From: Greg Kroah-Hartman Date: Sun, 18 Jun 2017 01:03:26 +0000 (+0800) Subject: 4.11-stable patches X-Git-Tag: v4.11.7~35 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8f717a5ca7b61c0685645caf62f4589310954c7b;p=thirdparty%2Fkernel%2Fstable-queue.git 4.11-stable patches added patches: alsa-hda-add-geminilake-id-to-skl_plus.patch alsa-usb-audio-fix-amanero-combo384-quirk-on-big-endian-hosts.patch can-gs_usb-fix-memory-leak-in-gs_cmd_reset.patch cec-race-fix-don-t-return-enonet-in-cec_receive.patch coda-restore-original-firmware-locations.patch configfs-fix-race-between-create_link-and-configfs_rmdir.patch cpufreq-conservative-allow-down_threshold-to-take-values-from-1-to-10.patch drivers-misc-c2port-c2port-duramar2150.c-checking-for-null-instead-of-is_err.patch drm-amdgpu-fix-overflow-of-watermark-calcs-at-4k-resolutions.patch drm-i915-do-not-sync-rcu-during-shrinking.patch drm-i915-fix-gvt-g-pvinfo-version-compatibility-check.patch drm-i915-fix-scaling-check-for-90-270-degree-plane-rotation.patch drm-mediatek-fix-mtk_hdmi_setup_vendor_specific_infoframe-mistake.patch drm-mxsfb_crtc-reset-the-elcdif-controller.patch drm-vc4-fix-oopses-from-trying-to-cache-a-partially-constructed-bo.patch dt-bindings-mfd-axp20x-add-xpowers-master-mode-property-for-axp806-pmics.patch fs-pass-on-flags-in-compat_writev.patch iio-adc-ti_am335x_adc-allocating-too-much-in-probe.patch iio-imu-st_lsm6dsx-do-not-apply-odr-configuration-in-write_raw-handler.patch iio-proximity-as3935-recalibrate-rco-after-resume.patch ila_xlat-add-missing-hash-secret-initialization.patch mac80211-don-t-look-at-the-pm-bit-of-bar-frames.patch mac80211-don-t-send-smps-action-frame-in-ap-mode-when-not-needed.patch mac80211-fix-dropped-counter-in-multiqueue-rx.patch mac80211-fix-ibss-presp-allocation-size.patch mac80211-strictly-check-mesh-address-extension-mode.patch mac80211-wpa-use-constant-time-memory-comparison-for-macs.patch mfd-axp20x-add-support-for-dts-property-xpowers-master-mode.patch mfd-cpcap-fix-bad-use-of-irq-sense-register.patch mfd-cpcap-fix-interrupt-to-use-level-interrupt.patch mfd-cpcap-use-ack_invert-interrupts.patch mfd-omap-usb-tll-fix-inverted-bit-use-for-usb-tll-mode.patch mtd-physmap_of-really-fix-the-physmap-add-ons.patch phy-rcar-gen3-usb2-fix-implementation-for-runtime-pm.patch powerpc-mm-add-physical-address-to-linux-page-table-dump.patch pvrusb2-reduce-stack-usage-pvr2_eeprom_analyze.patch selinux-fix-double-free-in-selinux_parse_opts_str.patch serial-8250_lpss-unconditionally-set-pci-master-for-quark.patch serial-efm32-fix-parity-management-in-efm32_uart_console_get_options.patch serial-sh-sci-fix-auto-rts-in-sci_init_pins.patch serial-sh-sci-fix-late-enablement-of-autorts.patch staging-bcm2835-camera-fix-error-handling-in-init.patch staging-iio-tsl2x7x_core-fix-standard-deviation-calculation.patch staging-rtl8188eu-prevent-an-underflow-in-rtw_check_beacon_data.patch usb-core-fix-potential-memory-leak-in-error-path-during-hcd-creation.patch usb-dwc3-gadget-fix-iso-transfer-performance.patch usb-gadget-dummy_hcd-fix-hub-descriptor-removable-fields.patch usb-gadget-udc-renesas_usb3-fix-deadlock-by-spinlock.patch usb-gadget-udc-renesas_usb3-fix-pm_runtime-functions-calling.patch usb-gadget-udc-renesas_usb3-lock-for-pn_-registers-access.patch usb-hub-fix-ss-max-number-of-ports.patch usb-r8a66597-hcd-decrease-timeout.patch usb-r8a66597-hcd-select-a-different-endpoint-on-timeout.patch usb-usbip-fix-nonconforming-hub-descriptor.patch vb2-fix-an-off-by-one-error-in-vb2_plane_vaddr.patch x86-mm-32-set-the-__vmalloc_start_set-flag-in-initmem_init.patch --- diff --git a/queue-3.18/series b/queue-3.18/series index d6b5f7afe74..2043ebaa2ca 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -7,3 +7,20 @@ ipv6-handle-ipv4-mapped-src-to-in6addr_any-dst.patch ipv6-inhibit-ipv4-mapped-src-address-on-the-wire.patch log2-make-order_base_2-behave-correctly-on-const-input-value-zero.patch sparc64-make-string-buffers-large-enough.patch +configfs-fix-race-between-create_link-and-configfs_rmdir.patch +can-gs_usb-fix-memory-leak-in-gs_cmd_reset.patch +cpufreq-conservative-allow-down_threshold-to-take-values-from-1-to-10.patch +vb2-fix-an-off-by-one-error-in-vb2_plane_vaddr.patch +mac80211-don-t-look-at-the-pm-bit-of-bar-frames.patch +serial-efm32-fix-parity-management-in-efm32_uart_console_get_options.patch +x86-mm-32-set-the-__vmalloc_start_set-flag-in-initmem_init.patch +mfd-omap-usb-tll-fix-inverted-bit-use-for-usb-tll-mode.patch +staging-rtl8188eu-prevent-an-underflow-in-rtw_check_beacon_data.patch +iio-proximity-as3935-recalibrate-rco-after-resume.patch +usb-hub-fix-ss-max-number-of-ports.patch +usb-core-fix-potential-memory-leak-in-error-path-during-hcd-creation.patch +pvrusb2-reduce-stack-usage-pvr2_eeprom_analyze.patch +usb-gadget-dummy_hcd-fix-hub-descriptor-removable-fields.patch +usb-r8a66597-hcd-select-a-different-endpoint-on-timeout.patch +usb-r8a66597-hcd-decrease-timeout.patch +drivers-misc-c2port-c2port-duramar2150.c-checking-for-null-instead-of-is_err.patch diff --git a/queue-4.11/alsa-hda-add-geminilake-id-to-skl_plus.patch b/queue-4.11/alsa-hda-add-geminilake-id-to-skl_plus.patch new file mode 100644 index 00000000000..1a847fccd67 --- /dev/null +++ b/queue-4.11/alsa-hda-add-geminilake-id-to-skl_plus.patch @@ -0,0 +1,37 @@ +From 12ee4022f67f8854061b46e5c0a7ad6258ab66c2 Mon Sep 17 00:00:00 2001 +From: "Subhransu S. Prusty" +Date: Wed, 12 Apr 2017 09:54:00 +0530 +Subject: ALSA: hda: Add Geminilake id to SKL_PLUS + +From: Subhransu S. Prusty + +commit 12ee4022f67f8854061b46e5c0a7ad6258ab66c2 upstream. + +Geminilake is Skylake family platform. So add it's id to skl_plus check. + +Fixes: 126cfa2f5e15 ("ALSA: hda: Add Geminilake HDMI codec ID") +Signed-off-by: Subhransu S. Prusty +Cc: Senthilnathan Veppur +Cc: Vinod Koul +Cc: Takashi Iwai +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -369,8 +369,10 @@ enum { + #define IS_KBL_LP(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d71) + #define IS_KBL_H(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa2f0) + #define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98) ++#define IS_GLK(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x3198) + #define IS_SKL_PLUS(pci) (IS_SKL(pci) || IS_SKL_LP(pci) || IS_BXT(pci)) || \ +- IS_KBL(pci) || IS_KBL_LP(pci) || IS_KBL_H(pci) ++ IS_KBL(pci) || IS_KBL_LP(pci) || IS_KBL_H(pci) || \ ++ IS_GLK(pci) + + static char *driver_short_names[] = { + [AZX_DRIVER_ICH] = "HDA Intel", diff --git a/queue-4.11/alsa-usb-audio-fix-amanero-combo384-quirk-on-big-endian-hosts.patch b/queue-4.11/alsa-usb-audio-fix-amanero-combo384-quirk-on-big-endian-hosts.patch new file mode 100644 index 00000000000..b0da5cc07b9 --- /dev/null +++ b/queue-4.11/alsa-usb-audio-fix-amanero-combo384-quirk-on-big-endian-hosts.patch @@ -0,0 +1,33 @@ +From f83914fdfcc3ecb62a5a83eeb609ff59a9c2052d Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 12 May 2017 14:34:37 +0200 +Subject: ALSA: usb-audio: fix Amanero Combo384 quirk on big-endian hosts + +From: Johan Hovold + +commit f83914fdfcc3ecb62a5a83eeb609ff59a9c2052d upstream. + +Add missing endianness conversion when using the USB device-descriptor +bcdDevice field when applying the Amanero Combo384 (endianness!) quirk. + +Fixes: 3eff682d765b ("ALSA: usb-audio: Support both DSD LE/BE Amanero firmware versions") +Cc: Jussi Laako +Signed-off-by: Johan Hovold +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/quirks.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1364,7 +1364,7 @@ u64 snd_usb_interface_dsd_format_quirks( + /* Amanero Combo384 USB interface with native DSD support */ + case USB_ID(0x16d0, 0x071a): + if (fp->altsetting == 2) { +- switch (chip->dev->descriptor.bcdDevice) { ++ switch (le16_to_cpu(chip->dev->descriptor.bcdDevice)) { + case 0x199: + return SNDRV_PCM_FMTBIT_DSD_U32_LE; + case 0x19b: diff --git a/queue-4.11/can-gs_usb-fix-memory-leak-in-gs_cmd_reset.patch b/queue-4.11/can-gs_usb-fix-memory-leak-in-gs_cmd_reset.patch new file mode 100644 index 00000000000..8a800a663e8 --- /dev/null +++ b/queue-4.11/can-gs_usb-fix-memory-leak-in-gs_cmd_reset.patch @@ -0,0 +1,31 @@ +From 5cda3ee5138e91ac369ed9d0b55eab0dab077686 Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Sun, 4 Jun 2017 14:03:42 +0200 +Subject: can: gs_usb: fix memory leak in gs_cmd_reset() + +From: Marc Kleine-Budde + +commit 5cda3ee5138e91ac369ed9d0b55eab0dab077686 upstream. + +This patch adds the missing kfree() in gs_cmd_reset() to free the +memory that is not used anymore after usb_control_msg(). + +Cc: Maximilian Schneider +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/gs_usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -265,6 +265,8 @@ static int gs_cmd_reset(struct gs_usb *g + sizeof(*dm), + 1000); + ++ kfree(dm); ++ + return rc; + } + diff --git a/queue-4.11/cec-race-fix-don-t-return-enonet-in-cec_receive.patch b/queue-4.11/cec-race-fix-don-t-return-enonet-in-cec_receive.patch new file mode 100644 index 00000000000..16047ab878f --- /dev/null +++ b/queue-4.11/cec-race-fix-don-t-return-enonet-in-cec_receive.patch @@ -0,0 +1,54 @@ +From b94aac64a4c17c5af92f9b4ba7164c5b384d5c02 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Wed, 7 Jun 2017 12:07:51 -0300 +Subject: [media] cec: race fix: don't return -ENONET in cec_receive() + +From: Hans Verkuil + +commit b94aac64a4c17c5af92f9b4ba7164c5b384d5c02 upstream. + +When calling CEC_RECEIVE do not check if the adapter is configured. +Typically CEC_RECEIVE is called after a select() and if that indicates +that there are messages in the receive queue, then you should always be +able to dequeue a message. + +The race condition here is that a message has been received and is +queued, so select() tells userspace that a message is available. But +before the application calls CEC_RECEIVE the adapter is unconfigured +(e.g. the HDMI cable is removed). Now select will always report that +there is a message, but calling CEC_RECEIVE will always return -ENONET +because the adapter is no longer configured and so will never actually +dequeue the message. + +There is really no need for this check, and in fact the ENONET error +code was never documented for CEC_RECEIVE. This may have been a left-over +of old code that was never updated. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/cec/cec-api.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +--- a/drivers/media/cec/cec-api.c ++++ b/drivers/media/cec/cec-api.c +@@ -267,16 +267,10 @@ static long cec_receive(struct cec_adapt + bool block, struct cec_msg __user *parg) + { + struct cec_msg msg = {}; +- long err = 0; ++ long err; + + if (copy_from_user(&msg, parg, sizeof(msg))) + return -EFAULT; +- mutex_lock(&adap->lock); +- if (!adap->is_configured && fh->mode_follower < CEC_MODE_MONITOR) +- err = -ENONET; +- mutex_unlock(&adap->lock); +- if (err) +- return err; + + err = cec_receive_msg(fh, &msg, block); + if (err) diff --git a/queue-4.11/coda-restore-original-firmware-locations.patch b/queue-4.11/coda-restore-original-firmware-locations.patch new file mode 100644 index 00000000000..eba0e39d9ff --- /dev/null +++ b/queue-4.11/coda-restore-original-firmware-locations.patch @@ -0,0 +1,67 @@ +From 1e9b71d53ddc3b8df81ef6be052e31b70442a47f Mon Sep 17 00:00:00 2001 +From: Philipp Zabel +Date: Wed, 8 Mar 2017 09:30:50 -0300 +Subject: [media] coda: restore original firmware locations + +From: Philipp Zabel + +commit 1e9b71d53ddc3b8df81ef6be052e31b70442a47f upstream. + +Recently, an unfinished patch was merged that added a third entry to the +beginning of the array of firmware locations without changing the code +to also look at the third element, thus pushing an old firmware location +off the list. + +Fixes: 8af7779f3cbc ("[media] coda: add Freescale firmware compatibility location") + +Signed-off-by: Philipp Zabel +Acked-by: Baruch Siach +Reviewed-by: Fabio Estevam +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/coda/coda-common.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +--- a/drivers/media/platform/coda/coda-common.c ++++ b/drivers/media/platform/coda/coda-common.c +@@ -2126,7 +2126,12 @@ static void coda_fw_callback(const struc + + static int coda_firmware_request(struct coda_dev *dev) + { +- char *fw = dev->devtype->firmware[dev->firmware]; ++ char *fw; ++ ++ if (dev->firmware >= ARRAY_SIZE(dev->devtype->firmware)) ++ return -EINVAL; ++ ++ fw = dev->devtype->firmware[dev->firmware]; + + dev_dbg(&dev->plat_dev->dev, "requesting firmware '%s' for %s\n", fw, + coda_product_name(dev->devtype->product)); +@@ -2142,16 +2147,16 @@ static void coda_fw_callback(const struc + struct platform_device *pdev = dev->plat_dev; + int i, ret; + +- if (!fw && dev->firmware == 1) { +- v4l2_err(&dev->v4l2_dev, "firmware request failed\n"); +- goto put_pm; +- } + if (!fw) { +- dev->firmware = 1; +- coda_firmware_request(dev); ++ dev->firmware++; ++ ret = coda_firmware_request(dev); ++ if (ret < 0) { ++ v4l2_err(&dev->v4l2_dev, "firmware request failed\n"); ++ goto put_pm; ++ } + return; + } +- if (dev->firmware == 1) { ++ if (dev->firmware > 0) { + /* + * Since we can't suppress warnings for failed asynchronous + * firmware requests, report that the fallback firmware was diff --git a/queue-4.11/configfs-fix-race-between-create_link-and-configfs_rmdir.patch b/queue-4.11/configfs-fix-race-between-create_link-and-configfs_rmdir.patch new file mode 100644 index 00000000000..911aea1e213 --- /dev/null +++ b/queue-4.11/configfs-fix-race-between-create_link-and-configfs_rmdir.patch @@ -0,0 +1,88 @@ +From ba80aa909c99802c428682c352b0ee0baac0acd3 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Thu, 8 Jun 2017 04:51:54 +0000 +Subject: configfs: Fix race between create_link and configfs_rmdir + +From: Nicholas Bellinger + +commit ba80aa909c99802c428682c352b0ee0baac0acd3 upstream. + +This patch closes a long standing race in configfs between +the creation of a new symlink in create_link(), while the +symlink target's config_item is being concurrently removed +via configfs_rmdir(). + +This can happen because the symlink target's reference +is obtained by config_item_get() in create_link() before +the CONFIGFS_USET_DROPPING bit set by configfs_detach_prep() +during configfs_rmdir() shutdown is actually checked.. + +This originally manifested itself on ppc64 on v4.8.y under +heavy load using ibmvscsi target ports with Novalink API: + +[ 7877.289863] rpadlpar_io: slot U8247.22L.212A91A-V1-C8 added +[ 7879.893760] ------------[ cut here ]------------ +[ 7879.893768] WARNING: CPU: 15 PID: 17585 at ./include/linux/kref.h:46 config_item_get+0x7c/0x90 [configfs] +[ 7879.893811] CPU: 15 PID: 17585 Comm: targetcli Tainted: G O 4.8.17-customv2.22 #12 +[ 7879.893812] task: c00000018a0d3400 task.stack: c0000001f3b40000 +[ 7879.893813] NIP: d000000002c664ec LR: d000000002c60980 CTR: c000000000b70870 +[ 7879.893814] REGS: c0000001f3b43810 TRAP: 0700 Tainted: G O (4.8.17-customv2.22) +[ 7879.893815] MSR: 8000000000029033 CR: 28222242 XER: 00000000 +[ 7879.893820] CFAR: d000000002c664bc SOFTE: 1 + GPR00: d000000002c60980 c0000001f3b43a90 d000000002c70908 c0000000fbc06820 + GPR04: c0000001ef1bd900 0000000000000004 0000000000000001 0000000000000000 + GPR08: 0000000000000000 0000000000000001 d000000002c69560 d000000002c66d80 + GPR12: c000000000b70870 c00000000e798700 c0000001f3b43ca0 c0000001d4949d40 + GPR16: c00000014637e1c0 0000000000000000 0000000000000000 c0000000f2392940 + GPR20: c0000001f3b43b98 0000000000000041 0000000000600000 0000000000000000 + GPR24: fffffffffffff000 0000000000000000 d000000002c60be0 c0000001f1dac490 + GPR28: 0000000000000004 0000000000000000 c0000001ef1bd900 c0000000f2392940 +[ 7879.893839] NIP [d000000002c664ec] config_item_get+0x7c/0x90 [configfs] +[ 7879.893841] LR [d000000002c60980] check_perm+0x80/0x2e0 [configfs] +[ 7879.893842] Call Trace: +[ 7879.893844] [c0000001f3b43ac0] [d000000002c60980] check_perm+0x80/0x2e0 [configfs] +[ 7879.893847] [c0000001f3b43b10] [c000000000329770] do_dentry_open+0x2c0/0x460 +[ 7879.893849] [c0000001f3b43b70] [c000000000344480] path_openat+0x210/0x1490 +[ 7879.893851] [c0000001f3b43c80] [c00000000034708c] do_filp_open+0xfc/0x170 +[ 7879.893853] [c0000001f3b43db0] [c00000000032b5bc] do_sys_open+0x1cc/0x390 +[ 7879.893856] [c0000001f3b43e30] [c000000000009584] system_call+0x38/0xec +[ 7879.893856] Instruction dump: +[ 7879.893858] 409d0014 38210030 e8010010 7c0803a6 4e800020 3d220000 e94981e0 892a0000 +[ 7879.893861] 2f890000 409effe0 39200001 992a0000 <0fe00000> 4bffffd0 60000000 60000000 +[ 7879.893866] ---[ end trace 14078f0b3b5ad0aa ]--- + +To close this race, go ahead and obtain the symlink's target +config_item reference only after the existing CONFIGFS_USET_DROPPING +check succeeds. + +This way, if configfs_rmdir() wins create_link() will return -ENONET, +and if create_link() wins configfs_rmdir() will return -EBUSY. + +Reported-by: Bryant G. Ly +Tested-by: Bryant G. Ly +Signed-off-by: Nicholas Bellinger +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman + +--- + fs/configfs/symlink.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/fs/configfs/symlink.c ++++ b/fs/configfs/symlink.c +@@ -83,14 +83,13 @@ static int create_link(struct config_ite + ret = -ENOMEM; + sl = kmalloc(sizeof(struct configfs_symlink), GFP_KERNEL); + if (sl) { +- sl->sl_target = config_item_get(item); + spin_lock(&configfs_dirent_lock); + if (target_sd->s_type & CONFIGFS_USET_DROPPING) { + spin_unlock(&configfs_dirent_lock); +- config_item_put(item); + kfree(sl); + return -ENOENT; + } ++ sl->sl_target = config_item_get(item); + list_add(&sl->sl_list, &target_sd->s_links); + spin_unlock(&configfs_dirent_lock); + ret = configfs_create_link(sl, parent_item->ci_dentry, diff --git a/queue-4.11/cpufreq-conservative-allow-down_threshold-to-take-values-from-1-to-10.patch b/queue-4.11/cpufreq-conservative-allow-down_threshold-to-take-values-from-1-to-10.patch new file mode 100644 index 00000000000..165d524616a --- /dev/null +++ b/queue-4.11/cpufreq-conservative-allow-down_threshold-to-take-values-from-1-to-10.patch @@ -0,0 +1,46 @@ +From b8e11f7d2791bd9320be1c6e772a60b2aa093e45 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tomasz=20Wilczy=C5=84ski?= +Date: Sun, 11 Jun 2017 17:28:39 +0900 +Subject: cpufreq: conservative: Allow down_threshold to take values from 1 to 10 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tomasz Wilczyński + +commit b8e11f7d2791bd9320be1c6e772a60b2aa093e45 upstream. + +Commit 27ed3cd2ebf4 (cpufreq: conservative: Fix the logic in frequency +decrease checking) removed the 10 point substraction when comparing the +load against down_threshold but did not remove the related limit for the +down_threshold value. As a result, down_threshold lower than 11 is not +allowed even though values from 1 to 10 do work correctly too. The +comment ("cannot be lower than 11 otherwise freq will not fall") also +does not apply after removing the substraction. + +For this reason, allow down_threshold to take any value from 1 to 99 +and fix the related comment. + +Fixes: 27ed3cd2ebf4 (cpufreq: conservative: Fix the logic in frequency decrease checking) +Signed-off-by: Tomasz Wilczyński +Acked-by: Viresh Kumar +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/cpufreq_conservative.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/cpufreq/cpufreq_conservative.c ++++ b/drivers/cpufreq/cpufreq_conservative.c +@@ -185,8 +185,8 @@ static ssize_t store_down_threshold(stru + int ret; + ret = sscanf(buf, "%u", &input); + +- /* cannot be lower than 11 otherwise freq will not fall */ +- if (ret != 1 || input < 11 || input > 100 || ++ /* cannot be lower than 1 otherwise freq will not fall */ ++ if (ret != 1 || input < 1 || input > 100 || + input >= dbs_data->up_threshold) + return -EINVAL; + diff --git a/queue-4.11/drivers-misc-c2port-c2port-duramar2150.c-checking-for-null-instead-of-is_err.patch b/queue-4.11/drivers-misc-c2port-c2port-duramar2150.c-checking-for-null-instead-of-is_err.patch new file mode 100644 index 00000000000..8046da9e6ed --- /dev/null +++ b/queue-4.11/drivers-misc-c2port-c2port-duramar2150.c-checking-for-null-instead-of-is_err.patch @@ -0,0 +1,37 @@ +From 8128a31eaadbcdfa37774bbd28f3f00bac69996a Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 8 May 2017 15:55:17 -0700 +Subject: drivers/misc/c2port/c2port-duramar2150.c: checking for NULL instead of IS_ERR() + +From: Dan Carpenter + +commit 8128a31eaadbcdfa37774bbd28f3f00bac69996a upstream. + +c2port_device_register() never returns NULL, it uses error pointers. + +Link: http://lkml.kernel.org/r/20170412083321.GC3250@mwanda +Fixes: 65131cd52b9e ("c2port: add c2port support for Eurotech Duramar 2150") +Signed-off-by: Dan Carpenter +Acked-by: Rodolfo Giometti +Cc: Greg Kroah-Hartman +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/c2port/c2port-duramar2150.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/misc/c2port/c2port-duramar2150.c ++++ b/drivers/misc/c2port/c2port-duramar2150.c +@@ -129,8 +129,8 @@ static int __init duramar2150_c2port_ini + + duramar2150_c2port_dev = c2port_device_register("uc", + &duramar2150_c2port_ops, NULL); +- if (!duramar2150_c2port_dev) { +- ret = -ENODEV; ++ if (IS_ERR(duramar2150_c2port_dev)) { ++ ret = PTR_ERR(duramar2150_c2port_dev); + goto free_region; + } + diff --git a/queue-4.11/drm-amdgpu-fix-overflow-of-watermark-calcs-at-4k-resolutions.patch b/queue-4.11/drm-amdgpu-fix-overflow-of-watermark-calcs-at-4k-resolutions.patch new file mode 100644 index 00000000000..27d909d89f7 --- /dev/null +++ b/queue-4.11/drm-amdgpu-fix-overflow-of-watermark-calcs-at-4k-resolutions.patch @@ -0,0 +1,96 @@ +From bea10413934dcf98cb9b2dfcdc56e1d28f192897 Mon Sep 17 00:00:00 2001 +From: Mario Kleiner +Date: Tue, 13 Jun 2017 07:17:10 +0200 +Subject: drm/amdgpu: Fix overflow of watermark calcs at > 4k resolutions. + +From: Mario Kleiner + +commit bea10413934dcf98cb9b2dfcdc56e1d28f192897 upstream. + +Commit d63c277dc672e0 +("drm/amdgpu: Make display watermark calculations more accurate") +made watermark calculations more accurate, but not for > 4k +resolutions on 32-Bit architectures, as it introduced an integer +overflow for those setups and resolutions. + +Fix this by proper u64 casting and division. + +Signed-off-by: Mario Kleiner +Reported-by: Ben Hutchings +Fixes: d63c277dc672 ("drm/amdgpu: Make display watermark calculations more accurate") +Cc: Ben Hutchings +Cc: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 7 +++++-- + drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 7 +++++-- + drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 7 +++++-- + drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 7 +++++-- + 4 files changed, 20 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c +@@ -1207,8 +1207,11 @@ static void dce_v10_0_program_watermarks + u32 tmp, wm_mask, lb_vblank_lead_lines = 0; + + if (amdgpu_crtc->base.enabled && num_heads && mode) { +- active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock; +- line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535); ++ active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000, ++ (u32)mode->clock); ++ line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000, ++ (u32)mode->clock); ++ line_time = min(line_time, (u32)65535); + + /* watermark for high clocks */ + if (adev->pm.dpm_enabled) { +--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c +@@ -1176,8 +1176,11 @@ static void dce_v11_0_program_watermarks + u32 tmp, wm_mask, lb_vblank_lead_lines = 0; + + if (amdgpu_crtc->base.enabled && num_heads && mode) { +- active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock; +- line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535); ++ active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000, ++ (u32)mode->clock); ++ line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000, ++ (u32)mode->clock); ++ line_time = min(line_time, (u32)65535); + + /* watermark for high clocks */ + if (adev->pm.dpm_enabled) { +--- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c +@@ -983,8 +983,11 @@ static void dce_v6_0_program_watermarks( + fixed20_12 a, b, c; + + if (amdgpu_crtc->base.enabled && num_heads && mode) { +- active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock; +- line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535); ++ active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000, ++ (u32)mode->clock); ++ line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000, ++ (u32)mode->clock); ++ line_time = min(line_time, (u32)65535); + priority_a_cnt = 0; + priority_b_cnt = 0; + +--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c +@@ -1091,8 +1091,11 @@ static void dce_v8_0_program_watermarks( + u32 tmp, wm_mask, lb_vblank_lead_lines = 0; + + if (amdgpu_crtc->base.enabled && num_heads && mode) { +- active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock; +- line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535); ++ active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000, ++ (u32)mode->clock); ++ line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000, ++ (u32)mode->clock); ++ line_time = min(line_time, (u32)65535); + + /* watermark for high clocks */ + if (adev->pm.dpm_enabled) { diff --git a/queue-4.11/drm-i915-do-not-sync-rcu-during-shrinking.patch b/queue-4.11/drm-i915-do-not-sync-rcu-during-shrinking.patch new file mode 100644 index 00000000000..9761d3ab66e --- /dev/null +++ b/queue-4.11/drm-i915-do-not-sync-rcu-during-shrinking.patch @@ -0,0 +1,74 @@ +From 4681ee21d62cfed4364e09ec50ee8e88185dd628 Mon Sep 17 00:00:00 2001 +From: Joonas Lahtinen +Date: Thu, 18 May 2017 11:49:39 +0300 +Subject: drm/i915: Do not sync RCU during shrinking + +From: Joonas Lahtinen + +commit 4681ee21d62cfed4364e09ec50ee8e88185dd628 upstream. + +Due to the complex dependencies between workqueues and RCU, which +are not easily detected by lockdep, do not synchronize RCU during +shrinking. + +On low-on-memory systems (mem=1G for example), the RCU sync leads +to all system workqueus freezing and unrelated lockdep splats are +displayed according to reports. GIT bisecting done by J. R. +Okajima points to the commit where RCU syncing was extended. + +RCU sync gains us very little benefit in real life scenarios +where the amount of memory used by object backing storage is +dominant over the metadata under RCU, so drop it altogether. + + " Yeeeaah, if core could just, go ahead and reclaim RCU + queues, that'd be great. " + + - Chris Wilson, 2016 (0eafec6d3244) + +v2: More information to commit message. +v3: Remove "grep _rcu_" escapee from i915_gem_shrink_all (Andrea) + +Fixes: c053b5a506d3 ("drm/i915: Don't call synchronize_rcu_expedited under struct_mutex") +Suggested-by: Chris Wilson +Reported-by: J. R. Okajima +Signed-off-by: Joonas Lahtinen +Reviewed-by: Chris Wilson +Tested-by: Hugh Dickins +Tested-by: Andrea Arcangeli +Cc: Chris Wilson +Cc: Tvrtko Ursulin +Cc: J. R. Okajima +Cc: Andrea Arcangeli +Cc: Hugh Dickins +Cc: Jani Nikula +(cherry picked from commit 73cc0b9aa9afa5ba65d92e46ded61d29430d72a4) +Signed-off-by: Jani Nikula +Link: http://patchwork.freedesktop.org/patch/msgid/1495097379-573-1-git-send-email-joonas.lahtinen@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/gpu/drm/i915/i915_gem_shrinker.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_gem_shrinker.c ++++ b/drivers/gpu/drm/i915/i915_gem_shrinker.c +@@ -59,9 +59,6 @@ static void i915_gem_shrinker_unlock(str + return; + + mutex_unlock(&dev->struct_mutex); +- +- /* expedite the RCU grace period to free some request slabs */ +- synchronize_rcu_expedited(); + } + + static bool any_vma_pinned(struct drm_i915_gem_object *obj) +@@ -271,8 +268,6 @@ unsigned long i915_gem_shrink_all(struct + I915_SHRINK_BOUND | + I915_SHRINK_UNBOUND | + I915_SHRINK_ACTIVE); +- synchronize_rcu(); /* wait for our earlier RCU delayed slab frees */ +- + return freed; + } + diff --git a/queue-4.11/drm-i915-fix-gvt-g-pvinfo-version-compatibility-check.patch b/queue-4.11/drm-i915-fix-gvt-g-pvinfo-version-compatibility-check.patch new file mode 100644 index 00000000000..1c0c74aecfc --- /dev/null +++ b/queue-4.11/drm-i915-fix-gvt-g-pvinfo-version-compatibility-check.patch @@ -0,0 +1,89 @@ +From c380f681245d7ae57f17d9ebbbe8f8f1557ee1fb Mon Sep 17 00:00:00 2001 +From: Zhenyu Wang +Date: Fri, 9 Jun 2017 15:48:05 +0800 +Subject: drm/i915: Fix GVT-g PVINFO version compatibility check + +From: Zhenyu Wang + +commit c380f681245d7ae57f17d9ebbbe8f8f1557ee1fb upstream. + +Current it's strictly checked if PVINFO version matches 1.0 +for GVT-g i915 guest which doesn't help for compatibility at +all and forces GVT-g host can't extend PVINFO easily with version +bump for real compatibility check. + +This fixes that to check minimal required PVINFO version instead. + +v2: +- drop unneeded version macro +- use only major version for sanity check + +v3: +- fix up PVInfo value with kernel type +- one indent fix + +Reviewed-by: Joonas Lahtinen +Cc: Chuanxiao Dong +Cc: Joonas Lahtinen +Signed-off-by: Zhenyu Wang +Signed-off-by: Joonas Lahtinen +Link: http://patchwork.freedesktop.org/patch/msgid/20170609074805.5101-1-zhenyuw@linux.intel.com +(cherry picked from commit 0c8792d00d38de85b6ceb1dd67d3ee009d7c8e42) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_pvinfo.h | 8 ++------ + drivers/gpu/drm/i915/i915_vgpu.c | 10 ++++------ + 2 files changed, 6 insertions(+), 12 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_pvinfo.h ++++ b/drivers/gpu/drm/i915/i915_pvinfo.h +@@ -36,10 +36,6 @@ + #define VGT_VERSION_MAJOR 1 + #define VGT_VERSION_MINOR 0 + +-#define INTEL_VGT_IF_VERSION_ENCODE(major, minor) ((major) << 16 | (minor)) +-#define INTEL_VGT_IF_VERSION \ +- INTEL_VGT_IF_VERSION_ENCODE(VGT_VERSION_MAJOR, VGT_VERSION_MINOR) +- + /* + * notifications from guest to vgpu device model + */ +@@ -55,8 +51,8 @@ enum vgt_g2v_type { + + struct vgt_if { + u64 magic; /* VGT_MAGIC */ +- uint16_t version_major; +- uint16_t version_minor; ++ u16 version_major; ++ u16 version_minor; + u32 vgt_id; /* ID of vGT instance */ + u32 rsv1[12]; /* pad to offset 0x40 */ + /* +--- a/drivers/gpu/drm/i915/i915_vgpu.c ++++ b/drivers/gpu/drm/i915/i915_vgpu.c +@@ -60,8 +60,8 @@ + */ + void i915_check_vgpu(struct drm_i915_private *dev_priv) + { +- uint64_t magic; +- uint32_t version; ++ u64 magic; ++ u16 version_major; + + BUILD_BUG_ON(sizeof(struct vgt_if) != VGT_PVINFO_SIZE); + +@@ -69,10 +69,8 @@ void i915_check_vgpu(struct drm_i915_pri + if (magic != VGT_MAGIC) + return; + +- version = INTEL_VGT_IF_VERSION_ENCODE( +- __raw_i915_read16(dev_priv, vgtif_reg(version_major)), +- __raw_i915_read16(dev_priv, vgtif_reg(version_minor))); +- if (version != INTEL_VGT_IF_VERSION) { ++ version_major = __raw_i915_read16(dev_priv, vgtif_reg(version_major)); ++ if (version_major < VGT_VERSION_MAJOR) { + DRM_INFO("VGT interface version mismatch!\n"); + return; + } diff --git a/queue-4.11/drm-i915-fix-scaling-check-for-90-270-degree-plane-rotation.patch b/queue-4.11/drm-i915-fix-scaling-check-for-90-270-degree-plane-rotation.patch new file mode 100644 index 00000000000..837945c85b6 --- /dev/null +++ b/queue-4.11/drm-i915-fix-scaling-check-for-90-270-degree-plane-rotation.patch @@ -0,0 +1,84 @@ +From 9a775e0308b575e3a17c66a586ed049b07f48199 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Thu, 8 Jun 2017 17:40:01 +0300 +Subject: drm/i915: Fix scaling check for 90/270 degree plane rotation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 9a775e0308b575e3a17c66a586ed049b07f48199 upstream. + +Starting from commit b63a16f6cd89 ("drm/i915: Compute display surface +offset in the plane check hook for SKL+") we've already rotated the src +coordinates by 270 degrees by the time we check if a scaler is needed +or not, so we must not account for the rotation a second time. +Previously we did these steps in the opposite order and hence the +scaler check had to deal with rotation itself. The double rotation +handling causes us to enable a scaler pretty much every time 90/270 +degree plane rotation is requested, leading to fuzzier fonts and whatnot. + +v2: s/unsigned/unsigned int/ to appease checkpatch +v3: s/DRM_ROTATE_0/DRM_MODE_ROTATE_0/ + +Cc: Tvrtko Ursulin +Reported-by: Tvrtko Ursulin +Tested-by: Tvrtko Ursulin +Fixes: b63a16f6cd89 ("drm/i915: Compute display surface offset in the plane check hook for SKL+") +Signed-off-by: Ville Syrjälä +Link: http://patchwork.freedesktop.org/patch/msgid/20170331180056.14086-2-ville.syrjala@linux.intel.com +Reviewed-by: Maarten Lankhorst +(cherry picked from commit d96a7d2adb040a67e163a82dad6316f9f572498a) +Signed-off-by: Jani Nikula +Link: http://patchwork.freedesktop.org/patch/msgid/20170608144002.1605-1-ville.syrjala@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_display.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -4633,7 +4633,7 @@ static void cpt_verify_modeset(struct dr + + static int + skl_update_scaler(struct intel_crtc_state *crtc_state, bool force_detach, +- unsigned scaler_user, int *scaler_id, unsigned int rotation, ++ unsigned int scaler_user, int *scaler_id, + int src_w, int src_h, int dst_w, int dst_h) + { + struct intel_crtc_scaler_state *scaler_state = +@@ -4642,9 +4642,12 @@ skl_update_scaler(struct intel_crtc_stat + to_intel_crtc(crtc_state->base.crtc); + int need_scaling; + +- need_scaling = drm_rotation_90_or_270(rotation) ? +- (src_h != dst_w || src_w != dst_h): +- (src_w != dst_w || src_h != dst_h); ++ /* ++ * Src coordinates are already rotated by 270 degrees for ++ * the 90/270 degree plane rotation cases (to match the ++ * GTT mapping), hence no need to account for rotation here. ++ */ ++ need_scaling = src_w != dst_w || src_h != dst_h; + + /* + * if plane is being disabled or scaler is no more required or force detach +@@ -4706,7 +4709,7 @@ int skl_update_scaler_crtc(struct intel_ + const struct drm_display_mode *adjusted_mode = &state->base.adjusted_mode; + + return skl_update_scaler(state, !state->base.active, SKL_CRTC_INDEX, +- &state->scaler_state.scaler_id, DRM_ROTATE_0, ++ &state->scaler_state.scaler_id, + state->pipe_src_w, state->pipe_src_h, + adjusted_mode->crtc_hdisplay, adjusted_mode->crtc_vdisplay); + } +@@ -4735,7 +4738,6 @@ static int skl_update_scaler_plane(struc + ret = skl_update_scaler(crtc_state, force_detach, + drm_plane_index(&intel_plane->base), + &plane_state->scaler_id, +- plane_state->base.rotation, + drm_rect_width(&plane_state->base.src) >> 16, + drm_rect_height(&plane_state->base.src) >> 16, + drm_rect_width(&plane_state->base.dst), diff --git a/queue-4.11/drm-mediatek-fix-mtk_hdmi_setup_vendor_specific_infoframe-mistake.patch b/queue-4.11/drm-mediatek-fix-mtk_hdmi_setup_vendor_specific_infoframe-mistake.patch new file mode 100644 index 00000000000..029c95883ba --- /dev/null +++ b/queue-4.11/drm-mediatek-fix-mtk_hdmi_setup_vendor_specific_infoframe-mistake.patch @@ -0,0 +1,35 @@ +From 014580ffab654bb83256783a2b185cf6c06dffaa Mon Sep 17 00:00:00 2001 +From: YYS +Date: Tue, 21 Mar 2017 16:27:03 +0800 +Subject: drm/mediatek: fix mtk_hdmi_setup_vendor_specific_infoframe mistake + +From: YYS + +commit 014580ffab654bb83256783a2b185cf6c06dffaa upstream. + +mtk_hdmi_setup_vendor_specific_infoframe will return before handle +mtk_hdmi_hw_send_info_frame.Because hdmi_vendor_infoframe_pack +returns the number of bytes packed into the binary buffer or +a negative error code on failure. +So correct it. + +Fixes: 8f83f26891e1 ("drm/mediatek: Add HDMI support") +Signed-off-by: Nickey Yang +Signed-off-by: CK Hu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/mediatek/mtk_hdmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c ++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c +@@ -1062,7 +1062,7 @@ static int mtk_hdmi_setup_vendor_specifi + } + + err = hdmi_vendor_infoframe_pack(&frame, buffer, sizeof(buffer)); +- if (err) { ++ if (err < 0) { + dev_err(hdmi->dev, "Failed to pack vendor infoframe: %zd\n", + err); + return err; diff --git a/queue-4.11/drm-mxsfb_crtc-reset-the-elcdif-controller.patch b/queue-4.11/drm-mxsfb_crtc-reset-the-elcdif-controller.patch new file mode 100644 index 00000000000..a1f79c4c116 --- /dev/null +++ b/queue-4.11/drm-mxsfb_crtc-reset-the-elcdif-controller.patch @@ -0,0 +1,98 @@ +From 0f933328f018c118ded2035f12068bbdfdef399d Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Fri, 5 May 2017 15:01:41 -0300 +Subject: drm: mxsfb_crtc: Reset the eLCDIF controller + +From: Fabio Estevam + +commit 0f933328f018c118ded2035f12068bbdfdef399d upstream. + +According to the eLCDIF initialization steps listed in the MX6SX +Reference Manual the eLCDIF block reset is mandatory. + +Without performing the eLCDIF reset the display shows garbage content +when the kernel boots. + +In earlier tests this issue has not been observed because the bootloader +was previously showing a splash screen and the bootloader display driver +does properly implement the eLCDIF reset. + +Add the eLCDIF reset to the driver, so that it can operate correctly +independently of the bootloader. + +Tested on a imx6sx-sdb board. + +Signed-off-by: Fabio Estevam +Signed-off-by: Sean Paul +Link: http://patchwork.freedesktop.org/patch/msgid/1494007301-14535-1-git-send-email-fabio.estevam@nxp.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/mxsfb/mxsfb_crtc.c | 42 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 42 insertions(+) + +--- a/drivers/gpu/drm/mxsfb/mxsfb_crtc.c ++++ b/drivers/gpu/drm/mxsfb/mxsfb_crtc.c +@@ -35,6 +35,13 @@ + #include "mxsfb_drv.h" + #include "mxsfb_regs.h" + ++#define MXS_SET_ADDR 0x4 ++#define MXS_CLR_ADDR 0x8 ++#define MODULE_CLKGATE BIT(30) ++#define MODULE_SFTRST BIT(31) ++/* 1 second delay should be plenty of time for block reset */ ++#define RESET_TIMEOUT 1000000 ++ + static u32 set_hsync_pulse_width(struct mxsfb_drm_private *mxsfb, u32 val) + { + return (val & mxsfb->devdata->hs_wdth_mask) << +@@ -159,6 +166,36 @@ static void mxsfb_disable_controller(str + clk_disable_unprepare(mxsfb->clk_disp_axi); + } + ++/* ++ * Clear the bit and poll it cleared. This is usually called with ++ * a reset address and mask being either SFTRST(bit 31) or CLKGATE ++ * (bit 30). ++ */ ++static int clear_poll_bit(void __iomem *addr, u32 mask) ++{ ++ u32 reg; ++ ++ writel(mask, addr + MXS_CLR_ADDR); ++ return readl_poll_timeout(addr, reg, !(reg & mask), 0, RESET_TIMEOUT); ++} ++ ++static int mxsfb_reset_block(void __iomem *reset_addr) ++{ ++ int ret; ++ ++ ret = clear_poll_bit(reset_addr, MODULE_SFTRST); ++ if (ret) ++ return ret; ++ ++ writel(MODULE_CLKGATE, reset_addr + MXS_CLR_ADDR); ++ ++ ret = clear_poll_bit(reset_addr, MODULE_SFTRST); ++ if (ret) ++ return ret; ++ ++ return clear_poll_bit(reset_addr, MODULE_CLKGATE); ++} ++ + static void mxsfb_crtc_mode_set_nofb(struct mxsfb_drm_private *mxsfb) + { + struct drm_display_mode *m = &mxsfb->pipe.crtc.state->adjusted_mode; +@@ -173,6 +210,11 @@ static void mxsfb_crtc_mode_set_nofb(str + */ + mxsfb_enable_axi_clk(mxsfb); + ++ /* Mandatory eLCDIF reset as per the Reference Manual */ ++ err = mxsfb_reset_block(mxsfb->base); ++ if (err) ++ return; ++ + /* Clear the FIFOs */ + writel(CTRL1_FIFO_CLEAR, mxsfb->base + LCDC_CTRL1 + REG_SET); + diff --git a/queue-4.11/drm-vc4-fix-oopses-from-trying-to-cache-a-partially-constructed-bo.patch b/queue-4.11/drm-vc4-fix-oopses-from-trying-to-cache-a-partially-constructed-bo.patch new file mode 100644 index 00000000000..b538de2333d --- /dev/null +++ b/queue-4.11/drm-vc4-fix-oopses-from-trying-to-cache-a-partially-constructed-bo.patch @@ -0,0 +1,41 @@ +From ca39b449f6d03e8235969f12f5dd25b8eb4304d6 Mon Sep 17 00:00:00 2001 +From: Eric Anholt +Date: Wed, 1 Mar 2017 10:56:02 -0800 +Subject: drm/vc4: Fix OOPSes from trying to cache a partially constructed BO. + +From: Eric Anholt + +commit ca39b449f6d03e8235969f12f5dd25b8eb4304d6 upstream. + +If a CMA allocation failed, the partially constructed BO would be +unreferenced through the normal path, and we might choose to put it in +the BO cache. If we then reused it before it expired from the cache, +the kernel would OOPS. + +Signed-off-by: Eric Anholt +Fixes: c826a6e10644 ("drm/vc4: Add a BO cache.") +Reviewed-by: Boris Brezillon +Link: http://patchwork.freedesktop.org/patch/msgid/20170301185602.6873-2-eric@anholt.net +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vc4/vc4_bo.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/gpu/drm/vc4/vc4_bo.c ++++ b/drivers/gpu/drm/vc4/vc4_bo.c +@@ -313,6 +313,14 @@ void vc4_free_object(struct drm_gem_obje + goto out; + } + ++ /* If this object was partially constructed but CMA allocation ++ * had failed, just free it. ++ */ ++ if (!bo->base.vaddr) { ++ vc4_bo_destroy(bo); ++ goto out; ++ } ++ + cache_list = vc4_get_cache_list_for_size(dev, gem_bo->size); + if (!cache_list) { + vc4_bo_destroy(bo); diff --git a/queue-4.11/dt-bindings-mfd-axp20x-add-xpowers-master-mode-property-for-axp806-pmics.patch b/queue-4.11/dt-bindings-mfd-axp20x-add-xpowers-master-mode-property-for-axp806-pmics.patch new file mode 100644 index 00000000000..ed0185a5fe6 --- /dev/null +++ b/queue-4.11/dt-bindings-mfd-axp20x-add-xpowers-master-mode-property-for-axp806-pmics.patch @@ -0,0 +1,38 @@ +From 8461cf20d17e0090e9236b73d25b31be4f7fadc5 Mon Sep 17 00:00:00 2001 +From: Rask Ingemann Lambertsen +Date: Wed, 22 Feb 2017 20:41:02 +0100 +Subject: dt-bindings: mfd: axp20x: Add "xpowers,master-mode" property for AXP806 PMICs + +From: Rask Ingemann Lambertsen + +commit 8461cf20d17e0090e9236b73d25b31be4f7fadc5 upstream. + +commit b101829a029a ("mfd: axp20x: Fix AXP806 access errors on cold boot") +was intended to fix the case where a board uses an AXP806 in slave mode, +but the boot loader leaves it in master mode for lack of AXP806 support. +But now the driver breaks on boards where the PMIC is operating in master +mode. To let the device tree describe which mode of operation is needed, +this patch introduces a new property "xpowers,master-mode". + +Fixes: 204ae2963e10 ("mfd: axp20x: Add bindings for AXP806 PMIC") +Signed-off-by: Rask Ingemann Lambertsen +Acked-by: Chen-Yu Tsai +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/devicetree/bindings/mfd/axp20x.txt | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/Documentation/devicetree/bindings/mfd/axp20x.txt ++++ b/Documentation/devicetree/bindings/mfd/axp20x.txt +@@ -28,6 +28,9 @@ Optional properties: + regulator to drive the OTG VBus, rather then as an input pin + which signals whether the board is driving OTG VBus or not. + ++- x-powers,master-mode: Boolean (axp806 only). Set this when the PMIC is ++ wired for master mode. The default is slave mode. ++ + - -supply: a phandle to the regulator supply node. May be omitted if + inputs are unregulated, such as using the IPSOUT output + from the PMIC. diff --git a/queue-4.11/fs-pass-on-flags-in-compat_writev.patch b/queue-4.11/fs-pass-on-flags-in-compat_writev.patch new file mode 100644 index 00000000000..206461bb251 --- /dev/null +++ b/queue-4.11/fs-pass-on-flags-in-compat_writev.patch @@ -0,0 +1,29 @@ +From 20223f0f39ea9d31ece08f04ac79f8c4e8d98246 Mon Sep 17 00:00:00 2001 +From: Christoph Hellwig +Date: Fri, 16 Jun 2017 11:08:24 +0200 +Subject: fs: pass on flags in compat_writev + +From: Christoph Hellwig + +commit 20223f0f39ea9d31ece08f04ac79f8c4e8d98246 upstream. + +Fixes: 793b80ef14af ("vfs: pass a flags argument to vfs_readv/vfs_writev") +Signed-off-by: Christoph Hellwig +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/read_write.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/read_write.c ++++ b/fs/read_write.c +@@ -1210,7 +1210,7 @@ static size_t compat_writev(struct file + if (!(file->f_mode & FMODE_CAN_WRITE)) + goto out; + +- ret = compat_do_readv_writev(WRITE, file, vec, vlen, pos, 0); ++ ret = compat_do_readv_writev(WRITE, file, vec, vlen, pos, flags); + + out: + if (ret > 0) diff --git a/queue-4.11/iio-adc-ti_am335x_adc-allocating-too-much-in-probe.patch b/queue-4.11/iio-adc-ti_am335x_adc-allocating-too-much-in-probe.patch new file mode 100644 index 00000000000..261b6e3959e --- /dev/null +++ b/queue-4.11/iio-adc-ti_am335x_adc-allocating-too-much-in-probe.patch @@ -0,0 +1,33 @@ +From 5ba5b437efaa7a502eec393c045d3bf90c92c4e9 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 10 May 2017 08:51:09 +0300 +Subject: iio: adc: ti_am335x_adc: allocating too much in probe + +From: Dan Carpenter + +commit 5ba5b437efaa7a502eec393c045d3bf90c92c4e9 upstream. + +We should be allocating enough information for a tiadc_device struct +which is about 400 bytes but instead we allocate enough for a second +iio_dev struct which is over 2000 bytes. + +Fixes: fea89e2dfcea ("iio: adc: ti_am335x_adc: use variable names for sizeof() operator") +Signed-off-by: Dan Carpenter +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/ti_am335x_adc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/ti_am335x_adc.c ++++ b/drivers/iio/adc/ti_am335x_adc.c +@@ -614,7 +614,7 @@ static int tiadc_probe(struct platform_d + return -EINVAL; + } + +- indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*indio_dev)); ++ indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*adc_dev)); + if (indio_dev == NULL) { + dev_err(&pdev->dev, "failed to allocate iio device\n"); + return -ENOMEM; diff --git a/queue-4.11/iio-imu-st_lsm6dsx-do-not-apply-odr-configuration-in-write_raw-handler.patch b/queue-4.11/iio-imu-st_lsm6dsx-do-not-apply-odr-configuration-in-write_raw-handler.patch new file mode 100644 index 00000000000..9621dfe0d5d --- /dev/null +++ b/queue-4.11/iio-imu-st_lsm6dsx-do-not-apply-odr-configuration-in-write_raw-handler.patch @@ -0,0 +1,99 @@ +From 2ccc15036d812e75f334c0fb813104ef765a2c77 Mon Sep 17 00:00:00 2001 +From: Lorenzo Bianconi +Date: Sun, 2 Apr 2017 14:58:45 +0200 +Subject: iio: imu: st_lsm6dsx: do not apply ODR configuration in write_raw handler + +From: Lorenzo Bianconi + +commit 2ccc15036d812e75f334c0fb813104ef765a2c77 upstream. + +This patch allows to avoid a transitory that occurs when a given sensor +has been already enabled (e.g. gyroscope) and the user is configuring +the sample frequency of the other one (e.g. accelerometer). +The transitory lasts until the accelerometer is enabled. +During that time slice the gyroscope ODR is incorrectly modified as well. +At the end of the transitory both sensors work at the right frequency. +Fix it introducing st_lsm6dsx_check_odr() routine to check ODR consistency +in write_raw handler in order to apply frequency configuration just +in st_lsm6dsx_set_odr() + +Fixes: 290a6ce11d93 (iio: imu: add support to lsm6dsx driver) +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 41 +++++++++++++++++---------- + 1 file changed, 26 insertions(+), 15 deletions(-) + +--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c ++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +@@ -298,32 +298,40 @@ static int st_lsm6dsx_set_full_scale(str + return 0; + } + +-static int st_lsm6dsx_set_odr(struct st_lsm6dsx_sensor *sensor, u16 odr) ++static int st_lsm6dsx_check_odr(struct st_lsm6dsx_sensor *sensor, u16 odr, ++ u8 *val) + { +- enum st_lsm6dsx_sensor_id id = sensor->id; +- int i, err; +- u8 val; ++ int i; + + for (i = 0; i < ST_LSM6DSX_ODR_LIST_SIZE; i++) +- if (st_lsm6dsx_odr_table[id].odr_avl[i].hz == odr) ++ if (st_lsm6dsx_odr_table[sensor->id].odr_avl[i].hz == odr) + break; + + if (i == ST_LSM6DSX_ODR_LIST_SIZE) + return -EINVAL; + +- val = st_lsm6dsx_odr_table[id].odr_avl[i].val; +- err = st_lsm6dsx_write_with_mask(sensor->hw, +- st_lsm6dsx_odr_table[id].reg.addr, +- st_lsm6dsx_odr_table[id].reg.mask, +- val); +- if (err < 0) +- return err; +- ++ *val = st_lsm6dsx_odr_table[sensor->id].odr_avl[i].val; + sensor->odr = odr; + + return 0; + } + ++static int st_lsm6dsx_set_odr(struct st_lsm6dsx_sensor *sensor, u16 odr) ++{ ++ enum st_lsm6dsx_sensor_id id = sensor->id; ++ int err; ++ u8 val; ++ ++ err = st_lsm6dsx_check_odr(sensor, odr, &val); ++ if (err < 0) ++ return err; ++ ++ return st_lsm6dsx_write_with_mask(sensor->hw, ++ st_lsm6dsx_odr_table[id].reg.addr, ++ st_lsm6dsx_odr_table[id].reg.mask, ++ val); ++} ++ + int st_lsm6dsx_sensor_enable(struct st_lsm6dsx_sensor *sensor) + { + int err; +@@ -426,9 +434,12 @@ static int st_lsm6dsx_write_raw(struct i + case IIO_CHAN_INFO_SCALE: + err = st_lsm6dsx_set_full_scale(sensor, val2); + break; +- case IIO_CHAN_INFO_SAMP_FREQ: +- err = st_lsm6dsx_set_odr(sensor, val); ++ case IIO_CHAN_INFO_SAMP_FREQ: { ++ u8 data; ++ ++ err = st_lsm6dsx_check_odr(sensor, val, &data); + break; ++ } + default: + err = -EINVAL; + break; diff --git a/queue-4.11/iio-proximity-as3935-recalibrate-rco-after-resume.patch b/queue-4.11/iio-proximity-as3935-recalibrate-rco-after-resume.patch new file mode 100644 index 00000000000..89b9622c2ec --- /dev/null +++ b/queue-4.11/iio-proximity-as3935-recalibrate-rco-after-resume.patch @@ -0,0 +1,53 @@ +From 6272c0de13abf1480f701d38288f28a11b4301c4 Mon Sep 17 00:00:00 2001 +From: Matt Ranostay +Date: Fri, 14 Apr 2017 16:38:19 -0700 +Subject: iio: proximity: as3935: recalibrate RCO after resume + +From: Matt Ranostay + +commit 6272c0de13abf1480f701d38288f28a11b4301c4 upstream. + +According to the datasheet the RCO must be recalibrated +on every power-on-reset. Also remove mutex locking in the +calibration function since callers other than the probe +function (which doesn't need it) will have a lock. + +Fixes: 24ddb0e4bba4 ("iio: Add AS3935 lightning sensor support") +Cc: George McCollister +Signed-off-by: Matt Ranostay +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/proximity/as3935.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/iio/proximity/as3935.c ++++ b/drivers/iio/proximity/as3935.c +@@ -269,8 +269,6 @@ static irqreturn_t as3935_interrupt_hand + + static void calibrate_as3935(struct as3935_state *st) + { +- mutex_lock(&st->lock); +- + /* mask disturber interrupt bit */ + as3935_write(st, AS3935_INT, BIT(5)); + +@@ -280,8 +278,6 @@ static void calibrate_as3935(struct as39 + + mdelay(2); + as3935_write(st, AS3935_TUNE_CAP, (st->tune_cap / TUNE_CAP_DIV)); +- +- mutex_unlock(&st->lock); + } + + #ifdef CONFIG_PM_SLEEP +@@ -318,6 +314,8 @@ static int as3935_resume(struct device * + val &= ~AS3935_AFE_PWR_BIT; + ret = as3935_write(st, AS3935_AFE_GAIN, val); + ++ calibrate_as3935(st); ++ + err_resume: + mutex_unlock(&st->lock); + diff --git a/queue-4.11/ila_xlat-add-missing-hash-secret-initialization.patch b/queue-4.11/ila_xlat-add-missing-hash-secret-initialization.patch new file mode 100644 index 00000000000..96ddd5b8306 --- /dev/null +++ b/queue-4.11/ila_xlat-add-missing-hash-secret-initialization.patch @@ -0,0 +1,45 @@ +From 0db47e3d323411beeb6ea97f2c4d19395c91fd8b Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Thu, 8 Jun 2017 09:54:24 +0200 +Subject: ila_xlat: add missing hash secret initialization + +From: Arnd Bergmann + +commit 0db47e3d323411beeb6ea97f2c4d19395c91fd8b upstream. + +While discussing the possible merits of clang warning about unused initialized +functions, I found one function that was clearly meant to be called but +never actually is. + +__ila_hash_secret_init() initializes the hash value for the ila locator, +apparently this is intended to prevent hash collision attacks, but this ends +up being a read-only zero constant since there is no caller. I could find +no indication of why it was never called, the earliest patch submission +for the module already was like this. If my interpretation is right, we +certainly want to backport the patch to stable kernels as well. + +I considered adding it to the ila_xlat_init callback, but for best effect +the random data is read as late as possible, just before it is first used. +The underlying net_get_random_once() is already highly optimized to avoid +overhead when called frequently. + +Fixes: 7f00feaf1076 ("ila: Add generic ILA translation facility") +Link: https://www.spinics.net/lists/kernel/msg2527243.html +Signed-off-by: Arnd Bergmann +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv6/ila/ila_xlat.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/ipv6/ila/ila_xlat.c ++++ b/net/ipv6/ila/ila_xlat.c +@@ -68,6 +68,7 @@ static inline u32 ila_locator_hash(struc + { + u32 *v = (u32 *)loc.v32; + ++ __ila_hash_secret_init(); + return jhash_2words(v[0], v[1], hashrnd); + } + diff --git a/queue-4.11/mac80211-don-t-look-at-the-pm-bit-of-bar-frames.patch b/queue-4.11/mac80211-don-t-look-at-the-pm-bit-of-bar-frames.patch new file mode 100644 index 00000000000..dc48d14ad43 --- /dev/null +++ b/queue-4.11/mac80211-don-t-look-at-the-pm-bit-of-bar-frames.patch @@ -0,0 +1,41 @@ +From 769dc04db3ed8484798aceb015b94deacc2ba557 Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Thu, 8 Jun 2017 14:00:49 +0300 +Subject: mac80211: don't look at the PM bit of BAR frames + +From: Emmanuel Grumbach + +commit 769dc04db3ed8484798aceb015b94deacc2ba557 upstream. + +When a peer sends a BAR frame with PM bit clear, we should +not modify its PM state as madated by the spec in +802.11-20012 10.2.1.2. + +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/rx.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -1587,12 +1587,16 @@ ieee80211_rx_h_sta_process(struct ieee80 + */ + if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) && + !ieee80211_has_morefrags(hdr->frame_control) && ++ !ieee80211_is_back_req(hdr->frame_control) && + !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) && + (rx->sdata->vif.type == NL80211_IFTYPE_AP || + rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) && +- /* PM bit is only checked in frames where it isn't reserved, ++ /* ++ * PM bit is only checked in frames where it isn't reserved, + * in AP mode it's reserved in non-bufferable management frames + * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field) ++ * BAR frames should be ignored as specified in ++ * IEEE 802.11-2012 10.2.1.2. + */ + (!ieee80211_is_mgmt(hdr->frame_control) || + ieee80211_is_bufferable_mmpdu(hdr->frame_control))) { diff --git a/queue-4.11/mac80211-don-t-send-smps-action-frame-in-ap-mode-when-not-needed.patch b/queue-4.11/mac80211-don-t-send-smps-action-frame-in-ap-mode-when-not-needed.patch new file mode 100644 index 00000000000..069cb5b6270 --- /dev/null +++ b/queue-4.11/mac80211-don-t-send-smps-action-frame-in-ap-mode-when-not-needed.patch @@ -0,0 +1,60 @@ +From b3dd8279659f14f3624bb32559782d699fa6f7d1 Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Sat, 10 Jun 2017 13:52:45 +0300 +Subject: mac80211: don't send SMPS action frame in AP mode when not needed + +From: Emmanuel Grumbach + +commit b3dd8279659f14f3624bb32559782d699fa6f7d1 upstream. + +mac80211 allows to modify the SMPS state of an AP both, +when it is started, and after it has been started. Such a +change will trigger an action frame to all the peers that +are currently connected, and will be remembered so that +new peers will get notified as soon as they connect (since +the SMPS setting in the beacon may not be the right one). + +This means that we need to remember the SMPS state +currently requested as well as the SMPS state that was +configured initially (and advertised in the beacon). +The former is bss->req_smps and the latter is +sdata->smps_mode. + +Initially, the AP interface could only be started with +SMPS_OFF, which means that sdata->smps_mode was SMPS_OFF +always. Later, a nl80211 API was added to be able to start +an AP with a different AP mode. That code forgot to update +bss->req_smps and because of that, if the AP interface was +started with SMPS_DYNAMIC, we had: + sdata->smps_mode = SMPS_DYNAMIC + bss->req_smps = SMPS_OFF + +That configuration made mac80211 think it needs to fire off +an action frame to any new station connecting to the AP in +order to let it know that the actual SMPS configuration is +SMPS_OFF. + +Fix that by properly setting bss->req_smps in +ieee80211_start_ap. + +Fixes: f69931748730 ("mac80211: set smps_mode according to ap params") +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Luca Coelho +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/cfg.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -862,6 +862,8 @@ static int ieee80211_start_ap(struct wip + default: + return -EINVAL; + } ++ sdata->u.ap.req_smps = sdata->smps_mode; ++ + sdata->needed_rx_chains = sdata->local->rx_chains; + + sdata->vif.bss_conf.beacon_int = params->beacon_interval; diff --git a/queue-4.11/mac80211-fix-dropped-counter-in-multiqueue-rx.patch b/queue-4.11/mac80211-fix-dropped-counter-in-multiqueue-rx.patch new file mode 100644 index 00000000000..20a1c046fb5 --- /dev/null +++ b/queue-4.11/mac80211-fix-dropped-counter-in-multiqueue-rx.patch @@ -0,0 +1,35 @@ +From e165bc02a02c70e40d5c811c705ba269aeca0497 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Thu, 1 Jun 2017 21:26:03 +0200 +Subject: mac80211: fix dropped counter in multiqueue RX + +From: Johannes Berg + +commit e165bc02a02c70e40d5c811c705ba269aeca0497 upstream. + +In the commit enabling per-CPU station statistics, I inadvertedly +copy-pasted some code to update rx_packets and forgot to change it +to update rx_dropped_misc. Fix that. + +This addresses https://bugzilla.kernel.org/show_bug.cgi?id=195953. + +Fixes: c9c5962b56c1 ("mac80211: enable collecting station statistics per-CPU") +Reported-by: Petru-Florin Mihancea +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/sta_info.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -2143,7 +2143,7 @@ void sta_set_sinfo(struct sta_info *sta, + struct ieee80211_sta_rx_stats *cpurxs; + + cpurxs = per_cpu_ptr(sta->pcpu_rx_stats, cpu); +- sinfo->rx_packets += cpurxs->dropped; ++ sinfo->rx_dropped_misc += cpurxs->dropped; + } + } + diff --git a/queue-4.11/mac80211-fix-ibss-presp-allocation-size.patch b/queue-4.11/mac80211-fix-ibss-presp-allocation-size.patch new file mode 100644 index 00000000000..df0b01bcc4c --- /dev/null +++ b/queue-4.11/mac80211-fix-ibss-presp-allocation-size.patch @@ -0,0 +1,34 @@ +From f1f3e9e2a50a70de908f9dfe0d870e9cdc67e042 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Thu, 27 Apr 2017 13:19:04 +0200 +Subject: mac80211: fix IBSS presp allocation size + +From: Johannes Berg + +commit f1f3e9e2a50a70de908f9dfe0d870e9cdc67e042 upstream. + +When VHT IBSS support was added, the size of the extra elements +wasn't considered in ieee80211_ibss_build_presp(), which makes +it possible that it would overrun the allocated buffer. Fix it +by allocating the necessary space. + +Fixes: abcff6ef01f9 ("mac80211: add VHT support for IBSS") +Reported-by: Shaul Triebitz +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/ibss.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/mac80211/ibss.c ++++ b/net/mac80211/ibss.c +@@ -66,6 +66,8 @@ ieee80211_ibss_build_presp(struct ieee80 + 2 + (IEEE80211_MAX_SUPP_RATES - 8) + + 2 + sizeof(struct ieee80211_ht_cap) + + 2 + sizeof(struct ieee80211_ht_operation) + ++ 2 + sizeof(struct ieee80211_vht_cap) + ++ 2 + sizeof(struct ieee80211_vht_operation) + + ifibss->ie_len; + presp = kzalloc(sizeof(*presp) + frame_len, GFP_KERNEL); + if (!presp) diff --git a/queue-4.11/mac80211-strictly-check-mesh-address-extension-mode.patch b/queue-4.11/mac80211-strictly-check-mesh-address-extension-mode.patch new file mode 100644 index 00000000000..40823c38096 --- /dev/null +++ b/queue-4.11/mac80211-strictly-check-mesh-address-extension-mode.patch @@ -0,0 +1,77 @@ +From 5667c86acf021e6dcf02584408b4484a273ac68f Mon Sep 17 00:00:00 2001 +From: Rajkumar Manoharan +Date: Sun, 14 May 2017 21:41:55 -0700 +Subject: mac80211: strictly check mesh address extension mode + +From: Rajkumar Manoharan + +commit 5667c86acf021e6dcf02584408b4484a273ac68f upstream. + +Mesh forwarding path checks for address extension mode to fetch +appropriate proxied address and MPP address. Existing condition +that looks for 6 address format is not strict enough so that +frames with improper values are processed and invalid entries +are added into MPP table. Fix that by adding a stricter check before +processing the packet. + +Per IEEE Std 802.11s-2011 spec. Table 7-6g1 lists address extension +mode 0x3 as reserved one. And also Table Table 9-13 does not specify +0x3 as valid address field. + +Fixes: 9b395bc3be1c ("mac80211: verify that skb data is present") +Signed-off-by: Rajkumar Manoharan +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/rx.c | 3 ++- + net/wireless/util.c | 10 ++++++---- + 2 files changed, 8 insertions(+), 5 deletions(-) + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2470,7 +2470,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80 + if (is_multicast_ether_addr(hdr->addr1)) { + mpp_addr = hdr->addr3; + proxied_addr = mesh_hdr->eaddr1; +- } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) { ++ } else if ((mesh_hdr->flags & MESH_FLAGS_AE) == ++ MESH_FLAGS_AE_A5_A6) { + /* has_a4 already checked in ieee80211_rx_mesh_check */ + mpp_addr = hdr->addr4; + proxied_addr = mesh_hdr->eaddr2; +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -454,6 +454,8 @@ int ieee80211_data_to_8023_exthdr(struct + if (iftype == NL80211_IFTYPE_MESH_POINT) + skb_copy_bits(skb, hdrlen, &mesh_flags, 1); + ++ mesh_flags &= MESH_FLAGS_AE; ++ + switch (hdr->frame_control & + cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) { + case cpu_to_le16(IEEE80211_FCTL_TODS): +@@ -469,9 +471,9 @@ int ieee80211_data_to_8023_exthdr(struct + iftype != NL80211_IFTYPE_STATION)) + return -1; + if (iftype == NL80211_IFTYPE_MESH_POINT) { +- if (mesh_flags & MESH_FLAGS_AE_A4) ++ if (mesh_flags == MESH_FLAGS_AE_A4) + return -1; +- if (mesh_flags & MESH_FLAGS_AE_A5_A6) { ++ if (mesh_flags == MESH_FLAGS_AE_A5_A6) { + skb_copy_bits(skb, hdrlen + + offsetof(struct ieee80211s_hdr, eaddr1), + tmp.h_dest, 2 * ETH_ALEN); +@@ -487,9 +489,9 @@ int ieee80211_data_to_8023_exthdr(struct + ether_addr_equal(tmp.h_source, addr))) + return -1; + if (iftype == NL80211_IFTYPE_MESH_POINT) { +- if (mesh_flags & MESH_FLAGS_AE_A5_A6) ++ if (mesh_flags == MESH_FLAGS_AE_A5_A6) + return -1; +- if (mesh_flags & MESH_FLAGS_AE_A4) ++ if (mesh_flags == MESH_FLAGS_AE_A4) + skb_copy_bits(skb, hdrlen + + offsetof(struct ieee80211s_hdr, eaddr1), + tmp.h_source, ETH_ALEN); diff --git a/queue-4.11/mac80211-wpa-use-constant-time-memory-comparison-for-macs.patch b/queue-4.11/mac80211-wpa-use-constant-time-memory-comparison-for-macs.patch new file mode 100644 index 00000000000..f6902623dcc --- /dev/null +++ b/queue-4.11/mac80211-wpa-use-constant-time-memory-comparison-for-macs.patch @@ -0,0 +1,67 @@ +From 98c67d187db7808b1f3c95f2110dd4392d034182 Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Sat, 10 Jun 2017 04:59:12 +0200 +Subject: mac80211/wpa: use constant time memory comparison for MACs + +From: Jason A. Donenfeld + +commit 98c67d187db7808b1f3c95f2110dd4392d034182 upstream. + +Otherwise, we enable all sorts of forgeries via timing attack. + +Signed-off-by: Jason A. Donenfeld +Cc: Johannes Berg +Cc: linux-wireless@vger.kernel.org +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/wpa.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/net/mac80211/wpa.c ++++ b/net/mac80211/wpa.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + #include "ieee80211_i.h" + #include "michael.h" +@@ -153,7 +154,7 @@ ieee80211_rx_h_michael_mic_verify(struct + data_len = skb->len - hdrlen - MICHAEL_MIC_LEN; + key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY]; + michael_mic(key, hdr, data, data_len, mic); +- if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0) ++ if (crypto_memneq(mic, data + data_len, MICHAEL_MIC_LEN)) + goto mic_fail; + + /* remove Michael MIC from payload */ +@@ -1048,7 +1049,7 @@ ieee80211_crypto_aes_cmac_decrypt(struct + bip_aad(skb, aad); + ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad, + skb->data + 24, skb->len - 24, mic); +- if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) { ++ if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) { + key->u.aes_cmac.icverrors++; + return RX_DROP_UNUSABLE; + } +@@ -1098,7 +1099,7 @@ ieee80211_crypto_aes_cmac_256_decrypt(st + bip_aad(skb, aad); + ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad, + skb->data + 24, skb->len - 24, mic); +- if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) { ++ if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) { + key->u.aes_cmac.icverrors++; + return RX_DROP_UNUSABLE; + } +@@ -1202,7 +1203,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct + if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce, + skb->data + 24, skb->len - 24, + mic) < 0 || +- memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) { ++ crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) { + key->u.aes_gmac.icverrors++; + return RX_DROP_UNUSABLE; + } diff --git a/queue-4.11/mfd-axp20x-add-support-for-dts-property-xpowers-master-mode.patch b/queue-4.11/mfd-axp20x-add-support-for-dts-property-xpowers-master-mode.patch new file mode 100644 index 00000000000..92bebccb321 --- /dev/null +++ b/queue-4.11/mfd-axp20x-add-support-for-dts-property-xpowers-master-mode.patch @@ -0,0 +1,63 @@ +From c0369698e6455c734a772e3acb09cff9a0c8ed9f Mon Sep 17 00:00:00 2001 +From: Rask Ingemann Lambertsen +Date: Wed, 22 Feb 2017 20:42:02 +0100 +Subject: mfd: axp20x: Add support for dts property "xpowers,master-mode" + +From: Rask Ingemann Lambertsen + +commit c0369698e6455c734a772e3acb09cff9a0c8ed9f upstream. + +commit b101829a029a ("mfd: axp20x: Fix AXP806 access errors on cold boot") +was intended to fix the case where a board uses an AXP806 in slave mode, +but the boot loader leaves it in master mode for lack of AXP806 support. +But now the driver breaks on boards where the PMIC is operating in master +mode. This patch lets the driver use the new device tree property +"xpowers,master-mode" to set the correct operating mode for the board. + +Fixes: 8824ee857348 ("mfd: axp20x: Add support for AXP806 PMIC") +Signed-off-by: Rask Ingemann Lambertsen +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/axp20x.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +--- a/drivers/mfd/axp20x.c ++++ b/drivers/mfd/axp20x.c +@@ -31,6 +31,7 @@ + + #define AXP20X_OFF 0x80 + ++#define AXP806_REG_ADDR_EXT_ADDR_MASTER_MODE 0 + #define AXP806_REG_ADDR_EXT_ADDR_SLAVE_MODE BIT(4) + + static const char * const axp20x_model_names[] = { +@@ -877,15 +878,19 @@ int axp20x_device_probe(struct axp20x_de + * the these device addressing bits (in the upper 4 bits of the + * registers) match. + * +- * Since we only support an AXP806 chained to an AXP809 in slave +- * mode, and there isn't any existing hardware which uses AXP806 +- * in master mode, or has 2 AXP806s in the same system, we can +- * just program the register address extension to the slave mode +- * address. ++ * By default we support an AXP806 chained to an AXP809 in slave ++ * mode. Boards which use an AXP806 in master mode can set the ++ * property "x-powers,master-mode" to override the default. + */ +- if (axp20x->variant == AXP806_ID) +- regmap_write(axp20x->regmap, AXP806_REG_ADDR_EXT, +- AXP806_REG_ADDR_EXT_ADDR_SLAVE_MODE); ++ if (axp20x->variant == AXP806_ID) { ++ if (of_property_read_bool(axp20x->dev->of_node, ++ "x-powers,master-mode")) ++ regmap_write(axp20x->regmap, AXP806_REG_ADDR_EXT, ++ AXP806_REG_ADDR_EXT_ADDR_MASTER_MODE); ++ else ++ regmap_write(axp20x->regmap, AXP806_REG_ADDR_EXT, ++ AXP806_REG_ADDR_EXT_ADDR_SLAVE_MODE); ++ } + + ret = regmap_add_irq_chip(axp20x->regmap, axp20x->irq, + IRQF_ONESHOT | IRQF_SHARED | axp20x->irq_flags, diff --git a/queue-4.11/mfd-cpcap-fix-bad-use-of-irq-sense-register.patch b/queue-4.11/mfd-cpcap-fix-bad-use-of-irq-sense-register.patch new file mode 100644 index 00000000000..f076eb01eb9 --- /dev/null +++ b/queue-4.11/mfd-cpcap-fix-bad-use-of-irq-sense-register.patch @@ -0,0 +1,33 @@ +From be269180c9335c257a2763c3fd3a44e65c90c1f0 Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Mon, 3 Apr 2017 20:15:56 -0700 +Subject: mfd: cpcap: Fix bad use of IRQ sense register + +From: Tony Lindgren + +commit be269180c9335c257a2763c3fd3a44e65c90c1f0 upstream. + +The cpcap INTS registers are for getting the value of the line, +not for configuring the type. + +Fixes: 56e1d40d3bea ("mfd: cpcap: Add minimal support") +Reviewed-By: Sebastian Reichel +Tested-by: Sebastian Reichel +Signed-off-by: Tony Lindgren +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/motorola-cpcap.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/mfd/motorola-cpcap.c ++++ b/drivers/mfd/motorola-cpcap.c +@@ -88,7 +88,6 @@ static struct regmap_irq_chip cpcap_irq_ + .status_base = CPCAP_REG_INT1, + .ack_base = CPCAP_REG_INT1, + .mask_base = CPCAP_REG_INTM1, +- .type_base = CPCAP_REG_INTS1, + .use_ack = true, + .ack_invert = true, + }, diff --git a/queue-4.11/mfd-cpcap-fix-interrupt-to-use-level-interrupt.patch b/queue-4.11/mfd-cpcap-fix-interrupt-to-use-level-interrupt.patch new file mode 100644 index 00000000000..255b146465f --- /dev/null +++ b/queue-4.11/mfd-cpcap-fix-interrupt-to-use-level-interrupt.patch @@ -0,0 +1,43 @@ +From ac89473213c602b98172d92e40f5e78032b1aba0 Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Mon, 3 Apr 2017 20:15:54 -0700 +Subject: mfd: cpcap: Fix interrupt to use level interrupt + +From: Tony Lindgren + +commit ac89473213c602b98172d92e40f5e78032b1aba0 upstream. + +I made a mistake assuming the device tree configuration for interrupt +triggering was somehow passed to the SPI device but it's not. + +In the Motorola Linux kernel tree CPCAP PMIC is configured as a rising +edge triggered interrupt, but then then it's interrupt handler keeps +looping until the GPIO line goes down. So the CPCAP interrupt is clearly +a level interrupt and not an edge interrupt. + +Earlier when I tried to configure it as level interrupt using the +device tree, I did not account that the triggering only gets passed +to the SPI core and it also needs to be specified in the CPCAP driver +when we do devm_regmap_add_irq_chip(). + +Fixes: 56e1d40d3bea ("mfd: cpcap: Add minimal support") +Signed-off-by: Tony Lindgren +Acked-by: Charles Keepax +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/motorola-cpcap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mfd/motorola-cpcap.c ++++ b/drivers/mfd/motorola-cpcap.c +@@ -126,7 +126,7 @@ static int cpcap_init_irq_chip(struct cp + + ret = devm_regmap_add_irq_chip(&cpcap->spi->dev, cpcap->regmap, + cpcap->spi->irq, +- IRQF_TRIGGER_RISING | ++ irq_get_trigger_type(cpcap->spi->irq) | + IRQF_SHARED, -1, + chip, &cpcap->irqdata[irq_chip]); + if (ret) { diff --git a/queue-4.11/mfd-cpcap-use-ack_invert-interrupts.patch b/queue-4.11/mfd-cpcap-use-ack_invert-interrupts.patch new file mode 100644 index 00000000000..ebab135d3b9 --- /dev/null +++ b/queue-4.11/mfd-cpcap-use-ack_invert-interrupts.patch @@ -0,0 +1,49 @@ +From 5a88d4120029601a0868e20774382d312952d3b5 Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Mon, 3 Apr 2017 20:15:55 -0700 +Subject: mfd: cpcap: Use ack_invert interrupts + +From: Tony Lindgren + +commit 5a88d4120029601a0868e20774382d312952d3b5 upstream. + +We should use ack_invert as the int_read_and_clear() in the Motorola +kernel tree does "ireg_val & ~mreg_val" before writing to the mask +register. + +Fixes: 56e1d40d3bea ("mfd: cpcap: Add minimal support") +Tested-by: Sebastian Reichel +Signed-off-by: Tony Lindgren +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/motorola-cpcap.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/mfd/motorola-cpcap.c ++++ b/drivers/mfd/motorola-cpcap.c +@@ -71,6 +71,7 @@ static struct regmap_irq_chip cpcap_irq_ + .ack_base = CPCAP_REG_MI1, + .mask_base = CPCAP_REG_MIM1, + .use_ack = true, ++ .ack_invert = true, + }, + { + .name = "cpcap-m2", +@@ -79,6 +80,7 @@ static struct regmap_irq_chip cpcap_irq_ + .ack_base = CPCAP_REG_MI2, + .mask_base = CPCAP_REG_MIM2, + .use_ack = true, ++ .ack_invert = true, + }, + { + .name = "cpcap1-4", +@@ -88,6 +90,7 @@ static struct regmap_irq_chip cpcap_irq_ + .mask_base = CPCAP_REG_INTM1, + .type_base = CPCAP_REG_INTS1, + .use_ack = true, ++ .ack_invert = true, + }, + }; + diff --git a/queue-4.11/mfd-omap-usb-tll-fix-inverted-bit-use-for-usb-tll-mode.patch b/queue-4.11/mfd-omap-usb-tll-fix-inverted-bit-use-for-usb-tll-mode.patch new file mode 100644 index 00000000000..a1adc3da853 --- /dev/null +++ b/queue-4.11/mfd-omap-usb-tll-fix-inverted-bit-use-for-usb-tll-mode.patch @@ -0,0 +1,40 @@ +From 8b8a84c54aff4256d592dc18346c65ecf6811b45 Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Sat, 15 Apr 2017 10:05:08 -0700 +Subject: mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode + +From: Tony Lindgren + +commit 8b8a84c54aff4256d592dc18346c65ecf6811b45 upstream. + +Commit 16fa3dc75c22 ("mfd: omap-usb-tll: HOST TLL platform driver") +added support for USB TLL, but uses OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF +bit the wrong way. The comments in the code are correct, but the inverted +use of OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF causes the register to be +enabled instead of disabled unlike what the comments say. + +Without this change the Wrigley 3G LTE modem on droid 4 EHCI bus can +be only pinged few times before it stops responding. + +Fixes: 16fa3dc75c22 ("mfd: omap-usb-tll: HOST TLL platform driver") +Signed-off-by: Tony Lindgren +Acked-by: Roger Quadros +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/omap-usb-tll.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mfd/omap-usb-tll.c ++++ b/drivers/mfd/omap-usb-tll.c +@@ -377,8 +377,8 @@ int omap_tll_init(struct usbhs_omap_plat + * and use SDR Mode + */ + reg &= ~(OMAP_TLL_CHANNEL_CONF_UTMIAUTOIDLE +- | OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF + | OMAP_TLL_CHANNEL_CONF_ULPIDDRMODE); ++ reg |= OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF; + } else if (pdata->port_mode[i] == + OMAP_EHCI_PORT_MODE_HSIC) { + /* diff --git a/queue-4.11/mtd-physmap_of-really-fix-the-physmap-add-ons.patch b/queue-4.11/mtd-physmap_of-really-fix-the-physmap-add-ons.patch new file mode 100644 index 00000000000..90f8490a361 --- /dev/null +++ b/queue-4.11/mtd-physmap_of-really-fix-the-physmap-add-ons.patch @@ -0,0 +1,834 @@ +From 8c925b263584e5a37244297ea9bd072020265fd4 Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Thu, 30 Mar 2017 17:36:39 +0200 +Subject: mtd: physmap_of: really fix the physmap add-ons + +From: Linus Walleij + +commit 8c925b263584e5a37244297ea9bd072020265fd4 upstream. + +The current way of building the of_physmap add-ons result in just +the add-on being in the object code, and not the actual core +implementation and regress the Gemini and Versatile. + +Bake the physmap_of.o object by baking physmap_of_core.o and +adding the Versatile and/or Gemini add-ons to the final object. +Rename the source file physmap_of_core.c to get the desired +build components. + +Suggested-by: Boris Brezillon +Fixes: 4f04f68e1598 ("mtd: physmap_of: fixup gemini/versatile dependencies") +Signed-off-by: Linus Walleij +Acked-by: Boris Brezillon +Signed-off-by: Brian Norris +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/maps/Makefile | 10 + drivers/mtd/maps/physmap_of.c | 389 ------------------------------------- + drivers/mtd/maps/physmap_of_core.c | 389 +++++++++++++++++++++++++++++++++++++ + 3 files changed, 393 insertions(+), 395 deletions(-) + +--- a/drivers/mtd/maps/Makefile ++++ b/drivers/mtd/maps/Makefile +@@ -17,12 +17,10 @@ obj-$(CONFIG_MTD_CK804XROM) += ck804xrom + obj-$(CONFIG_MTD_TSUNAMI) += tsunami_flash.o + obj-$(CONFIG_MTD_PXA2XX) += pxa2xx-flash.o + obj-$(CONFIG_MTD_PHYSMAP) += physmap.o +-ifdef CONFIG_MTD_PHYSMAP_OF_VERSATILE +-physmap_of-objs += physmap_of_versatile.o +-endif +-ifdef CONFIG_MTD_PHYSMAP_OF_GEMINI +-physmap_of-objs += physmap_of_gemini.o +-endif ++physmap_of-objs-y += physmap_of_core.o ++physmap_of-objs-$(CONFIG_MTD_PHYSMAP_OF_VERSATILE) += physmap_of_versatile.o ++physmap_of-objs-$(CONFIG_MTD_PHYSMAP_OF_GEMINI) += physmap_of_gemini.o ++physmap_of-objs := $(physmap_of-objs-y) + obj-$(CONFIG_MTD_PHYSMAP_OF) += physmap_of.o + obj-$(CONFIG_MTD_PISMO) += pismo.o + obj-$(CONFIG_MTD_PMC_MSP_EVM) += pmcmsp-flash.o +--- a/drivers/mtd/maps/physmap_of.c ++++ /dev/null +@@ -1,389 +0,0 @@ +-/* +- * Flash mappings described by the OF (or flattened) device tree +- * +- * Copyright (C) 2006 MontaVista Software Inc. +- * Author: Vitaly Wool +- * +- * Revised to handle newer style flash binding by: +- * Copyright (C) 2007 David Gibson, IBM Corporation. +- * +- * This program is free software; you can redistribute it and/or modify it +- * under the terms of the GNU General Public License as published by the +- * Free Software Foundation; either version 2 of the License, or (at your +- * option) any later version. +- */ +- +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include "physmap_of_gemini.h" +-#include "physmap_of_versatile.h" +- +-struct of_flash_list { +- struct mtd_info *mtd; +- struct map_info map; +- struct resource *res; +-}; +- +-struct of_flash { +- struct mtd_info *cmtd; +- int list_size; /* number of elements in of_flash_list */ +- struct of_flash_list list[0]; +-}; +- +-static int of_flash_remove(struct platform_device *dev) +-{ +- struct of_flash *info; +- int i; +- +- info = dev_get_drvdata(&dev->dev); +- if (!info) +- return 0; +- dev_set_drvdata(&dev->dev, NULL); +- +- if (info->cmtd) { +- mtd_device_unregister(info->cmtd); +- if (info->cmtd != info->list[0].mtd) +- mtd_concat_destroy(info->cmtd); +- } +- +- for (i = 0; i < info->list_size; i++) { +- if (info->list[i].mtd) +- map_destroy(info->list[i].mtd); +- +- if (info->list[i].map.virt) +- iounmap(info->list[i].map.virt); +- +- if (info->list[i].res) { +- release_resource(info->list[i].res); +- kfree(info->list[i].res); +- } +- } +- return 0; +-} +- +-static const char * const rom_probe_types[] = { +- "cfi_probe", "jedec_probe", "map_rom" }; +- +-/* Helper function to handle probing of the obsolete "direct-mapped" +- * compatible binding, which has an extra "probe-type" property +- * describing the type of flash probe necessary. */ +-static struct mtd_info *obsolete_probe(struct platform_device *dev, +- struct map_info *map) +-{ +- struct device_node *dp = dev->dev.of_node; +- const char *of_probe; +- struct mtd_info *mtd; +- int i; +- +- dev_warn(&dev->dev, "Device tree uses obsolete \"direct-mapped\" " +- "flash binding\n"); +- +- of_probe = of_get_property(dp, "probe-type", NULL); +- if (!of_probe) { +- for (i = 0; i < ARRAY_SIZE(rom_probe_types); i++) { +- mtd = do_map_probe(rom_probe_types[i], map); +- if (mtd) +- return mtd; +- } +- return NULL; +- } else if (strcmp(of_probe, "CFI") == 0) { +- return do_map_probe("cfi_probe", map); +- } else if (strcmp(of_probe, "JEDEC") == 0) { +- return do_map_probe("jedec_probe", map); +- } else { +- if (strcmp(of_probe, "ROM") != 0) +- dev_warn(&dev->dev, "obsolete_probe: don't know probe " +- "type '%s', mapping as rom\n", of_probe); +- return do_map_probe("map_rom", map); +- } +-} +- +-/* When partitions are set we look for a linux,part-probe property which +- specifies the list of partition probers to use. If none is given then the +- default is use. These take precedence over other device tree +- information. */ +-static const char * const part_probe_types_def[] = { +- "cmdlinepart", "RedBoot", "ofpart", "ofoldpart", NULL }; +- +-static const char * const *of_get_probes(struct device_node *dp) +-{ +- const char *cp; +- int cplen; +- unsigned int l; +- unsigned int count; +- const char **res; +- +- cp = of_get_property(dp, "linux,part-probe", &cplen); +- if (cp == NULL) +- return part_probe_types_def; +- +- count = 0; +- for (l = 0; l != cplen; l++) +- if (cp[l] == 0) +- count++; +- +- res = kzalloc((count + 1)*sizeof(*res), GFP_KERNEL); +- if (!res) +- return NULL; +- count = 0; +- while (cplen > 0) { +- res[count] = cp; +- l = strlen(cp) + 1; +- cp += l; +- cplen -= l; +- count++; +- } +- return res; +-} +- +-static void of_free_probes(const char * const *probes) +-{ +- if (probes != part_probe_types_def) +- kfree(probes); +-} +- +-static const struct of_device_id of_flash_match[]; +-static int of_flash_probe(struct platform_device *dev) +-{ +- const char * const *part_probe_types; +- const struct of_device_id *match; +- struct device_node *dp = dev->dev.of_node; +- struct resource res; +- struct of_flash *info; +- const char *probe_type; +- const __be32 *width; +- int err; +- int i; +- int count; +- const __be32 *p; +- int reg_tuple_size; +- struct mtd_info **mtd_list = NULL; +- resource_size_t res_size; +- bool map_indirect; +- const char *mtd_name = NULL; +- +- match = of_match_device(of_flash_match, &dev->dev); +- if (!match) +- return -EINVAL; +- probe_type = match->data; +- +- reg_tuple_size = (of_n_addr_cells(dp) + of_n_size_cells(dp)) * sizeof(u32); +- +- of_property_read_string(dp, "linux,mtd-name", &mtd_name); +- +- /* +- * Get number of "reg" tuples. Scan for MTD devices on area's +- * described by each "reg" region. This makes it possible (including +- * the concat support) to support the Intel P30 48F4400 chips which +- * consists internally of 2 non-identical NOR chips on one die. +- */ +- p = of_get_property(dp, "reg", &count); +- if (!p || count % reg_tuple_size != 0) { +- dev_err(&dev->dev, "Malformed reg property on %s\n", +- dev->dev.of_node->full_name); +- err = -EINVAL; +- goto err_flash_remove; +- } +- count /= reg_tuple_size; +- +- map_indirect = of_property_read_bool(dp, "no-unaligned-direct-access"); +- +- err = -ENOMEM; +- info = devm_kzalloc(&dev->dev, +- sizeof(struct of_flash) + +- sizeof(struct of_flash_list) * count, GFP_KERNEL); +- if (!info) +- goto err_flash_remove; +- +- dev_set_drvdata(&dev->dev, info); +- +- mtd_list = kzalloc(sizeof(*mtd_list) * count, GFP_KERNEL); +- if (!mtd_list) +- goto err_flash_remove; +- +- for (i = 0; i < count; i++) { +- err = -ENXIO; +- if (of_address_to_resource(dp, i, &res)) { +- /* +- * Continue with next register tuple if this +- * one is not mappable +- */ +- continue; +- } +- +- dev_dbg(&dev->dev, "of_flash device: %pR\n", &res); +- +- err = -EBUSY; +- res_size = resource_size(&res); +- info->list[i].res = request_mem_region(res.start, res_size, +- dev_name(&dev->dev)); +- if (!info->list[i].res) +- goto err_out; +- +- err = -ENXIO; +- width = of_get_property(dp, "bank-width", NULL); +- if (!width) { +- dev_err(&dev->dev, "Can't get bank width from device" +- " tree\n"); +- goto err_out; +- } +- +- info->list[i].map.name = mtd_name ?: dev_name(&dev->dev); +- info->list[i].map.phys = res.start; +- info->list[i].map.size = res_size; +- info->list[i].map.bankwidth = be32_to_cpup(width); +- info->list[i].map.device_node = dp; +- +- err = of_flash_probe_gemini(dev, dp, &info->list[i].map); +- if (err) +- return err; +- err = of_flash_probe_versatile(dev, dp, &info->list[i].map); +- if (err) +- return err; +- +- err = -ENOMEM; +- info->list[i].map.virt = ioremap(info->list[i].map.phys, +- info->list[i].map.size); +- if (!info->list[i].map.virt) { +- dev_err(&dev->dev, "Failed to ioremap() flash" +- " region\n"); +- goto err_out; +- } +- +- simple_map_init(&info->list[i].map); +- +- /* +- * On some platforms (e.g. MPC5200) a direct 1:1 mapping +- * may cause problems with JFFS2 usage, as the local bus (LPB) +- * doesn't support unaligned accesses as implemented in the +- * JFFS2 code via memcpy(). By setting NO_XIP, the +- * flash will not be exposed directly to the MTD users +- * (e.g. JFFS2) any more. +- */ +- if (map_indirect) +- info->list[i].map.phys = NO_XIP; +- +- if (probe_type) { +- info->list[i].mtd = do_map_probe(probe_type, +- &info->list[i].map); +- } else { +- info->list[i].mtd = obsolete_probe(dev, +- &info->list[i].map); +- } +- +- /* Fall back to mapping region as ROM */ +- if (!info->list[i].mtd) { +- dev_warn(&dev->dev, +- "do_map_probe() failed for type %s\n", +- probe_type); +- +- info->list[i].mtd = do_map_probe("map_rom", +- &info->list[i].map); +- } +- mtd_list[i] = info->list[i].mtd; +- +- err = -ENXIO; +- if (!info->list[i].mtd) { +- dev_err(&dev->dev, "do_map_probe() failed\n"); +- goto err_out; +- } else { +- info->list_size++; +- } +- info->list[i].mtd->dev.parent = &dev->dev; +- } +- +- err = 0; +- info->cmtd = NULL; +- if (info->list_size == 1) { +- info->cmtd = info->list[0].mtd; +- } else if (info->list_size > 1) { +- /* +- * We detected multiple devices. Concatenate them together. +- */ +- info->cmtd = mtd_concat_create(mtd_list, info->list_size, +- dev_name(&dev->dev)); +- } +- if (info->cmtd == NULL) +- err = -ENXIO; +- +- if (err) +- goto err_out; +- +- info->cmtd->dev.parent = &dev->dev; +- mtd_set_of_node(info->cmtd, dp); +- part_probe_types = of_get_probes(dp); +- if (!part_probe_types) { +- err = -ENOMEM; +- goto err_out; +- } +- mtd_device_parse_register(info->cmtd, part_probe_types, NULL, +- NULL, 0); +- of_free_probes(part_probe_types); +- +- kfree(mtd_list); +- +- return 0; +- +-err_out: +- kfree(mtd_list); +-err_flash_remove: +- of_flash_remove(dev); +- +- return err; +-} +- +-static const struct of_device_id of_flash_match[] = { +- { +- .compatible = "cfi-flash", +- .data = (void *)"cfi_probe", +- }, +- { +- /* FIXME: JEDEC chips can't be safely and reliably +- * probed, although the mtd code gets it right in +- * practice most of the time. We should use the +- * vendor and device ids specified by the binding to +- * bypass the heuristic probe code, but the mtd layer +- * provides, at present, no interface for doing so +- * :(. */ +- .compatible = "jedec-flash", +- .data = (void *)"jedec_probe", +- }, +- { +- .compatible = "mtd-ram", +- .data = (void *)"map_ram", +- }, +- { +- .compatible = "mtd-rom", +- .data = (void *)"map_rom", +- }, +- { +- .type = "rom", +- .compatible = "direct-mapped" +- }, +- { }, +-}; +-MODULE_DEVICE_TABLE(of, of_flash_match); +- +-static struct platform_driver of_flash_driver = { +- .driver = { +- .name = "of-flash", +- .of_match_table = of_flash_match, +- }, +- .probe = of_flash_probe, +- .remove = of_flash_remove, +-}; +- +-module_platform_driver(of_flash_driver); +- +-MODULE_LICENSE("GPL"); +-MODULE_AUTHOR("Vitaly Wool "); +-MODULE_DESCRIPTION("Device tree based MTD map driver"); +--- /dev/null ++++ b/drivers/mtd/maps/physmap_of_core.c +@@ -0,0 +1,389 @@ ++/* ++ * Flash mappings described by the OF (or flattened) device tree ++ * ++ * Copyright (C) 2006 MontaVista Software Inc. ++ * Author: Vitaly Wool ++ * ++ * Revised to handle newer style flash binding by: ++ * Copyright (C) 2007 David Gibson, IBM Corporation. ++ * ++ * This program is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License as published by the ++ * Free Software Foundation; either version 2 of the License, or (at your ++ * option) any later version. ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include "physmap_of_gemini.h" ++#include "physmap_of_versatile.h" ++ ++struct of_flash_list { ++ struct mtd_info *mtd; ++ struct map_info map; ++ struct resource *res; ++}; ++ ++struct of_flash { ++ struct mtd_info *cmtd; ++ int list_size; /* number of elements in of_flash_list */ ++ struct of_flash_list list[0]; ++}; ++ ++static int of_flash_remove(struct platform_device *dev) ++{ ++ struct of_flash *info; ++ int i; ++ ++ info = dev_get_drvdata(&dev->dev); ++ if (!info) ++ return 0; ++ dev_set_drvdata(&dev->dev, NULL); ++ ++ if (info->cmtd) { ++ mtd_device_unregister(info->cmtd); ++ if (info->cmtd != info->list[0].mtd) ++ mtd_concat_destroy(info->cmtd); ++ } ++ ++ for (i = 0; i < info->list_size; i++) { ++ if (info->list[i].mtd) ++ map_destroy(info->list[i].mtd); ++ ++ if (info->list[i].map.virt) ++ iounmap(info->list[i].map.virt); ++ ++ if (info->list[i].res) { ++ release_resource(info->list[i].res); ++ kfree(info->list[i].res); ++ } ++ } ++ return 0; ++} ++ ++static const char * const rom_probe_types[] = { ++ "cfi_probe", "jedec_probe", "map_rom" }; ++ ++/* Helper function to handle probing of the obsolete "direct-mapped" ++ * compatible binding, which has an extra "probe-type" property ++ * describing the type of flash probe necessary. */ ++static struct mtd_info *obsolete_probe(struct platform_device *dev, ++ struct map_info *map) ++{ ++ struct device_node *dp = dev->dev.of_node; ++ const char *of_probe; ++ struct mtd_info *mtd; ++ int i; ++ ++ dev_warn(&dev->dev, "Device tree uses obsolete \"direct-mapped\" " ++ "flash binding\n"); ++ ++ of_probe = of_get_property(dp, "probe-type", NULL); ++ if (!of_probe) { ++ for (i = 0; i < ARRAY_SIZE(rom_probe_types); i++) { ++ mtd = do_map_probe(rom_probe_types[i], map); ++ if (mtd) ++ return mtd; ++ } ++ return NULL; ++ } else if (strcmp(of_probe, "CFI") == 0) { ++ return do_map_probe("cfi_probe", map); ++ } else if (strcmp(of_probe, "JEDEC") == 0) { ++ return do_map_probe("jedec_probe", map); ++ } else { ++ if (strcmp(of_probe, "ROM") != 0) ++ dev_warn(&dev->dev, "obsolete_probe: don't know probe " ++ "type '%s', mapping as rom\n", of_probe); ++ return do_map_probe("map_rom", map); ++ } ++} ++ ++/* When partitions are set we look for a linux,part-probe property which ++ specifies the list of partition probers to use. If none is given then the ++ default is use. These take precedence over other device tree ++ information. */ ++static const char * const part_probe_types_def[] = { ++ "cmdlinepart", "RedBoot", "ofpart", "ofoldpart", NULL }; ++ ++static const char * const *of_get_probes(struct device_node *dp) ++{ ++ const char *cp; ++ int cplen; ++ unsigned int l; ++ unsigned int count; ++ const char **res; ++ ++ cp = of_get_property(dp, "linux,part-probe", &cplen); ++ if (cp == NULL) ++ return part_probe_types_def; ++ ++ count = 0; ++ for (l = 0; l != cplen; l++) ++ if (cp[l] == 0) ++ count++; ++ ++ res = kzalloc((count + 1)*sizeof(*res), GFP_KERNEL); ++ if (!res) ++ return NULL; ++ count = 0; ++ while (cplen > 0) { ++ res[count] = cp; ++ l = strlen(cp) + 1; ++ cp += l; ++ cplen -= l; ++ count++; ++ } ++ return res; ++} ++ ++static void of_free_probes(const char * const *probes) ++{ ++ if (probes != part_probe_types_def) ++ kfree(probes); ++} ++ ++static const struct of_device_id of_flash_match[]; ++static int of_flash_probe(struct platform_device *dev) ++{ ++ const char * const *part_probe_types; ++ const struct of_device_id *match; ++ struct device_node *dp = dev->dev.of_node; ++ struct resource res; ++ struct of_flash *info; ++ const char *probe_type; ++ const __be32 *width; ++ int err; ++ int i; ++ int count; ++ const __be32 *p; ++ int reg_tuple_size; ++ struct mtd_info **mtd_list = NULL; ++ resource_size_t res_size; ++ bool map_indirect; ++ const char *mtd_name = NULL; ++ ++ match = of_match_device(of_flash_match, &dev->dev); ++ if (!match) ++ return -EINVAL; ++ probe_type = match->data; ++ ++ reg_tuple_size = (of_n_addr_cells(dp) + of_n_size_cells(dp)) * sizeof(u32); ++ ++ of_property_read_string(dp, "linux,mtd-name", &mtd_name); ++ ++ /* ++ * Get number of "reg" tuples. Scan for MTD devices on area's ++ * described by each "reg" region. This makes it possible (including ++ * the concat support) to support the Intel P30 48F4400 chips which ++ * consists internally of 2 non-identical NOR chips on one die. ++ */ ++ p = of_get_property(dp, "reg", &count); ++ if (!p || count % reg_tuple_size != 0) { ++ dev_err(&dev->dev, "Malformed reg property on %s\n", ++ dev->dev.of_node->full_name); ++ err = -EINVAL; ++ goto err_flash_remove; ++ } ++ count /= reg_tuple_size; ++ ++ map_indirect = of_property_read_bool(dp, "no-unaligned-direct-access"); ++ ++ err = -ENOMEM; ++ info = devm_kzalloc(&dev->dev, ++ sizeof(struct of_flash) + ++ sizeof(struct of_flash_list) * count, GFP_KERNEL); ++ if (!info) ++ goto err_flash_remove; ++ ++ dev_set_drvdata(&dev->dev, info); ++ ++ mtd_list = kzalloc(sizeof(*mtd_list) * count, GFP_KERNEL); ++ if (!mtd_list) ++ goto err_flash_remove; ++ ++ for (i = 0; i < count; i++) { ++ err = -ENXIO; ++ if (of_address_to_resource(dp, i, &res)) { ++ /* ++ * Continue with next register tuple if this ++ * one is not mappable ++ */ ++ continue; ++ } ++ ++ dev_dbg(&dev->dev, "of_flash device: %pR\n", &res); ++ ++ err = -EBUSY; ++ res_size = resource_size(&res); ++ info->list[i].res = request_mem_region(res.start, res_size, ++ dev_name(&dev->dev)); ++ if (!info->list[i].res) ++ goto err_out; ++ ++ err = -ENXIO; ++ width = of_get_property(dp, "bank-width", NULL); ++ if (!width) { ++ dev_err(&dev->dev, "Can't get bank width from device" ++ " tree\n"); ++ goto err_out; ++ } ++ ++ info->list[i].map.name = mtd_name ?: dev_name(&dev->dev); ++ info->list[i].map.phys = res.start; ++ info->list[i].map.size = res_size; ++ info->list[i].map.bankwidth = be32_to_cpup(width); ++ info->list[i].map.device_node = dp; ++ ++ err = of_flash_probe_gemini(dev, dp, &info->list[i].map); ++ if (err) ++ return err; ++ err = of_flash_probe_versatile(dev, dp, &info->list[i].map); ++ if (err) ++ return err; ++ ++ err = -ENOMEM; ++ info->list[i].map.virt = ioremap(info->list[i].map.phys, ++ info->list[i].map.size); ++ if (!info->list[i].map.virt) { ++ dev_err(&dev->dev, "Failed to ioremap() flash" ++ " region\n"); ++ goto err_out; ++ } ++ ++ simple_map_init(&info->list[i].map); ++ ++ /* ++ * On some platforms (e.g. MPC5200) a direct 1:1 mapping ++ * may cause problems with JFFS2 usage, as the local bus (LPB) ++ * doesn't support unaligned accesses as implemented in the ++ * JFFS2 code via memcpy(). By setting NO_XIP, the ++ * flash will not be exposed directly to the MTD users ++ * (e.g. JFFS2) any more. ++ */ ++ if (map_indirect) ++ info->list[i].map.phys = NO_XIP; ++ ++ if (probe_type) { ++ info->list[i].mtd = do_map_probe(probe_type, ++ &info->list[i].map); ++ } else { ++ info->list[i].mtd = obsolete_probe(dev, ++ &info->list[i].map); ++ } ++ ++ /* Fall back to mapping region as ROM */ ++ if (!info->list[i].mtd) { ++ dev_warn(&dev->dev, ++ "do_map_probe() failed for type %s\n", ++ probe_type); ++ ++ info->list[i].mtd = do_map_probe("map_rom", ++ &info->list[i].map); ++ } ++ mtd_list[i] = info->list[i].mtd; ++ ++ err = -ENXIO; ++ if (!info->list[i].mtd) { ++ dev_err(&dev->dev, "do_map_probe() failed\n"); ++ goto err_out; ++ } else { ++ info->list_size++; ++ } ++ info->list[i].mtd->dev.parent = &dev->dev; ++ } ++ ++ err = 0; ++ info->cmtd = NULL; ++ if (info->list_size == 1) { ++ info->cmtd = info->list[0].mtd; ++ } else if (info->list_size > 1) { ++ /* ++ * We detected multiple devices. Concatenate them together. ++ */ ++ info->cmtd = mtd_concat_create(mtd_list, info->list_size, ++ dev_name(&dev->dev)); ++ } ++ if (info->cmtd == NULL) ++ err = -ENXIO; ++ ++ if (err) ++ goto err_out; ++ ++ info->cmtd->dev.parent = &dev->dev; ++ mtd_set_of_node(info->cmtd, dp); ++ part_probe_types = of_get_probes(dp); ++ if (!part_probe_types) { ++ err = -ENOMEM; ++ goto err_out; ++ } ++ mtd_device_parse_register(info->cmtd, part_probe_types, NULL, ++ NULL, 0); ++ of_free_probes(part_probe_types); ++ ++ kfree(mtd_list); ++ ++ return 0; ++ ++err_out: ++ kfree(mtd_list); ++err_flash_remove: ++ of_flash_remove(dev); ++ ++ return err; ++} ++ ++static const struct of_device_id of_flash_match[] = { ++ { ++ .compatible = "cfi-flash", ++ .data = (void *)"cfi_probe", ++ }, ++ { ++ /* FIXME: JEDEC chips can't be safely and reliably ++ * probed, although the mtd code gets it right in ++ * practice most of the time. We should use the ++ * vendor and device ids specified by the binding to ++ * bypass the heuristic probe code, but the mtd layer ++ * provides, at present, no interface for doing so ++ * :(. */ ++ .compatible = "jedec-flash", ++ .data = (void *)"jedec_probe", ++ }, ++ { ++ .compatible = "mtd-ram", ++ .data = (void *)"map_ram", ++ }, ++ { ++ .compatible = "mtd-rom", ++ .data = (void *)"map_rom", ++ }, ++ { ++ .type = "rom", ++ .compatible = "direct-mapped" ++ }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(of, of_flash_match); ++ ++static struct platform_driver of_flash_driver = { ++ .driver = { ++ .name = "of-flash", ++ .of_match_table = of_flash_match, ++ }, ++ .probe = of_flash_probe, ++ .remove = of_flash_remove, ++}; ++ ++module_platform_driver(of_flash_driver); ++ ++MODULE_LICENSE("GPL"); ++MODULE_AUTHOR("Vitaly Wool "); ++MODULE_DESCRIPTION("Device tree based MTD map driver"); diff --git a/queue-4.11/phy-rcar-gen3-usb2-fix-implementation-for-runtime-pm.patch b/queue-4.11/phy-rcar-gen3-usb2-fix-implementation-for-runtime-pm.patch new file mode 100644 index 00000000000..5e74e565bbe --- /dev/null +++ b/queue-4.11/phy-rcar-gen3-usb2-fix-implementation-for-runtime-pm.patch @@ -0,0 +1,106 @@ +From 441a681b8843474c9796b50c35794ff102701f37 Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Tue, 14 Mar 2017 08:37:40 +0900 +Subject: phy: rcar-gen3-usb2: fix implementation for runtime PM + +From: Yoshihiro Shimoda + +commit 441a681b8843474c9796b50c35794ff102701f37 upstream. + +This patch fixes an issue that this driver doesn't take care of the runtime +PM. This code assumed that devm_phy_create() called pm_runtime_enable(dev), +but it misunderstood the dev_phy_create()'s specification. +This driver should call its own pm_runtime_enable() before +dev_phy_create(). + +Fixes: f3b5a8d9b50d ("phy: rcar-gen3-usb2: Add R-Car Gen3 USB2 PHY driver") +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/phy/phy-rcar-gen3-usb2.c | 31 ++++++++++++++++++++++++------- + 1 file changed, 24 insertions(+), 7 deletions(-) + +--- a/drivers/phy/phy-rcar-gen3-usb2.c ++++ b/drivers/phy/phy-rcar-gen3-usb2.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -395,7 +396,7 @@ static int rcar_gen3_phy_usb2_probe(stru + struct rcar_gen3_chan *channel; + struct phy_provider *provider; + struct resource *res; +- int irq; ++ int irq, ret = 0; + + if (!dev->of_node) { + dev_err(dev, "This driver needs device tree\n"); +@@ -434,17 +435,24 @@ static int rcar_gen3_phy_usb2_probe(stru + } + } + +- /* devm_phy_create() will call pm_runtime_enable(dev); */ ++ /* ++ * devm_phy_create() will call pm_runtime_enable(&phy->dev); ++ * And then, phy-core will manage runtime pm for this device. ++ */ ++ pm_runtime_enable(dev); + channel->phy = devm_phy_create(dev, NULL, &rcar_gen3_phy_usb2_ops); + if (IS_ERR(channel->phy)) { + dev_err(dev, "Failed to create USB2 PHY\n"); +- return PTR_ERR(channel->phy); ++ ret = PTR_ERR(channel->phy); ++ goto error; + } + + channel->vbus = devm_regulator_get_optional(dev, "vbus"); + if (IS_ERR(channel->vbus)) { +- if (PTR_ERR(channel->vbus) == -EPROBE_DEFER) +- return PTR_ERR(channel->vbus); ++ if (PTR_ERR(channel->vbus) == -EPROBE_DEFER) { ++ ret = PTR_ERR(channel->vbus); ++ goto error; ++ } + channel->vbus = NULL; + } + +@@ -454,15 +462,22 @@ static int rcar_gen3_phy_usb2_probe(stru + provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate); + if (IS_ERR(provider)) { + dev_err(dev, "Failed to register PHY provider\n"); ++ ret = PTR_ERR(provider); ++ goto error; + } else if (channel->has_otg) { + int ret; + + ret = device_create_file(dev, &dev_attr_role); + if (ret < 0) +- return ret; ++ goto error; + } + +- return PTR_ERR_OR_ZERO(provider); ++ return 0; ++ ++error: ++ pm_runtime_disable(dev); ++ ++ return ret; + } + + static int rcar_gen3_phy_usb2_remove(struct platform_device *pdev) +@@ -472,6 +487,8 @@ static int rcar_gen3_phy_usb2_remove(str + if (channel->has_otg) + device_remove_file(&pdev->dev, &dev_attr_role); + ++ pm_runtime_disable(&pdev->dev); ++ + return 0; + }; + diff --git a/queue-4.11/powerpc-mm-add-physical-address-to-linux-page-table-dump.patch b/queue-4.11/powerpc-mm-add-physical-address-to-linux-page-table-dump.patch new file mode 100644 index 00000000000..9d8e539ac3c --- /dev/null +++ b/queue-4.11/powerpc-mm-add-physical-address-to-linux-page-table-dump.patch @@ -0,0 +1,91 @@ +From aaa229529244a1135b29353fefb001c430db79f0 Mon Sep 17 00:00:00 2001 +From: Oliver O'Halloran +Date: Fri, 31 Mar 2017 12:37:49 +1100 +Subject: powerpc/mm: Add physical address to Linux page table dump + +From: Oliver O'Halloran + +commit aaa229529244a1135b29353fefb001c430db79f0 upstream. + +The current page table dumper scans the Linux page tables and coalesces mappings +with adjacent virtual addresses and similar PTE flags. This behaviour is +somewhat broken when you consider the IOREMAP space where entirely unrelated +mappings will appear to be virtually contiguous. This patch modifies the range +coalescing so that only ranges that are both physically and virtually contiguous +are combined. This patch also adds to the dump output the physical address at +the start of each range. + +Fixes: 8eb07b187000 ("powerpc/mm: Dump linux pagetables") +Signed-off-by: Oliver O'Halloran +[mpe: Print the physicall address with 0x like the other addresses] +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/mm/dump_linuxpagetables.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +--- a/arch/powerpc/mm/dump_linuxpagetables.c ++++ b/arch/powerpc/mm/dump_linuxpagetables.c +@@ -57,6 +57,8 @@ struct pg_state { + struct seq_file *seq; + const struct addr_marker *marker; + unsigned long start_address; ++ unsigned long start_pa; ++ unsigned long last_pa; + unsigned int level; + u64 current_flags; + }; +@@ -253,7 +255,9 @@ static void dump_addr(struct pg_state *s + const char *unit = units; + unsigned long delta; + +- seq_printf(st->seq, "0x%016lx-0x%016lx ", st->start_address, addr-1); ++ seq_printf(st->seq, "0x%016lx-0x%016lx ", st->start_address, addr-1); ++ seq_printf(st->seq, "0x%016lx ", st->start_pa); ++ + delta = (addr - st->start_address) >> 10; + /* Work out what appropriate unit to use */ + while (!(delta & 1023) && unit[1]) { +@@ -268,11 +272,15 @@ static void note_page(struct pg_state *s + unsigned int level, u64 val) + { + u64 flag = val & pg_level[level].mask; ++ u64 pa = val & PTE_RPN_MASK; ++ + /* At first no level is set */ + if (!st->level) { + st->level = level; + st->current_flags = flag; + st->start_address = addr; ++ st->start_pa = pa; ++ st->last_pa = pa; + seq_printf(st->seq, "---[ %s ]---\n", st->marker->name); + /* + * Dump the section of virtual memory when: +@@ -280,9 +288,11 @@ static void note_page(struct pg_state *s + * - we change levels in the tree. + * - the address is in a different section of memory and is thus + * used for a different purpose, regardless of the flags. ++ * - the pa of this page is not adjacent to the last inspected page + */ + } else if (flag != st->current_flags || level != st->level || +- addr >= st->marker[1].start_address) { ++ addr >= st->marker[1].start_address || ++ pa != st->last_pa + PAGE_SIZE) { + + /* Check the PTE flags */ + if (st->current_flags) { +@@ -306,8 +316,12 @@ static void note_page(struct pg_state *s + seq_printf(st->seq, "---[ %s ]---\n", st->marker->name); + } + st->start_address = addr; ++ st->start_pa = pa; ++ st->last_pa = pa; + st->current_flags = flag; + st->level = level; ++ } else { ++ st->last_pa = pa; + } + } + diff --git a/queue-4.11/pvrusb2-reduce-stack-usage-pvr2_eeprom_analyze.patch b/queue-4.11/pvrusb2-reduce-stack-usage-pvr2_eeprom_analyze.patch new file mode 100644 index 00000000000..5b80b713fe1 --- /dev/null +++ b/queue-4.11/pvrusb2-reduce-stack-usage-pvr2_eeprom_analyze.patch @@ -0,0 +1,57 @@ +From 6830733d53a4517588e56227b9c8538633f0c496 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Thu, 2 Feb 2017 12:53:04 -0200 +Subject: [media] pvrusb2: reduce stack usage pvr2_eeprom_analyze() + +From: Arnd Bergmann + +commit 6830733d53a4517588e56227b9c8538633f0c496 upstream. + +The driver uses a relatively large data structure on the stack, which +showed up on my radar as we get a warning with the "latent entropy" +GCC plugin: + +drivers/media/usb/pvrusb2/pvrusb2-eeprom.c:153:1: error: the frame size of 1376 bytes is larger than 1152 bytes [-Werror=frame-larger-than=] + +The warning is usually hidden as we raise the warning limit to 2048 +when the plugin is enabled, but I'd like to lower that again in the +future, and making this function smaller helps to do that without +build regressions. + +Further analysis shows that putting an 'i2c_client' structure on +the stack is not really supported, as the embedded 'struct device' +is not initialized here, and we are only saved by the fact that +the function that is called here does not use the pointer at all. + +Fixes: d855497edbfb ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18") + +Signed-off-by: Arnd Bergmann +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/pvrusb2/pvrusb2-eeprom.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +--- a/drivers/media/usb/pvrusb2/pvrusb2-eeprom.c ++++ b/drivers/media/usb/pvrusb2/pvrusb2-eeprom.c +@@ -118,15 +118,10 @@ int pvr2_eeprom_analyze(struct pvr2_hdw + memset(&tvdata,0,sizeof(tvdata)); + + eeprom = pvr2_eeprom_fetch(hdw); +- if (!eeprom) return -EINVAL; ++ if (!eeprom) ++ return -EINVAL; + +- { +- struct i2c_client fake_client; +- /* Newer version expects a useless client interface */ +- fake_client.addr = hdw->eeprom_addr; +- fake_client.adapter = &hdw->i2c_adap; +- tveeprom_hauppauge_analog(&fake_client,&tvdata,eeprom); +- } ++ tveeprom_hauppauge_analog(NULL, &tvdata, eeprom); + + trace_eeprom("eeprom assumed v4l tveeprom module"); + trace_eeprom("eeprom direct call results:"); diff --git a/queue-4.11/selinux-fix-double-free-in-selinux_parse_opts_str.patch b/queue-4.11/selinux-fix-double-free-in-selinux_parse_opts_str.patch new file mode 100644 index 00000000000..86a2212bf8c --- /dev/null +++ b/queue-4.11/selinux-fix-double-free-in-selinux_parse_opts_str.patch @@ -0,0 +1,57 @@ +From 023f108dcc187e34ef864bf10ed966cf25e14e2a Mon Sep 17 00:00:00 2001 +From: Paul Moore +Date: Wed, 7 Jun 2017 16:48:19 -0400 +Subject: selinux: fix double free in selinux_parse_opts_str() + +From: Paul Moore + +commit 023f108dcc187e34ef864bf10ed966cf25e14e2a upstream. + +This patch is based on a discussion generated by an earlier patch +from Tetsuo Handa: + +* https://marc.info/?t=149035659300001&r=1&w=2 + +The double free problem involves the mnt_opts field of the +security_mnt_opts struct, selinux_parse_opts_str() frees the memory +on error, but doesn't set the field to NULL so if the caller later +attempts to call security_free_mnt_opts() we trigger the problem. + +In order to play it safe we change selinux_parse_opts_str() to call +security_free_mnt_opts() on error instead of free'ing the memory +directly. This should ensure that everything is handled correctly, +regardless of what the caller may do. + +Fixes: e0007529893c1c06 ("LSM/SELinux: Interfaces to allow FS to control mount options") +Cc: Tetsuo Handa +Reported-by: Dmitry Vyukov +Signed-off-by: Paul Moore +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + security/selinux/hooks.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -1106,10 +1106,8 @@ static int selinux_parse_opts_str(char * + + opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), + GFP_KERNEL); +- if (!opts->mnt_opts_flags) { +- kfree(opts->mnt_opts); ++ if (!opts->mnt_opts_flags) + goto out_err; +- } + + if (fscontext) { + opts->mnt_opts[num_mnt_opts] = fscontext; +@@ -1132,6 +1130,7 @@ static int selinux_parse_opts_str(char * + return 0; + + out_err: ++ security_free_mnt_opts(opts); + kfree(context); + kfree(defcontext); + kfree(fscontext); diff --git a/queue-4.11/serial-8250_lpss-unconditionally-set-pci-master-for-quark.patch b/queue-4.11/serial-8250_lpss-unconditionally-set-pci-master-for-quark.patch new file mode 100644 index 00000000000..5300a3a3248 --- /dev/null +++ b/queue-4.11/serial-8250_lpss-unconditionally-set-pci-master-for-quark.patch @@ -0,0 +1,43 @@ +From 7cd3e9dbdd4c0025d0e37c8c73a2ac8641fc55bc Mon Sep 17 00:00:00 2001 +From: Jan Kiszka +Date: Thu, 23 Mar 2017 09:26:42 +0100 +Subject: serial: 8250_lpss: Unconditionally set PCI master for Quark + +From: Jan Kiszka + +commit 7cd3e9dbdd4c0025d0e37c8c73a2ac8641fc55bc upstream. + +MSI needs it as well. + +Should have no practical impact, though, as DMA is always available on +the Quark. But given the few users of pci_alloc_irq_vectors so far, this +incorrect pattern may spread otherwise. + +Fixes: 3f3a46951e02 ("serial: 8250_lpss: set PCI master only for private DMA") +Signed-off-by: Jan Kiszka +Reviewed-by: Andy Shevchenko +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/8250/8250_lpss.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_lpss.c ++++ b/drivers/tty/serial/8250/8250_lpss.c +@@ -183,7 +183,6 @@ static void qrk_serial_setup_dma(struct + if (ret) + return; + +- pci_set_master(pdev); + pci_try_set_mwi(pdev); + + /* Special DMA address for UART */ +@@ -216,6 +215,8 @@ static int qrk_serial_setup(struct lpss8 + struct pci_dev *pdev = to_pci_dev(port->dev); + int ret; + ++ pci_set_master(pdev); ++ + ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_ALL_TYPES); + if (ret < 0) + return ret; diff --git a/queue-4.11/serial-efm32-fix-parity-management-in-efm32_uart_console_get_options.patch b/queue-4.11/serial-efm32-fix-parity-management-in-efm32_uart_console_get_options.patch new file mode 100644 index 00000000000..307d76ae3fa --- /dev/null +++ b/queue-4.11/serial-efm32-fix-parity-management-in-efm32_uart_console_get_options.patch @@ -0,0 +1,56 @@ +From be40597a1bc173bf9dadccdf5388b956f620ae8f Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Fri, 12 May 2017 16:35:45 +0200 +Subject: serial: efm32: Fix parity management in 'efm32_uart_console_get_options()' +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christophe JAILLET + +commit be40597a1bc173bf9dadccdf5388b956f620ae8f upstream. + +UARTn_FRAME_PARITY_ODD is 0x0300 +UARTn_FRAME_PARITY_EVEN is 0x0200 +So if the UART is configured for EVEN parity, it would be reported as ODD. +Fix it by correctly testing if the 2 bits are set. + +Fixes: 3afbd89c9639 ("serial/efm32: add new driver") +Signed-off-by: Christophe JAILLET +Acked-by: Uwe Kleine-König +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/efm32-uart.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/tty/serial/efm32-uart.c ++++ b/drivers/tty/serial/efm32-uart.c +@@ -27,6 +27,7 @@ + #define UARTn_FRAME 0x04 + #define UARTn_FRAME_DATABITS__MASK 0x000f + #define UARTn_FRAME_DATABITS(n) ((n) - 3) ++#define UARTn_FRAME_PARITY__MASK 0x0300 + #define UARTn_FRAME_PARITY_NONE 0x0000 + #define UARTn_FRAME_PARITY_EVEN 0x0200 + #define UARTn_FRAME_PARITY_ODD 0x0300 +@@ -572,12 +573,16 @@ static void efm32_uart_console_get_optio + 16 * (4 + (clkdiv >> 6))); + + frame = efm32_uart_read32(efm_port, UARTn_FRAME); +- if (frame & UARTn_FRAME_PARITY_ODD) ++ switch (frame & UARTn_FRAME_PARITY__MASK) { ++ case UARTn_FRAME_PARITY_ODD: + *parity = 'o'; +- else if (frame & UARTn_FRAME_PARITY_EVEN) ++ break; ++ case UARTn_FRAME_PARITY_EVEN: + *parity = 'e'; +- else ++ break; ++ default: + *parity = 'n'; ++ } + + *bits = (frame & UARTn_FRAME_DATABITS__MASK) - + UARTn_FRAME_DATABITS(4) + 4; diff --git a/queue-4.11/serial-sh-sci-fix-auto-rts-in-sci_init_pins.patch b/queue-4.11/serial-sh-sci-fix-auto-rts-in-sci_init_pins.patch new file mode 100644 index 00000000000..eb80a21b279 --- /dev/null +++ b/queue-4.11/serial-sh-sci-fix-auto-rts-in-sci_init_pins.patch @@ -0,0 +1,73 @@ +From cfa6eb239154315e6efcdda1d929e024097f927b Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Tue, 28 Mar 2017 11:13:46 +0200 +Subject: serial: sh-sci: Fix (AUTO)RTS in sci_init_pins() + +From: Geert Uytterhoeven + +commit cfa6eb239154315e6efcdda1d929e024097f927b upstream. + +If a UART has dedicated RTS/CTS pins, and hardware control flow is +disabled (or AUTORTS is not yet effective), changing any serial port +configuration deasserts RTS, as .set_termios() calls sci_init_pins(). + +To fix this, consider the current (AUTO)RTS state when (re)initializing +the pins. Note that for SCIFA/SCIFB, AUTORTS needs explicit +configuration of the RTS# pin function, while (H)SCIF handles this +automatically. + +Fixes: d2b9775d795ec05f ("serial: sh-sci: Correct pin initialization on (H)SCIF") +Fixes: e9d7a45a03991349 ("serial: sh-sci: Add pin initialization for SCIFA/SCIFB") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/sh-sci.c | 25 +++++++++++++++++++------ + 1 file changed, 19 insertions(+), 6 deletions(-) + +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -683,24 +683,37 @@ static void sci_init_pins(struct uart_po + } + + if (port->type == PORT_SCIFA || port->type == PORT_SCIFB) { ++ u16 data = serial_port_in(port, SCPDR); + u16 ctrl = serial_port_in(port, SCPCR); + + /* Enable RXD and TXD pin functions */ + ctrl &= ~(SCPCR_RXDC | SCPCR_TXDC); + if (to_sci_port(port)->has_rtscts) { +- /* RTS# is output, driven 1 */ +- ctrl |= SCPCR_RTSC; +- serial_port_out(port, SCPDR, +- serial_port_in(port, SCPDR) | SCPDR_RTSD); ++ /* RTS# is output, active low, unless autorts */ ++ if (!(port->mctrl & TIOCM_RTS)) { ++ ctrl |= SCPCR_RTSC; ++ data |= SCPDR_RTSD; ++ } else if (!s->autorts) { ++ ctrl |= SCPCR_RTSC; ++ data &= ~SCPDR_RTSD; ++ } else { ++ /* Enable RTS# pin function */ ++ ctrl &= ~SCPCR_RTSC; ++ } + /* Enable CTS# pin function */ + ctrl &= ~SCPCR_CTSC; + } ++ serial_port_out(port, SCPDR, data); + serial_port_out(port, SCPCR, ctrl); + } else if (sci_getreg(port, SCSPTR)->size) { + u16 status = serial_port_in(port, SCSPTR); + +- /* RTS# is output, driven 1 */ +- status |= SCSPTR_RTSIO | SCSPTR_RTSDT; ++ /* RTS# is always output; and active low, unless autorts */ ++ status |= SCSPTR_RTSIO; ++ if (!(port->mctrl & TIOCM_RTS)) ++ status |= SCSPTR_RTSDT; ++ else if (!s->autorts) ++ status &= ~SCSPTR_RTSDT; + /* CTS# and SCK are inputs */ + status &= ~(SCSPTR_CTSIO | SCSPTR_SCKIO); + serial_port_out(port, SCSPTR, status); diff --git a/queue-4.11/serial-sh-sci-fix-late-enablement-of-autorts.patch b/queue-4.11/serial-sh-sci-fix-late-enablement-of-autorts.patch new file mode 100644 index 00000000000..b4551e01df6 --- /dev/null +++ b/queue-4.11/serial-sh-sci-fix-late-enablement-of-autorts.patch @@ -0,0 +1,44 @@ +From 5f76895e4c712b1b5af450cf344389b8c53ac2c2 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Tue, 28 Mar 2017 11:13:45 +0200 +Subject: serial: sh-sci: Fix late enablement of AUTORTS + +From: Geert Uytterhoeven + +commit 5f76895e4c712b1b5af450cf344389b8c53ac2c2 upstream. + +When changing hardware control flow for a UART with dedicated RTS/CTS +pins, the new AUTORTS state is not immediately reflected in the +hardware, but only when RTS is raised. However, the serial core does +not call .set_mctrl() after .set_termios(), hence AUTORTS may only +become effective when the port is closed, and reopened later. +Note that this problem does not happen when manually using stty to +change CRTSCTS, as AUTORTS will work fine on next open. + +To fix this, call .set_mctrl() from .set_termios() when dedicated +RTS/CTS pins are present, to refresh the AUTORTS or RTS state. +This is similar to what other drivers supporting AUTORTS do (e.g. +omap-serial). + +Reported-by: Baumann, Christoph (C.) +Fixes: 33f50ffc253854cf ("serial: sh-sci: Fix support for hardware-assisted RTS/CTS") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/sh-sci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -2389,6 +2389,10 @@ done: + + serial_port_out(port, SCFCR, ctrl); + } ++ if (port->flags & UPF_HARD_FLOW) { ++ /* Refresh (Auto) RTS */ ++ sci_set_mctrl(port, port->mctrl); ++ } + + scr_val |= SCSCR_RE | SCSCR_TE | + (s->cfg->scscr & ~(SCSCR_CKE1 | SCSCR_CKE0)); diff --git a/queue-4.11/series b/queue-4.11/series new file mode 100644 index 00000000000..255e8077b5f --- /dev/null +++ b/queue-4.11/series @@ -0,0 +1,56 @@ +fs-pass-on-flags-in-compat_writev.patch +configfs-fix-race-between-create_link-and-configfs_rmdir.patch +can-gs_usb-fix-memory-leak-in-gs_cmd_reset.patch +ila_xlat-add-missing-hash-secret-initialization.patch +cpufreq-conservative-allow-down_threshold-to-take-values-from-1-to-10.patch +vb2-fix-an-off-by-one-error-in-vb2_plane_vaddr.patch +cec-race-fix-don-t-return-enonet-in-cec_receive.patch +selinux-fix-double-free-in-selinux_parse_opts_str.patch +mac80211-don-t-look-at-the-pm-bit-of-bar-frames.patch +mac80211-wpa-use-constant-time-memory-comparison-for-macs.patch +drm-mxsfb_crtc-reset-the-elcdif-controller.patch +drm-amdgpu-fix-overflow-of-watermark-calcs-at-4k-resolutions.patch +drm-i915-fix-gvt-g-pvinfo-version-compatibility-check.patch +drm-i915-fix-scaling-check-for-90-270-degree-plane-rotation.patch +drm-i915-do-not-sync-rcu-during-shrinking.patch +mac80211-fix-ibss-presp-allocation-size.patch +mac80211-strictly-check-mesh-address-extension-mode.patch +mac80211-fix-dropped-counter-in-multiqueue-rx.patch +mac80211-don-t-send-smps-action-frame-in-ap-mode-when-not-needed.patch +drm-mediatek-fix-mtk_hdmi_setup_vendor_specific_infoframe-mistake.patch +drm-vc4-fix-oopses-from-trying-to-cache-a-partially-constructed-bo.patch +serial-efm32-fix-parity-management-in-efm32_uart_console_get_options.patch +serial-8250_lpss-unconditionally-set-pci-master-for-quark.patch +serial-sh-sci-fix-auto-rts-in-sci_init_pins.patch +serial-sh-sci-fix-late-enablement-of-autorts.patch +x86-mm-32-set-the-__vmalloc_start_set-flag-in-initmem_init.patch +mfd-omap-usb-tll-fix-inverted-bit-use-for-usb-tll-mode.patch +mfd-axp20x-add-support-for-dts-property-xpowers-master-mode.patch +dt-bindings-mfd-axp20x-add-xpowers-master-mode-property-for-axp806-pmics.patch +mfd-cpcap-fix-interrupt-to-use-level-interrupt.patch +mfd-cpcap-use-ack_invert-interrupts.patch +mfd-cpcap-fix-bad-use-of-irq-sense-register.patch +phy-rcar-gen3-usb2-fix-implementation-for-runtime-pm.patch +mtd-physmap_of-really-fix-the-physmap-add-ons.patch +powerpc-mm-add-physical-address-to-linux-page-table-dump.patch +staging-rtl8188eu-prevent-an-underflow-in-rtw_check_beacon_data.patch +staging-bcm2835-camera-fix-error-handling-in-init.patch +staging-iio-tsl2x7x_core-fix-standard-deviation-calculation.patch +iio-imu-st_lsm6dsx-do-not-apply-odr-configuration-in-write_raw-handler.patch +iio-proximity-as3935-recalibrate-rco-after-resume.patch +iio-adc-ti_am335x_adc-allocating-too-much-in-probe.patch +alsa-hda-add-geminilake-id-to-skl_plus.patch +alsa-usb-audio-fix-amanero-combo384-quirk-on-big-endian-hosts.patch +usb-gadget-udc-renesas_usb3-fix-pm_runtime-functions-calling.patch +usb-gadget-udc-renesas_usb3-fix-deadlock-by-spinlock.patch +usb-gadget-udc-renesas_usb3-lock-for-pn_-registers-access.patch +usb-hub-fix-ss-max-number-of-ports.patch +usb-core-fix-potential-memory-leak-in-error-path-during-hcd-creation.patch +usb-usbip-fix-nonconforming-hub-descriptor.patch +usb-dwc3-gadget-fix-iso-transfer-performance.patch +pvrusb2-reduce-stack-usage-pvr2_eeprom_analyze.patch +usb-gadget-dummy_hcd-fix-hub-descriptor-removable-fields.patch +usb-r8a66597-hcd-select-a-different-endpoint-on-timeout.patch +usb-r8a66597-hcd-decrease-timeout.patch +coda-restore-original-firmware-locations.patch +drivers-misc-c2port-c2port-duramar2150.c-checking-for-null-instead-of-is_err.patch diff --git a/queue-4.11/staging-bcm2835-camera-fix-error-handling-in-init.patch b/queue-4.11/staging-bcm2835-camera-fix-error-handling-in-init.patch new file mode 100644 index 00000000000..3d40f7e91e8 --- /dev/null +++ b/queue-4.11/staging-bcm2835-camera-fix-error-handling-in-init.patch @@ -0,0 +1,59 @@ +From 8e17858a8818b40d66e83de2bf3724c64eaad72d Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Sat, 18 Feb 2017 02:20:15 +0300 +Subject: staging: bcm2835-camera: fix error handling in init + +From: Dan Carpenter + +commit 8e17858a8818b40d66e83de2bf3724c64eaad72d upstream. + +The unwinding here isn't right. We don't free gdev[0] and instead +free 1 step past what was allocated. Also we can't allocate "dev" then +we should unwind instead of returning directly. + +Fixes: 7b3ad5abf027 ("staging: Import the BCM2835 MMAL-based V4L2 camera driver.") +Signed-off-by: Dan Carpenter +Acked-by: walter harms +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/media/platform/bcm2835/bcm2835-camera.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/drivers/staging/media/platform/bcm2835/bcm2835-camera.c ++++ b/drivers/staging/media/platform/bcm2835/bcm2835-camera.c +@@ -1901,6 +1901,7 @@ static int __init bm2835_mmal_init(void) + unsigned int num_cameras; + struct vchiq_mmal_instance *instance; + unsigned int resolutions[MAX_BCM2835_CAMERAS][2]; ++ int i; + + ret = vchiq_mmal_init(&instance); + if (ret < 0) +@@ -1914,8 +1915,10 @@ static int __init bm2835_mmal_init(void) + + for (camera = 0; camera < num_cameras; camera++) { + dev = kzalloc(sizeof(struct bm2835_mmal_dev), GFP_KERNEL); +- if (!dev) +- return -ENOMEM; ++ if (!dev) { ++ ret = -ENOMEM; ++ goto cleanup_gdev; ++ } + + dev->camera_num = camera; + dev->max_width = resolutions[camera][0]; +@@ -1998,9 +2001,10 @@ unreg_dev: + free_dev: + kfree(dev); + +- for ( ; camera > 0; camera--) { +- bcm2835_cleanup_instance(gdev[camera]); +- gdev[camera] = NULL; ++cleanup_gdev: ++ for (i = 0; i < camera; i++) { ++ bcm2835_cleanup_instance(gdev[i]); ++ gdev[i] = NULL; + } + pr_info("%s: error %d while loading driver\n", + BM2835_MMAL_MODULE_NAME, ret); diff --git a/queue-4.11/staging-iio-tsl2x7x_core-fix-standard-deviation-calculation.patch b/queue-4.11/staging-iio-tsl2x7x_core-fix-standard-deviation-calculation.patch new file mode 100644 index 00000000000..8a2256b163d --- /dev/null +++ b/queue-4.11/staging-iio-tsl2x7x_core-fix-standard-deviation-calculation.patch @@ -0,0 +1,34 @@ +From cf6c77323a96fc40309cc8a4921ef206cccdd961 Mon Sep 17 00:00:00 2001 +From: Eva Rachel Retuya +Date: Mon, 20 Mar 2017 19:27:05 +0800 +Subject: staging: iio: tsl2x7x_core: Fix standard deviation calculation + +From: Eva Rachel Retuya + +commit cf6c77323a96fc40309cc8a4921ef206cccdd961 upstream. + +Standard deviation is calculated as the square root of the variance +where variance is the mean of sample_sum and length. Correct the +computation of statP->stddev in accordance to the proper calculation. + +Fixes: 3c97c08b5735 ("staging: iio: add TAOS tsl2x7x driver") +Reported-by: Abhiram Balasubramanian +Signed-off-by: Eva Rachel Retuya +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/iio/light/tsl2x7x_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/iio/light/tsl2x7x_core.c ++++ b/drivers/staging/iio/light/tsl2x7x_core.c +@@ -854,7 +854,7 @@ void tsl2x7x_prox_calculate(int *data, i + tmp = data[i] - statP->mean; + sample_sum += tmp * tmp; + } +- statP->stddev = int_sqrt((long)sample_sum) / length; ++ statP->stddev = int_sqrt((long)sample_sum / length); + } + + /** diff --git a/queue-4.11/staging-rtl8188eu-prevent-an-underflow-in-rtw_check_beacon_data.patch b/queue-4.11/staging-rtl8188eu-prevent-an-underflow-in-rtw_check_beacon_data.patch new file mode 100644 index 00000000000..95e94e0038f --- /dev/null +++ b/queue-4.11/staging-rtl8188eu-prevent-an-underflow-in-rtw_check_beacon_data.patch @@ -0,0 +1,30 @@ +From 784047eb2d3405a35087af70cba46170c5576b25 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Sat, 22 Apr 2017 13:47:23 +0300 +Subject: staging: rtl8188eu: prevent an underflow in rtw_check_beacon_data() + +From: Dan Carpenter + +commit 784047eb2d3405a35087af70cba46170c5576b25 upstream. + +The "len" could be as low as -14 so we should check for negatives. + +Fixes: 9a7fe54ddc3a ("staging: r8188eu: Add source files for new driver - part 1") +Signed-off-by: Dan Carpenter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rtl8188eu/core/rtw_ap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/rtl8188eu/core/rtw_ap.c ++++ b/drivers/staging/rtl8188eu/core/rtw_ap.c +@@ -888,7 +888,7 @@ int rtw_check_beacon_data(struct adapter + return _FAIL; + + +- if (len > MAX_IE_SZ) ++ if (len < 0 || len > MAX_IE_SZ) + return _FAIL; + + pbss_network->IELength = len; diff --git a/queue-4.11/usb-core-fix-potential-memory-leak-in-error-path-during-hcd-creation.patch b/queue-4.11/usb-core-fix-potential-memory-leak-in-error-path-during-hcd-creation.patch new file mode 100644 index 00000000000..a34c100ec20 --- /dev/null +++ b/queue-4.11/usb-core-fix-potential-memory-leak-in-error-path-during-hcd-creation.patch @@ -0,0 +1,32 @@ +From 1a744d2eb76aaafb997fda004ae3ae62a1538f85 Mon Sep 17 00:00:00 2001 +From: Anton Bondarenko +Date: Sun, 7 May 2017 01:53:46 +0200 +Subject: usb: core: fix potential memory leak in error path during hcd creation + +From: Anton Bondarenko + +commit 1a744d2eb76aaafb997fda004ae3ae62a1538f85 upstream. + +Free memory allocated for address0_mutex if allocation of bandwidth_mutex +failed. + +Fixes: feb26ac31a2a ("usb: core: hub: hub_port_init lock controller instead of bus") + +Signed-off-by: Anton Bondarenko +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -2535,6 +2535,7 @@ struct usb_hcd *usb_create_shared_hcd(co + hcd->bandwidth_mutex = kmalloc(sizeof(*hcd->bandwidth_mutex), + GFP_KERNEL); + if (!hcd->bandwidth_mutex) { ++ kfree(hcd->address0_mutex); + kfree(hcd); + dev_dbg(dev, "hcd bandwidth mutex alloc failed\n"); + return NULL; diff --git a/queue-4.11/usb-dwc3-gadget-fix-iso-transfer-performance.patch b/queue-4.11/usb-dwc3-gadget-fix-iso-transfer-performance.patch new file mode 100644 index 00000000000..b019774c23b --- /dev/null +++ b/queue-4.11/usb-dwc3-gadget-fix-iso-transfer-performance.patch @@ -0,0 +1,56 @@ +From f1d6826cae30e97e37a1f2481d7e1dc4faa09ce1 Mon Sep 17 00:00:00 2001 +From: Roger Quadros +Date: Fri, 21 Apr 2017 15:58:08 +0300 +Subject: usb: dwc3: gadget: Fix ISO transfer performance + +From: Roger Quadros + +commit f1d6826cae30e97e37a1f2481d7e1dc4faa09ce1 upstream. + +Commit 08a36b543803 ("usb: dwc3: gadget: simplify __dwc3_gadget_ep_queue()") +caused a small change in the way ISO transfer is handled in the case +when XferInProgress event happens on Isoc EP with an active transfer. +This caused a performance degradation of 50%. e.g. using g_webcam on DUT +and luvcview on host the video frame rate dropped from 16fps to 8fps +@high-speed. + +Make the ISO transfer handling equivalent to that prior to that commit +to get back the original ISO performance numbers. + +Fixes: 08a36b543803 ("usb: dwc3: gadget: simplify __dwc3_gadget_ep_queue()") +Signed-off-by: Roger Quadros +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1258,14 +1258,24 @@ static int __dwc3_gadget_ep_queue(struct + __dwc3_gadget_start_isoc(dwc, dep, cur_uf); + dep->flags &= ~DWC3_EP_PENDING_REQUEST; + } ++ return 0; + } +- return 0; ++ ++ if ((dep->flags & DWC3_EP_BUSY) && ++ !(dep->flags & DWC3_EP_MISSED_ISOC)) { ++ WARN_ON_ONCE(!dep->resource_index); ++ ret = __dwc3_gadget_kick_transfer(dep, ++ dep->resource_index); ++ } ++ ++ goto out; + } + + if (!dwc3_calc_trbs_left(dep)) + return 0; + + ret = __dwc3_gadget_kick_transfer(dep, 0); ++out: + if (ret == -EBUSY) + ret = 0; + diff --git a/queue-4.11/usb-gadget-dummy_hcd-fix-hub-descriptor-removable-fields.patch b/queue-4.11/usb-gadget-dummy_hcd-fix-hub-descriptor-removable-fields.patch new file mode 100644 index 00000000000..27f6813794a --- /dev/null +++ b/queue-4.11/usb-gadget-dummy_hcd-fix-hub-descriptor-removable-fields.patch @@ -0,0 +1,51 @@ +From d81182ce30dbd497a1e7047d7fda2af040347790 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 10 May 2017 18:18:25 +0200 +Subject: USB: gadget: dummy_hcd: fix hub-descriptor removable fields + +From: Johan Hovold + +commit d81182ce30dbd497a1e7047d7fda2af040347790 upstream. + +Flag the first and only port as removable while also leaving the +remaining bits (including the reserved bit zero) unset in accordance +with the specifications: + + "Within a byte, if no port exists for a given location, the bit + field representing the port characteristics shall be 0." + +Also add a comment marking the legacy PortPwrCtrlMask field. + +Fixes: 1cd8fd2887e1 ("usb: gadget: dummy_hcd: add SuperSpeed support") +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: Tatyana Brokhman +Signed-off-by: Johan Hovold +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/dummy_hcd.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/usb/gadget/udc/dummy_hcd.c ++++ b/drivers/usb/gadget/udc/dummy_hcd.c +@@ -2008,7 +2008,7 @@ ss_hub_descriptor(struct usb_hub_descrip + HUB_CHAR_COMMON_OCPM); + desc->bNbrPorts = 1; + desc->u.ss.bHubHdrDecLat = 0x04; /* Worst case: 0.4 micro sec*/ +- desc->u.ss.DeviceRemovable = 0xffff; ++ desc->u.ss.DeviceRemovable = 0; + } + + static inline void hub_descriptor(struct usb_hub_descriptor *desc) +@@ -2020,8 +2020,8 @@ static inline void hub_descriptor(struct + HUB_CHAR_INDV_PORT_LPSM | + HUB_CHAR_COMMON_OCPM); + desc->bNbrPorts = 1; +- desc->u.hs.DeviceRemovable[0] = 0xff; +- desc->u.hs.DeviceRemovable[1] = 0xff; ++ desc->u.hs.DeviceRemovable[0] = 0; ++ desc->u.hs.DeviceRemovable[1] = 0xff; /* PortPwrCtrlMask */ + } + + static int dummy_hub_control( diff --git a/queue-4.11/usb-gadget-udc-renesas_usb3-fix-deadlock-by-spinlock.patch b/queue-4.11/usb-gadget-udc-renesas_usb3-fix-deadlock-by-spinlock.patch new file mode 100644 index 00000000000..7d814219a5f --- /dev/null +++ b/queue-4.11/usb-gadget-udc-renesas_usb3-fix-deadlock-by-spinlock.patch @@ -0,0 +1,40 @@ +From 067d6fdc558d2c43f0bfdc7af99630dd5eb08dc5 Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Wed, 26 Apr 2017 20:50:08 +0900 +Subject: usb: gadget: udc: renesas_usb3: fix deadlock by spinlock + +From: Yoshihiro Shimoda + +commit 067d6fdc558d2c43f0bfdc7af99630dd5eb08dc5 upstream. + +This patch fixes an issue that this driver is possible to cause +deadlock by double-spinclocked in renesas_usb3_stop_controller(). +So, this patch removes spinlock API calling in renesas_usb3_stop(). +(In other words, the previous code had a redundant lock.) + +Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller") +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/renesas_usb3.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -1718,14 +1718,11 @@ static int renesas_usb3_start(struct usb + static int renesas_usb3_stop(struct usb_gadget *gadget) + { + struct renesas_usb3 *usb3 = gadget_to_renesas_usb3(gadget); +- unsigned long flags; + +- spin_lock_irqsave(&usb3->lock, flags); + usb3->softconnect = false; + usb3->gadget.speed = USB_SPEED_UNKNOWN; + usb3->driver = NULL; + renesas_usb3_stop_controller(usb3); +- spin_unlock_irqrestore(&usb3->lock, flags); + + pm_runtime_put(usb3_to_dev(usb3)); + pm_runtime_disable(usb3_to_dev(usb3)); diff --git a/queue-4.11/usb-gadget-udc-renesas_usb3-fix-pm_runtime-functions-calling.patch b/queue-4.11/usb-gadget-udc-renesas_usb3-fix-pm_runtime-functions-calling.patch new file mode 100644 index 00000000000..589eaff8aae --- /dev/null +++ b/queue-4.11/usb-gadget-udc-renesas_usb3-fix-pm_runtime-functions-calling.patch @@ -0,0 +1,66 @@ +From cdc876877ebc3f0677b267756d4564e2a429e730 Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Wed, 26 Apr 2017 20:50:07 +0900 +Subject: usb: gadget: udc: renesas_usb3: fix pm_runtime functions calling + +From: Yoshihiro Shimoda + +commit cdc876877ebc3f0677b267756d4564e2a429e730 upstream. + +This patch fixes an issue that this driver is possible to access +the registers before pm_runtime_get_sync() if a gadget driver is +installed first. After that, oops happens on R-Car Gen3 environment. +To avoid it, this patch changes the pm_runtime call timing from +probe/remove to udc_start/udc_stop. + +Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller") +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/renesas_usb3.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -1707,6 +1707,9 @@ static int renesas_usb3_start(struct usb + /* hook up the driver */ + usb3->driver = driver; + ++ pm_runtime_enable(usb3_to_dev(usb3)); ++ pm_runtime_get_sync(usb3_to_dev(usb3)); ++ + renesas_usb3_init_controller(usb3); + + return 0; +@@ -1724,6 +1727,9 @@ static int renesas_usb3_stop(struct usb_ + renesas_usb3_stop_controller(usb3); + spin_unlock_irqrestore(&usb3->lock, flags); + ++ pm_runtime_put(usb3_to_dev(usb3)); ++ pm_runtime_disable(usb3_to_dev(usb3)); ++ + return 0; + } + +@@ -1761,9 +1767,6 @@ static int renesas_usb3_remove(struct pl + { + struct renesas_usb3 *usb3 = platform_get_drvdata(pdev); + +- pm_runtime_put(&pdev->dev); +- pm_runtime_disable(&pdev->dev); +- + usb_del_gadget_udc(&usb3->gadget); + + __renesas_usb3_ep_free_request(usb3->ep0_req); +@@ -1948,9 +1951,6 @@ static int renesas_usb3_probe(struct pla + + usb3->workaround_for_vbus = priv->workaround_for_vbus; + +- pm_runtime_enable(&pdev->dev); +- pm_runtime_get_sync(&pdev->dev); +- + dev_info(&pdev->dev, "probed\n"); + + return 0; diff --git a/queue-4.11/usb-gadget-udc-renesas_usb3-lock-for-pn_-registers-access.patch b/queue-4.11/usb-gadget-udc-renesas_usb3-lock-for-pn_-registers-access.patch new file mode 100644 index 00000000000..771b45c79eb --- /dev/null +++ b/queue-4.11/usb-gadget-udc-renesas_usb3-lock-for-pn_-registers-access.patch @@ -0,0 +1,88 @@ +From 940f538a100c84c6e72813e4ac88bd1753a86945 Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Wed, 26 Apr 2017 20:50:09 +0900 +Subject: usb: gadget: udc: renesas_usb3: lock for PN_ registers access + +From: Yoshihiro Shimoda + +commit 940f538a100c84c6e72813e4ac88bd1753a86945 upstream. + +This controller disallows to change the PIPE until reading/writing +a packet finishes. However. the previous code is not enough to hold +the lock in some functions. So, this patch fixes it. + +Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller") +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/renesas_usb3.c | 28 +++++++++++++++++++++++++--- + 1 file changed, 25 insertions(+), 3 deletions(-) + +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -1401,7 +1401,13 @@ static void usb3_request_done_pipen(stru + struct renesas_usb3_request *usb3_req, + int status) + { +- usb3_pn_stop(usb3); ++ unsigned long flags; ++ ++ spin_lock_irqsave(&usb3->lock, flags); ++ if (usb3_pn_change(usb3, usb3_ep->num)) ++ usb3_pn_stop(usb3); ++ spin_unlock_irqrestore(&usb3->lock, flags); ++ + usb3_disable_pipe_irq(usb3, usb3_ep->num); + usb3_request_done(usb3_ep, usb3_req, status); + +@@ -1430,30 +1436,46 @@ static void usb3_irq_epc_pipen_bfrdy(str + { + struct renesas_usb3_ep *usb3_ep = usb3_get_ep(usb3, num); + struct renesas_usb3_request *usb3_req = usb3_get_request(usb3_ep); ++ bool done = false; + + if (!usb3_req) + return; + ++ spin_lock(&usb3->lock); ++ if (usb3_pn_change(usb3, num)) ++ goto out; ++ + if (usb3_ep->dir_in) { + /* Do not stop the IN pipe here to detect LSTTR interrupt */ + if (!usb3_write_pipe(usb3_ep, usb3_req, USB3_PN_WRITE)) + usb3_clear_bit(usb3, PN_INT_BFRDY, USB3_PN_INT_ENA); + } else { + if (!usb3_read_pipe(usb3_ep, usb3_req, USB3_PN_READ)) +- usb3_request_done_pipen(usb3, usb3_ep, usb3_req, 0); ++ done = true; + } ++ ++out: ++ /* need to unlock because usb3_request_done_pipen() locks it */ ++ spin_unlock(&usb3->lock); ++ ++ if (done) ++ usb3_request_done_pipen(usb3, usb3_ep, usb3_req, 0); + } + + static void usb3_irq_epc_pipen(struct renesas_usb3 *usb3, int num) + { + u32 pn_int_sta; + +- if (usb3_pn_change(usb3, num) < 0) ++ spin_lock(&usb3->lock); ++ if (usb3_pn_change(usb3, num) < 0) { ++ spin_unlock(&usb3->lock); + return; ++ } + + pn_int_sta = usb3_read(usb3, USB3_PN_INT_STA); + pn_int_sta &= usb3_read(usb3, USB3_PN_INT_ENA); + usb3_write(usb3, pn_int_sta, USB3_PN_INT_STA); ++ spin_unlock(&usb3->lock); + if (pn_int_sta & PN_INT_LSTTR) + usb3_irq_epc_pipen_lsttr(usb3, num); + if (pn_int_sta & PN_INT_BFRDY) diff --git a/queue-4.11/usb-hub-fix-ss-max-number-of-ports.patch b/queue-4.11/usb-hub-fix-ss-max-number-of-ports.patch new file mode 100644 index 00000000000..743ed906287 --- /dev/null +++ b/queue-4.11/usb-hub-fix-ss-max-number-of-ports.patch @@ -0,0 +1,55 @@ +From 93491ced3c87c94b12220dbac0527e1356702179 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 10 May 2017 18:18:29 +0200 +Subject: USB: hub: fix SS max number of ports + +From: Johan Hovold + +commit 93491ced3c87c94b12220dbac0527e1356702179 upstream. + +Add define for the maximum number of ports on a SuperSpeed hub as per +USB 3.1 spec Table 10-5, and use it when verifying the retrieved hub +descriptor. + +This specifically avoids benign attempts to update the DeviceRemovable +mask for non-existing ports (should we get that far). + +Fixes: dbe79bbe9dcb ("USB 3.0 Hub Changes") +Acked-by: Alan Stern +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 8 +++++++- + include/uapi/linux/usb/ch11.h | 3 +++ + 2 files changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1336,7 +1336,13 @@ static int hub_configure(struct usb_hub + if (ret < 0) { + message = "can't read hub descriptor"; + goto fail; +- } else if (hub->descriptor->bNbrPorts > USB_MAXCHILDREN) { ++ } ++ ++ maxchild = USB_MAXCHILDREN; ++ if (hub_is_superspeed(hdev)) ++ maxchild = min_t(unsigned, maxchild, USB_SS_MAXPORTS); ++ ++ if (hub->descriptor->bNbrPorts > maxchild) { + message = "hub has too many ports!"; + ret = -ENODEV; + goto fail; +--- a/include/uapi/linux/usb/ch11.h ++++ b/include/uapi/linux/usb/ch11.h +@@ -22,6 +22,9 @@ + */ + #define USB_MAXCHILDREN 31 + ++/* See USB 3.1 spec Table 10-5 */ ++#define USB_SS_MAXPORTS 15 ++ + /* + * Hub request types + */ diff --git a/queue-4.11/usb-r8a66597-hcd-decrease-timeout.patch b/queue-4.11/usb-r8a66597-hcd-decrease-timeout.patch new file mode 100644 index 00000000000..49886d8fac2 --- /dev/null +++ b/queue-4.11/usb-r8a66597-hcd-decrease-timeout.patch @@ -0,0 +1,32 @@ +From dd14a3e9b92ac6f0918054f9e3477438760a4fa6 Mon Sep 17 00:00:00 2001 +From: Chris Brandt +Date: Thu, 27 Apr 2017 12:12:49 -0700 +Subject: usb: r8a66597-hcd: decrease timeout + +From: Chris Brandt + +commit dd14a3e9b92ac6f0918054f9e3477438760a4fa6 upstream. + +The timeout for BULK packets was 300ms which is a long time if other +endpoints or devices are waiting for their turn. Changing it to 50ms +greatly increased the overall performance for multi-endpoint devices. + +Fixes: 5d3043586db4 ("usb: r8a66597-hcd: host controller driver for R8A6659") +Signed-off-by: Chris Brandt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/r8a66597-hcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/r8a66597-hcd.c ++++ b/drivers/usb/host/r8a66597-hcd.c +@@ -1269,7 +1269,7 @@ static void set_td_timer(struct r8a66597 + time = 30; + break; + default: +- time = 300; ++ time = 50; + break; + } + diff --git a/queue-4.11/usb-r8a66597-hcd-select-a-different-endpoint-on-timeout.patch b/queue-4.11/usb-r8a66597-hcd-select-a-different-endpoint-on-timeout.patch new file mode 100644 index 00000000000..39eda60b955 --- /dev/null +++ b/queue-4.11/usb-r8a66597-hcd-select-a-different-endpoint-on-timeout.patch @@ -0,0 +1,45 @@ +From 1f873d857b6c2fefb4dada952674aa01bcfb92bd Mon Sep 17 00:00:00 2001 +From: Chris Brandt +Date: Thu, 27 Apr 2017 12:12:02 -0700 +Subject: usb: r8a66597-hcd: select a different endpoint on timeout + +From: Chris Brandt + +commit 1f873d857b6c2fefb4dada952674aa01bcfb92bd upstream. + +If multiple endpoints on a single device have pending IN URBs and one +endpoint times out due to NAKs (perfectly legal), select a different +endpoint URB to try. +The existing code only checked to see another device address has pending +URBs and ignores other IN endpoints on the current device address. This +leads to endpoints never getting serviced if one endpoint is using NAK as +a flow control method. + +Fixes: 5d3043586db4 ("usb: r8a66597-hcd: host controller driver for R8A6659") +Signed-off-by: Chris Brandt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/r8a66597-hcd.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/r8a66597-hcd.c ++++ b/drivers/usb/host/r8a66597-hcd.c +@@ -1785,6 +1785,7 @@ static void r8a66597_td_timer(unsigned l + pipe = td->pipe; + pipe_stop(r8a66597, pipe); + ++ /* Select a different address or endpoint */ + new_td = td; + do { + list_move_tail(&new_td->queue, +@@ -1794,7 +1795,8 @@ static void r8a66597_td_timer(unsigned l + new_td = td; + break; + } +- } while (td != new_td && td->address == new_td->address); ++ } while (td != new_td && td->address == new_td->address && ++ td->pipe->info.epnum == new_td->pipe->info.epnum); + + start_transfer(r8a66597, new_td); + diff --git a/queue-4.11/usb-usbip-fix-nonconforming-hub-descriptor.patch b/queue-4.11/usb-usbip-fix-nonconforming-hub-descriptor.patch new file mode 100644 index 00000000000..264717e5adc --- /dev/null +++ b/queue-4.11/usb-usbip-fix-nonconforming-hub-descriptor.patch @@ -0,0 +1,56 @@ +From ec963b412a54aac8e527708ecad06a6988a86fb4 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 10 May 2017 18:18:26 +0200 +Subject: USB: usbip: fix nonconforming hub descriptor + +From: Johan Hovold + +commit ec963b412a54aac8e527708ecad06a6988a86fb4 upstream. + +Fix up the root-hub descriptor to accommodate the variable-length +DeviceRemovable and PortPwrCtrlMask fields, while marking all ports as +removable (and leaving the reserved bit zero unset). + +Also add a build-time constraint on VHCI_HC_PORTS which must never be +greater than USB_MAXCHILDREN (but this was only enforced through a +KConfig constant). + +This specifically fixes the descriptor layout whenever VHCI_HC_PORTS is +greater than seven (default is 8). + +Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver") +Cc: Takahiro Hirofuchi +Cc: Valentina Manea +Signed-off-by: Johan Hovold +Acked-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/usbip/vhci_hcd.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -235,14 +235,19 @@ done: + + static inline void hub_descriptor(struct usb_hub_descriptor *desc) + { ++ int width; ++ + memset(desc, 0, sizeof(*desc)); + desc->bDescriptorType = USB_DT_HUB; +- desc->bDescLength = 9; + desc->wHubCharacteristics = cpu_to_le16( + HUB_CHAR_INDV_PORT_LPSM | HUB_CHAR_COMMON_OCPM); ++ + desc->bNbrPorts = VHCI_HC_PORTS; +- desc->u.hs.DeviceRemovable[0] = 0xff; +- desc->u.hs.DeviceRemovable[1] = 0xff; ++ BUILD_BUG_ON(VHCI_HC_PORTS > USB_MAXCHILDREN); ++ width = desc->bNbrPorts / 8 + 1; ++ desc->bDescLength = USB_DT_HUB_NONVAR_SIZE + 2 * width; ++ memset(&desc->u.hs.DeviceRemovable[0], 0, width); ++ memset(&desc->u.hs.DeviceRemovable[width], 0xff, width); + } + + static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, diff --git a/queue-4.11/vb2-fix-an-off-by-one-error-in-vb2_plane_vaddr.patch b/queue-4.11/vb2-fix-an-off-by-one-error-in-vb2_plane_vaddr.patch new file mode 100644 index 00000000000..995fe058ce4 --- /dev/null +++ b/queue-4.11/vb2-fix-an-off-by-one-error-in-vb2_plane_vaddr.patch @@ -0,0 +1,35 @@ +From 5ebb6dd36c9f5fb37b1077b393c254d70a14cb46 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Fri, 28 Apr 2017 01:51:40 -0300 +Subject: [media] vb2: Fix an off by one error in 'vb2_plane_vaddr' + +From: Christophe JAILLET + +commit 5ebb6dd36c9f5fb37b1077b393c254d70a14cb46 upstream. + +We should ensure that 'plane_no' is '< vb->num_planes' as done in +'vb2_plane_cookie' just a few lines below. + +Fixes: e23ccc0ad925 ("[media] v4l: add videobuf2 Video for Linux 2 driver framework") + +Signed-off-by: Christophe JAILLET +Reviewed-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/v4l2-core/videobuf2-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -868,7 +868,7 @@ EXPORT_SYMBOL_GPL(vb2_core_create_bufs); + + void *vb2_plane_vaddr(struct vb2_buffer *vb, unsigned int plane_no) + { +- if (plane_no > vb->num_planes || !vb->planes[plane_no].mem_priv) ++ if (plane_no >= vb->num_planes || !vb->planes[plane_no].mem_priv) + return NULL; + + return call_ptr_memop(vb, vaddr, vb->planes[plane_no].mem_priv); diff --git a/queue-4.11/x86-mm-32-set-the-__vmalloc_start_set-flag-in-initmem_init.patch b/queue-4.11/x86-mm-32-set-the-__vmalloc_start_set-flag-in-initmem_init.patch new file mode 100644 index 00000000000..8ff66e5d4c0 --- /dev/null +++ b/queue-4.11/x86-mm-32-set-the-__vmalloc_start_set-flag-in-initmem_init.patch @@ -0,0 +1,42 @@ +From 861ce4a3244c21b0af64f880d5bfe5e6e2fb9e4a Mon Sep 17 00:00:00 2001 +From: Laura Abbott +Date: Mon, 8 May 2017 14:23:16 -0700 +Subject: x86/mm/32: Set the '__vmalloc_start_set' flag in initmem_init() + +From: Laura Abbott + +commit 861ce4a3244c21b0af64f880d5bfe5e6e2fb9e4a upstream. + +'__vmalloc_start_set' currently only gets set in initmem_init() when +!CONFIG_NEED_MULTIPLE_NODES. This breaks detection of vmalloc address +with virt_addr_valid() with CONFIG_NEED_MULTIPLE_NODES=y, causing +a kernel crash: + + [mm/usercopy] 517e1fbeb6: kernel BUG at arch/x86/mm/physaddr.c:78! + +Set '__vmalloc_start_set' appropriately for that case as well. + +Reported-by: kbuild test robot +Signed-off-by: Laura Abbott +Reviewed-by: Kees Cook +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Fixes: dc16ecf7fd1f ("x86-32: use specific __vmalloc_start_set flag in __virt_addr_valid") +Link: http://lkml.kernel.org/r/1494278596-30373-1-git-send-email-labbott@redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/mm/numa_32.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/x86/mm/numa_32.c ++++ b/arch/x86/mm/numa_32.c +@@ -100,5 +100,6 @@ void __init initmem_init(void) + printk(KERN_DEBUG "High memory starts at vaddr %08lx\n", + (ulong) pfn_to_kaddr(highstart_pfn)); + ++ __vmalloc_start_set = true; + setup_bootmem_allocator(); + } diff --git a/queue-4.4/series b/queue-4.4/series new file mode 100644 index 00000000000..4c3e09c2f5c --- /dev/null +++ b/queue-4.4/series @@ -0,0 +1,20 @@ +configfs-fix-race-between-create_link-and-configfs_rmdir.patch +can-gs_usb-fix-memory-leak-in-gs_cmd_reset.patch +cpufreq-conservative-allow-down_threshold-to-take-values-from-1-to-10.patch +vb2-fix-an-off-by-one-error-in-vb2_plane_vaddr.patch +mac80211-don-t-look-at-the-pm-bit-of-bar-frames.patch +mac80211-wpa-use-constant-time-memory-comparison-for-macs.patch +mac80211-fix-csa-in-ibss-mode.patch +mac80211-fix-ibss-presp-allocation-size.patch +serial-efm32-fix-parity-management-in-efm32_uart_console_get_options.patch +x86-mm-32-set-the-__vmalloc_start_set-flag-in-initmem_init.patch +mfd-omap-usb-tll-fix-inverted-bit-use-for-usb-tll-mode.patch +staging-rtl8188eu-prevent-an-underflow-in-rtw_check_beacon_data.patch +iio-proximity-as3935-recalibrate-rco-after-resume.patch +usb-hub-fix-ss-max-number-of-ports.patch +usb-core-fix-potential-memory-leak-in-error-path-during-hcd-creation.patch +pvrusb2-reduce-stack-usage-pvr2_eeprom_analyze.patch +usb-gadget-dummy_hcd-fix-hub-descriptor-removable-fields.patch +usb-r8a66597-hcd-select-a-different-endpoint-on-timeout.patch +usb-r8a66597-hcd-decrease-timeout.patch +drivers-misc-c2port-c2port-duramar2150.c-checking-for-null-instead-of-is_err.patch diff --git a/queue-4.9/series b/queue-4.9/series new file mode 100644 index 00000000000..086ee261ad5 --- /dev/null +++ b/queue-4.9/series @@ -0,0 +1,42 @@ +fs-pass-on-flags-in-compat_writev.patch +configfs-fix-race-between-create_link-and-configfs_rmdir.patch +can-gs_usb-fix-memory-leak-in-gs_cmd_reset.patch +ila_xlat-add-missing-hash-secret-initialization.patch +cpufreq-conservative-allow-down_threshold-to-take-values-from-1-to-10.patch +vb2-fix-an-off-by-one-error-in-vb2_plane_vaddr.patch +mac80211-don-t-look-at-the-pm-bit-of-bar-frames.patch +mac80211-wpa-use-constant-time-memory-comparison-for-macs.patch +drm-amdgpu-fix-overflow-of-watermark-calcs-at-4k-resolutions.patch +drm-i915-fix-gvt-g-pvinfo-version-compatibility-check.patch +usb-musb-dsps-keep-vbus-on-for-host-only-mode.patch +mac80211-fix-csa-in-ibss-mode.patch +mac80211-fix-packet-statistics-for-fast-rx.patch +mac80211-fix-ibss-presp-allocation-size.patch +mac80211-strictly-check-mesh-address-extension-mode.patch +mac80211-fix-dropped-counter-in-multiqueue-rx.patch +mac80211-don-t-send-smps-action-frame-in-ap-mode-when-not-needed.patch +drm-mediatek-fix-mtk_hdmi_setup_vendor_specific_infoframe-mistake.patch +drm-vc4-fix-oopses-from-trying-to-cache-a-partially-constructed-bo.patch +serial-efm32-fix-parity-management-in-efm32_uart_console_get_options.patch +serial-sh-sci-fix-late-enablement-of-autorts.patch +x86-mm-32-set-the-__vmalloc_start_set-flag-in-initmem_init.patch +mfd-omap-usb-tll-fix-inverted-bit-use-for-usb-tll-mode.patch +staging-rtl8188eu-prevent-an-underflow-in-rtw_check_beacon_data.patch +staging-iio-tsl2x7x_core-fix-standard-deviation-calculation.patch +iio-st_pressure-fix-data-sign.patch +iio-proximity-as3935-recalibrate-rco-after-resume.patch +iio-adc-ti_am335x_adc-allocating-too-much-in-probe.patch +ib-mlx5-fix-kernel-to-user-leak-prevention-logic.patch +usb-gadget-udc-renesas_usb3-fix-pm_runtime-functions-calling.patch +usb-gadget-udc-renesas_usb3-fix-deadlock-by-spinlock.patch +usb-gadget-udc-renesas_usb3-lock-for-pn_-registers-access.patch +usb-hub-fix-ss-max-number-of-ports.patch +usb-core-fix-potential-memory-leak-in-error-path-during-hcd-creation.patch +usb-usbip-fix-nonconforming-hub-descriptor.patch +pvrusb2-reduce-stack-usage-pvr2_eeprom_analyze.patch +usb-gadget-dummy_hcd-fix-hub-descriptor-removable-fields.patch +usb-r8a66597-hcd-select-a-different-endpoint-on-timeout.patch +usb-r8a66597-hcd-decrease-timeout.patch +ath10k-fix-napi-crash-during-rmmod-when-probe-firmware-fails.patch +misc-mic-double-free-on-ioctl-error-path.patch +drivers-misc-c2port-c2port-duramar2150.c-checking-for-null-instead-of-is_err.patch