From d38f04b1e7319ba3545912ecb98dd2b85cb0e03c Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 4 Feb 2017 16:45:37 +0100 Subject: [PATCH] 4.9-stable patches added patches: dmaengine-cppi41-fix-oops-in-cppi41_runtime_resume.patch dmaengine-cppi41-fix-runtime-pm-timeouts-with-usb-mass-storage.patch hid-hid-lg-fix-immediate-disconnection-of-logitech-rumblepad-2.patch hid-usbhid-quirk-a-ami-virtual-mouse-and-keyboard-with-always_poll.patch hid-wacom-fix-poor-prox-handling-in-wacom_pl_irq.patch iwlwifi-fix-double-hyphen-in-module_firmware-for-8000.patch iwlwifi-mvm-avoid-crash-on-restart-w-o-reserved-queues.patch perf-x86-intel-uncore-clean-up-hotplug-conversion-fallout.patch pinctrl-baytrail-debounce-register-is-one-per-community.patch pinctrl-intel-merrifield-add-missed-check-in-mrfld_config_set.patch --- ...41-fix-oops-in-cppi41_runtime_resume.patch | 170 ++++++++++++++++++ ...me-pm-timeouts-with-usb-mass-storage.patch | 92 ++++++++++ ...isconnection-of-logitech-rumblepad-2.patch | 35 ++++ ...-mouse-and-keyboard-with-always_poll.patch | 65 +++++++ ...x-poor-prox-handling-in-wacom_pl_irq.patch | 68 +++++++ ...e-hyphen-in-module_firmware-for-8000.patch | 37 ++++ ...crash-on-restart-w-o-reserved-queues.patch | 40 +++++ ...-clean-up-hotplug-conversion-fallout.patch | 131 ++++++++++++++ ...bounce-register-is-one-per-community.patch | 64 +++++++ ...add-missed-check-in-mrfld_config_set.patch | 34 ++++ queue-4.9/series | 10 ++ 11 files changed, 746 insertions(+) create mode 100644 queue-4.9/dmaengine-cppi41-fix-oops-in-cppi41_runtime_resume.patch create mode 100644 queue-4.9/dmaengine-cppi41-fix-runtime-pm-timeouts-with-usb-mass-storage.patch create mode 100644 queue-4.9/hid-hid-lg-fix-immediate-disconnection-of-logitech-rumblepad-2.patch create mode 100644 queue-4.9/hid-usbhid-quirk-a-ami-virtual-mouse-and-keyboard-with-always_poll.patch create mode 100644 queue-4.9/hid-wacom-fix-poor-prox-handling-in-wacom_pl_irq.patch create mode 100644 queue-4.9/iwlwifi-fix-double-hyphen-in-module_firmware-for-8000.patch create mode 100644 queue-4.9/iwlwifi-mvm-avoid-crash-on-restart-w-o-reserved-queues.patch create mode 100644 queue-4.9/perf-x86-intel-uncore-clean-up-hotplug-conversion-fallout.patch create mode 100644 queue-4.9/pinctrl-baytrail-debounce-register-is-one-per-community.patch create mode 100644 queue-4.9/pinctrl-intel-merrifield-add-missed-check-in-mrfld_config_set.patch diff --git a/queue-4.9/dmaengine-cppi41-fix-oops-in-cppi41_runtime_resume.patch b/queue-4.9/dmaengine-cppi41-fix-oops-in-cppi41_runtime_resume.patch new file mode 100644 index 00000000000..dda24099483 --- /dev/null +++ b/queue-4.9/dmaengine-cppi41-fix-oops-in-cppi41_runtime_resume.patch @@ -0,0 +1,170 @@ +From 362f4562466c3b9490e733e06999025638310d4a Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Thu, 19 Jan 2017 08:49:08 -0800 +Subject: dmaengine: cppi41: Fix oops in cppi41_runtime_resume + +From: Tony Lindgren + +commit 362f4562466c3b9490e733e06999025638310d4a upstream. + +Commit fdea2d09b997 ("dmaengine: cppi41: Add basic PM runtime support") +together with recent MUSB changes allowed USB and DMA on BeagleBone to idle +when no cable is connected. But looks like few corner case issues still +remain. + +Looks like just by re-plugging USB cable about ten or so times on BeagleBone +when configured in USB peripheral mode we can get warnings and eventually +trigger an oops in cppi41 DMA: + +WARNING: CPU: 0 PID: 14 at drivers/dma/cppi41.c:1154 cppi41_runtime_suspend+ +x28/0x38 [cppi41] +... + +WARNING: CPU: 0 PID: 14 at drivers/dma/cppi41.c:452 +push_desc_queue+0x94/0x9c [cppi41] +... + +Unable to handle kernel NULL pointer dereference at virtual +address 00000104 +pgd = c0004000 +[00000104] *pgd=00000000 +Internal error: Oops: 805 [#1] SMP ARM +... +[] (cppi41_runtime_resume [cppi41]) from [] +(__rpm_callback+0xc0/0x214) +[] (__rpm_callback) from [] (rpm_callback+0x20/0x80) +[] (rpm_callback) from [] (rpm_resume+0x504/0x78c) +[] (rpm_resume) from [] (pm_runtime_work+0x60/0xa8) +[] (pm_runtime_work) from [] (process_one_work+0x2b4/0x808) + +This is because of a race with runtime PM and cppi41_dma_issue_pending() +as reported by Alexandre Bailon in earlier +set of patches. Based on mailing list discussions we however came to the +conclusion that a different fix from Alexandre's fix is needed in order +to guarantee that DMA is really active when we try to use it. + +To fix the issue, we need to add a driver specific flag as we otherwise +can have -EINPROGRESS state set by runtime PM and can't rely on +pm_runtime_active() to tell us when we can use the DMA. + +And we need to make sure the DMA transfers get triggered in the queued +order. So let's always queue the transfers, then flush the queue +from both cppi41_dma_issue_pending() and cppi41_runtime_resume() +as suggested by Grygorii Strashko in an +earlier example patch. + +For reference, this is also documented in Documentation/power/runtime_pm.txt +in the example at the end of the file as pointed out by Grygorii Strashko +. + +Based on earlier patches from Alexandre Bailon +and Grygorii Strashko modified based on +testing and what was discussed on the mailing lists. + +Fixes: fdea2d09b997 ("dmaengine: cppi41: Add basic PM runtime support") +Cc: Andy Shevchenko +Cc: Bin Liu +Cc: Grygorii Strashko +Cc: Kevin Hilman +Cc: Patrick Titiano +Cc: Sergei Shtylyov +Reported-by: Alexandre Bailon +Signed-off-by: Tony Lindgren +Tested-by: Bin Liu +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/cppi41.c | 40 +++++++++++++++++++++++++--------------- + 1 file changed, 25 insertions(+), 15 deletions(-) + +--- a/drivers/dma/cppi41.c ++++ b/drivers/dma/cppi41.c +@@ -153,6 +153,8 @@ struct cppi41_dd { + + /* context for suspend/resume */ + unsigned int dma_tdfdq; ++ ++ bool is_suspended; + }; + + #define FIST_COMPLETION_QUEUE 93 +@@ -470,20 +472,26 @@ static void push_desc_queue(struct cppi4 + cppi_writel(reg, cdd->qmgr_mem + QMGR_QUEUE_D(c->q_num)); + } + +-static void pending_desc(struct cppi41_channel *c) ++/* ++ * Caller must hold cdd->lock to prevent push_desc_queue() ++ * getting called out of order. We have both cppi41_dma_issue_pending() ++ * and cppi41_runtime_resume() call this function. ++ */ ++static void cppi41_run_queue(struct cppi41_dd *cdd) + { +- struct cppi41_dd *cdd = c->cdd; +- unsigned long flags; ++ struct cppi41_channel *c, *_c; + +- spin_lock_irqsave(&cdd->lock, flags); +- list_add_tail(&c->node, &cdd->pending); +- spin_unlock_irqrestore(&cdd->lock, flags); ++ list_for_each_entry_safe(c, _c, &cdd->pending, node) { ++ push_desc_queue(c); ++ list_del(&c->node); ++ } + } + + static void cppi41_dma_issue_pending(struct dma_chan *chan) + { + struct cppi41_channel *c = to_cpp41_chan(chan); + struct cppi41_dd *cdd = c->cdd; ++ unsigned long flags; + int error; + + error = pm_runtime_get(cdd->ddev.dev); +@@ -495,10 +503,11 @@ static void cppi41_dma_issue_pending(str + return; + } + +- if (likely(pm_runtime_active(cdd->ddev.dev))) +- push_desc_queue(c); +- else +- pending_desc(c); ++ spin_lock_irqsave(&cdd->lock, flags); ++ list_add_tail(&c->node, &cdd->pending); ++ if (!cdd->is_suspended) ++ cppi41_run_queue(cdd); ++ spin_unlock_irqrestore(&cdd->lock, flags); + + pm_runtime_mark_last_busy(cdd->ddev.dev); + pm_runtime_put_autosuspend(cdd->ddev.dev); +@@ -1166,8 +1175,12 @@ static int __maybe_unused cppi41_resume( + static int __maybe_unused cppi41_runtime_suspend(struct device *dev) + { + struct cppi41_dd *cdd = dev_get_drvdata(dev); ++ unsigned long flags; + ++ spin_lock_irqsave(&cdd->lock, flags); ++ cdd->is_suspended = true; + WARN_ON(!list_empty(&cdd->pending)); ++ spin_unlock_irqrestore(&cdd->lock, flags); + + return 0; + } +@@ -1175,14 +1188,11 @@ static int __maybe_unused cppi41_runtime + static int __maybe_unused cppi41_runtime_resume(struct device *dev) + { + struct cppi41_dd *cdd = dev_get_drvdata(dev); +- struct cppi41_channel *c, *_c; + unsigned long flags; + + spin_lock_irqsave(&cdd->lock, flags); +- list_for_each_entry_safe(c, _c, &cdd->pending, node) { +- push_desc_queue(c); +- list_del(&c->node); +- } ++ cdd->is_suspended = false; ++ cppi41_run_queue(cdd); + spin_unlock_irqrestore(&cdd->lock, flags); + + return 0; diff --git a/queue-4.9/dmaengine-cppi41-fix-runtime-pm-timeouts-with-usb-mass-storage.patch b/queue-4.9/dmaengine-cppi41-fix-runtime-pm-timeouts-with-usb-mass-storage.patch new file mode 100644 index 00000000000..7a2b882de4f --- /dev/null +++ b/queue-4.9/dmaengine-cppi41-fix-runtime-pm-timeouts-with-usb-mass-storage.patch @@ -0,0 +1,92 @@ +From ae4a3e028bb8b59e7cfeb0cc9ef03d885182ce8b Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Thu, 19 Jan 2017 08:49:07 -0800 +Subject: dmaengine: cppi41: Fix runtime PM timeouts with USB mass storage + +From: Tony Lindgren + +commit ae4a3e028bb8b59e7cfeb0cc9ef03d885182ce8b upstream. + +Commit fdea2d09b997 ("dmaengine: cppi41: Add basic PM runtime support") +added runtime PM support for cppi41, but had corner case issues. Some of +the issues were fixed with commit 098de42ad670 ("dmaengine: cppi41: Fix +unpaired pm runtime when only a USB hub is connected"). That fix however +caused a new regression where we can get error -115 messages with USB on +BeagleBone when connecting a USB mass storage device to a hub. + +This is because when connecting a USB mass storage device to a hub, the +initial DMA transfers can take over 200ms to complete and cppi41 +autosuspend delay times out. + +To fix the issue, we want to implement refcounting for chan_busy array +that contains the active dma transfers. Increasing the autosuspend delay +won't help as that the delay could be potentially seconds, and it's best +to let the USB subsystem to deal with the timeouts on errors. + +The earlier attempt for runtime PM was buggy as the pm_runtime_get/put() +calls could get unpaired easily as they did not follow the state of +the chan_busy array as described in commit 098de42ad670 ("dmaengine: +cppi41: Fix unpaired pm runtime when only a USB hub is connected". + +Let's fix the issue by adding pm_runtime_get() to where a new transfer +is added to the chan_busy array, and calls to pm_runtime_put() where +chan_busy array entry is cleared. This prevents any autosuspend timeouts +from happening while dma transfers are active. + +Fixes: 098de42ad670 ("dmaengine: cppi41: Fix unpaired pm runtime when +only a USB hub is connected") +Fixes: fdea2d09b997 ("dmaengine: cppi41: Add basic PM runtime support") +Cc: Andy Shevchenko +Cc: Bin Liu +Cc: Grygorii Strashko +Cc: Kevin Hilman +Cc: Patrick Titiano +Cc: Sergei Shtylyov +Signed-off-by: Tony Lindgren +Tested-by: Bin Liu +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/cppi41.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/drivers/dma/cppi41.c ++++ b/drivers/dma/cppi41.c +@@ -257,6 +257,10 @@ static struct cppi41_channel *desc_to_ch + BUG_ON(desc_num >= ALLOC_DECS_NUM); + c = cdd->chan_busy[desc_num]; + cdd->chan_busy[desc_num] = NULL; ++ ++ /* Usecount for chan_busy[], paired with push_desc_queue() */ ++ pm_runtime_put(cdd->ddev.dev); ++ + return c; + } + +@@ -447,6 +451,15 @@ static void push_desc_queue(struct cppi4 + */ + __iowmb(); + ++ /* ++ * DMA transfers can take at least 200ms to complete with USB mass ++ * storage connected. To prevent autosuspend timeouts, we must use ++ * pm_runtime_get/put() when chan_busy[] is modified. This will get ++ * cleared in desc_to_chan() or cppi41_stop_chan() depending on the ++ * outcome of the transfer. ++ */ ++ pm_runtime_get(cdd->ddev.dev); ++ + desc_phys = lower_32_bits(c->desc_phys); + desc_num = (desc_phys - cdd->descs_phys) / sizeof(struct cppi41_desc); + WARN_ON(cdd->chan_busy[desc_num]); +@@ -705,6 +718,9 @@ static int cppi41_stop_chan(struct dma_c + WARN_ON(!cdd->chan_busy[desc_num]); + cdd->chan_busy[desc_num] = NULL; + ++ /* Usecount for chan_busy[], paired with push_desc_queue() */ ++ pm_runtime_put(cdd->ddev.dev); ++ + return 0; + } + diff --git a/queue-4.9/hid-hid-lg-fix-immediate-disconnection-of-logitech-rumblepad-2.patch b/queue-4.9/hid-hid-lg-fix-immediate-disconnection-of-logitech-rumblepad-2.patch new file mode 100644 index 00000000000..d952b66359a --- /dev/null +++ b/queue-4.9/hid-hid-lg-fix-immediate-disconnection-of-logitech-rumblepad-2.patch @@ -0,0 +1,35 @@ +From 877a021e08ccb6434718c0cc781fdf943c884cc0 Mon Sep 17 00:00:00 2001 +From: Ardinartsev Nikita +Date: Thu, 26 Jan 2017 16:54:42 +0300 +Subject: HID: hid-lg: Fix immediate disconnection of Logitech Rumblepad 2 + +From: Ardinartsev Nikita + +commit 877a021e08ccb6434718c0cc781fdf943c884cc0 upstream. + +With NOGET quirk Logitech F510 is now fully workable in dinput mode including +rumble effects (according to fftest). + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=117091 + +[jkosina@suse.cz: fix patch format] +Signed-off-by: Ardinartsev Nikita +Acked-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-lg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hid/hid-lg.c ++++ b/drivers/hid/hid-lg.c +@@ -872,7 +872,7 @@ static const struct hid_device_id lg_dev + { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WINGMAN_FFG), + .driver_data = LG_NOGET | LG_FF4 }, + { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2), +- .driver_data = LG_FF2 }, ++ .driver_data = LG_NOGET | LG_FF2 }, + { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_FLIGHT_SYSTEM_G940), + .driver_data = LG_FF3 }, + { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACENAVIGATOR), diff --git a/queue-4.9/hid-usbhid-quirk-a-ami-virtual-mouse-and-keyboard-with-always_poll.patch b/queue-4.9/hid-usbhid-quirk-a-ami-virtual-mouse-and-keyboard-with-always_poll.patch new file mode 100644 index 00000000000..63ca04a859b --- /dev/null +++ b/queue-4.9/hid-usbhid-quirk-a-ami-virtual-mouse-and-keyboard-with-always_poll.patch @@ -0,0 +1,65 @@ +From ed9ab4287f96e66340e0390e2c583f2f9110cba0 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Thu, 26 Jan 2017 17:34:40 +0000 +Subject: HID: usbhid: Quirk a AMI virtual mouse and keyboard with ALWAYS_POLL + +From: Colin Ian King + +commit ed9ab4287f96e66340e0390e2c583f2f9110cba0 upstream. + +Quirking the following AMI USB device with ALWAYS_POLL fixes an AMI +virtual keyboard and mouse from not responding and timing out when +it is attached to a ppc64el Power 8 system and when we have some +rapid open/closes on the mouse device. + + usb 1-3: new high-speed USB device number 2 using xhci_hcd + usb 1-3: New USB device found, idVendor=046b, idProduct=ff01 + usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3 + usb 1-3: Product: Virtual Hub + usb 1-3: Manufacturer: American Megatrends Inc. + usb 1-3: SerialNumber: serial + usb 1-3.3: new high-speed USB device number 3 using xhci_hcd + usb 1-3.3: New USB device found, idVendor=046b, idProduct=ff31 + usb 1-3.3: New USB device strings: Mfr=1, Product=2, SerialNumber=3 + usb 1-3.3: Product: Virtual HardDisk Device + usb 1-3.3: Manufacturer: American Megatrends Inc. + usb 1-3.4: new low-speed USB device number 4 using xhci_hcd + usb 1-3.4: New USB device found, idVendor=046b, idProduct=ff10 + usb 1-3.4: New USB device strings: Mfr=1, Product=2, SerialNumber=0 + usb 1-3.4: Product: Virtual Keyboard and Mouse + usb 1-3.4: Manufacturer: American Megatrends Inc. + +With the quirk I have not been able to trigger the issue with +half an hour of saturation soak testing. + +Signed-off-by: Colin Ian King +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/usbhid/hid-quirks.c | 1 + + 2 files changed, 4 insertions(+) + +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -76,6 +76,9 @@ + #define USB_VENDOR_ID_ALPS_JP 0x044E + #define HID_DEVICE_ID_ALPS_U1_DUAL 0x120B + ++#define USB_VENDOR_ID_AMI 0x046b ++#define USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE 0xff10 ++ + #define USB_VENDOR_ID_ANTON 0x1130 + #define USB_DEVICE_ID_ANTON_TOUCH_PAD 0x3101 + +--- a/drivers/hid/usbhid/hid-quirks.c ++++ b/drivers/hid/usbhid/hid-quirks.c +@@ -57,6 +57,7 @@ static const struct hid_blacklist { + { USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_AKAI, USB_DEVICE_ID_AKAI_MPKMINI2, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_AKAI_09E8, USB_DEVICE_ID_AKAI_09E8_MIDIMIX, HID_QUIRK_NO_INIT_REPORTS }, ++ { USB_VENDOR_ID_AMI, USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE, HID_QUIRK_ALWAYS_POLL }, + { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET }, diff --git a/queue-4.9/hid-wacom-fix-poor-prox-handling-in-wacom_pl_irq.patch b/queue-4.9/hid-wacom-fix-poor-prox-handling-in-wacom_pl_irq.patch new file mode 100644 index 00000000000..847a6de18b1 --- /dev/null +++ b/queue-4.9/hid-wacom-fix-poor-prox-handling-in-wacom_pl_irq.patch @@ -0,0 +1,68 @@ +From 282e4637bc1c0b338708bcebd09d31c69abec070 Mon Sep 17 00:00:00 2001 +From: Jason Gerecke +Date: Thu, 26 Jan 2017 09:06:22 -0800 +Subject: HID: wacom: Fix poor prox handling in 'wacom_pl_irq' + +From: Jason Gerecke + +commit 282e4637bc1c0b338708bcebd09d31c69abec070 upstream. + +Commit 025bcc1 performed cleanup work on the 'wacom_pl_irq' function, making +it follow the standards used in the rest of the codebase. The change +unintiontionally allowed the function to send input events from reports +that are not marked as being in prox. This can cause problems as the +report values for X, Y, etc. are not guaranteed to be correct. In +particular, occasionally the tablet will send a report with these values +set to zero. If such a report is received it can caus an unexpected jump +in the XY position. + +This patch surrounds more of the processing code with a proximity check, +preventing these zeroed reports from overwriting the current state. To +be safe, only the tool type and ABS_MISC events should be reported when +the pen is marked as being out of prox. + +Fixes: 025bcc1540 ("HID: wacom: Simplify 'wacom_pl_irq'") +Signed-off-by: Jason Gerecke +Reviewed-by: Ping Cheng +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/wacom_wac.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -164,19 +164,21 @@ static int wacom_pl_irq(struct wacom_wac + wacom->id[0] = STYLUS_DEVICE_ID; + } + +- pressure = (signed char)((data[7] << 1) | ((data[4] >> 2) & 1)); +- if (features->pressure_max > 255) +- pressure = (pressure << 1) | ((data[4] >> 6) & 1); +- pressure += (features->pressure_max + 1) / 2; ++ if (prox) { ++ pressure = (signed char)((data[7] << 1) | ((data[4] >> 2) & 1)); ++ if (features->pressure_max > 255) ++ pressure = (pressure << 1) | ((data[4] >> 6) & 1); ++ pressure += (features->pressure_max + 1) / 2; + +- input_report_abs(input, ABS_X, data[3] | (data[2] << 7) | ((data[1] & 0x03) << 14)); +- input_report_abs(input, ABS_Y, data[6] | (data[5] << 7) | ((data[4] & 0x03) << 14)); +- input_report_abs(input, ABS_PRESSURE, pressure); ++ input_report_abs(input, ABS_X, data[3] | (data[2] << 7) | ((data[1] & 0x03) << 14)); ++ input_report_abs(input, ABS_Y, data[6] | (data[5] << 7) | ((data[4] & 0x03) << 14)); ++ input_report_abs(input, ABS_PRESSURE, pressure); + +- input_report_key(input, BTN_TOUCH, data[4] & 0x08); +- input_report_key(input, BTN_STYLUS, data[4] & 0x10); +- /* Only allow the stylus2 button to be reported for the pen tool. */ +- input_report_key(input, BTN_STYLUS2, (wacom->tool[0] == BTN_TOOL_PEN) && (data[4] & 0x20)); ++ input_report_key(input, BTN_TOUCH, data[4] & 0x08); ++ input_report_key(input, BTN_STYLUS, data[4] & 0x10); ++ /* Only allow the stylus2 button to be reported for the pen tool. */ ++ input_report_key(input, BTN_STYLUS2, (wacom->tool[0] == BTN_TOOL_PEN) && (data[4] & 0x20)); ++ } + + if (!prox) + wacom->id[0] = 0; diff --git a/queue-4.9/iwlwifi-fix-double-hyphen-in-module_firmware-for-8000.patch b/queue-4.9/iwlwifi-fix-double-hyphen-in-module_firmware-for-8000.patch new file mode 100644 index 00000000000..89058af5805 --- /dev/null +++ b/queue-4.9/iwlwifi-fix-double-hyphen-in-module_firmware-for-8000.patch @@ -0,0 +1,37 @@ +From 7941c59e45f3b6d30e07375e9b6713427e0a9f98 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?J=C3=BCrg=20Billeter?= +Date: Mon, 10 Oct 2016 18:30:01 +0200 +Subject: iwlwifi: fix double hyphen in MODULE_FIRMWARE for 8000 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jürg Billeter + +commit 7941c59e45f3b6d30e07375e9b6713427e0a9f98 upstream. + +Mistakenly, the driver is trying to load the 8000C firmware with an +incorrect name (i.e. with two hyphens where there should be only one) +and that fails. Fix that by removing the hyphen from the format +macro. + +Fixes: e1ba684f762b ("iwlwifi: 8000: fix MODULE_FIRMWARE input") +Signed-off-by: Jürg Billeter +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/iwl-8000.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c +@@ -91,7 +91,7 @@ + + #define IWL8000_FW_PRE "iwlwifi-8000C-" + #define IWL8000_MODULE_FIRMWARE(api) \ +- IWL8000_FW_PRE "-" __stringify(api) ".ucode" ++ IWL8000_FW_PRE __stringify(api) ".ucode" + + #define IWL8265_FW_PRE "iwlwifi-8265-" + #define IWL8265_MODULE_FIRMWARE(api) \ diff --git a/queue-4.9/iwlwifi-mvm-avoid-crash-on-restart-w-o-reserved-queues.patch b/queue-4.9/iwlwifi-mvm-avoid-crash-on-restart-w-o-reserved-queues.patch new file mode 100644 index 00000000000..f5ec916f8a8 --- /dev/null +++ b/queue-4.9/iwlwifi-mvm-avoid-crash-on-restart-w-o-reserved-queues.patch @@ -0,0 +1,40 @@ +From 03c902bff524e0cf664737a33f2365f7837040bf Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Fri, 2 Dec 2016 12:03:36 +0100 +Subject: iwlwifi: mvm: avoid crash on restart w/o reserved queues + +From: Johannes Berg + +commit 03c902bff524e0cf664737a33f2365f7837040bf upstream. + +When the firmware restarts in a situation in which any station +has no queue reserved anymore because that queue was used, the +code will crash trying to access the queue_info array at the +offset 255, which is far too big. Fix this by checking that a +queue is actually reserved before writing its status. + +Fixes: 8d98ae6eb0d5 ("iwlwifi: mvm: re-assign old queues after hw restart in dqa mode") +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -1144,9 +1144,10 @@ static void iwl_mvm_realloc_queues_after + .frame_limit = IWL_FRAME_LIMIT, + }; + +- /* Make sure reserved queue is still marked as such (or allocated) */ +- mvm->queue_info[mvm_sta->reserved_queue].status = +- IWL_MVM_QUEUE_RESERVED; ++ /* Make sure reserved queue is still marked as such (if allocated) */ ++ if (mvm_sta->reserved_queue != IEEE80211_INVAL_HW_QUEUE) ++ mvm->queue_info[mvm_sta->reserved_queue].status = ++ IWL_MVM_QUEUE_RESERVED; + + for (i = 0; i <= IWL_MAX_TID_COUNT; i++) { + struct iwl_mvm_tid_data *tid_data = &mvm_sta->tid_data[i]; diff --git a/queue-4.9/perf-x86-intel-uncore-clean-up-hotplug-conversion-fallout.patch b/queue-4.9/perf-x86-intel-uncore-clean-up-hotplug-conversion-fallout.patch new file mode 100644 index 00000000000..dc89bcb4221 --- /dev/null +++ b/queue-4.9/perf-x86-intel-uncore-clean-up-hotplug-conversion-fallout.patch @@ -0,0 +1,131 @@ +From 1aa6cfd33df492939b0be15ebdbcff1f8ae5ddb6 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Tue, 31 Jan 2017 23:58:39 +0100 +Subject: perf/x86/intel/uncore: Clean up hotplug conversion fallout + +From: Thomas Gleixner + +commit 1aa6cfd33df492939b0be15ebdbcff1f8ae5ddb6 upstream. + +The recent conversion to the hotplug state machine kept two mechanisms from +the original code: + + 1) The first_init logic which adds the number of online CPUs in a package + to the refcount. That's wrong because the callbacks are executed for + all online CPUs. + + Remove it so the refcounting is correct. + + 2) The on_each_cpu() call to undo box->init() in the error handling + path. That's bogus because when the prepare callback fails no box has + been initialized yet. + + Remove it. + +Signed-off-by: Thomas Gleixner +Cc: Alexander Shishkin +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Sebastian Siewior +Cc: Stephane Eranian +Cc: Vince Weaver +Cc: Yasuaki Ishimatsu +Fixes: 1a246b9f58c6 ("perf/x86/intel/uncore: Convert to hotplug state machine") +Link: http://lkml.kernel.org/r/20170131230141.298032324@linutronix.de +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/events/intel/uncore.c | 44 +++-------------------------------------- + 1 file changed, 4 insertions(+), 40 deletions(-) + +--- a/arch/x86/events/intel/uncore.c ++++ b/arch/x86/events/intel/uncore.c +@@ -763,30 +763,6 @@ static void uncore_pmu_unregister(struct + pmu->registered = false; + } + +-static void __uncore_exit_boxes(struct intel_uncore_type *type, int cpu) +-{ +- struct intel_uncore_pmu *pmu = type->pmus; +- struct intel_uncore_box *box; +- int i, pkg; +- +- if (pmu) { +- pkg = topology_physical_package_id(cpu); +- for (i = 0; i < type->num_boxes; i++, pmu++) { +- box = pmu->boxes[pkg]; +- if (box) +- uncore_box_exit(box); +- } +- } +-} +- +-static void uncore_exit_boxes(void *dummy) +-{ +- struct intel_uncore_type **types; +- +- for (types = uncore_msr_uncores; *types; types++) +- __uncore_exit_boxes(*types++, smp_processor_id()); +-} +- + static void uncore_free_boxes(struct intel_uncore_pmu *pmu) + { + int pkg; +@@ -1077,22 +1053,12 @@ static int uncore_cpu_dying(unsigned int + return 0; + } + +-static int first_init; +- + static int uncore_cpu_starting(unsigned int cpu) + { + struct intel_uncore_type *type, **types = uncore_msr_uncores; + struct intel_uncore_pmu *pmu; + struct intel_uncore_box *box; +- int i, pkg, ncpus = 1; +- +- if (first_init) { +- /* +- * On init we get the number of online cpus in the package +- * and set refcount for all of them. +- */ +- ncpus = cpumask_weight(topology_core_cpumask(cpu)); +- } ++ int i, pkg; + + pkg = topology_logical_package_id(cpu); + for (; *types; types++) { +@@ -1103,7 +1069,7 @@ static int uncore_cpu_starting(unsigned + if (!box) + continue; + /* The first cpu on a package activates the box */ +- if (atomic_add_return(ncpus, &box->refcnt) == ncpus) ++ if (atomic_inc_return(&box->refcnt) == 1) + uncore_box_init(box); + } + } +@@ -1407,19 +1373,17 @@ static int __init intel_uncore_init(void + "PERF_X86_UNCORE_PREP", + uncore_cpu_prepare, NULL); + } +- first_init = 1; ++ + cpuhp_setup_state(CPUHP_AP_PERF_X86_UNCORE_STARTING, + "AP_PERF_X86_UNCORE_STARTING", + uncore_cpu_starting, uncore_cpu_dying); +- first_init = 0; ++ + cpuhp_setup_state(CPUHP_AP_PERF_X86_UNCORE_ONLINE, + "AP_PERF_X86_UNCORE_ONLINE", + uncore_event_cpu_online, uncore_event_cpu_offline); + return 0; + + err: +- /* Undo box->init_box() */ +- on_each_cpu_mask(&uncore_cpu_mask, uncore_exit_boxes, NULL, 1); + uncore_types_exit(uncore_msr_uncores); + uncore_pci_exit(); + return ret; diff --git a/queue-4.9/pinctrl-baytrail-debounce-register-is-one-per-community.patch b/queue-4.9/pinctrl-baytrail-debounce-register-is-one-per-community.patch new file mode 100644 index 00000000000..6143a7b29a4 --- /dev/null +++ b/queue-4.9/pinctrl-baytrail-debounce-register-is-one-per-community.patch @@ -0,0 +1,64 @@ +From 1b89970d81bbd52720fc64a3fe9572ee33588363 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Thu, 26 Jan 2017 19:24:08 +0200 +Subject: pinctrl: baytrail: Debounce register is one per community + +From: Andy Shevchenko + +commit 1b89970d81bbd52720fc64a3fe9572ee33588363 upstream. + +Debounce value is set globally per community. Otherwise user will easily +get a kernel crash when they start using the feature: + +BUG: unable to handle kernel paging request at ffffc900003be000 +IP: byt_gpio_dbg_show+0xa9/0x430 + +Make it clear in byt_gpio_reg(). + +Note that this fix just prevents kernel to crash, but doesn't make any +difference to the existing logic. It means the last caller will win the +trade and debounce value will be configured accordingly. The actual +logic fix needs to be thought about and it's not as important as crash +fix. That's why the latter goes separately and right now. + +Fixes: 658b476c742f ("pinctrl: baytrail: Add debounce configuration") +Cc: Cristina Ciocan +Signed-off-by: Andy Shevchenko +Reviewed-by: Jean Delvare +Acked-by: Mika Westerberg +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/intel/pinctrl-baytrail.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/drivers/pinctrl/intel/pinctrl-baytrail.c ++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c +@@ -731,16 +731,23 @@ static void __iomem *byt_gpio_reg(struct + int reg) + { + struct byt_community *comm = byt_get_community(vg, offset); +- u32 reg_offset = 0; ++ u32 reg_offset; + + if (!comm) + return NULL; + + offset -= comm->pin_base; +- if (reg == BYT_INT_STAT_REG) ++ switch (reg) { ++ case BYT_INT_STAT_REG: + reg_offset = (offset / 32) * 4; +- else ++ break; ++ case BYT_DEBOUNCE_REG: ++ reg_offset = 0; ++ break; ++ default: + reg_offset = comm->pad_map[offset] * 16; ++ break; ++ } + + return comm->reg_base + reg_offset + reg; + } diff --git a/queue-4.9/pinctrl-intel-merrifield-add-missed-check-in-mrfld_config_set.patch b/queue-4.9/pinctrl-intel-merrifield-add-missed-check-in-mrfld_config_set.patch new file mode 100644 index 00000000000..fbf1500987d --- /dev/null +++ b/queue-4.9/pinctrl-intel-merrifield-add-missed-check-in-mrfld_config_set.patch @@ -0,0 +1,34 @@ +From 19b26d92dfb70f56440c187a20c49102ab648b97 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Tue, 24 Jan 2017 17:28:22 +0200 +Subject: pinctrl: intel: merrifield: Add missed check in mrfld_config_set() + +From: Andy Shevchenko + +commit 19b26d92dfb70f56440c187a20c49102ab648b97 upstream. + +Not every pin can be configured. Add missed check to prevent access +violation. + +Fixes: 4e80c8f50574 ("pinctrl: intel: Add Intel Merrifield pin controller support") +Acked-by: Mika Westerberg +Signed-off-by: Andy Shevchenko +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/intel/pinctrl-merrifield.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/pinctrl/intel/pinctrl-merrifield.c ++++ b/drivers/pinctrl/intel/pinctrl-merrifield.c +@@ -794,6 +794,9 @@ static int mrfld_config_set(struct pinct + unsigned int i; + int ret; + ++ if (!mrfld_buf_available(mp, pin)) ++ return -ENOTSUPP; ++ + for (i = 0; i < nconfigs; i++) { + switch (pinconf_to_config_param(configs[i])) { + case PIN_CONFIG_BIAS_DISABLE: diff --git a/queue-4.9/series b/queue-4.9/series index f4149fc9578..a083f0df4a6 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -36,3 +36,13 @@ regulator-axp20x-axp806-fix-dcdcb-being-set-instead-of-dcdce.patch percpu-refcount-fix-reference-leak-during-percpu-atomic-transition.patch revert-bcma-init-serial-console-directly-from-chipcommon-code.patch revert-vring-force-use-of-dma-api-for-arm-based-systems-with-legacy-devices.patch +pinctrl-baytrail-debounce-register-is-one-per-community.patch +pinctrl-intel-merrifield-add-missed-check-in-mrfld_config_set.patch +iwlwifi-fix-double-hyphen-in-module_firmware-for-8000.patch +iwlwifi-mvm-avoid-crash-on-restart-w-o-reserved-queues.patch +hid-usbhid-quirk-a-ami-virtual-mouse-and-keyboard-with-always_poll.patch +hid-hid-lg-fix-immediate-disconnection-of-logitech-rumblepad-2.patch +hid-wacom-fix-poor-prox-handling-in-wacom_pl_irq.patch +perf-x86-intel-uncore-clean-up-hotplug-conversion-fallout.patch +dmaengine-cppi41-fix-runtime-pm-timeouts-with-usb-mass-storage.patch +dmaengine-cppi41-fix-oops-in-cppi41_runtime_resume.patch -- 2.47.3