From: Sasha Levin Date: Fri, 30 Aug 2019 02:30:30 +0000 (-0400) Subject: fixes for 4.9 X-Git-Tag: v4.4.191~60 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fc2d732000c5d6aa4729c1b886bbdf769933a693;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.9 Signed-off-by: Sasha Levin --- diff --git a/queue-4.9/dmaengine-ste_dma40-fix-unneeded-variable-warning.patch b/queue-4.9/dmaengine-ste_dma40-fix-unneeded-variable-warning.patch new file mode 100644 index 00000000000..faea386399e --- /dev/null +++ b/queue-4.9/dmaengine-ste_dma40-fix-unneeded-variable-warning.patch @@ -0,0 +1,54 @@ +From 4ec5d04ded5be0927682b374e81bb4985c0896cf Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Fri, 12 Jul 2019 11:13:30 +0200 +Subject: dmaengine: ste_dma40: fix unneeded variable warning + +[ Upstream commit 5d6fb560729a5d5554e23db8d00eb57cd0021083 ] + +clang-9 points out that there are two variables that depending on the +configuration may only be used in an ARRAY_SIZE() expression but not +referenced: + +drivers/dma/ste_dma40.c:145:12: error: variable 'd40_backup_regs' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration] +static u32 d40_backup_regs[] = { + ^ +drivers/dma/ste_dma40.c:214:12: error: variable 'd40_backup_regs_chan' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration] +static u32 d40_backup_regs_chan[] = { + +Mark these __maybe_unused to shut up the warning. + +Signed-off-by: Arnd Bergmann +Reviewed-by: Nathan Chancellor +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20190712091357.744515-1-arnd@arndb.de +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ste_dma40.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c +index 8684d11b29bba..68b41daab3a8f 100644 +--- a/drivers/dma/ste_dma40.c ++++ b/drivers/dma/ste_dma40.c +@@ -142,7 +142,7 @@ enum d40_events { + * when the DMA hw is powered off. + * TODO: Add save/restore of D40_DREG_GCC on dma40 v3 or later, if that works. + */ +-static u32 d40_backup_regs[] = { ++static __maybe_unused u32 d40_backup_regs[] = { + D40_DREG_LCPA, + D40_DREG_LCLA, + D40_DREG_PRMSE, +@@ -211,7 +211,7 @@ static u32 d40_backup_regs_v4b[] = { + + #define BACKUP_REGS_SZ_V4B ARRAY_SIZE(d40_backup_regs_v4b) + +-static u32 d40_backup_regs_chan[] = { ++static __maybe_unused u32 d40_backup_regs_chan[] = { + D40_CHAN_REG_SSCFG, + D40_CHAN_REG_SSELT, + D40_CHAN_REG_SSPTR, +-- +2.20.1 + diff --git a/queue-4.9/i2c-emev2-avoid-race-when-unregistering-slave-client.patch b/queue-4.9/i2c-emev2-avoid-race-when-unregistering-slave-client.patch new file mode 100644 index 00000000000..ed6abd8dd35 --- /dev/null +++ b/queue-4.9/i2c-emev2-avoid-race-when-unregistering-slave-client.patch @@ -0,0 +1,78 @@ +From 435bea18b6109e9351577d940a85136d390a25dd Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Thu, 8 Aug 2019 21:54:17 +0200 +Subject: i2c: emev2: avoid race when unregistering slave client + +[ Upstream commit d7437fc0d8291181debe032671a289b6bd93f46f ] + +After we disabled interrupts, there might still be an active one +running. Sync before clearing the pointer to the slave device. + +Fixes: c31d0a00021d ("i2c: emev2: add slave support") +Reported-by: Krzysztof Adamski +Signed-off-by: Wolfram Sang +Reviewed-by: Krzysztof Adamski +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-emev2.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-emev2.c b/drivers/i2c/busses/i2c-emev2.c +index 96bb4e7490128..0218ba6eb26ab 100644 +--- a/drivers/i2c/busses/i2c-emev2.c ++++ b/drivers/i2c/busses/i2c-emev2.c +@@ -72,6 +72,7 @@ struct em_i2c_device { + struct completion msg_done; + struct clk *sclk; + struct i2c_client *slave; ++ int irq; + }; + + static inline void em_clear_set_bit(struct em_i2c_device *priv, u8 clear, u8 set, u8 reg) +@@ -342,6 +343,12 @@ static int em_i2c_unreg_slave(struct i2c_client *slave) + + writeb(0, priv->base + I2C_OFS_SVA0); + ++ /* ++ * Wait for interrupt to finish. New slave irqs cannot happen because we ++ * cleared the slave address and, thus, only extension codes will be ++ * detected which do not use the slave ptr. ++ */ ++ synchronize_irq(priv->irq); + priv->slave = NULL; + + return 0; +@@ -358,7 +365,7 @@ static int em_i2c_probe(struct platform_device *pdev) + { + struct em_i2c_device *priv; + struct resource *r; +- int irq, ret; ++ int ret; + + priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL); + if (!priv) +@@ -391,8 +398,8 @@ static int em_i2c_probe(struct platform_device *pdev) + + em_i2c_reset(&priv->adap); + +- irq = platform_get_irq(pdev, 0); +- ret = devm_request_irq(&pdev->dev, irq, em_i2c_irq_handler, 0, ++ priv->irq = platform_get_irq(pdev, 0); ++ ret = devm_request_irq(&pdev->dev, priv->irq, em_i2c_irq_handler, 0, + "em_i2c", priv); + if (ret) + goto err_clk; +@@ -402,7 +409,8 @@ static int em_i2c_probe(struct platform_device *pdev) + if (ret) + goto err_clk; + +- dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr, irq); ++ dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr, ++ priv->irq); + + return 0; + +-- +2.20.1 + diff --git a/queue-4.9/iommu-dma-handle-sg-length-overflow-better.patch b/queue-4.9/iommu-dma-handle-sg-length-overflow-better.patch new file mode 100644 index 00000000000..56036a0a8ee --- /dev/null +++ b/queue-4.9/iommu-dma-handle-sg-length-overflow-better.patch @@ -0,0 +1,45 @@ +From 1dbf91e4fa80e4af02369b1688a43b1e5e5864a3 Mon Sep 17 00:00:00 2001 +From: Robin Murphy +Date: Mon, 29 Jul 2019 17:46:00 +0100 +Subject: iommu/dma: Handle SG length overflow better + +[ Upstream commit ab2cbeb0ed301a9f0460078e91b09f39958212ef ] + +Since scatterlist dimensions are all unsigned ints, in the relatively +rare cases where a device's max_segment_size is set to UINT_MAX, then +the "cur_len + s_length <= max_len" check in __finalise_sg() will always +return true. As a result, the corner case of such a device mapping an +excessively large scatterlist which is mergeable to or beyond a total +length of 4GB can lead to overflow and a bogus truncated dma_length in +the resulting segment. + +As we already assume that any single segment must be no longer than +max_len to begin with, this can easily be addressed by reshuffling the +comparison. + +Fixes: 809eac54cdd6 ("iommu/dma: Implement scatterlist segment merging") +Reported-by: Nicolin Chen +Tested-by: Nicolin Chen +Signed-off-by: Robin Murphy +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/dma-iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c +index 1520e7f02c2f1..89d191b6a0e0f 100644 +--- a/drivers/iommu/dma-iommu.c ++++ b/drivers/iommu/dma-iommu.c +@@ -493,7 +493,7 @@ static int __finalise_sg(struct device *dev, struct scatterlist *sg, int nents, + * - and wouldn't make the resulting output segment too long + */ + if (cur_len && !s_iova_off && (dma_addr & seg_mask) && +- (cur_len + s_length <= max_len)) { ++ (max_len - cur_len >= s_length)) { + /* ...then concatenate it with the previous one */ + cur_len += s_length; + } else { +-- +2.20.1 + diff --git a/queue-4.9/scsi-ufs-fix-rx_termination_force_enable-define-valu.patch b/queue-4.9/scsi-ufs-fix-rx_termination_force_enable-define-valu.patch new file mode 100644 index 00000000000..cfef24a42e7 --- /dev/null +++ b/queue-4.9/scsi-ufs-fix-rx_termination_force_enable-define-valu.patch @@ -0,0 +1,34 @@ +From eb9096b5c826a17f76c3e04fa8e4bb61d9d7773e Mon Sep 17 00:00:00 2001 +From: Pedro Sousa +Date: Thu, 18 Apr 2019 21:13:34 +0200 +Subject: scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value + +[ Upstream commit ebcb8f8508c5edf428f52525cec74d28edea7bcb ] + +Fix RX_TERMINATION_FORCE_ENABLE define value from 0x0089 to 0x00A9 +according to MIPI Alliance MPHY specification. + +Fixes: e785060ea3a1 ("ufs: definitions for phy interface") +Signed-off-by: Pedro Sousa +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/unipro.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/ufs/unipro.h b/drivers/scsi/ufs/unipro.h +index 23129d7b2678d..c77e365264478 100644 +--- a/drivers/scsi/ufs/unipro.h ++++ b/drivers/scsi/ufs/unipro.h +@@ -52,7 +52,7 @@ + #define RX_HS_UNTERMINATED_ENABLE 0x00A6 + #define RX_ENTER_HIBERN8 0x00A7 + #define RX_BYPASS_8B10B_ENABLE 0x00A8 +-#define RX_TERMINATION_FORCE_ENABLE 0x0089 ++#define RX_TERMINATION_FORCE_ENABLE 0x00A9 + #define RX_MIN_ACTIVATETIME_CAPABILITY 0x008F + #define RX_HIBERN8TIME_CAPABILITY 0x0092 + #define RX_REFCLKFREQ 0x00EB +-- +2.20.1 + diff --git a/queue-4.9/series b/queue-4.9/series index 06d4ddb2a46..0b6bd10325a 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -43,3 +43,12 @@ mm-zsmalloc.c-migration-can-leave-pages-in-zs_empty-indefinitely.patch xfs-fix-missing-ilock-unlock-when-xfs_setattr_nonsize-fails-due-to-edquot.patch revert-perf-test-6-fix-missing-kvm-module-load-for-s.patch x86-cpu-amd-clear-rdrand-cpuid-bit-on-amd-family-15h.patch +dmaengine-ste_dma40-fix-unneeded-variable-warning.patch +iommu-dma-handle-sg-length-overflow-better.patch +usb-gadget-composite-clear-suspended-on-reset-discon.patch +xen-blkback-fix-memory-leaks.patch +i2c-emev2-avoid-race-when-unregistering-slave-client.patch +usb-host-fotg2-restart-hcd-after-port-reset.patch +tools-hv-fix-kvp-and-vss-daemons-exit-code.patch +watchdog-bcm2835_wdt-fix-module-autoload.patch +scsi-ufs-fix-rx_termination_force_enable-define-valu.patch diff --git a/queue-4.9/tools-hv-fix-kvp-and-vss-daemons-exit-code.patch b/queue-4.9/tools-hv-fix-kvp-and-vss-daemons-exit-code.patch new file mode 100644 index 00000000000..105480d76dc --- /dev/null +++ b/queue-4.9/tools-hv-fix-kvp-and-vss-daemons-exit-code.patch @@ -0,0 +1,52 @@ +From 2c8c5433785690a9002e1c0e1a022233e9d43543 Mon Sep 17 00:00:00 2001 +From: Adrian Vladu +Date: Mon, 6 May 2019 16:50:58 +0000 +Subject: tools: hv: fix KVP and VSS daemons exit code + +[ Upstream commit b0995156071b0ff29a5902964a9dc8cfad6f81c0 ] + +HyperV KVP and VSS daemons should exit with 0 when the '--help' +or '-h' flags are used. + +Signed-off-by: Adrian Vladu + +Cc: "K. Y. Srinivasan" +Cc: Haiyang Zhang +Cc: Stephen Hemminger +Cc: Sasha Levin +Cc: Alessandro Pilotti +Signed-off-by: Sasha Levin +--- + tools/hv/hv_kvp_daemon.c | 2 ++ + tools/hv/hv_vss_daemon.c | 2 ++ + 2 files changed, 4 insertions(+) + +diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c +index 1774800668168..fffc7c4184599 100644 +--- a/tools/hv/hv_kvp_daemon.c ++++ b/tools/hv/hv_kvp_daemon.c +@@ -1379,6 +1379,8 @@ int main(int argc, char *argv[]) + daemonize = 0; + break; + case 'h': ++ print_usage(argv); ++ exit(0); + default: + print_usage(argv); + exit(EXIT_FAILURE); +diff --git a/tools/hv/hv_vss_daemon.c b/tools/hv/hv_vss_daemon.c +index e0829809c8970..bdc1891e0a9a3 100644 +--- a/tools/hv/hv_vss_daemon.c ++++ b/tools/hv/hv_vss_daemon.c +@@ -164,6 +164,8 @@ int main(int argc, char *argv[]) + daemonize = 0; + break; + case 'h': ++ print_usage(argv); ++ exit(0); + default: + print_usage(argv); + exit(EXIT_FAILURE); +-- +2.20.1 + diff --git a/queue-4.9/usb-gadget-composite-clear-suspended-on-reset-discon.patch b/queue-4.9/usb-gadget-composite-clear-suspended-on-reset-discon.patch new file mode 100644 index 00000000000..19336fac79e --- /dev/null +++ b/queue-4.9/usb-gadget-composite-clear-suspended-on-reset-discon.patch @@ -0,0 +1,33 @@ +From a8d2605f5fa1a3f7573b1ac71bb954849d4b43b9 Mon Sep 17 00:00:00 2001 +From: Benjamin Herrenschmidt +Date: Fri, 26 Jul 2019 14:59:03 +1000 +Subject: usb: gadget: composite: Clear "suspended" on reset/disconnect + +[ Upstream commit 602fda17c7356bb7ae98467d93549057481d11dd ] + +In some cases, one can get out of suspend with a reset or +a disconnect followed by a reconnect. Previously we would +leave a stale suspended flag set. + +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/composite.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c +index 2c022a08f1638..9fa168af847b5 100644 +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -2000,6 +2000,7 @@ void composite_disconnect(struct usb_gadget *gadget) + * disconnect callbacks? + */ + spin_lock_irqsave(&cdev->lock, flags); ++ cdev->suspended = 0; + if (cdev->config) + reset_config(cdev); + if (cdev->driver->disconnect) +-- +2.20.1 + diff --git a/queue-4.9/usb-host-fotg2-restart-hcd-after-port-reset.patch b/queue-4.9/usb-host-fotg2-restart-hcd-after-port-reset.patch new file mode 100644 index 00000000000..a621471cb24 --- /dev/null +++ b/queue-4.9/usb-host-fotg2-restart-hcd-after-port-reset.patch @@ -0,0 +1,37 @@ +From 5544eed913fd46a9cad3c88f0ef366b4ac0f0a24 Mon Sep 17 00:00:00 2001 +From: Hans Ulli Kroll +Date: Sat, 10 Aug 2019 17:04:58 +0200 +Subject: usb: host: fotg2: restart hcd after port reset + +[ Upstream commit 777758888ffe59ef754cc39ab2f275dc277732f4 ] + +On the Gemini SoC the FOTG2 stalls after port reset +so restart the HCD after each port reset. + +Signed-off-by: Hans Ulli Kroll +Signed-off-by: Linus Walleij +Link: https://lore.kernel.org/r/20190810150458.817-1-linus.walleij@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/fotg210-hcd.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c +index 66efa9a676877..72853020a5426 100644 +--- a/drivers/usb/host/fotg210-hcd.c ++++ b/drivers/usb/host/fotg210-hcd.c +@@ -1653,6 +1653,10 @@ static int fotg210_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + /* see what we found out */ + temp = check_reset_complete(fotg210, wIndex, status_reg, + fotg210_readl(fotg210, status_reg)); ++ ++ /* restart schedule */ ++ fotg210->command |= CMD_RUN; ++ fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command); + } + + if (!(temp & (PORT_RESUME|PORT_RESET))) { +-- +2.20.1 + diff --git a/queue-4.9/watchdog-bcm2835_wdt-fix-module-autoload.patch b/queue-4.9/watchdog-bcm2835_wdt-fix-module-autoload.patch new file mode 100644 index 00000000000..909f26f4a57 --- /dev/null +++ b/queue-4.9/watchdog-bcm2835_wdt-fix-module-autoload.patch @@ -0,0 +1,35 @@ +From 8b5028646ef4876500e2e1c45b6cc66350714cd1 Mon Sep 17 00:00:00 2001 +From: Stefan Wahren +Date: Wed, 15 May 2019 19:14:18 +0200 +Subject: watchdog: bcm2835_wdt: Fix module autoload + +[ Upstream commit 215e06f0d18d5d653d6ea269e4dfc684854d48bf ] + +The commit 5e6acc3e678e ("bcm2835-pm: Move bcm2835-watchdog's DT probe +to an MFD.") broke module autoloading on Raspberry Pi. So add a +module alias this fix this. + +Signed-off-by: Stefan Wahren +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/bcm2835_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c +index 4dddd8298a227..3e2e2e6a8328c 100644 +--- a/drivers/watchdog/bcm2835_wdt.c ++++ b/drivers/watchdog/bcm2835_wdt.c +@@ -240,6 +240,7 @@ module_param(nowayout, bool, 0); + MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" + __MODULE_STRING(WATCHDOG_NOWAYOUT) ")"); + ++MODULE_ALIAS("platform:bcm2835-wdt"); + MODULE_AUTHOR("Lubomir Rintel "); + MODULE_DESCRIPTION("Driver for Broadcom BCM2835 watchdog timer"); + MODULE_LICENSE("GPL"); +-- +2.20.1 + diff --git a/queue-4.9/xen-blkback-fix-memory-leaks.patch b/queue-4.9/xen-blkback-fix-memory-leaks.patch new file mode 100644 index 00000000000..a39b56f99b9 --- /dev/null +++ b/queue-4.9/xen-blkback-fix-memory-leaks.patch @@ -0,0 +1,59 @@ +From 202e8661ec4c3771335168bf9ebab9e545dbfbbd Mon Sep 17 00:00:00 2001 +From: Wenwen Wang +Date: Sun, 11 Aug 2019 12:23:22 -0500 +Subject: xen/blkback: fix memory leaks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit ae78ca3cf3d9e9f914bfcd0bc5c389ff18b9c2e0 ] + +In read_per_ring_refs(), after 'req' and related memory regions are +allocated, xen_blkif_map() is invoked to map the shared frame, irq, and +etc. However, if this mapping process fails, no cleanup is performed, +leading to memory leaks. To fix this issue, invoke the cleanup before +returning the error. + +Acked-by: Roger Pau Monné +Reviewed-by: Boris Ostrovsky +Signed-off-by: Wenwen Wang +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/xen-blkback/xenbus.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c +index 5dfe6e8af1408..ad736d7de8383 100644 +--- a/drivers/block/xen-blkback/xenbus.c ++++ b/drivers/block/xen-blkback/xenbus.c +@@ -967,6 +967,7 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir) + } + blkif->nr_ring_pages = nr_grefs; + ++ err = -ENOMEM; + for (i = 0; i < nr_grefs * XEN_BLKIF_REQS_PER_PAGE; i++) { + req = kzalloc(sizeof(*req), GFP_KERNEL); + if (!req) +@@ -989,7 +990,7 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir) + err = xen_blkif_map(ring, ring_ref, nr_grefs, evtchn); + if (err) { + xenbus_dev_fatal(dev, err, "mapping ring-ref port %u", evtchn); +- return err; ++ goto fail; + } + + return 0; +@@ -1009,8 +1010,7 @@ fail: + } + kfree(req); + } +- return -ENOMEM; +- ++ return err; + } + + static int connect_ring(struct backend_info *be) +-- +2.20.1 +