linux-stable.git/drivers/misc, branch v4.4.10

drivers/misc/ad525x_dpot: AD5274 fix RDAC read back errors

2016-05-04T21:48:52+00:00

commit f3df53e4d70b5736368a8fe8aa1bb70c1cb1f577 upstream.

Fix RDAC read back errors caused by a typo. Value must shift by 2.

Fixes: a4bd394956f2 ("drivers/misc/ad525x_dpot.c: new features")
Signed-off-by: Michael Hennerich 
Signed-off-by: Greg Kroah-Hartman

misc: mic/scif: fix wrap around tests

2016-05-04T21:48:51+00:00

commit 7b64dbf849abdd7e769820e25120758f956a7f13 upstream.

Signed integer overflow is undefined.  Also I added a check for
"(offset < 0)" in scif_unregister() because that makes it match the
other conditions and because I didn't want to subtract a negative.

Fixes: ba612aa8b487 ('misc: mic: SCIF memory registration and unregistration')
Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

misc/bmp085: Enable building as a module

2016-05-04T21:48:51+00:00

commit 50e6315dba721cbc24ccd6d7b299f1782f210a98 upstream.

Commit 985087dbcb02 'misc: add support for bmp18x chips to the bmp085
driver' changed the BMP085 config symbol to a boolean.  I see no
reason why the shared code cannot be built as a module, so change it
back to tristate.

Fixes: 985087dbcb02 ("misc: add support for bmp18x chips to the bmp085 driver")
Cc: Eric Andersson 
Signed-off-by: Ben Hutchings 
Acked-by: Arnd Bergmann 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Greg Kroah-Hartman

cxl: Keep IRQ mappings on context teardown

2016-05-04T21:48:48+00:00

commit d6776bba44d9752f6cdf640046070e71ee4bba7b upstream.

Keep IRQ mappings on context teardown.  This won't leak IRQs as if we
allocate the mapping again, the generic code will give the same
mapping used last time.

Doing this works around a race in the generic code. Masking the
interrupt introduces a race which can crash the kernel or result in
IRQ that is never EOIed. The lost of EOI results in all subsequent
mappings to the same HW IRQ never receiving an interrupt.

We've seen this race with cxl test cases which are doing heavy context
startup and teardown at the same time as heavy interrupt load.

A fix to the generic code is being investigated also.

Signed-off-by: Michael Neuling 
Tested-by: Andrew Donnellan 
Acked-by: Ian Munsie 
Tested-by: Vaibhav Jain 
Signed-off-by: Michael Ellerman 
Signed-off-by: Greg Kroah-Hartman

mei: bus: check if the device is enabled before data transfer

2016-04-12T16:08:46+00:00

commit 15c13dfcad883a1e76b714480fb27be96247fd82 upstream.

The bus data transfer interface was missing the check if the device is
in enabled state, this may lead to stack corruption during link reset.

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

cxl: Fix PSL timebase synchronization detection

2016-03-09T23:34:55+00:00

commit 923adb1646d5ba739d2a1e63ee20d60574d9da8e upstream.

The PSL timebase synchronization is seemingly failing for
configuration not including VIRT_CPU_ACCOUNTING_NATIVE. The driver
shows the following trace in dmesg:
PSL: Timebase sync: giving up!

The PSL timebase register is actually syncing correctly, but the cxl
driver is not detecting it. Fix is to use the proper timebase-to-time
conversion.

Signed-off-by: Frederic Barrat 
Acked-by: Michael Neuling 
Reviewed-by: Matthew R. Ochs 
Acked-by: Ian Munsie 
Reviewed-by: Andrew Donnellan 
Reviewed-by: Vaibhav Jain 
Signed-off-by: Michael Ellerman 
Signed-off-by: Greg Kroah-Hartman

cxl: use correct operator when writing pcie config space values

2016-03-03T23:07:17+00:00

commit 48f0f6b717e314a30be121b67e1d044f6d311d66 upstream.

When writing a value to config space, cxl_pcie_write_config() calls
cxl_pcie_config_info() to obtain a mask and shift value, shifts the new
value accordingly, then uses the mask to combine the shifted value with the
existing value at the address as part of a read-modify-write pattern.

Currently, we use a logical OR operator rather than a bitwise OR operator,
which means any use of this function results in an incorrect value being
written. Replace the logical OR operator with a bitwise OR operator so the
value is written correctly.

Reported-by: Michael Ellerman 
Fixes: 6f7f0b3df6d4 ("cxl: Add AFU virtual PHB and kernel API")
Signed-off-by: Andrew Donnellan 
Acked-by: Ian Munsie 
Signed-off-by: Michael Ellerman 
Signed-off-by: Greg Kroah-Hartman

mei: validate request value in client notify request ioctl

2016-03-03T23:07:13+00:00

commit 7326fffb712f09a315bc73cc1ee63843f59b8bd4 upstream.

This patch address a possible security issue:

The request field in client notify request ioctl comes from user space
as u32 and is downcasted to u8 with out validation.
Check request field to have approved values
MEI_HBM_NOTIFICATION_STAR/STOP

Signed-off-by: Alexander Usyskin 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

mei: fix fasync return value on error

2016-03-03T23:07:13+00:00

commit ed6dc538e5a36a331b6256d54f435c80f6715460 upstream.

fasync should return a negative value on error
and not poll mask POLLERR.

Cc: Al Viro 
Reported-by: Al Viro 
Signed-off-by: Tomas Winkler 
Signed-off-by: Greg Kroah-Hartman

cxl: Set endianess of kernel contexts

2015-12-08T05:57:01+00:00

A process element (defined in CAIA) keeps track of the endianess of
contexts through the Little Endian (LE) bit of the State Register. It
is currently set for user contexts, but was somehow forgotten for
kernel contexts, so this patch fixes it.
It could lead to erratic behavior from an AFU when the context is
attached through the kernel API.

Fixes: 2f663527bd6a ("cxl: Configure PSL for kernel contexts and merge code")
Cc: stable@vger.kernel.org # 4.2+
Signed-off-by: Frederic Barrat 
Suggested-by: Michael Neuling 
Signed-off-by: Michael Ellerman