commit f4ca8c1b9c4e24a693794badf09d3a8857c46a80 Author: Greg Kroah-Hartman Date: Mon Sep 21 10:11:11 2015 -0700 Linux 4.2.1 commit 896b4f1558712a7b7112bc876a4821894ba83794 Author: Caesar Wang Date: Mon Jul 6 11:37:23 2015 +0800 ARM: rockchip: fix broken build commit cb8cc37f4d38d96552f2c52deb15e511cdacf906 upstream. The following was seen in branch[0] build. arch/arm/mach-rockchip/platsmp.c:154:23: error: 'rockchip_secondary_startup' undeclared (first use in this function) branch[0]: git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip.git v4.3-armsoc/soc The broken build is caused by the commit fe4407c0dc58 ("ARM: rockchip: fix the CPU soft reset"). Signed-off-by: Caesar Wang The breakage was a result of it being wrongly merged in my branch with the cache invalidation rework from Russell 02b4e2756e01c ("ARM: v7 setup function should invalidate L1 cache"). Signed-off-by: Heiko Stuebner Cc: Willy Tarreau Signed-off-by: Greg Kroah-Hartman commit c5291202ffc78688bc48ffbd7a7cf7807093e25e Author: Kees Cook Date: Fri Sep 4 15:44:57 2015 -0700 fs: create and use seq_show_option for escaping commit a068acf2ee77693e0bf39d6e07139ba704f461c3 upstream. Many file systems that implement the show_options hook fail to correctly escape their output which could lead to unescaped characters (e.g. new lines) leaking into /proc/mounts and /proc/[pid]/mountinfo files. This could lead to confusion, spoofed entries (resulting in things like systemd issuing false d-bus "mount" notifications), and who knows what else. This looks like it would only be the root user stepping on themselves, but it's possible weird things could happen in containers or in other situations with delegated mount privileges. Here's an example using overlay with setuid fusermount trusting the contents of /proc/mounts (via the /etc/mtab symlink). Imagine the use of "sudo" is something more sneaky: $ BASE="ovl" $ MNT="$BASE/mnt" $ LOW="$BASE/lower" $ UP="$BASE/upper" $ WORK="$BASE/work/ 0 0 none /proc fuse.pwn user_id=1000" $ mkdir -p "$LOW" "$UP" "$WORK" $ sudo mount -t overlay -o "lowerdir=$LOW,upperdir=$UP,workdir=$WORK" none /mnt $ cat /proc/mounts none /root/ovl/mnt overlay rw,relatime,lowerdir=ovl/lower,upperdir=ovl/upper,workdir=ovl/work/ 0 0 none /proc fuse.pwn user_id=1000 0 0 $ fusermount -u /proc $ cat /proc/mounts cat: /proc/mounts: No such file or directory This fixes the problem by adding new seq_show_option and seq_show_option_n helpers, and updating the vulnerable show_option handlers to use them as needed. Some, like SELinux, need to be open coded due to unusual existing escape mechanisms. [akpm@linux-foundation.org: add lost chunk, per Kees] [keescook@chromium.org: seq_show_option should be using const parameters] Signed-off-by: Kees Cook Acked-by: Serge Hallyn Acked-by: Jan Kara Acked-by: Paul Moore Cc: J. R. Okajima Signed-off-by: Kees Cook Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 42c7443496288aab3504a2e9dc61930cc96f92a5 Author: Tang Chen Date: Fri Sep 4 15:42:32 2015 -0700 memory-hotplug: add hot-added memory ranges to memblock before allocate node_data for a node. commit 7f36e3e56db1ae75d1e157011b3cb2e0957f0a7e upstream. Commit f9126ab9241f ("memory-hotplug: fix wrong edge when hot add a new node") hot-added memory range to memblock, after creating pgdat for new node. But there is a problem: add_memory() |--> hotadd_new_pgdat() |--> free_area_init_node() |--> get_pfn_range_for_nid() |--> find start_pfn and end_pfn in memblock |--> ...... |--> memblock_add_node(start, size, nid) -------- Here, just too late. get_pfn_range_for_nid() will find that start_pfn and end_pfn are both 0. As a result, when adding memory, dmesg will give the following wrong message. Initmem setup node 5 [mem 0x0000000000000000-0xffffffffffffffff] On node 5 totalpages: 0 Built 5 zonelists in Node order, mobility grouping on. Total pages: 32588823 Policy zone: Normal init_memory_mapping: [mem 0x60000000000-0x607ffffffff] The solution is simple, just add the memory range to memblock a little earlier, before hotadd_new_pgdat(). [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Tang Chen Cc: Xishi Qiu Cc: Yasuaki Ishimatsu Cc: Kamezawa Hiroyuki Cc: Taku Izumi Cc: Gu Zheng Cc: Naoya Horiguchi Cc: Vlastimil Babka Cc: Mel Gorman Cc: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 95125d513b1a434c00f68276b7484acd59022606 Author: Ryan Ding Date: Fri Sep 4 15:42:36 2015 -0700 ocfs2: direct write will call ocfs2_rw_unlock() twice when doing aio+dio commit aa1057b3dec478b20c77bad07442318ae36d893c upstream. ocfs2_file_write_iter() is usng the wrong return value ('written'). This will cause ocfs2_rw_unlock() be called both in write_iter & end_io, triggering a BUG_ON. This issue was introduced by commit 7da839c47589 ("ocfs2: use __generic_file_write_iter()"). Orabug: 21612107 Fixes: 7da839c47589 ("ocfs2: use __generic_file_write_iter()") Signed-off-by: Ryan Ding Reviewed-by: Junxiao Bi Cc: Al Viro Cc: Mark Fasheh Cc: Joel Becker Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 7548d27d214a61ee0caaf81fcbcf46b4b4ec76ff Author: Mikulas Patocka Date: Wed Sep 2 22:51:53 2015 +0200 hpfs: update ctime and mtime on directory modification commit f49a26e7718dd30b49e3541e3e25aecf5e7294e2 upstream. Update ctime and mtime when a directory is modified. (though OS/2 doesn't update them anyway) Signed-off-by: Mikulas Patocka Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 5bd1456e702519bae29c62d6422d9277328d03af Author: Eric W. Biederman Date: Wed Aug 12 15:00:12 2015 -0500 fs: Set the size of empty dirs to 0. commit 4b75de8615050c1b0dd8d7794838c42f74ed36ba upstream. Before the make_empty_dir_inode calls were introduce into proc, sysfs, and sysctl those directories when stated reported an i_size of 0. make_empty_dir_inode started reporting an i_size of 2. At least one userspace application depended on stat returning i_size of 0. So modify make_empty_dir_inode to cause an i_size of 0 to be reported for these directories. Reported-by: Tejun Heo Acked-by: Tejun Heo Signed-off-by: "Eric W. Biederman" Signed-off-by: Greg Kroah-Hartman commit 38c7d7770013cdbac508cf10f542b1ed52c70176 Author: Joe Thornber Date: Mon Aug 31 18:20:08 2015 +0100 dm cache: fix leaking of deferred bio prison cells commit 9153df7405ae04c1b0466de720e0a685cfea1a3a upstream. There were two cases where dm_cell_visit_release() was being called, which removes the cell from the prison's rbtree, but the callers didn't also return the cell to the mempool. Fix this by having them call free_prison_cell(). This leak manifested as the 'kmalloc-96' slab growing until OOM. Fixes: 651f5fa2a3 ("dm cache: defer whole cells") Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman commit 8f019cb9644f46b00a2cb489ae53c1413ae68238 Author: Mikulas Patocka Date: Tue Aug 18 16:26:16 2015 -0400 dm stats: report precise_timestamps and histogram in @stats_list output commit bd49784fd1e8f42c7600fbfa206361324857f373 upstream. If the user selected the precise_timestamps or histogram options, report it in the @stats_list message output. If the user didn't select these options, no extra tokens are reported, thus it is backward compatible with old software that doesn't know about precise timestamps and histogram. Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer Cc: stable@vger.kernel.org # 4.2 Signed-off-by: Greg Kroah-Hartman commit 2d984207a768c1737ba15a4c292a72dd39eb8269 Author: Grant Likely Date: Sun Jun 7 15:20:11 2015 +0100 drivercore: Fix unregistration path of platform devices commit 7f5dcaf1fdf289767a126a0a5cc3ef39b5254b06 upstream. The unregister path of platform_device is broken. On registration, it will register all resources with either a parent already set, or type==IORESOURCE_{IO,MEM}. However, on unregister it will release everything with type==IORESOURCE_{IO,MEM}, but ignore the others. There are also cases where resources don't get registered in the first place, like with devices created by of_platform_populate()*. Fix the unregister path to be symmetrical with the register path by checking the parent pointer instead of the type field to decide which resources to unregister. This is safe because the upshot of the registration path algorithm is that registered resources have a parent pointer, and non-registered resources do not. * It can be argued that of_platform_populate() should be registering it's resources, and they argument has some merit. However, there are quite a few platforms that end up broken if we try to do that due to overlapping resources in the device tree. Until that is fixed, we need to solve the immediate problem. Cc: Pantelis Antoniou Cc: Wolfram Sang Cc: Rob Herring Cc: Greg Kroah-Hartman Cc: Ricardo Ribalda Delgado Signed-off-by: Grant Likely Tested-by: Ricardo Ribalda Delgado Tested-by: Wolfram Sang Signed-off-by: Rob Herring Signed-off-by: Greg Kroah-Hartman commit 75fa68d1cbb9a6087f5079cda5685d1ac8b81c63 Author: Jiang Liu Date: Fri Aug 21 15:36:23 2015 +0800 ACPI, PCI: Penalize legacy IRQ used by ACPI SCI commit 5d0ddfebb93069061880fc57ee4ba7246bd1e1ee upstream. Nick Meier reported a regression with HyperV that " After rebooting the VM, the following messages are logged in syslog when trying to load the tulip driver: tulip: Linux Tulip drivers version 1.1.15 (Feb 27, 2007) tulip: 0000:00:0a.0: PCI INT A: failed to register GSI tulip: Cannot enable tulip board #0, aborting tulip: probe of 0000:00:0a.0 failed with error -16 Errors occur in 3.19.0 kernel Works in 3.17 kernel. " According to the ACPI dump file posted by Nick at https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1440072 The ACPI MADT table includes an interrupt source overridden entry for ACPI SCI: [236h 0566 1] Subtable Type : 02 [237h 0567 1] Length : 0A [238h 0568 1] Bus : 00 [239h 0569 1] Source : 09 [23Ah 0570 4] Interrupt : 00000009 [23Eh 0574 2] Flags (decoded below) : 000D Polarity : 1 Trigger Mode : 3 And in DSDT table, we have _PRT method to define PCI interrupts, which eventually goes to: Name (PRSA, ResourceTemplate () { IRQ (Level, ActiveLow, Shared, ) {3,4,5,7,9,10,11,12,14,15} }) Name (PRSB, ResourceTemplate () { IRQ (Level, ActiveLow, Shared, ) {3,4,5,7,9,10,11,12,14,15} }) Name (PRSC, ResourceTemplate () { IRQ (Level, ActiveLow, Shared, ) {3,4,5,7,9,10,11,12,14,15} }) Name (PRSD, ResourceTemplate () { IRQ (Level, ActiveLow, Shared, ) {3,4,5,7,9,10,11,12,14,15} }) According to the MADT and DSDT tables, IRQ 9 may be used for: 1) ACPI SCI in level, high mode 2) PCI legacy IRQ in level, low mode So there's a conflict in polarity setting for IRQ 9. Prior to commit cd68f6bd53cf ("x86, irq, acpi: Get rid of special handling of GSI for ACPI SCI"), ACPI SCI is handled specially and there's no check for conflicts between ACPI SCI and PCI legagy IRQ. And it seems that the HyperV hypervisor doesn't make use of the polarity configuration in IOAPIC entry, so it just works. Commit cd68f6bd53cf gets rid of the specially handling of ACPI SCI, and then the pin attribute checking code discloses the conflicts between ACPI SCI and PCI legacy IRQ on HyperV virtual machine, and rejects the request to assign IRQ9 to PCI devices. So penalize legacy IRQ used by ACPI SCI and mark it unusable if ACPI SCI attributes conflict with PCI IRQ attributes. Please refer to following links for more information: https://bugzilla.kernel.org/show_bug.cgi?id=101301 https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1440072 Fixes: cd68f6bd53cf ("x86, irq, acpi: Get rid of special handling of GSI for ACPI SCI") Reported-and-tested-by: Nick Meier Acked-by: Thomas Gleixner Signed-off-by: Jiang Liu Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit 83065983f6b05de0e6c83206f138989bc94d91fa Author: Heiko Stuebner Date: Fri Jun 19 16:31:14 2015 +0200 ARM: dts: rockchip: fix rk3288 watchdog irq commit 1a1b698b115467242303daf5fe1d3c9886c2fa17 upstream. The watchdog irq is actually SPI 79, which translates to the original 111 in the manual where the SPI irqs start at 32. The current dw_wdt driver does not use the irq at all, so this issue never surfaced. Nevertheless fix this for a time we want to use the irq. Fixes: 2ab557b72d46 ("ARM: dts: rockchip: add core rk3288 dtsi") Signed-off-by: Heiko Stuebner Reviewed-by: Douglas Anderson Signed-off-by: Greg Kroah-Hartman commit b82505c8b7c0368a8f2dbd2559dbd358ae079aad Author: Caesar Wang Date: Tue Jun 9 17:49:57 2015 +0800 ARM: rockchip: fix the CPU soft reset commit fe4407c0dc58215a7abfb7532740d79ddabe7a7a upstream. We need different orderings when turning a core on and turning a core off. In one case we need to assert reset before turning power off. In ther other case we need to turn power on and the deassert reset. In general, the correct flow is: CPU off: reset_control_assert regmap_update_bits(pmu, PMU_PWRDN_CON, BIT(pd), BIT(pd)) wait_for_power_domain_to_turn_off CPU on: regmap_update_bits(pmu, PMU_PWRDN_CON, BIT(pd), 0) wait_for_power_domain_to_turn_on reset_control_deassert This is needed for stressing CPU up/down, as per: cd /sys/devices/system/cpu/ for i in $(seq 10000); do echo "================= $i ============" for j in $(seq 100); do while [[ "$(cat cpu1/online)$(cat cpu2/online)$(cat cpu3/online)" != "000"" ]] echo 0 > cpu1/online echo 0 > cpu2/online echo 0 > cpu3/online done while [[ "$(cat cpu1/online)$(cat cpu2/online)$(cat cpu3/online)" != "111" ]]; do echo 1 > cpu1/online echo 1 > cpu2/online echo 1 > cpu3/online done done done The following is reproducable log: [34466.186812] PM: noirq suspend of devices complete after 0.669 msecs [34466.186824] Disabling non-boot CPUs ... [34466.187509] CPU1: shutdown [34466.188672] CPU2: shutdown [34473.736627] Kernel panic - not syncing:Watchdog detected hard LOCKUP on cpu 0 ....... or others similar log: ....... [ 4072.454453] CPU1: shutdown [ 4072.504436] CPU2: shutdown [ 4072.554426] CPU3: shutdown [ 4072.577827] CPU1: Booted secondary processor [ 4072.582611] CPU2: Booted secondary processor Tested by cpu up/down scripts, the results told us need delay more time before write the sram. The wait time is affected by many aspects (e.g: cpu frequency, bootrom frequency, sram frequency, bus speed, ...). Although the cpus other than cpu0 will write the sram, the speedy is no the same as cpu0, if the cpu0 early wake up, perhaps the other cpus can't startup. As we know, the cpu0 can wake up when the cpu1/2/3 write the 'sram+4/8' and send the sev. Anyway..... At the moment, 1ms delay will be happy work for cpu up/down scripts test. Signed-off-by: Caesar Wang Reviewed-by: Doug Anderson Reviewed-by: Kever Yang Fixes: 3ee851e212d0 ("ARM: rockchip: add basic smp support for rk3288") Signed-off-by: Heiko Stuebner Signed-off-by: Greg Kroah-Hartman commit 4b0b99d5b95072e366007d3383df1ece8db241e5 Author: Vignesh R Date: Wed Jun 3 17:21:20 2015 +0530 ARM: OMAP2+: DRA7: clockdomain: change l4per2_7xx_clkdm to SW_WKUP commit b9e23f321940d2db2c9def8ff723b8464fb86343 upstream. Legacy IPs like PWMSS, present under l4per2_7xx_clkdm, cannot support smart-idle when its clock domain is in HW_AUTO on DRA7 SoCs. Hence, program clock domain to SW_WKUP. Signed-off-by: Vignesh R Acked-by: Tero Kristo Reviewed-by: Paul Walmsley Signed-off-by: Paul Walmsley Signed-off-by: Greg Kroah-Hartman commit 3d7bb5c7e5a201dd59df9b22f58db0ecd8f1114e Author: Hyungwon Hwang Date: Mon Jun 15 13:03:17 2015 +0900 ARM: dts: fix clock-frequency of display timing0 for exynos3250-rinato commit 65e3293381e1cf1abcfe1aa22b914650a40e3af4 upstream. After the commit abc0b1447d49 ("drm: Perform basic sanity checks on probed modes"), proper clock-frequency becomes mandatory for validating the mode of panel. The display does not work if there is no mode validated. Also, this clock-frequency must be set appropriately for getting required frame rate. Fixes: abc0b1447d49 ("drm: Perform basic sanity checks on probed modes") Signed-off-by: Hyungwon Hwang Signed-off-by: Krzysztof Kozlowski Sigend-off-by: Kukjin Kim Signed-off-by: Greg Kroah-Hartman commit 2dd53a1cc5f0a1a7b8ca8a1100251a099968ec2a Author: Benjamin Cama Date: Tue Jul 14 16:25:58 2015 +0200 ARM: orion5x: fix legacy orion5x IRQ numbers commit 5be9fc23cdb42e1d383ecc8eae8a8ff70a752708 upstream. Since v3.18, attempts to deliver IRQ0 are rejected, breaking orion5x. Fix this by increasing all interrupts by one, as did 5d6bed2a9c8b for dove. Also, force MULTI_IRQ_HANDLER for all orion platforms (including dove) as the specific handler is needed to shift back IRQ numbers by one. [gregory.clement@free-electrons.com]: moved the select MULTI_IRQ_HANDLER from PLAT_ORION_LEGACY to ARCH_ORION5X as it broke the build for dove. Fixes: a71b092a9c68 ("ARM: Convert handle_IRQ to use __handle_domain_irq") Signed-off-by: Benjamin Cama Signed-off-by: Gregory CLEMENT Tested-by: Detlef Vollmann Signed-off-by: Greg Kroah-Hartman commit 72b6a4c39899ef4e15826b791d571a4611edc935 Author: Sudeep Holla Date: Fri Jul 10 18:36:11 2015 +0100 ARM: BCM63xx: fix parameter to of_get_cpu_node in bcm63138_smp_boot_secondary commit a6b4b25bd15c0a490769422a7eee355e9e91a57b upstream. of_get_cpu_node provides the device node associated with the given logical CPU and cpu_logical_map contains the physical id for each CPU in the logical ordering. Passing cpu_logical_map(cpu) to of_get_cpu_node is incorrect. This patch fixes the issue by passing the logical CPU number to of_get_cpu_node Fixes: ed5cd8163da8 ("ARM: BCM63xx: Add SMP support for BCM63138") Cc: Florian Fainelli Cc: bcm-kernel-feedback-list@broadcom.com Signed-off-by: Sudeep Holla Signed-off-by: Florian Fainelli Signed-off-by: Greg Kroah-Hartman commit f41846b6ab0954079d9e656a1b69ac2d5c5cc69b Author: David Daney Date: Wed Aug 19 13:17:47 2015 -0700 of/address: Don't loop forever in of_find_matching_node_by_address(). commit 3a496b00b6f90c41bd21a410871dfc97d4f3c7ab upstream. If the internal call to of_address_to_resource() fails, we end up looping forever in of_find_matching_node_by_address(). This can be caused by a defective device tree, or calling with an incorrect matches argument. Fix by calling of_find_matching_node() unconditionally at the end of the loop. Signed-off-by: David Daney Signed-off-by: Rob Herring Signed-off-by: Greg Kroah-Hartman commit 0d9357e39a90f9287e4cc172e1713ff7ddf0cb39 Author: Thierry Reding Date: Thu Jul 9 09:59:55 2015 +0200 soc/tegra: pmc: Avoid usage of uninitialized variable commit 95169cd23bfa88003f8be06234dbd65f5737add0 upstream. Make sure to only drop the reference to the OF node after it's been successfully obtained. Fixes: 3568df3d31d6 ("soc: tegra: Add thermal reset (thermtrip) support to PMC") Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding Signed-off-by: Greg Kroah-Hartman commit f9d75f0e681f44d01621b3a80cf9407433d0e2ad Author: Xie XiuQi Date: Wed Aug 12 18:29:41 2015 +0200 x86/mce: Reenable CMCI banks when swiching back to interrupt mode commit 1b48465500611a2dc5e75800c61ac352e22d41c3 upstream. Zhang Liguang reported the following issue: 1) System detects a CMCI storm on the current CPU. 2) Kernel disables the CMCI interrupt on banks owned by the current CPU and switches to poll mode 3) After the CMCI storm subsides, kernel switches back to interrupt mode 4) We expect the system to reenable the CMCI interrupt on banks owned by the current CPU mce_intel_adjust_timer |-> cmci_reenable |-> cmci_discover # owned banks are ignored here static void cmci_discover(int banks) ... for (i = 0; i < banks; i++) { ... if (test_bit(i, owned)) # ownd banks is ignore here continue; So convert cmci_storm_disable_banks() to cmci_toggle_interrupt_mode() which controls whether to enable or disable CMCI interrupts with its argument. NB: We cannot clear the owned bit because the banks won't be polled, otherwise. See: 27f6c573e0f7 ("x86, CMCI: Add proper detection of end of CMCI storms") for more info. Reported-by: Zhang Liguang Signed-off-by: Xie XiuQi Signed-off-by: Borislav Petkov Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Tony Luck Cc: huawei.libin@huawei.com Cc: linux-edac Cc: rui.xiang@huawei.com Link: http://lkml.kernel.org/r/1439396985-12812-10-git-send-email-bp@alien8.de Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit bebd1a8108375dd05c80a1044a631cb5dd3ba152 Author: Kishon Vijay Abraham I Date: Mon Jul 27 16:54:10 2015 +0530 regulator: pbias: Fix broken pbias disable functionality commit c329061be51bef655f28c9296093984c977aff85 upstream. regulator_disable of pbias always writes '0' to the enable_reg. However actual disable value of pbias regulator is not always '0'. Fix it by populating the disable_val in pbias_reg_info for the various platforms and assign it to the disable_val of pbias regulator descriptor. This will be used by regulator_disable_regmap while disabling pbias regulator. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 65f91945f0c2a198ef3c5b234dd819e096976a80 Author: Sudip Mukherjee Date: Mon Jul 20 17:27:21 2015 +0530 auxdisplay: ks0108: fix refcount commit bab383de3b84e584b0f09227151020b2a43dc34c upstream. parport_find_base() will implicitly do parport_get_port() which increases the refcount. Then parport_register_device() will again increment the refcount. But while unloading the module we are only doing parport_unregister_device() decrementing the refcount only once. We add an parport_put_port() to neutralize the effect of parport_get_port(). Signed-off-by: Sudip Mukherjee Signed-off-by: Greg Kroah-Hartman commit cbe1672f269d6624da6ddea416ec21bee555b268 Author: Ricardo Ribalda Delgado Date: Wed Aug 12 18:04:04 2015 +0200 spi/spi-xilinx: Fix mixed poll/irq mode commit 16ea9b8ac45bf11d48af6013283e141e8ed86348 upstream. Once the module process a transfer in irq mode, the next poll transfer will not work because the transmitter is left in inhibited state. Fixes: 22417352f6b7f623 (Use polling mode on small transfers) Reported-by: Edward Kigwana Signed-off-by: Ricardo Ribalda Delgado Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit ea6964054088c32e4aba0279d1dab09a0e139bd9 Author: Ricardo Ribalda Delgado Date: Thu Aug 13 16:09:28 2015 +0200 spi/spi-xilinx: Fix spurious IRQ ACK on irq mode commit 74346841e6f5df5f7b83d5904435d273c507dba6 upstream. The ACK of an inexistent IRQ can trigger an spurious IRQ that breaks the txrx logic. This has been observed on axi_quad_spi:3.2 core. This patch only ACKs IRQs that have not been Acknowledge jet. Reported-by: Edward Kigwana Tested-by: Edward Kigwana Signed-off-by: Ricardo Ribalda Delgado Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit aefbf559ad7f965272d6ff88488c7d4d5e86a2a6 Author: Peter Chen Date: Fri Jul 31 16:36:29 2015 +0800 Doc: ABI: testing: configfs-usb-gadget-sourcesink commit 4bc58eb16bb2352854b9c664cc36c1c68d2bfbb7 upstream. Fix the name of attribute Signed-off-by: Peter Chen Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 55d7857dfb37f73cf44f798b666fb23593dcbe8d Author: Peter Chen Date: Fri Jul 31 16:36:28 2015 +0800 Doc: ABI: testing: configfs-usb-gadget-loopback commit 8cd50626823c00ca7472b2f61cb8c0eb9798ddc0 upstream. Fix the name of attribute Signed-off-by: Peter Chen Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 7688dfece365d7ea2a6d1e10be60973a5fd63af6 Author: Masahiro Yamada Date: Wed Jul 15 10:29:00 2015 +0900 devres: fix devres_get() commit 64526370d11ce8868ca495723d595b61e8697fbf upstream. Currently, devres_get() passes devres_free() the pointer to devres, but devres_free() should be given with the pointer to resource data. Fixes: 9ac7849e35f7 ("devres: device resource management") Signed-off-by: Masahiro Yamada Acked-by: Tejun Heo Signed-off-by: Greg Kroah-Hartman commit 7affef4971c2cd293118bac10522b1feeab8876f Author: Max Filippov Date: Thu Jul 16 10:41:02 2015 +0300 xtensa: fix kernel register spilling commit 77d6273e79e3a86552fcf10cdd31a69b46ed2ce6 upstream. call12 can't be safely used as the first call in the inline function, because the compiler does not extend the stack frame of the bounding function accordingly, which may result in corruption of local variables. If a call needs to be done, do call8 first followed by call12. For pure assembly code in _switch_to increase stack frame size of the bounding function. Signed-off-by: Max Filippov Signed-off-by: Greg Kroah-Hartman commit 0b07d2d83f3c7dc46b844442f27a17e17060e07f Author: Max Filippov Date: Sat Jul 4 15:27:39 2015 +0300 xtensa: fix threadptr reload on return to userspace commit 4229fb12a03e5da5882b420b0aa4a02e77447b86 upstream. Userspace return code may skip restoring THREADPTR register if there are no registers that need to be zeroed. This leads to spurious failures in libc NPTL tests. Always restore THREADPTR on return to userspace. Signed-off-by: Max Filippov Signed-off-by: Greg Kroah-Hartman commit 1e264dadd94b0f7f4063eeef9443930e3ac75855 Author: Paul Mackerras Date: Wed Jun 24 21:18:05 2015 +1000 KVM: PPC: Book3S HV: Fix race in reading change bit when removing HPTE commit 1e5bf454f58731e360e504253e85bae7aaa2d298 upstream. The reference (R) and change (C) bits in a HPT entry can be set by hardware at any time up until the HPTE is invalidated and the TLB invalidation sequence has completed. This means that when removing a HPTE, we need to read the HPTE after the invalidation sequence has completed in order to obtain reliable values of R and C. The code in kvmppc_do_h_remove() used to do this. However, commit 6f22bd3265fb ("KVM: PPC: Book3S HV: Make HTAB code LE host aware") removed the read after invalidation as a side effect of other changes. This restores the read of the HPTE after invalidation. The user-visible effect of this bug would be that when migrating a guest, there is a small probability that a page modified by the guest and then unmapped by the guest might not get re-transmitted and thus the destination might end up with a stale copy of the page. Fixes: 6f22bd3265fb Signed-off-by: Paul Mackerras Signed-off-by: Alexander Graf Signed-off-by: Greg Kroah-Hartman commit 4dd33bd6a462c7b3f8e3073c3fab6e4ed8da3620 Author: Gautham R. Shenoy Date: Fri Aug 7 17:41:20 2015 +0530 KVM: PPC: Book3S HV: Exit on H_DOORBELL if HOST_IPI is set commit 06554d9f6cc8f0b5ec903db19726a15dfc7b09d6 upstream. The code that handles the case when we receive a H_DOORBELL interrupt has a comment which says "Hypervisor doorbell - exit only if host IPI flag set". However, the current code does not actually check if the host IPI flag is set. This is due to a comparison instruction that got missed. As a result, the current code performs the exit to host only if some sibling thread or a sibling sub-core is exiting to the host. This implies that, an IPI sent to a sibling core in (subcores-per-core != 1) mode will be missed by the host unless the sibling core is on the exit path to the host. This patch adds the missing comparison operation which will ensure that when HOST_IPI flag is set, we unconditionally exit to the host. Fixes: 66feed61cdf6 Signed-off-by: Gautham R. Shenoy Reviewed-by: David Gibson Signed-off-by: Paul Mackerras Signed-off-by: Greg Kroah-Hartman commit a0a93221d62ca1b2363573c66aa1d2e5091507ad Author: Xiao Guangrong Date: Wed Aug 5 12:04:19 2015 +0800 KVM: MMU: fix validation of mmio page fault commit 6f691251c0350ac52a007c54bf3ef62e9d8cdc5e upstream. We got the bug that qemu complained with "KVM: unknown exit, hardware reason 31" and KVM shown these info: [84245.284948] EPT: Misconfiguration. [84245.285056] EPT: GPA: 0xfeda848 [84245.285154] ept_misconfig_inspect_spte: spte 0x5eaef50107 level 4 [84245.285344] ept_misconfig_inspect_spte: spte 0x5f5fadc107 level 3 [84245.285532] ept_misconfig_inspect_spte: spte 0x5141d18107 level 2 [84245.285723] ept_misconfig_inspect_spte: spte 0x52e40dad77 level 1 This is because we got a mmio #PF and the handler see the mmio spte becomes normal (points to the ram page) However, this is valid after introducing fast mmio spte invalidation which increases the generation-number instead of zapping mmio sptes, a example is as follows: 1. QEMU drops mmio region by adding a new memslot 2. invalidate all mmio sptes 3. VCPU 0 VCPU 1 access the invalid mmio spte access the region originally was MMIO before set the spte to the normal ram map mmio #PF check the spte and see it becomes normal ram mapping !!! This patch fixes the bug just by dropping the check in mmio handler, it's good for backport. Full check will be introduced in later patches Reported-by: Pavel Shirshov Tested-by: Pavel Shirshov Signed-off-by: Xiao Guangrong Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini Signed-off-by: Greg Kroah-Hartman commit 8c5117dde744d3176969e819608f0ed65abafba8 Author: Ellen Wang Date: Mon Jul 13 15:23:54 2015 -0700 HID: cp2112: fix I2C_SMBUS_BYTE write commit 6d00d153f00097d259f86304e11858a50a1b8ad1 upstream. When doing an I2C_SMBUS_BYTE write (one byte write, no address), the data to be written is in "command" not "data->byte". Signed-off-by: Ellen Wang Acked-by: Wolfram Sang Reviewed-by: Antonio Borneo Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 6fafee2a79551ccefd6f3447fef4e9ee7c86f9f4 Author: Ellen Wang Date: Thu Jul 9 22:04:31 2015 -0700 HID: cp2112: fix byte order in SMBUS operations commit 29e2d6d1f6f61ba2b5cc9d9867e01d8c31a6c4f7 upstream. Change all occurrences of be16 to le16 in cp2112_xfer(), because SMBUS words are little endian, not big endian. Signed-off-by: Ellen Wang Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit cd3d4797843c82591b3c2db2dfb8e30d864b75b5 Author: Don Zickus Date: Mon Aug 10 12:06:53 2015 -0400 HID: usbhid: Fix the check for HID_RESET_PENDING in hid_io_error commit 3af4e5a95184d6d3c1c6a065f163faa174a96a1d upstream. It was reported that after 10-20 reboots, a usb keyboard plugged into a docking station would not work unless it was replugged in. Using usbmon, it turns out the interrupt URBs were streaming with callback errors of -71 for some reason. The hid-core.c::hid_io_error was supposed to retry and then reset, but the reset wasn't really happening. The check for HID_NO_BANDWIDTH was inverted. Fix was simple. Tested by reporter and locally by me by unplugging a keyboard halfway until I could recreate a stream of errors but no disconnect. Signed-off-by: Don Zickus Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit b6acf9cd02fc824ed24edaf941d576519c4300dd Author: Andrey Ryabinin Date: Thu Sep 3 14:32:01 2015 +0300 crypto: ghash-clmulni: specify context size for ghash async algorithm commit 71c6da846be478a61556717ef1ee1cea91f5d6a8 upstream. Currently context size (cra_ctxsize) doesn't specified for ghash_async_alg. Which means it's zero. Thus crypto_create_tfm() doesn't allocate needed space for ghash_async_ctx, so any read/write to ctx (e.g. in ghash_async_init_tfm()) is not valid. Signed-off-by: Andrey Ryabinin Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit 859fe08991ab7b6996b79e1d70af2ffb5e2ef1ae Author: Leonidas Da Silva Barbosa Date: Fri Aug 14 10:14:16 2015 -0300 crypto: vmx - Fixing GHASH Key issue on little endian commit 3c5f0ed78e976be705218cad62acf6a68e9d121e upstream. GHASH table algorithm is using a big endian key. In little endian machines key will be LE ordered. After a lxvd2x instruction key is loaded as it is, LE/BE order, in first case it'll generate a wrong table resulting in wrong hashes from the algorithm. Bug affects only LE machines. In order to fix it we do a swap for loaded key. Signed-off-by: Leonidas S Barbosa Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit 30c3a5fe42df2e9fa12d8e2d753d9e0c25d9d28b Author: Leonidas Da Silva Barbosa Date: Fri Aug 14 10:12:22 2015 -0300 crypto: vmx - Fixing AES-CTR counter bug commit 1d4aa0b4c1816e8ca92a6aadb0d8f6b43c56c0d0 upstream. AES-CTR is using a counter 8bytes-8bytes what miss match with kernel specs. In the previous code a vadduwm was done to increment counter. Replacing this for a vadduqm now considering both cases counter 8-8 bytes and full 16bytes. Signed-off-by: Leonidas S Barbosa Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit 6748f4b790e955bd8e6b714a3b15b6f811910b17 Author: Robert Baldyga Date: Fri Jul 31 10:58:28 2015 +0200 serial: samsung: fix DMA for FIFO smaller than cache line size commit 736cd79f483fd7a1e0b71e6eaddf01d8d87fbbbb upstream. So far DMA mode were activated when only number of bytes to send was equal or greater than min_dma_size. Due to requirement that DMA transaction buffer should be aligned to cache line size, the excessive bytes were written to FIFO before starting DMA transaction. The problem occurred when FIFO size were smaller than cache alignment, because writing all excessive bytes to FIFO would fail. It happened in DMA mode when PIO interrupts disabled, which caused driver hung. The solution is to test if buffer is alligned to cache line size before activating DMA mode, and if it's not, running PIO mode to align buffer and then starting DMA transaction. In PIO mode, when interrupts are enabled, lack of space in FIFO isn't the problem, so buffer aligning will always finish with success. Reported-by: Krzysztof Kozlowski Signed-off-by: Robert Baldyga Signed-off-by: Greg Kroah-Hartman commit 69d0fc72c665df29ce09c6f1b07af4a5b30387a6 Author: Marek Szyprowski Date: Fri Jul 31 10:58:27 2015 +0200 serial: samsung: fix DMA mode enter condition for small FIFO sizes commit 81ccb2a69f76b88295a1da9fc9484df715fe3bfa upstream. Due to some of serial ports can have FIFO size smaller than cache line size, and because of need to align DMA buffer address to cache line size, it's necessary to calculate minimum number of bytes for which we want to start DMA transaction to be at least cache line size. The simplest way to meet this requirement is to get maximum of cache line size and FIFO size. Reported-by: Krzysztof Kozlowski Signed-off-by: Marek Szyprowski Signed-off-by: Robert Baldyga Signed-off-by: Greg Kroah-Hartman commit 79084e05b22a4de359688288687cc728263da9a6 Author: Adam Lee Date: Mon Aug 3 13:28:13 2015 +0800 serial: 8250_pci: Add support for Pericom PI7C9X795[1248] commit 89c043a6cb2d4525d48a38ed78d5f0f5672338b3 upstream. Pericom PI7C9X795[1248] are Uno/Dual/Quad/Octal UART devices, this patch enables them, also defines PCI_VENDOR_ID_PERICOM here. Signed-off-by: Adam Lee Signed-off-by: Greg Kroah-Hartman commit ec561dc3d806846507d02ba113b6433481ad8f9d Author: Maciej S. Szmigiero Date: Sun Aug 2 23:15:05 2015 +0200 serial: 8250: bind to ALi Fast Infrared Controller (ALI5123) commit 1d7002777a8fe8188caaa98d4a8eb4ed298fcdae upstream. This way this device can be used with irtty-sir - at least on Toshiba Satellite A20-S103 it is not configured by default and needs PNP activation before it starts to respond on I/O ports. This device has actually its own driver (ali-ircc), but this driver seems to be non-functional for a very long time (see http://permalink.gmane.org/gmane.linux.irda.general/484 http://permalink.gmane.org/gmane.network.protocols.obex.openobex.user/943 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=535070 ). Signed-off-by: Maciej Szmigiero Signed-off-by: Greg Kroah-Hartman commit 832810d9df00dc681b4629e08c009f5b4a1c7abc Author: Maciej S. Szmigiero Date: Sun Aug 2 23:11:52 2015 +0200 serial: 8250: don't bind to SMSC IrCC IR port commit ffa34de03bcfbfa88d8352942bc238bb48e94e2d upstream. SMSC IrCC SIR/FIR port should not be bound to by (legacy) serial driver so its own driver (smsc-ircc2) can bind to it. Signed-off-by: Maciej Szmigiero Signed-off-by: Greg Kroah-Hartman commit d96fc0af4ea266d2fc39a49a44d46b56c53f502c Author: Charles Keepax Date: Tue Aug 25 12:43:48 2015 +0100 ASoC: arizona: Poll for FLL clock OK rather than use interrupts commit 0e7659712836ca59b4735bc5cc94de38698a5e01 upstream. The extcon driver takes the DAPM mutex from within the interrupt thread in several places, which makes it possible to get into a situation where the interrupt thread is blocked waiting on the DAPM mutex whilst a DAPM sequence is running which is attempting to configure the FLL. In this case the FLL completion can't be completed as as the IRQ handler is ONE_SHOT, which cause the FLL lock to use the full time out (250mS) and report that the process timed out. It is not really practical to make the extcon driver not take the DAPM mutex from within the interrupt thread, at least not without extensive modification. So this patch fixes the issue by switching the wait for the FLL lock to polling. A few fast polls are done first as the FLL should lock quickly for a good quality reference clock, (indeed it hits on the first poll on my system) and it will poll every 20mS after that until it times out. Signed-off-by: Charles Keepax Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 00de7f96794db1f761480e172326a9d42c6e8697 Author: Nikesh Oswal Date: Wed Aug 19 16:02:24 2015 +0100 ASoC: arizona: Fix gain settings of FLL in free-run mode commit 1cf5a330c05ae37a0a98ac7c9800a6f50d5579ec upstream. The wrong register was used to set the gain of ref loop, when changing the FLL output on an active FLL. This patch corrects the offset of the gain register. Signed-off-by: Nikesh Oswal Signed-off-by: Charles Keepax Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit fa3b747afec0c88cef9d9e99090f4c8993d66410 Author: Axel Lin Date: Fri Aug 14 17:54:07 2015 +0800 ASoC: adav80x: Remove .read_flag_mask setting from adav80x_regmap_config commit 9d8352864907f0ad76124c5b28f65b5a382d7d7c upstream. Don't set .read_flag_mask for adav803, it's for adav801 only. Fixes: 0c2d69645628 ("ASoC: adav80x: Split SPI and I2C code into different modules") Signed-off-by: Axel Lin Acked-by: Lars-Peter Clausen Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 867b4196c1245c779e94c9876df3cca7f016efd5 Author: Vaishali Thakkar Date: Thu Aug 20 22:11:15 2015 +0530 ASoC: samsung: Remove redundant arndale_audio_remove commit 14a500fe1396934c6b3ed8f009459a4723da7862 upstream. There is no use of snd_soc_unregister_card in remove function as devm_snd_soc_register_card in probe function automatically handles it. So, remove use of snd_soc_unregister_card and with this change remove arndale_audio_remove as it is now redundant. Signed-off-by: Vaishali Thakkar Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 7ae811d50e1bfca4eb30366787f53d797892fd7f Author: Oder Chiou Date: Tue Aug 25 16:03:48 2015 +0800 ASoC: rt5645: Add struct dmi_system_id "Google Celes" for chrome platform commit c1713485f9fc06e1f4de9800b43f6486f2527379 upstream. Signed-off-by: Oder Chiou Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 33d4ee442a28e215d2b798fd0788e7b797d8fb29 Author: John Lin Date: Tue Aug 11 14:27:25 2015 +0800 ASoC: rt5640: fix line out no sound issue commit 9b850ca4f1c5acd7fcbbd4b38a2d27132801a8d5 upstream. The power for line out was not turned on when line out is enabled. So we add "LOUT amp" widget to turn on the power for line out. Signed-off-by: John Lin Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit f803126238a4d14067455a5a083055478a29a833 Author: Johannes Thumshirn Date: Thu Aug 6 09:16:37 2015 +0200 tty: serial: men_z135_uart.c: Fix race between IRQ and set_termios() commit 8117e347406278fd399b077add4e638cd017ae2d upstream. Fix panic caused by a race between men_z135_intr() and men_z135_set_termios(). men_z135_intr() and men_z135_set_termios() both hold the struct uart_port::lock spinlock, but men_z135_intr() does a spin_lock_irqsave() and men_z135_set_termios() does a normal spin_lock(), which can lead to a deadlock when an interrupt is called while the lock is being helt by men_z135_set_termios(). This was discovered using a insmod, hardware looppback send/receive, rmmod stress test. Signed-off-by: Johannes Thumshirn Reviewed-by: Peter Hurley Cc: Andreas Werner Signed-off-by: Greg Kroah-Hartman commit e611a710330e4c255b17500c9824fbaacb4d1e4a Author: Peter Chen Date: Mon Aug 17 10:23:03 2015 +0800 usb: host: ehci-sys: delete useless bus_to_hcd conversion commit 0521cfd06e1ebcd575e7ae36aab068b38df23850 upstream. The ehci platform device's drvdata is the pointer of struct usb_hcd already, so we doesn't need to call bus_to_hcd conversion again. Signed-off-by: Peter Chen Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit c25ec85099c45c364181284c4eb4936aa7374cc2 Author: Peter Chen Date: Thu Jul 30 13:13:03 2015 +0800 usb: gadget: f_uac2: finalize wMaxPacketSize according to bandwidth commit 913e4a90b6f9687ac0f543e7b632753e4f51c441 upstream. According to USB Audio Device 2.0 Spec, Ch4.10.1.1: wMaxPacketSize is defined as follows: Maximum packet size this endpoint is capable of sending or receiving when this configuration is selected. This is determined by the audio bandwidth constraints of the endpoint. In current code, the wMaxPacketSize is defined as the maximum packet size for ISO endpoint, and it will let the host reserve much more space than it really needs, so that we can't let more endpoints work together at one frame. We find this issue when we try to let 4 f_uac2 gadgets work together [1] at FS connection. [1]http://www.spinics.net/lists/linux-usb/msg123478.html Acked-by: Daniel Mack Cc: andrzej.p@samsung.com Cc: Daniel Mack Cc: tiwai@suse.de Cc: Alan Stern Signed-off-by: Peter Chen Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 56bd58d47653f16573367f97577c7bddaba30387 Author: Kishon Vijay Abraham I Date: Mon Jul 27 12:25:27 2015 +0530 usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes commit b2fb5b1a0f50d3ebc12342c8d8dead245e9c9d4e upstream. DWC3 uses bounce buffer to handle non max packet aligned OUT transfers and the size of bounce buffer is 512 bytes. However if the host initiates OUT transfers of size more than 512 bytes (and non max packet aligned), the driver throws a WARN dump but still programs the TRB to receive more than 512 bytes. This will cause bounce buffer to overflow and corrupt the adjacent memory locations which can be fatal. Fix it by programming the TRB to receive a maximum of DWC3_EP0_BOUNCE_SIZE (512) bytes. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit b21aa64b051d6cb2e4bd84d034f277eb97ca1700 Author: Peter Chen Date: Fri Jul 31 16:36:30 2015 +0800 doc: usb: gadget-testing: using the updated testusb.c commit f811a38300be3cdb603171aea5ad3fb42b71ca53 upstream. testusb.c at http://www.linux-usb.org/usbtest/ is out of date, using the one at the kernel source folder. Signed-off-by: Peter Chen Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 8e07a319b155824ce74496798a2e73a84c4ef025 Author: Dan Carpenter Date: Thu Jul 30 00:30:58 2015 +0300 usb: gadget: m66592-udc: forever loop in set_feature() commit 5feb5d2003499b1094d898c010a7604d7afddc4c upstream. There is an "&&" vs "||" typo here so this loops 3000 times or if we get unlucky it could loop forever. Fixes: ceaa0a6eeadf ('usb: gadget: m66592-udc: add support for TEST_MODE') Signed-off-by: Dan Carpenter Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 94d718d024e87486eba1a5bcfb13624b382c01c9 Author: David Jeffery Date: Fri Aug 28 14:50:45 2015 +1000 xfs: return errors from partial I/O failures to files commit c9eb256eda4420c06bb10f5e8fbdbe1a34bc98e0 upstream. There is an issue with xfs's error reporting in some cases of I/O partially failing and partially succeeding. Calls like fsync() can report success even though not all I/O was successful in partial-failure cases such as one disk of a RAID0 array being offline. The issue can occur when there are more than one bio per xfs_ioend struct. Each call to xfs_end_bio() for a bio completing will write a value to ioend->io_error. If a successful bio completes after any failed bio, no error is reported do to it writing 0 over the error code set by any failed bio. The I/O error information is now lost and when the ioend is completed only success is reported back up the filesystem stack. xfs_end_bio() should only set ioend->io_error in the case of BIO_UPTODATE being clear. ioend->io_error is initialized to 0 at allocation so only needs to be updated by a failed bio. Also check that ioend->io_error is 0 so that the first error reported will be the error code returned. Signed-off-by: David Jeffery Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner Signed-off-by: Greg Kroah-Hartman commit 2937b784b1947b8bc375efb8cc0ecf8ed9398a84 Author: Jan Kara Date: Tue Aug 25 10:05:13 2015 +1000 xfs: Fix file type directory corruption for btree directories commit 037542345a82aaaa228ec280fe6ddff1568d169f upstream. Users have occasionally reported that file type for some directory entries is wrong. This mostly happened after updating libraries some libraries. After some debugging the problem was traced down to xfs_dir2_node_replace(). The function uses args->filetype as a file type to store in the replaced directory entry however it also calls xfs_da3_node_lookup_int() which will store file type of the current directory entry in args->filetype. Thus we fail to change file type of a directory entry to a proper type. Fix the problem by storing new file type in a local variable before calling xfs_da3_node_lookup_int(). Reported-by: Giacomo Comes Signed-off-by: Jan Kara Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner Signed-off-by: Greg Kroah-Hartman commit 74960d2880830b3e49bab19bbf29655075258c09 Author: Jan Kara Date: Wed Aug 19 10:34:32 2015 +1000 xfs: Fix xfs_attr_leafblock definition commit ffeecc5213024ae663377b442eedcfbacf6d0c5d upstream. struct xfs_attr_leafblock contains 'entries' array which is declared with size 1 altough it can in fact contain much more entries. Since this array is followed by further struct members, gcc (at least in version 4.8.3) thinks that the array has the fixed size of 1 element and thus may optimize away all accesses beyond the end of array resulting in non-working code. This problem was only observed with userspace code in xfsprogs, however it's better to be safe in kernel as well and have matching kernel and xfsprogs definitions. Signed-off-by: Jan Kara Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner Signed-off-by: Greg Kroah-Hartman commit 95310b79776c758c97140890c7bbfc1ff730957c Author: Darrick J. Wong Date: Wed Aug 19 10:33:58 2015 +1000 libxfs: readahead of dir3 data blocks should use the read verifier commit 2f123bce18943fff819bc10f8868ffb9149fc622 upstream. In the dir3 data block readahead function, use the regular read verifier to check the block's CRC and spot-check the block contents instead of directly calling only the spot-checking routine. This prevents corrupted directory data blocks from being read into the kernel, which can lead to garbage ls output and directory loops (if say one of the entries contains slashes and other junk). Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Dave Chinner Signed-off-by: Greg Kroah-Hartman commit 3ded94561e83926a15e080f8428ba5b1af8619ea Author: Michał Pecio Date: Sun Jul 26 11:14:34 2015 +0200 USB: pl2303: fix baud-rate divisor calculations commit 49bda21266fdf195142e8b5dea057f09e96ada9f upstream. This commit fixes the following issues: 1. The 9th bit of buf was believed to be the LSB of divisor's exponent, but the hardware interprets it as MSB (9th bit) of the mantissa. The exponent is actually one bit shorter and applies to base 4, not 2 as previously believed. 2. Loop iterations doubled the exponent instead of incrementing. 3. The exponent wasn't checked for overflow. 4. The function returned requested rate instead of actual rate. Due to issue #2, the old code deviated from the wrong formula described in #1 and actually yielded correct rates when divisor was lower than 4096 by using exponents of 0, 2 or 4 base-2, interpreted as 0, 1, 2 base-4 with the 9th mantissa bit clear. However, at 93.75 kbaud or less the rate turned out too slow due to #2 or too fast due to #2 and #3. I tested this patch by sending and validating 0x00,0x01,..,0xff to an FTDI dongle at 234, 987, 2401, 9601, 31415, 115199, 250k, 500k, 750k, 1M, 1.5M, 3M+1 baud. All rates passed. I also used pv to check speed at some rates unsupported by FTDI: 45 (the lowest possible), 2M, 4M, 5M and 6M-1. Looked sane. Signed-off-by: Michal Pecio Fixes: 399aa9a75ad3 ("USB: pl2303: use divisors for unsupported baud rates") [johan: update summary ] Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman commit 1ceb04924d6ed9005e1437478fdf710011e28f84 Author: Matthijs Kooijman Date: Tue Aug 18 10:33:56 2015 +0200 USB: ftdi_sio: Added custom PID for CustomWare products commit 1fb8dc36384ae1140ee6ccc470de74397606a9d5 upstream. CustomWare uses the FTDI VID with custom PIDs for their ShipModul MiniPlex products. Signed-off-by: Matthijs Kooijman Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman commit 1ba4197a7d41fc55637fc2a93eaca4ec4ea25bbd Author: David Ward Date: Tue Aug 18 10:36:23 2015 +0200 USB: qcserial: add HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module commit 44840dec6127e4d7c5074f75d2dd96bc4ab85fe3 upstream. This is an HP-branded Sierra Wireless EM7355: https://bugzilla.redhat.com/show_bug.cgi?id=1223646#c2 Signed-off-by: David Ward Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman commit aa5715916a18e988aaa2e4f3411d6c8faae7b5df Author: Philipp Hachtmann Date: Mon Aug 17 17:31:46 2015 +0200 USB: symbolserial: Use usb_get_serial_port_data commit 951d3793bbfc0a441d791d820183aa3085c83ea9 upstream. The driver used usb_get_serial_data(port->serial) which compiled but resulted in a NULL pointer being returned (and subsequently used). I did not go deeper into this but I guess this is a regression. Signed-off-by: Philipp Hachtmann Fixes: a85796ee5149 ("USB: symbolserial: move private-data allocation to port_probe") Acked-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman commit 87da90b393bf6b5ee625dd802f914f9898123779 Author: Michael van der Westhuizen Date: Tue Aug 18 22:21:53 2015 +0200 spi: dw: Allow interface drivers to limit data I/O to word sizes commit c4fe57f76269dbb2af135071513f260ca40229a3 upstream. The commit dd11444327ce ("spi: dw-spi: Convert 16bit accesses to 32bit accesses") changed all 16bit accesses in the DW_apb_ssi driver to 32bit. This, unfortunately, breaks data register access on picoXcell, where the DW IP needs data register accesses to be word accesses (all other accesses appear to be OK). This change introduces a new master variable to allow interface drivers to specify that 16bit data transfer I/O is required. This change also introduces the ability to set this variable via device tree bindings in the MMIO interface driver. Both the core and the MMIO interface driver default to the current 32bit behaviour. Before this change, on a picoXcell pc3x3: spi_master spi32766: interrupt_transfer: fifo overrun/underrun m25p80 spi32766.0: error -5 reading 9f m25p80: probe of spi32766.0 failed with error -5 After this change: m25p80 spi32766.0: m25p40 (512 Kbytes) Fixes: dd11444327ce ("spi: dw-spi: Convert 16bit accesses to 32bit accesses") Signed-off-by: Michael van der Westhuizen Reviewed-by: Andy Shevchenko Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 28ed737ad8b39b1daf57eced83497820a6ef18d5 Author: Sebastian Reichel Date: Wed Jul 22 20:46:09 2015 +0200 spi: omap2-mcspi: add runtime PM to set_cs() commit 5f74db105b1c0980c9863e7a7d1bc0525e0316e8 upstream. Since commit ddcad7e9068eb omap2_mcspi_set_cs() is called without runtime power management requested. This patch fixes the problem by requesting runtime power management in omap2_mcspi_set_cs(). Reported-By: Pali Rohár Fixes: ddcad7e9068eb (spi: omap2-mcspi: Fix native cs with new set_cs) Tested-By: Pavel Machek Signed-off-by: Sebastian Reichel Acked-by: Michael Welling Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 321eaa816039f7bdb76be0dd010b5a6175409011 Author: Sifan Naeem Date: Thu Aug 6 10:33:01 2015 +0100 spi: img-spfi: fix kbuild test robot warning commit 9176c6657b5c313cf504d157e6d91496ee5c8708 upstream. drivers/spi/spi-img-spfi.c: In function 'img_spfi_setup': drivers/spi/spi-img-spfi.c:446: warning: 'ret' may be used uninitialized in this function. Fixes: commit b03ba9e314c1 ("spi: img-spfi: fix multiple calls to request gpio") Signed-off-by: Sifan Naeem Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 5eddcb34ea1040a9786180cb823f57dd6b2bc566 Author: Sifan Naeem Date: Wed Jul 29 11:55:26 2015 +0100 spi: img-spfi: fix multiple calls to request gpio commit b03ba9e314c12b2127243145b5c1f41b2408de62 upstream. spfi_setup may be called many times by the spi framework, but gpio_request_one can only be called once without freeing, repeatedly calling gpio_request_one will cause an error to be thrown, which causes the request to spi_setup to be marked as failed. We can have a per-spi_device flag that indicates whether or not the gpio has been requested. If the gpio has already been requested use gpio_direction_output to set the direction of the gpio. Fixes: 8c2c8c03cdcb ("spi: img-spfi: Control CS lines with GPIO") Signed-off-by: Sifan Naeem Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 3d6cbc37b49618405e69d6aaab379672a8d19aae Author: Sifan Naeem Date: Mon Jul 27 13:11:15 2015 +0100 spi: img-spfi: check for timeout error before proceeding commit 011710e2ab659c7ad6e5e554806414bd7a9508be upstream. Calling spfi_wait_all_done is not required if the transfer has timed out before all data is transferred. spfi_wait_all_done polls for Alldone interrupt which is triggered to mark the transfer as complete and to indicate it is now safe to issue a new transfer. Fixes: 8c2c8c0 ("spi: img-spfi: Control CS lines with GPIO") Signed-off-by: Sifan Naeem Reviewed-by: Andrew Bresticker Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 7c19755fe21bd1eafd8d01ca52c295548b9fa055 Author: Koji Matsuoka Date: Mon Jun 15 02:25:05 2015 +0900 spi: sh-msiof: Fix FIFO size to 64 word from 256 word commit fe78d0b7691c02744004b15f6979b3f106464bc4 upstream. The upper limit of Tx/Rx FIFO size is 64 word by the specification of H/W. This patch corrects to 64 word from 256 word. Signed-off-by: Koji Matsuoka Signed-off-by: Yoshihiro Kaneko Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 2e69408e311cdebc54de84dc1e23a3562a630efb Author: Nadav Haklai Date: Tue Aug 11 11:58:47 2015 +0200 spi: orion: On a38x, implement "50MHZ SPI AC timing" Erratum No. FE-9144572 commit 38d6211e8565af5855385825a4fdc7261eb3740e upstream. Description: On Armada 38x, the device SPI interface supports frequencies of up to 50 MHz. However, due to this erratum, when the device core clock is 250 MHz and the SPI interfaces is configured for 50MHz SPI clock and CPOL=CPHA=1, there might occur data corruption on reads from the SPI device. Workaround: Work in one of the following configurations: 1. Set CPOL=CPHA=0 in "SPI Interface Configuration Register". 2. Set TMISO_SAMPLE value to 0x2 in "SPI Timing Parameters 1 Register" before setting the interface. [gregory.clement@free-electrons.com}: port to v4.2-rc, use is_errata_50mhz_ac instead of using a new ARMADA_380_SPI spi type. Signed-off-by: Nadav Haklai Signed-off-by: Gregory CLEMENT Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit c05337fa23e289367c89fe5a6b74d2df4083ca99 Author: Lars Persson Date: Wed Jul 29 09:32:02 2015 +0200 spi: Fix regression in spi-bitbang-txrx.h commit 26a67ec47a4c58fe79c6421c3dc3d697d322d2d6 upstream. This patch fixes a regression introduced by commit 232a5adc5199 ("spi: bitbang: only toggle bitchanges"). The attempt to optimize writes of consecutive bit patterns broke most of the combinations of word size and SPI modes due to selecting the wrong bit as the MSB value. Fixes: 232a5adc5199 (spi: bitbang: only toggle bitchanges) Signed-off-by: Lars Persson Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 75572c70578fdc4ba41a516c37d5546be8195bc6 Author: Martin Sperl Date: Tue Jul 28 14:03:12 2015 +0000 spi: bcm2835: set up spi-mode before asserting cs-gpio commit acace73df2c1913a526c1b41e4741a4a6704c863 upstream. When using reverse polarity for clock (spi-cpol) on a device the clock line gets altered after chip-select has been asserted resulting in an additional clock beat, which confuses hardware. This did not show when using native-CS, as the same register is used to control cs as well as polarity, so the changes came into effect at the same time. Unfortunately this is not true with gpio-cs. To avoid this situation this patch moves the setup of polarity (spi-cpol and spi-cpha) outside of the chip-select into prepare_message, which is run prior to asserting chip-select. Also fixes resetting 3-wire mode after use of rx-mode, so that a 3-Wire sequence TX, RX, TX works as well (right now it runs TX, RX, RX instead) Reported-by: Noralf Tronnes Signed-off-by: Martin Sperl Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 5b80ec46314ee62ad3d8d330b3217f46364494d9 Author: Sebastian Andrzej Siewior Date: Fri Aug 14 17:52:07 2015 +0200 tty: serial: 8250_omap: do not use RX DMA if pause is not supported commit 830acf9e3044d4644f91b4418ef35a2094089946 upstream. The 8250-omap driver requires the DMA-engine driver to support the pause command in order to properly turn off programmed RX transfer before the driver stars manually reading from the FIFO. The lacking support of the requirement has been discovered recently. In order to stay safe here we disable RX-DMA completly on probe. The rx_dma_broken assignment on probe could be removed once we working pause function in omap-dma. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Greg Kroah-Hartman commit 5a101aacec67e8c69bca114dc59bc88bef70dafa Author: Masahiro Yamada Date: Fri Jul 24 15:58:28 2015 +0900 serial: 8250_uniphier: call clk_disable_unprepare() on failure path commit e70e69bf205e6d1f742f1cf1935b155417c9e29a upstream. If serial8250_register_8250_port() fails, disable and unprepare the clock before exiting. Fixes: 1a8d2903cb6a ("serial: 8250_uniphier: add UniPhier serial driver") Signed-off-by: Masahiro Yamada Reviewed-by: Matthias Brugger Signed-off-by: Greg Kroah-Hartman commit a7cec7d54536bc29580a8b2d9138a2bb83a21050 Author: Zhang Rui Date: Mon Aug 24 15:27:11 2015 -0500 PCI: Disable async suspend/resume for JMicron multi-function SATA/AHCI commit 91f15fb30c77d4a0d0d9b97e5cec647650853145 upstream. On multi-function JMicron SATA/PATA/AHCI devices, the PATA controller at function 1 doesn't work if it is powered on before the SATA controller at function 0. The result is that PATA doesn't work after resume, and we print messages like this: pata_jmicron 0000:02:00.1: Refused to change power state, currently in D3 irq 17: nobody cared (try booting with the "irqpoll" option) Async resume was introduced in v3.15 by 76569faa62c4 ("PM / sleep: Asynchronous threads for resume_noirq"). Prior to that, we powered on the functions in order, so this problem shouldn't happen. e6b7e41cdd8c ("ata: Disabling the async PM for JMicron chip 363/361") solved the problem for JMicron 361 and 363 devices. With async suspend disabled, we always power on function 0 before function 1. Barto then reported the same problem with a JMicron 368 (see comment #57 in the bugzilla). Rather than extending the blacklist piecemeal, disable async suspend for all JMicron multi-function SATA/PATA/AHCI devices. This quirk could stay in the ahci and pata_jmicron drivers, but it's likely the problem will occur even if pata_jmicron isn't loaded until after the suspend/resume. Making it a PCI quirk ensures that we'll preserve the power-on order even if the drivers aren't loaded. [bhelgaas: changelog, limit to multi-function, limit to IDE/ATA] Link: https://bugzilla.kernel.org/show_bug.cgi?id=81551 Reported-and-tested-by: Barto Signed-off-by: Zhang Rui Signed-off-by: Bjorn Helgaas Signed-off-by: Greg Kroah-Hartman commit a0ad5741b8e63f65f94b439a3f66e76a91aef700 Author: Mark Rustad Date: Mon Jul 13 11:40:07 2015 -0700 PCI: Add VPD function 0 quirk for Intel Ethernet devices commit 7aa6ca4d39edf01f997b9e02cf6d2fdeb224f351 upstream. Set the PCI_DEV_FLAGS_VPD_REF_F0 flag on all Intel Ethernet device functions other than function 0, so that on multi-function devices, we will always read VPD from function 0 instead of from the other functions. [bhelgaas: changelog] Signed-off-by: Mark Rustad Signed-off-by: Bjorn Helgaas Acked-by: Alexander Duyck Signed-off-by: Greg Kroah-Hartman commit dbabc222f96398c3c25a2f9da404aa21dda68bc3 Author: Mark Rustad Date: Mon Jul 13 11:40:02 2015 -0700 PCI: Add dev_flags bit to access VPD through function 0 commit 932c435caba8a2ce473a91753bad0173269ef334 upstream. Add a dev_flags bit, PCI_DEV_FLAGS_VPD_REF_F0, to access VPD through function 0 to provide VPD access on other functions. This is for hardware devices that provide copies of the same VPD capability registers in multiple functions. Because the kernel expects that each function has its own registers, both the locking and the state tracking are affected by VPD accesses to different functions. On such devices for example, if a VPD write is performed on function 0, *any* later attempt to read VPD from any other function of that device will hang. This has to do with how the kernel tracks the expected value of the F bit per function. Concurrent accesses to different functions of the same device can not only hang but also corrupt both read and write VPD data. When hangs occur, typically the error message: vpd r/w failed. This is likely a firmware bug on this device. will be seen. Never set this bit on function 0 or there will be an infinite recursion. Signed-off-by: Mark Rustad Signed-off-by: Bjorn Helgaas Acked-by: Alexander Duyck Signed-off-by: Greg Kroah-Hartman commit 2aeb4858fa61583bb4b01c9b4ab84b273573eafc Author: Bjorn Helgaas Date: Fri Jun 19 15:58:24 2015 -0500 PCI: Fix TI816X class code quirk commit d1541dc977d376406f4584d8eb055488655c98ec upstream. In fixup_ti816x_class(), we assigned "class = PCI_CLASS_MULTIMEDIA_VIDEO". But PCI_CLASS_MULTIMEDIA_VIDEO is only the two-byte base class/sub-class and needs to be shifted to make space for the low-order interface byte. Shift PCI_CLASS_MULTIMEDIA_VIDEO to set the correct class code. Fixes: 63c4408074cb ("PCI: Add quirk for setting valid class for TI816X Endpoint") Signed-off-by: Bjorn Helgaas CC: Hemant Pedanekar Signed-off-by: Greg Kroah-Hartman commit 224739ba1ca32082a582c8bcd2e10f1336a7e844 Author: Georgi Djakov Date: Tue Aug 25 15:27:43 2015 +0300 clk: qcom: Fix MSM8916 prng clock enable bit commit 1c4b4b0eb1909010b8ebda1ef208bf3ed62e7487 upstream. Fix the enable bit of the pseudorandom number generator clock. Reported-by: Stanimir Varbanov Fixes: 3966fab8b6ab "clk: qcom: Add MSM8916 Global Clock Controller support" Signed-off-by: Georgi Djakov Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman commit 4020a98269ac05953ba08e2cd4e1285c81e75869 Author: Stephen Boyd Date: Tue Jul 14 16:57:29 2015 -0700 clk: qcom: Set CLK_SET_RATE_PARENT on ce1 clocks commit d7a304e9d018c99dda80f4c16ec0fe817b5be4a1 upstream. The other ce clocks have the flag set, but ce1 doesn't, so clk_set_rate() doesn't propagate up the tree to the ce1_src_clk. Set the flag as this is supported. Reported-by: Bjorn Andersson Tested-by: Bjorn Andersson Fixes: 02824653200b ("clk: qcom: Add APQ8084 Global Clock Controller support") Fixes: d33faa9ead8d ("clk: qcom: Add support for MSM8974's global clock controller (GCC)") Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman commit b3ca66d81736ceecb1e350c71280ac1859c7590c Author: Robert Jarzmik Date: Sun Jul 12 22:49:53 2015 +0200 clk: pxa: fix core frequency reporting unit commit 4b5fb7dc9096d949a22651370bb6bf11f21edb30 upstream. Legacy drivers which are not yet ported, such as cpufreq-pxa[23]xx, rely on pxaXXx_get_clk_frequency_khz() to find the CPU core frequency. This reporting was broken because the expected unit is kHz and not Hz. Fix the reporting for pxa25x, pxa27x and pxa3xx. Fixes: fe7710fae477 ("clk: add pxa25x clock drivers") Fixes: d40670dc6169 ("clk: add pxa27x clock drivers") Fixes: 9bbb8a338fb2 ("clk: pxa: add pxa3xx clock driver") Signed-off-by: Robert Jarzmik Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman commit 42f61b54c473ed9735fc9cf2d627e3e310ed225c Author: Dan Carpenter Date: Wed Jul 29 13:17:06 2015 +0300 clk: versatile: off by one in clk_sp810_timerclken_of_get() commit 3294bee87091be5f179474f6c39d1d87769635e2 upstream. The ">" should be ">=" or we end up reading beyond the end of the array. Fixes: 6e973d2c4385 ('clk: vexpress: Add separate SP810 driver') Signed-off-by: Dan Carpenter Acked-by: Pawel Moll Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman commit ba45728dd3d3ad24c8829bb6fc9b35b53c681ebe Author: Damien.Horsley Date: Wed Aug 26 17:11:40 2015 +0100 clk: pistachio: correct critical clock list commit d31ff5f7f3b142b8d1ebb3da89187c54cdf2bc71 upstream. Current critical clock list for pistachio enables only mips and sys clocks by default but there are also other clocks that are not claimed by anyone and needs to be enabled by default. This patch updates the critical clocks that need to be enabled by default. Add a separate struct to distinguish the critical clocks as listed: 1.) core clocks: a.) mips clock 2.) peripheral system clocks: a.) sys clock b.) sys_bus clock c.) DDR clock d.) ROM clock Fixes: b35d7c33419c("CLK: Pistachio: Register core clocks") Reviewed-by: Andrew Bresticker Signed-off-by: Ezequiel Garcia Signed-off-by: Damien.Horsley Signed-off-by: Govindraj Raja Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman commit 73cf8cac24ec72354266a2b57578921118841576 Author: Zdenko Pulitika Date: Wed Aug 26 17:11:39 2015 +0100 clk: pistachio: Fix PLL rate calculation in integer mode commit 7937c6c57e0da7bffa7b10bac23f230c77523e35 upstream. .recalc_rate callback for the fractional PLL doesn't take operating mode into account when calculating PLL rate. This results in the incorrect PLL rates when PLL is operating in integer mode. Operating mode of fractional PLL is based on the value of the fractional divider. Currently it assumes that the PLL will always be configured in fractional mode which may not be the case. This may result in the wrong output frequency. Also vco was calculated based on the current operating mode which makes no sense because .set_rate is setting operating mode. Instead, vco should be calculated using PLL settings that are about to be set. Fixes: 43049b0c83f17("CLK: Pistachio: Add PLL driver") Reviewed-by: Andrew Bresticker Signed-off-by: Zdenko Pulitika Signed-off-by: Govindraj Raja Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman commit ac4c4c4ffc96cd271043204fc9f6ba9afe8355ed Author: Zdenko Pulitika Date: Wed Aug 26 17:11:38 2015 +0100 clk: pistachio: Fix override of clk-pll settings from boot loader commit e53f21c761d141bbcbce06e9ddab3b4e0a828f2c upstream. PLL enable callbacks are overriding PLL mode (int/frac) and Noise reduction (on/off) settings set by the boot loader which results in the incorrect clock rate. PLL mode and noise reduction are defined by the DSMPD and DACPD bits of the PLL control register. PLL .enable() callbacks enable PLL by deasserting all power-down bits of the PLL control register, including DSMPD and DACPD bits, which is not necessary since these bits don't actually enable/disable PLL. This commit fixes the problem by removing DSMPD and DACPD bits from the "PLL enable" mask. Fixes: 43049b0c83f17("CLK: Pistachio: Add PLL driver") Reviewed-by: Andrew Bresitcker Signed-off-by: Zdenko Pulitika Signed-off-by: Govindraj Raja Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman commit f96b6fdea5a2ef6a4ceba96463904e320fae88a3 Author: Zdenko Pulitika Date: Wed Aug 26 17:11:37 2015 +0100 clk: pistachio: Fix 32bit integer overflows commit 093affb009a3d87848e51217cd1a06ce1135633f upstream. This commit fixes 32bit integer overflows throughout the pll driver (i.e. wherever the result of integer multiplication may exceed the range of u32). One of the functions affected by this problem is .recalc_rate. It returns incorrect rate for some pll settings (not for all though) which in turn results in the incorrect rate setup of pll's child clocks. Fixes: 43049b0c83f17("CLK: Pistachio: Add PLL driver") Reviewed-by: Andrew Bresticker Signed-off-by: Zdenko Pulitika Signed-off-by: Govindraj Raja Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman commit cd26539f1233da20113eaab88a1b18775ed6dd04 Author: Marek Szyprowski Date: Wed Aug 12 10:58:22 2015 +0200 clk: s5pv210: add missing call to samsung_clk_of_add_provider() commit ba30011577330b7e29ecb5916d89c6db9fbc5b3d upstream. Commit d5e136a21b2028fb1f45143ea7112d5869bfc6c7 ("clk: samsung: Register clk provider only after registering its all clocks", merged to v3.17-rc1) modified a way that driver registers registers to core framework. This change has not been applied to s5pv210 clocks driver, which has been merged in parallel to that commit. This patch adds a missing call to samsung_clk_of_add_provider(), so the driver is operational again. Signed-off-by: Marek Szyprowski Acked-by: Tomasz Figa Signed-off-by: Michael Turquette Signed-off-by: Greg Kroah-Hartman commit 36dd7abb6ad5a99cc240911aa36abf2c2a806771 Author: Krzysztof Kozlowski Date: Fri Jun 12 10:53:25 2015 +0900 clk: exynos4: Fix wrong clock for Exynos4x12 ADC commit e323d56eb06b266b77c2b430cb5f1977ba549e03 upstream. The TSADC gate clock was used in Exynos4x12 DTSI for exynos-adc driver. However TSADC is present only on Exynos4210 so on Trats2 board (with Exynos4412 SoC) the exynos-adc driver could not be probed: ERROR: could not get clock /adc@126C0000:adc(0) exynos-adc 126c0000.adc: failed getting clock, err = -2 exynos-adc: probe of 126c0000.adc failed with error -2 Instead on Exynos4x12 SoCs the main clock used by Analog to Digital Converter is located in different register and it is named in datasheet as PCLK_ADC. Regardless of the name the purpose of this PCLK_ADC clock is the same as purpose of TSADC from Exynos4210. The patch adds gate clock for Exynos4x12 using the proper register so backward compatibility is preserved. This fixes the probe of exynos-adc driver on Exynos4x12 boards and allows accessing sensors connected to it on Trats2 board (ntc,ncp15wb473 AP and battery thermistors). Signed-off-by: Krzysztof Kozlowski Fixes: c63c57433003 ("ARM: dts: Add ADC's dt data to read raw data for exynos4x12") Reviewed-by: Javier Martinez Canillas Acked-by: Tomasz Figa Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman commit 87e980e67b3d9c5dd1e5105744f2bad0c3dc13a8 Author: Heiko Stuebner Date: Thu Jun 18 16:18:28 2015 +0200 clk: rockchip: rk3288: add CLK_SET_RATE_PARENT to sclk_mac commit 4791eb61dbe8100ccac59fecfac9d93a15db1447 upstream. The dwmac ethernet controller on the rk3288 supports phys connected via rgmii and rmii. With rgmii phys it is expected that the mac clock is provided externally while with rmii phys the clock can be external but also generated from the plls. In the later case it of course needs be at 50MHz, which gets set from the dwmac_rk driver. As most devices use a rgmii phy it never surfaced so far that the mac clk mux, doesn't go up one lever to the pll clock in the rmii case with internal clock generation, as it is missing the CLK_SET_RATE_PARENT flag, and thus will not set the correct frequency in most cases. Fixes: b9e4ba541607 ("clk: rockchip: add clock controller for rk3288") Signed-off-by: Heiko Stuebner Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman commit 342f0685635665fa940fa6bcb0da29955574239c Author: Colin Ian King Date: Mon Jun 29 22:13:38 2015 +0100 PM / clk: don't return int on __pm_clk_enable() commit f4745a92781b872455f32feb01d1dce92aefcb6c upstream. Static analysis by cppcheck found an issue that was recently introduced by commit 471f7707b6f0b1 ("PM / clock_ops: make __pm_clk_enable more generic") where a return status in ret was not being initialised and garbage being returned when ce->status >= PCE_STATUS_ERROR. The fact that ret is not being checked by the caller and that ret is only used internally __pm_clk_enable() to check if clk_enable() was OK means we can ignore returning it instead turn __pm_clk_enable() into function with a void return. Fixes: 471f7707b6f0b1 ("PM / clock_ops: make __pm_clk_enable more generic") Signed-off-by: Colin Ian King Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit 0fc9f4da02c033bc8cddb4df2fbe51e00dd5d675 Author: David Kershner Date: Thu Jul 9 13:27:53 2015 -0400 staging: unisys: Allow visorbus to autoload commit 1fc07f99134ba0b8d4099322ea0753137ea7ed3b upstream. We inadvertently remove the MODULE_DEVICE_TABLE line for visorbus, this patch adds it back in. Signed-off-by: David Kershner Signed-off-by: Benjamin Romer Fixes: d5b3f1dccee4 ('staging: unisys: move timskmod.h functionality') Signed-off-by: Greg Kroah-Hartman commit 77b7b8c74a70ac4ab3744127e8297f2a79681fe9 Author: Ian Abbott Date: Thu Jul 23 16:46:58 2015 +0100 staging: comedi: usbduxsigma: don't clobber ao_timer in command test commit c04a1f17803e0d3eeada586ca34a6b436959bc20 upstream. `devpriv->ao_timer` is used while an asynchronous command is running on the AO subdevice. It also gets modified by the subdevice's `cmdtest` handler for checking new asynchronous commands, `usbduxsigma_ao_cmdtest()`, which is not correct as it's allowed to check new commands while an old command is still running. Fix it by moving the code which sets up `devpriv->ao_timer` into the subdevice's `cmd` handler, `usbduxsigma_ao_cmd()`. Note that the removed code in `usbduxsigma_ao_cmdtest()` checked that `devpriv->ao_timer` did not end up less that 1, but that could not happen due because `cmd->scan_begin_arg` or `cmd->convert_arg` had already been range-checked. Also note that we tested the `high_speed` variable in the old code, but that is currently always 0 and means that we always use "scan" timing (`cmd->scan_begin_src == TRIG_TIMER` and `cmd->convert_src == TRIG_NOW`) and never "convert" (individual sample) timing (`cmd->scan_begin_src == TRIG_FOLLOW` and `cmd->convert_src == TRIG_TIMER`). The moved code tests `cmd->convert_src` instead to decide whether "scan" or "convert" timing is being used, although currently only "scan" timing is supported. Fixes: fb1ef622e7a3 ("staging: comedi: usbduxsigma: tidy up analog output command support") Signed-off-by: Ian Abbott Reviewed-by: Bernd Porr Reviewed-by: H Hartley Sweeten Signed-off-by: Greg Kroah-Hartman commit 2721d9990c254b032c44cba1c500fa8247053258 Author: Ian Abbott Date: Thu Jul 23 16:46:57 2015 +0100 staging: comedi: usbduxsigma: don't clobber ai_timer in command test commit 423b24c37dd5794a674c74b0ed56392003a69891 upstream. `devpriv->ai_timer` is used while an asynchronous command is running on the AI subdevice. It also gets modified by the subdevice's `cmdtest` handler for checking new asynchronous commands (`usbduxsigma_ai_cmdtest()`), which is not correct as it's allowed to check new commands while an old command is still running. Fix it by moving the code which sets up `devpriv->ai_timer` and `devpriv->ai_interval` into the subdevice's `cmd` handler, `usbduxsigma_ai_cmd()`. Note that the removed code in `usbduxsigma_ai_cmdtest()` checked that `devpriv->ai_timer` did not end up less than than 1, but that could not happen because `cmd->scan_begin_arg` had already been checked to be at least the minimum required value (at least when `cmd->scan_begin_src == TRIG_TIMER`, which had also been checked to be the case). Fixes: b986be8527c7 ("staging: comedi: usbduxsigma: tidy up analog input command support) Signed-off-by: Ian Abbott Reviewed-by: Bernd Porr Reviewed-by: H Hartley Sweeten Signed-off-by: Greg Kroah-Hartman commit 27f337ef43a9768b10ba931558c5b83951353728 Author: Ian Abbott Date: Tue Aug 11 13:05:10 2015 +0100 staging: comedi: adl_pci7x3x: fix digital output on PCI-7230 commit ad83dbd974feb2e2a8cc071a1d28782bd4d2c70e upstream. The "adl_pci7x3x" driver replaced the "adl_pci7230" and "adl_pci7432" drivers in commits 8f567c373c4b ("staging: comedi: new adl_pci7x3x driver") and 657f77d173d3 ("staging: comedi: remove adl_pci7230 and adl_pci7432 drivers"). Although the new driver code agrees with the user manuals for the respective boards, digital outputs stopped working on the PCI-7230. This has 16 digital output channels and the previous adl_pci7230 driver shifted the 16 bit output state left by 16 bits before writing to the hardware register. The new adl_pci7x3x driver doesn't do that. Fix it in `adl_pci7x3x_do_insn_bits()` by checking for the special case of the subdevice having only 16 channels and duplicating the 16 bit output state into both halves of the 32-bit register. That should work both for what the board actually does and for what the user manual says it should do. Fixes: 8f567c373c4b ("staging: comedi: new adl_pci7x3x driver") Signed-off-by: Ian Abbott Signed-off-by: Greg Kroah-Hartman commit ef07b80a189eccb3b53b07993fcdcf933cbfe4b9 Author: Mateusz Kulikowski Date: Wed Aug 12 21:54:49 2015 +0200 staging: rtl8192e: Fix log spamming in rtl8192_hard_data_xmit commit 435009bba4d0449b611bc24ae5c9636ac5b2a00e upstream. This patch fixes issue generated by commit ca93dcba3a92 ("staging: rtl8192e: Remove assert() macro") One negation was missed in conversion, therefore asserted message was always printed. For 1MB file downloaded via http, ~500 messages were generated. Signed-off-by: Mateusz Kulikowski Signed-off-by: Greg Kroah-Hartman commit 0a3b19cef4f1fd27eb8eea3f86e8e1be84bedfa7 Author: Jan H. Schönherr Date: Wed Aug 12 21:35:56 2015 +0200 sched: Fix cpu_active_mask/cpu_online_mask race commit dd9d3843755da95f63dd3a376f62b3e45c011210 upstream. There is a race condition in SMP bootup code, which may result in WARNING: CPU: 0 PID: 1 at kernel/workqueue.c:4418 workqueue_cpu_up_callback() or kernel BUG at kernel/smpboot.c:135! It can be triggered with a bit of luck in Linux guests running on busy hosts. CPU0 CPUn ==== ==== _cpu_up() __cpu_up() start_secondary() set_cpu_online() cpumask_set_cpu(cpu, to_cpumask(cpu_online_bits)); cpu_notify(CPU_ONLINE) cpumask_set_cpu(cpu, to_cpumask(cpu_active_bits)); During the various CPU_ONLINE callbacks CPUn is online but not active. Several things can go wrong at that point, depending on the scheduling of tasks on CPU0. Variant 1: cpu_notify(CPU_ONLINE) workqueue_cpu_up_callback() rebind_workers() set_cpus_allowed_ptr() This call fails because it requires an active CPU; rebind_workers() ends with a warning: WARNING: CPU: 0 PID: 1 at kernel/workqueue.c:4418 workqueue_cpu_up_callback() Variant 2: cpu_notify(CPU_ONLINE) smpboot_thread_call() smpboot_unpark_threads() .. __kthread_unpark() __kthread_bind() wake_up_state() .. select_task_rq() select_fallback_rq() The ->wake_cpu of the unparked thread is not allowed, making a call to select_fallback_rq() necessary. Then, select_fallback_rq() cannot find an allowed, active CPU and promptly resets the allowed CPUs, so that the task in question ends up on CPU0. When those unparked tasks are eventually executed, they run immediately into a BUG: kernel BUG at kernel/smpboot.c:135! Just changing the order in which the online/active bits are set (and adding some memory barriers), would solve the two issues above. However, it would change the order of operations back to the one before commit 6acbfb96976f ("sched: Fix hotplug vs. set_cpus_allowed_ptr()"), thus, reintroducing that particular problem. Going further back into history, we have at least the following commits touching this topic: - commit 2baab4e90495 ("sched: Fix select_fallback_rq() vs cpu_active/cpu_online") - commit 5fbd036b552f ("sched: Cleanup cpu_active madness") Together, these give us the following non-working solutions: - secondary CPU sets active before online, because active is assumed to be a subset of online; - secondary CPU sets online before active, because the primary CPU assumes that an online CPU is also active; - secondary CPU sets online and waits for primary CPU to set active, because it might deadlock. Commit 875ebe940d77 ("powerpc/smp: Wait until secondaries are active & online") introduces an arch-specific solution to this arch-independent problem. Now, go for a more general solution without explicit waiting and simply set active twice: once on the secondary CPU after online was set and once on the primary CPU after online was seen. set_cpus_allowed_ptr()") Signed-off-by: Jan H. Schönherr Acked-by: Peter Zijlstra Cc: Anton Blanchard Cc: Borislav Petkov Cc: Joerg Roedel Cc: Linus Torvalds Cc: Matt Wilson Cc: Michael Ellerman Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: 6acbfb96976f ("sched: Fix hotplug vs. set_cpus_allowed_ptr()") Link: http://lkml.kernel.org/r/1439408156-18840-1-git-send-email-jschoenh@amazon.de Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit d409b075a8a700838d2168175339a45dbf62240a Author: Hartmut Knaack Date: Sun Aug 2 22:43:46 2015 +0200 iio:accel:mma8452: fix _get_hp_filter_index commit 001fceb9c64a39aebb85d31134182d39c1628a21 upstream. To iterate through the available frequencies of mma8452_hp_filter_cutoff[], the array size of a row of that table needs to be provided to _get_int_plus_micros_index(). Fixes: 1e79841a00e46 ("iio: mma8452: Add highpass filter configuration.") Signed-off-by: Hartmut Knaack Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit 84ba7a767a82dc9c9ebe57eafc1320075427679a Author: Lars-Peter Clausen Date: Wed Aug 5 15:38:15 2015 +0200 iio: adis16480: Fix scale factors commit 7abad1063deb0f77d275c61f58863ec319c58c5c upstream. The different devices support by the adis16480 driver have slightly different scales for the gyroscope and accelerometer channels. Signed-off-by: Lars-Peter Clausen Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit 0d24649359448da5e80fdad0ad0475c24bdf6a7a Author: Lars-Peter Clausen Date: Wed Aug 5 15:38:14 2015 +0200 iio: Add inverse unit conversion macros commit c689a923c867eac40ed3826c1d9328edea8b6bc7 upstream. Add inverse unit conversion macro to convert from standard IIO units to units that might be used by some devices. Those are useful in combination with scale factors that are specified as IIO_VAL_FRACTIONAL. Typically the denominator for those specifications will contain the maximum raw value the sensor will generate and the numerator the value it maps to in a specific unit. Sometimes datasheets specify those in different units than the standard IIO units (e.g. degree/s instead of rad/s) and so we need to do a unit conversion. From a mathematical point of view it does not make a difference whether we apply the unit conversion to the numerator or the inverse unit conversion to the denominator since (x / y) / z = x / (y * z). But as the denominator is typically a larger value and we are rounding both the numerator and denominator to integer values using the later method gives us a better precision (E.g. the relative error is smaller if we round 8000.3 to 8000 rather than rounding 8.3 to 8). This is where in inverse unit conversion macros will be used. Marked for stable as used by some upcoming fixes. Signed-off-by: Lars-Peter Clausen Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit eb01c4a25a11b72bfaed1308325f12285f86b985 Author: Lars-Peter Clausen Date: Wed Aug 5 15:38:13 2015 +0200 iio: adis16400: Fix adis16448 gyroscope scale commit 8166537283b31d7abaae9e56bd48fbbc30cdc579 upstream. Use the correct scale for the adis16448 gyroscope output. Signed-off-by: Lars-Peter Clausen Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit b424b198e8f34e88c2e6fea995a626d188089be8 Author: Cristina Opriceana Date: Mon Aug 3 13:37:40 2015 +0300 iio: industrialio-buffer: Fix iio_buffer_poll return value commit 1bdc0293901cbea23c6dc29432e81919d4719844 upstream. Change return value to 0 if no device is bound since unsigned int cannot support negative error codes. Fixes: f18e7a068 ("iio: Return -ENODEV for file operations if the device has been unregistered") Signed-off-by: Cristina Opriceana Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit 63fa3d22fea64e85103db8248e2fb0b32b756d2a Author: Cristina Opriceana Date: Mon Aug 3 13:00:47 2015 +0300 iio: event: Remove negative error code from iio_event_poll commit 41d903c00051d8f31c98a8136edbac67e6f8688f upstream. Negative return values are not supported by iio_event_poll since its return type is unsigned int. Fixes: f18e7a068a0a3 ("iio: Return -ENODEV for file operations if the device has been unregistered") Signed-off-by: Cristina Opriceana Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit 8acfac8b0a70930a9f2d9f651bc76d8fbb3dd5ef Author: Markus Pargmann Date: Wed Jul 29 15:46:03 2015 +0200 iio: bmg160: IIO_BUFFER and IIO_TRIGGERED_BUFFER are required commit 06d2f6ca5a38abe92f1f3a132b331eee773868c3 upstream. This patch adds selects for IIO_BUFFER and IIO_TRIGGERED_BUFFER. Without IIO_BUFFER, the driver does not compile. Signed-off-by: Markus Pargmann Reviewed-by: Srinivas Pandruvada Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit eb9edaae432b0bbe88072dc95aee0237072b574b Author: Martin Schwidefsky Date: Fri Aug 14 13:20:28 2015 +0200 s390/setup: fix novx parameter commit 89b1145e93771d727645c96e323539c029b63f1c upstream. The novx parameter disables the vector facility but the HWCAP_S390_VXRS bit in the ELf hardware capabilies is always set if the machine has the vector facility. If the user space program uses the "vx" string in the features field of /proc/cpuinfo to utilize vector instruction it will crash if the novx kernel paramter is set. Convert setup_hwcaps to an arch_initcall and use MACHINE_HAS_VX to decide if the HWCAPS_S390_VXRS bit needs to be set. Reported-by: Ulrich Weigand Reviewed-by: Heiko Carstens Signed-off-by: Martin Schwidefsky Signed-off-by: Greg Kroah-Hartman commit 303b47e5346c6b528c2cc6d4c102eae1ec22326c Author: Takashi Iwai Date: Wed Sep 9 16:52:09 2015 +0200 drm/i915: Fix CSR MMIO address check commit 982b0b2dd590c00f089fc6fe915bd0cb302a7f5c upstream. Fix a wrong logical AND (&&) used for the range check of CSR MMIO. Spotted nicely by gcc -Wlogical-op flag: drivers/gpu/drm/i915/intel_csr.c: In function ‘finish_csr_load’: drivers/gpu/drm/i915/intel_csr.c:353:41: warning: logical ‘and’ of mutually exclusive tests is always false [-Wlogical-op] Fixes: eb805623d8b1 ('drm/i915/skl: Add support to load SKL CSR firmware.') Signed-off-by: Takashi Iwai Reviewed-by: Daniel Vetter Reviewed-by: Animesh Manna Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit f3bfd56b350b9ece3336deecbc44a03e3d9ca600 Author: Chris Wilson Date: Tue Sep 8 14:17:13 2015 +0100 drm/i915: Limit the number of loops for reading a split 64bit register commit acd29f7b22262d9e848393b9b6ae13eb42d22514 upstream. In I915_READ64_2x32 we attempt to read a 64bit register using 2 32bit reads. Due to the nature of the registers we try to read in this manner, they may increment between the two instruction (e.g. a timestamp counter). To keep the result accurate, we repeat the read if we detect an overflow (i.e. the upper value varies). However, some hardware is just plain flaky and may endless loop as the the upper 32bits are not stable. Just give up after a couple of tries and report whatever we read last. v2: Use the most recent values when erring out on an unstable register. Reported-by: russianneuromancer@ya.ru Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91906 Signed-off-by: Chris Wilson Cc: Michał Winiarski Cc: Daniel Vetter Cc: Jani Nikula Reviewed-by: Daniel Vetter Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit f962a1efb5d690fbb0b061eb944d6b92953cb8cd Author: Chris Wilson Date: Mon Aug 31 15:10:39 2015 +0100 drm/i915: Always mark the object as dirty when used by the GPU commit 51bc140431e233284660b1d22c47dec9ecdb521e upstream. There have been many hard to track down bugs whereby userspace forgot to flag a write buffer and then cause graphics corruption or a hung GPU when that buffer was later purged under memory pressure (as the buffer appeared clean, its pages would have been evicted rather than preserved and any changes more recent than in the backing storage would be lost). In retrospect this is a rare optimisation against memory pressure, already the slow path. If we always mark the buffer as dirty when accessed by the GPU, anything not used can still be evicted cheaply (ideal behaviour for mark-and-sweep eviction) but we do not run the risk of corruption. For correct read serialisation, userspace still has to notify when the GPU writes to an object. However, there are certain situations under which userspace may wish to tell white lies to the kernel... Signed-off-by: Chris Wilson Cc: Daniel Vetter Cc: Kristian Høgsberg Cc: Jesse Barnes Cc: "Goel, Akash" Cc: Michał Winiarski Reviewed-by: Daniel Vetter Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit 2c5417aecde9955cc3a48a39946344a22cda522c Author: Gaurav K Singh Date: Mon Aug 3 15:45:32 2015 +0530 drm/i915: Allow DSI dual link to be configured on any pipe commit 824257857fd81f5e749831ff9cd63566b5a86abe upstream. Just like single link MIPI panels, similarly for dual link panels, pipe to be configured is based on the DVO port from VBT Block 2. In hardware, Port A is mapped with Pipe A and Port C is mapped with Pipe B. This issue got introduced in - commit 7e9804fdcffc650515c60f524b8b2076ee59e710 Author: Jani Nikula Date: Fri Jan 16 14:27:23 2015 +0200 drm/i915/dsi: add drm mipi dsi host support Signed-off-by: Gaurav K Singh Reviewed-by: Ville Syrjälä Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit 9648e7a7c73ecf873afbf2e566258115140740ae Author: Jonathon Jongsma Date: Thu Aug 20 14:04:32 2015 -0500 drm/qxl: validate monitors config modes commit bd3e1c7c6de9f5f70d97cdb6c817151c0477c5e3 upstream. Due to some recent changes in drm_helper_probe_single_connector_modes_merge_bits(), old custom modes were not being pruned properly. In current kernels, drm_mode_validate_basic() is called to sanity-check each mode in the list. If the sanity-check passes, the mode's status gets set to to MODE_OK. In older kernels this check was not done, so old custom modes would still have a status of MODE_UNVERIFIED at this point, and would therefore be pruned later in the function. As a result of this new behavior, the list of modes for a device always includes every custom mode ever configured for the device, with the largest one listed first. Since desktop environments usually choose the first preferred mode when a hotplug event is emitted, this had the result of making it very difficult for the user to reduce the size of the display. The qxl driver did implement the mode_valid connector function, but it was empty. In order to restore the old behavior where old custom modes are pruned, we implement a proper mode_valid function for the qxl driver. This function now checks each mode against the last configured custom mode and the list of standard modes. If the mode doesn't match any of these, its status is set to MODE_BAD so that it will be pruned as expected. Signed-off-by: Jonathon Jongsma Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit c4764645a1c292c82f8bde5f98956052be5a4ac1 Author: Lukas Wunner Date: Wed Jul 15 13:57:35 2015 +0200 drm/i915: Preserve SSC earlier commit 69f92f67b68ab7028ffe15f0eea76b59f8859383 upstream. Commit 92122789b2d6 ("drm/i915: preserve SSC if previously set v3") added code to intel_modeset_gem_init to override the SSC status read from VBT with the SSC status set by BIOS. However, intel_modeset_gem_init is invoked *after* intel_modeset_init, which calls intel_setup_outputs, which *modifies* SSC status by way of intel_init_pch_refclk. So unlike advertised, intel_modeset_gem_init doesn't preserve the SSC status set by BIOS but whatever intel_init_pch_refclk decided on. This is a problem on dual gpu laptops such as the MacBook Pro which require either a handler to switch DDC lines, or the discrete gpu to proxy DDC/AUX communication: Both the handler and the discrete gpu may initialize after the i915 driver, and consequently, an LVDS connector may initially seem disconnected and the SSC therefore is disabled by intel_init_pch_refclk, but on reprobe the connector may turn out to be connected and the SSC must then be enabled. Due to 92122789b2d6 however, the SSC is not enabled on reprobe since it is assumed BIOS disabled it while in fact it was disabled by intel_init_pch_refclk. Also, because the SSC status is preserved so late, the preserved value only ever gets used on resume but not on panel initialization: intel_modeset_init calls intel_init_display which indirectly calls intel_panel_use_ssc via multiple subroutines, *before* the BIOS value overrides the VBT value in intel_modeset_gem_init (intel_panel_use_ssc is the sole user of dev_priv->vbt.lvds_use_ssc). Fix this by moving the code introduced by 92122789b2d6 from intel_modeset_gem_init to intel_modeset_init before the invocation of intel_setup_outputs and intel_init_display. Add a DRM_DEBUG_KMS as suggested way back by Jani: http://lists.freedesktop.org/archives/intel-gfx/2014-June/046666.html Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=88861 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=61115 Tested-by: Paul Hordiienko [MBP 6,2 2010 intel ILK + nvidia GT216 pre-retina] Tested-by: William Brown [MBP 8,2 2011 intel SNB + amd turks pre-retina] Tested-by: Lukas Wunner [MBP 9,1 2012 intel IVB + nvidia GK107 pre-retina] Tested-by: Bruno Bierbaumer [MBP 11,3 2013 intel HSW + nvidia GK107 retina -- work in progress] Fixes: 92122789b2d6 ("drm/i915: preserve SSC if previously set v3") Signed-off-by: Lukas Wunner Reviewed-by: Jesse Barnes Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit b17595564244237fdc08965b7e2dc2c7e31710a9 Author: Alex Deucher Date: Thu Sep 3 10:19:03 2015 -0400 drm/amdgpu: fix typo in dce10 watermark setup commit be9fd2e978939ab3e59ee4164fa0893e70359557 upstream. Using the wrong watermwark value for the secondary watermark. Copy paste typo. Noticed by Mykola. Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 5ee5204400b16c30151928b3d6e845717e11d888 Author: Alex Deucher Date: Thu Sep 3 10:16:23 2015 -0400 drm/amdgpu: fix typo in dce11 watermark setup commit 99a092383794e07d60644b449a01656da112eb1f upstream. Using the wrong watermwark value for the secondary watermark. Copy paste typo. Noticed by Mykola. Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 0abcb8a6c1ede6322d64f6a46333b38282a00fc4 Author: Alex Deucher Date: Mon Aug 24 22:46:13 2015 -0400 drm/amdgpu: fix IH ring allocation for bus addresses (v2) commit 52293c67f1e7542a6dc61037d83c266e216bef27 upstream. Use pci_alloc_consistent rather than kzalloc since we need 256 byte aligned memory for the ring buffer. v2: fix copy paste typo in free function noticed by Jammy. bug: https://bugs.freedesktop.org/show_bug.cgi?id=91749 Reviewed-by: Christian König Reviewed-by: Jammy Zhou Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit a93dd14f3cefffc46e49e55fc907b7323053cf09 Author: Alex Deucher Date: Fri Aug 21 18:07:38 2015 -0400 drm/amdgpu: Don't link train DisplayPort on HPD until we get the dpcd commit a887adadb7b9ef9eb4ee48e4ad575aefcfd1db14 upstream. This is a port of: DRM - radeon: Don't link train DisplayPort on HPD until we get the dpcd to amdgpu. Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit b2a109867f4d17ceb9e77cf1ffeb7aaa7a26fa4d Author: Jammy Zhou Date: Fri Aug 7 15:30:44 2015 +0800 drm/amdgpu: fix one warning message commit 21df89a5667de5fcd061753d3833e7dfcf5509d3 upstream. In function 'amdgpu_uvd_cs_pass2': warning: 'min_ctx_size' may be used uninitialized in this function buf_sizes[0x4] = min_ctx_size; ^ note: 'min_ctx_size' was declared here unsigned image_size, tmp, min_dpb_size, num_dpb_buffer, min_ctx_size; ^ Signed-off-by: Jammy Zhou Reviewed-by: Christian König Signed-off-by: Greg Kroah-Hartman commit c5a3c45b29f7efece508802a093b5a88b560827f Author: Alex Deucher Date: Thu Aug 27 09:52:22 2015 -0400 drm/radeon: fix HDMI quantization_range for pre-DCE5 asics commit 86b7709d48f0df8796bddd7e1ce45c6fb7a7c6ec upstream. Support for output_csc is only available on DCE5 and newer so don't mess with the HDMI quantization_range on pre-DCE5 asics. bug: https://bugs.freedesktop.org/show_bug.cgi?id=83226 Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 9aaf23566d3f726962862bb37e20197daa8f3332 Author: Alex Deucher Date: Mon Aug 31 11:15:05 2015 -0400 drm/radeon/native: Send out the full AUX address commit 7040c399aea2b0213a9aefd73e507369a6d641d6 upstream. AUX addresses are 20 bits long. Send out the entire address instead of just the low 16 bits. Port of: drm/radeon/atom: Send out the full AUX address to radeon non-atom aux path Reviewed-by: Christian König Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit b11b8de427d0fa915f8f0421fa91bd75402775bd Author: Alex Deucher Date: Mon Aug 31 11:08:44 2015 -0400 drm/amdgpu/atom: Send out the full AUX address commit e39daf2c63518a8ce92e3ad5caa04097524b3585 upstream. AUX addresses are 20 bits long. Send out the entire address instead of just the low 16 bits. Port of: drm/radeon/atom: Send out the full AUX address to amdgpu Reviewed-by: Jammy Zhou Reviewed-by: Christian König Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 14d98e461e0c70e5b85b25bddd6ca8947e950881 Author: Ville Syrjälä Date: Thu Aug 27 17:23:31 2015 +0300 drm/radeon/atom: Send out the full AUX address commit 3f8340cc72c9a1a4b49bce7802afd7f248400ef5 upstream. AUX addresses are 20 bits long. Send out the entire address instead of just the low 16 bits. Cc: Alex Deucher Cc: "Christian König" Signed-off-by: Ville Syrjälä Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 529c5643147ef78e1cc8f366a0b0a49e2dedbe67 Author: Ville Syrjälä Date: Thu Aug 20 19:37:29 2015 +0300 drm/i915: Check DP link status on long hpd too commit d14e7b6d1d8747826cb900db852351c550e00fdd upstream. We are no longer checkling the DP link status on long hpd. We used to do that from the .hot_plug() handler, but it was removed when MST got introduced. If there's no userspace we now fail to retrain the link if the sink power is toggled (or cable yanked and replugged), meaning the user is left staring at a blank screen. With the retraining put back that should be fixed. Also remove the leftover comment that referred to the old retraining from .hot_plug(). Fixes a regression introduced in: commit 0e32b39ceed665bfa4a77a4bc307b6652b991632 Author: Dave Airlie Date: Fri May 2 14:02:48 2014 +1000 drm/i915: add DP 1.2 MST support (v0.7) Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=89453 Tested-by: Palmer Dabbelt Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91407 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=89461 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=89594 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=85641 Cc: Dave Airlie Signed-off-by: Ville Syrjälä Reviewed-by: Daniel Vetter Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit 197765d90d79d26ed4a57c01b4efa7dbcce7ae6d Author: Imre Deak Date: Tue Jun 30 17:06:47 2015 +0300 drm/i915: apply the PCI_D0/D3 hibernation workaround everywhere on pre GEN6 commit 54875571bbfde00fc63741715c531cbb5246c3b2 upstream. commit da2bc1b9db3351addd293e5b82757efe1f77ed1d Author: Imre Deak Date: Thu Oct 23 19:23:26 2014 +0300 drm/i915: add poweroff_late handler introduced a regression on old platforms during hibernation. A workaround was added in commit ab3be73fa7b43f4c3648ce29b5fd649ea54d3adb Author: Imre Deak Date: Mon Mar 2 13:04:41 2015 +0200 drm/i915: gen4: work around hang during hibernation using an explicit blacklist for the GENs/BIOS vendors where the issue was reported. Later there we had reports of the same failure on platforms not on this list. To my best knowledge the correct thing to do is still to put the device to PCI D3 state during hibernation, see [1] and [2] for the reasons. This also aligns with our future plans to unify more the runtime and system suspend/resume paths. Since an exact blacklist seems to be impractical (multiple GENs and BIOS vendors are affected) apply the workaround on everything pre GEN6. [1] http://lists.freedesktop.org/archives/intel-gfx/2015-February/060710.html [2] https://lkml.org/lkml/2015/6/22/274 Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=95061 Reported-by: Ilya Tumaykin Reported-by: Dirk Griesbach Reported-by: Pavel Machek Reported-by: Mikko Rapeli Tested-by: Mikko Rapeli Reported-by: Paul Bolle Signed-off-by: Imre Deak Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit 71f778cf274775aa562fed413d3fb258c358241a Author: Stephen Chandler Paul Date: Fri Aug 21 14:16:12 2015 -0400 DRM - radeon: Don't link train DisplayPort on HPD until we get the dpcd commit 924f92bf12bfbef3662619e3ed24a1cea7c1cbcd upstream. Most of the time this isn't an issue since hotplugging an adaptor will trigger a crtc mode change which in turn, causes the driver to probe every DisplayPort for a dpcd. However, in cases where hotplugging doesn't cause a mode change (specifically when one unplugs a monitor from a DisplayPort connector, then plugs that same monitor back in seconds later on the same port without any other monitors connected), we never probe for the dpcd before starting the initial link training. What happens from there looks like this: - GPU has only one monitor connected. It's connected via DisplayPort, and does not go through an adaptor of any sort. - User unplugs DisplayPort connector from GPU. - Change in HPD is detected by the driver, we probe every DisplayPort for a possible connection. - Probe the port the user originally had the monitor connected on for it's dpcd. This fails, and we clear the first (and only the first) byte of the dpcd to indicate we no longer have a dpcd for this port. - User plugs the previously disconnected monitor back into the same DisplayPort. - radeon_connector_hotplug() is called before everyone else, and tries to handle the link training. Since only the first byte of the dpcd is zeroed, the driver is able to complete link training but does so against the wrong dpcd, causing it to initialize the link with the wrong settings. - Display stays blank (usually), dpcd is probed after the initial link training, and the driver prints no obvious messages to the log. In theory, since only one byte of the dpcd is chopped off (specifically, the byte that contains the revision information for DisplayPort), it's not entirely impossible that this bug may not show on certain monitors. For instance, the only reason this bug was visible on my ASUS PB238 monitor was due to the fact that this monitor using the enhanced framing symbol sequence, the flag for which is ignored if the radeon driver thinks that the DisplayPort version is below 1.1. Signed-off-by: Stephen Chandler Paul Reviewed-by: Jerome Glisse Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman