-code-for-great-britain.patch spi-spidev_test-fix-buffer-overflow-in-unescape.patch --- ...copy-engine-5-destination-ring-stuck.patch | 51 +++++++++ ....mx6dl-clock-tree-to-reflect-reality.patch | 104 ++++++++++++++++++ .../clk-imx6-initialize-gpu-clocks.patch | 53 +++++++++ ...ei-fix-return-value-on-disconnection.patch | 54 +++++++++ .../mei-me-add-kaby-point-device-ids.patch | 44 ++++++++ ...-t-use-cmd23-with-very-old-mmc-cards.patch | 46 ++++++++ ...d-long-long-to-avoid-unexpeted-error.patch | 37 +++++++ ...rk-atheros-ar9580-to-avoid-bus-reset.patch | 33 ++++++ ...ment-order-in-tegra_pcie_phy_disable.patch | 33 ++++++ ...-duplicate-devfreq_event_get_drvdata.patch | 37 +++++++ ...-work-around-silicon-erratum-swcz010.patch | 61 ++++++++++ ...ssing-country-code-for-great-britain.patch | 46 ++++++++ queue-4.8/series | 13 +++ ...test-fix-buffer-overflow-in-unescape.patch | 47 ++++++++ 14 files changed, 659 insertions(+) create mode 100644 queue-4.8/ath10k-fix-copy-engine-5-destination-ring-stuck.patch create mode 100644 queue-4.8/clk-imx6-fix-i.mx6dl-clock-tree-to-reflect-reality.patch create mode 100644 queue-4.8/clk-imx6-initialize-gpu-clocks.patch create mode 100644 queue-4.8/mei-fix-return-value-on-disconnection.patch create mode 100644 queue-4.8/mei-me-add-kaby-point-device-ids.patch create mode 100644 queue-4.8/mmc-block-don-t-use-cmd23-with-very-old-mmc-cards.patch create mode 100644 queue-4.8/mmc-sdhci-cast-unsigned-int-to-unsigned-long-long-to-avoid-unexpeted-error.patch create mode 100644 queue-4.8/pci-mark-atheros-ar9580-to-avoid-bus-reset.patch create mode 100644 queue-4.8/pci-tegra-fix-argument-order-in-tegra_pcie_phy_disable.patch create mode 100644 queue-4.8/pm-devfreq-event-remove-duplicate-devfreq_event_get_drvdata.patch create mode 100644 queue-4.8/regulator-tps65910-work-around-silicon-erratum-swcz010.patch create mode 100644 queue-4.8/rtlwifi-fix-missing-country-code-for-great-britain.patch create mode 100644 queue-4.8/spi-spidev_test-fix-buffer-overflow-in-unescape.patch diff --git a/queue-4.8/ath10k-fix-copy-engine-5-destination-ring-stuck.patch b/queue-4.8/ath10k-fix-copy-engine-5-destination-ring-stuck.patch new file mode 100644 index 00000000000..6900073419a --- /dev/null +++ b/queue-4.8/ath10k-fix-copy-engine-5-destination-ring-stuck.patch @@ -0,0 +1,51 @@ +From 0628467f97b5227755428bac10a68257322f7e34 Mon Sep 17 00:00:00 2001 +From: Rajkumar Manoharan +Date: Wed, 21 Sep 2016 16:28:06 +0530 +Subject: ath10k: fix copy engine 5 destination ring stuck + +From: Rajkumar Manoharan + +commit 0628467f97b5227755428bac10a68257322f7e34 upstream. + +Firmware is running watchdog timer for tracking copy engine ring index +and write index. Whenever both indices are stuck at same location for +given duration, watchdog will be trigger to assert target. While +updating copy engine destination ring write index, driver ensures that +write index will not be same as read index by finding delta between these +two indices (CE_RING_DELTA). + +HTT target to host copy engine (CE5) is special case where ring buffers +will be reused and delta check is not applied while updating write index. +In rare scenario, whenever CE5 ring is full, both indices will be referring +same location and this is causing CE ring stuck issue as explained +above. This issue is originally reported on IPQ4019 during long hour stress +testing and during veriwave max clients testsuites. The same issue is +also observed in other chips as well. Fix this by ensuring that write +index is one less than read index which means that full ring is +available for receiving data. + +Tested-by: Tamizh chelvam +Signed-off-by: Rajkumar Manoharan +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath10k/ce.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/net/wireless/ath/ath10k/ce.c ++++ b/drivers/net/wireless/ath/ath10k/ce.c +@@ -433,6 +433,13 @@ void ath10k_ce_rx_update_write_idx(struc + unsigned int nentries_mask = dest_ring->nentries_mask; + unsigned int write_index = dest_ring->write_index; + u32 ctrl_addr = pipe->ctrl_addr; ++ u32 cur_write_idx = ath10k_ce_dest_ring_write_index_get(ar, ctrl_addr); ++ ++ /* Prevent CE ring stuck issue that will occur when ring is full. ++ * Make sure that write index is 1 less than read index. ++ */ ++ if ((cur_write_idx + nentries) == dest_ring->sw_index) ++ nentries -= 1; + + write_index = CE_RING_IDX_ADD(nentries_mask, write_index, nentries); + ath10k_ce_dest_ring_write_index_set(ar, ctrl_addr, write_index); diff --git a/queue-4.8/clk-imx6-fix-i.mx6dl-clock-tree-to-reflect-reality.patch b/queue-4.8/clk-imx6-fix-i.mx6dl-clock-tree-to-reflect-reality.patch new file mode 100644 index 00000000000..f39b456c6aa --- /dev/null +++ b/queue-4.8/clk-imx6-fix-i.mx6dl-clock-tree-to-reflect-reality.patch @@ -0,0 +1,104 @@ +From b1d51b448e4e6a392283b3eab06a7c5ec6d8a4e2 Mon Sep 17 00:00:00 2001 +From: Lucas Stach +Date: Fri, 16 Sep 2016 11:16:10 +0200 +Subject: clk: imx6: fix i.MX6DL clock tree to reflect reality + +From: Lucas Stach + +commit b1d51b448e4e6a392283b3eab06a7c5ec6d8a4e2 upstream. + +The current clock tree only implements the minimal set of differences +between the i.MX6Q and the i.MX6DL, but that doesn't really reflect +reality. + +Apply the following fixes to match the RM: +- DL has no GPU3D_SHADER_SEL/PODF, the shader domain is clocked by + GPU3D_CORE +- GPU3D_SHADER_SEL/PODF has been repurposed as GPU2D_CORE_SEL/PODF +- GPU2D_CORE_SEL/PODF has been repurposed as MLB_SEL/PODF + +Signed-off-by: Lucas Stach +Acked-by: Shawn Guo +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/imx/clk-imx6q.c | 28 ++++++++++++++++------------ + include/dt-bindings/clock/imx6qdl-clock.h | 4 +++- + 2 files changed, 19 insertions(+), 13 deletions(-) + +--- a/drivers/clk/imx/clk-imx6q.c ++++ b/drivers/clk/imx/clk-imx6q.c +@@ -318,11 +318,16 @@ static void __init imx6q_clocks_init(str + clk[IMX6QDL_CLK_IPG_PER_SEL] = imx_clk_mux("ipg_per_sel", base + 0x1c, 6, 1, ipg_per_sels, ARRAY_SIZE(ipg_per_sels)); + clk[IMX6QDL_CLK_UART_SEL] = imx_clk_mux("uart_sel", base + 0x24, 6, 1, uart_sels, ARRAY_SIZE(uart_sels)); + clk[IMX6QDL_CLK_GPU2D_CORE_SEL] = imx_clk_mux("gpu2d_core_sel", base + 0x18, 16, 2, gpu2d_core_sels_2, ARRAY_SIZE(gpu2d_core_sels_2)); ++ } else if (clk_on_imx6dl()) { ++ clk[IMX6QDL_CLK_MLB_SEL] = imx_clk_mux("mlb_sel", base + 0x18, 16, 2, gpu2d_core_sels, ARRAY_SIZE(gpu2d_core_sels)); + } else { + clk[IMX6QDL_CLK_GPU2D_CORE_SEL] = imx_clk_mux("gpu2d_core_sel", base + 0x18, 16, 2, gpu2d_core_sels, ARRAY_SIZE(gpu2d_core_sels)); + } + clk[IMX6QDL_CLK_GPU3D_CORE_SEL] = imx_clk_mux("gpu3d_core_sel", base + 0x18, 4, 2, gpu3d_core_sels, ARRAY_SIZE(gpu3d_core_sels)); +- clk[IMX6QDL_CLK_GPU3D_SHADER_SEL] = imx_clk_mux("gpu3d_shader_sel", base + 0x18, 8, 2, gpu3d_shader_sels, ARRAY_SIZE(gpu3d_shader_sels)); ++ if (clk_on_imx6dl()) ++ clk[IMX6QDL_CLK_GPU2D_CORE_SEL] = imx_clk_mux("gpu2d_core_sel", base + 0x18, 8, 2, gpu3d_shader_sels, ARRAY_SIZE(gpu3d_shader_sels)); ++ else ++ clk[IMX6QDL_CLK_GPU3D_SHADER_SEL] = imx_clk_mux("gpu3d_shader_sel", base + 0x18, 8, 2, gpu3d_shader_sels, ARRAY_SIZE(gpu3d_shader_sels)); + clk[IMX6QDL_CLK_IPU1_SEL] = imx_clk_mux("ipu1_sel", base + 0x3c, 9, 2, ipu_sels, ARRAY_SIZE(ipu_sels)); + clk[IMX6QDL_CLK_IPU2_SEL] = imx_clk_mux("ipu2_sel", base + 0x3c, 14, 2, ipu_sels, ARRAY_SIZE(ipu_sels)); + clk[IMX6QDL_CLK_LDB_DI0_SEL] = imx_clk_mux_flags("ldb_di0_sel", base + 0x2c, 9, 3, ldb_di_sels, ARRAY_SIZE(ldb_di_sels), CLK_SET_RATE_PARENT); +@@ -400,9 +405,15 @@ static void __init imx6q_clocks_init(str + clk[IMX6QDL_CLK_LDB_DI0_DIV_3_5] = imx_clk_fixed_factor("ldb_di0_div_3_5", "ldb_di0_sel", 2, 7); + clk[IMX6QDL_CLK_LDB_DI1_DIV_3_5] = imx_clk_fixed_factor("ldb_di1_div_3_5", "ldb_di1_sel", 2, 7); + } +- clk[IMX6QDL_CLK_GPU2D_CORE_PODF] = imx_clk_divider("gpu2d_core_podf", "gpu2d_core_sel", base + 0x18, 23, 3); ++ if (clk_on_imx6dl()) ++ clk[IMX6QDL_CLK_MLB_PODF] = imx_clk_divider("mlb_podf", "mlb_sel", base + 0x18, 23, 3); ++ else ++ clk[IMX6QDL_CLK_GPU2D_CORE_PODF] = imx_clk_divider("gpu2d_core_podf", "gpu2d_core_sel", base + 0x18, 23, 3); + clk[IMX6QDL_CLK_GPU3D_CORE_PODF] = imx_clk_divider("gpu3d_core_podf", "gpu3d_core_sel", base + 0x18, 26, 3); +- clk[IMX6QDL_CLK_GPU3D_SHADER] = imx_clk_divider("gpu3d_shader", "gpu3d_shader_sel", base + 0x18, 29, 3); ++ if (clk_on_imx6dl()) ++ clk[IMX6QDL_CLK_GPU2D_CORE_PODF] = imx_clk_divider("gpu2d_core_podf", "gpu2d_core_sel", base + 0x18, 29, 3); ++ else ++ clk[IMX6QDL_CLK_GPU3D_SHADER] = imx_clk_divider("gpu3d_shader", "gpu3d_shader_sel", base + 0x18, 29, 3); + clk[IMX6QDL_CLK_IPU1_PODF] = imx_clk_divider("ipu1_podf", "ipu1_sel", base + 0x3c, 11, 3); + clk[IMX6QDL_CLK_IPU2_PODF] = imx_clk_divider("ipu2_podf", "ipu2_sel", base + 0x3c, 16, 3); + clk[IMX6QDL_CLK_LDB_DI0_PODF] = imx_clk_divider_flags("ldb_di0_podf", "ldb_di0_div_3_5", base + 0x20, 10, 1, 0); +@@ -473,14 +484,7 @@ static void __init imx6q_clocks_init(str + clk[IMX6QDL_CLK_ESAI_MEM] = imx_clk_gate2_shared("esai_mem", "ahb", base + 0x6c, 16, &share_count_esai); + clk[IMX6QDL_CLK_GPT_IPG] = imx_clk_gate2("gpt_ipg", "ipg", base + 0x6c, 20); + clk[IMX6QDL_CLK_GPT_IPG_PER] = imx_clk_gate2("gpt_ipg_per", "ipg_per", base + 0x6c, 22); +- if (clk_on_imx6dl()) +- /* +- * The multiplexer and divider of imx6q clock gpu3d_shader get +- * redefined/reused as gpu2d_core_sel and gpu2d_core_podf on imx6dl. +- */ +- clk[IMX6QDL_CLK_GPU2D_CORE] = imx_clk_gate2("gpu2d_core", "gpu3d_shader", base + 0x6c, 24); +- else +- clk[IMX6QDL_CLK_GPU2D_CORE] = imx_clk_gate2("gpu2d_core", "gpu2d_core_podf", base + 0x6c, 24); ++ clk[IMX6QDL_CLK_GPU2D_CORE] = imx_clk_gate2("gpu2d_core", "gpu2d_core_podf", base + 0x6c, 24); + clk[IMX6QDL_CLK_GPU3D_CORE] = imx_clk_gate2("gpu3d_core", "gpu3d_core_podf", base + 0x6c, 26); + clk[IMX6QDL_CLK_HDMI_IAHB] = imx_clk_gate2("hdmi_iahb", "ahb", base + 0x70, 0); + clk[IMX6QDL_CLK_HDMI_ISFR] = imx_clk_gate2("hdmi_isfr", "video_27m", base + 0x70, 4); +@@ -511,7 +515,7 @@ static void __init imx6q_clocks_init(str + * The multiplexer and divider of the imx6q clock gpu2d get + * redefined/reused as mlb_sys_sel and mlb_sys_clk_podf on imx6dl. + */ +- clk[IMX6QDL_CLK_MLB] = imx_clk_gate2("mlb", "gpu2d_core_podf", base + 0x74, 18); ++ clk[IMX6QDL_CLK_MLB] = imx_clk_gate2("mlb", "mlb_podf", base + 0x74, 18); + else + clk[IMX6QDL_CLK_MLB] = imx_clk_gate2("mlb", "axi", base + 0x74, 18); + clk[IMX6QDL_CLK_MMDC_CH0_AXI] = imx_clk_gate2("mmdc_ch0_axi", "mmdc_ch0_axi_podf", base + 0x74, 20); +--- a/include/dt-bindings/clock/imx6qdl-clock.h ++++ b/include/dt-bindings/clock/imx6qdl-clock.h +@@ -269,6 +269,8 @@ + #define IMX6QDL_CLK_PRG0_APB 256 + #define IMX6QDL_CLK_PRG1_APB 257 + #define IMX6QDL_CLK_PRE_AXI 258 +-#define IMX6QDL_CLK_END 259 ++#define IMX6QDL_CLK_MLB_SEL 259 ++#define IMX6QDL_CLK_MLB_PODF 260 ++#define IMX6QDL_CLK_END 261 + + #endif /* __DT_BINDINGS_CLOCK_IMX6QDL_H */ diff --git a/queue-4.8/clk-imx6-initialize-gpu-clocks.patch b/queue-4.8/clk-imx6-initialize-gpu-clocks.patch new file mode 100644 index 00000000000..0ef53d8f953 --- /dev/null +++ b/queue-4.8/clk-imx6-initialize-gpu-clocks.patch @@ -0,0 +1,53 @@ +From d8846023aed1293e54d33499558fc2aa2b2f393f Mon Sep 17 00:00:00 2001 +From: Lucas Stach +Date: Fri, 16 Sep 2016 11:16:11 +0200 +Subject: clk: imx6: initialize GPU clocks + +From: Lucas Stach + +commit d8846023aed1293e54d33499558fc2aa2b2f393f upstream. + +Initialize the GPU clock muxes to sane inputs. Until now they have +not been changed from their default values, which means that both +GPU3D shader and GPU2D core were fed by clock inputs whose rates +exceed the maximium allowed frequency of the cores by as much as +200MHz. + +This fixes a severe GPU stability issue on i.MX6DL. + +Signed-off-by: Lucas Stach +Acked-by: Shawn Guo +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/imx/clk-imx6q.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +--- a/drivers/clk/imx/clk-imx6q.c ++++ b/drivers/clk/imx/clk-imx6q.c +@@ -629,6 +629,24 @@ static void __init imx6q_clocks_init(str + if (IS_ENABLED(CONFIG_PCI_IMX6)) + clk_set_parent(clk[IMX6QDL_CLK_LVDS1_SEL], clk[IMX6QDL_CLK_SATA_REF_100M]); + ++ /* ++ * Initialize the GPU clock muxes, so that the maximum specified clock ++ * rates for the respective SoC are not exceeded. ++ */ ++ if (clk_on_imx6dl()) { ++ clk_set_parent(clk[IMX6QDL_CLK_GPU3D_CORE_SEL], ++ clk[IMX6QDL_CLK_PLL2_PFD1_594M]); ++ clk_set_parent(clk[IMX6QDL_CLK_GPU2D_CORE_SEL], ++ clk[IMX6QDL_CLK_PLL2_PFD1_594M]); ++ } else if (clk_on_imx6q()) { ++ clk_set_parent(clk[IMX6QDL_CLK_GPU3D_CORE_SEL], ++ clk[IMX6QDL_CLK_MMDC_CH0_AXI]); ++ clk_set_parent(clk[IMX6QDL_CLK_GPU3D_SHADER_SEL], ++ clk[IMX6QDL_CLK_PLL2_PFD1_594M]); ++ clk_set_parent(clk[IMX6QDL_CLK_GPU2D_CORE_SEL], ++ clk[IMX6QDL_CLK_PLL3_USB_OTG]); ++ } ++ + imx_register_uart_clocks(uart_clks); + } + CLK_OF_DECLARE(imx6q, "fsl,imx6q-ccm", imx6q_clocks_init); diff --git a/queue-4.8/mei-fix-return-value-on-disconnection.patch b/queue-4.8/mei-fix-return-value-on-disconnection.patch new file mode 100644 index 00000000000..e6c1e1b3baf --- /dev/null +++ b/queue-4.8/mei-fix-return-value-on-disconnection.patch @@ -0,0 +1,54 @@ +From 2d4d5481e2d6f93b25fcfb13a9f20bbfbf54266a Mon Sep 17 00:00:00 2001 +From: Tomas Winkler +Date: Thu, 23 Jun 2016 00:25:31 +0300 +Subject: mei: fix return value on disconnection + +From: Tomas Winkler + +commit 2d4d5481e2d6f93b25fcfb13a9f20bbfbf54266a upstream. + +Correct errno on client disconnection is -ENODEV not -EBUSY + +Signed-off-by: Tomas Winkler +Signed-off-by: Alexander Usyskin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/mei/amthif.c | 2 +- + drivers/misc/mei/bus.c | 2 +- + drivers/misc/mei/main.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/misc/mei/amthif.c ++++ b/drivers/misc/mei/amthif.c +@@ -139,7 +139,7 @@ int mei_amthif_read(struct mei_device *d + return -ERESTARTSYS; + + if (!mei_cl_is_connected(cl)) { +- rets = -EBUSY; ++ rets = -ENODEV; + goto out; + } + +--- a/drivers/misc/mei/bus.c ++++ b/drivers/misc/mei/bus.c +@@ -142,7 +142,7 @@ ssize_t __mei_cl_recv(struct mei_cl *cl, + mutex_lock(&bus->device_lock); + + if (!mei_cl_is_connected(cl)) { +- rets = -EBUSY; ++ rets = -ENODEV; + goto out; + } + } +--- a/drivers/misc/mei/main.c ++++ b/drivers/misc/mei/main.c +@@ -202,7 +202,7 @@ static ssize_t mei_read(struct file *fil + + mutex_lock(&dev->device_lock); + if (!mei_cl_is_connected(cl)) { +- rets = -EBUSY; ++ rets = -ENODEV; + goto out; + } + } diff --git a/queue-4.8/mei-me-add-kaby-point-device-ids.patch b/queue-4.8/mei-me-add-kaby-point-device-ids.patch new file mode 100644 index 00000000000..48bdf5ffa0a --- /dev/null +++ b/queue-4.8/mei-me-add-kaby-point-device-ids.patch @@ -0,0 +1,44 @@ +From ac182e8abc6f93c1c4cc12f042af64c9d7be0d1e Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Mon, 12 Sep 2016 16:21:43 +0300 +Subject: mei: me: add kaby point device ids + +From: Alexander Usyskin + +commit ac182e8abc6f93c1c4cc12f042af64c9d7be0d1e upstream. + +Add device ids for Intel Kabypoint PCH (Kabylake) + +Signed-off-by: Alexander Usyskin +Signed-off-by: Tomas Winkler +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/mei/hw-me-regs.h | 3 +++ + drivers/misc/mei/pci-me.c | 3 +++ + 2 files changed, 6 insertions(+) + +--- a/drivers/misc/mei/hw-me-regs.h ++++ b/drivers/misc/mei/hw-me-regs.h +@@ -125,6 +125,9 @@ + #define MEI_DEV_ID_BXT_M 0x1A9A /* Broxton M */ + #define MEI_DEV_ID_APL_I 0x5A9A /* Apollo Lake I */ + ++#define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */ ++#define MEI_DEV_ID_KBP_2 0xA2BB /* Kaby Point 2 */ ++ + /* + * MEI HW Section + */ +--- a/drivers/misc/mei/pci-me.c ++++ b/drivers/misc/mei/pci-me.c +@@ -91,6 +91,9 @@ static const struct pci_device_id mei_me + {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)}, + ++ {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, mei_me_pch8_cfg)}, ++ {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, mei_me_pch8_cfg)}, ++ + /* required last entry */ + {0, } + }; diff --git a/queue-4.8/mmc-block-don-t-use-cmd23-with-very-old-mmc-cards.patch b/queue-4.8/mmc-block-don-t-use-cmd23-with-very-old-mmc-cards.patch new file mode 100644 index 00000000000..8258630100b --- /dev/null +++ b/queue-4.8/mmc-block-don-t-use-cmd23-with-very-old-mmc-cards.patch @@ -0,0 +1,46 @@ +From 0ed50abb2d8fc81570b53af25621dad560cd49b3 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20Gl=C3=B6ckner?= +Date: Tue, 30 Aug 2016 14:17:30 +0200 +Subject: mmc: block: don't use CMD23 with very old MMC cards +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Glöckner + +commit 0ed50abb2d8fc81570b53af25621dad560cd49b3 upstream. + +CMD23 aka SET_BLOCK_COUNT was introduced with MMC v3.1. +Older versions of the specification allowed to terminate +multi-block transfers only with CMD12. + +The patch fixes the following problem: + + mmc0: new MMC card at address 0001 + mmcblk0: mmc0:0001 SDMB-16 15.3 MiB + mmcblk0: timed out sending SET_BLOCK_COUNT command, card status 0x400900 + ... + blk_update_request: I/O error, dev mmcblk0, sector 0 + Buffer I/O error on dev mmcblk0, logical block 0, async page read + mmcblk0: unable to read partition table + +Signed-off-by: Daniel Glöckner +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/card/block.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/card/block.c ++++ b/drivers/mmc/card/block.c +@@ -2303,7 +2303,8 @@ again: + set_capacity(md->disk, size); + + if (mmc_host_cmd23(card->host)) { +- if (mmc_card_mmc(card) || ++ if ((mmc_card_mmc(card) && ++ card->csd.mmca_vsn >= CSD_SPEC_VER_3) || + (mmc_card_sd(card) && + card->scr.cmds & SD_SCR_CMD23_SUPPORT)) + md->flags |= MMC_BLK_CMD23; diff --git a/queue-4.8/mmc-sdhci-cast-unsigned-int-to-unsigned-long-long-to-avoid-unexpeted-error.patch b/queue-4.8/mmc-sdhci-cast-unsigned-int-to-unsigned-long-long-to-avoid-unexpeted-error.patch new file mode 100644 index 00000000000..e96408569a4 --- /dev/null +++ b/queue-4.8/mmc-sdhci-cast-unsigned-int-to-unsigned-long-long-to-avoid-unexpeted-error.patch @@ -0,0 +1,37 @@ +From 02265cd60335a2c1417abae4192611e1fc05a6e5 Mon Sep 17 00:00:00 2001 +From: Haibo Chen +Date: Mon, 17 Oct 2016 10:18:37 +0200 +Subject: mmc: sdhci: cast unsigned int to unsigned long long to avoid unexpeted error + +From: Haibo Chen + +commit 02265cd60335a2c1417abae4192611e1fc05a6e5 upstream. + +Potentially overflowing expression 1000000 * data->timeout_clks with +type unsigned int is evaluated using 32-bit arithmetic, and then used +in a context that expects an expression of type unsigned long long. + +To avoid overflow, cast 1000000U to type unsigned long long. +Special thanks to Coverity. + +Fixes: 7f05538af71c ("mmc: sdhci: fix data timeout (part 2)") +Signed-off-by: Haibo Chen +Acked-by: Adrian Hunter +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -687,7 +687,7 @@ static u8 sdhci_calc_timeout(struct sdhc + * host->clock is in Hz. target_timeout is in us. + * Hence, us = 1000000 * cycles / Hz. Round up. + */ +- val = 1000000 * data->timeout_clks; ++ val = 1000000ULL * data->timeout_clks; + if (do_div(val, host->clock)) + target_timeout++; + target_timeout += val; diff --git a/queue-4.8/pci-mark-atheros-ar9580-to-avoid-bus-reset.patch b/queue-4.8/pci-mark-atheros-ar9580-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..981f55f367e --- /dev/null +++ b/queue-4.8/pci-mark-atheros-ar9580-to-avoid-bus-reset.patch @@ -0,0 +1,33 @@ +From 8e2e03179923479ca0c0b6fdc7c93ecf89bce7a8 Mon Sep 17 00:00:00 2001 +From: Maik Broemme +Date: Tue, 9 Aug 2016 16:41:31 +0200 +Subject: PCI: Mark Atheros AR9580 to avoid bus reset + +From: Maik Broemme + +commit 8e2e03179923479ca0c0b6fdc7c93ecf89bce7a8 upstream. + +Similar to the AR93xx and the AR94xx series, the AR95xx also have the same +quirk for the Bus Reset. It will lead to instant system reset if the +device is assigned via VFIO to a KVM VM. I've been able reproduce this +behavior with a MikroTik R11e-2HnD. + +Fixes: c3e59ee4e766 ("PCI: Mark Atheros AR93xx to avoid bus reset") +Signed-off-by: Maik Broemme +Signed-off-by: Bjorn Helgaas +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3198,6 +3198,7 @@ static void quirk_no_bus_reset(struct pc + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset); + + static void quirk_no_pm_reset(struct pci_dev *dev) + { diff --git a/queue-4.8/pci-tegra-fix-argument-order-in-tegra_pcie_phy_disable.patch b/queue-4.8/pci-tegra-fix-argument-order-in-tegra_pcie_phy_disable.patch new file mode 100644 index 00000000000..aafd3413ce8 --- /dev/null +++ b/queue-4.8/pci-tegra-fix-argument-order-in-tegra_pcie_phy_disable.patch @@ -0,0 +1,33 @@ +From 8dd99bca7bfa4b62753b556c45d26f45ec9da6e6 Mon Sep 17 00:00:00 2001 +From: Bjorn Helgaas +Date: Wed, 5 Oct 2016 16:04:13 -0500 +Subject: PCI: tegra: Fix argument order in tegra_pcie_phy_disable() + +From: Bjorn Helgaas + +commit 8dd99bca7bfa4b62753b556c45d26f45ec9da6e6 upstream. + +The tegra_pcie_phy_disable() path called pads_writel() with arguments in +the wrong order. Swap them to be the "value, offset" order expected by +pads_writel(). + +Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs") +Signed-off-by: Bjorn Helgaas +Acked-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/host/pci-tegra.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/host/pci-tegra.c ++++ b/drivers/pci/host/pci-tegra.c +@@ -856,7 +856,7 @@ static int tegra_pcie_phy_disable(struct + /* override IDDQ */ + value = pads_readl(pcie, PADS_CTL); + value |= PADS_CTL_IDDQ_1L; +- pads_writel(pcie, PADS_CTL, value); ++ pads_writel(pcie, value, PADS_CTL); + + /* reset PLL */ + value = pads_readl(pcie, soc->pads_pll_ctl); diff --git a/queue-4.8/pm-devfreq-event-remove-duplicate-devfreq_event_get_drvdata.patch b/queue-4.8/pm-devfreq-event-remove-duplicate-devfreq_event_get_drvdata.patch new file mode 100644 index 00000000000..fc42f55923c --- /dev/null +++ b/queue-4.8/pm-devfreq-event-remove-duplicate-devfreq_event_get_drvdata.patch @@ -0,0 +1,37 @@ +From c8a9a6daccad495c48d5435d3487956ce01bc6a1 Mon Sep 17 00:00:00 2001 +From: Lin Huang +Date: Thu, 4 Aug 2016 19:32:33 +0900 +Subject: PM / devfreq: event: remove duplicate devfreq_event_get_drvdata() + +From: Lin Huang + +commit c8a9a6daccad495c48d5435d3487956ce01bc6a1 upstream. + +there define two devfreq_event_get_drvdata() function in devfreq-event.h +when disable CONFIG_PM_DEVFREQ_EVENT, it will lead to build fail. So +remove devfreq_event_get_drvdata() function. + +Fixes: f262f28c1470 ("PM / devfreq: event: Add devfreq_event class") +Signed-off-by: Lin Huang +Signed-off-by: Chanwoo Choi +Signed-off-by: MyungJoo Ham +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/devfreq-event.h | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/include/linux/devfreq-event.h ++++ b/include/linux/devfreq-event.h +@@ -148,11 +148,6 @@ static inline int devfreq_event_reset_ev + return -EINVAL; + } + +-static inline void *devfreq_event_get_drvdata(struct devfreq_event_dev *edev) +-{ +- return ERR_PTR(-EINVAL); +-} +- + static inline struct devfreq_event_dev *devfreq_event_get_edev_by_phandle( + struct device *dev, int index) + { diff --git a/queue-4.8/regulator-tps65910-work-around-silicon-erratum-swcz010.patch b/queue-4.8/regulator-tps65910-work-around-silicon-erratum-swcz010.patch new file mode 100644 index 00000000000..fecb5a54f8d --- /dev/null +++ b/queue-4.8/regulator-tps65910-work-around-silicon-erratum-swcz010.patch @@ -0,0 +1,61 @@ +From 8f9165c981fed187bb483de84caf9adf835aefda Mon Sep 17 00:00:00 2001 +From: Jan Remmet +Date: Fri, 23 Sep 2016 10:52:00 +0200 +Subject: regulator: tps65910: Work around silicon erratum SWCZ010 + +From: Jan Remmet + +commit 8f9165c981fed187bb483de84caf9adf835aefda upstream. + +http://www.ti.com/lit/pdf/SWCZ010: + DCDC o/p voltage can go higher than programmed value + +Impact: +VDDI, VDD2, and VIO output programmed voltage level can go higher than +expected or crash, when coming out of PFM to PWM mode or using DVFS. + +Description: +When DCDC CLK SYNC bits are 11/01: +* VIO 3-MHz oscillator is the source clock of the digital core and input + clock of VDD1 and VDD2 +* Turn-on of VDD1 and VDD2 HSD PFETis synchronized or at a constant + phase shift +* Current pulled though VCC1+VCC2 is Iload(VDD1) + Iload(VDD2) +* The 3 HSD PFET will be turned-on at the same time, causing the highest + possible switching noise on the application. This noise level depends + on the layout, the VBAT level, and the load current. The noise level + increases with improper layout. + +When DCDC CLK SYNC bits are 00: +* VIO 3-MHz oscillator is the source clock of digital core +* VDD1 and VDD2 are running on their own 3-MHz oscillator +* Current pulled though VCC1+VCC2 average of Iload(VDD1) + Iload(VDD2) +* The switching noise of the 3 SMPS will be randomly spread over time, + causing lower overall switching noise. + +Workaround: +Set DCDCCTRL_REG[1:0]= 00. + +Signed-off-by: Jan Remmet +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/tps65910-regulator.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/regulator/tps65910-regulator.c ++++ b/drivers/regulator/tps65910-regulator.c +@@ -1111,6 +1111,12 @@ static int tps65910_probe(struct platfor + pmic->num_regulators = ARRAY_SIZE(tps65910_regs); + pmic->ext_sleep_control = tps65910_ext_sleep_control; + info = tps65910_regs; ++ /* Work around silicon erratum SWCZ010: output programmed ++ * voltage level can go higher than expected or crash ++ * Workaround: use no synchronization of DCDC clocks ++ */ ++ tps65910_reg_clear_bits(pmic->mfd, TPS65910_DCDCCTRL, ++ DCDCCTRL_DCDCCKSYNC_MASK); + break; + case TPS65911: + pmic->get_ctrl_reg = &tps65911_get_ctrl_register; diff --git a/queue-4.8/rtlwifi-fix-missing-country-code-for-great-britain.patch b/queue-4.8/rtlwifi-fix-missing-country-code-for-great-britain.patch new file mode 100644 index 00000000000..bcf8bf97917 --- /dev/null +++ b/queue-4.8/rtlwifi-fix-missing-country-code-for-great-britain.patch @@ -0,0 +1,46 @@ +From 0c9d3491530773858ff9d705ec2a9c382f449230 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Mon, 22 Aug 2016 14:27:59 -0500 +Subject: rtlwifi: Fix missing country code for Great Britain + +From: Larry Finger + +commit 0c9d3491530773858ff9d705ec2a9c382f449230 upstream. + +Some RTL8821AE devices sold in Great Britain have the country code of +0x25 encoded in their EEPROM. This value is not tested in the routine +that establishes the regulatory info for the chip. The fix is to set +this code to have the same capabilities as the EU countries. In addition, +the channels allowed for COUNTRY_CODE_ETSI were more properly suited +for China and Israel, not the EU. This problem has also been fixed. + +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/realtek/rtlwifi/regd.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/realtek/rtlwifi/regd.c ++++ b/drivers/net/wireless/realtek/rtlwifi/regd.c +@@ -345,9 +345,9 @@ static const struct ieee80211_regdomain + return &rtl_regdom_no_midband; + case COUNTRY_CODE_IC: + return &rtl_regdom_11; +- case COUNTRY_CODE_ETSI: + case COUNTRY_CODE_TELEC_NETGEAR: + return &rtl_regdom_60_64; ++ case COUNTRY_CODE_ETSI: + case COUNTRY_CODE_SPAIN: + case COUNTRY_CODE_FRANCE: + case COUNTRY_CODE_ISRAEL: +@@ -406,6 +406,8 @@ static u8 channel_plan_to_country_code(u + return COUNTRY_CODE_WORLD_WIDE_13; + case 0x22: + return COUNTRY_CODE_IC; ++ case 0x25: ++ return COUNTRY_CODE_ETSI; + case 0x32: + return COUNTRY_CODE_TELEC_NETGEAR; + case 0x41: diff --git a/queue-4.8/series b/queue-4.8/series index 902a05ff96d..70ccb4a9201 100644 --- a/queue-4.8/series +++ b/queue-4.8/series @@ -1 +1,14 @@ gpio-mpc8xxx-correct-irq-handler-function.patch +mei-fix-return-value-on-disconnection.patch +mei-me-add-kaby-point-device-ids.patch +regulator-tps65910-work-around-silicon-erratum-swcz010.patch +clk-imx6-initialize-gpu-clocks.patch +clk-imx6-fix-i.mx6dl-clock-tree-to-reflect-reality.patch +spi-spidev_test-fix-buffer-overflow-in-unescape.patch +pm-devfreq-event-remove-duplicate-devfreq_event_get_drvdata.patch +ath10k-fix-copy-engine-5-destination-ring-stuck.patch +rtlwifi-fix-missing-country-code-for-great-britain.patch +mmc-block-don-t-use-cmd23-with-very-old-mmc-cards.patch +mmc-sdhci-cast-unsigned-int-to-unsigned-long-long-to-avoid-unexpeted-error.patch +pci-mark-atheros-ar9580-to-avoid-bus-reset.patch +pci-tegra-fix-argument-order-in-tegra_pcie_phy_disable.patch diff --git a/queue-4.8/spi-spidev_test-fix-buffer-overflow-in-unescape.patch b/queue-4.8/spi-spidev_test-fix-buffer-overflow-in-unescape.patch new file mode 100644 index 00000000000..3efbe4b3600 --- /dev/null +++ b/queue-4.8/spi-spidev_test-fix-buffer-overflow-in-unescape.patch @@ -0,0 +1,47 @@ +From 0278b34bf15f8d8a609595b15909cd8622dd64ca Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Fri, 9 Sep 2016 09:02:51 +0200 +Subject: spi: spidev_test: Fix buffer overflow in unescape() + +From: Geert Uytterhoeven + +commit 0278b34bf15f8d8a609595b15909cd8622dd64ca upstream. + +Sometimes spidev_test crashes with: + + *** Error in `spidev_test': munmap_chunk(): invalid pointer: 0x00022020 *** + Aborted + +or just + + Segmentation fault + +This is due to transfer_escaped_string() miscalculating the required +size of the buffer by one byte, causing a buffer overflow in unescape(). + +Drop the bogus "+ 1" in the strlen() parameter to fix this. + +Note that unescape() never copies the zero-terminator of the source +string, so it writes at most as many bytes as the length of the source +string. + +Fixes: 30061915be6e3a2c (spi: spidev_test: Added input buffer from the terminal) +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + tools/spi/spidev_test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/spi/spidev_test.c ++++ b/tools/spi/spidev_test.c +@@ -284,7 +284,7 @@ static void parse_opts(int argc, char *a + + static void transfer_escaped_string(int fd, char *str) + { +- size_t size = strlen(str + 1); ++ size_t size = strlen(str); + uint8_t *tx; + uint8_t *rx; + -- 2.47.3