Commit Graph

608022 Commits

Author SHA1 Message Date
Sandy Huang
ddcb4f03b5 drm/rockchip: px30 vop: enable more debug interrupt
Change-Id: Ib9a6835cf4113b84fbd4ef249868a5ba11ec8073
Signed-off-by: Sandy Huang <hjc@rock-chips.com>
2018-03-01 18:19:36 +08:00
Zheng Yang
955745bc12 drm/bridge: synopsys: dw-hdmi: disable phy in dw_hdmi_bind
If hdmi is enabled in uboot and pluged out when booting kernel,
the hdmi phy is still enabled. It's better to disable it to
match the real status.

Change-Id: Ia1c5ede6499ee277d08c35a85c50e3257305f90f
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>
2018-03-01 16:23:55 +08:00
Zheng Yang
b87d97a99c drm/bridge: synopsys: dw-hdmi: update rxsense status in repo_hpd_event
Under following processes, rxsense will be not match the real
signal status.
1. HDMI plug in, irq is triggered.

2. HDMI irq is mute in dw_hdmi_hardirq, bring up dw_hdmi_irq.

3. For HDMI connection is not stable, phy_stat read in
   dw_hdmi_irq may be zero, then hdmi->rxsense will be false.

4. Connection fallback to stable, but dw_hdmi_irq had not
   unmute the irq, irq is not triggered again, and hdmi->rxsense
   keep false.

5. repo_hpd_event inform HDMI is pluggned in, dw_hdmi_bridge_enable
   is called to enable HDMI. For rxsense is flase, bridge is not
   powered up.

When repo_hpd_event is called, we think HDMI connection is stable,
updating rxsense is reliable.

Change-Id: Ie1f52f65b15e9a603dad9200529202053528a390
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>
2018-03-01 16:22:43 +08:00
Sandy Huang
f1f22eb38b drm/rockchip: add version control for rockchip drm driver
Add basic version for rockchip DRM driver

Change-Id: I13f9b81a79e4f580aa0ba6cb5b418e2780ee4f5e
Signed-off-by: Sandy Huang <hjc@rock-chips.com>
2018-03-01 16:04:28 +08:00
Sandy Huang
23d7592936 drm/rockchip: rk3288 vop: identify vop lit and vop big
most of rk3288 vop lit is same with vop big, but some feature is
different, just like max output resolution.

vop big max output: 3840*2160
vop lit max ougput: 2560*1600

Change-Id: Ie926ed29c9d23159ccf3dd5c3e885e48a21731cb
Signed-off-by: Sandy Huang <hjc@rock-chips.com>
2018-03-01 16:04:28 +08:00
Zheng Yang
c8b307dd01 phy: rockchip: inno-hdmi: set sync detection counter length
The RK3328 HDMI PHY adds a method to detect the TMDS Data sync
enable status. The counter length is defined as:
	Fref * 495 * 4 / Ftmdsclk
If sync enable counter match the counter length, the sync status
defined in reg0xdd will be set to true.

Change-Id: Ib6a58cb50127e84399011cb398e7fa36f72b3a45
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>
2018-03-01 15:45:11 +08:00
Tony Xie
1ed201f3fa arm64: dts: rockchip: set dcdc auto mode for rk817&rk809
Change-Id: I149bd790e20eb89899e091a767ef8293f83ecdd6
Signed-off-by: Tony Xie <tony.xie@rock-chips.com>
2018-03-01 14:22:53 +08:00
Sandy Huang
621759cbea arm64: dts: rockchip: rk3328: add clk define for vop iommu
Change-Id: I1f6a2ad41455046e3de90be3a6026ac0afa2490d
Signed-off-by: Sandy Huang <hjc@rock-chips.com>
2018-03-01 14:22:04 +08:00
Sandy Huang
d37da3f924 drm/rockchip: vop: close all win when enable vop
Because vop is unstable when update output timing,
so we close all win make sure stable.

Change-Id: Ifd4e60a41c667426d40e0d57e5180034bab9d5e7
Signed-off-by: Sandy Huang <hjc@rock-chips.com>
2018-03-01 14:22:04 +08:00
Sandy Huang
3edcf7147a drm/rockchip: update crtc->primary->fb to fb help fb
Before this update, drm_fb_helper_is_bound will return false
when hdmi plug.

Change-Id: I28c07b1c1c3405af2627bf423721c757f1e84258
Signed-off-by: Sandy Huang <hjc@rock-chips.com>
2018-03-01 14:22:04 +08:00
Sandy Huang
0f25f377ac drm/rockchip: vop: set is_iommu_enabled to false when enable iommu fail
for some unknown reason, iommu will enable fail, so we set is_iommu_enabled
to false insure the iommu will be enable at next frame.

Change-Id: Icd8779fff816f7498385aff9aa4712e6ad18f93c
Signed-off-by: Sandy Huang <hjc@rock-chips.com>
2018-03-01 14:22:04 +08:00
Xiao Yao
edda3bd7f2 arm64: dts: rockchip: add sample/drv clk for sdmmc/ext for rk3328 chip
Change-Id: I2c00f2e461e283abbc18b426f5298490dee4bdfe
Signed-off-by: Xiao Yao <xiaoyao@rock-chips.com>
2018-02-28 17:46:49 +08:00
Binyuan Lan
d23a54bc04 ASoC: rockchip: rk817-codec: add get_regmap and optimize the code
Change-Id: If6a810b3b9f2d192bf765ad28bcd6c9f4bfd5a9e
Signed-off-by: Binyuan Lan <lby@rock-chips.com>
2018-02-28 17:47:55 +08:00
Greg Kroah-Hartman
5e0c4113fc Linux 4.4.119 2018-02-28 10:17:24 +01:00
Eric Biggers
bf5a6a7256 binder: add missing binder_unlock()
When commit 4be5a28104 ("binder: check for binder_thread allocation
failure in binder_poll()") was applied to 4.4-stable and 4.9-stable it
was forgotten to release the global binder lock in the new error path.
The global binder lock wasn't removed until v4.14, by commit
a60b890f60 ("binder: remove global binder lock").

Fix the new error path to release the lock.

Reported-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:23 +01:00
Alex Deucher
2938d3b274 drm/amdgpu: Avoid leaking PM domain on driver unbind (v2)
commit 458d876eb8 upstream.

We only support vga_switcheroo and runtime pm on PX/HG systems
so forcing runpm to 1 doesn't do anything useful anyway.

Only call vga_switcheroo_init_domain_pm_ops() for PX/HG so
that the cleanup path is correct as well.  This mirrors what
radeon does as well.

v2: rework the patch originally sent by Lukas (Alex)

Acked-by: Lukas Wunner <lukas@wunner.de>
Reported-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Lukas Wunner <lukas@wunner.de> (v1)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:23 +01:00
Yoshihiro Shimoda
8565e4005e usb: renesas_usbhs: missed the "running" flag in usb_dmac with rx path
commit 17aa31f13c upstream.

This fixes an issue that a gadget driver (usb_f_fs) is possible to
stop rx transactions after the usb-dmac is used because the following
functions missed to set/check the "running" flag.
 - usbhsf_dma_prepare_pop_with_usb_dmac()
 - usbhsf_dma_pop_done_with_usb_dmac()

So, if next transaction uses pio, the usbhsf_prepare_pop() can not
start the transaction because the "running" flag is 0.

Fixes: 8355b2b308 ("usb: renesas_usbhs: fix the behavior of some usbhs_pkt_handle")
Cc: <stable@vger.kernel.org> # v3.19+
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:23 +01:00
Jack Pham
7a67ec752f usb: gadget: f_fs: Process all descriptors during bind
commit 6cf439e0d3 upstream.

During _ffs_func_bind(), the received descriptors are evaluated
to prepare for binding with the gadget in order to allocate
endpoints and optionally set up OS descriptors. However, the
high- and super-speed descriptors are only parsed based on
whether the gadget_is_dualspeed() and gadget_is_superspeed()
calls are true, respectively.

This is a problem in case a userspace program always provides
all of the {full,high,super,OS} descriptors when configuring a
function. Then, for example if a gadget device is not capable
of SuperSpeed, the call to ffs_do_descs() for the SS descriptors
is skipped, resulting in an incorrect offset calculation for
the vla_ptr when moving on to the OS descriptors that follow.
This causes ffs_do_os_descs() to fail as it is now looking at
the SS descriptors' offset within the raw_descs buffer instead.

_ffs_func_bind() should evaluate the descriptors unconditionally,
so remove the checks for gadget speed.

Fixes: f0175ab519 ("usb: gadget: f_fs: OS descriptors support")
Cc: stable@vger.kernel.org
Co-Developed-by: Mayank Rana <mrana@codeaurora.org>
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:23 +01:00
Karsten Koop
c54c3c7c92 usb: ldusb: add PIDs for new CASSY devices supported by this driver
commit 52ad2bd891 upstream.

This patch adds support for new CASSY devices to the ldusb driver. The
PIDs are also added to the ignore list in hid-quirks.

Signed-off-by: Karsten Koop <kkoop@ld-didactic.de>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:23 +01:00
Thinh Nguyen
2421986b04 usb: dwc3: gadget: Set maxpacket size for ep0 IN
commit 6180026341 upstream.

There are 2 control endpoint structures for DWC3. However, the driver
only updates the OUT direction control endpoint structure during
ConnectDone event. DWC3 driver needs to update the endpoint max packet
size for control IN endpoint as well. If the max packet size is not
properly set, then the driver will incorrectly calculate the data
transfer size and fail to send ZLP for HS/FS 3-stage control read
transfer.

The fix is simply to update the max packet size for the ep0 IN direction
during ConnectDone event.

Cc: stable@vger.kernel.org
Fixes: 72246da40f ("usb: Introduce DesignWare USB3 DRD Driver")
Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:23 +01:00
Kai-Heng Feng
5b7ed41497 drm/edid: Add 6 bpc quirk for CPT panel in Asus UX303LA
commit 06998a756a upstream.

Similar to commit e10aec652f ("drm/edid: Add 6 bpc quirk for display
AEO model 0."), the EDID reports "DFP 1.x compliant TMDS" but it support
6bpc instead of 8 bpc.

Hence, use 6 bpc quirk for this panel.

Fixes: 196f954e25 ("drm/i915/dp: Revert "drm/i915/dp: fall back to 18 bpp when sink capability is unknown"")
BugLink: https://bugs.launchpad.net/bugs/1749420
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Reviewed-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Cc: <stable@vger.kernel.org> # v4.8+
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20180218085359.7817-1-kai.heng.feng@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:23 +01:00
Jack Stocker
e587f0e79d Add delay-init quirk for Corsair K70 RGB keyboards
commit 7a1646d922 upstream.

Following on from this patch: https://lkml.org/lkml/2017/11/3/516,
Corsair K70 RGB keyboards also require the DELAY_INIT quirk to
start correctly at boot.

Device ids found here:
usb 3-3: New USB device found, idVendor=1b1c, idProduct=1b13
usb 3-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 3-3: Product: Corsair K70 RGB Gaming Keyboard

Signed-off-by: Jack Stocker <jackstocker.93@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:23 +01:00
Michael Weiser
56b57bd20f arm64: Disable unhandled signal log messages by default
commit 5ee39a71fd upstream.

aarch64 unhandled signal kernel messages are very verbose, suggesting
them to be more of a debugging aid:

sigsegv[33]: unhandled level 2 translation fault (11) at 0x00000000, esr
0x92000046, in sigsegv[400000+71000]
CPU: 1 PID: 33 Comm: sigsegv Tainted: G        W        4.15.0-rc3+ #3
Hardware name: linux,dummy-virt (DT)
pstate: 60000000 (nZCv daif -PAN -UAO)
pc : 0x4003f4
lr : 0x4006bc
sp : 0000fffffe94a060
x29: 0000fffffe94a070 x28: 0000000000000000
x27: 0000000000000000 x26: 0000000000000000
x25: 0000000000000000 x24: 00000000004001b0
x23: 0000000000486ac8 x22: 00000000004001c8
x21: 0000000000000000 x20: 0000000000400be8
x19: 0000000000400b30 x18: 0000000000484728
x17: 000000000865ffc8 x16: 000000000000270f
x15: 00000000000000b0 x14: 0000000000000002
x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: 0008000020008008
x9 : 000000000000000f x8 : ffffffffffffffff
x7 : 0004000000000000 x6 : ffffffffffffffff
x5 : 0000000000000000 x4 : 0000000000000000
x3 : 00000000004003e4 x2 : 0000fffffe94a1e8
x1 : 000000000000000a x0 : 0000000000000000

Disable them by default, so they can be enabled using
/proc/sys/debug/exception-trace.

Cc: <stable@vger.kernel.org>
Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:23 +01:00
AMAN DEEP
04dcdd0ed4 usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks()
commit 46408ea558 upstream.

There is a race condition between finish_unlinks->finish_urb() function
and usb_kill_urb() in ohci controller case. The finish_urb calls
spin_unlock(&ohci->lock) before usb_hcd_giveback_urb() function call,
then if during this time, usb_kill_urb is called for another endpoint,
then new ed will be added to ed_rm_list at beginning for unlink, and
ed_rm_list will point to newly added.

When finish_urb() is completed in finish_unlinks() and ed->td_list
becomes empty as in below code (in finish_unlinks() function):

        if (list_empty(&ed->td_list)) {
                *last = ed->ed_next;
                ed->ed_next = NULL;
        } else if (ohci->rh_state == OHCI_RH_RUNNING) {
                *last = ed->ed_next;
                ed->ed_next = NULL;
                ed_schedule(ohci, ed);
        }

The *last = ed->ed_next will make ed_rm_list to point to ed->ed_next
and previously added ed by usb_kill_urb will be left unreferenced by
ed_rm_list. This causes usb_kill_urb() hang forever waiting for
finish_unlink to remove added ed from ed_rm_list.

The main reason for hang in this race condtion is addition and removal
of ed from ed_rm_list in the beginning during usb_kill_urb and later
last* is modified in finish_unlinks().

As suggested by Alan Stern, the solution for proper handling of
ohci->ed_rm_list is to remove ed from the ed_rm_list before finishing
any URBs. Then at the end, we can add ed back to the list if necessary.

This properly handle the updated ohci->ed_rm_list in usb_kill_urb().

Fixes: 977dcfdc60 ("USB: OHCI: don't lose track of EDs when a controller dies")
Acked-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Aman Deep <aman.deep@samsung.com>
Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:22 +01:00
Shanker Donthineni
9eda5e8c27 irqchip/gic-v3: Use wmb() instead of smb_wmb() in gic_raise_softirq()
commit 21ec30c0ef upstream.

A DMB instruction can be used to ensure the relative order of only
memory accesses before and after the barrier. Since writes to system
registers are not memory operations, barrier DMB is not sufficient
for observability of memory accesses that occur before ICC_SGI1R_EL1
writes.

A DSB instruction ensures that no instructions that appear in program
order after the DSB instruction, can execute until the DSB instruction
has completed.

Cc: stable@vger.kernel.org
Acked-by: Will Deacon <will.deacon@arm.com>,
Signed-off-by: Shanker Donthineni <shankerd@codeaurora.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:22 +01:00
Arnd Bergmann
e169f13cbc x86/oprofile: Fix bogus GCC-8 warning in nmi_setup()
commit 85c615eb52 upstream.

GCC-8 shows a warning for the x86 oprofile code that copies per-CPU
data from CPU 0 to all other CPUs, which when building a non-SMP
kernel turns into a memcpy() with identical source and destination
pointers:

 arch/x86/oprofile/nmi_int.c: In function 'mux_clone':
 arch/x86/oprofile/nmi_int.c:285:2: error: 'memcpy' source argument is the same as destination [-Werror=restrict]
   memcpy(per_cpu(cpu_msrs, cpu).multiplex,
   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
          per_cpu(cpu_msrs, 0).multiplex,
          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
          sizeof(struct op_msr) * model->num_virt_counters);
          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 arch/x86/oprofile/nmi_int.c: In function 'nmi_setup':
 arch/x86/oprofile/nmi_int.c:466:3: error: 'memcpy' source argument is the same as destination [-Werror=restrict]
 arch/x86/oprofile/nmi_int.c:470:3: error: 'memcpy' source argument is the same as destination [-Werror=restrict]

I have analyzed a number of such warnings now: some are valid and the
GCC warning is welcome. Others turned out to be false-positives, and
GCC was changed to not warn about those any more. This is a corner case
that is a false-positive but the GCC developers feel it's better to keep
warning about it.

In this case, it seems best to work around it by telling GCC
a little more clearly that this code path is never hit with
an IS_ENABLED() configuration check.

Cc:stable as we also want old kernels to build cleanly with GCC-8.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: Jessica Yu <jeyu@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Martin Sebor <msebor@gcc.gnu.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Robert Richter <rric@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: oprofile-list@lists.sf.net
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/20180220205826.2008875-1-arnd@arndb.de
Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84095
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:22 +01:00
Lars-Peter Clausen
b19f9c4311 iio: adis_lib: Initialize trigger before requesting interrupt
commit f027e0b3a7 upstream.

The adis_probe_trigger() creates a new IIO trigger and requests an
interrupt associated with the trigger. The interrupt uses the generic
iio_trigger_generic_data_rdy_poll() function as its interrupt handler.

Currently the driver initializes some fields of the trigger structure after
the interrupt has been requested. But an interrupt can fire as soon as it
has been requested. This opens up a race condition.

iio_trigger_generic_data_rdy_poll() will access the trigger data structure
and dereference the ops field. If the ops field is not yet initialized this
will result in a NULL pointer deref.

It is not expected that the device generates an interrupt at this point, so
typically this issue did not surface unless e.g. due to a hardware
misconfiguration (wrong interrupt number, wrong polarity, etc.).

But some newer devices from the ADIS family start to generate periodic
interrupts in their power-on reset configuration and unfortunately the
interrupt can not be masked in the device.  This makes the race condition
much more visible and the following crash has been observed occasionally
when booting a system using the ADIS16460.

	Unable to handle kernel NULL pointer dereference at virtual address 00000008
	pgd = c0004000
	[00000008] *pgd=00000000
	Internal error: Oops: 5 [#1] PREEMPT SMP ARM
	Modules linked in:
	CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.9.0-04126-gf9739f0-dirty #257
	Hardware name: Xilinx Zynq Platform
	task: ef04f640 task.stack: ef050000
	PC is at iio_trigger_notify_done+0x30/0x68
	LR is at iio_trigger_generic_data_rdy_poll+0x18/0x20
	pc : [<c042d868>]    lr : [<c042d924>]    psr: 60000193
	sp : ef051bb8  ip : 00000000  fp : ef106400
	r10: c081d80a  r9 : ef3bfa00  r8 : 00000087
	r7 : ef051bec  r6 : 00000000  r5 : ef3bfa00  r4 : ee92ab00
	r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 : ee97e400
	Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment none
	Control: 18c5387d  Table: 0000404a  DAC: 00000051
	Process swapper/0 (pid: 1, stack limit = 0xef050210)
	[<c042d868>] (iio_trigger_notify_done) from [<c0065b10>] (__handle_irq_event_percpu+0x88/0x118)
	[<c0065b10>] (__handle_irq_event_percpu) from [<c0065bbc>] (handle_irq_event_percpu+0x1c/0x58)
	[<c0065bbc>] (handle_irq_event_percpu) from [<c0065c30>] (handle_irq_event+0x38/0x5c)
	[<c0065c30>] (handle_irq_event) from [<c0068e28>] (handle_level_irq+0xa4/0x130)
	[<c0068e28>] (handle_level_irq) from [<c0064e74>] (generic_handle_irq+0x24/0x34)
	[<c0064e74>] (generic_handle_irq) from [<c021ab7c>] (zynq_gpio_irqhandler+0xb8/0x13c)
	[<c021ab7c>] (zynq_gpio_irqhandler) from [<c0064e74>] (generic_handle_irq+0x24/0x34)
	[<c0064e74>] (generic_handle_irq) from [<c0065370>] (__handle_domain_irq+0x5c/0xb4)
	[<c0065370>] (__handle_domain_irq) from [<c000940c>] (gic_handle_irq+0x48/0x8c)
	[<c000940c>] (gic_handle_irq) from [<c0013e8c>] (__irq_svc+0x6c/0xa8)

To fix this make sure that the trigger is fully initialized before
requesting the interrupt.

Fixes: ccd2b52f4a ("staging:iio: Add common ADIS library")
Reported-by: Robin Getz <Robin.Getz@analog.com>
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:22 +01:00
Stefan Windfeldt-Prytz
f4e23b4343 iio: buffer: check if a buffer has been set up when poll is called
commit 4cd140bda6 upstream.

If no iio buffer has been set up and poll is called return 0.
Without this check there will be a null pointer dereference when
calling poll on a iio driver without an iio buffer.

Cc: stable@vger.kernel.org
Signed-off-by: Stefan Windfeldt-Prytz <stefan.windfeldt@axis.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:22 +01:00
Arnd Bergmann
bef7f1f03d cfg80211: fix cfg80211_beacon_dup
commit bee92d0615 upstream.

gcc-8 warns about some obviously incorrect code:

net/mac80211/cfg.c: In function 'cfg80211_beacon_dup':
net/mac80211/cfg.c:2896:3: error: 'memcpy' source argument is the same as destination [-Werror=restrict]

From the context, I conclude that we want to copy from beacon into
new_beacon, as we do in the rest of the function.

Cc: stable@vger.kernel.org
Fixes: 73da7d5bab ("mac80211: add channel switch command and beacon callbacks")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:22 +01:00
Tyrel Datwyler
ff7c5d1204 scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info
commit c398136527 upstream.

The fcp_rsp_info structure as defined in the FC spec has an initial 3
bytes reserved field. The ibmvfc driver mistakenly defined this field as
4 bytes resulting in the rsp_code field being defined in what should be
the start of the second reserved field and thus always being reported as
zero by the driver.

Ideally, we should wire ibmvfc up with libfc for the sake of code
deduplication, and ease of maintaining standardized structures in a
single place. However, for now simply fixup the definition in ibmvfc for
backporting to distros on older kernels. Wiring up with libfc will be
done in a followup patch.

Cc: <stable@vger.kernel.org>
Reported-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:22 +01:00
Paolo Abeni
d3bef1e80e ip_tunnel: fix preempt warning in ip tunnel creation/updating
commit f27337e16f upstream.

After the commit e09acddf87 ("ip_tunnel: replace dst_cache with generic
implementation"), a preemption debug warning is triggered on ip4
tunnels updating; the dst cache helper needs to be invoked in unpreemptible
context.

We don't need to load the cache on tunnel update, so this commit fixes
the warning replacing the load with a dst cache reset, which is
preempt safe.

Fixes: e09acddf87 ("ip_tunnel: replace dst_cache with generic implementation")
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:22 +01:00
Paolo Abeni
e6454536ad ip_tunnel: replace dst_cache with generic implementation
commit e09acddf87 upstream.

The current ip_tunnel cache implementation is prone to a race
that will cause the wrong dst to be cached on cuncurrent dst cache
miss and ip tunnel update via netlink.

Replacing with the generic implementation fix the issue.

Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Suggested-and-acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Nathan Chancellor <natechancellor@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:21 +01:00
Johan Hovold
7de85e493a PCI: keystone: Fix interrupt-controller-node lookup
commit eac56aa3bc upstream.

Fix child-node lookup during initialisation which was using the wrong
OF-helper and ended up searching the whole device tree depth-first
starting at the parent rather than just matching on its children.

To make things worse, the parent pci node could end up being prematurely
freed as of_find_node_by_name() drops a reference to its first argument.
Any matching child interrupt-controller node was also leaked.

Fixes: 0c4ffcfe1f ("PCI: keystone: Add TI Keystone PCIe driver")
Cc: stable <stable@vger.kernel.org>     # 3.18
Acked-by: Murali Karicheri <m-karicheri2@ti.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
[lorenzo.pieralisi@arm.com: updated commit subject]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
[johan: backport to 4.4]
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:21 +01:00
Michael Ellerman
920a541397 powerpc/64s: Fix RFI flush dependency on HARDLOCKUP_DETECTOR
The backport of commit aa8a5e0062 ("powerpc/64s: Add support for RFI
flush of L1-D cache"), incorrectly placed the new RFI flush code
inside an existing #ifdef CONFIG_HARDLOCKUP_DETECTOR block.

This has the obvious effect of requiring HARDLOCKUP_DETECTOR to be
enabled in order for RFI flush to be enabled, which is a bug.

Fix it by moving the #endif up to where it belongs.

Fixes: c389294631 ("powerpc/64s: Add support for RFI flush of L1-D cache")
Reported-by: Bernhard Kaindl <bernhard.kaindl@thalesgroup.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:21 +01:00
Paolo Abeni
482526ec0a netfilter: drop outermost socket lock in getsockopt()
commit 01ea306f2a upstream.

The Syzbot reported a possible deadlock in the netfilter area caused by
rtnl lock, xt lock and socket lock being acquired with a different order
on different code paths, leading to the following backtrace:
Reviewed-by: Xin Long <lucien.xin@gmail.com>

======================================================
WARNING: possible circular locking dependency detected
4.15.0+ #301 Not tainted
------------------------------------------------------
syzkaller233489/4179 is trying to acquire lock:
  (rtnl_mutex){+.+.}, at: [<0000000048e996fd>] rtnl_lock+0x17/0x20
net/core/rtnetlink.c:74

but task is already holding lock:
  (&xt[i].mutex){+.+.}, at: [<00000000328553a2>]
xt_find_table_lock+0x3e/0x3e0 net/netfilter/x_tables.c:1041

which lock already depends on the new lock.
===

Since commit 3f34cfae1230 ("netfilter: on sockopt() acquire sock lock
only in the required scope"), we already acquire the socket lock in
the innermost scope, where needed. In such commit I forgot to remove
the outer-most socket lock from the getsockopt() path, this commit
addresses the issues dropping it now.

v1 -> v2: fix bad subj, added relavant 'fixes' tag

Fixes: 22265a5c3c ("netfilter: xt_TEE: resolve oif using netdevice notifiers")
Fixes: 202f59afd4 ("netfilter: ipt_CLUSTERIP: do not hold dev")
Fixes: 3f34cfae1230 ("netfilter: on sockopt() acquire sock lock only in the required scope")
Reported-by: syzbot+ddde1c7b7ff7442d7f2d@syzkaller.appspotmail.com
Suggested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Tested-by: Krzysztof Piotr Oledzki <ole@ans.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-28 10:17:21 +01:00
Markus Elfring
bd48cb28be UPSTREAM: pinctrl: rockchip: Fix a typo in four comment lines
Adjust words in these descriptions.

Change-Id: I93775d4d1c40f278e46889fabbd1a65eb7708520
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
(cherry picked from commit 85dc397a24)
2018-02-28 14:55:00 +08:00
Markus Elfring
3598d8ec98 UPSTREAM: pinctrl: rockchip: Improve a size determination in rockchip_pinctrl_probe()
Replace the specification of a data structure by a pointer dereference
as the parameter for the operator "sizeof" to make the corresponding size
determination a bit safer according to the Linux coding style convention.

This issue was detected by using the Coccinelle software.

Change-Id: Ic9e944a36fb8ed01a71c60922c949c00e6ecda48
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
(cherry picked from commit 283b7ac92b)
2018-02-28 14:55:00 +08:00
Markus Elfring
e9db9f694e UPSTREAM: pinctrl: rockchip: Delete error messages for a failed memory allocation in two functions
Omit extra messages for a memory allocation failure in these functions.

This issue was detected by using the Coccinelle software.

Change-Id: If4c563f14388b60a9c49bcf4c050198a53c89a6c
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
(cherry picked from commit 98c8ee73fe)
2018-02-28 14:55:00 +08:00
Laxman Dewangan
84f76e7c4b UPSTREAM: pinctrl: rockchip: Use devm_pinctrl_register() for pinctrl registration
Use devm_pinctrl_register() for pin control registration.

Change-Id: Id474b9b0020cef9ed56e5fa1f0e477c2f5dee99a
Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
Cc: Heiko Stuebner <heiko@sntech.de>
Cc: linux-rockchip@lists.infradead.org
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
(cherry picked from commit 0085a2b47b)
2018-02-28 14:55:00 +08:00
Brian Norris
108a463671 UPSTREAM: pinctrl: rockchip: enable clock when reading pin direction register
We generally leave the GPIO clock disabled, unless an interrupt is
requested or we're accessing IO registers. We forgot to do this for the
->get_direction() callback, which means we can sometimes [1] get
incorrect results [2] from, e.g., /sys/kernel/debug/gpio.

Enable the clock, so we get the right results!

[1] Sometimes, because many systems have 1 or mor interrupt requested on
each GPIO bank, so they always leave their clock on.

[2] Incorrect, meaning the register returns 0, and so we interpret that
as "input".

Change-Id: I8c98cb41719d0666845d0ff893a7de05ce04128f
Signed-off-by: Brian Norris <briannorris@chromium.org>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
(cherry picked from commit 5c9d8c4f6b)
2018-02-28 14:55:00 +08:00
Caesar Wang
6fc772255b UPSTREAM: pinctrl: rockchip: add support the get_direction
This patch adds the get_direction to support the gpio
interface.

The gpio direction is not used on rockchip platform when use the gpio
debugfs.

Tested on kylin board. (RK3036 SoCs)
The repro steps:
$/sys/class/gpio/
echo 53 > export
$/sys/class/gpio/gpio53# cat direction
in
In general, the gpio53 should be out value, but the direction is the
default value 'in',  since the get_direction didn't supported in rockchip
pinctrl.

So, we should add this patch to support it.

Change-Id: I5510f3e60fdcae16b01a8dff1efbe31960dfcc1d
Cc: linux-gpio@vger.kernel.org
Cc: linux-rockchip@lists.infradead.org
Reported-by: Jeffy Chen <jeffy.chen@rock-chips.com>
Signed-off-by: Caesar Wang <wxt@rock-chips.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
(cherry picked from commit 6ba20a00a3)
2018-02-28 14:55:00 +08:00
Irina Tirdea
87bd37c8c8 UPSTREAM: pinctrl: Rename pinctrl_utils_dt_free_map to pinctrl_utils_free_map
Rename pinctrl_utils_dt_free_map to pinctrl_utils_free_map, since
it does not depend on device tree despite the current name. This
will enforce a consistent naming in pinctr-utils.c and will make
it clear it can be called from outside device tree (e.g. from
ACPI handling code).

Change-Id: I442cea04967997ed29d6e7a3cfe35f2ec2e9c95f
Signed-off-by: Irina Tirdea <irina.tirdea@intel.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
(cherry picked from commit d32f7fd3bb)
2018-02-28 14:55:00 +08:00
Julia Lawall
5e8693fe05 UPSTREAM: pinctrl: mediatek: add missing of_node_put
for_each_child_of_node performs an of_node_get on each iteration, so a
return from the loop requires an of_node_put.

A simplified version of the semantic patch that fixes this problem is as
follows (http://coccinelle.lip6.fr):

// <smpl>
@@
local idexpression n;
expression e,e1;
@@

 for_each_child_of_node(e1,n) {
   ...
(
   of_node_put(n);
|
   e = n
|
   return n;
|
+  of_node_put(n);
?  return ...;
)
   ...
 }
// </smpl>

Change-Id: Ifa715e7d1c475d3f33cfff3ce8b7f32636447a7c
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
(cherry picked from commit 4fc8a4b2a4)
2018-02-28 14:55:00 +08:00
Laxman Dewangan
5a4d5e6dcb UPSTREAM: pinctrl: Add devm_ apis for pinctrl_{register, unregister}
Add device managed APIs devm_pinctrl_register() and
devm_pinctrl_unregister() for the APIs pinctrl_register()
and pinctrl_unregister().

This helps in reducing code in error path and sometimes
removal of .remove callback for driver unbind.

Change-Id: I6e5f092ed0d830f8fdf357d51ae7d65fe9fb2020
Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
(cherry picked from commit 80e0f8d94d)
Fix devm_pinctrl_dev_match with commit 3024f920eb
("pinctrl: zynq: Use devm_pinctrl_register() for pinctrl registration")
2018-02-28 14:55:00 +08:00
Laxman Dewangan
6f49ad54ab UPSTREAM: gpio: Add devm_ apis for gpiochip_add_data and gpiochip_remove
Add device managed APIs devm_gpiochip_add_data() and
devm_gpiochip_remove() for the APIs gpiochip_add_data()
and gpiochip_remove().

This helps in reducing code in error path and sometimes
removal of .remove callback for driver unbind.

Change-Id: I84e3336b05d0c0e82170d16cdae8977c9f962942
Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
(cherry picked from commit 0cf3292cde)
2018-02-28 14:55:00 +08:00
Linus Walleij
0ed8601921 UPSTREAM: pinctrl: rockchip: use gpiochip data pointer
This makes the driver use the data pointer added to the gpio_chip
to store a pointer to the state container instead of relying on
container_of().

Change-Id: I9a9c0b6558e09efa680dfee0777469db62669e6c
Acked-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
(cherry picked from commit 03bf81f1cb)
2018-02-28 14:55:00 +08:00
Linus Walleij
42ca171815 UPSTREAM: gpio: add a data pointer to gpio_chip
This adds a void * pointer to gpio_chip so that driver can
assign and retrieve some states. This is done to get rid of
container_of() calls for gpio_chips embedded inside state
containers, so we can remove the need to have the gpio_chip
or later (planned) struct gpio_device be dynamically allocated
at registration time, so that its struct device can be properly
reference counted and not bound to its parent device (e.g.
a platform_device) but instead live on after unregistration
if it is opened by e.g. a char device or sysfs.

The data is added with the new function gpiochip_add_data()
and for compatibility we add static inline wrapper function
gpiochip_add() that will call gpiochip_add_data() with
NULL as argument. The latter will be removed once we have
exorcised gpiochip_add() from the kernel.

gpiochip_get_data() is added as a static inline accessor
for drivers to quickly get their data out.

Change-Id: I00f974c6008c7bd36f9bfef30bf1ef162330a6f6
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
(cherry picked from commit b08ea35a32)
2018-02-28 14:55:00 +08:00
Bamvor Jian Zhang
a1c0fa7868 UPSTREAM: gpiolib: make comment consistent with code
Commit f4d566a8a0e6 ("gpio: change member .dev to .parent") changes
member of gpiochip from .dev to .parent. Update the corresponding
comment.

Change-Id: Ib469ecfcd6dc6b97f0a20425c853ac395a0f31d9
Signed-off-by: Bamvor Jian Zhang <bamvor.zhangjian@linaro.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
(cherry picked from commit c88402c2e6)
2018-02-28 14:55:00 +08:00
Bamvor Jian Zhang
2909c66ccb UPSTREAM: gpiolib: do not allow to insert an empty gpiochip
We need to check if number of gpio is positive if there is no
such check in devicetree or acpi or whatever called before
gpiochip_add.

I suppose that devicetree and acpi do not allow insert gpiochip
with zero number but I do not know if it is enough to ignore
this check in gpiochip_add.

Change-Id: Ie11b24596988a90d03a957979e27e23658785a2f
Signed-off-by: Bamvor Jian Zhang <bamvor.zhangjian@linaro.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
(cherry picked from commit 5ed41cc4ba)
2018-02-28 14:55:00 +08:00
Linus Walleij
8aba7c88ee UPSTREAM: gpio: change member .dev to .parent
The name .dev in a struct is normally reserved for a struct device
that is let us say a superclass to the thing described by the struct.
struct gpio_chip stands out by confusingly using a struct device *dev
to point to the parent device (such as a platform_device) that
represents the hardware. As we want to give gpio_chip:s real devices,
this is not working. We need to rename this member to parent.

This was done by two coccinelle scripts, I guess it is possible to
combine them into one, but I don't know such stuff. They look like
this:

@@
struct gpio_chip *var;
@@
-var->dev
+var->parent

and:

@@
struct gpio_chip var;
@@
-var.dev
+var.parent

and:

@@
struct bgpio_chip *var;
@@
-var->gc.dev
+var->gc.parent

Plus a few instances of bgpio that I couldn't figure out how
to teach Coccinelle to rewrite.

This patch hits all over the place, but I *strongly* prefer this
solution to any piecemal approaches that just exercise patch
mechanics all over the place. It mainly hits drivers/gpio and
drivers/pinctrl which is my own backyard anyway.

Change-Id: Ib178cec5ee519164386cb60ba7f6c3f796e84f0e
Cc: Haavard Skinnemoen <hskinnemoen@gmail.com>
Cc: Rafał Miłecki <zajec5@gmail.com>
Cc: Richard Purdie <rpurdie@rpsys.net>
Cc: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Cc: Alek Du <alek.du@intel.com>
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Takashi Iwai <tiwai@suse.com>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Lee Jones <lee.jones@linaro.org>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Acked-by: Hans-Christian Egtvedt <egtvedt@samfundet.no>
Acked-by: Jacek Anaszewski <j.anaszewski@samsung.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
(cherry picked from commit 58383c7842)
2018-02-28 14:55:00 +08:00