From: Sasha Levin Date: Fri, 1 Nov 2019 14:53:21 +0000 (-0400) Subject: fixes for 5.3 X-Git-Tag: v4.4.199~43 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=38d3036f6420b7c420b650394e122015b7deadc9;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 5.3 Signed-off-by: Sasha Levin --- diff --git a/queue-5.3/arm64-dts-qcom-add-asus-novago-tp370ql.patch b/queue-5.3/arm64-dts-qcom-add-asus-novago-tp370ql.patch new file mode 100644 index 00000000000..c7b9fdd04fe --- /dev/null +++ b/queue-5.3/arm64-dts-qcom-add-asus-novago-tp370ql.patch @@ -0,0 +1,89 @@ +From b711438ca762b07b59bb1f611dba3887ec5806ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2019 07:59:51 -0700 +Subject: arm64: dts: qcom: Add Asus NovaGo TP370QL + +From: Jeffrey Hugo + +[ Upstream commit 722eb2f65acc4cebeb710fc7cc98f51513e90f1f ] + +This adds the initial DT for the Asus NovaGo TP370QL laptop. Supported +functionality includes USB (host), microSD-card, keyboard, and trackpad. + +Signed-off-by: Jeffrey Hugo +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/Makefile | 1 + + .../dts/qcom/msm8998-asus-novago-tp370ql.dts | 47 +++++++++++++++++++ + 2 files changed, 48 insertions(+) + create mode 100644 arch/arm64/boot/dts/qcom/msm8998-asus-novago-tp370ql.dts + +diff --git a/arch/arm64/boot/dts/qcom/Makefile b/arch/arm64/boot/dts/qcom/Makefile +index 28695e7c0cc3d..954d75de617ba 100644 +--- a/arch/arm64/boot/dts/qcom/Makefile ++++ b/arch/arm64/boot/dts/qcom/Makefile +@@ -6,6 +6,7 @@ dtb-$(CONFIG_ARCH_QCOM) += msm8916-mtp.dtb + dtb-$(CONFIG_ARCH_QCOM) += msm8992-bullhead-rev-101.dtb + dtb-$(CONFIG_ARCH_QCOM) += msm8994-angler-rev-101.dtb + dtb-$(CONFIG_ARCH_QCOM) += msm8996-mtp.dtb ++dtb-$(CONFIG_ARCH_QCOM) += msm8998-asus-novago-tp370ql.dtb + dtb-$(CONFIG_ARCH_QCOM) += msm8998-hp-envy-x2.dtb + dtb-$(CONFIG_ARCH_QCOM) += msm8998-lenovo-miix-630.dtb + dtb-$(CONFIG_ARCH_QCOM) += msm8998-mtp.dtb +diff --git a/arch/arm64/boot/dts/qcom/msm8998-asus-novago-tp370ql.dts b/arch/arm64/boot/dts/qcom/msm8998-asus-novago-tp370ql.dts +new file mode 100644 +index 0000000000000..db5821be1e2fe +--- /dev/null ++++ b/arch/arm64/boot/dts/qcom/msm8998-asus-novago-tp370ql.dts +@@ -0,0 +1,47 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* Copyright (c) 2019, Jeffrey Hugo. All rights reserved. */ ++ ++/dts-v1/; ++ ++#include "msm8998-clamshell.dtsi" ++ ++/ { ++ model = "Asus NovaGo TP370QL"; ++ compatible = "asus,novago-tp370ql", "qcom,msm8998"; ++}; ++ ++&blsp1_i2c6 { ++ status = "okay"; ++ ++ touchpad@15 { ++ compatible = "hid-over-i2c"; ++ interrupt-parent = <&tlmm>; ++ interrupts = <0x7b IRQ_TYPE_LEVEL_LOW>; ++ reg = <0x15>; ++ hid-descr-addr = <0x0001>; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&touchpad>; ++ }; ++ ++ keyboard@3a { ++ compatible = "hid-over-i2c"; ++ interrupt-parent = <&tlmm>; ++ interrupts = <0x25 IRQ_TYPE_LEVEL_LOW>; ++ reg = <0x3a>; ++ hid-descr-addr = <0x0001>; ++ }; ++}; ++ ++&sdhc2 { ++ cd-gpios = <&tlmm 95 GPIO_ACTIVE_HIGH>; ++}; ++ ++&tlmm { ++ touchpad: touchpad { ++ config { ++ pins = "gpio123"; ++ bias-pull-up; ++ }; ++ }; ++}; +-- +2.20.1 + diff --git a/queue-5.3/arm64-dts-qcom-add-hp-envy-x2.patch b/queue-5.3/arm64-dts-qcom-add-hp-envy-x2.patch new file mode 100644 index 00000000000..e8760e79b9f --- /dev/null +++ b/queue-5.3/arm64-dts-qcom-add-hp-envy-x2.patch @@ -0,0 +1,72 @@ +From d4b56ef90fe67e72cedebdf3ac44c764c1a5ffe2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2019 07:57:21 -0700 +Subject: arm64: dts: qcom: Add HP Envy x2 + +From: Jeffrey Hugo + +[ Upstream commit 3f527d311932791fde67ffec32536d22d5dd3030 ] + +This adds the initial DT for the HP Envy x2 laptop. Supported +functionality includes USB (host), microSD-card, keyboard, and trackpad. + +Signed-off-by: Jeffrey Hugo +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/Makefile | 1 + + .../boot/dts/qcom/msm8998-hp-envy-x2.dts | 30 +++++++++++++++++++ + 2 files changed, 31 insertions(+) + create mode 100644 arch/arm64/boot/dts/qcom/msm8998-hp-envy-x2.dts + +diff --git a/arch/arm64/boot/dts/qcom/Makefile b/arch/arm64/boot/dts/qcom/Makefile +index c38ca859f2e02..28695e7c0cc3d 100644 +--- a/arch/arm64/boot/dts/qcom/Makefile ++++ b/arch/arm64/boot/dts/qcom/Makefile +@@ -6,6 +6,7 @@ dtb-$(CONFIG_ARCH_QCOM) += msm8916-mtp.dtb + dtb-$(CONFIG_ARCH_QCOM) += msm8992-bullhead-rev-101.dtb + dtb-$(CONFIG_ARCH_QCOM) += msm8994-angler-rev-101.dtb + dtb-$(CONFIG_ARCH_QCOM) += msm8996-mtp.dtb ++dtb-$(CONFIG_ARCH_QCOM) += msm8998-hp-envy-x2.dtb + dtb-$(CONFIG_ARCH_QCOM) += msm8998-lenovo-miix-630.dtb + dtb-$(CONFIG_ARCH_QCOM) += msm8998-mtp.dtb + dtb-$(CONFIG_ARCH_QCOM) += sdm845-cheza-r1.dtb +diff --git a/arch/arm64/boot/dts/qcom/msm8998-hp-envy-x2.dts b/arch/arm64/boot/dts/qcom/msm8998-hp-envy-x2.dts +new file mode 100644 +index 0000000000000..24073127091f6 +--- /dev/null ++++ b/arch/arm64/boot/dts/qcom/msm8998-hp-envy-x2.dts +@@ -0,0 +1,30 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* Copyright (c) 2019, Jeffrey Hugo. All rights reserved. */ ++ ++/dts-v1/; ++ ++#include "msm8998-clamshell.dtsi" ++ ++/ { ++ model = "HP Envy x2"; ++ compatible = "hp,envy-x2", "qcom,msm8998"; ++}; ++ ++&blsp1_i2c6 { ++ status = "okay"; ++ ++ keyboard@3a { ++ compatible = "hid-over-i2c"; ++ interrupt-parent = <&tlmm>; ++ interrupts = <0x79 IRQ_TYPE_LEVEL_LOW>; ++ reg = <0x3a>; ++ hid-descr-addr = <0x0001>; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&touchpad>; ++ }; ++}; ++ ++&sdhc2 { ++ cd-gpios = <&tlmm 95 GPIO_ACTIVE_LOW>; ++}; +-- +2.20.1 + diff --git a/queue-5.3/arm64-dts-qcom-add-lenovo-miix-630.patch b/queue-5.3/arm64-dts-qcom-add-lenovo-miix-630.patch new file mode 100644 index 00000000000..e85ac9290c3 --- /dev/null +++ b/queue-5.3/arm64-dts-qcom-add-lenovo-miix-630.patch @@ -0,0 +1,320 @@ +From 01422f61f5c90132d668568a1fbd7185732afec6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2019 07:54:50 -0700 +Subject: arm64: dts: qcom: Add Lenovo Miix 630 + +From: Jeffrey Hugo + +[ Upstream commit 2c6d2d3a580a852fe0a694e13af502a862293e0e ] + +This adds the initial DT for the Lenovo Miix 630 laptop. Supported +functionality includes USB (host), microSD-card, keyboard, and trackpad. + +Signed-off-by: Jeffrey Hugo +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/Makefile | 1 + + .../boot/dts/qcom/msm8998-clamshell.dtsi | 240 ++++++++++++++++++ + .../boot/dts/qcom/msm8998-lenovo-miix-630.dts | 30 +++ + 3 files changed, 271 insertions(+) + create mode 100644 arch/arm64/boot/dts/qcom/msm8998-clamshell.dtsi + create mode 100644 arch/arm64/boot/dts/qcom/msm8998-lenovo-miix-630.dts + +diff --git a/arch/arm64/boot/dts/qcom/Makefile b/arch/arm64/boot/dts/qcom/Makefile +index 0a7e5dfce6f79..c38ca859f2e02 100644 +--- a/arch/arm64/boot/dts/qcom/Makefile ++++ b/arch/arm64/boot/dts/qcom/Makefile +@@ -6,6 +6,7 @@ dtb-$(CONFIG_ARCH_QCOM) += msm8916-mtp.dtb + dtb-$(CONFIG_ARCH_QCOM) += msm8992-bullhead-rev-101.dtb + dtb-$(CONFIG_ARCH_QCOM) += msm8994-angler-rev-101.dtb + dtb-$(CONFIG_ARCH_QCOM) += msm8996-mtp.dtb ++dtb-$(CONFIG_ARCH_QCOM) += msm8998-lenovo-miix-630.dtb + dtb-$(CONFIG_ARCH_QCOM) += msm8998-mtp.dtb + dtb-$(CONFIG_ARCH_QCOM) += sdm845-cheza-r1.dtb + dtb-$(CONFIG_ARCH_QCOM) += sdm845-cheza-r2.dtb +diff --git a/arch/arm64/boot/dts/qcom/msm8998-clamshell.dtsi b/arch/arm64/boot/dts/qcom/msm8998-clamshell.dtsi +new file mode 100644 +index 0000000000000..9682d4dd7496e +--- /dev/null ++++ b/arch/arm64/boot/dts/qcom/msm8998-clamshell.dtsi +@@ -0,0 +1,240 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* Copyright (c) 2019, Jeffrey Hugo. All rights reserved. */ ++ ++/* ++ * Common include for MSM8998 clamshell devices, ie the Lenovo Miix 630, ++ * Asus NovaGo TP370QL, and HP Envy x2. All three devices are basically the ++ * same, with differences in peripherals. ++ */ ++ ++#include "msm8998.dtsi" ++#include "pm8998.dtsi" ++#include "pm8005.dtsi" ++ ++/ { ++ chosen { ++ }; ++ ++ vph_pwr: vph-pwr-regulator { ++ compatible = "regulator-fixed"; ++ regulator-name = "vph_pwr"; ++ regulator-always-on; ++ regulator-boot-on; ++ }; ++}; ++ ++&qusb2phy { ++ status = "okay"; ++ ++ vdda-pll-supply = <&vreg_l12a_1p8>; ++ vdda-phy-dpdm-supply = <&vreg_l24a_3p075>; ++}; ++ ++&rpm_requests { ++ pm8998-regulators { ++ compatible = "qcom,rpm-pm8998-regulators"; ++ ++ vdd_s1-supply = <&vph_pwr>; ++ vdd_s2-supply = <&vph_pwr>; ++ vdd_s3-supply = <&vph_pwr>; ++ vdd_s4-supply = <&vph_pwr>; ++ vdd_s5-supply = <&vph_pwr>; ++ vdd_s6-supply = <&vph_pwr>; ++ vdd_s7-supply = <&vph_pwr>; ++ vdd_s8-supply = <&vph_pwr>; ++ vdd_s9-supply = <&vph_pwr>; ++ vdd_s10-supply = <&vph_pwr>; ++ vdd_s11-supply = <&vph_pwr>; ++ vdd_s12-supply = <&vph_pwr>; ++ vdd_s13-supply = <&vph_pwr>; ++ vdd_l1_l27-supply = <&vreg_s7a_1p025>; ++ vdd_l2_l8_l17-supply = <&vreg_s3a_1p35>; ++ vdd_l3_l11-supply = <&vreg_s7a_1p025>; ++ vdd_l4_l5-supply = <&vreg_s7a_1p025>; ++ vdd_l6-supply = <&vreg_s5a_2p04>; ++ vdd_l7_l12_l14_l15-supply = <&vreg_s5a_2p04>; ++ vdd_l9-supply = <&vph_pwr>; ++ vdd_l10_l23_l25-supply = <&vph_pwr>; ++ vdd_l13_l19_l21-supply = <&vph_pwr>; ++ vdd_l16_l28-supply = <&vph_pwr>; ++ vdd_l18_l22-supply = <&vph_pwr>; ++ vdd_l20_l24-supply = <&vph_pwr>; ++ vdd_l26-supply = <&vreg_s3a_1p35>; ++ vdd_lvs1_lvs2-supply = <&vreg_s4a_1p8>; ++ ++ vreg_s3a_1p35: s3 { ++ regulator-min-microvolt = <1352000>; ++ regulator-max-microvolt = <1352000>; ++ }; ++ vreg_s4a_1p8: s4 { ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ regulator-allow-set-load; ++ }; ++ vreg_s5a_2p04: s5 { ++ regulator-min-microvolt = <1904000>; ++ regulator-max-microvolt = <2040000>; ++ }; ++ vreg_s7a_1p025: s7 { ++ regulator-min-microvolt = <900000>; ++ regulator-max-microvolt = <1028000>; ++ }; ++ vreg_l1a_0p875: l1 { ++ regulator-min-microvolt = <880000>; ++ regulator-max-microvolt = <880000>; ++ regulator-allow-set-load; ++ }; ++ vreg_l2a_1p2: l2 { ++ regulator-min-microvolt = <1200000>; ++ regulator-max-microvolt = <1200000>; ++ regulator-allow-set-load; ++ }; ++ vreg_l3a_1p0: l3 { ++ regulator-min-microvolt = <1000000>; ++ regulator-max-microvolt = <1000000>; ++ }; ++ vreg_l5a_0p8: l5 { ++ regulator-min-microvolt = <800000>; ++ regulator-max-microvolt = <800000>; ++ }; ++ vreg_l6a_1p8: l6 { ++ regulator-min-microvolt = <1808000>; ++ regulator-max-microvolt = <1808000>; ++ }; ++ vreg_l7a_1p8: l7 { ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ vreg_l8a_1p2: l8 { ++ regulator-min-microvolt = <1200000>; ++ regulator-max-microvolt = <1200000>; ++ }; ++ vreg_l9a_1p8: l9 { ++ regulator-min-microvolt = <1808000>; ++ regulator-max-microvolt = <2960000>; ++ }; ++ vreg_l10a_1p8: l10 { ++ regulator-min-microvolt = <1808000>; ++ regulator-max-microvolt = <2960000>; ++ }; ++ vreg_l11a_1p0: l11 { ++ regulator-min-microvolt = <1000000>; ++ regulator-max-microvolt = <1000000>; ++ }; ++ vreg_l12a_1p8: l12 { ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ vreg_l13a_2p95: l13 { ++ regulator-min-microvolt = <1808000>; ++ regulator-max-microvolt = <2960000>; ++ }; ++ vreg_l14a_1p88: l14 { ++ regulator-min-microvolt = <1880000>; ++ regulator-max-microvolt = <1880000>; ++ }; ++ vreg_15a_1p8: l15 { ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ vreg_l16a_2p7: l16 { ++ regulator-min-microvolt = <2704000>; ++ regulator-max-microvolt = <2704000>; ++ }; ++ vreg_l17a_1p3: l17 { ++ regulator-min-microvolt = <1304000>; ++ regulator-max-microvolt = <1304000>; ++ }; ++ vreg_l18a_2p7: l18 { ++ regulator-min-microvolt = <2704000>; ++ regulator-max-microvolt = <2704000>; ++ }; ++ vreg_l19a_3p0: l19 { ++ regulator-min-microvolt = <3008000>; ++ regulator-max-microvolt = <3008000>; ++ }; ++ vreg_l20a_2p95: l20 { ++ regulator-min-microvolt = <2960000>; ++ regulator-max-microvolt = <2960000>; ++ regulator-allow-set-load; ++ }; ++ vreg_l21a_2p95: l21 { ++ regulator-min-microvolt = <2960000>; ++ regulator-max-microvolt = <2960000>; ++ regulator-allow-set-load; ++ regulator-system-load = <800000>; ++ }; ++ vreg_l22a_2p85: l22 { ++ regulator-min-microvolt = <2864000>; ++ regulator-max-microvolt = <2864000>; ++ }; ++ vreg_l23a_3p3: l23 { ++ regulator-min-microvolt = <3312000>; ++ regulator-max-microvolt = <3312000>; ++ }; ++ vreg_l24a_3p075: l24 { ++ regulator-min-microvolt = <3088000>; ++ regulator-max-microvolt = <3088000>; ++ }; ++ vreg_l25a_3p3: l25 { ++ regulator-min-microvolt = <3104000>; ++ regulator-max-microvolt = <3312000>; ++ }; ++ vreg_l26a_1p2: l26 { ++ regulator-min-microvolt = <1200000>; ++ regulator-max-microvolt = <1200000>; ++ }; ++ vreg_l28_3p0: l28 { ++ regulator-min-microvolt = <3008000>; ++ regulator-max-microvolt = <3008000>; ++ }; ++ ++ vreg_lvs1a_1p8: lvs1 { ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ ++ vreg_lvs2a_1p8: lvs2 { ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ }; ++ ++ }; ++}; ++ ++&tlmm { ++ gpio-reserved-ranges = <0 4>, <81 4>; ++ ++ touchpad: touchpad { ++ config { ++ pins = "gpio123"; ++ bias-pull-up; /* pull up */ ++ }; ++ }; ++}; ++ ++&sdhc2 { ++ status = "okay"; ++ ++ vmmc-supply = <&vreg_l21a_2p95>; ++ vqmmc-supply = <&vreg_l13a_2p95>; ++ ++ pinctrl-names = "default", "sleep"; ++ pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>; ++ pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>; ++}; ++ ++&usb3 { ++ status = "okay"; ++}; ++ ++&usb3_dwc3 { ++ dr_mode = "host"; /* Force to host until we have Type-C hooked up */ ++}; ++ ++&usb3phy { ++ status = "okay"; ++ ++ vdda-phy-supply = <&vreg_l1a_0p875>; ++ vdda-pll-supply = <&vreg_l2a_1p2>; ++}; +diff --git a/arch/arm64/boot/dts/qcom/msm8998-lenovo-miix-630.dts b/arch/arm64/boot/dts/qcom/msm8998-lenovo-miix-630.dts +new file mode 100644 +index 0000000000000..407c6a32911cc +--- /dev/null ++++ b/arch/arm64/boot/dts/qcom/msm8998-lenovo-miix-630.dts +@@ -0,0 +1,30 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* Copyright (c) 2019, Jeffrey Hugo. All rights reserved. */ ++ ++/dts-v1/; ++ ++#include "msm8998-clamshell.dtsi" ++ ++/ { ++ model = "Lenovo Miix 630"; ++ compatible = "lenovo,miix-630", "qcom,msm8998"; ++}; ++ ++&blsp1_i2c6 { ++ status = "okay"; ++ ++ keyboard@3a { ++ compatible = "hid-over-i2c"; ++ interrupt-parent = <&tlmm>; ++ interrupts = <0x79 IRQ_TYPE_LEVEL_LOW>; ++ reg = <0x3a>; ++ hid-descr-addr = <0x0001>; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&touchpad>; ++ }; ++}; ++ ++&sdhc2 { ++ cd-gpios = <&tlmm 95 GPIO_ACTIVE_HIGH>; ++}; +-- +2.20.1 + diff --git a/queue-5.3/ath6kl-fix-a-null-ptr-deref-bug-in-ath6kl_usb_alloc_.patch b/queue-5.3/ath6kl-fix-a-null-ptr-deref-bug-in-ath6kl_usb_alloc_.patch new file mode 100644 index 00000000000..4060d89480f --- /dev/null +++ b/queue-5.3/ath6kl-fix-a-null-ptr-deref-bug-in-ath6kl_usb_alloc_.patch @@ -0,0 +1,77 @@ +From 2a3d9cce7fae80a89d53aaa91a48e1877222a619 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Aug 2019 20:29:04 -0400 +Subject: ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe() + +From: Hui Peng + +[ Upstream commit 39d170b3cb62ba98567f5c4f40c27b5864b304e5 ] + +The `ar_usb` field of `ath6kl_usb_pipe_usb_pipe` objects +are initialized to point to the containing `ath6kl_usb` object +according to endpoint descriptors read from the device side, as shown +below in `ath6kl_usb_setup_pipe_resources`: + +for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { + endpoint = &iface_desc->endpoint[i].desc; + + // get the address from endpoint descriptor + pipe_num = ath6kl_usb_get_logical_pipe_num(ar_usb, + endpoint->bEndpointAddress, + &urbcount); + ...... + // select the pipe object + pipe = &ar_usb->pipes[pipe_num]; + + // initialize the ar_usb field + pipe->ar_usb = ar_usb; +} + +The driver assumes that the addresses reported in endpoint +descriptors from device side to be complete. If a device is +malicious and does not report complete addresses, it may trigger +NULL-ptr-deref `ath6kl_usb_alloc_urb_from_pipe` and +`ath6kl_usb_free_urb_to_pipe`. + +This patch fixes the bug by preventing potential NULL-ptr-deref +(CVE-2019-15098). + +Signed-off-by: Hui Peng +Reported-by: Hui Peng +Reported-by: Mathias Payer +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/usb.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c +index 4defb7a0330f4..53b66e9434c99 100644 +--- a/drivers/net/wireless/ath/ath6kl/usb.c ++++ b/drivers/net/wireless/ath/ath6kl/usb.c +@@ -132,6 +132,10 @@ ath6kl_usb_alloc_urb_from_pipe(struct ath6kl_usb_pipe *pipe) + struct ath6kl_urb_context *urb_context = NULL; + unsigned long flags; + ++ /* bail if this pipe is not initialized */ ++ if (!pipe->ar_usb) ++ return NULL; ++ + spin_lock_irqsave(&pipe->ar_usb->cs_lock, flags); + if (!list_empty(&pipe->urb_list_head)) { + urb_context = +@@ -150,6 +154,10 @@ static void ath6kl_usb_free_urb_to_pipe(struct ath6kl_usb_pipe *pipe, + { + unsigned long flags; + ++ /* bail if this pipe is not initialized */ ++ if (!pipe->ar_usb) ++ return; ++ + spin_lock_irqsave(&pipe->ar_usb->cs_lock, flags); + pipe->urb_cnt++; + +-- +2.20.1 + diff --git a/queue-5.3/rtw88-fix-misuse-of-genmask-macro.patch b/queue-5.3/rtw88-fix-misuse-of-genmask-macro.patch new file mode 100644 index 00000000000..b6e4333e016 --- /dev/null +++ b/queue-5.3/rtw88-fix-misuse-of-genmask-macro.patch @@ -0,0 +1,35 @@ +From ef6c8326c7e16a380ba3a3ed553f76865b01eb18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jul 2019 22:04:22 -0700 +Subject: rtw88: Fix misuse of GENMASK macro + +From: Joe Perches + +[ Upstream commit 5ff29d836d1beb347080bd96e6321c811a8e3f62 ] + +Arguments are supposed to be ordered high then low. + +Signed-off-by: Joe Perches +Acked-by: Yan-Hsuan Chuang +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/rtw8822b.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.c b/drivers/net/wireless/realtek/rtw88/rtw8822b.c +index 1172f6c0605b3..d61d534396c73 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c +@@ -997,7 +997,7 @@ static void rtw8822b_do_iqk(struct rtw_dev *rtwdev) + rtw_write_rf(rtwdev, RF_PATH_A, RF_DTXLOK, RFREG_MASK, 0x0); + + reload = !!rtw_read32_mask(rtwdev, REG_IQKFAILMSK, BIT(16)); +- iqk_fail_mask = rtw_read32_mask(rtwdev, REG_IQKFAILMSK, GENMASK(0, 7)); ++ iqk_fail_mask = rtw_read32_mask(rtwdev, REG_IQKFAILMSK, GENMASK(7, 0)); + rtw_dbg(rtwdev, RTW_DBG_PHY, + "iqk counter=%d reload=%d do_iqk_cnt=%d n_iqk_fail(mask)=0x%02x\n", + counter, reload, ++do_iqk_cnt, iqk_fail_mask); +-- +2.20.1 + diff --git a/queue-5.3/s390-pci-fix-msi-message-data.patch b/queue-5.3/s390-pci-fix-msi-message-data.patch new file mode 100644 index 00000000000..f0425d48b6a --- /dev/null +++ b/queue-5.3/s390-pci-fix-msi-message-data.patch @@ -0,0 +1,36 @@ +From 6f81da225f550a86937118dcf91468727f3d48b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Sep 2019 15:45:04 +0200 +Subject: s390/pci: fix MSI message data + +From: Sebastian Ott + +[ Upstream commit cf2c4a3f35b75d38cebb4afbd578f1594f068d1e ] + +After recent changes the MSI message data needs to specify the +function-relative IRQ number. + +Reported-and-tested-by: Alexander Schmidt +Signed-off-by: Sebastian Ott +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/pci/pci_irq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/pci/pci_irq.c b/arch/s390/pci/pci_irq.c +index d80616ae8dd8a..fbe97ab2e2286 100644 +--- a/arch/s390/pci/pci_irq.c ++++ b/arch/s390/pci/pci_irq.c +@@ -284,7 +284,7 @@ int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type) + return rc; + irq_set_chip_and_handler(irq, &zpci_irq_chip, + handle_percpu_irq); +- msg.data = hwirq; ++ msg.data = hwirq - bit; + if (irq_delivery == DIRECTED) { + msg.address_lo = zdev->msi_addr & 0xff0000ff; + msg.address_lo |= msi->affinity ? +-- +2.20.1 + diff --git a/queue-5.3/series b/queue-5.3/series index 5c9fa20e49b..10a02cafd6e 100644 --- a/queue-5.3/series +++ b/queue-5.3/series @@ -84,3 +84,11 @@ perf-annotate-fix-multiple-memory-and-file-descripto.patch perf-aux-fix-tracking-of-auxiliary-trace-buffer-allo.patch usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch nbd-verify-socket-is-supported-during-setup.patch +arm64-dts-qcom-add-lenovo-miix-630.patch +arm64-dts-qcom-add-hp-envy-x2.patch +arm64-dts-qcom-add-asus-novago-tp370ql.patch +rtw88-fix-misuse-of-genmask-macro.patch +s390-pci-fix-msi-message-data.patch +thunderbolt-correct-path-indices-for-pcie-tunnel.patch +thunderbolt-use-32-bit-writes-when-writing-ring-prod.patch +ath6kl-fix-a-null-ptr-deref-bug-in-ath6kl_usb_alloc_.patch diff --git a/queue-5.3/thunderbolt-correct-path-indices-for-pcie-tunnel.patch b/queue-5.3/thunderbolt-correct-path-indices-for-pcie-tunnel.patch new file mode 100644 index 00000000000..d8ff25a2b1b --- /dev/null +++ b/queue-5.3/thunderbolt-correct-path-indices-for-pcie-tunnel.patch @@ -0,0 +1,48 @@ +From 593771bcdb10dcfe60d99bc3e440666d9d4c3823 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2019 19:31:26 +0300 +Subject: thunderbolt: Correct path indices for PCIe tunnel + +From: Mika Westerberg + +[ Upstream commit ce19f91eae43e39d5a1da55344756ab5a3c7e8d1 ] + +PCIe tunnel path indices got mixed up when we added support for tunnels +between switches that are not adjacent. This did not affect the +functionality as it is just an index but fix it now nevertheless to make +the code easier to understand. + +Reported-by: Rajmohan Mani +Fixes: 8c7acaaf020f ("thunderbolt: Extend tunnel creation to more than 2 adjacent switches") +Signed-off-by: Mika Westerberg +Reviewed-by: Yehezkel Bernat +Signed-off-by: Sasha Levin +--- + drivers/thunderbolt/tunnel.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/thunderbolt/tunnel.c b/drivers/thunderbolt/tunnel.c +index 31d0234837e45..5a99234826e73 100644 +--- a/drivers/thunderbolt/tunnel.c ++++ b/drivers/thunderbolt/tunnel.c +@@ -211,7 +211,7 @@ struct tb_tunnel *tb_tunnel_alloc_pci(struct tb *tb, struct tb_port *up, + return NULL; + } + tb_pci_init_path(path); +- tunnel->paths[TB_PCI_PATH_UP] = path; ++ tunnel->paths[TB_PCI_PATH_DOWN] = path; + + path = tb_path_alloc(tb, up, TB_PCI_HOPID, down, TB_PCI_HOPID, 0, + "PCIe Up"); +@@ -220,7 +220,7 @@ struct tb_tunnel *tb_tunnel_alloc_pci(struct tb *tb, struct tb_port *up, + return NULL; + } + tb_pci_init_path(path); +- tunnel->paths[TB_PCI_PATH_DOWN] = path; ++ tunnel->paths[TB_PCI_PATH_UP] = path; + + return tunnel; + } +-- +2.20.1 + diff --git a/queue-5.3/thunderbolt-use-32-bit-writes-when-writing-ring-prod.patch b/queue-5.3/thunderbolt-use-32-bit-writes-when-writing-ring-prod.patch new file mode 100644 index 00000000000..6cced35bf16 --- /dev/null +++ b/queue-5.3/thunderbolt-use-32-bit-writes-when-writing-ring-prod.patch @@ -0,0 +1,73 @@ +From e0dd6709b01e8fc405617023c251d2fd81b974e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jul 2018 08:46:07 +0300 +Subject: thunderbolt: Use 32-bit writes when writing ring producer/consumer + +From: Mika Westerberg + +[ Upstream commit 943795219d3cb9f8ce6ce51cad3ffe1f61e95c6b ] + +The register access should be using 32-bit reads/writes according to the +datasheet. With the previous generation hardware 16-bit writes have been +working but starting with ICL this is not the case anymore so fix +producer/consumer register update to use correct width register address. + +Signed-off-by: Mika Westerberg +Reviewed-by: Yehezkel Bernat +Tested-by: Mario Limonciello +Signed-off-by: Sasha Levin +--- + drivers/thunderbolt/nhi.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c +index 27fbe62c7ddd4..9c782706e652f 100644 +--- a/drivers/thunderbolt/nhi.c ++++ b/drivers/thunderbolt/nhi.c +@@ -143,9 +143,20 @@ static void __iomem *ring_options_base(struct tb_ring *ring) + return io; + } + +-static void ring_iowrite16desc(struct tb_ring *ring, u32 value, u32 offset) ++static void ring_iowrite_cons(struct tb_ring *ring, u16 cons) + { +- iowrite16(value, ring_desc_base(ring) + offset); ++ /* ++ * The other 16-bits in the register is read-only and writes to it ++ * are ignored by the hardware so we can save one ioread32() by ++ * filling the read-only bits with zeroes. ++ */ ++ iowrite32(cons, ring_desc_base(ring) + 8); ++} ++ ++static void ring_iowrite_prod(struct tb_ring *ring, u16 prod) ++{ ++ /* See ring_iowrite_cons() above for explanation */ ++ iowrite32(prod << 16, ring_desc_base(ring) + 8); + } + + static void ring_iowrite32desc(struct tb_ring *ring, u32 value, u32 offset) +@@ -197,7 +208,10 @@ static void ring_write_descriptors(struct tb_ring *ring) + descriptor->sof = frame->sof; + } + ring->head = (ring->head + 1) % ring->size; +- ring_iowrite16desc(ring, ring->head, ring->is_tx ? 10 : 8); ++ if (ring->is_tx) ++ ring_iowrite_prod(ring, ring->head); ++ else ++ ring_iowrite_cons(ring, ring->head); + } + } + +@@ -662,7 +676,7 @@ void tb_ring_stop(struct tb_ring *ring) + + ring_iowrite32options(ring, 0, 0); + ring_iowrite64desc(ring, 0, 0); +- ring_iowrite16desc(ring, 0, ring->is_tx ? 10 : 8); ++ ring_iowrite32desc(ring, 0, 8); + ring_iowrite32desc(ring, 0, 12); + ring->head = 0; + ring->tail = 0; +-- +2.20.1 +