v4.11-rc1 did introduce a patch series that rearranged the
sdio quirks into a header file. Unfortunately this did forget
to handle SDIO_VENDOR_ID_TI differently between wl1251 and
wl1271 with the result that although the wl1251 was found on
the sdio bus, the firmware did not load any more and there was
no interface registration.
This patch defines separate constants to be used by sdio quirks
and drivers.
Fixes: 884f38607897 ("mmc: core: move some sdio IDs out of quirks file")
Signed-off-by: H. Nikolaus Schaller <hns(a)goldelico.com>
Cc: <stable(a)vger.kernel.org> # 4.11.0
---
include/linux/mmc/sdio_ids.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h
index d1a5d5df02f5..08b25c02b5a1 100644
--- a/include/linux/mmc/sdio_ids.h
+++ b/include/linux/mmc/sdio_ids.h
@@ -71,6 +71,8 @@
#define SDIO_VENDOR_ID_TI 0x0097
#define SDIO_DEVICE_ID_TI_WL1271 0x4076
+#define SDIO_VENDOR_ID_TI_WL1251 0x104c
+#define SDIO_DEVICE_ID_TI_WL1251 0x9066
#define SDIO_VENDOR_ID_STE 0x0020
#define SDIO_DEVICE_ID_STE_CW1200 0x2280
--
2.19.1
Pandora_wl1251_init_card was used to do special pdata based
setup of the sdio mmc interface. This does no longer work with
v4.7 and later. A fix requires a device tree based mmc3 setup.
Therefore we move the special setup to omap_hsmmc.c instead
of calling some pdata supplied init_card function.
The new code checks for a DT child node compatible to wl1251
so it will not affect other MMC3 use cases.
Fixes: 81eef6ca9201 ("mmc: omap_hsmmc: Use dma_request_chan() for requesting DMA channel")
Signed-off-by: H. Nikolaus Schaller <hns(a)goldelico.com>
Cc: <stable(a)vger.kernel.org> # 4.7.0
---
drivers/mmc/host/omap_hsmmc.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 952fa4063ff8..03ba80bcf319 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -1512,6 +1512,27 @@ static void omap_hsmmc_init_card(struct mmc_host *mmc, struct mmc_card *card)
if (mmc_pdata(host)->init_card)
mmc_pdata(host)->init_card(card);
+ else if (card->type == MMC_TYPE_SDIO || card->type == MMC_TYPE_SD_COMBO) {
+ struct device_node *np = mmc_dev(mmc)->of_node;
+
+ np = of_get_compatible_child(np, "ti,wl1251");
+ if (np) {
+ /*
+ * We have TI wl1251 attached to MMC3. Pass this information to
+ * SDIO core because it can't be probed by normal methods.
+ */
+
+ dev_info(host->dev, "found wl1251\n");
+ card->quirks |= MMC_QUIRK_NONSTD_SDIO;
+ card->cccr.wide_bus = 1;
+ card->cis.vendor = 0x104c;
+ card->cis.device = 0x9066;
+ card->cis.blksize = 512;
+ card->cis.max_dtr = 24000000;
+ card->ocr = 0x80;
+ of_node_put(np);
+ }
+ }
}
static void omap_hsmmc_enable_sdio_irq(struct mmc_host *mmc, int enable)
--
2.19.1
On Wed, 16 Oct 2019 05:43:10 PDT (-0700), sashal(a)kernel.org wrote:
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a -stable tag.
> The stable tag indicates that it's relevant for the following trees: all
>
> The bot has tested the following trees: v5.3.6, v5.2.21, v4.19.79, v4.14.149, v4.9.196, v4.4.196.
>
> v5.3.6: Build OK!
> v5.2.21: Build OK!
> v4.19.79: Failed to apply! Possible dependencies:
> 86c7cbf1e8d1d ("irqchip/sifive-plic: Pre-compute context hart base and enable base")
> cc9f04f9a84f7 ("irqchip/sifive-plic: Implement irq_set_affinity() for SMP host")
>
> v4.14.149: Failed to apply! Possible dependencies:
> 215f4cc0fb208 ("irqchip/meson: Add support for gpio interrupt controller")
> 33c57c0d3c67f ("RISC-V: Add a basic defconfig")
> 4235ff50cf98d ("irqchip/irq-goldfish-pic: Add Goldfish PIC driver")
> 4a632cec8884b ("RISC-V: Enable module support in defconfig")
> 8237f8bc4f6eb ("irqchip: add a SiFive PLIC driver")
> 86c7cbf1e8d1d ("irqchip/sifive-plic: Pre-compute context hart base and enable base")
> c2ba80af48055 ("dt-bindings/goldfish-pic: Add device tree binding for Goldfish PIC driver")
> c94fb639d5462 ("irqchip: Add Kconfig menu")
> cc9f04f9a84f7 ("irqchip/sifive-plic: Implement irq_set_affinity() for SMP host")
> f55c73aef8904 ("irqchip/pdc: Add PDC interrupt controller for QCOM SoCs")
>
> v4.9.196: Failed to apply! Possible dependencies:
> 215f4cc0fb208 ("irqchip/meson: Add support for gpio interrupt controller")
> 33c57c0d3c67f ("RISC-V: Add a basic defconfig")
> 4235ff50cf98d ("irqchip/irq-goldfish-pic: Add Goldfish PIC driver")
> 4a632cec8884b ("RISC-V: Enable module support in defconfig")
> 5ed34d3a4387c ("irqchip: Add UniPhier AIDET irqchip driver")
> 7a08de1d8fd27 ("dt-bindings: Add device tree binding for Goldfish RTC driver")
> 8237f8bc4f6eb ("irqchip: add a SiFive PLIC driver")
> 86c7cbf1e8d1d ("irqchip/sifive-plic: Pre-compute context hart base and enable base")
> c2ba80af48055 ("dt-bindings/goldfish-pic: Add device tree binding for Goldfish PIC driver")
> c94fb639d5462 ("irqchip: Add Kconfig menu")
> cc9f04f9a84f7 ("irqchip/sifive-plic: Implement irq_set_affinity() for SMP host")
> f20cc9b00c7b7 ("irqchip/qcom: Add IRQ combiner driver")
> f55c73aef8904 ("irqchip/pdc: Add PDC interrupt controller for QCOM SoCs")
>
> v4.4.196: Failed to apply! Possible dependencies:
> 215f4cc0fb208 ("irqchip/meson: Add support for gpio interrupt controller")
> 33c57c0d3c67f ("RISC-V: Add a basic defconfig")
> 4235ff50cf98d ("irqchip/irq-goldfish-pic: Add Goldfish PIC driver")
> 44df427c894a4 ("irqchip: add nps Internal and external irqchips")
> 4a632cec8884b ("RISC-V: Enable module support in defconfig")
> 5952884258e52 ("irqchip/aspeed-vic: Add irq controller for Aspeed")
> 5ed34d3a4387c ("irqchip: Add UniPhier AIDET irqchip driver")
> 7a08de1d8fd27 ("dt-bindings: Add device tree binding for Goldfish RTC driver")
> 8237f8bc4f6eb ("irqchip: add a SiFive PLIC driver")
> aaa8666ada780 ("IRQCHIP: irq-pic32-evic: Add support for PIC32 interrupt controller")
> c27f29bbbf021 ("irqchip/mvebu-odmi: Add new driver for platform MSI on Marvell 7K/8K")
> c2ba80af48055 ("dt-bindings/goldfish-pic: Add device tree binding for Goldfish PIC driver")
> c94fb639d5462 ("irqchip: Add Kconfig menu")
> cc9f04f9a84f7 ("irqchip/sifive-plic: Implement irq_set_affinity() for SMP host")
> d03c023e1ea6c ("MAINTAINERS: Add Android Ion as a separate entry")
> e072041688ca7 ("drivers/irqchip: Add STM32 external interrupts support")
> f20cc9b00c7b7 ("irqchip/qcom: Add IRQ combiner driver")
> f55c73aef8904 ("irqchip/pdc: Add PDC interrupt controller for QCOM SoCs")
>
>
> NOTE: The patch will not be queued to stable trees until it is upstream.
>
> How should we proceed with this patch?
I think it's fine to leave this out of 4.19, as I doubt we have anyone using it
on RISC-V systems as there were some pretty major kernel bugs back then.
The PLIC driver was merged in 4.19, so the older kernels are obvious
non-starters.
This is a note to let you know that I've just added the patch titled
USB: ldusb: fix read info leaks
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 7a6f22d7479b7a0b68eadd308a997dd64dda7dae Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan(a)kernel.org>
Date: Fri, 18 Oct 2019 17:19:54 +0200
Subject: USB: ldusb: fix read info leaks
Fix broken read implementation, which could be used to trigger slab info
leaks.
The driver failed to check if the custom ring buffer was still empty
when waking up after having waited for more data. This would happen on
every interrupt-in completion, even if no data had been added to the
ring buffer (e.g. on disconnect events).
Due to missing sanity checks and uninitialised (kmalloced) ring-buffer
entries, this meant that huge slab info leaks could easily be triggered.
Note that the empty-buffer check after wakeup is enough to fix the info
leak on disconnect, but let's clear the buffer on allocation and add a
sanity check to read() to prevent further leaks.
Fixes: 2824bd250f0b ("[PATCH] USB: add ldusb driver")
Cc: stable <stable(a)vger.kernel.org> # 2.6.13
Reported-by: syzbot+6fe95b826644f7f12b0b(a)syzkaller.appspotmail.com
Signed-off-by: Johan Hovold <johan(a)kernel.org>
Link: https://lore.kernel.org/r/20191018151955.25135-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/misc/ldusb.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
index 147c90c2a4e5..15b5f06fb0b3 100644
--- a/drivers/usb/misc/ldusb.c
+++ b/drivers/usb/misc/ldusb.c
@@ -464,7 +464,7 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
/* wait for data */
spin_lock_irq(&dev->rbsl);
- if (dev->ring_head == dev->ring_tail) {
+ while (dev->ring_head == dev->ring_tail) {
dev->interrupt_in_done = 0;
spin_unlock_irq(&dev->rbsl);
if (file->f_flags & O_NONBLOCK) {
@@ -474,12 +474,17 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
retval = wait_event_interruptible(dev->read_wait, dev->interrupt_in_done);
if (retval < 0)
goto unlock_exit;
- } else {
- spin_unlock_irq(&dev->rbsl);
+
+ spin_lock_irq(&dev->rbsl);
}
+ spin_unlock_irq(&dev->rbsl);
/* actual_buffer contains actual_length + interrupt_in_buffer */
actual_buffer = (size_t *)(dev->ring_buffer + dev->ring_tail * (sizeof(size_t)+dev->interrupt_in_endpoint_size));
+ if (*actual_buffer > dev->interrupt_in_endpoint_size) {
+ retval = -EIO;
+ goto unlock_exit;
+ }
bytes_to_read = min(count, *actual_buffer);
if (bytes_to_read < *actual_buffer)
dev_warn(&dev->intf->dev, "Read buffer overflow, %zd bytes dropped\n",
@@ -690,10 +695,9 @@ static int ld_usb_probe(struct usb_interface *intf, const struct usb_device_id *
dev_warn(&intf->dev, "Interrupt out endpoint not found (using control endpoint instead)\n");
dev->interrupt_in_endpoint_size = usb_endpoint_maxp(dev->interrupt_in_endpoint);
- dev->ring_buffer =
- kmalloc_array(ring_buffer_size,
- sizeof(size_t) + dev->interrupt_in_endpoint_size,
- GFP_KERNEL);
+ dev->ring_buffer = kcalloc(ring_buffer_size,
+ sizeof(size_t) + dev->interrupt_in_endpoint_size,
+ GFP_KERNEL);
if (!dev->ring_buffer)
goto error;
dev->interrupt_in_buffer = kmalloc(dev->interrupt_in_endpoint_size, GFP_KERNEL);
--
2.23.0
This is a note to let you know that I've just added the patch titled
USB: serial: ti_usb_3410_5052: fix port-close races
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
>From 6f1d1dc8d540a9aa6e39b9cb86d3a67bbc1c8d8d Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan(a)kernel.org>
Date: Fri, 11 Oct 2019 11:57:35 +0200
Subject: USB: serial: ti_usb_3410_5052: fix port-close races
Fix races between closing a port and opening or closing another port on
the same device which could lead to a failure to start or stop the
shared interrupt URB. The latter could potentially cause a
use-after-free or worse in the completion handler on driver unbind.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Johan Hovold <johan(a)kernel.org>
---
drivers/usb/serial/ti_usb_3410_5052.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index dd0ad67aa71e..9174ba2e06da 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -776,7 +776,6 @@ static void ti_close(struct usb_serial_port *port)
struct ti_port *tport;
int port_number;
int status;
- int do_unlock;
unsigned long flags;
tdev = usb_get_serial_data(port->serial);
@@ -800,16 +799,13 @@ static void ti_close(struct usb_serial_port *port)
"%s - cannot send close port command, %d\n"
, __func__, status);
- /* if mutex_lock is interrupted, continue anyway */
- do_unlock = !mutex_lock_interruptible(&tdev->td_open_close_lock);
+ mutex_lock(&tdev->td_open_close_lock);
--tport->tp_tdev->td_open_port_count;
- if (tport->tp_tdev->td_open_port_count <= 0) {
+ if (tport->tp_tdev->td_open_port_count == 0) {
/* last port is closed, shut down interrupt urb */
usb_kill_urb(port->serial->port[0]->interrupt_in_urb);
- tport->tp_tdev->td_open_port_count = 0;
}
- if (do_unlock)
- mutex_unlock(&tdev->td_open_close_lock);
+ mutex_unlock(&tdev->td_open_close_lock);
}
--
2.23.0
Until a few years ago, this driver was only used with CS GPIO. The
only exception is CS0 on AT91RM9200 which has to use internal CS. A
limitation of the internal CS is that they don't support CS High.
So by using the CS GPIO the CS high configuration was available except
for the particular case CS0 on RM9200.
When the support for the internal chip-select was added, the check of
the CS high support was not updated. Due to this the driver accepts
this configuration for all the SPI controller v2 (used by all SoCs
excepting the AT91RM9200) whereas the hardware doesn't support it for
infernal CS.
This patch fixes the test to match the hardware capabilities.
Fixes: 4820303480a1 ("spi: atmel: add support for the internal chip-select of the spi controller")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Gregory CLEMENT <gregory.clement(a)bootlin.com>
---
drivers/spi/spi-atmel.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index 7a17c3e2a8ee..6e08ae539bc0 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -1176,10 +1176,8 @@ static int atmel_spi_setup(struct spi_device *spi)
as = spi_master_get_devdata(spi->master);
/* see notes above re chipselect */
- if (!atmel_spi_is_v2(as)
- && spi->chip_select == 0
- && (spi->mode & SPI_CS_HIGH)) {
- dev_dbg(&spi->dev, "setup: can't be active-high\n");
+ if (!as->use_cs_gpios && (spi->mode & SPI_CS_HIGH)) {
+ dev_warn(&spi->dev, "setup: non GPIO CS can't be active-high\n");
return -EINVAL;
}
--
2.23.0
From: Junya Monden <jmonden(a)jp.adit-jv.com>
Unlike other format-related DAI parameters, rdai->bit_clk_inv flag
is not properly re-initialized when setting format for new stream
processing. The inversion, if requested, is then applied not to default,
but to a previous value, which leads to SCKP bit in SSICR register being
set incorrectly.
Fix this by re-setting the flag to its initial value, determined by format.
Fixes: 1a7889ca8aba3 ("ASoC: rsnd: fixup SND_SOC_DAIFMT_xB_xF behavior")
Cc: Andrew Gabbasov <andrew_gabbasov(a)mentor.com>
Cc: Jiada Wang <jiada_wang(a)mentor.com>
Cc: Timo Wischer <twischer(a)de.adit-jv.com>
Cc: stable(a)vger.kernel.org # v3.17+
Signed-off-by: Junya Monden <jmonden(a)jp.adit-jv.com>
Signed-off-by: Eugeniu Rosca <erosca(a)de.adit-jv.com>
---
sound/soc/sh/rcar/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index bda5b958d0dc..e9596c2096cd 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -761,6 +761,7 @@ static int rsnd_soc_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
}
/* set format */
+ rdai->bit_clk_inv = 0;
switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
case SND_SOC_DAIFMT_I2S:
rdai->sys_delay = 0;
--
2.23.0