From 905f85a8a50a5e7dffd7f8030f7f3eb5c072e8fc Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 19 Apr 2018 18:25:30 +0200 Subject: [PATCH] 4.16-stable patches added patches: arm-dts-at91-at91sam9g25-fix-mux-mask-pinctrl-property.patch arm-dts-at91-sama5d4-fix-pinctrl-compatible-string.patch arm-dts-exynos-fix-iommu-support-for-gscaler-devices-on-exynos5250.patch arm-dts-mt7623-fix-usb-initialization-fails-on-bananapi-r2.patch arm-exynos-fix-coupled-cpu-idle-freeze-on-exynos4210.patch arm64-dts-meson-reduce-odroid-c2-emmc-maximum-rate.patch kvm-arm-arm64-vgic-its-fix-potential-overrun-in-vgic_copy_lpi_list.patch media-atomisp_fops.c-disable-atomisp_compat_ioctl32.patch media-rc-oops-in-ir_timer_keyup-after-device-unplug.patch media-vb2-core-finish-buffers-at-the-end-of-the-stream.patch media-vivid-check-if-the-cec_adapter-is-valid.patch media-vsp1-fix-brx-conditional-path-in-wpf.patch spi-atmel-init-fifos-before-spi-enable.patch spi-fix-scatterlist-elements-size-in-spi_map_buf.patch spi-fix-unregistration-of-controller-with-fixed-spi-bus-number.patch --- ...am9g25-fix-mux-mask-pinctrl-property.patch | 34 ++++++++ ...ama5d4-fix-pinctrl-compatible-string.patch | 35 +++++++++ ...rt-for-gscaler-devices-on-exynos5250.patch | 62 +++++++++++++++ ...-initialization-fails-on-bananapi-r2.patch | 73 ++++++++++++++++++ ...oupled-cpu-idle-freeze-on-exynos4210.patch | 50 ++++++++++++ ...n-reduce-odroid-c2-emmc-maximum-rate.patch | 43 +++++++++++ ...ential-overrun-in-vgic_copy_lpi_list.patch | 77 +++++++++++++++++++ ...ops.c-disable-atomisp_compat_ioctl32.patch | 48 ++++++++++++ ...n-ir_timer_keyup-after-device-unplug.patch | 41 ++++++++++ ...ish-buffers-at-the-end-of-the-stream.patch | 49 ++++++++++++ ...id-check-if-the-cec_adapter-is-valid.patch | 33 ++++++++ ...vsp1-fix-brx-conditional-path-in-wpf.patch | 48 ++++++++++++ queue-4.16/series | 15 ++++ ...i-atmel-init-fifos-before-spi-enable.patch | 49 ++++++++++++ ...terlist-elements-size-in-spi_map_buf.patch | 50 ++++++++++++ ...controller-with-fixed-spi-bus-number.patch | 69 +++++++++++++++++ 16 files changed, 776 insertions(+) create mode 100644 queue-4.16/arm-dts-at91-at91sam9g25-fix-mux-mask-pinctrl-property.patch create mode 100644 queue-4.16/arm-dts-at91-sama5d4-fix-pinctrl-compatible-string.patch create mode 100644 queue-4.16/arm-dts-exynos-fix-iommu-support-for-gscaler-devices-on-exynos5250.patch create mode 100644 queue-4.16/arm-dts-mt7623-fix-usb-initialization-fails-on-bananapi-r2.patch create mode 100644 queue-4.16/arm-exynos-fix-coupled-cpu-idle-freeze-on-exynos4210.patch create mode 100644 queue-4.16/arm64-dts-meson-reduce-odroid-c2-emmc-maximum-rate.patch create mode 100644 queue-4.16/kvm-arm-arm64-vgic-its-fix-potential-overrun-in-vgic_copy_lpi_list.patch create mode 100644 queue-4.16/media-atomisp_fops.c-disable-atomisp_compat_ioctl32.patch create mode 100644 queue-4.16/media-rc-oops-in-ir_timer_keyup-after-device-unplug.patch create mode 100644 queue-4.16/media-vb2-core-finish-buffers-at-the-end-of-the-stream.patch create mode 100644 queue-4.16/media-vivid-check-if-the-cec_adapter-is-valid.patch create mode 100644 queue-4.16/media-vsp1-fix-brx-conditional-path-in-wpf.patch create mode 100644 queue-4.16/spi-atmel-init-fifos-before-spi-enable.patch create mode 100644 queue-4.16/spi-fix-scatterlist-elements-size-in-spi_map_buf.patch create mode 100644 queue-4.16/spi-fix-unregistration-of-controller-with-fixed-spi-bus-number.patch diff --git a/queue-4.16/arm-dts-at91-at91sam9g25-fix-mux-mask-pinctrl-property.patch b/queue-4.16/arm-dts-at91-at91sam9g25-fix-mux-mask-pinctrl-property.patch new file mode 100644 index 00000000000..d4fa72bce76 --- /dev/null +++ b/queue-4.16/arm-dts-at91-at91sam9g25-fix-mux-mask-pinctrl-property.patch @@ -0,0 +1,34 @@ +From e8fd0adf105e132fd84545997bbef3d5edc2c9c1 Mon Sep 17 00:00:00 2001 +From: Nicolas Ferre +Date: Tue, 13 Mar 2018 16:20:05 +0100 +Subject: ARM: dts: at91: at91sam9g25: fix mux-mask pinctrl property + +From: Nicolas Ferre + +commit e8fd0adf105e132fd84545997bbef3d5edc2c9c1 upstream. + +There are only 19 PIOB pins having primary names PB0-PB18. Not all of them +have a 'C' function. So the pinctrl property mask ends up being the same as the +other SoC of the at91sam9x5 series. + +Reported-by: Marek Sieranski +Signed-off-by: Nicolas Ferre +Cc: # v3.8+ +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/at91sam9g25.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/at91sam9g25.dtsi ++++ b/arch/arm/boot/dts/at91sam9g25.dtsi +@@ -21,7 +21,7 @@ + atmel,mux-mask = < + /* A B C */ + 0xffffffff 0xffe0399f 0xc000001c /* pioA */ +- 0x0007ffff 0x8000fe3f 0x00000000 /* pioB */ ++ 0x0007ffff 0x00047e3f 0x00000000 /* pioB */ + 0x80000000 0x07c0ffff 0xb83fffff /* pioC */ + 0x003fffff 0x003f8000 0x00000000 /* pioD */ + >; diff --git a/queue-4.16/arm-dts-at91-sama5d4-fix-pinctrl-compatible-string.patch b/queue-4.16/arm-dts-at91-sama5d4-fix-pinctrl-compatible-string.patch new file mode 100644 index 00000000000..21230dcffe4 --- /dev/null +++ b/queue-4.16/arm-dts-at91-sama5d4-fix-pinctrl-compatible-string.patch @@ -0,0 +1,35 @@ +From 9a06757dcc8509c162ac00488c8c82fc98e04227 Mon Sep 17 00:00:00 2001 +From: Santiago Esteban +Date: Thu, 18 Jan 2018 15:38:47 +0100 +Subject: ARM: dts: at91: sama5d4: fix pinctrl compatible string + +From: Santiago Esteban + +commit 9a06757dcc8509c162ac00488c8c82fc98e04227 upstream. + +The compatible string is incorrect. Add atmel,sama5d3-pinctrl since +it's the appropriate compatible string. Remove the +atmel,at91rm9200-pinctrl compatible string, this fallback is +useless, there are too many changes. + +Signed-off-by: Santiago Esteban +Signed-off-by: Ludovic Desroches +Cc: stable@vger.kernel.org #v3.18 +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/sama5d4.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/sama5d4.dtsi ++++ b/arch/arm/boot/dts/sama5d4.dtsi +@@ -1379,7 +1379,7 @@ + pinctrl@fc06a000 { + #address-cells = <1>; + #size-cells = <1>; +- compatible = "atmel,at91sam9x5-pinctrl", "atmel,at91rm9200-pinctrl", "simple-bus"; ++ compatible = "atmel,sama5d3-pinctrl", "atmel,at91sam9x5-pinctrl", "simple-bus"; + ranges = <0xfc068000 0xfc068000 0x100 + 0xfc06a000 0xfc06a000 0x4000>; + /* WARNING: revisit as pin spec has changed */ diff --git a/queue-4.16/arm-dts-exynos-fix-iommu-support-for-gscaler-devices-on-exynos5250.patch b/queue-4.16/arm-dts-exynos-fix-iommu-support-for-gscaler-devices-on-exynos5250.patch new file mode 100644 index 00000000000..3e2a6a89992 --- /dev/null +++ b/queue-4.16/arm-dts-exynos-fix-iommu-support-for-gscaler-devices-on-exynos5250.patch @@ -0,0 +1,62 @@ +From 6f4870753f29edf7dc39444246f9e39987b8b158 Mon Sep 17 00:00:00 2001 +From: Marek Szyprowski +Date: Fri, 2 Mar 2018 17:07:42 +0100 +Subject: ARM: dts: exynos: Fix IOMMU support for GScaler devices on Exynos5250 + +From: Marek Szyprowski + +commit 6f4870753f29edf7dc39444246f9e39987b8b158 upstream. + +The proper name for the property, which assign given device to IOMMU is +'iommus', not 'iommu'. Fix incorrect name and let all GScaler devices +to be properly handled when IOMMU support is enabled. + +Reported-by: Andrzej Hajda +Signed-off-by: Marek Szyprowski +Fixes: 6cbfdd73a94f ("ARM: dts: add sysmmu nodes for exynos5250") +Cc: # v4.8+ +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/exynos5250.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/arm/boot/dts/exynos5250.dtsi ++++ b/arch/arm/boot/dts/exynos5250.dtsi +@@ -655,7 +655,7 @@ + power-domains = <&pd_gsc>; + clocks = <&clock CLK_GSCL0>; + clock-names = "gscl"; +- iommu = <&sysmmu_gsc0>; ++ iommus = <&sysmmu_gsc0>; + }; + + gsc_1: gsc@13e10000 { +@@ -665,7 +665,7 @@ + power-domains = <&pd_gsc>; + clocks = <&clock CLK_GSCL1>; + clock-names = "gscl"; +- iommu = <&sysmmu_gsc1>; ++ iommus = <&sysmmu_gsc1>; + }; + + gsc_2: gsc@13e20000 { +@@ -675,7 +675,7 @@ + power-domains = <&pd_gsc>; + clocks = <&clock CLK_GSCL2>; + clock-names = "gscl"; +- iommu = <&sysmmu_gsc2>; ++ iommus = <&sysmmu_gsc2>; + }; + + gsc_3: gsc@13e30000 { +@@ -685,7 +685,7 @@ + power-domains = <&pd_gsc>; + clocks = <&clock CLK_GSCL3>; + clock-names = "gscl"; +- iommu = <&sysmmu_gsc3>; ++ iommus = <&sysmmu_gsc3>; + }; + + hdmi: hdmi@14530000 { diff --git a/queue-4.16/arm-dts-mt7623-fix-usb-initialization-fails-on-bananapi-r2.patch b/queue-4.16/arm-dts-mt7623-fix-usb-initialization-fails-on-bananapi-r2.patch new file mode 100644 index 00000000000..a8cd81943de --- /dev/null +++ b/queue-4.16/arm-dts-mt7623-fix-usb-initialization-fails-on-bananapi-r2.patch @@ -0,0 +1,73 @@ +From 0629a01920c0f8a3f825361b24863d760610884a Mon Sep 17 00:00:00 2001 +From: Sean Wang +Date: Fri, 23 Feb 2018 18:16:26 +0800 +Subject: arm: dts: mt7623: fix USB initialization fails on bananapi-r2 + +From: Sean Wang + +commit 0629a01920c0f8a3f825361b24863d760610884a upstream. + +Fix that USB initialization fails as below runtime log is present during +booting on bananapi-r2 board by adding missing regulators the USB device +requires. Current regulators USB device uses are being updated with the +correct ones to reflect real configurations which are all from fixed +regulators rather than MT6323 one's output. + +xhci-mtk 1a1c0000.usb: 1a1c0000.usb supply vbus not found, using dummy regulator +xhci-mtk 1a240000.usb: 1a240000.usb supply vbus not found, using dummy regulator + +Cc: stable@vger.kernel.org +Fixes: f4ff257cd160 ("arm: dts: mt7623: add support for Bananapi R2 (BPI-R2) board") +Signed-off-by: Sean Wang +[mb: update kernel log in commit message] +Signed-off-by: Matthias Brugger +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts | 24 ++++++++++++++++++++++-- + 1 file changed, 22 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts ++++ b/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts +@@ -39,6 +39,24 @@ + }; + }; + ++ reg_3p3v: regulator-3p3v { ++ compatible = "regulator-fixed"; ++ regulator-name = "fixed-3.3V"; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ regulator-boot-on; ++ regulator-always-on; ++ }; ++ ++ reg_5v: regulator-5v { ++ compatible = "regulator-fixed"; ++ regulator-name = "fixed-5V"; ++ regulator-min-microvolt = <5000000>; ++ regulator-max-microvolt = <5000000>; ++ regulator-boot-on; ++ regulator-always-on; ++ }; ++ + gpio_keys { + compatible = "gpio-keys"; + pinctrl-names = "default"; +@@ -468,12 +486,14 @@ + }; + + &usb1 { +- vusb33-supply = <&mt6323_vusb_reg>; ++ vusb33-supply = <®_3p3v>; ++ vbus-supply = <®_5v>; + status = "okay"; + }; + + &usb2 { +- vusb33-supply = <&mt6323_vusb_reg>; ++ vusb33-supply = <®_3p3v>; ++ vbus-supply = <®_5v>; + status = "okay"; + }; + diff --git a/queue-4.16/arm-exynos-fix-coupled-cpu-idle-freeze-on-exynos4210.patch b/queue-4.16/arm-exynos-fix-coupled-cpu-idle-freeze-on-exynos4210.patch new file mode 100644 index 00000000000..960b55b9985 --- /dev/null +++ b/queue-4.16/arm-exynos-fix-coupled-cpu-idle-freeze-on-exynos4210.patch @@ -0,0 +1,50 @@ +From a7480dbcf983c31d8111f864c848e8a75116a87d Mon Sep 17 00:00:00 2001 +From: Marek Szyprowski +Date: Wed, 21 Mar 2018 10:45:05 +0100 +Subject: ARM: EXYNOS: Fix coupled CPU idle freeze on Exynos4210 + +From: Marek Szyprowski + +commit a7480dbcf983c31d8111f864c848e8a75116a87d upstream. + +Since commit 04c8b0f82c7d ("irqchip/gic: Make locking a BL_SWITCHER only +feature") coupled CPU idle freezes from time to time on Exynos4210. Later +commit 313c8c16ee62 ("PM / CPU: replace raw_notifier with atomic_notifier") +changed the context in which the CPU idle code is executed, what results +in fully reproducible freeze all the time. However, almost the same coupled +CPU idle code works fine on Exynos3250 regardless of the changes made in +the mentioned commits. + +It turned out that the IPI call used on Exynos4210 is conflicting with the +change done in the first mentioned commit in GIC. Fix this by using the +same code path as for Exynos3250, instead of the IPI call for +synchronization with second CPU core, call dsb_sev() directly. + +Tested on Exynos4210-based Trats and Origen boards. + +Signed-off-by: Marek Szyprowski +CC: # v4.13+ +Acked-by: Marc Zyngier +Acked-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-exynos/pm.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/arch/arm/mach-exynos/pm.c ++++ b/arch/arm/mach-exynos/pm.c +@@ -271,11 +271,7 @@ abort: + goto fail; + + call_firmware_op(cpu_boot, 1); +- +- if (soc_is_exynos3250()) +- dsb_sev(); +- else +- arch_send_wakeup_ipi_mask(cpumask_of(1)); ++ dsb_sev(); + } + } + fail: diff --git a/queue-4.16/arm64-dts-meson-reduce-odroid-c2-emmc-maximum-rate.patch b/queue-4.16/arm64-dts-meson-reduce-odroid-c2-emmc-maximum-rate.patch new file mode 100644 index 00000000000..d68a774297f --- /dev/null +++ b/queue-4.16/arm64-dts-meson-reduce-odroid-c2-emmc-maximum-rate.patch @@ -0,0 +1,43 @@ +From c04ffa71ff491220cac28f55237c9aad379a8656 Mon Sep 17 00:00:00 2001 +From: Jerome Brunet +Date: Fri, 2 Mar 2018 14:44:36 +0100 +Subject: ARM64: dts: meson: reduce odroid-c2 eMMC maximum rate + +From: Jerome Brunet + +commit c04ffa71ff491220cac28f55237c9aad379a8656 upstream. + +Different modules maybe installed by the user on the eMMC connector +of the odroid-c2. While the red modules are working without an issue, +it seems some black modules (apparently Samsung based) are having +issue at 200MHz + +While the tuning algorithm introduced in v4.14 enables high speed modes +on every other tested designs, it seems a problem remains for this +particular combination of board and eMMC module. + +Lowering the maximum frequency of the eMMC on this board until we can +figure out a better solution. + +Fixes: d341ca88eead ("mmc: meson-gx: rework tuning function") +Suggested-by: Ellie Reeves +Signed-off-by: Jerome Brunet +Cc: stable@vger.kernel.org +Signed-off-by: Kevin Hilman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts +@@ -310,7 +310,7 @@ + pinctrl-names = "default", "clk-gate"; + + bus-width = <8>; +- max-frequency = <200000000>; ++ max-frequency = <100000000>; + non-removable; + disable-wp; + cap-mmc-highspeed; diff --git a/queue-4.16/kvm-arm-arm64-vgic-its-fix-potential-overrun-in-vgic_copy_lpi_list.patch b/queue-4.16/kvm-arm-arm64-vgic-its-fix-potential-overrun-in-vgic_copy_lpi_list.patch new file mode 100644 index 00000000000..6de6832067d --- /dev/null +++ b/queue-4.16/kvm-arm-arm64-vgic-its-fix-potential-overrun-in-vgic_copy_lpi_list.patch @@ -0,0 +1,77 @@ +From 7d8b44c54e0c7c8f688e3a07f17e6083f849f01f Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Fri, 23 Mar 2018 14:57:09 +0000 +Subject: KVM: arm/arm64: vgic-its: Fix potential overrun in vgic_copy_lpi_list + +From: Marc Zyngier + +commit 7d8b44c54e0c7c8f688e3a07f17e6083f849f01f upstream. + +vgic_copy_lpi_list() parses the LPI list and picks LPIs targeting +a given vcpu. We allocate the array containing the intids before taking +the lpi_list_lock, which means we can have an array size that is not +equal to the number of LPIs. + +This is particularly obvious when looking at the path coming from +vgic_enable_lpis, which is not a command, and thus can run in parallel +with commands: + +vcpu 0: vcpu 1: +vgic_enable_lpis + its_sync_lpi_pending_table + vgic_copy_lpi_list + intids = kmalloc_array(irq_count) + MAPI(lpi targeting vcpu 0) + list_for_each_entry(lpi_list_head) + intids[i++] = irq->intid; + +At that stage, we will happily overrun the intids array. Boo. An easy +fix is is to break once the array is full. The MAPI command will update +the config anyway, and we won't miss a thing. We also make sure that +lpi_list_count is read exactly once, so that further updates of that +value will not affect the array bound check. + +Cc: stable@vger.kernel.org +Fixes: ccb1d791ab9e ("KVM: arm64: vgic-its: Fix pending table sync") +Reviewed-by: Andre Przywara +Reviewed-by: Eric Auger +Signed-off-by: Marc Zyngier +Signed-off-by: Greg Kroah-Hartman + +--- + virt/kvm/arm/vgic/vgic-its.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/virt/kvm/arm/vgic/vgic-its.c ++++ b/virt/kvm/arm/vgic/vgic-its.c +@@ -316,21 +316,24 @@ static int vgic_copy_lpi_list(struct kvm + struct vgic_dist *dist = &vcpu->kvm->arch.vgic; + struct vgic_irq *irq; + u32 *intids; +- int irq_count = dist->lpi_list_count, i = 0; ++ int irq_count, i = 0; + + /* +- * We use the current value of the list length, which may change +- * after the kmalloc. We don't care, because the guest shouldn't +- * change anything while the command handling is still running, +- * and in the worst case we would miss a new IRQ, which one wouldn't +- * expect to be covered by this command anyway. ++ * There is an obvious race between allocating the array and LPIs ++ * being mapped/unmapped. If we ended up here as a result of a ++ * command, we're safe (locks are held, preventing another ++ * command). If coming from another path (such as enabling LPIs), ++ * we must be careful not to overrun the array. + */ ++ irq_count = READ_ONCE(dist->lpi_list_count); + intids = kmalloc_array(irq_count, sizeof(intids[0]), GFP_KERNEL); + if (!intids) + return -ENOMEM; + + spin_lock(&dist->lpi_list_lock); + list_for_each_entry(irq, &dist->lpi_list_head, lpi_list) { ++ if (i == irq_count) ++ break; + /* We don't need to "get" the IRQ, as we hold the list lock. */ + if (irq->target_vcpu != vcpu) + continue; diff --git a/queue-4.16/media-atomisp_fops.c-disable-atomisp_compat_ioctl32.patch b/queue-4.16/media-atomisp_fops.c-disable-atomisp_compat_ioctl32.patch new file mode 100644 index 00000000000..402ff8bb001 --- /dev/null +++ b/queue-4.16/media-atomisp_fops.c-disable-atomisp_compat_ioctl32.patch @@ -0,0 +1,48 @@ +From 57e6b6f2303e596a6493078b53be14b789e7b79f Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Sun, 25 Feb 2018 06:55:32 -0500 +Subject: media: atomisp_fops.c: disable atomisp_compat_ioctl32 + +From: Hans Verkuil + +commit 57e6b6f2303e596a6493078b53be14b789e7b79f upstream. + +The atomisp_compat_ioctl32() code has problems. This patch disables the +compat_ioctl32 support until those issues have been fixed. + +Contact Sakari or me for more details. + +Signed-off-by: Hans Verkuil +Cc: # for v4.12 and up +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/media/atomisp/pci/atomisp2/atomisp_fops.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_fops.c ++++ b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_fops.c +@@ -1279,7 +1279,10 @@ const struct v4l2_file_operations atomis + .mmap = atomisp_mmap, + .unlocked_ioctl = video_ioctl2, + #ifdef CONFIG_COMPAT ++ /* ++ * There are problems with this code. Disable this for now. + .compat_ioctl32 = atomisp_compat_ioctl32, ++ */ + #endif + .poll = atomisp_poll, + }; +@@ -1291,7 +1294,10 @@ const struct v4l2_file_operations atomis + .mmap = atomisp_file_mmap, + .unlocked_ioctl = video_ioctl2, + #ifdef CONFIG_COMPAT ++ /* ++ * There are problems with this code. Disable this for now. + .compat_ioctl32 = atomisp_compat_ioctl32, ++ */ + #endif + .poll = atomisp_poll, + }; diff --git a/queue-4.16/media-rc-oops-in-ir_timer_keyup-after-device-unplug.patch b/queue-4.16/media-rc-oops-in-ir_timer_keyup-after-device-unplug.patch new file mode 100644 index 00000000000..b61ab7ba64b --- /dev/null +++ b/queue-4.16/media-rc-oops-in-ir_timer_keyup-after-device-unplug.patch @@ -0,0 +1,41 @@ +From 8d4068810d9926250dd2435719a080b889eb44c3 Mon Sep 17 00:00:00 2001 +From: Sean Young +Date: Tue, 6 Mar 2018 08:57:57 -0500 +Subject: media: rc: oops in ir_timer_keyup after device unplug + +From: Sean Young + +commit 8d4068810d9926250dd2435719a080b889eb44c3 upstream. + +If there is IR in the raw kfifo when ir_raw_event_unregister() is called, +then kthread_stop() causes ir_raw_event_thread to be scheduled, decode +some scancodes and re-arm timer_keyup. The timer_keyup then fires when +the rc device is long gone. + +Cc: stable@vger.kernel.org +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/rc/rc-main.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/media/rc/rc-main.c ++++ b/drivers/media/rc/rc-main.c +@@ -1929,12 +1929,12 @@ void rc_unregister_device(struct rc_dev + if (!dev) + return; + +- del_timer_sync(&dev->timer_keyup); +- del_timer_sync(&dev->timer_repeat); +- + if (dev->driver_type == RC_DRIVER_IR_RAW) + ir_raw_event_unregister(dev); + ++ del_timer_sync(&dev->timer_keyup); ++ del_timer_sync(&dev->timer_repeat); ++ + rc_free_rx_device(dev); + + mutex_lock(&dev->lock); diff --git a/queue-4.16/media-vb2-core-finish-buffers-at-the-end-of-the-stream.patch b/queue-4.16/media-vb2-core-finish-buffers-at-the-end-of-the-stream.patch new file mode 100644 index 00000000000..a79c5e8afea --- /dev/null +++ b/queue-4.16/media-vb2-core-finish-buffers-at-the-end-of-the-stream.patch @@ -0,0 +1,49 @@ +From 03703ed1debf777ea845aa9b50ba2e80a5e7dd3c Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Fri, 2 Feb 2018 05:08:59 -0500 +Subject: media: vb2: core: Finish buffers at the end of the stream + +From: Sakari Ailus + +commit 03703ed1debf777ea845aa9b50ba2e80a5e7dd3c upstream. + +If buffers were prepared or queued and the buffers were released without +starting the queue, the finish mem op (corresponding to the prepare mem +op) was never called to the buffers. + +Before commit a136f59c0a1f there was no need to do this as in such a case +the prepare mem op had not been called yet. Address the problem by +explicitly calling finish mem op when the queue is stopped if the buffer +is in either prepared or queued state. + +Fixes: a136f59c0a1f ("[media] vb2: Move buffer cache synchronisation to prepare from queue") + +Cc: stable@vger.kernel.org # for v4.13 and up +Signed-off-by: Sakari Ailus +Tested-by: Devin Heitmueller +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/common/videobuf2/videobuf2-core.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/media/common/videobuf2/videobuf2-core.c ++++ b/drivers/media/common/videobuf2/videobuf2-core.c +@@ -1696,6 +1696,15 @@ static void __vb2_queue_cancel(struct vb + for (i = 0; i < q->num_buffers; ++i) { + struct vb2_buffer *vb = q->bufs[i]; + ++ if (vb->state == VB2_BUF_STATE_PREPARED || ++ vb->state == VB2_BUF_STATE_QUEUED) { ++ unsigned int plane; ++ ++ for (plane = 0; plane < vb->num_planes; ++plane) ++ call_void_memop(vb, finish, ++ vb->planes[plane].mem_priv); ++ } ++ + if (vb->state != VB2_BUF_STATE_DEQUEUED) { + vb->state = VB2_BUF_STATE_PREPARED; + call_void_vb_qop(vb, buf_finish, vb); diff --git a/queue-4.16/media-vivid-check-if-the-cec_adapter-is-valid.patch b/queue-4.16/media-vivid-check-if-the-cec_adapter-is-valid.patch new file mode 100644 index 00000000000..5324025884c --- /dev/null +++ b/queue-4.16/media-vivid-check-if-the-cec_adapter-is-valid.patch @@ -0,0 +1,33 @@ +From ed356f110403f6acc64dcbbbfdc38662ab9b06c2 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Mon, 12 Feb 2018 06:45:32 -0500 +Subject: media: vivid: check if the cec_adapter is valid + +From: Hans Verkuil + +commit ed356f110403f6acc64dcbbbfdc38662ab9b06c2 upstream. + +If CEC is not enabled for the vivid driver, then the adap pointer is NULL +and 'adap->phys_addr' will fail. + +Cc: # for v4.12 and up +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/vivid/vivid-vid-common.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/media/platform/vivid/vivid-vid-common.c ++++ b/drivers/media/platform/vivid/vivid-vid-common.c +@@ -874,7 +874,8 @@ int vidioc_g_edid(struct file *file, voi + return -EINVAL; + if (edid->start_block + edid->blocks > dev->edid_blocks) + edid->blocks = dev->edid_blocks - edid->start_block; +- cec_set_edid_phys_addr(dev->edid, dev->edid_blocks * 128, adap->phys_addr); ++ if (adap) ++ cec_set_edid_phys_addr(dev->edid, dev->edid_blocks * 128, adap->phys_addr); + memcpy(edid->edid, dev->edid + edid->start_block * 128, edid->blocks * 128); + return 0; + } diff --git a/queue-4.16/media-vsp1-fix-brx-conditional-path-in-wpf.patch b/queue-4.16/media-vsp1-fix-brx-conditional-path-in-wpf.patch new file mode 100644 index 00000000000..35773fd6994 --- /dev/null +++ b/queue-4.16/media-vsp1-fix-brx-conditional-path-in-wpf.patch @@ -0,0 +1,48 @@ +From 639fa43d59e5a41ca8c55592cd5c1021fea2ab83 Mon Sep 17 00:00:00 2001 +From: Kieran Bingham +Date: Mon, 26 Mar 2018 09:29:17 -0400 +Subject: media: vsp1: Fix BRx conditional path in WPF + +From: Kieran Bingham + +commit 639fa43d59e5a41ca8c55592cd5c1021fea2ab83 upstream. + +When a BRx is provided by a pipeline, the WPF must determine the master +layer. Currently the condition to check this identifies pipe->bru || +pipe->num_inputs > 1. + +The code then moves on to dereference pipe->bru, thus the check fails +static analysers on the possibility that pipe->num_inputs could be +greater than 1 without pipe->bru being set. + +The reality is that the pipeline must have a BRx to support more than +one input, thus this could never cause a fault - however it also +identifies that the num_inputs > 1 check is redundant. + +Remove the redundant check - and always configure the master layer +appropriately when we have a BRx configured in our pipeline. + +Fixes: 6134148f6098 ("v4l: vsp1: Add support for the BRS entity") + +Cc: stable@vger.kernel.org +Suggested-by: Mauro Carvalho Chehab +Signed-off-by: Kieran Bingham +Reviewed-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/vsp1/vsp1_wpf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/vsp1/vsp1_wpf.c ++++ b/drivers/media/platform/vsp1/vsp1_wpf.c +@@ -452,7 +452,7 @@ static void wpf_configure(struct vsp1_en + : VI6_WPF_SRCRPF_RPF_ACT_SUB(input->entity.index); + } + +- if (pipe->bru || pipe->num_inputs > 1) ++ if (pipe->bru) + srcrpf |= pipe->bru->type == VSP1_ENTITY_BRU + ? VI6_WPF_SRCRPF_VIRACT_MST + : VI6_WPF_SRCRPF_VIRACT2_MST; diff --git a/queue-4.16/series b/queue-4.16/series index fe798f2187c..76f11ba4719 100644 --- a/queue-4.16/series +++ b/queue-4.16/series @@ -17,3 +17,18 @@ mm-slab-reschedule-cache_reap-on-the-same-cpu.patch usb-musb-gadget-misplaced-out-of-bounds-check.patch phy-allwinner-sun4i-usb-poll-vbus-changes-on-a23-a33-when-driving-vbus.patch usb-gadget-udc-core-update-usb_ep_queue-documentation.patch +arm64-dts-meson-reduce-odroid-c2-emmc-maximum-rate.patch +kvm-arm-arm64-vgic-its-fix-potential-overrun-in-vgic_copy_lpi_list.patch +arm-exynos-fix-coupled-cpu-idle-freeze-on-exynos4210.patch +arm-dts-mt7623-fix-usb-initialization-fails-on-bananapi-r2.patch +arm-dts-at91-at91sam9g25-fix-mux-mask-pinctrl-property.patch +arm-dts-exynos-fix-iommu-support-for-gscaler-devices-on-exynos5250.patch +arm-dts-at91-sama5d4-fix-pinctrl-compatible-string.patch +spi-atmel-init-fifos-before-spi-enable.patch +spi-fix-scatterlist-elements-size-in-spi_map_buf.patch +spi-fix-unregistration-of-controller-with-fixed-spi-bus-number.patch +media-rc-oops-in-ir_timer_keyup-after-device-unplug.patch +media-atomisp_fops.c-disable-atomisp_compat_ioctl32.patch +media-vivid-check-if-the-cec_adapter-is-valid.patch +media-vb2-core-finish-buffers-at-the-end-of-the-stream.patch +media-vsp1-fix-brx-conditional-path-in-wpf.patch diff --git a/queue-4.16/spi-atmel-init-fifos-before-spi-enable.patch b/queue-4.16/spi-atmel-init-fifos-before-spi-enable.patch new file mode 100644 index 00000000000..8cf4d99d460 --- /dev/null +++ b/queue-4.16/spi-atmel-init-fifos-before-spi-enable.patch @@ -0,0 +1,49 @@ +From 9581329eff9db72ab4fbb46a594fd7fdda3c51b0 Mon Sep 17 00:00:00 2001 +From: Eugen Hristev +Date: Tue, 27 Feb 2018 12:25:07 +0200 +Subject: spi: atmel: init FIFOs before spi enable + +From: Eugen Hristev + +commit 9581329eff9db72ab4fbb46a594fd7fdda3c51b0 upstream. + +The datasheet recommends initializing FIFOs before +SPI enable. If we do not do it like this, there may be +a strange behavior. We noticed that DMA does not work properly +with FIFOs if we do not clear them beforehand or enable them +before SPIEN. + +Signed-off-by: Eugen Hristev +Acked-by: Nicolas Ferre +Signed-off-by: Mark Brown +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-atmel.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/spi/spi-atmel.c ++++ b/drivers/spi/spi-atmel.c +@@ -1512,6 +1512,11 @@ static void atmel_spi_init(struct atmel_ + { + spi_writel(as, CR, SPI_BIT(SWRST)); + spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */ ++ ++ /* It is recommended to enable FIFOs first thing after reset */ ++ if (as->fifo_size) ++ spi_writel(as, CR, SPI_BIT(FIFOEN)); ++ + if (as->caps.has_wdrbt) { + spi_writel(as, MR, SPI_BIT(WDRBT) | SPI_BIT(MODFDIS) + | SPI_BIT(MSTR)); +@@ -1522,9 +1527,6 @@ static void atmel_spi_init(struct atmel_ + if (as->use_pdc) + spi_writel(as, PTCR, SPI_BIT(RXTDIS) | SPI_BIT(TXTDIS)); + spi_writel(as, CR, SPI_BIT(SPIEN)); +- +- if (as->fifo_size) +- spi_writel(as, CR, SPI_BIT(FIFOEN)); + } + + static int atmel_spi_probe(struct platform_device *pdev) diff --git a/queue-4.16/spi-fix-scatterlist-elements-size-in-spi_map_buf.patch b/queue-4.16/spi-fix-scatterlist-elements-size-in-spi_map_buf.patch new file mode 100644 index 00000000000..d09558c9348 --- /dev/null +++ b/queue-4.16/spi-fix-scatterlist-elements-size-in-spi_map_buf.patch @@ -0,0 +1,50 @@ +From ce99319a182fe766be67f96338386f3ec73e321c Mon Sep 17 00:00:00 2001 +From: Maxime Chevallier +Date: Fri, 2 Mar 2018 15:55:09 +0100 +Subject: spi: Fix scatterlist elements size in spi_map_buf + +From: Maxime Chevallier + +commit ce99319a182fe766be67f96338386f3ec73e321c upstream. + +When SPI transfers can be offloaded using DMA, the SPI core need to +build a scatterlist to make sure that the buffer to be transferred is +dma-able. + +This patch fixes the scatterlist entry size computation in the case +where the maximum acceptable scatterlist entry supported by the DMA +controller is less than PAGE_SIZE, when the buffer is vmalloced. + +For each entry, the actual size is given by the minimum between the +desc_len (which is the max buffer size supported by the DMA controller) +and the remaining buffer length until we cross a page boundary. + +Fixes: 65598c13fd66 ("spi: Fix per-page mapping of unaligned vmalloc-ed buffer") +Signed-off-by: Maxime Chevallier +Signed-off-by: Mark Brown +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -779,8 +779,14 @@ static int spi_map_buf(struct spi_contro + for (i = 0; i < sgs; i++) { + + if (vmalloced_buf || kmap_buf) { +- min = min_t(size_t, +- len, desc_len - offset_in_page(buf)); ++ /* ++ * Next scatterlist entry size is the minimum between ++ * the desc_len and the remaining buffer length that ++ * fits in a page. ++ */ ++ min = min_t(size_t, desc_len, ++ min_t(size_t, len, ++ PAGE_SIZE - offset_in_page(buf))); + if (vmalloced_buf) + vm_page = vmalloc_to_page(buf); + else diff --git a/queue-4.16/spi-fix-unregistration-of-controller-with-fixed-spi-bus-number.patch b/queue-4.16/spi-fix-unregistration-of-controller-with-fixed-spi-bus-number.patch new file mode 100644 index 00000000000..9b6a4f68fce --- /dev/null +++ b/queue-4.16/spi-fix-unregistration-of-controller-with-fixed-spi-bus-number.patch @@ -0,0 +1,69 @@ +From 613bd1ea387bb48b7c9a71a0bb451ac15cfbbc01 Mon Sep 17 00:00:00 2001 +From: Jarkko Nikula +Date: Tue, 20 Mar 2018 10:27:50 +0200 +Subject: spi: Fix unregistration of controller with fixed SPI bus number + +From: Jarkko Nikula + +commit 613bd1ea387bb48b7c9a71a0bb451ac15cfbbc01 upstream. + +Commit 9b61e302210e (spi: Pick spi bus number from Linux idr or spi alias) +ceased to unregister SPI buses with fixed bus numbers. Moreover this is +visible only if CONFIG_SPI_DEBUG=y is set or when trying to re-register +the same SPI controller. + +rmmod spi_pxa2xx_platform (with CONFIG_SPI_DEBUG=y): +[ 26.788362] spi_master spi1: attempting to delete unregistered controller [spi1] + +modprobe spi_pxa2xx_platform: +[ 37.883137] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:19.0/pxa2xx-spi.12/spi_master/spi1' +[ 37.894984] CPU: 1 PID: 1467 Comm: modprobe Not tainted 4.16.0-rc4+ #21 +[ 37.902384] Call Trace: +... +[ 38.122680] kobject_add_internal failed for spi1 with -EEXIST, don't try to register things with the same name in the same directory. +[ 38.136154] WARNING: CPU: 1 PID: 1467 at lib/kobject.c:238 kobject_add_internal+0x2a5/0x2f0 +... +[ 38.513817] pxa2xx-spi pxa2xx-spi.12: problem registering spi master +[ 38.521036] pxa2xx-spi: probe of pxa2xx-spi.12 failed with error -17 + +Fix this by not returning immediately from spi_unregister_controller() if +idr_find() doesn't find controller with given ID/bus number. It finds +only those controllers that were registered with dynamic SPI bus +numbers. Only conditional cleanup between dynamic and fixed bus numbers +is to remove allocated IDR. + +Fixes: 9b61e302210e (spi: Pick spi bus number from Linux idr or spi alias) +Cc: stable@vger.kernel.org +Signed-off-by: Jarkko Nikula +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -2260,12 +2260,6 @@ void spi_unregister_controller(struct sp + mutex_lock(&board_lock); + found = idr_find(&spi_master_idr, id); + mutex_unlock(&board_lock); +- if (found != ctlr) { +- dev_dbg(&ctlr->dev, +- "attempting to delete unregistered controller [%s]\n", +- dev_name(&ctlr->dev)); +- return; +- } + if (ctlr->queued) { + if (spi_destroy_queue(ctlr)) + dev_err(&ctlr->dev, "queue remove failed\n"); +@@ -2278,7 +2272,8 @@ void spi_unregister_controller(struct sp + device_unregister(&ctlr->dev); + /* free bus id */ + mutex_lock(&board_lock); +- idr_remove(&spi_master_idr, id); ++ if (found == ctlr) ++ idr_remove(&spi_master_idr, id); + mutex_unlock(&board_lock); + } + EXPORT_SYMBOL_GPL(spi_unregister_controller); -- 2.47.3