From c1ac4ad220e2245e2f44f0c1d93a80cf55f12cae Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 15 Nov 2016 20:08:42 +0100 Subject: [PATCH] 4.4-stable patches added patches: arc-timer-rtc-implement-read-loop-in-c-vs.-inline-asm.patch clk-qoriq-don-t-allow-cpu-clocks-higher-than-starting-value.patch coredump-fix-unfreezable-coredumping-task.patch drbd-fix-kernel_sendmsg-usage-potential-null-deref.patch drivers-staging-nvec-remove-bogus-reset-command-for-ps-2-interface.patch drm-amdgpu-disable-runtime-pm-in-certain-cases.patch drm-i915-respect-alternate_ddc_pin-for-all-ddi-ports.patch drm-radeon-disable-runtime-pm-in-certain-cases.patch iio-hid-sensors-increase-the-precision-of-scale-to-fix-wrong-reading-interpretation.patch iio-orientation-hid-sensor-rotation-add-pm-function-fix-non-working-driver.patch kvm-mips-precalculate-mmio-load-resume-pc.patch pinctrl-cherryview-prevent-possible-interrupt-storm-on-resume.patch pinctrl-cherryview-serialize-register-access-in-suspend-resume.patch revert-staging-nvec-ps2-change-serio-type-to-passthrough.patch s390-hypfs-use-get_free_page-instead-of-kmalloc-to-ensure-page-alignment.patch scsi-mpt3sas-fix-for-block-device-of-raid-exists-even-after-deleting-raid-disk.patch scsi-qla2xxx-fix-scsi-scan-hang-triggered-if-adapter-fails-during-init.patch staging-iio-ad5933-avoid-uninitialized-variable-in-error-case.patch staging-nvec-remove-managed-resource-from-ps2-driver.patch swapfile-fix-memory-corruption-via-malformed-swapfile.patch toshiba-wmi-fix-loading-the-driver-on-non-toshiba-laptops.patch usb-cdc-acm-fix-tiocmiwait.patch usb-gadget-u_ether-remove-interrupt-throttling.patch --- ...lement-read-loop-in-c-vs.-inline-asm.patch | 52 ++++++ ...pu-clocks-higher-than-starting-value.patch | 86 +++++++++ ...ump-fix-unfreezable-coredumping-task.patch | 57 ++++++ ...l_sendmsg-usage-potential-null-deref.patch | 77 ++++++++ ...gus-reset-command-for-ps-2-interface.patch | 44 +++++ ...-disable-runtime-pm-in-certain-cases.patch | 34 ++++ ...-alternate_ddc_pin-for-all-ddi-ports.patch | 163 +++++++++++++++++ ...-disable-runtime-pm-in-certain-cases.patch | 54 ++++++ ...-to-fix-wrong-reading-interpretation.patch | 166 ++++++++++++++++++ ...d-pm-function-fix-non-working-driver.patch | 42 +++++ ...ips-precalculate-mmio-load-resume-pc.patch | 119 +++++++++++++ ...t-possible-interrupt-storm-on-resume.patch | 74 ++++++++ ...ze-register-access-in-suspend-resume.patch | 66 +++++++ ...ps2-change-serio-type-to-passthrough.patch | 48 +++++ ...-of-kmalloc-to-ensure-page-alignment.patch | 59 +++++++ ...exists-even-after-deleting-raid-disk.patch | 57 ++++++ ...iggered-if-adapter-fails-during-init.patch | 80 +++++++++ queue-4.4/series | 23 +++ ...uninitialized-variable-in-error-case.patch | 86 +++++++++ ...ove-managed-resource-from-ps2-driver.patch | 33 ++++ ...ry-corruption-via-malformed-swapfile.patch | 45 +++++ ...ng-the-driver-on-non-toshiba-laptops.patch | 110 ++++++++++++ queue-4.4/usb-cdc-acm-fix-tiocmiwait.patch | 36 ++++ ...-u_ether-remove-interrupt-throttling.patch | 50 ++++++ 24 files changed, 1661 insertions(+) create mode 100644 queue-4.4/arc-timer-rtc-implement-read-loop-in-c-vs.-inline-asm.patch create mode 100644 queue-4.4/clk-qoriq-don-t-allow-cpu-clocks-higher-than-starting-value.patch create mode 100644 queue-4.4/coredump-fix-unfreezable-coredumping-task.patch create mode 100644 queue-4.4/drbd-fix-kernel_sendmsg-usage-potential-null-deref.patch create mode 100644 queue-4.4/drivers-staging-nvec-remove-bogus-reset-command-for-ps-2-interface.patch create mode 100644 queue-4.4/drm-amdgpu-disable-runtime-pm-in-certain-cases.patch create mode 100644 queue-4.4/drm-i915-respect-alternate_ddc_pin-for-all-ddi-ports.patch create mode 100644 queue-4.4/drm-radeon-disable-runtime-pm-in-certain-cases.patch create mode 100644 queue-4.4/iio-hid-sensors-increase-the-precision-of-scale-to-fix-wrong-reading-interpretation.patch create mode 100644 queue-4.4/iio-orientation-hid-sensor-rotation-add-pm-function-fix-non-working-driver.patch create mode 100644 queue-4.4/kvm-mips-precalculate-mmio-load-resume-pc.patch create mode 100644 queue-4.4/pinctrl-cherryview-prevent-possible-interrupt-storm-on-resume.patch create mode 100644 queue-4.4/pinctrl-cherryview-serialize-register-access-in-suspend-resume.patch create mode 100644 queue-4.4/revert-staging-nvec-ps2-change-serio-type-to-passthrough.patch create mode 100644 queue-4.4/s390-hypfs-use-get_free_page-instead-of-kmalloc-to-ensure-page-alignment.patch create mode 100644 queue-4.4/scsi-mpt3sas-fix-for-block-device-of-raid-exists-even-after-deleting-raid-disk.patch create mode 100644 queue-4.4/scsi-qla2xxx-fix-scsi-scan-hang-triggered-if-adapter-fails-during-init.patch create mode 100644 queue-4.4/staging-iio-ad5933-avoid-uninitialized-variable-in-error-case.patch create mode 100644 queue-4.4/staging-nvec-remove-managed-resource-from-ps2-driver.patch create mode 100644 queue-4.4/swapfile-fix-memory-corruption-via-malformed-swapfile.patch create mode 100644 queue-4.4/toshiba-wmi-fix-loading-the-driver-on-non-toshiba-laptops.patch create mode 100644 queue-4.4/usb-cdc-acm-fix-tiocmiwait.patch create mode 100644 queue-4.4/usb-gadget-u_ether-remove-interrupt-throttling.patch diff --git a/queue-4.4/arc-timer-rtc-implement-read-loop-in-c-vs.-inline-asm.patch b/queue-4.4/arc-timer-rtc-implement-read-loop-in-c-vs.-inline-asm.patch new file mode 100644 index 00000000000..1b405717c6a --- /dev/null +++ b/queue-4.4/arc-timer-rtc-implement-read-loop-in-c-vs.-inline-asm.patch @@ -0,0 +1,52 @@ +From 922cc171998ac3dbe74d57011ef7ed57e9b0d7df Mon Sep 17 00:00:00 2001 +From: Vineet Gupta +Date: Mon, 31 Oct 2016 14:09:52 -0700 +Subject: ARC: timer: rtc: implement read loop in "C" vs. inline asm + +From: Vineet Gupta + +commit 922cc171998ac3dbe74d57011ef7ed57e9b0d7df upstream. + +The current code doesn't even compile as somehow the inline assembly +can't see the register names defined as ARC_RTC_* +I'm pretty sure It worked when I first got it merged, but the tools were +definitely different then. + +So better to write this in "C" anyways. + +Acked-by: Daniel Lezcano +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/kernel/time.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +--- a/arch/arc/kernel/time.c ++++ b/arch/arc/kernel/time.c +@@ -130,14 +130,17 @@ static cycle_t arc_counter_read(struct c + cycle_t full; + } stamp; + +- +- __asm__ __volatile( +- "1: \n" +- " lr %0, [AUX_RTC_LOW] \n" +- " lr %1, [AUX_RTC_HIGH] \n" +- " lr %2, [AUX_RTC_CTRL] \n" +- " bbit0.nt %2, 31, 1b \n" +- : "=r" (stamp.low), "=r" (stamp.high), "=r" (status)); ++ /* ++ * hardware has an internal state machine which tracks readout of ++ * low/high and updates the CTRL.status if ++ * - interrupt/exception taken between the two reads ++ * - high increments after low has been read ++ */ ++ do { ++ stamp.low = read_aux_reg(AUX_RTC_LOW); ++ stamp.high = read_aux_reg(AUX_RTC_HIGH); ++ status = read_aux_reg(AUX_RTC_CTRL); ++ } while (!(status & _BITUL(31))); + + return stamp.full; + } diff --git a/queue-4.4/clk-qoriq-don-t-allow-cpu-clocks-higher-than-starting-value.patch b/queue-4.4/clk-qoriq-don-t-allow-cpu-clocks-higher-than-starting-value.patch new file mode 100644 index 00000000000..0259095ecde --- /dev/null +++ b/queue-4.4/clk-qoriq-don-t-allow-cpu-clocks-higher-than-starting-value.patch @@ -0,0 +1,86 @@ +From 7c1c5413a7bdf1c9adc8d979521f1b8286366aef Mon Sep 17 00:00:00 2001 +From: Scott Wood +Date: Mon, 17 Oct 2016 13:42:23 -0500 +Subject: clk: qoriq: Don't allow CPU clocks higher than starting value + +From: Scott Wood + +commit 7c1c5413a7bdf1c9adc8d979521f1b8286366aef upstream. + +The boot-time frequency of a CPU is considered its rated maximum, as we +have no other source of such information. However, this was previously +only used for chips with 80% restrictions on secondary PLLs. This +usually wasn't a problem because most chips/configs boot with a divider +of /1, with other dividers being used only for dynamic frequency +reduction. However, at least one config (LS1021A at less than 1 GHz) +uses a different divider for top speed. This was causing cpufreq to set +a frequency beyond the chip's rated speed. + +This is fixed by applying a 100%-of-initial-speed limit to all CPU PLLs, +similar to the existing 80% limit that only applied to some. + +Signed-off-by: Scott Wood +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/clk-qoriq.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/clk/clk-qoriq.c ++++ b/drivers/clk/clk-qoriq.c +@@ -700,6 +700,7 @@ static struct clk * __init create_mux_co + struct mux_hwclock *hwc, + const struct clk_ops *ops, + unsigned long min_rate, ++ unsigned long max_rate, + unsigned long pct80_rate, + const char *fmt, int idx) + { +@@ -728,6 +729,8 @@ static struct clk * __init create_mux_co + continue; + if (rate < min_rate) + continue; ++ if (rate > max_rate) ++ continue; + + parent_names[j] = div->name; + hwc->parent_to_clksel[j] = i; +@@ -759,7 +762,7 @@ static struct clk * __init create_one_cm + struct mux_hwclock *hwc; + const struct clockgen_pll_div *div; + unsigned long plat_rate, min_rate; +- u64 pct80_rate; ++ u64 max_rate, pct80_rate; + u32 clksel; + + hwc = kzalloc(sizeof(*hwc), GFP_KERNEL); +@@ -787,8 +790,8 @@ static struct clk * __init create_one_cm + return NULL; + } + +- pct80_rate = clk_get_rate(div->clk); +- pct80_rate *= 8; ++ max_rate = clk_get_rate(div->clk); ++ pct80_rate = max_rate * 8; + do_div(pct80_rate, 10); + + plat_rate = clk_get_rate(cg->pll[PLATFORM_PLL].div[PLL_DIV1].clk); +@@ -798,7 +801,7 @@ static struct clk * __init create_one_cm + else + min_rate = plat_rate / 2; + +- return create_mux_common(cg, hwc, &cmux_ops, min_rate, ++ return create_mux_common(cg, hwc, &cmux_ops, min_rate, max_rate, + pct80_rate, "cg-cmux%d", idx); + } + +@@ -813,7 +816,7 @@ static struct clk * __init create_one_hw + hwc->reg = cg->regs + 0x20 * idx + 0x10; + hwc->info = cg->info.hwaccel[idx]; + +- return create_mux_common(cg, hwc, &hwaccel_ops, 0, 0, ++ return create_mux_common(cg, hwc, &hwaccel_ops, 0, ULONG_MAX, 0, + "cg-hwaccel%d", idx); + } + diff --git a/queue-4.4/coredump-fix-unfreezable-coredumping-task.patch b/queue-4.4/coredump-fix-unfreezable-coredumping-task.patch new file mode 100644 index 00000000000..21cb3b8a6d5 --- /dev/null +++ b/queue-4.4/coredump-fix-unfreezable-coredumping-task.patch @@ -0,0 +1,57 @@ +From 70d78fe7c8b640b5acfad56ad341985b3810998a Mon Sep 17 00:00:00 2001 +From: Andrey Ryabinin +Date: Thu, 10 Nov 2016 10:46:38 -0800 +Subject: coredump: fix unfreezable coredumping task + +From: Andrey Ryabinin + +commit 70d78fe7c8b640b5acfad56ad341985b3810998a upstream. + +It could be not possible to freeze coredumping task when it waits for +'core_state->startup' completion, because threads are frozen in +get_signal() before they got a chance to complete 'core_state->startup'. + +Inability to freeze a task during suspend will cause suspend to fail. +Also CRIU uses cgroup freezer during dump operation. So with an +unfreezable task the CRIU dump will fail because it waits for a +transition from 'FREEZING' to 'FROZEN' state which will never happen. + +Use freezer_do_not_count() to tell freezer to ignore coredumping task +while it waits for core_state->startup completion. + +Link: http://lkml.kernel.org/r/1475225434-3753-1-git-send-email-aryabinin@virtuozzo.com +Signed-off-by: Andrey Ryabinin +Acked-by: Pavel Machek +Acked-by: Oleg Nesterov +Cc: Alexander Viro +Cc: Tejun Heo +Cc: "Rafael J. Wysocki" +Cc: Michal Hocko +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/coredump.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/coredump.c ++++ b/fs/coredump.c +@@ -1,6 +1,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -399,7 +400,9 @@ static int coredump_wait(int exit_code, + if (core_waiters > 0) { + struct core_thread *ptr; + ++ freezer_do_not_count(); + wait_for_completion(&core_state->startup); ++ freezer_count(); + /* + * Wait for all the threads to become inactive, so that + * all the thread context (extended register state, like diff --git a/queue-4.4/drbd-fix-kernel_sendmsg-usage-potential-null-deref.patch b/queue-4.4/drbd-fix-kernel_sendmsg-usage-potential-null-deref.patch new file mode 100644 index 00000000000..89dc5259566 --- /dev/null +++ b/queue-4.4/drbd-fix-kernel_sendmsg-usage-potential-null-deref.patch @@ -0,0 +1,77 @@ +From d8e9e5e80e882b4f90cba7edf1e6cb7376e52e54 Mon Sep 17 00:00:00 2001 +From: Richard Weinberger +Date: Wed, 9 Nov 2016 22:52:58 +0100 +Subject: drbd: Fix kernel_sendmsg() usage - potential NULL deref + +From: Richard Weinberger + +commit d8e9e5e80e882b4f90cba7edf1e6cb7376e52e54 upstream. + +Don't pass a size larger than iov_len to kernel_sendmsg(). +Otherwise it will cause a NULL pointer deref when kernel_sendmsg() +returns with rv < size. + +DRBD as external module has been around in the kernel 2.4 days already. +We used to be compatible to 2.4 and very early 2.6 kernels, +we used to use + rv = sock_sendmsg(sock, &msg, iov.iov_len); +then later changed to + rv = kernel_sendmsg(sock, &msg, &iov, 1, size); +when we should have used + rv = kernel_sendmsg(sock, &msg, &iov, 1, iov.iov_len); + +tcp_sendmsg() used to totally ignore the size parameter. + 57be5bd ip: convert tcp_sendmsg() to iov_iter primitives +changes that, and exposes our long standing error. + +Even with this error exposed, to trigger the bug, we would need to have +an environment (config or otherwise) causing us to not use sendpage() +for larger transfers, a failing connection, and have it fail "just at the +right time". Apparently that was unlikely enough for most, so this went +unnoticed for years. + +Still, it is known to trigger at least some of these, +and suspected for the others: +[0] http://lists.linbit.com/pipermail/drbd-user/2016-July/023112.html +[1] http://lists.linbit.com/pipermail/drbd-dev/2016-March/003362.html +[2] https://forums.grsecurity.net/viewtopic.php?f=3&t=4546 +[3] https://ubuntuforums.org/showthread.php?t=2336150 +[4] http://e2.howsolveproblem.com/i/1175162/ + +This should go into 4.9, +and into all stable branches since and including v4.0, +which is the first to contain the exposing change. + +It is correct for all stable branches older than that as well +(which contain the DRBD driver; which is 2.6.33 and up). + +It requires a small "conflict" resolution for v4.4 and earlier, with v4.5 +we dropped the comment block immediately preceding the kernel_sendmsg(). + +Fixes: b411b3637fa7 ("The DRBD driver") +Cc: viro@zeniv.linux.org.uk +Cc: christoph.lechleitner@iteg.at +Cc: wolfgang.glas@iteg.at +Reported-by: Christoph Lechleitner +Tested-by: Christoph Lechleitner +Signed-off-by: Richard Weinberger +[changed oneliner to be "obvious" without context; more verbose message] +Signed-off-by: Lars Ellenberg +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/drbd/drbd_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/block/drbd/drbd_main.c ++++ b/drivers/block/drbd/drbd_main.c +@@ -1802,7 +1802,7 @@ int drbd_send(struct drbd_connection *co + * do we need to block DRBD_SIG if sock == &meta.socket ?? + * otherwise wake_asender() might interrupt some send_*Ack ! + */ +- rv = kernel_sendmsg(sock, &msg, &iov, 1, size); ++ rv = kernel_sendmsg(sock, &msg, &iov, 1, iov.iov_len); + if (rv == -EAGAIN) { + if (we_should_drop_the_connection(connection, sock)) + break; diff --git a/queue-4.4/drivers-staging-nvec-remove-bogus-reset-command-for-ps-2-interface.patch b/queue-4.4/drivers-staging-nvec-remove-bogus-reset-command-for-ps-2-interface.patch new file mode 100644 index 00000000000..312768c0fd2 --- /dev/null +++ b/queue-4.4/drivers-staging-nvec-remove-bogus-reset-command-for-ps-2-interface.patch @@ -0,0 +1,44 @@ +From d8f8a74d5fece355d2234e1731231d1aebc66b38 Mon Sep 17 00:00:00 2001 +From: Paul Fertser +Date: Thu, 27 Oct 2016 17:22:08 +0300 +Subject: drivers: staging: nvec: remove bogus reset command for PS/2 interface + +From: Paul Fertser + +commit d8f8a74d5fece355d2234e1731231d1aebc66b38 upstream. + +This command was sent behind serio's back and the answer to it was +confusing atkbd probe function which lead to the elantech touchpad +getting detected as a keyboard. + +To prevent this from happening just let every party do its part of the +job. + +Signed-off-by: Paul Fertser +Acked-by: Marc Dietrich +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/nvec/nvec_ps2.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/drivers/staging/nvec/nvec_ps2.c ++++ b/drivers/staging/nvec/nvec_ps2.c +@@ -106,7 +106,6 @@ static int nvec_mouse_probe(struct platf + { + struct nvec_chip *nvec = dev_get_drvdata(pdev->dev.parent); + struct serio *ser_dev; +- char mouse_reset[] = { NVEC_PS2, SEND_COMMAND, PSMOUSE_RST, 3 }; + + ser_dev = devm_kzalloc(&pdev->dev, sizeof(struct serio), GFP_KERNEL); + if (!ser_dev) +@@ -127,9 +126,6 @@ static int nvec_mouse_probe(struct platf + + serio_register_port(ser_dev); + +- /* mouse reset */ +- nvec_write_async(nvec, mouse_reset, sizeof(mouse_reset)); +- + return 0; + } + diff --git a/queue-4.4/drm-amdgpu-disable-runtime-pm-in-certain-cases.patch b/queue-4.4/drm-amdgpu-disable-runtime-pm-in-certain-cases.patch new file mode 100644 index 00000000000..4d75f8b5b8f --- /dev/null +++ b/queue-4.4/drm-amdgpu-disable-runtime-pm-in-certain-cases.patch @@ -0,0 +1,34 @@ +From 84b1528e8cef55274f0df20e93513b3060ce495a Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 31 Oct 2016 11:02:31 -0400 +Subject: drm/amdgpu: disable runtime pm in certain cases +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit 84b1528e8cef55274f0df20e93513b3060ce495a upstream. + +If the platform does not support hybrid graphics or ATPX dGPU +power control. + +Acked-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -96,6 +96,8 @@ int amdgpu_driver_load_kms(struct drm_de + + if ((amdgpu_runtime_pm != 0) && + amdgpu_has_atpx() && ++ (amdgpu_is_atpx_hybrid() || ++ amdgpu_has_atpx_dgpu_power_cntl()) && + ((flags & AMD_IS_APU) == 0)) + flags |= AMD_IS_PX; + diff --git a/queue-4.4/drm-i915-respect-alternate_ddc_pin-for-all-ddi-ports.patch b/queue-4.4/drm-i915-respect-alternate_ddc_pin-for-all-ddi-ports.patch new file mode 100644 index 00000000000..8eb5de8401b --- /dev/null +++ b/queue-4.4/drm-i915-respect-alternate_ddc_pin-for-all-ddi-ports.patch @@ -0,0 +1,163 @@ +From 8d83bc22b259e5526625b6d298f637786c71129f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Tue, 11 Oct 2016 20:52:46 +0300 +Subject: drm/i915: Respect alternate_ddc_pin for all DDI ports +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 8d83bc22b259e5526625b6d298f637786c71129f upstream. + +The VBT provides the platform a way to mix and match the DDI ports vs. +GMBUS pins. Currently we only trust the VBT for DDI E, which I suppose +has no standard GMBUS pin assignment. However, there are machines out +there that use a non-standard mapping for the other ports as well. +Let's start trusting the VBT on this one for all ports on DDI platforms. + +I've structured the code such that other platforms could easily start +using this as well, by simply filling in the ddi_port_info. IIRC there +may be CHV system that might actually need this. + +v2: Include a commit message, include a debug message during init + +Cc: Maarten Maathuis +Tested-by: Maarten Maathuis +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97877 +Signed-off-by: Ville Syrjälä +Link: http://patchwork.freedesktop.org/patch/msgid/1476208368-5710-3-git-send-email-ville.syrjala@linux.intel.com +Reviewed-by: Jim Bride +(cherry picked from commit e4ab73a13291fc844c9e24d5c347bd95818544d2) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_hdmi.c | 84 +++++++++++++++++++++----------------- + 1 file changed, 48 insertions(+), 36 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_hdmi.c ++++ b/drivers/gpu/drm/i915/intel_hdmi.c +@@ -1997,6 +1997,50 @@ intel_hdmi_add_properties(struct intel_h + intel_hdmi->aspect_ratio = HDMI_PICTURE_ASPECT_NONE; + } + ++static u8 intel_hdmi_ddc_pin(struct drm_i915_private *dev_priv, ++ enum port port) ++{ ++ const struct ddi_vbt_port_info *info = ++ &dev_priv->vbt.ddi_port_info[port]; ++ u8 ddc_pin; ++ ++ if (info->alternate_ddc_pin) { ++ DRM_DEBUG_KMS("Using DDC pin 0x%x for port %c (VBT)\n", ++ info->alternate_ddc_pin, port_name(port)); ++ return info->alternate_ddc_pin; ++ } ++ ++ switch (port) { ++ case PORT_B: ++ if (IS_BROXTON(dev_priv)) ++ ddc_pin = GMBUS_PIN_1_BXT; ++ else ++ ddc_pin = GMBUS_PIN_DPB; ++ break; ++ case PORT_C: ++ if (IS_BROXTON(dev_priv)) ++ ddc_pin = GMBUS_PIN_2_BXT; ++ else ++ ddc_pin = GMBUS_PIN_DPC; ++ break; ++ case PORT_D: ++ if (IS_CHERRYVIEW(dev_priv)) ++ ddc_pin = GMBUS_PIN_DPD_CHV; ++ else ++ ddc_pin = GMBUS_PIN_DPD; ++ break; ++ default: ++ MISSING_CASE(port); ++ ddc_pin = GMBUS_PIN_DPB; ++ break; ++ } ++ ++ DRM_DEBUG_KMS("Using DDC pin 0x%x for port %c (platform default)\n", ++ ddc_pin, port_name(port)); ++ ++ return ddc_pin; ++} ++ + void intel_hdmi_init_connector(struct intel_digital_port *intel_dig_port, + struct intel_connector *intel_connector) + { +@@ -2006,7 +2050,6 @@ void intel_hdmi_init_connector(struct in + struct drm_device *dev = intel_encoder->base.dev; + struct drm_i915_private *dev_priv = dev->dev_private; + enum port port = intel_dig_port->port; +- uint8_t alternate_ddc_pin; + + DRM_DEBUG_KMS("Adding HDMI connector on port %c\n", + port_name(port)); +@@ -2019,12 +2062,10 @@ void intel_hdmi_init_connector(struct in + connector->doublescan_allowed = 0; + connector->stereo_allowed = 1; + ++ intel_hdmi->ddc_bus = intel_hdmi_ddc_pin(dev_priv, port); ++ + switch (port) { + case PORT_B: +- if (IS_BROXTON(dev_priv)) +- intel_hdmi->ddc_bus = GMBUS_PIN_1_BXT; +- else +- intel_hdmi->ddc_bus = GMBUS_PIN_DPB; + /* + * On BXT A0/A1, sw needs to activate DDIA HPD logic and + * interrupts to check the external panel connection. +@@ -2035,46 +2076,17 @@ void intel_hdmi_init_connector(struct in + intel_encoder->hpd_pin = HPD_PORT_B; + break; + case PORT_C: +- if (IS_BROXTON(dev_priv)) +- intel_hdmi->ddc_bus = GMBUS_PIN_2_BXT; +- else +- intel_hdmi->ddc_bus = GMBUS_PIN_DPC; + intel_encoder->hpd_pin = HPD_PORT_C; + break; + case PORT_D: +- if (WARN_ON(IS_BROXTON(dev_priv))) +- intel_hdmi->ddc_bus = GMBUS_PIN_DISABLED; +- else if (IS_CHERRYVIEW(dev_priv)) +- intel_hdmi->ddc_bus = GMBUS_PIN_DPD_CHV; +- else +- intel_hdmi->ddc_bus = GMBUS_PIN_DPD; + intel_encoder->hpd_pin = HPD_PORT_D; + break; + case PORT_E: +- /* On SKL PORT E doesn't have seperate GMBUS pin +- * We rely on VBT to set a proper alternate GMBUS pin. */ +- alternate_ddc_pin = +- dev_priv->vbt.ddi_port_info[PORT_E].alternate_ddc_pin; +- switch (alternate_ddc_pin) { +- case DDC_PIN_B: +- intel_hdmi->ddc_bus = GMBUS_PIN_DPB; +- break; +- case DDC_PIN_C: +- intel_hdmi->ddc_bus = GMBUS_PIN_DPC; +- break; +- case DDC_PIN_D: +- intel_hdmi->ddc_bus = GMBUS_PIN_DPD; +- break; +- default: +- MISSING_CASE(alternate_ddc_pin); +- } + intel_encoder->hpd_pin = HPD_PORT_E; + break; +- case PORT_A: +- intel_encoder->hpd_pin = HPD_PORT_A; +- /* Internal port only for eDP. */ + default: +- BUG(); ++ MISSING_CASE(port); ++ return; + } + + if (IS_VALLEYVIEW(dev)) { diff --git a/queue-4.4/drm-radeon-disable-runtime-pm-in-certain-cases.patch b/queue-4.4/drm-radeon-disable-runtime-pm-in-certain-cases.patch new file mode 100644 index 00000000000..88b49bdbc45 --- /dev/null +++ b/queue-4.4/drm-radeon-disable-runtime-pm-in-certain-cases.patch @@ -0,0 +1,54 @@ +From 066f1f0b4719eb4573ef09bfc63c2bbb6f7676ca Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 31 Oct 2016 10:41:49 -0400 +Subject: drm/radeon: disable runtime pm in certain cases +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit 066f1f0b4719eb4573ef09bfc63c2bbb6f7676ca upstream. + +If the platform does not support hybrid graphics or ATPX dGPU +power control. + +bug: https://bugzilla.kernel.org/show_bug.cgi?id=51381 + +Acked-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_device.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -103,6 +103,14 @@ static const char radeon_family_name[][1 + "LAST", + }; + ++#if defined(CONFIG_VGA_SWITCHEROO) ++bool radeon_has_atpx_dgpu_power_cntl(void); ++bool radeon_is_atpx_hybrid(void); ++#else ++static inline bool radeon_has_atpx_dgpu_power_cntl(void) { return false; } ++static inline bool radeon_is_atpx_hybrid(void) { return false; } ++#endif ++ + #define RADEON_PX_QUIRK_DISABLE_PX (1 << 0) + #define RADEON_PX_QUIRK_LONG_WAKEUP (1 << 1) + +@@ -159,6 +167,11 @@ static void radeon_device_handle_px_quir + + if (rdev->px_quirk_flags & RADEON_PX_QUIRK_DISABLE_PX) + rdev->flags &= ~RADEON_IS_PX; ++ ++ /* disable PX is the system doesn't support dGPU power control or hybrid gfx */ ++ if (!radeon_is_atpx_hybrid() && ++ !radeon_has_atpx_dgpu_power_cntl()) ++ rdev->flags &= ~RADEON_IS_PX; + } + + /** diff --git a/queue-4.4/iio-hid-sensors-increase-the-precision-of-scale-to-fix-wrong-reading-interpretation.patch b/queue-4.4/iio-hid-sensors-increase-the-precision-of-scale-to-fix-wrong-reading-interpretation.patch new file mode 100644 index 00000000000..c98d2fa68e4 --- /dev/null +++ b/queue-4.4/iio-hid-sensors-increase-the-precision-of-scale-to-fix-wrong-reading-interpretation.patch @@ -0,0 +1,166 @@ +From 6f77199e9e4b84340c751c585691d7642a47d226 Mon Sep 17 00:00:00 2001 +From: Song Hongyan +Date: Tue, 25 Oct 2016 01:30:07 +0000 +Subject: iio: hid-sensors: Increase the precision of scale to fix wrong reading interpretation. + +From: Song Hongyan + +commit 6f77199e9e4b84340c751c585691d7642a47d226 upstream. + +While testing, it was observed that on some platforms the scale value +from iio sysfs for gyroscope is always 0 (E.g. Yoga 260). This results +in the final angular velocity component values to be zeros. + +This is caused by insufficient precision of scale value displayed in sysfs. +If the precision is changed to nano from current micro, then this is +sufficient to display the scale value on this platform. +Since this can be a problem for all other HID sensors, increase scale +precision of all HID sensors to nano from current micro. + +Results on Yoga 260: + +name scale before scale now +-------------------------------------------- +gyro_3d 0.000000 0.000000174 +als 0.001000 0.001000000 +magn_3d 0.000001 0.000001000 +accel_3d 0.000009 0.000009806 + +Signed-off-by: Song Hongyan +Acked-by: Srinivas Pandruvada +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/common/hid-sensors/hid-sensor-attributes.c | 56 ++++++++--------- + 1 file changed, 28 insertions(+), 28 deletions(-) + +--- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c ++++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c +@@ -30,26 +30,26 @@ static struct { + u32 usage_id; + int unit; /* 0 for default others from HID sensor spec */ + int scale_val0; /* scale, whole number */ +- int scale_val1; /* scale, fraction in micros */ ++ int scale_val1; /* scale, fraction in nanos */ + } unit_conversion[] = { +- {HID_USAGE_SENSOR_ACCEL_3D, 0, 9, 806650}, ++ {HID_USAGE_SENSOR_ACCEL_3D, 0, 9, 806650000}, + {HID_USAGE_SENSOR_ACCEL_3D, + HID_USAGE_SENSOR_UNITS_METERS_PER_SEC_SQRD, 1, 0}, + {HID_USAGE_SENSOR_ACCEL_3D, +- HID_USAGE_SENSOR_UNITS_G, 9, 806650}, ++ HID_USAGE_SENSOR_UNITS_G, 9, 806650000}, + +- {HID_USAGE_SENSOR_GYRO_3D, 0, 0, 17453}, ++ {HID_USAGE_SENSOR_GYRO_3D, 0, 0, 17453293}, + {HID_USAGE_SENSOR_GYRO_3D, + HID_USAGE_SENSOR_UNITS_RADIANS_PER_SECOND, 1, 0}, + {HID_USAGE_SENSOR_GYRO_3D, +- HID_USAGE_SENSOR_UNITS_DEGREES_PER_SECOND, 0, 17453}, ++ HID_USAGE_SENSOR_UNITS_DEGREES_PER_SECOND, 0, 17453293}, + +- {HID_USAGE_SENSOR_COMPASS_3D, 0, 0, 1000}, ++ {HID_USAGE_SENSOR_COMPASS_3D, 0, 0, 1000000}, + {HID_USAGE_SENSOR_COMPASS_3D, HID_USAGE_SENSOR_UNITS_GAUSS, 1, 0}, + +- {HID_USAGE_SENSOR_INCLINOMETER_3D, 0, 0, 17453}, ++ {HID_USAGE_SENSOR_INCLINOMETER_3D, 0, 0, 17453293}, + {HID_USAGE_SENSOR_INCLINOMETER_3D, +- HID_USAGE_SENSOR_UNITS_DEGREES, 0, 17453}, ++ HID_USAGE_SENSOR_UNITS_DEGREES, 0, 17453293}, + {HID_USAGE_SENSOR_INCLINOMETER_3D, + HID_USAGE_SENSOR_UNITS_RADIANS, 1, 0}, + +@@ -57,7 +57,7 @@ static struct { + {HID_USAGE_SENSOR_ALS, HID_USAGE_SENSOR_UNITS_LUX, 1, 0}, + + {HID_USAGE_SENSOR_PRESSURE, 0, 100, 0}, +- {HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 0, 1000}, ++ {HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 0, 1000000}, + }; + + static int pow_10(unsigned power) +@@ -266,15 +266,15 @@ EXPORT_SYMBOL(hid_sensor_write_raw_hyst_ + /* + * This fuction applies the unit exponent to the scale. + * For example: +- * 9.806650 ->exp:2-> val0[980]val1[665000] +- * 9.000806 ->exp:2-> val0[900]val1[80600] +- * 0.174535 ->exp:2-> val0[17]val1[453500] +- * 1.001745 ->exp:0-> val0[1]val1[1745] +- * 1.001745 ->exp:2-> val0[100]val1[174500] +- * 1.001745 ->exp:4-> val0[10017]val1[450000] +- * 9.806650 ->exp:-2-> val0[0]val1[98066] ++ * 9.806650000 ->exp:2-> val0[980]val1[665000000] ++ * 9.000806000 ->exp:2-> val0[900]val1[80600000] ++ * 0.174535293 ->exp:2-> val0[17]val1[453529300] ++ * 1.001745329 ->exp:0-> val0[1]val1[1745329] ++ * 1.001745329 ->exp:2-> val0[100]val1[174532900] ++ * 1.001745329 ->exp:4-> val0[10017]val1[453290000] ++ * 9.806650000 ->exp:-2-> val0[0]val1[98066500] + */ +-static void adjust_exponent_micro(int *val0, int *val1, int scale0, ++static void adjust_exponent_nano(int *val0, int *val1, int scale0, + int scale1, int exp) + { + int i; +@@ -285,32 +285,32 @@ static void adjust_exponent_micro(int *v + if (exp > 0) { + *val0 = scale0 * pow_10(exp); + res = 0; +- if (exp > 6) { ++ if (exp > 9) { + *val1 = 0; + return; + } + for (i = 0; i < exp; ++i) { +- x = scale1 / pow_10(5 - i); ++ x = scale1 / pow_10(8 - i); + res += (pow_10(exp - 1 - i) * x); +- scale1 = scale1 % pow_10(5 - i); ++ scale1 = scale1 % pow_10(8 - i); + } + *val0 += res; + *val1 = scale1 * pow_10(exp); + } else if (exp < 0) { + exp = abs(exp); +- if (exp > 6) { ++ if (exp > 9) { + *val0 = *val1 = 0; + return; + } + *val0 = scale0 / pow_10(exp); + rem = scale0 % pow_10(exp); + res = 0; +- for (i = 0; i < (6 - exp); ++i) { +- x = scale1 / pow_10(5 - i); +- res += (pow_10(5 - exp - i) * x); +- scale1 = scale1 % pow_10(5 - i); ++ for (i = 0; i < (9 - exp); ++i) { ++ x = scale1 / pow_10(8 - i); ++ res += (pow_10(8 - exp - i) * x); ++ scale1 = scale1 % pow_10(8 - i); + } +- *val1 = rem * pow_10(6 - exp) + res; ++ *val1 = rem * pow_10(9 - exp) + res; + } else { + *val0 = scale0; + *val1 = scale1; +@@ -332,14 +332,14 @@ int hid_sensor_format_scale(u32 usage_id + unit_conversion[i].unit == attr_info->units) { + exp = hid_sensor_convert_exponent( + attr_info->unit_expo); +- adjust_exponent_micro(val0, val1, ++ adjust_exponent_nano(val0, val1, + unit_conversion[i].scale_val0, + unit_conversion[i].scale_val1, exp); + break; + } + } + +- return IIO_VAL_INT_PLUS_MICRO; ++ return IIO_VAL_INT_PLUS_NANO; + } + EXPORT_SYMBOL(hid_sensor_format_scale); + diff --git a/queue-4.4/iio-orientation-hid-sensor-rotation-add-pm-function-fix-non-working-driver.patch b/queue-4.4/iio-orientation-hid-sensor-rotation-add-pm-function-fix-non-working-driver.patch new file mode 100644 index 00000000000..467132bff23 --- /dev/null +++ b/queue-4.4/iio-orientation-hid-sensor-rotation-add-pm-function-fix-non-working-driver.patch @@ -0,0 +1,42 @@ +From 8af644a7d6846f48d6b72be5d4a3c6eb16bd33c8 Mon Sep 17 00:00:00 2001 +From: Song Hongyan +Date: Tue, 25 Oct 2016 01:06:03 +0000 +Subject: iio: orientation: hid-sensor-rotation: Add PM function (fix non working driver) + +From: Song Hongyan + +commit 8af644a7d6846f48d6b72be5d4a3c6eb16bd33c8 upstream. + +This fix makes newer ISH hubs work. Previous ones worked by lucky +coincidence. + +Rotation sensor function does not work due to miss PM function. +Add common hid sensor iio pm function for rotation sensor. + +Further clarification from Srinivas: + +If CONFIG_PM is not defined, then this prevents this sensor to +function. So above commit caused this. + +This sensor was supposed to be always on to trigger wake up in prior +external hubs. But with the new ISH hub this is not the case. + +Signed-off-by: Song Hongyan +Fixes: 2b89635e9a9e ("iio: hid_sensor_hub: Common PM functions") +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/orientation/hid-sensor-rotation.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/orientation/hid-sensor-rotation.c ++++ b/drivers/iio/orientation/hid-sensor-rotation.c +@@ -335,6 +335,7 @@ static struct platform_driver hid_dev_ro + .id_table = hid_dev_rot_ids, + .driver = { + .name = KBUILD_MODNAME, ++ .pm = &hid_sensor_pm_ops, + }, + .probe = hid_dev_rot_probe, + .remove = hid_dev_rot_remove, diff --git a/queue-4.4/kvm-mips-precalculate-mmio-load-resume-pc.patch b/queue-4.4/kvm-mips-precalculate-mmio-load-resume-pc.patch new file mode 100644 index 00000000000..dee1102ca63 --- /dev/null +++ b/queue-4.4/kvm-mips-precalculate-mmio-load-resume-pc.patch @@ -0,0 +1,119 @@ +From e1e575f6b026734be3b1f075e780e91ab08ca541 Mon Sep 17 00:00:00 2001 +From: James Hogan +Date: Tue, 25 Oct 2016 16:11:12 +0100 +Subject: KVM: MIPS: Precalculate MMIO load resume PC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: James Hogan + +commit e1e575f6b026734be3b1f075e780e91ab08ca541 upstream. + +The advancing of the PC when completing an MMIO load is done before +re-entering the guest, i.e. before restoring the guest ASID. However if +the load is in a branch delay slot it may need to access guest code to +read the prior branch instruction. This isn't safe in TLB mapped code at +the moment, nor in the future when we'll access unmapped guest segments +using direct user accessors too, as it could read the branch from host +user memory instead. + +Therefore calculate the resume PC in advance while we're still in the +right context and save it in the new vcpu->arch.io_pc (replacing the no +longer needed vcpu->arch.pending_load_cause), and restore it on MMIO +completion. + +Fixes: e685c689f3a8 ("KVM/MIPS32: Privileged instruction/target branch emulation.") +Signed-off-by: James Hogan +Cc: Paolo Bonzini +Cc: "Radim Krčmář +Cc: Ralf Baechle +Cc: linux-mips@linux-mips.org +Cc: kvm@vger.kernel.org +Signed-off-by: Paolo Bonzini +[james.hogan@imgtec.com: Backport to 3.18..4.4] +Signed-off-by: James Hogan +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/include/asm/kvm_host.h | 7 ++++--- + arch/mips/kvm/emulate.c | 24 +++++++++++++++--------- + 2 files changed, 19 insertions(+), 12 deletions(-) + +--- a/arch/mips/include/asm/kvm_host.h ++++ b/arch/mips/include/asm/kvm_host.h +@@ -400,7 +400,10 @@ struct kvm_vcpu_arch { + /* Host KSEG0 address of the EI/DI offset */ + void *kseg0_commpage; + +- u32 io_gpr; /* GPR used as IO source/target */ ++ /* Resume PC after MMIO completion */ ++ unsigned long io_pc; ++ /* GPR used as IO source/target */ ++ u32 io_gpr; + + struct hrtimer comparecount_timer; + /* Count timer control KVM register */ +@@ -422,8 +425,6 @@ struct kvm_vcpu_arch { + /* Bitmask of pending exceptions to be cleared */ + unsigned long pending_exceptions_clr; + +- unsigned long pending_load_cause; +- + /* Save/Restore the entryhi register when are are preempted/scheduled back in */ + unsigned long preempt_entryhi; + +--- a/arch/mips/kvm/emulate.c ++++ b/arch/mips/kvm/emulate.c +@@ -1473,6 +1473,7 @@ enum emulation_result kvm_mips_emulate_l + struct kvm_vcpu *vcpu) + { + enum emulation_result er = EMULATE_DO_MMIO; ++ unsigned long curr_pc; + int32_t op, base, rt, offset; + uint32_t bytes; + +@@ -1481,7 +1482,18 @@ enum emulation_result kvm_mips_emulate_l + offset = inst & 0xffff; + op = (inst >> 26) & 0x3f; + +- vcpu->arch.pending_load_cause = cause; ++ /* ++ * Find the resume PC now while we have safe and easy access to the ++ * prior branch instruction, and save it for ++ * kvm_mips_complete_mmio_load() to restore later. ++ */ ++ curr_pc = vcpu->arch.pc; ++ er = update_pc(vcpu, cause); ++ if (er == EMULATE_FAIL) ++ return er; ++ vcpu->arch.io_pc = vcpu->arch.pc; ++ vcpu->arch.pc = curr_pc; ++ + vcpu->arch.io_gpr = rt; + + switch (op) { +@@ -2461,9 +2473,8 @@ enum emulation_result kvm_mips_complete_ + goto done; + } + +- er = update_pc(vcpu, vcpu->arch.pending_load_cause); +- if (er == EMULATE_FAIL) +- return er; ++ /* Restore saved resume PC */ ++ vcpu->arch.pc = vcpu->arch.io_pc; + + switch (run->mmio.len) { + case 4: +@@ -2485,11 +2496,6 @@ enum emulation_result kvm_mips_complete_ + break; + } + +- if (vcpu->arch.pending_load_cause & CAUSEF_BD) +- kvm_debug("[%#lx] Completing %d byte BD Load to gpr %d (0x%08lx) type %d\n", +- vcpu->arch.pc, run->mmio.len, vcpu->arch.io_gpr, *gpr, +- vcpu->mmio_needed); +- + done: + return er; + } diff --git a/queue-4.4/pinctrl-cherryview-prevent-possible-interrupt-storm-on-resume.patch b/queue-4.4/pinctrl-cherryview-prevent-possible-interrupt-storm-on-resume.patch new file mode 100644 index 00000000000..4dd6ed5bbe2 --- /dev/null +++ b/queue-4.4/pinctrl-cherryview-prevent-possible-interrupt-storm-on-resume.patch @@ -0,0 +1,74 @@ +From d2cdf5dc58f6970e9d9d26e47974c21fe87983f3 Mon Sep 17 00:00:00 2001 +From: Mika Westerberg +Date: Mon, 31 Oct 2016 16:57:33 +0200 +Subject: pinctrl: cherryview: Prevent possible interrupt storm on resume + +From: Mika Westerberg + +commit d2cdf5dc58f6970e9d9d26e47974c21fe87983f3 upstream. + +When the system is suspended to S3 the BIOS might re-initialize certain +GPIO pins back to their original state or it may re-program interrupt mask +of others. For example Acer TravelMate B116-M had BIOS bug where certain +GPIO pin (MF_ISH_GPIO_5) was programmed to trigger on high level, and the +pin state was high once the BIOS gave control to the OS on resume. + +This triggers lots of messages like: + + irq 117, desc: ffff88017a61e600, depth: 1, count: 0, unhandled: 0 + ->handle_irq(): ffffffff8109b613, handle_bad_irq+0x0/0x1e0 + ->irq_data.chip(): ffffffffa0020180, chv_pinctrl_exit+0x2d84/0x12 [pinctrl_cherryview] + ->action(): (null) + IRQ_NOPROBE set + +We reset the mask back to known state in chv_pinctrl_resume() but that is +called only after device interrupts have already been enabled. + +Now, this particular issue was fixed by upgrading the BIOS to the latest +(v1.23) but not everybody upgrades their BIOSes so we fix it up in the +driver as well. + +Prevent the possible interrupt storm by moving suspend and resume hooks to +be called at _noirq time instead. Since device interrupts are still +disabled we can restore the mask back to known state before interrupt storm +happens. + +Reported-by: Christian Steiner +Signed-off-by: Mika Westerberg +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/intel/pinctrl-cherryview.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/pinctrl/intel/pinctrl-cherryview.c ++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c +@@ -1564,7 +1564,7 @@ static int chv_pinctrl_remove(struct pla + } + + #ifdef CONFIG_PM_SLEEP +-static int chv_pinctrl_suspend(struct device *dev) ++static int chv_pinctrl_suspend_noirq(struct device *dev) + { + struct platform_device *pdev = to_platform_device(dev); + struct chv_pinctrl *pctrl = platform_get_drvdata(pdev); +@@ -1598,7 +1598,7 @@ static int chv_pinctrl_suspend(struct de + return 0; + } + +-static int chv_pinctrl_resume(struct device *dev) ++static int chv_pinctrl_resume_noirq(struct device *dev) + { + struct platform_device *pdev = to_platform_device(dev); + struct chv_pinctrl *pctrl = platform_get_drvdata(pdev); +@@ -1658,7 +1658,8 @@ static int chv_pinctrl_resume(struct dev + #endif + + static const struct dev_pm_ops chv_pinctrl_pm_ops = { +- SET_LATE_SYSTEM_SLEEP_PM_OPS(chv_pinctrl_suspend, chv_pinctrl_resume) ++ SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(chv_pinctrl_suspend_noirq, ++ chv_pinctrl_resume_noirq) + }; + + static const struct acpi_device_id chv_pinctrl_acpi_match[] = { diff --git a/queue-4.4/pinctrl-cherryview-serialize-register-access-in-suspend-resume.patch b/queue-4.4/pinctrl-cherryview-serialize-register-access-in-suspend-resume.patch new file mode 100644 index 00000000000..43abe9c8356 --- /dev/null +++ b/queue-4.4/pinctrl-cherryview-serialize-register-access-in-suspend-resume.patch @@ -0,0 +1,66 @@ +From 56211121c0825cd188caad05574fdc518d5cac6f Mon Sep 17 00:00:00 2001 +From: Mika Westerberg +Date: Mon, 31 Oct 2016 16:57:32 +0200 +Subject: pinctrl: cherryview: Serialize register access in suspend/resume + +From: Mika Westerberg + +commit 56211121c0825cd188caad05574fdc518d5cac6f upstream. + +If async suspend is enabled, the driver may access registers concurrently +with another instance which may fail because of the bug in Cherryview GPIO +hardware. Prevent this by taking the shared lock while accessing the +hardware in suspend and resume hooks. + +Signed-off-by: Mika Westerberg +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/intel/pinctrl-cherryview.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/pinctrl/intel/pinctrl-cherryview.c ++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c +@@ -1568,8 +1568,11 @@ static int chv_pinctrl_suspend(struct de + { + struct platform_device *pdev = to_platform_device(dev); + struct chv_pinctrl *pctrl = platform_get_drvdata(pdev); ++ unsigned long flags; + int i; + ++ raw_spin_lock_irqsave(&chv_lock, flags); ++ + pctrl->saved_intmask = readl(pctrl->regs + CHV_INTMASK); + + for (i = 0; i < pctrl->community->npins; i++) { +@@ -1590,6 +1593,8 @@ static int chv_pinctrl_suspend(struct de + ctx->padctrl1 = readl(reg); + } + ++ raw_spin_unlock_irqrestore(&chv_lock, flags); ++ + return 0; + } + +@@ -1597,8 +1602,11 @@ static int chv_pinctrl_resume(struct dev + { + struct platform_device *pdev = to_platform_device(dev); + struct chv_pinctrl *pctrl = platform_get_drvdata(pdev); ++ unsigned long flags; + int i; + ++ raw_spin_lock_irqsave(&chv_lock, flags); ++ + /* + * Mask all interrupts before restoring per-pin configuration + * registers because we don't know in which state BIOS left them +@@ -1643,6 +1651,8 @@ static int chv_pinctrl_resume(struct dev + chv_writel(0xffff, pctrl->regs + CHV_INTSTAT); + chv_writel(pctrl->saved_intmask, pctrl->regs + CHV_INTMASK); + ++ raw_spin_unlock_irqrestore(&chv_lock, flags); ++ + return 0; + } + #endif diff --git a/queue-4.4/revert-staging-nvec-ps2-change-serio-type-to-passthrough.patch b/queue-4.4/revert-staging-nvec-ps2-change-serio-type-to-passthrough.patch new file mode 100644 index 00000000000..e260195726c --- /dev/null +++ b/queue-4.4/revert-staging-nvec-ps2-change-serio-type-to-passthrough.patch @@ -0,0 +1,48 @@ +From 17c1c9ba15b238ef79b51cf40d855c05b58d5934 Mon Sep 17 00:00:00 2001 +From: Paul Fertser +Date: Thu, 27 Oct 2016 17:22:09 +0300 +Subject: Revert "staging: nvec: ps2: change serio type to passthrough" + +From: Paul Fertser + +commit 17c1c9ba15b238ef79b51cf40d855c05b58d5934 upstream. + +This reverts commit 36b30d6138f4677514aca35ab76c20c1604baaad. + +This is necessary to detect paz00 (ac100) touchpad properly as one +speaking ETPS/2 protocol. Without it X.org's synaptics driver doesn't +work as the touchpad is detected as an ImPS/2 mouse instead. + +Commit ec6184b1c717b8768122e25fe6d312f609cc1bb4 changed the way +auto-detection is performed on ports marked as pass through and made the +issue apparent. + +A pass through port is an additional PS/2 port used to connect a slave +device to a master device that is using PS/2 to communicate with the +host (so slave's PS/2 communication is tunneled over master's PS/2 +link). "Synaptics PS/2 TouchPad Interfacing Guide" describes such a +setup (PS/2 PASS-THROUGH OPTION section). + +Since paz00's embedded controller is not connected to a PS/2 port +itself, the PS/2 interface it exposes is not a pass-through one. + +Signed-off-by: Paul Fertser +Acked-by: Marc Dietrich +Fixes: 36b30d6138f4 ("staging: nvec: ps2: change serio type to passthrough") +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/nvec/nvec_ps2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/nvec/nvec_ps2.c ++++ b/drivers/staging/nvec/nvec_ps2.c +@@ -111,7 +111,7 @@ static int nvec_mouse_probe(struct platf + if (!ser_dev) + return -ENOMEM; + +- ser_dev->id.type = SERIO_PS_PSTHRU; ++ ser_dev->id.type = SERIO_8042; + ser_dev->write = ps2_sendcommand; + ser_dev->start = ps2_startstreaming; + ser_dev->stop = ps2_stopstreaming; diff --git a/queue-4.4/s390-hypfs-use-get_free_page-instead-of-kmalloc-to-ensure-page-alignment.patch b/queue-4.4/s390-hypfs-use-get_free_page-instead-of-kmalloc-to-ensure-page-alignment.patch new file mode 100644 index 00000000000..55f6ec77a9c --- /dev/null +++ b/queue-4.4/s390-hypfs-use-get_free_page-instead-of-kmalloc-to-ensure-page-alignment.patch @@ -0,0 +1,59 @@ +From 237d6e6884136923b6bd26d5141ebe1d065960c9 Mon Sep 17 00:00:00 2001 +From: Michael Holzheu +Date: Tue, 25 Oct 2016 16:24:28 +0200 +Subject: s390/hypfs: Use get_free_page() instead of kmalloc to ensure page alignment + +From: Michael Holzheu + +commit 237d6e6884136923b6bd26d5141ebe1d065960c9 upstream. + +Since commit d86bd1bece6f ("mm/slub: support left redzone") it is no longer +guaranteed that kmalloc(PAGE_SIZE) returns page aligned memory. + +After the above commit we get an error for diag224 because aligned +memory is required. This leads to the following user visible error: + + # mount none -t s390_hypfs /sys/hypervisor/ + mount: unknown filesystem type 's390_hypfs' + + # dmesg | grep hypfs + hypfs.cccfb8: The hardware system does not provide all functions + required by hypfs + hypfs.7a79f0: Initialization of hypfs failed with rc=-61 + +Fix this problem and use get_free_page() instead of kmalloc() to get +correctly aligned memory. + +Signed-off-by: Michael Holzheu +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/hypfs/hypfs_diag.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/s390/hypfs/hypfs_diag.c ++++ b/arch/s390/hypfs/hypfs_diag.c +@@ -525,11 +525,11 @@ static int diag224(void *ptr) + static int diag224_get_name_table(void) + { + /* memory must be below 2GB */ +- diag224_cpu_names = kmalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA); ++ diag224_cpu_names = (char *) __get_free_page(GFP_KERNEL | GFP_DMA); + if (!diag224_cpu_names) + return -ENOMEM; + if (diag224(diag224_cpu_names)) { +- kfree(diag224_cpu_names); ++ free_page((unsigned long) diag224_cpu_names); + return -EOPNOTSUPP; + } + EBCASC(diag224_cpu_names + 16, (*diag224_cpu_names + 1) * 16); +@@ -538,7 +538,7 @@ static int diag224_get_name_table(void) + + static void diag224_delete_name_table(void) + { +- kfree(diag224_cpu_names); ++ free_page((unsigned long) diag224_cpu_names); + } + + static int diag224_idx2name(int index, char *name) diff --git a/queue-4.4/scsi-mpt3sas-fix-for-block-device-of-raid-exists-even-after-deleting-raid-disk.patch b/queue-4.4/scsi-mpt3sas-fix-for-block-device-of-raid-exists-even-after-deleting-raid-disk.patch new file mode 100644 index 00000000000..66b7b6fe9f2 --- /dev/null +++ b/queue-4.4/scsi-mpt3sas-fix-for-block-device-of-raid-exists-even-after-deleting-raid-disk.patch @@ -0,0 +1,57 @@ +From 6d3a56ed098566bc83d6c2afa74b4199c12ea074 Mon Sep 17 00:00:00 2001 +From: Sreekanth Reddy +Date: Fri, 28 Oct 2016 10:09:12 +0530 +Subject: scsi: mpt3sas: Fix for block device of raid exists even after deleting raid disk + +From: Sreekanth Reddy + +commit 6d3a56ed098566bc83d6c2afa74b4199c12ea074 upstream. + +While merging mpt3sas & mpt2sas code, we added the is_warpdrive check +condition on the wrong line + +--------------------------------------------------------------------------- + scsih_target_alloc(struct scsi_target *starget) + sas_target_priv_data->handle = raid_device->handle; + sas_target_priv_data->sas_address = raid_device->wwid; + sas_target_priv_data->flags |= MPT_TARGET_FLAGS_VOLUME; +- raid_device->starget = starget; ++ sas_target_priv_data->raid_device = raid_device; ++ if (ioc->is_warpdrive) ++ raid_device->starget = starget; + } + spin_unlock_irqrestore(&ioc->raid_device_lock, flags); + return 0; +------------------------------------------------------------------------------ + +That check should be for the line sas_target_priv_data->raid_device = +raid_device; + +Due to above hunk, we are not initializing raid_device's starget for +raid volumes, and so during raid disk deletion driver is not calling +scsi_remove_target() API as driver observes starget field of +raid_device's structure as NULL. + +Signed-off-by: Sreekanth Reddy +Fixes: 7786ab6aff9 ("mpt3sas: Ported WarpDrive product SSS6200 support") +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -1275,9 +1275,9 @@ scsih_target_alloc(struct scsi_target *s + sas_target_priv_data->handle = raid_device->handle; + sas_target_priv_data->sas_address = raid_device->wwid; + sas_target_priv_data->flags |= MPT_TARGET_FLAGS_VOLUME; +- sas_target_priv_data->raid_device = raid_device; + if (ioc->is_warpdrive) +- raid_device->starget = starget; ++ sas_target_priv_data->raid_device = raid_device; ++ raid_device->starget = starget; + } + spin_unlock_irqrestore(&ioc->raid_device_lock, flags); + return 0; diff --git a/queue-4.4/scsi-qla2xxx-fix-scsi-scan-hang-triggered-if-adapter-fails-during-init.patch b/queue-4.4/scsi-qla2xxx-fix-scsi-scan-hang-triggered-if-adapter-fails-during-init.patch new file mode 100644 index 00000000000..1cbc4005063 --- /dev/null +++ b/queue-4.4/scsi-qla2xxx-fix-scsi-scan-hang-triggered-if-adapter-fails-during-init.patch @@ -0,0 +1,80 @@ +From a5dd506e1584e91f3e7500ab9a165aa1b49eabd4 Mon Sep 17 00:00:00 2001 +From: Bill Kuzeja +Date: Fri, 21 Oct 2016 16:45:27 -0400 +Subject: scsi: qla2xxx: Fix scsi scan hang triggered if adapter fails during init + +From: Bill Kuzeja + +commit a5dd506e1584e91f3e7500ab9a165aa1b49eabd4 upstream. + +A system can get hung task timeouts if a qlogic board fails during +initialization (if the board breaks again or fails the init). The hang +involves the scsi scan. + +In a nutshell, since commit beb9e315e6e0 ("qla2xxx: Prevent removal and +board_disable race"): + +...it is possible to have freed ha (base_vha->hw) early by a call to +qla2x00_remove_one when pdev->enable_cnt equals zero: + + if (!atomic_read(&pdev->enable_cnt)) { + scsi_host_put(base_vha->host); + kfree(ha); + pci_set_drvdata(pdev, NULL); + return; + +Almost always, the scsi_host_put above frees the vha structure +(attached to the end of the Scsi_Host we're putting) since it's the last +put, and life is good. However, if we are entering this routine because +the adapter has broken sometime during initialization AND a scsi scan is +already in progress (and has done its own scsi_host_get), vha will not +be freed. What's worse, the scsi scan will access the freed ha structure +through qla2xxx_scan_finished: + + if (time > vha->hw->loop_reset_delay * HZ) + return 1; + +The scsi scan keeps checking to see if a scan is complete by calling +qla2xxx_scan_finished. There is a timeout value that limits the length +of time a scan can take (hw->loop_reset_delay, usually set to 5 +seconds), but this definition is in the data structure (hw) that can get +freed early. + +This can yield unpredictable results, the worst of which is that the +scsi scan can hang indefinitely. This happens when the freed structure +gets reused and loop_reset_delay gets overwritten with garbage, which +the scan obliviously uses as its timeout value. + +The fix for this is simple: at the top of qla2xxx_scan_finished, check +for the UNLOADING bit in the vha structure (_vha is not freed at this +point). If UNLOADING is set, we exit the scan for this adapter +immediately. After this last reference to the ha structure, we'll exit +the scan for this adapter, and continue on. + +This problem is hard to hit, but I have run into it doing negative +testing many times now (with a test specifically designed to bring it +out), so I can verify that this fix works. My testing has been against a +RHEL7 driver variant, but the bug and patch are equally relevant to to +the upstream driver. + +Fixes: beb9e315e6e0 ("qla2xxx: Prevent removal and board_disable race") +Signed-off-by: Bill Kuzeja +Acked-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_os.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -2257,6 +2257,8 @@ qla2xxx_scan_finished(struct Scsi_Host * + { + scsi_qla_host_t *vha = shost_priv(shost); + ++ if (test_bit(UNLOADING, &vha->dpc_flags)) ++ return 1; + if (!vha->host) + return 1; + if (time > vha->hw->loop_reset_delay * HZ) diff --git a/queue-4.4/series b/queue-4.4/series index 935f72eef8a..0960646efec 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -2,3 +2,26 @@ alsa-info-return-error-for-invalid-read-write.patch alsa-info-limit-the-proc-text-input-size.patch asoc-cs4270-fix-dapm-stream-name-mismatch.patch dib0700-fix-nec-repeat-handling.patch +swapfile-fix-memory-corruption-via-malformed-swapfile.patch +coredump-fix-unfreezable-coredumping-task.patch +s390-hypfs-use-get_free_page-instead-of-kmalloc-to-ensure-page-alignment.patch +arc-timer-rtc-implement-read-loop-in-c-vs.-inline-asm.patch +pinctrl-cherryview-serialize-register-access-in-suspend-resume.patch +pinctrl-cherryview-prevent-possible-interrupt-storm-on-resume.patch +staging-iio-ad5933-avoid-uninitialized-variable-in-error-case.patch +drivers-staging-nvec-remove-bogus-reset-command-for-ps-2-interface.patch +revert-staging-nvec-ps2-change-serio-type-to-passthrough.patch +staging-nvec-remove-managed-resource-from-ps2-driver.patch +usb-cdc-acm-fix-tiocmiwait.patch +usb-gadget-u_ether-remove-interrupt-throttling.patch +drbd-fix-kernel_sendmsg-usage-potential-null-deref.patch +toshiba-wmi-fix-loading-the-driver-on-non-toshiba-laptops.patch +clk-qoriq-don-t-allow-cpu-clocks-higher-than-starting-value.patch +iio-hid-sensors-increase-the-precision-of-scale-to-fix-wrong-reading-interpretation.patch +iio-orientation-hid-sensor-rotation-add-pm-function-fix-non-working-driver.patch +scsi-qla2xxx-fix-scsi-scan-hang-triggered-if-adapter-fails-during-init.patch +scsi-mpt3sas-fix-for-block-device-of-raid-exists-even-after-deleting-raid-disk.patch +kvm-mips-precalculate-mmio-load-resume-pc.patch +drm-radeon-disable-runtime-pm-in-certain-cases.patch +drm-i915-respect-alternate_ddc_pin-for-all-ddi-ports.patch +drm-amdgpu-disable-runtime-pm-in-certain-cases.patch diff --git a/queue-4.4/staging-iio-ad5933-avoid-uninitialized-variable-in-error-case.patch b/queue-4.4/staging-iio-ad5933-avoid-uninitialized-variable-in-error-case.patch new file mode 100644 index 00000000000..960a2372c1c --- /dev/null +++ b/queue-4.4/staging-iio-ad5933-avoid-uninitialized-variable-in-error-case.patch @@ -0,0 +1,86 @@ +From 34eee70a7b82b09dbda4cb453e0e21d460dae226 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 24 Oct 2016 17:22:01 +0200 +Subject: staging: iio: ad5933: avoid uninitialized variable in error case + +From: Arnd Bergmann + +commit 34eee70a7b82b09dbda4cb453e0e21d460dae226 upstream. + +The ad5933_i2c_read function returns an error code to indicate +whether it could read data or not. However ad5933_work() ignores +this return code and just accesses the data unconditionally, +which gets detected by gcc as a possible bug: + +drivers/staging/iio/impedance-analyzer/ad5933.c: In function 'ad5933_work': +drivers/staging/iio/impedance-analyzer/ad5933.c:649:16: warning: 'status' may be used uninitialized in this function [-Wmaybe-uninitialized] + +This adds minimal error handling so we only evaluate the +data if it was correctly read. + +Link: https://patchwork.kernel.org/patch/8110281/ +Signed-off-by: Arnd Bergmann +Acked-by: Lars-Peter Clausen +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/iio/impedance-analyzer/ad5933.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +--- a/drivers/staging/iio/impedance-analyzer/ad5933.c ++++ b/drivers/staging/iio/impedance-analyzer/ad5933.c +@@ -647,6 +647,7 @@ static void ad5933_work(struct work_stru + __be16 buf[2]; + int val[2]; + unsigned char status; ++ int ret; + + mutex_lock(&indio_dev->mlock); + if (st->state == AD5933_CTRL_INIT_START_FREQ) { +@@ -654,19 +655,22 @@ static void ad5933_work(struct work_stru + ad5933_cmd(st, AD5933_CTRL_START_SWEEP); + st->state = AD5933_CTRL_START_SWEEP; + schedule_delayed_work(&st->work, st->poll_time_jiffies); +- mutex_unlock(&indio_dev->mlock); +- return; ++ goto out; + } + +- ad5933_i2c_read(st->client, AD5933_REG_STATUS, 1, &status); ++ ret = ad5933_i2c_read(st->client, AD5933_REG_STATUS, 1, &status); ++ if (ret) ++ goto out; + + if (status & AD5933_STAT_DATA_VALID) { + int scan_count = bitmap_weight(indio_dev->active_scan_mask, + indio_dev->masklength); +- ad5933_i2c_read(st->client, ++ ret = ad5933_i2c_read(st->client, + test_bit(1, indio_dev->active_scan_mask) ? + AD5933_REG_REAL_DATA : AD5933_REG_IMAG_DATA, + scan_count * 2, (u8 *)buf); ++ if (ret) ++ goto out; + + if (scan_count == 2) { + val[0] = be16_to_cpu(buf[0]); +@@ -678,8 +682,7 @@ static void ad5933_work(struct work_stru + } else { + /* no data available - try again later */ + schedule_delayed_work(&st->work, st->poll_time_jiffies); +- mutex_unlock(&indio_dev->mlock); +- return; ++ goto out; + } + + if (status & AD5933_STAT_SWEEP_DONE) { +@@ -691,7 +694,7 @@ static void ad5933_work(struct work_stru + ad5933_cmd(st, AD5933_CTRL_INC_FREQ); + schedule_delayed_work(&st->work, st->poll_time_jiffies); + } +- ++out: + mutex_unlock(&indio_dev->mlock); + } + diff --git a/queue-4.4/staging-nvec-remove-managed-resource-from-ps2-driver.patch b/queue-4.4/staging-nvec-remove-managed-resource-from-ps2-driver.patch new file mode 100644 index 00000000000..ced9cb059e7 --- /dev/null +++ b/queue-4.4/staging-nvec-remove-managed-resource-from-ps2-driver.patch @@ -0,0 +1,33 @@ +From 68fae2f3df455f53d0dfe33483a49020b3b758f3 Mon Sep 17 00:00:00 2001 +From: Marc Dietrich +Date: Tue, 1 Nov 2016 13:59:40 +0100 +Subject: staging: nvec: remove managed resource from PS2 driver + +From: Marc Dietrich + +commit 68fae2f3df455f53d0dfe33483a49020b3b758f3 upstream. + +This basicly reverts commit e534f3e9 (staging:nvec: Introduce the use of +the managed version of kzalloc). Serio struct should never by managed +because it is refcounted. Doing so will lead to a double free oops on module +remove. + +Signed-off-by: Marc Dietrich +Fixes: e534f3e9429f ("staging:nvec: Introduce the use of the managed version of kzalloc") +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/nvec/nvec_ps2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/nvec/nvec_ps2.c ++++ b/drivers/staging/nvec/nvec_ps2.c +@@ -107,7 +107,7 @@ static int nvec_mouse_probe(struct platf + struct nvec_chip *nvec = dev_get_drvdata(pdev->dev.parent); + struct serio *ser_dev; + +- ser_dev = devm_kzalloc(&pdev->dev, sizeof(struct serio), GFP_KERNEL); ++ ser_dev = kzalloc(sizeof(struct serio), GFP_KERNEL); + if (!ser_dev) + return -ENOMEM; + diff --git a/queue-4.4/swapfile-fix-memory-corruption-via-malformed-swapfile.patch b/queue-4.4/swapfile-fix-memory-corruption-via-malformed-swapfile.patch new file mode 100644 index 00000000000..8f5ea96fc60 --- /dev/null +++ b/queue-4.4/swapfile-fix-memory-corruption-via-malformed-swapfile.patch @@ -0,0 +1,45 @@ +From dd111be69114cc867f8e826284559bfbc1c40e37 Mon Sep 17 00:00:00 2001 +From: Jann Horn +Date: Thu, 10 Nov 2016 10:46:19 -0800 +Subject: swapfile: fix memory corruption via malformed swapfile + +From: Jann Horn + +commit dd111be69114cc867f8e826284559bfbc1c40e37 upstream. + +When root activates a swap partition whose header has the wrong +endianness, nr_badpages elements of badpages are swabbed before +nr_badpages has been checked, leading to a buffer overrun of up to 8GB. + +This normally is not a security issue because it can only be exploited +by root (more specifically, a process with CAP_SYS_ADMIN or the ability +to modify a swap file/partition), and such a process can already e.g. +modify swapped-out memory of any other userspace process on the system. + +Link: http://lkml.kernel.org/r/1477949533-2509-1-git-send-email-jann@thejh.net +Signed-off-by: Jann Horn +Acked-by: Kees Cook +Acked-by: Jerome Marchand +Acked-by: Johannes Weiner +Cc: "Kirill A. Shutemov" +Cc: Vlastimil Babka +Cc: Hugh Dickins +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/swapfile.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -2225,6 +2225,8 @@ static unsigned long read_swap_header(st + swab32s(&swap_header->info.version); + swab32s(&swap_header->info.last_page); + swab32s(&swap_header->info.nr_badpages); ++ if (swap_header->info.nr_badpages > MAX_SWAP_BADPAGES) ++ return 0; + for (i = 0; i < swap_header->info.nr_badpages; i++) + swab32s(&swap_header->info.badpages[i]); + } diff --git a/queue-4.4/toshiba-wmi-fix-loading-the-driver-on-non-toshiba-laptops.patch b/queue-4.4/toshiba-wmi-fix-loading-the-driver-on-non-toshiba-laptops.patch new file mode 100644 index 00000000000..5d526535cf6 --- /dev/null +++ b/queue-4.4/toshiba-wmi-fix-loading-the-driver-on-non-toshiba-laptops.patch @@ -0,0 +1,110 @@ +From 1c80e9603fe8341ed5bea696747d07083d5e0476 Mon Sep 17 00:00:00 2001 +From: Azael Avalos +Date: Thu, 25 Aug 2016 12:50:55 -0600 +Subject: toshiba-wmi: Fix loading the driver on non Toshiba laptops + +From: Azael Avalos + +commit 1c80e9603fe8341ed5bea696747d07083d5e0476 upstream. + +Bug 150611 uncovered that the WMI ID used by the toshiba-wmi driver +is not Toshiba specific, and as such, the driver was being loaded +on non Toshiba laptops too. + +This patch adds a DMI matching list checking for TOSHIBA as the +vendor, refusing to load if it is not. + +Also the WMI GUID was renamed, dropping the TOSHIBA_ prefix, to +better reflect that such GUID is not a Toshiba specific one. + +Signed-off-by: Azael Avalos +Signed-off-by: Darren Hart +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/toshiba-wmi.c | 26 +++++++++++++++++++------- + 1 file changed, 19 insertions(+), 7 deletions(-) + +--- a/drivers/platform/x86/toshiba-wmi.c ++++ b/drivers/platform/x86/toshiba-wmi.c +@@ -24,14 +24,15 @@ + #include + #include + #include ++#include + + MODULE_AUTHOR("Azael Avalos"); + MODULE_DESCRIPTION("Toshiba WMI Hotkey Driver"); + MODULE_LICENSE("GPL"); + +-#define TOSHIBA_WMI_EVENT_GUID "59142400-C6A3-40FA-BADB-8A2652834100" ++#define WMI_EVENT_GUID "59142400-C6A3-40FA-BADB-8A2652834100" + +-MODULE_ALIAS("wmi:"TOSHIBA_WMI_EVENT_GUID); ++MODULE_ALIAS("wmi:"WMI_EVENT_GUID); + + static struct input_dev *toshiba_wmi_input_dev; + +@@ -63,6 +64,16 @@ static void toshiba_wmi_notify(u32 value + kfree(response.pointer); + } + ++static struct dmi_system_id toshiba_wmi_dmi_table[] __initdata = { ++ { ++ .ident = "Toshiba laptop", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), ++ }, ++ }, ++ {} ++}; ++ + static int __init toshiba_wmi_input_setup(void) + { + acpi_status status; +@@ -81,7 +92,7 @@ static int __init toshiba_wmi_input_setu + if (err) + goto err_free_dev; + +- status = wmi_install_notify_handler(TOSHIBA_WMI_EVENT_GUID, ++ status = wmi_install_notify_handler(WMI_EVENT_GUID, + toshiba_wmi_notify, NULL); + if (ACPI_FAILURE(status)) { + err = -EIO; +@@ -95,7 +106,7 @@ static int __init toshiba_wmi_input_setu + return 0; + + err_remove_notifier: +- wmi_remove_notify_handler(TOSHIBA_WMI_EVENT_GUID); ++ wmi_remove_notify_handler(WMI_EVENT_GUID); + err_free_keymap: + sparse_keymap_free(toshiba_wmi_input_dev); + err_free_dev: +@@ -105,7 +116,7 @@ static int __init toshiba_wmi_input_setu + + static void toshiba_wmi_input_destroy(void) + { +- wmi_remove_notify_handler(TOSHIBA_WMI_EVENT_GUID); ++ wmi_remove_notify_handler(WMI_EVENT_GUID); + sparse_keymap_free(toshiba_wmi_input_dev); + input_unregister_device(toshiba_wmi_input_dev); + } +@@ -114,7 +125,8 @@ static int __init toshiba_wmi_init(void) + { + int ret; + +- if (!wmi_has_guid(TOSHIBA_WMI_EVENT_GUID)) ++ if (!wmi_has_guid(WMI_EVENT_GUID) || ++ !dmi_check_system(toshiba_wmi_dmi_table)) + return -ENODEV; + + ret = toshiba_wmi_input_setup(); +@@ -130,7 +142,7 @@ static int __init toshiba_wmi_init(void) + + static void __exit toshiba_wmi_exit(void) + { +- if (wmi_has_guid(TOSHIBA_WMI_EVENT_GUID)) ++ if (wmi_has_guid(WMI_EVENT_GUID)) + toshiba_wmi_input_destroy(); + } + diff --git a/queue-4.4/usb-cdc-acm-fix-tiocmiwait.patch b/queue-4.4/usb-cdc-acm-fix-tiocmiwait.patch new file mode 100644 index 00000000000..b80fc616ff5 --- /dev/null +++ b/queue-4.4/usb-cdc-acm-fix-tiocmiwait.patch @@ -0,0 +1,36 @@ +From 18266403f3fe507f0246faa1d5432333a2f139ca Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 8 Nov 2016 13:10:57 +0100 +Subject: USB: cdc-acm: fix TIOCMIWAIT + +From: Johan Hovold + +commit 18266403f3fe507f0246faa1d5432333a2f139ca upstream. + +The TIOCMIWAIT implementation would return -EINVAL if any of the three +supported signals were included in the mask. + +Instead of returning an error in case TIOCM_CTS is included, simply +drop the mask check completely, which is in accordance with how other +drivers implement this ioctl. + +Fixes: 5a6a62bdb925 ("cdc-acm: add TIOCMIWAIT") +Signed-off-by: Johan Hovold +Acked-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -877,8 +877,6 @@ static int wait_serial_change(struct acm + DECLARE_WAITQUEUE(wait, current); + struct async_icount old, new; + +- if (arg & (TIOCM_DSR | TIOCM_RI | TIOCM_CD )) +- return -EINVAL; + do { + spin_lock_irq(&acm->read_lock); + old = acm->oldcount; diff --git a/queue-4.4/usb-gadget-u_ether-remove-interrupt-throttling.patch b/queue-4.4/usb-gadget-u_ether-remove-interrupt-throttling.patch new file mode 100644 index 00000000000..fa11e2baacf --- /dev/null +++ b/queue-4.4/usb-gadget-u_ether-remove-interrupt-throttling.patch @@ -0,0 +1,50 @@ +From fd9afd3cbe404998d732be6cc798f749597c5114 Mon Sep 17 00:00:00 2001 +From: Felipe Balbi +Date: Tue, 1 Nov 2016 13:20:22 +0200 +Subject: usb: gadget: u_ether: remove interrupt throttling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Felipe Balbi + +commit fd9afd3cbe404998d732be6cc798f749597c5114 upstream. + +According to Dave Miller "the networking stack has a +hard requirement that all SKBs which are transmitted +must have their completion signalled in a fininte +amount of time. This is because, until the SKB is +freed by the driver, it holds onto socket, +netfilter, and other subsystem resources." + +In summary, this means that using TX IRQ throttling +for the networking gadgets is, at least, complex and +we should avoid it for the time being. + +Reported-by: Ville Syrjälä +Tested-by: Ville Syrjälä +Suggested-by: David Miller +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/u_ether.c | 8 -------- + 1 file changed, 8 deletions(-) + +--- a/drivers/usb/gadget/function/u_ether.c ++++ b/drivers/usb/gadget/function/u_ether.c +@@ -594,14 +594,6 @@ static netdev_tx_t eth_start_xmit(struct + + req->length = length; + +- /* throttle high/super speed IRQ rate back slightly */ +- if (gadget_is_dualspeed(dev->gadget)) +- req->no_interrupt = (((dev->gadget->speed == USB_SPEED_HIGH || +- dev->gadget->speed == USB_SPEED_SUPER)) && +- !list_empty(&dev->tx_reqs)) +- ? ((atomic_read(&dev->tx_qlen) % dev->qmult) != 0) +- : 0; +- + retval = usb_ep_queue(in, req, GFP_ATOMIC); + switch (retval) { + default: -- 2.47.3