Merge "Merge branch 'chinook_fixed' into chinook" into chinook

4 files changed, 102 insertions, 1 deletions

diff --git a/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/0001-ASoC-ak4642-Replace-mdelay-function-to-msleep.patch b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/0001-ASoC-ak4642-Replace-mdelay-function-to-msleep.patch
new file mode 100644
index 0000000..7bfff9a
--- /dev/null
+++ b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/0001-ASoC-ak4642-Replace-mdelay-function-to-msleep.patch
@@ -0,0 +1,29 @@
+From 21b85faf93b8028cfa477279354bedab93dcea04 Mon Sep 17 00:00:00 2001
+From: Harunobu Kurokawa <harunobu.kurokawa.dn@renesas.com>
+Date: Wed, 21 Dec 2016 11:27:34 +0900
+Subject: [PATCH] ASoC: ak4642: Replace mdelay function to msleep
+
+Replace mdelay to msleep to avoid busy loop on ak4642_lout_event().
+Otherwise, sometimes playback doesn't work correctly when pulseaudio was used.
+
+Signed-off-by: Harunobu Kurokawa <harunobu.kurokawa.dn@renesas.com>
+---
+ sound/soc/codecs/ak4642.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/ak4642.c b/sound/soc/codecs/ak4642.c
+index 40500cd..0205ae1 100644
+--- a/sound/soc/codecs/ak4642.c
++++ b/sound/soc/codecs/ak4642.c
+@@ -186,7 +186,7 @@ static int ak4642_lout_event(struct snd_soc_dapm_widget *w,
+ 		break;
+ 	case SND_SOC_DAPM_POST_PMU:	/* after widget power up */
+ 		/* Power save mode OFF */
+-		mdelay(popup_wait);
++		msleep(popup_wait);
+ 		snd_soc_update_bits(codec, SG_SL2, LOPS, 0);
+ 		break;
+ 	case SND_SOC_DAPM_PRE_PMD:	/* before widget power down */
+-- 
+2.9.2
+
diff --git a/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/0008-Porter-board-support.patch b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/0008-Porter-board-support.patch
index 13fc68b..e452f0e 100644
--- a/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/0008-Porter-board-support.patch
+++ b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/0008-Porter-board-support.patch
@@ -1322,7 +1322,7 @@ index 0000000..d481ecd
 +
 +/* POWER IC */
 +static struct i2c_board_info poweric_i2c[] = {
-+	{ I2C_BOARD_INFO("da9063", 0x58), },
++	{ I2C_BOARD_INFO("da9063", 0x5a), },
 +};
 +
 +static void porter_restart(char mode, const char *cmd)
diff --git a/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/9999-Backport-fix-for-CVE-2016-5195.patch b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/9999-Backport-fix-for-CVE-2016-5195.patch
new file mode 100644
index 0000000..e7a143f
--- /dev/null
+++ b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/9999-Backport-fix-for-CVE-2016-5195.patch
@@ -0,0 +1,68 @@
+From 8003e1524789537680204d44d5bf7a82561f8ba3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan-Simon=20M=C3=B6ller?= <jsmoeller@linuxfoundation.org>
+Date: Fri, 4 Nov 2016 20:58:46 +0100
+Subject: [PATCH] Backport fix for CVE-2016-5195
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Jan-Simon Möller <jsmoeller@linuxfoundation.org>
+---
+ include/linux/mm.h |  1 +
+ mm/memory.c        | 14 ++++++++++++--
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 3bf21c3..263b405 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -1702,6 +1702,7 @@ static inline struct page *follow_page(struct vm_area_struct *vma,
+ #define FOLL_HWPOISON	0x100	/* check page is hwpoisoned */
+ #define FOLL_NUMA	0x200	/* force NUMA hinting page fault */
+ #define FOLL_MIGRATION	0x400	/* wait for page to replace migration entry */
++#define FOLL_COW	0x4000	/* internal GUP flag */
+ 
+ typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr,
+ 			void *data);
+diff --git a/mm/memory.c b/mm/memory.c
+index 48aa275..3a3f316 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1462,6 +1462,16 @@ int zap_vma_ptes(struct vm_area_struct *vma, unsigned long address,
+ }
+ EXPORT_SYMBOL_GPL(zap_vma_ptes);
+ 
++/*
++ * FOLL_FORCE can write to even unwritable pte's, but only
++ * after we've gone through a COW cycle and they are dirty.
++ */
++static inline bool can_follow_write_pte(pte_t pte, unsigned int flags)
++{
++	return pte_write(pte) ||
++		((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte));
++}
++
+ /**
+  * follow_page_mask - look up a page descriptor from a user-virtual address
+  * @vma: vm_area_struct mapping @address
+@@ -1569,7 +1579,7 @@ split_fallthrough:
+ 	}
+ 	if ((flags & FOLL_NUMA) && pte_numa(pte))
+ 		goto no_page;
+-	if ((flags & FOLL_WRITE) && !pte_write(pte))
++	if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, flags))
+ 		goto unlock;
+ 
+ 	page = vm_normal_page(vma, address, pte);
+@@ -1876,7 +1886,7 @@ long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+ 				 */
+ 				if ((ret & VM_FAULT_WRITE) &&
+ 				    !(vma->vm_flags & VM_WRITE))
+-					foll_flags &= ~FOLL_WRITE;
++					foll_flags |= FOLL_COW;
+ 
+ 				cond_resched();
+ 			}
+-- 
+2.1.4
+
diff --git a/meta-rcar-gen2/recipes-kernel/linux/linux-renesas_3.10.bb b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas_3.10.bb
index 4a3e515..e8e80f2 100644
--- a/meta-rcar-gen2/recipes-kernel/linux/linux-renesas_3.10.bb
+++ b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas_3.10.bb
@@ -17,6 +17,7 @@ SRC_URI = "${RENESAS_BACKPORTS_URL};protocol=git;branch=bsp/v3.10.31-ltsi/rcar-g
 	file://0001-arm-koelsch-Add-vmalloc-384M-to-bootargs-of-DTS.patch \
 	file://0001-arm-alt-Add-vmalloc-384M-to-bootargs-of-DTS.patch \
 	file://0001-arm-gose-Add-vmalloc-384M-to-bootargs-of-DTS.patch \
+	file://0001-ASoC-ak4642-Replace-mdelay-function-to-msleep.patch \
 "
 
 SRC_URI_append_porter = " \
@@ -156,6 +157,9 @@ SRC_URI_append_smack = " \
 
 SRC_URI_append_porter = " file://can-rcar.cfg"
 
+# Backport fix for CVE-2016-5195
+SRC_URI_append = " file://9999-Backport-fix-for-CVE-2016-5195.patch "
+
 S = "${WORKDIR}/git"
 
 KERNEL_DEFCONFIG = "shmobile_defconfig"