From 384f6dcdb7548c887054237c9224ea66569c0e14 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Thu, 29 Aug 2019 22:30:29 -0400 Subject: [PATCH] fixes for 4.19 Signed-off-by: Sasha Levin --- ...ex-mixup-in-afs_deliver_vl_get_entry.patch | 68 ++++++ ...robeuuid-service-handler-to-reply-co.patch | 60 +++++ ...d_fsdata-if-different-in-afs_d_reval.patch | 46 ++++ ...-don-t-treat-granule-sizes-as-strict.patch | 66 ++++++ ...-need-to-delete-scan_timer-when-misc.patch | 35 +++ ..._dma40-fix-unneeded-variable-warning.patch | 54 +++++ ...mdma-fix-a-possible-null-pointer-der.patch | 41 ++++ ...-reboot-test-may-cause-system-hanged.patch | 74 +++++++ ...idge-tfp410-fix-memleak-in-get_modes.patch | 40 ++++ ...rm-i915-fix-broadwell-eu-computation.patch | 36 +++ ...ter-cpufreq-notifier-after-we-have-i.patch | 87 ++++++++ ...sible-null-pointer-dereference-in-af.patch | 55 +++++ ...race-when-unregistering-slave-client.patch | 78 +++++++ ...race-when-unregistering-slave-client.patch | 70 ++++++ ...dma-handle-sg-length-overflow-better.patch | 45 ++++ ...ble-deadlock-when-passthru-commands-.patch | 209 ++++++++++++++++++ ...evalidate-nvme_ns_head-gendisk-in-nv.patch | 45 ++++ ...nvme-pci-fix-async-probe-remove-race.patch | 45 ++++ ...-nvme_delete_wq-when-removing-the-po.patch | 50 +++++ ...ap_vout_vrfb-fix-off-by-one-fi-value.patch | 78 +++++++ ...termination_force_enable-define-valu.patch | 34 +++ queue-4.19/series | 30 +++ ...e_master-fix-definitions-for-intstat.patch | 36 +++ ...e_master-fix-register-definition-for.patch | 35 +++ ...hv-fix-kvp-and-vss-daemons-exit-code.patch | 52 +++++ ...ython-pep8-flake8-warnings-for-lsvmb.patch | 154 +++++++++++++ ...site-clear-suspended-on-reset-discon.patch | 33 +++ ...storage-fix-races-between-fsg_disabl.patch | 168 ++++++++++++++ ...t-fotg2-restart-hcd-after-port-reset.patch | 37 ++++ ...hdog-bcm2835_wdt-fix-module-autoload.patch | 35 +++ queue-4.19/xen-blkback-fix-memory-leaks.patch | 59 +++++ 31 files changed, 1955 insertions(+) create mode 100644 queue-4.19/afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch create mode 100644 queue-4.19/afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch create mode 100644 queue-4.19/afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch create mode 100644 queue-4.19/arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch create mode 100644 queue-4.19/auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch create mode 100644 queue-4.19/dmaengine-ste_dma40-fix-unneeded-variable-warning.patch create mode 100644 queue-4.19/dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch create mode 100644 queue-4.19/drm-ast-fixed-reboot-test-may-cause-system-hanged.patch create mode 100644 queue-4.19/drm-bridge-tfp410-fix-memleak-in-get_modes.patch create mode 100644 queue-4.19/drm-i915-fix-broadwell-eu-computation.patch create mode 100644 queue-4.19/drm-tilcdc-register-cpufreq-notifier-after-we-have-i.patch create mode 100644 queue-4.19/fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch create mode 100644 queue-4.19/i2c-emev2-avoid-race-when-unregistering-slave-client.patch create mode 100644 queue-4.19/i2c-rcar-avoid-race-when-unregistering-slave-client.patch create mode 100644 queue-4.19/iommu-dma-handle-sg-length-overflow-better.patch create mode 100644 queue-4.19/nvme-fix-a-possible-deadlock-when-passthru-commands-.patch create mode 100644 queue-4.19/nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch create mode 100644 queue-4.19/nvme-pci-fix-async-probe-remove-race.patch create mode 100644 queue-4.19/nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch create mode 100644 queue-4.19/omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch create mode 100644 queue-4.19/scsi-ufs-fix-rx_termination_force_enable-define-valu.patch create mode 100644 queue-4.19/series create mode 100644 queue-4.19/soundwire-cadence_master-fix-definitions-for-intstat.patch create mode 100644 queue-4.19/soundwire-cadence_master-fix-register-definition-for.patch create mode 100644 queue-4.19/tools-hv-fix-kvp-and-vss-daemons-exit-code.patch create mode 100644 queue-4.19/tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch create mode 100644 queue-4.19/usb-gadget-composite-clear-suspended-on-reset-discon.patch create mode 100644 queue-4.19/usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch create mode 100644 queue-4.19/usb-host-fotg2-restart-hcd-after-port-reset.patch create mode 100644 queue-4.19/watchdog-bcm2835_wdt-fix-module-autoload.patch create mode 100644 queue-4.19/xen-blkback-fix-memory-leaks.patch diff --git a/queue-4.19/afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch b/queue-4.19/afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch new file mode 100644 index 00000000000..678f2bfe758 --- /dev/null +++ b/queue-4.19/afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch @@ -0,0 +1,68 @@ +From 313741611fb2877bc9777e4526318b49c8f9b138 Mon Sep 17 00:00:00 2001 +From: Marc Dionne +Date: Tue, 30 Jul 2019 14:38:51 +0100 +Subject: afs: Fix loop index mixup in afs_deliver_vl_get_entry_by_name_u() + +[ Upstream commit 4a46fdba449a5cd890271df5a9e23927d519ed00 ] + +afs_deliver_vl_get_entry_by_name_u() scans through the vl entry +received from the volume location server and builds a return list +containing the sites that are currently valid. When assigning +values for the return list, the index into the vl entry (i) is used +rather than the one for the new list (entry->nr_server). If all +sites are usable, this works out fine as the indices will match. +If some sites are not valid, for example if AFS_VLSF_DONTUSE is +set, fs_mask and the uuid will be set for the wrong return site. + +Fix this by using entry->nr_server as the index into the arrays +being filled in rather than i. + +This can lead to EDESTADDRREQ errors if none of the returned sites +have a valid fs_mask. + +Fixes: d2ddc776a458 ("afs: Overhaul volume and server record caching and fileserver rotation") +Signed-off-by: Marc Dionne +Signed-off-by: David Howells +Reviewed-by: Jeffrey Altman +Signed-off-by: Sasha Levin +--- + fs/afs/vlclient.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c +index c3b740813fc71..c7dd47eaff29d 100644 +--- a/fs/afs/vlclient.c ++++ b/fs/afs/vlclient.c +@@ -60,23 +60,24 @@ static int afs_deliver_vl_get_entry_by_name_u(struct afs_call *call) + struct afs_uuid__xdr *xdr; + struct afs_uuid *uuid; + int j; ++ int n = entry->nr_servers; + + tmp = ntohl(uvldb->serverFlags[i]); + if (tmp & AFS_VLSF_DONTUSE || + (new_only && !(tmp & AFS_VLSF_NEWREPSITE))) + continue; + if (tmp & AFS_VLSF_RWVOL) { +- entry->fs_mask[i] |= AFS_VOL_VTM_RW; ++ entry->fs_mask[n] |= AFS_VOL_VTM_RW; + if (vlflags & AFS_VLF_BACKEXISTS) +- entry->fs_mask[i] |= AFS_VOL_VTM_BAK; ++ entry->fs_mask[n] |= AFS_VOL_VTM_BAK; + } + if (tmp & AFS_VLSF_ROVOL) +- entry->fs_mask[i] |= AFS_VOL_VTM_RO; +- if (!entry->fs_mask[i]) ++ entry->fs_mask[n] |= AFS_VOL_VTM_RO; ++ if (!entry->fs_mask[n]) + continue; + + xdr = &uvldb->serverNumber[i]; +- uuid = (struct afs_uuid *)&entry->fs_server[i]; ++ uuid = (struct afs_uuid *)&entry->fs_server[n]; + uuid->time_low = xdr->time_low; + uuid->time_mid = htons(ntohl(xdr->time_mid)); + uuid->time_hi_and_version = htons(ntohl(xdr->time_hi_and_version)); +-- +2.20.1 + diff --git a/queue-4.19/afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch b/queue-4.19/afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch new file mode 100644 index 00000000000..aea224efbdb --- /dev/null +++ b/queue-4.19/afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch @@ -0,0 +1,60 @@ +From 32601551eabd4580b9c0a50cd337e42720f0f2f9 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Tue, 30 Jul 2019 14:38:51 +0100 +Subject: afs: Fix the CB.ProbeUuid service handler to reply correctly + +[ Upstream commit 2067b2b3f4846402a040286135f98f46f8919939 ] + +Fix the service handler function for the CB.ProbeUuid RPC call so that it +replies in the correct manner - that is an empty reply for success and an +abort of 1 for failure. + +Putting 0 or 1 in an integer in the body of the reply should result in the +fileserver throwing an RX_PROTOCOL_ERROR abort and discarding its record of +the client; older servers, however, don't necessarily check that all the +data got consumed, and so might incorrectly think that they got a positive +response and associate the client with the wrong host record. + +If the client is incorrectly associated, this will result in callbacks +intended for a different client being delivered to this one and then, when +the other client connects and responds positively, all of the callback +promises meant for the client that issued the improper response will be +lost and it won't receive any further change notifications. + +Fixes: 9396d496d745 ("afs: support the CB.ProbeUuid RPC op") +Signed-off-by: David Howells +Reviewed-by: Jeffrey Altman +Signed-off-by: Sasha Levin +--- + fs/afs/cmservice.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c +index 9e51d6fe7e8f9..40c6860d4c632 100644 +--- a/fs/afs/cmservice.c ++++ b/fs/afs/cmservice.c +@@ -423,18 +423,14 @@ static void SRXAFSCB_ProbeUuid(struct work_struct *work) + struct afs_call *call = container_of(work, struct afs_call, work); + struct afs_uuid *r = call->request; + +- struct { +- __be32 match; +- } reply; +- + _enter(""); + + if (memcmp(r, &call->net->uuid, sizeof(call->net->uuid)) == 0) +- reply.match = htonl(0); ++ afs_send_empty_reply(call); + else +- reply.match = htonl(1); ++ rxrpc_kernel_abort_call(call->net->socket, call->rxcall, ++ 1, 1, "K-1"); + +- afs_send_simple_reply(call, &reply, sizeof(reply)); + afs_put_call(call); + _leave(""); + } +-- +2.20.1 + diff --git a/queue-4.19/afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch b/queue-4.19/afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch new file mode 100644 index 00000000000..afd2979e229 --- /dev/null +++ b/queue-4.19/afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch @@ -0,0 +1,46 @@ +From fd818b0aba8fa1211ee6dd88353de4adbf294968 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Tue, 30 Jul 2019 14:38:51 +0100 +Subject: afs: Only update d_fsdata if different in afs_d_revalidate() + +[ Upstream commit 5dc84855b0fc7e1db182b55c5564fd539d6eff92 ] + +In the in-kernel afs filesystem, d_fsdata is set with the data version of +the parent directory. afs_d_revalidate() will update this to the current +directory version, but it shouldn't do this if it the value it read from +d_fsdata is the same as no lock is held and cmpxchg() is not used. + +Fix the code to only change the value if it is different from the current +directory version. + +Fixes: 260a980317da ("[AFS]: Add "directory write" support.") +Signed-off-by: David Howells +Signed-off-by: Sasha Levin +--- + fs/afs/dir.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/afs/dir.c b/fs/afs/dir.c +index 855bf2b79fed4..54e7f6f1405e2 100644 +--- a/fs/afs/dir.c ++++ b/fs/afs/dir.c +@@ -937,7 +937,7 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags) + dir_version = (long)dir->status.data_version; + de_version = (long)dentry->d_fsdata; + if (de_version == dir_version) +- goto out_valid; ++ goto out_valid_noupdate; + + dir_version = (long)dir->invalid_before; + if (de_version - dir_version >= 0) +@@ -1001,6 +1001,7 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags) + + out_valid: + dentry->d_fsdata = (void *)dir_version; ++out_valid_noupdate: + dput(parent); + key_put(key); + _leave(" = 1 [valid]"); +-- +2.20.1 + diff --git a/queue-4.19/arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch b/queue-4.19/arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch new file mode 100644 index 00000000000..65e486d093c --- /dev/null +++ b/queue-4.19/arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch @@ -0,0 +1,66 @@ +From 73974176562a0085b38c78fc6bc1817ff91691dc Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Mon, 12 Aug 2019 16:02:25 +0100 +Subject: arm64: cpufeature: Don't treat granule sizes as strict + +[ Upstream commit 5717fe5ab38f9ccb32718bcb03bea68409c9cce4 ] + +If a CPU doesn't support the page size for which the kernel is +configured, then we will complain and refuse to bring it online. For +secondary CPUs (and the boot CPU on a system booting with EFI), we will +also print an error identifying the mismatch. + +Consequently, the only time that the cpufeature code can detect a +granule size mismatch is for a granule other than the one that is +currently being used. Although we would rather such systems didn't +exist, we've unfortunately lost that battle and Kevin reports that +on his amlogic S922X (odroid-n2 board) we end up warning and taining +with defconfig because 16k pages are not supported by all of the CPUs. + +In such a situation, we don't actually care about the feature mismatch, +particularly now that KVM only exposes the sanitised view of the CPU +registers (commit 93390c0a1b20 - "arm64: KVM: Hide unsupported AArch64 +CPU features from guests"). Treat the granule fields as non-strict and +let Kevin run without a tainted kernel. + +Cc: Marc Zyngier +Reported-by: Kevin Hilman +Tested-by: Kevin Hilman +Acked-by: Mark Rutland +Acked-by: Suzuki K Poulose +Signed-off-by: Will Deacon +[catalin.marinas@arm.com: changelog updated with KVM sanitised regs commit] +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/cpufeature.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c +index bce06083685dc..94babc3d0ec2c 100644 +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -165,9 +165,17 @@ static const struct arm64_ftr_bits ftr_id_aa64pfr0[] = { + }; + + static const struct arm64_ftr_bits ftr_id_aa64mmfr0[] = { +- S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN4_SHIFT, 4, ID_AA64MMFR0_TGRAN4_NI), +- S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN64_SHIFT, 4, ID_AA64MMFR0_TGRAN64_NI), +- ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN16_SHIFT, 4, ID_AA64MMFR0_TGRAN16_NI), ++ /* ++ * We already refuse to boot CPUs that don't support our configured ++ * page size, so we can only detect mismatches for a page size other ++ * than the one we're currently using. Unfortunately, SoCs like this ++ * exist in the wild so, even though we don't like it, we'll have to go ++ * along with it and treat them as non-strict. ++ */ ++ S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN4_SHIFT, 4, ID_AA64MMFR0_TGRAN4_NI), ++ S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN64_SHIFT, 4, ID_AA64MMFR0_TGRAN64_NI), ++ ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_TGRAN16_SHIFT, 4, ID_AA64MMFR0_TGRAN16_NI), ++ + ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_BIGENDEL0_SHIFT, 4, 0), + /* Linux shouldn't care about secure memory */ + ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR0_SNSMEM_SHIFT, 4, 0), +-- +2.20.1 + diff --git a/queue-4.19/auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch b/queue-4.19/auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch new file mode 100644 index 00000000000..2e166e9fdd6 --- /dev/null +++ b/queue-4.19/auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch @@ -0,0 +1,35 @@ +From c04ae16eaa2086639831b54826287fd8891c1b29 Mon Sep 17 00:00:00 2001 +From: zhengbin +Date: Mon, 8 Jul 2019 20:42:18 +0800 +Subject: auxdisplay: panel: need to delete scan_timer when misc_register fails + in panel_attach + +[ Upstream commit b33d567560c1aadf3033290d74d4fd67af47aa61 ] + +In panel_attach, if misc_register fails, we need to delete scan_timer, +which was setup in keypad_init->init_scan_timer. + +Reported-by: Hulk Robot +Signed-off-by: zhengbin +Signed-off-by: Miguel Ojeda +Signed-off-by: Sasha Levin +--- + drivers/auxdisplay/panel.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c +index 3b25a643058c9..0b8e2a7d6e934 100644 +--- a/drivers/auxdisplay/panel.c ++++ b/drivers/auxdisplay/panel.c +@@ -1618,6 +1618,8 @@ static void panel_attach(struct parport *port) + return; + + err_lcd_unreg: ++ if (scan_timer.function) ++ del_timer_sync(&scan_timer); + if (lcd.enabled) + charlcd_unregister(lcd.charlcd); + err_unreg_device: +-- +2.20.1 + diff --git a/queue-4.19/dmaengine-ste_dma40-fix-unneeded-variable-warning.patch b/queue-4.19/dmaengine-ste_dma40-fix-unneeded-variable-warning.patch new file mode 100644 index 00000000000..d63dcc2bbfa --- /dev/null +++ b/queue-4.19/dmaengine-ste_dma40-fix-unneeded-variable-warning.patch @@ -0,0 +1,54 @@ +From 90dae3c6ee479efc3d6af0da31e0ad7f64983ef0 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Fri, 12 Jul 2019 11:13:30 +0200 +Subject: dmaengine: ste_dma40: fix unneeded variable warning + +[ Upstream commit 5d6fb560729a5d5554e23db8d00eb57cd0021083 ] + +clang-9 points out that there are two variables that depending on the +configuration may only be used in an ARRAY_SIZE() expression but not +referenced: + +drivers/dma/ste_dma40.c:145:12: error: variable 'd40_backup_regs' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration] +static u32 d40_backup_regs[] = { + ^ +drivers/dma/ste_dma40.c:214:12: error: variable 'd40_backup_regs_chan' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration] +static u32 d40_backup_regs_chan[] = { + +Mark these __maybe_unused to shut up the warning. + +Signed-off-by: Arnd Bergmann +Reviewed-by: Nathan Chancellor +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20190712091357.744515-1-arnd@arndb.de +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ste_dma40.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c +index f4edfc56f34ef..3d55405c49cac 100644 +--- a/drivers/dma/ste_dma40.c ++++ b/drivers/dma/ste_dma40.c +@@ -142,7 +142,7 @@ enum d40_events { + * when the DMA hw is powered off. + * TODO: Add save/restore of D40_DREG_GCC on dma40 v3 or later, if that works. + */ +-static u32 d40_backup_regs[] = { ++static __maybe_unused u32 d40_backup_regs[] = { + D40_DREG_LCPA, + D40_DREG_LCLA, + D40_DREG_PRMSE, +@@ -211,7 +211,7 @@ static u32 d40_backup_regs_v4b[] = { + + #define BACKUP_REGS_SZ_V4B ARRAY_SIZE(d40_backup_regs_v4b) + +-static u32 d40_backup_regs_chan[] = { ++static __maybe_unused u32 d40_backup_regs_chan[] = { + D40_CHAN_REG_SSCFG, + D40_CHAN_REG_SSELT, + D40_CHAN_REG_SSPTR, +-- +2.20.1 + diff --git a/queue-4.19/dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch b/queue-4.19/dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch new file mode 100644 index 00000000000..7a9bda409ba --- /dev/null +++ b/queue-4.19/dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch @@ -0,0 +1,41 @@ +From 584cc8700a538bbb6deb813077fc76052aa8d1ce Mon Sep 17 00:00:00 2001 +From: Jia-Ju Bai +Date: Mon, 29 Jul 2019 10:08:49 +0800 +Subject: dmaengine: stm32-mdma: Fix a possible null-pointer dereference in + stm32_mdma_irq_handler() + +[ Upstream commit 39c71a5b8212f4b502d9a630c6706ac723abd422 ] + +In stm32_mdma_irq_handler(), chan is checked on line 1368. +When chan is NULL, it is still used on line 1369: + dev_err(chan2dev(chan), "MDMA channel not initialized\n"); + +Thus, a possible null-pointer dereference may occur. + +To fix this bug, "dev_dbg(mdma2dev(dmadev), ...)" is used instead. + +Signed-off-by: Jia-Ju Bai +Fixes: a4ffb13c8946 ("dmaengine: Add STM32 MDMA driver") +Link: https://lore.kernel.org/r/20190729020849.17971-1-baijiaju1990@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/stm32-mdma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c +index 06dd1725375e5..8c3c3e5b812a8 100644 +--- a/drivers/dma/stm32-mdma.c ++++ b/drivers/dma/stm32-mdma.c +@@ -1376,7 +1376,7 @@ static irqreturn_t stm32_mdma_irq_handler(int irq, void *devid) + + chan = &dmadev->chan[id]; + if (!chan) { +- dev_err(chan2dev(chan), "MDMA channel not initialized\n"); ++ dev_dbg(mdma2dev(dmadev), "MDMA channel not initialized\n"); + goto exit; + } + +-- +2.20.1 + diff --git a/queue-4.19/drm-ast-fixed-reboot-test-may-cause-system-hanged.patch b/queue-4.19/drm-ast-fixed-reboot-test-may-cause-system-hanged.patch new file mode 100644 index 00000000000..f414e5f34cb --- /dev/null +++ b/queue-4.19/drm-ast-fixed-reboot-test-may-cause-system-hanged.patch @@ -0,0 +1,74 @@ +From 193d1f943595c85c7ea7898409e786cd21209cab Mon Sep 17 00:00:00 2001 +From: "Y.C. Chen" +Date: Wed, 11 Apr 2018 09:27:39 +0800 +Subject: drm/ast: Fixed reboot test may cause system hanged + +[ Upstream commit 05b439711f6ff8700e8660f97a1179650778b9cb ] + +There is another thread still access standard VGA I/O while loading drm driver. +Disable standard VGA I/O decode to avoid this issue. + +Signed-off-by: Y.C. Chen +Reviewed-by: Benjamin Herrenschmidt +Signed-off-by: Dave Airlie +Link: https://patchwork.freedesktop.org/patch/msgid/1523410059-18415-1-git-send-email-yc_chen@aspeedtech.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ast/ast_main.c | 5 ++++- + drivers/gpu/drm/ast/ast_mode.c | 2 +- + drivers/gpu/drm/ast/ast_post.c | 2 +- + 3 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c +index 373700c05a00f..224fa1ef87ff9 100644 +--- a/drivers/gpu/drm/ast/ast_main.c ++++ b/drivers/gpu/drm/ast/ast_main.c +@@ -131,8 +131,8 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post) + + + /* Enable extended register access */ +- ast_enable_mmio(dev); + ast_open_key(ast); ++ ast_enable_mmio(dev); + + /* Find out whether P2A works or whether to use device-tree */ + ast_detect_config_mode(dev, &scu_rev); +@@ -576,6 +576,9 @@ void ast_driver_unload(struct drm_device *dev) + { + struct ast_private *ast = dev->dev_private; + ++ /* enable standard VGA decode */ ++ ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x04); ++ + ast_release_firmware(dev); + kfree(ast->dp501_fw_addr); + ast_mode_fini(dev); +diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c +index 8bb355d5d43d8..9d92d2d2fcfc7 100644 +--- a/drivers/gpu/drm/ast/ast_mode.c ++++ b/drivers/gpu/drm/ast/ast_mode.c +@@ -600,7 +600,7 @@ static int ast_crtc_mode_set(struct drm_crtc *crtc, + return -EINVAL; + ast_open_key(ast); + +- ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa1, 0xff, 0x04); ++ ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x06); + + ast_set_std_reg(crtc, adjusted_mode, &vbios_mode); + ast_set_crtc_reg(crtc, adjusted_mode, &vbios_mode); +diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c +index f7d421359d564..c1d1ac51d1c20 100644 +--- a/drivers/gpu/drm/ast/ast_post.c ++++ b/drivers/gpu/drm/ast/ast_post.c +@@ -46,7 +46,7 @@ void ast_enable_mmio(struct drm_device *dev) + { + struct ast_private *ast = dev->dev_private; + +- ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa1, 0xff, 0x04); ++ ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x06); + } + + +-- +2.20.1 + diff --git a/queue-4.19/drm-bridge-tfp410-fix-memleak-in-get_modes.patch b/queue-4.19/drm-bridge-tfp410-fix-memleak-in-get_modes.patch new file mode 100644 index 00000000000..0390d23aee6 --- /dev/null +++ b/queue-4.19/drm-bridge-tfp410-fix-memleak-in-get_modes.patch @@ -0,0 +1,40 @@ +From 4b766a79d3a24d8b94e33511643ac43dfe2fd475 Mon Sep 17 00:00:00 2001 +From: Tomi Valkeinen +Date: Mon, 10 Jun 2019 16:57:38 +0300 +Subject: drm/bridge: tfp410: fix memleak in get_modes() + +[ Upstream commit c08f99c39083ab55a9c93b3e93cef48711294dad ] + +We don't free the edid blob allocated by the call to drm_get_edid(), +causing a memleak. Fix this by calling kfree(edid) at the end of the +get_modes(). + +Signed-off-by: Tomi Valkeinen +Signed-off-by: Andrzej Hajda +Link: https://patchwork.freedesktop.org/patch/msgid/20190610135739.6077-1-tomi.valkeinen@ti.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-tfp410.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/ti-tfp410.c b/drivers/gpu/drm/bridge/ti-tfp410.c +index c3e32138c6bb0..9dc109df0808c 100644 +--- a/drivers/gpu/drm/bridge/ti-tfp410.c ++++ b/drivers/gpu/drm/bridge/ti-tfp410.c +@@ -64,7 +64,12 @@ static int tfp410_get_modes(struct drm_connector *connector) + + drm_connector_update_edid_property(connector, edid); + +- return drm_add_edid_modes(connector, edid); ++ ret = drm_add_edid_modes(connector, edid); ++ ++ kfree(edid); ++ ++ return ret; ++ + fallback: + /* No EDID, fallback on the XGA standard modes */ + ret = drm_add_modes_noedid(connector, 1920, 1200); +-- +2.20.1 + diff --git a/queue-4.19/drm-i915-fix-broadwell-eu-computation.patch b/queue-4.19/drm-i915-fix-broadwell-eu-computation.patch new file mode 100644 index 00000000000..f0f747d15e3 --- /dev/null +++ b/queue-4.19/drm-i915-fix-broadwell-eu-computation.patch @@ -0,0 +1,36 @@ +From 0ed0cc9921be280b94c58bd77c15a21c1e23fa8e Mon Sep 17 00:00:00 2001 +From: Lionel Landwerlin +Date: Mon, 12 Nov 2018 12:39:31 +0000 +Subject: drm/i915: fix broadwell EU computation + +[ Upstream commit 63ac3328f0d1d37f286e397b14d9596ed09d7ca5 ] + +subslice_mask is an array indexed by slice, not subslice. + +Signed-off-by: Lionel Landwerlin +Fixes: 8cc7669355136f ("drm/i915: store all subslice masks") +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108712 +Reviewed-by: Chris Wilson +Reviewed-by: Tvrtko Ursulin +Link: https://patchwork.freedesktop.org/patch/msgid/20181112123931.2815-1-lionel.g.landwerlin@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/intel_device_info.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/intel_device_info.c b/drivers/gpu/drm/i915/intel_device_info.c +index 0ef0c6448d53a..01fa98299bae6 100644 +--- a/drivers/gpu/drm/i915/intel_device_info.c ++++ b/drivers/gpu/drm/i915/intel_device_info.c +@@ -474,7 +474,7 @@ static void broadwell_sseu_info_init(struct drm_i915_private *dev_priv) + u8 eu_disabled_mask; + u32 n_disabled; + +- if (!(sseu->subslice_mask[ss] & BIT(ss))) ++ if (!(sseu->subslice_mask[s] & BIT(ss))) + /* skip disabled subslice */ + continue; + +-- +2.20.1 + diff --git a/queue-4.19/drm-tilcdc-register-cpufreq-notifier-after-we-have-i.patch b/queue-4.19/drm-tilcdc-register-cpufreq-notifier-after-we-have-i.patch new file mode 100644 index 00000000000..5869ce7e6d4 --- /dev/null +++ b/queue-4.19/drm-tilcdc-register-cpufreq-notifier-after-we-have-i.patch @@ -0,0 +1,87 @@ +From d7b40ae7640263fd0c28433e112325d262b20c27 Mon Sep 17 00:00:00 2001 +From: Jyri Sarha +Date: Wed, 12 Dec 2018 19:26:32 +0200 +Subject: drm/tilcdc: Register cpufreq notifier after we have initialized crtc + +[ Upstream commit 432973fd3a20102840d5f7e61af9f1a03c217a4c ] + +Register cpufreq notifier after we have initialized the crtc and +unregister it before we remove the ctrc. Receiving a cpufreq notify +without crtc causes a crash. + +Reported-by: Peter Ujfalusi +Signed-off-by: Jyri Sarha +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tilcdc/tilcdc_drv.c | 34 ++++++++++++++--------------- + 1 file changed, 17 insertions(+), 17 deletions(-) + +diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c +index 0fb300d41a09c..e1868776da252 100644 +--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c ++++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c +@@ -184,6 +184,12 @@ static void tilcdc_fini(struct drm_device *dev) + { + struct tilcdc_drm_private *priv = dev->dev_private; + ++#ifdef CONFIG_CPU_FREQ ++ if (priv->freq_transition.notifier_call) ++ cpufreq_unregister_notifier(&priv->freq_transition, ++ CPUFREQ_TRANSITION_NOTIFIER); ++#endif ++ + if (priv->crtc) + tilcdc_crtc_shutdown(priv->crtc); + +@@ -198,12 +204,6 @@ static void tilcdc_fini(struct drm_device *dev) + drm_mode_config_cleanup(dev); + tilcdc_remove_external_device(dev); + +-#ifdef CONFIG_CPU_FREQ +- if (priv->freq_transition.notifier_call) +- cpufreq_unregister_notifier(&priv->freq_transition, +- CPUFREQ_TRANSITION_NOTIFIER); +-#endif +- + if (priv->clk) + clk_put(priv->clk); + +@@ -274,17 +274,6 @@ static int tilcdc_init(struct drm_driver *ddrv, struct device *dev) + goto init_failed; + } + +-#ifdef CONFIG_CPU_FREQ +- priv->freq_transition.notifier_call = cpufreq_transition; +- ret = cpufreq_register_notifier(&priv->freq_transition, +- CPUFREQ_TRANSITION_NOTIFIER); +- if (ret) { +- dev_err(dev, "failed to register cpufreq notifier\n"); +- priv->freq_transition.notifier_call = NULL; +- goto init_failed; +- } +-#endif +- + if (of_property_read_u32(node, "max-bandwidth", &priv->max_bandwidth)) + priv->max_bandwidth = TILCDC_DEFAULT_MAX_BANDWIDTH; + +@@ -361,6 +350,17 @@ static int tilcdc_init(struct drm_driver *ddrv, struct device *dev) + } + modeset_init(ddev); + ++#ifdef CONFIG_CPU_FREQ ++ priv->freq_transition.notifier_call = cpufreq_transition; ++ ret = cpufreq_register_notifier(&priv->freq_transition, ++ CPUFREQ_TRANSITION_NOTIFIER); ++ if (ret) { ++ dev_err(dev, "failed to register cpufreq notifier\n"); ++ priv->freq_transition.notifier_call = NULL; ++ goto init_failed; ++ } ++#endif ++ + if (priv->is_componentized) { + ret = component_bind_all(dev, ddev); + if (ret < 0) +-- +2.20.1 + diff --git a/queue-4.19/fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch b/queue-4.19/fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch new file mode 100644 index 00000000000..14b5e151e04 --- /dev/null +++ b/queue-4.19/fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch @@ -0,0 +1,55 @@ +From d4d7e2d9631ed3c579ca4813437a2fec4ae61a13 Mon Sep 17 00:00:00 2001 +From: Jia-Ju Bai +Date: Tue, 30 Jul 2019 14:38:51 +0100 +Subject: fs: afs: Fix a possible null-pointer dereference in afs_put_read() + +[ Upstream commit a6eed4ab5dd4bfb696c1a3f49742b8d1846a66a0 ] + +In afs_read_dir(), there is an if statement on line 255 to check whether +req->pages is NULL: + if (!req->pages) + goto error; + +If req->pages is NULL, afs_put_read() on line 337 is executed. +In afs_put_read(), req->pages[i] is used on line 195. +Thus, a possible null-pointer dereference may occur in this case. + +To fix this possible bug, an if statement is added in afs_put_read() to +check req->pages. + +This bug is found by a static analysis tool STCheck written by us. + +Fixes: f3ddee8dc4e2 ("afs: Fix directory handling") +Signed-off-by: Jia-Ju Bai +Signed-off-by: David Howells +Signed-off-by: Sasha Levin +--- + fs/afs/file.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/fs/afs/file.c b/fs/afs/file.c +index 7d4f26198573d..843d3b970b845 100644 +--- a/fs/afs/file.c ++++ b/fs/afs/file.c +@@ -193,11 +193,13 @@ void afs_put_read(struct afs_read *req) + int i; + + if (refcount_dec_and_test(&req->usage)) { +- for (i = 0; i < req->nr_pages; i++) +- if (req->pages[i]) +- put_page(req->pages[i]); +- if (req->pages != req->array) +- kfree(req->pages); ++ if (req->pages) { ++ for (i = 0; i < req->nr_pages; i++) ++ if (req->pages[i]) ++ put_page(req->pages[i]); ++ if (req->pages != req->array) ++ kfree(req->pages); ++ } + kfree(req); + } + } +-- +2.20.1 + diff --git a/queue-4.19/i2c-emev2-avoid-race-when-unregistering-slave-client.patch b/queue-4.19/i2c-emev2-avoid-race-when-unregistering-slave-client.patch new file mode 100644 index 00000000000..83c8f4052c5 --- /dev/null +++ b/queue-4.19/i2c-emev2-avoid-race-when-unregistering-slave-client.patch @@ -0,0 +1,78 @@ +From e126f799564f9ecf38710d17ba0ffc2372b7b471 Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Thu, 8 Aug 2019 21:54:17 +0200 +Subject: i2c: emev2: avoid race when unregistering slave client + +[ Upstream commit d7437fc0d8291181debe032671a289b6bd93f46f ] + +After we disabled interrupts, there might still be an active one +running. Sync before clearing the pointer to the slave device. + +Fixes: c31d0a00021d ("i2c: emev2: add slave support") +Reported-by: Krzysztof Adamski +Signed-off-by: Wolfram Sang +Reviewed-by: Krzysztof Adamski +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-emev2.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-emev2.c b/drivers/i2c/busses/i2c-emev2.c +index 35b302d983e0d..959d4912ec0d5 100644 +--- a/drivers/i2c/busses/i2c-emev2.c ++++ b/drivers/i2c/busses/i2c-emev2.c +@@ -69,6 +69,7 @@ struct em_i2c_device { + struct completion msg_done; + struct clk *sclk; + struct i2c_client *slave; ++ int irq; + }; + + static inline void em_clear_set_bit(struct em_i2c_device *priv, u8 clear, u8 set, u8 reg) +@@ -339,6 +340,12 @@ static int em_i2c_unreg_slave(struct i2c_client *slave) + + writeb(0, priv->base + I2C_OFS_SVA0); + ++ /* ++ * Wait for interrupt to finish. New slave irqs cannot happen because we ++ * cleared the slave address and, thus, only extension codes will be ++ * detected which do not use the slave ptr. ++ */ ++ synchronize_irq(priv->irq); + priv->slave = NULL; + + return 0; +@@ -355,7 +362,7 @@ static int em_i2c_probe(struct platform_device *pdev) + { + struct em_i2c_device *priv; + struct resource *r; +- int irq, ret; ++ int ret; + + priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL); + if (!priv) +@@ -390,8 +397,8 @@ static int em_i2c_probe(struct platform_device *pdev) + + em_i2c_reset(&priv->adap); + +- irq = platform_get_irq(pdev, 0); +- ret = devm_request_irq(&pdev->dev, irq, em_i2c_irq_handler, 0, ++ priv->irq = platform_get_irq(pdev, 0); ++ ret = devm_request_irq(&pdev->dev, priv->irq, em_i2c_irq_handler, 0, + "em_i2c", priv); + if (ret) + goto err_clk; +@@ -401,7 +408,8 @@ static int em_i2c_probe(struct platform_device *pdev) + if (ret) + goto err_clk; + +- dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr, irq); ++ dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr, ++ priv->irq); + + return 0; + +-- +2.20.1 + diff --git a/queue-4.19/i2c-rcar-avoid-race-when-unregistering-slave-client.patch b/queue-4.19/i2c-rcar-avoid-race-when-unregistering-slave-client.patch new file mode 100644 index 00000000000..c8f5c8ac363 --- /dev/null +++ b/queue-4.19/i2c-rcar-avoid-race-when-unregistering-slave-client.patch @@ -0,0 +1,70 @@ +From 630c9e8e4dc24ef2d36f1f7c9720df8112fffd93 Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Thu, 8 Aug 2019 21:39:10 +0200 +Subject: i2c: rcar: avoid race when unregistering slave client + +[ Upstream commit 7b814d852af6944657c2961039f404c4490771c0 ] + +After we disabled interrupts, there might still be an active one +running. Sync before clearing the pointer to the slave device. + +Fixes: de20d1857dd6 ("i2c: rcar: add slave support") +Reported-by: Krzysztof Adamski +Signed-off-by: Wolfram Sang +Reviewed-by: Krzysztof Adamski +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rcar.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index 254e6219e5389..2c29f901d3090 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -139,6 +139,7 @@ struct rcar_i2c_priv { + enum dma_data_direction dma_direction; + + struct reset_control *rstc; ++ int irq; + }; + + #define rcar_i2c_priv_to_dev(p) ((p)->adap.dev.parent) +@@ -859,9 +860,11 @@ static int rcar_unreg_slave(struct i2c_client *slave) + + WARN_ON(!priv->slave); + ++ /* disable irqs and ensure none is running before clearing ptr */ + rcar_i2c_write(priv, ICSIER, 0); + rcar_i2c_write(priv, ICSCR, 0); + ++ synchronize_irq(priv->irq); + priv->slave = NULL; + + pm_runtime_put(rcar_i2c_priv_to_dev(priv)); +@@ -916,7 +919,7 @@ static int rcar_i2c_probe(struct platform_device *pdev) + struct i2c_adapter *adap; + struct device *dev = &pdev->dev; + struct i2c_timings i2c_t; +- int irq, ret; ++ int ret; + + priv = devm_kzalloc(dev, sizeof(struct rcar_i2c_priv), GFP_KERNEL); + if (!priv) +@@ -979,10 +982,10 @@ static int rcar_i2c_probe(struct platform_device *pdev) + pm_runtime_put(dev); + + +- irq = platform_get_irq(pdev, 0); +- ret = devm_request_irq(dev, irq, rcar_i2c_irq, 0, dev_name(dev), priv); ++ priv->irq = platform_get_irq(pdev, 0); ++ ret = devm_request_irq(dev, priv->irq, rcar_i2c_irq, 0, dev_name(dev), priv); + if (ret < 0) { +- dev_err(dev, "cannot get irq %d\n", irq); ++ dev_err(dev, "cannot get irq %d\n", priv->irq); + goto out_pm_disable; + } + +-- +2.20.1 + diff --git a/queue-4.19/iommu-dma-handle-sg-length-overflow-better.patch b/queue-4.19/iommu-dma-handle-sg-length-overflow-better.patch new file mode 100644 index 00000000000..89d045b0781 --- /dev/null +++ b/queue-4.19/iommu-dma-handle-sg-length-overflow-better.patch @@ -0,0 +1,45 @@ +From da09aac25bf6ae4c405dbe16e816d34276049081 Mon Sep 17 00:00:00 2001 +From: Robin Murphy +Date: Mon, 29 Jul 2019 17:46:00 +0100 +Subject: iommu/dma: Handle SG length overflow better + +[ Upstream commit ab2cbeb0ed301a9f0460078e91b09f39958212ef ] + +Since scatterlist dimensions are all unsigned ints, in the relatively +rare cases where a device's max_segment_size is set to UINT_MAX, then +the "cur_len + s_length <= max_len" check in __finalise_sg() will always +return true. As a result, the corner case of such a device mapping an +excessively large scatterlist which is mergeable to or beyond a total +length of 4GB can lead to overflow and a bogus truncated dma_length in +the resulting segment. + +As we already assume that any single segment must be no longer than +max_len to begin with, this can easily be addressed by reshuffling the +comparison. + +Fixes: 809eac54cdd6 ("iommu/dma: Implement scatterlist segment merging") +Reported-by: Nicolin Chen +Tested-by: Nicolin Chen +Signed-off-by: Robin Murphy +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/dma-iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c +index 511ff9a1d6d94..f9dbb064f9571 100644 +--- a/drivers/iommu/dma-iommu.c ++++ b/drivers/iommu/dma-iommu.c +@@ -675,7 +675,7 @@ static int __finalise_sg(struct device *dev, struct scatterlist *sg, int nents, + * - and wouldn't make the resulting output segment too long + */ + if (cur_len && !s_iova_off && (dma_addr & seg_mask) && +- (cur_len + s_length <= max_len)) { ++ (max_len - cur_len >= s_length)) { + /* ...then concatenate it with the previous one */ + cur_len += s_length; + } else { +-- +2.20.1 + diff --git a/queue-4.19/nvme-fix-a-possible-deadlock-when-passthru-commands-.patch b/queue-4.19/nvme-fix-a-possible-deadlock-when-passthru-commands-.patch new file mode 100644 index 00000000000..f0c424e764c --- /dev/null +++ b/queue-4.19/nvme-fix-a-possible-deadlock-when-passthru-commands-.patch @@ -0,0 +1,209 @@ +From f5144fac683ca92285c21b59c5eaddd101c57ba5 Mon Sep 17 00:00:00 2001 +From: Sagi Grimberg +Date: Wed, 31 Jul 2019 11:00:26 -0700 +Subject: nvme: fix a possible deadlock when passthru commands sent to a + multipath device + +[ Upstream commit b9156daeb1601d69007b7e50efcf89d69d72ec1d ] + +When the user issues a command with side effects, we will end up freezing +the namespace request queue when updating disk info (and the same for +the corresponding mpath disk node). + +However, we are not freezing the mpath node request queue, +which means that mpath I/O can still come in and block on blk_queue_enter +(called from nvme_ns_head_make_request -> direct_make_request). + +This is a deadlock, because blk_queue_enter will block until the inner +namespace request queue is unfroze, but that process is blocked because +the namespace revalidation is trying to update the mpath disk info +and freeze its request queue (which will never complete because +of the I/O that is blocked on blk_queue_enter). + +Fix this by freezing all the subsystem nsheads request queues before +executing the passthru command. Given that these commands are infrequent +we should not worry about this temporary I/O freeze to keep things sane. + +Here is the matching hang traces: +-- +[ 374.465002] INFO: task systemd-udevd:17994 blocked for more than 122 seconds. +[ 374.472975] Not tainted 5.2.0-rc3-mpdebug+ #42 +[ 374.478522] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 374.487274] systemd-udevd D 0 17994 1 0x00000000 +[ 374.493407] Call Trace: +[ 374.496145] __schedule+0x2ef/0x620 +[ 374.500047] schedule+0x38/0xa0 +[ 374.503569] blk_queue_enter+0x139/0x220 +[ 374.507959] ? remove_wait_queue+0x60/0x60 +[ 374.512540] direct_make_request+0x60/0x130 +[ 374.517219] nvme_ns_head_make_request+0x11d/0x420 [nvme_core] +[ 374.523740] ? generic_make_request_checks+0x307/0x6f0 +[ 374.529484] generic_make_request+0x10d/0x2e0 +[ 374.534356] submit_bio+0x75/0x140 +[ 374.538163] ? guard_bio_eod+0x32/0xe0 +[ 374.542361] submit_bh_wbc+0x171/0x1b0 +[ 374.546553] block_read_full_page+0x1ed/0x330 +[ 374.551426] ? check_disk_change+0x70/0x70 +[ 374.556008] ? scan_shadow_nodes+0x30/0x30 +[ 374.560588] blkdev_readpage+0x18/0x20 +[ 374.564783] do_read_cache_page+0x301/0x860 +[ 374.569463] ? blkdev_writepages+0x10/0x10 +[ 374.574037] ? prep_new_page+0x88/0x130 +[ 374.578329] ? get_page_from_freelist+0xa2f/0x1280 +[ 374.583688] ? __alloc_pages_nodemask+0x179/0x320 +[ 374.588947] read_cache_page+0x12/0x20 +[ 374.593142] read_dev_sector+0x2d/0xd0 +[ 374.597337] read_lba+0x104/0x1f0 +[ 374.601046] find_valid_gpt+0xfa/0x720 +[ 374.605243] ? string_nocheck+0x58/0x70 +[ 374.609534] ? find_valid_gpt+0x720/0x720 +[ 374.614016] efi_partition+0x89/0x430 +[ 374.618113] ? string+0x48/0x60 +[ 374.621632] ? snprintf+0x49/0x70 +[ 374.625339] ? find_valid_gpt+0x720/0x720 +[ 374.629828] check_partition+0x116/0x210 +[ 374.634214] rescan_partitions+0xb6/0x360 +[ 374.638699] __blkdev_reread_part+0x64/0x70 +[ 374.643377] blkdev_reread_part+0x23/0x40 +[ 374.647860] blkdev_ioctl+0x48c/0x990 +[ 374.651956] block_ioctl+0x41/0x50 +[ 374.655766] do_vfs_ioctl+0xa7/0x600 +[ 374.659766] ? locks_lock_inode_wait+0xb1/0x150 +[ 374.664832] ksys_ioctl+0x67/0x90 +[ 374.668539] __x64_sys_ioctl+0x1a/0x20 +[ 374.672732] do_syscall_64+0x5a/0x1c0 +[ 374.676828] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +[ 374.738474] INFO: task nvmeadm:49141 blocked for more than 123 seconds. +[ 374.745871] Not tainted 5.2.0-rc3-mpdebug+ #42 +[ 374.751419] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 374.760170] nvmeadm D 0 49141 36333 0x00004080 +[ 374.766301] Call Trace: +[ 374.769038] __schedule+0x2ef/0x620 +[ 374.772939] schedule+0x38/0xa0 +[ 374.776452] blk_mq_freeze_queue_wait+0x59/0x100 +[ 374.781614] ? remove_wait_queue+0x60/0x60 +[ 374.786192] blk_mq_freeze_queue+0x1a/0x20 +[ 374.790773] nvme_update_disk_info.isra.57+0x5f/0x350 [nvme_core] +[ 374.797582] ? nvme_identify_ns.isra.50+0x71/0xc0 [nvme_core] +[ 374.804006] __nvme_revalidate_disk+0xe5/0x110 [nvme_core] +[ 374.810139] nvme_revalidate_disk+0xa6/0x120 [nvme_core] +[ 374.816078] ? nvme_submit_user_cmd+0x11e/0x320 [nvme_core] +[ 374.822299] nvme_user_cmd+0x264/0x370 [nvme_core] +[ 374.827661] nvme_dev_ioctl+0x112/0x1d0 [nvme_core] +[ 374.833114] do_vfs_ioctl+0xa7/0x600 +[ 374.837117] ? __audit_syscall_entry+0xdd/0x130 +[ 374.842184] ksys_ioctl+0x67/0x90 +[ 374.845891] __x64_sys_ioctl+0x1a/0x20 +[ 374.850082] do_syscall_64+0x5a/0x1c0 +[ 374.854178] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +-- + +Reported-by: James Puthukattukaran +Tested-by: James Puthukattukaran +Reviewed-by: Keith Busch +Signed-off-by: Sagi Grimberg +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 5 +++++ + drivers/nvme/host/multipath.c | 30 ++++++++++++++++++++++++++++++ + drivers/nvme/host/nvme.h | 12 ++++++++++++ + 3 files changed, 47 insertions(+) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index d838a300ae770..ae0b01059fc6d 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1183,6 +1183,9 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns, + */ + if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) { + mutex_lock(&ctrl->scan_lock); ++ mutex_lock(&ctrl->subsys->lock); ++ nvme_mpath_start_freeze(ctrl->subsys); ++ nvme_mpath_wait_freeze(ctrl->subsys); + nvme_start_freeze(ctrl); + nvme_wait_freeze(ctrl); + } +@@ -1213,6 +1216,8 @@ static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects) + nvme_update_formats(ctrl); + if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) { + nvme_unfreeze(ctrl); ++ nvme_mpath_unfreeze(ctrl->subsys); ++ mutex_unlock(&ctrl->subsys->lock); + mutex_unlock(&ctrl->scan_lock); + } + if (effects & NVME_CMD_EFFECTS_CCC) +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index a11e210d173e4..05d6371c7f385 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -20,6 +20,36 @@ module_param(multipath, bool, 0444); + MODULE_PARM_DESC(multipath, + "turn on native support for multiple controllers per subsystem"); + ++void nvme_mpath_unfreeze(struct nvme_subsystem *subsys) ++{ ++ struct nvme_ns_head *h; ++ ++ lockdep_assert_held(&subsys->lock); ++ list_for_each_entry(h, &subsys->nsheads, entry) ++ if (h->disk) ++ blk_mq_unfreeze_queue(h->disk->queue); ++} ++ ++void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys) ++{ ++ struct nvme_ns_head *h; ++ ++ lockdep_assert_held(&subsys->lock); ++ list_for_each_entry(h, &subsys->nsheads, entry) ++ if (h->disk) ++ blk_mq_freeze_queue_wait(h->disk->queue); ++} ++ ++void nvme_mpath_start_freeze(struct nvme_subsystem *subsys) ++{ ++ struct nvme_ns_head *h; ++ ++ lockdep_assert_held(&subsys->lock); ++ list_for_each_entry(h, &subsys->nsheads, entry) ++ if (h->disk) ++ blk_freeze_queue_start(h->disk->queue); ++} ++ + /* + * If multipathing is enabled we need to always use the subsystem instance + * number for numbering our devices to avoid conflicts between subsystems that +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index d5e29b57eb340..2653e1f4196d5 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -469,6 +469,9 @@ static inline bool nvme_ctrl_use_ana(struct nvme_ctrl *ctrl) + return ctrl->ana_log_buf != NULL; + } + ++void nvme_mpath_unfreeze(struct nvme_subsystem *subsys); ++void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys); ++void nvme_mpath_start_freeze(struct nvme_subsystem *subsys); + void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns, + struct nvme_ctrl *ctrl, int *flags); + void nvme_failover_req(struct request *req); +@@ -553,6 +556,15 @@ static inline void nvme_mpath_uninit(struct nvme_ctrl *ctrl) + static inline void nvme_mpath_stop(struct nvme_ctrl *ctrl) + { + } ++static inline void nvme_mpath_unfreeze(struct nvme_subsystem *subsys) ++{ ++} ++static inline void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys) ++{ ++} ++static inline void nvme_mpath_start_freeze(struct nvme_subsystem *subsys) ++{ ++} + #endif /* CONFIG_NVME_MULTIPATH */ + + #ifdef CONFIG_NVM +-- +2.20.1 + diff --git a/queue-4.19/nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch b/queue-4.19/nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch new file mode 100644 index 00000000000..4508f9d539e --- /dev/null +++ b/queue-4.19/nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch @@ -0,0 +1,45 @@ +From a6d6968665a7706b5adc7a1d696480cd8d3be609 Mon Sep 17 00:00:00 2001 +From: Anthony Iliopoulos +Date: Mon, 29 Jul 2019 14:40:40 +0200 +Subject: nvme-multipath: revalidate nvme_ns_head gendisk in nvme_validate_ns + +[ Upstream commit fab7772bfbcfe8fb8e3e352a6a8fcaf044cded17 ] + +When CONFIG_NVME_MULTIPATH is set, only the hidden gendisk associated +with the per-controller ns is run through revalidate_disk when a +rescan is triggered, while the visible blockdev never gets its size +(bdev->bd_inode->i_size) updated to reflect any capacity changes that +may have occurred. + +This prevents online resizing of nvme block devices and in extension of +any filesystems atop that will are unable to expand while mounted, as +userspace relies on the blockdev size for obtaining the disk capacity +(via BLKGETSIZE/64 ioctls). + +Fix this by explicitly revalidating the actual namespace gendisk in +addition to the per-controller gendisk, when multipath is enabled. + +Signed-off-by: Anthony Iliopoulos +Reviewed-by: Sagi Grimberg +Reviewed-by: Johannes Thumshirn +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index e26d1191c5ad6..d838a300ae770 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1557,6 +1557,7 @@ static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id) + if (ns->head->disk) { + nvme_update_disk_info(ns->head->disk, ns, id); + blk_queue_stack_limits(ns->head->disk->queue, ns->queue); ++ revalidate_disk(ns->head->disk); + } + #endif + } +-- +2.20.1 + diff --git a/queue-4.19/nvme-pci-fix-async-probe-remove-race.patch b/queue-4.19/nvme-pci-fix-async-probe-remove-race.patch new file mode 100644 index 00000000000..b5da9f22c8c --- /dev/null +++ b/queue-4.19/nvme-pci-fix-async-probe-remove-race.patch @@ -0,0 +1,45 @@ +From 18c4642d6bdc80ed0634dd5089461f8349873636 Mon Sep 17 00:00:00 2001 +From: Keith Busch +Date: Mon, 29 Jul 2019 16:34:52 -0600 +Subject: nvme-pci: Fix async probe remove race + +[ Upstream commit bd46a90634302bfe791e93ad5496f98f165f7ae0 ] + +Ensure the controller is not in the NEW state when nvme_probe() exits. +This will always allow a subsequent nvme_remove() to set the state to +DELETING, fixing a potential race between the initial asynchronous probe +and device removal. + +Reported-by: Li Zhong +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Sagi Grimberg +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 0a5d064f82ca3..a64a8bca0d5b9 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -2468,7 +2468,7 @@ static void nvme_async_probe(void *data, async_cookie_t cookie) + { + struct nvme_dev *dev = data; + +- nvme_reset_ctrl_sync(&dev->ctrl); ++ flush_work(&dev->ctrl.reset_work); + flush_work(&dev->ctrl.scan_work); + nvme_put_ctrl(&dev->ctrl); + } +@@ -2535,6 +2535,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + dev_info(dev->ctrl.device, "pci function %s\n", dev_name(&pdev->dev)); + ++ nvme_reset_ctrl(&dev->ctrl); + nvme_get_ctrl(&dev->ctrl); + async_schedule(nvme_async_probe, dev); + +-- +2.20.1 + diff --git a/queue-4.19/nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch b/queue-4.19/nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch new file mode 100644 index 00000000000..6c133f4846e --- /dev/null +++ b/queue-4.19/nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch @@ -0,0 +1,50 @@ +From 48d643606f01b17f3aa2f189338085af8b6509dc Mon Sep 17 00:00:00 2001 +From: Logan Gunthorpe +Date: Wed, 31 Jul 2019 17:35:32 -0600 +Subject: nvmet-loop: Flush nvme_delete_wq when removing the port + +[ Upstream commit 86b9a63e595ff03f9d0a7b92b6acc231fecefc29 ] + +After calling nvme_loop_delete_ctrl(), the controllers will not +yet be deleted because nvme_delete_ctrl() only schedules work +to do the delete. + +This means a race can occur if a port is removed but there +are still active controllers trying to access that memory. + +To fix this, flush the nvme_delete_wq before returning from +nvme_loop_remove_port() so that any controllers that might +be in the process of being deleted won't access a freed port. + +Signed-off-by: Logan Gunthorpe +Reviewed-by: Sagi Grimberg +Reviewed-by: Max Gurtovoy +Reviewed-by : Chaitanya Kulkarni +Signed-off-by: Sagi Grimberg +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/loop.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c +index 9908082b32c4b..137a27fa369cb 100644 +--- a/drivers/nvme/target/loop.c ++++ b/drivers/nvme/target/loop.c +@@ -678,6 +678,14 @@ static void nvme_loop_remove_port(struct nvmet_port *port) + mutex_lock(&nvme_loop_ports_mutex); + list_del_init(&port->entry); + mutex_unlock(&nvme_loop_ports_mutex); ++ ++ /* ++ * Ensure any ctrls that are in the process of being ++ * deleted are in fact deleted before we return ++ * and free the port. This is to prevent active ++ * ctrls from using a port after it's freed. ++ */ ++ flush_workqueue(nvme_delete_wq); + } + + static const struct nvmet_fabrics_ops nvme_loop_ops = { +-- +2.20.1 + diff --git a/queue-4.19/omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch b/queue-4.19/omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch new file mode 100644 index 00000000000..cee94a8917c --- /dev/null +++ b/queue-4.19/omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch @@ -0,0 +1,78 @@ +From 7848d898b2b6ff61606a449dd6f27abf09383ef4 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Fri, 9 Aug 2019 10:32:40 +0200 +Subject: omap-dma/omap_vout_vrfb: fix off-by-one fi value + +[ Upstream commit d555c34338cae844b207564c482e5a3fb089d25e ] + +The OMAP 4 TRM specifies that when using double-index addressing +the address increases by the ES plus the EI value minus 1 within +a frame. When a full frame is transferred, the address increases +by the ES plus the frame index (FI) value minus 1. + +The omap-dma code didn't account for the 'minus 1' in the FI register. +To get correct addressing, add 1 to the src_icg value. + +This was found when testing a hacked version of the media m2m-deinterlace.c +driver on a Pandaboard. + +The only other source that uses this feature is omap_vout_vrfb.c, +and that adds a + 1 when setting the dst_icg. This is a workaround +for the broken omap-dma.c behavior. So remove the workaround at the +same time that we fix omap-dma.c. + +I tested the omap_vout driver with a Beagle XM board to check that +the '+ 1' in omap_vout_vrfb.c was indeed a workaround for the omap-dma +bug. + +Signed-off-by: Hans Verkuil +Reviewed-by: Laurent Pinchart +Acked-by: Peter Ujfalusi +Acked-by: Mauro Carvalho Chehab +Link: https://lore.kernel.org/r/952e7f51-f208-9333-6f58-b7ed20d2ea0b@xs4all.nl +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/omap-dma.c | 4 ++-- + drivers/media/platform/omap/omap_vout_vrfb.c | 3 +-- + 2 files changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c +index a4a931ddf6f69..aeb9c29e52554 100644 +--- a/drivers/dma/ti/omap-dma.c ++++ b/drivers/dma/ti/omap-dma.c +@@ -1237,7 +1237,7 @@ static struct dma_async_tx_descriptor *omap_dma_prep_dma_interleaved( + if (src_icg) { + d->ccr |= CCR_SRC_AMODE_DBLIDX; + d->ei = 1; +- d->fi = src_icg; ++ d->fi = src_icg + 1; + } else if (xt->src_inc) { + d->ccr |= CCR_SRC_AMODE_POSTINC; + d->fi = 0; +@@ -1252,7 +1252,7 @@ static struct dma_async_tx_descriptor *omap_dma_prep_dma_interleaved( + if (dst_icg) { + d->ccr |= CCR_DST_AMODE_DBLIDX; + sg->ei = 1; +- sg->fi = dst_icg; ++ sg->fi = dst_icg + 1; + } else if (xt->dst_inc) { + d->ccr |= CCR_DST_AMODE_POSTINC; + sg->fi = 0; +diff --git a/drivers/media/platform/omap/omap_vout_vrfb.c b/drivers/media/platform/omap/omap_vout_vrfb.c +index 29e3f5da59c1f..11ec048929e80 100644 +--- a/drivers/media/platform/omap/omap_vout_vrfb.c ++++ b/drivers/media/platform/omap/omap_vout_vrfb.c +@@ -253,8 +253,7 @@ int omap_vout_prepare_vrfb(struct omap_vout_device *vout, + */ + + pixsize = vout->bpp * vout->vrfb_bpp; +- dst_icg = ((MAX_PIXELS_PER_LINE * pixsize) - +- (vout->pix.width * vout->bpp)) + 1; ++ dst_icg = MAX_PIXELS_PER_LINE * pixsize - vout->pix.width * vout->bpp; + + xt->src_start = vout->buf_phy_addr[vb->i]; + xt->dst_start = vout->vrfb_context[vb->i].paddr[0]; +-- +2.20.1 + diff --git a/queue-4.19/scsi-ufs-fix-rx_termination_force_enable-define-valu.patch b/queue-4.19/scsi-ufs-fix-rx_termination_force_enable-define-valu.patch new file mode 100644 index 00000000000..804946a5d19 --- /dev/null +++ b/queue-4.19/scsi-ufs-fix-rx_termination_force_enable-define-valu.patch @@ -0,0 +1,34 @@ +From 53a19233ff3370b1eda09d3888cfa68d9f94e54b Mon Sep 17 00:00:00 2001 +From: Pedro Sousa +Date: Thu, 18 Apr 2019 21:13:34 +0200 +Subject: scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value + +[ Upstream commit ebcb8f8508c5edf428f52525cec74d28edea7bcb ] + +Fix RX_TERMINATION_FORCE_ENABLE define value from 0x0089 to 0x00A9 +according to MIPI Alliance MPHY specification. + +Fixes: e785060ea3a1 ("ufs: definitions for phy interface") +Signed-off-by: Pedro Sousa +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/unipro.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/ufs/unipro.h b/drivers/scsi/ufs/unipro.h +index 23129d7b2678d..c77e365264478 100644 +--- a/drivers/scsi/ufs/unipro.h ++++ b/drivers/scsi/ufs/unipro.h +@@ -52,7 +52,7 @@ + #define RX_HS_UNTERMINATED_ENABLE 0x00A6 + #define RX_ENTER_HIBERN8 0x00A7 + #define RX_BYPASS_8B10B_ENABLE 0x00A8 +-#define RX_TERMINATION_FORCE_ENABLE 0x0089 ++#define RX_TERMINATION_FORCE_ENABLE 0x00A9 + #define RX_MIN_ACTIVATETIME_CAPABILITY 0x008F + #define RX_HIBERN8TIME_CAPABILITY 0x0092 + #define RX_REFCLKFREQ 0x00EB +-- +2.20.1 + diff --git a/queue-4.19/series b/queue-4.19/series new file mode 100644 index 00000000000..f85466841b1 --- /dev/null +++ b/queue-4.19/series @@ -0,0 +1,30 @@ +dmaengine-ste_dma40-fix-unneeded-variable-warning.patch +nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch +afs-fix-the-cb.probeuuid-service-handler-to-reply-co.patch +afs-fix-loop-index-mixup-in-afs_deliver_vl_get_entry.patch +fs-afs-fix-a-possible-null-pointer-dereference-in-af.patch +afs-only-update-d_fsdata-if-different-in-afs_d_reval.patch +nvmet-loop-flush-nvme_delete_wq-when-removing-the-po.patch +nvme-fix-a-possible-deadlock-when-passthru-commands-.patch +nvme-pci-fix-async-probe-remove-race.patch +soundwire-cadence_master-fix-register-definition-for.patch +soundwire-cadence_master-fix-definitions-for-intstat.patch +auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch +dmaengine-stm32-mdma-fix-a-possible-null-pointer-der.patch +omap-dma-omap_vout_vrfb-fix-off-by-one-fi-value.patch +iommu-dma-handle-sg-length-overflow-better.patch +usb-gadget-composite-clear-suspended-on-reset-discon.patch +usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch +xen-blkback-fix-memory-leaks.patch +arm64-cpufeature-don-t-treat-granule-sizes-as-strict.patch +i2c-rcar-avoid-race-when-unregistering-slave-client.patch +i2c-emev2-avoid-race-when-unregistering-slave-client.patch +drm-ast-fixed-reboot-test-may-cause-system-hanged.patch +usb-host-fotg2-restart-hcd-after-port-reset.patch +tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch +tools-hv-fix-kvp-and-vss-daemons-exit-code.patch +drm-i915-fix-broadwell-eu-computation.patch +watchdog-bcm2835_wdt-fix-module-autoload.patch +drm-bridge-tfp410-fix-memleak-in-get_modes.patch +scsi-ufs-fix-rx_termination_force_enable-define-valu.patch +drm-tilcdc-register-cpufreq-notifier-after-we-have-i.patch diff --git a/queue-4.19/soundwire-cadence_master-fix-definitions-for-intstat.patch b/queue-4.19/soundwire-cadence_master-fix-definitions-for-intstat.patch new file mode 100644 index 00000000000..2ee56d1bb60 --- /dev/null +++ b/queue-4.19/soundwire-cadence_master-fix-definitions-for-intstat.patch @@ -0,0 +1,36 @@ +From 5b28439f113df0a52b18d555372d878d38cef071 Mon Sep 17 00:00:00 2001 +From: Pierre-Louis Bossart +Date: Thu, 25 Jul 2019 18:40:06 -0500 +Subject: soundwire: cadence_master: fix definitions for INTSTAT0/1 + +[ Upstream commit 664b16589f882202b8fa8149d0074f3159bade76 ] + +Two off-by-one errors: INTSTAT0 missed BIT(31) and INTSTAT1 is only +defined on first 16 bits. + +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20190725234032.21152-15-pierre-louis.bossart@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/cadence_master.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c +index d3d7de5a319c5..70f78eda037e8 100644 +--- a/drivers/soundwire/cadence_master.c ++++ b/drivers/soundwire/cadence_master.c +@@ -96,8 +96,8 @@ + #define CDNS_MCP_SLAVE_INTMASK0 0x5C + #define CDNS_MCP_SLAVE_INTMASK1 0x60 + +-#define CDNS_MCP_SLAVE_INTMASK0_MASK GENMASK(30, 0) +-#define CDNS_MCP_SLAVE_INTMASK1_MASK GENMASK(16, 0) ++#define CDNS_MCP_SLAVE_INTMASK0_MASK GENMASK(31, 0) ++#define CDNS_MCP_SLAVE_INTMASK1_MASK GENMASK(15, 0) + + #define CDNS_MCP_PORT_INTSTAT 0x64 + #define CDNS_MCP_PDI_STAT 0x6C +-- +2.20.1 + diff --git a/queue-4.19/soundwire-cadence_master-fix-register-definition-for.patch b/queue-4.19/soundwire-cadence_master-fix-register-definition-for.patch new file mode 100644 index 00000000000..65477c290b6 --- /dev/null +++ b/queue-4.19/soundwire-cadence_master-fix-register-definition-for.patch @@ -0,0 +1,35 @@ +From 59b2706a0716980131805f23421ea756f0e8dd03 Mon Sep 17 00:00:00 2001 +From: Pierre-Louis Bossart +Date: Thu, 25 Jul 2019 18:40:05 -0500 +Subject: soundwire: cadence_master: fix register definition for SLAVE_STATE + +[ Upstream commit b07dd9b400981f487940a4d84292d3a0e7cd9362 ] + +wrong prefix and wrong macro. + +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20190725234032.21152-14-pierre-louis.bossart@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/cadence_master.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c +index cb6a331f448ab..d3d7de5a319c5 100644 +--- a/drivers/soundwire/cadence_master.c ++++ b/drivers/soundwire/cadence_master.c +@@ -81,8 +81,8 @@ + + #define CDNS_MCP_INTSET 0x4C + +-#define CDNS_SDW_SLAVE_STAT 0x50 +-#define CDNS_MCP_SLAVE_STAT_MASK BIT(1, 0) ++#define CDNS_MCP_SLAVE_STAT 0x50 ++#define CDNS_MCP_SLAVE_STAT_MASK GENMASK(1, 0) + + #define CDNS_MCP_SLAVE_INTSTAT0 0x54 + #define CDNS_MCP_SLAVE_INTSTAT1 0x58 +-- +2.20.1 + diff --git a/queue-4.19/tools-hv-fix-kvp-and-vss-daemons-exit-code.patch b/queue-4.19/tools-hv-fix-kvp-and-vss-daemons-exit-code.patch new file mode 100644 index 00000000000..d5789fdb4b2 --- /dev/null +++ b/queue-4.19/tools-hv-fix-kvp-and-vss-daemons-exit-code.patch @@ -0,0 +1,52 @@ +From 63da5bd87c15655a12ca6d359bf7a712e184106e Mon Sep 17 00:00:00 2001 +From: Adrian Vladu +Date: Mon, 6 May 2019 16:50:58 +0000 +Subject: tools: hv: fix KVP and VSS daemons exit code + +[ Upstream commit b0995156071b0ff29a5902964a9dc8cfad6f81c0 ] + +HyperV KVP and VSS daemons should exit with 0 when the '--help' +or '-h' flags are used. + +Signed-off-by: Adrian Vladu + +Cc: "K. Y. Srinivasan" +Cc: Haiyang Zhang +Cc: Stephen Hemminger +Cc: Sasha Levin +Cc: Alessandro Pilotti +Signed-off-by: Sasha Levin +--- + tools/hv/hv_kvp_daemon.c | 2 ++ + tools/hv/hv_vss_daemon.c | 2 ++ + 2 files changed, 4 insertions(+) + +diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c +index d7e06fe0270ee..0ce50c319cfd6 100644 +--- a/tools/hv/hv_kvp_daemon.c ++++ b/tools/hv/hv_kvp_daemon.c +@@ -1386,6 +1386,8 @@ int main(int argc, char *argv[]) + daemonize = 0; + break; + case 'h': ++ print_usage(argv); ++ exit(0); + default: + print_usage(argv); + exit(EXIT_FAILURE); +diff --git a/tools/hv/hv_vss_daemon.c b/tools/hv/hv_vss_daemon.c +index b133001727623..c2bb8a3601777 100644 +--- a/tools/hv/hv_vss_daemon.c ++++ b/tools/hv/hv_vss_daemon.c +@@ -229,6 +229,8 @@ int main(int argc, char *argv[]) + daemonize = 0; + break; + case 'h': ++ print_usage(argv); ++ exit(0); + default: + print_usage(argv); + exit(EXIT_FAILURE); +-- +2.20.1 + diff --git a/queue-4.19/tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch b/queue-4.19/tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch new file mode 100644 index 00000000000..c7783d754a4 --- /dev/null +++ b/queue-4.19/tools-hv-fixed-python-pep8-flake8-warnings-for-lsvmb.patch @@ -0,0 +1,154 @@ +From 352a964c39f36ba59f01783d3441567843a89210 Mon Sep 17 00:00:00 2001 +From: Adrian Vladu +Date: Mon, 6 May 2019 17:27:37 +0000 +Subject: tools: hv: fixed Python pep8/flake8 warnings for lsvmbus + +[ Upstream commit 5912e791f3018de0a007c8cfa9cb38c97d3e5f5c ] + +Fixed pep8/flake8 python style code for lsvmbus tool. + +The TAB indentation was on purpose ignored (pep8 rule W191) to make +sure the code is complying with the Linux code guideline. +The following command doe not show any warnings now: +pep8 --ignore=W191 lsvmbus +flake8 --ignore=W191 lsvmbus + +Signed-off-by: Adrian Vladu + +Cc: "K. Y. Srinivasan" +Cc: Haiyang Zhang +Cc: Stephen Hemminger +Cc: Sasha Levin +Cc: Dexuan Cui +Cc: Alessandro Pilotti +Signed-off-by: Sasha Levin +--- + tools/hv/lsvmbus | 75 +++++++++++++++++++++++++++--------------------- + 1 file changed, 42 insertions(+), 33 deletions(-) + +diff --git a/tools/hv/lsvmbus b/tools/hv/lsvmbus +index 55e7374bade0d..099f2c44dbed2 100644 +--- a/tools/hv/lsvmbus ++++ b/tools/hv/lsvmbus +@@ -4,10 +4,10 @@ + import os + from optparse import OptionParser + ++help_msg = "print verbose messages. Try -vv, -vvv for more verbose messages" + parser = OptionParser() +-parser.add_option("-v", "--verbose", dest="verbose", +- help="print verbose messages. Try -vv, -vvv for \ +- more verbose messages", action="count") ++parser.add_option( ++ "-v", "--verbose", dest="verbose", help=help_msg, action="count") + + (options, args) = parser.parse_args() + +@@ -21,27 +21,28 @@ if not os.path.isdir(vmbus_sys_path): + exit(-1) + + vmbus_dev_dict = { +- '{0e0b6031-5213-4934-818b-38d90ced39db}' : '[Operating system shutdown]', +- '{9527e630-d0ae-497b-adce-e80ab0175caf}' : '[Time Synchronization]', +- '{57164f39-9115-4e78-ab55-382f3bd5422d}' : '[Heartbeat]', +- '{a9a0f4e7-5a45-4d96-b827-8a841e8c03e6}' : '[Data Exchange]', +- '{35fa2e29-ea23-4236-96ae-3a6ebacba440}' : '[Backup (volume checkpoint)]', +- '{34d14be3-dee4-41c8-9ae7-6b174977c192}' : '[Guest services]', +- '{525074dc-8985-46e2-8057-a307dc18a502}' : '[Dynamic Memory]', +- '{cfa8b69e-5b4a-4cc0-b98b-8ba1a1f3f95a}' : 'Synthetic mouse', +- '{f912ad6d-2b17-48ea-bd65-f927a61c7684}' : 'Synthetic keyboard', +- '{da0a7802-e377-4aac-8e77-0558eb1073f8}' : 'Synthetic framebuffer adapter', +- '{f8615163-df3e-46c5-913f-f2d2f965ed0e}' : 'Synthetic network adapter', +- '{32412632-86cb-44a2-9b5c-50d1417354f5}' : 'Synthetic IDE Controller', +- '{ba6163d9-04a1-4d29-b605-72e2ffb1dc7f}' : 'Synthetic SCSI Controller', +- '{2f9bcc4a-0069-4af3-b76b-6fd0be528cda}' : 'Synthetic fiber channel adapter', +- '{8c2eaf3d-32a7-4b09-ab99-bd1f1c86b501}' : 'Synthetic RDMA adapter', +- '{44c4f61d-4444-4400-9d52-802e27ede19f}' : 'PCI Express pass-through', +- '{276aacf4-ac15-426c-98dd-7521ad3f01fe}' : '[Reserved system device]', +- '{f8e65716-3cb3-4a06-9a60-1889c5cccab5}' : '[Reserved system device]', +- '{3375baf4-9e15-4b30-b765-67acb10d607b}' : '[Reserved system device]', ++ '{0e0b6031-5213-4934-818b-38d90ced39db}': '[Operating system shutdown]', ++ '{9527e630-d0ae-497b-adce-e80ab0175caf}': '[Time Synchronization]', ++ '{57164f39-9115-4e78-ab55-382f3bd5422d}': '[Heartbeat]', ++ '{a9a0f4e7-5a45-4d96-b827-8a841e8c03e6}': '[Data Exchange]', ++ '{35fa2e29-ea23-4236-96ae-3a6ebacba440}': '[Backup (volume checkpoint)]', ++ '{34d14be3-dee4-41c8-9ae7-6b174977c192}': '[Guest services]', ++ '{525074dc-8985-46e2-8057-a307dc18a502}': '[Dynamic Memory]', ++ '{cfa8b69e-5b4a-4cc0-b98b-8ba1a1f3f95a}': 'Synthetic mouse', ++ '{f912ad6d-2b17-48ea-bd65-f927a61c7684}': 'Synthetic keyboard', ++ '{da0a7802-e377-4aac-8e77-0558eb1073f8}': 'Synthetic framebuffer adapter', ++ '{f8615163-df3e-46c5-913f-f2d2f965ed0e}': 'Synthetic network adapter', ++ '{32412632-86cb-44a2-9b5c-50d1417354f5}': 'Synthetic IDE Controller', ++ '{ba6163d9-04a1-4d29-b605-72e2ffb1dc7f}': 'Synthetic SCSI Controller', ++ '{2f9bcc4a-0069-4af3-b76b-6fd0be528cda}': 'Synthetic fiber channel adapter', ++ '{8c2eaf3d-32a7-4b09-ab99-bd1f1c86b501}': 'Synthetic RDMA adapter', ++ '{44c4f61d-4444-4400-9d52-802e27ede19f}': 'PCI Express pass-through', ++ '{276aacf4-ac15-426c-98dd-7521ad3f01fe}': '[Reserved system device]', ++ '{f8e65716-3cb3-4a06-9a60-1889c5cccab5}': '[Reserved system device]', ++ '{3375baf4-9e15-4b30-b765-67acb10d607b}': '[Reserved system device]', + } + ++ + def get_vmbus_dev_attr(dev_name, attr): + try: + f = open('%s/%s/%s' % (vmbus_sys_path, dev_name, attr), 'r') +@@ -52,6 +53,7 @@ def get_vmbus_dev_attr(dev_name, attr): + + return lines + ++ + class VMBus_Dev: + pass + +@@ -66,12 +68,13 @@ for f in os.listdir(vmbus_sys_path): + + chn_vp_mapping = get_vmbus_dev_attr(f, 'channel_vp_mapping') + chn_vp_mapping = [c.strip() for c in chn_vp_mapping] +- chn_vp_mapping = sorted(chn_vp_mapping, +- key = lambda c : int(c.split(':')[0])) ++ chn_vp_mapping = sorted( ++ chn_vp_mapping, key=lambda c: int(c.split(':')[0])) + +- chn_vp_mapping = ['\tRel_ID=%s, target_cpu=%s' % +- (c.split(':')[0], c.split(':')[1]) +- for c in chn_vp_mapping] ++ chn_vp_mapping = [ ++ '\tRel_ID=%s, target_cpu=%s' % ++ (c.split(':')[0], c.split(':')[1]) for c in chn_vp_mapping ++ ] + d = VMBus_Dev() + d.sysfs_path = '%s/%s' % (vmbus_sys_path, f) + d.vmbus_id = vmbus_id +@@ -85,7 +88,7 @@ for f in os.listdir(vmbus_sys_path): + vmbus_dev_list.append(d) + + +-vmbus_dev_list = sorted(vmbus_dev_list, key = lambda d : int(d.vmbus_id)) ++vmbus_dev_list = sorted(vmbus_dev_list, key=lambda d: int(d.vmbus_id)) + + format0 = '%2s: %s' + format1 = '%2s: Class_ID = %s - %s\n%s' +@@ -95,9 +98,15 @@ for d in vmbus_dev_list: + if verbose == 0: + print(('VMBUS ID ' + format0) % (d.vmbus_id, d.dev_desc)) + elif verbose == 1: +- print (('VMBUS ID ' + format1) % \ +- (d.vmbus_id, d.class_id, d.dev_desc, d.chn_vp_mapping)) ++ print( ++ ('VMBUS ID ' + format1) % ++ (d.vmbus_id, d.class_id, d.dev_desc, d.chn_vp_mapping) ++ ) + else: +- print (('VMBUS ID ' + format2) % \ +- (d.vmbus_id, d.class_id, d.dev_desc, \ +- d.device_id, d.sysfs_path, d.chn_vp_mapping)) ++ print( ++ ('VMBUS ID ' + format2) % ++ ( ++ d.vmbus_id, d.class_id, d.dev_desc, ++ d.device_id, d.sysfs_path, d.chn_vp_mapping ++ ) ++ ) +-- +2.20.1 + diff --git a/queue-4.19/usb-gadget-composite-clear-suspended-on-reset-discon.patch b/queue-4.19/usb-gadget-composite-clear-suspended-on-reset-discon.patch new file mode 100644 index 00000000000..0e0e73c1ee4 --- /dev/null +++ b/queue-4.19/usb-gadget-composite-clear-suspended-on-reset-discon.patch @@ -0,0 +1,33 @@ +From bd0c90c82709f0d8d600c1b66888a23a4e0b533e Mon Sep 17 00:00:00 2001 +From: Benjamin Herrenschmidt +Date: Fri, 26 Jul 2019 14:59:03 +1000 +Subject: usb: gadget: composite: Clear "suspended" on reset/disconnect + +[ Upstream commit 602fda17c7356bb7ae98467d93549057481d11dd ] + +In some cases, one can get out of suspend with a reset or +a disconnect followed by a reconnect. Previously we would +leave a stale suspended flag set. + +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/composite.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c +index b8a15840b4ffd..dfcabadeed01b 100644 +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -1976,6 +1976,7 @@ void composite_disconnect(struct usb_gadget *gadget) + * disconnect callbacks? + */ + spin_lock_irqsave(&cdev->lock, flags); ++ cdev->suspended = 0; + if (cdev->config) + reset_config(cdev); + if (cdev->driver->disconnect) +-- +2.20.1 + diff --git a/queue-4.19/usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch b/queue-4.19/usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch new file mode 100644 index 00000000000..f9417ddb411 --- /dev/null +++ b/queue-4.19/usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch @@ -0,0 +1,168 @@ +From 6cc7d3cb64ba4dab93a99ae9a26bbccaf99a0e34 Mon Sep 17 00:00:00 2001 +From: Benjamin Herrenschmidt +Date: Fri, 26 Jul 2019 14:59:04 +1000 +Subject: usb: gadget: mass_storage: Fix races between fsg_disable and + fsg_set_alt + +[ Upstream commit 4a56a478a525d6427be90753451c40e1327caa1a ] + +If fsg_disable() and fsg_set_alt() are called too closely to each +other (for example due to a quick reset/reconnect), what can happen +is that fsg_set_alt sets common->new_fsg from an interrupt while +handle_exception is trying to process the config change caused by +fsg_disable(): + + fsg_disable() + ... + handle_exception() + sets state back to FSG_STATE_NORMAL + hasn't yet called do_set_interface() + or is inside it. + + ---> interrupt + fsg_set_alt + sets common->new_fsg + queues a new FSG_STATE_CONFIG_CHANGE + <--- + +Now, the first handle_exception can "see" the updated +new_fsg, treats it as if it was a fsg_set_alt() response, +call usb_composite_setup_continue() etc... + +But then, the thread sees the second FSG_STATE_CONFIG_CHANGE, +and goes back down the same path, wipes and reattaches a now +active fsg, and .. calls usb_composite_setup_continue() which +at this point is wrong. + +Not only we get a backtrace, but I suspect the second set_interface +wrecks some state causing the host to get upset in my case. + +This fixes it by replacing "new_fsg" by a "state argument" (same +principle) which is set in the same lock section as the state +update, and retrieved similarly. + +That way, there is never any discrepancy between the dequeued +state and the observed value of it. We keep the ability to have +the latest reconfig operation take precedence, but we guarantee +that once "dequeued" the argument (new_fsg) will not be clobbered +by any new event. + +Signed-off-by: Benjamin Herrenschmidt +Acked-by: Alan Stern +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_mass_storage.c | 28 +++++++++++++------- + 1 file changed, 18 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c +index 1074cb82ec172..0b7b4d09785b6 100644 +--- a/drivers/usb/gadget/function/f_mass_storage.c ++++ b/drivers/usb/gadget/function/f_mass_storage.c +@@ -261,7 +261,7 @@ struct fsg_common; + struct fsg_common { + struct usb_gadget *gadget; + struct usb_composite_dev *cdev; +- struct fsg_dev *fsg, *new_fsg; ++ struct fsg_dev *fsg; + wait_queue_head_t io_wait; + wait_queue_head_t fsg_wait; + +@@ -290,6 +290,7 @@ struct fsg_common { + unsigned int bulk_out_maxpacket; + enum fsg_state state; /* For exception handling */ + unsigned int exception_req_tag; ++ void *exception_arg; + + enum data_direction data_dir; + u32 data_size; +@@ -391,7 +392,8 @@ static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep) + + /* These routines may be called in process context or in_irq */ + +-static void raise_exception(struct fsg_common *common, enum fsg_state new_state) ++static void __raise_exception(struct fsg_common *common, enum fsg_state new_state, ++ void *arg) + { + unsigned long flags; + +@@ -404,6 +406,7 @@ static void raise_exception(struct fsg_common *common, enum fsg_state new_state) + if (common->state <= new_state) { + common->exception_req_tag = common->ep0_req_tag; + common->state = new_state; ++ common->exception_arg = arg; + if (common->thread_task) + send_sig_info(SIGUSR1, SEND_SIG_FORCED, + common->thread_task); +@@ -411,6 +414,10 @@ static void raise_exception(struct fsg_common *common, enum fsg_state new_state) + spin_unlock_irqrestore(&common->lock, flags); + } + ++static void raise_exception(struct fsg_common *common, enum fsg_state new_state) ++{ ++ __raise_exception(common, new_state, NULL); ++} + + /*-------------------------------------------------------------------------*/ + +@@ -2285,16 +2292,16 @@ reset: + static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt) + { + struct fsg_dev *fsg = fsg_from_func(f); +- fsg->common->new_fsg = fsg; +- raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE); ++ ++ __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, fsg); + return USB_GADGET_DELAYED_STATUS; + } + + static void fsg_disable(struct usb_function *f) + { + struct fsg_dev *fsg = fsg_from_func(f); +- fsg->common->new_fsg = NULL; +- raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE); ++ ++ __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL); + } + + +@@ -2307,6 +2314,7 @@ static void handle_exception(struct fsg_common *common) + enum fsg_state old_state; + struct fsg_lun *curlun; + unsigned int exception_req_tag; ++ struct fsg_dev *new_fsg; + + /* + * Clear the existing signals. Anything but SIGUSR1 is converted +@@ -2360,6 +2368,7 @@ static void handle_exception(struct fsg_common *common) + common->next_buffhd_to_fill = &common->buffhds[0]; + common->next_buffhd_to_drain = &common->buffhds[0]; + exception_req_tag = common->exception_req_tag; ++ new_fsg = common->exception_arg; + old_state = common->state; + common->state = FSG_STATE_NORMAL; + +@@ -2413,8 +2422,8 @@ static void handle_exception(struct fsg_common *common) + break; + + case FSG_STATE_CONFIG_CHANGE: +- do_set_interface(common, common->new_fsg); +- if (common->new_fsg) ++ do_set_interface(common, new_fsg); ++ if (new_fsg) + usb_composite_setup_continue(common->cdev); + break; + +@@ -2989,8 +2998,7 @@ static void fsg_unbind(struct usb_configuration *c, struct usb_function *f) + + DBG(fsg, "unbind\n"); + if (fsg->common->fsg == fsg) { +- fsg->common->new_fsg = NULL; +- raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE); ++ __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL); + /* FIXME: make interruptible or killable somehow? */ + wait_event(common->fsg_wait, common->fsg != fsg); + } +-- +2.20.1 + diff --git a/queue-4.19/usb-host-fotg2-restart-hcd-after-port-reset.patch b/queue-4.19/usb-host-fotg2-restart-hcd-after-port-reset.patch new file mode 100644 index 00000000000..3581b498e01 --- /dev/null +++ b/queue-4.19/usb-host-fotg2-restart-hcd-after-port-reset.patch @@ -0,0 +1,37 @@ +From 1356f72b847b13e6454d2ba74d24084d8c5ac52a Mon Sep 17 00:00:00 2001 +From: Hans Ulli Kroll +Date: Sat, 10 Aug 2019 17:04:58 +0200 +Subject: usb: host: fotg2: restart hcd after port reset + +[ Upstream commit 777758888ffe59ef754cc39ab2f275dc277732f4 ] + +On the Gemini SoC the FOTG2 stalls after port reset +so restart the HCD after each port reset. + +Signed-off-by: Hans Ulli Kroll +Signed-off-by: Linus Walleij +Link: https://lore.kernel.org/r/20190810150458.817-1-linus.walleij@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/fotg210-hcd.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c +index e64eb47770c8b..2d5a72c15069e 100644 +--- a/drivers/usb/host/fotg210-hcd.c ++++ b/drivers/usb/host/fotg210-hcd.c +@@ -1627,6 +1627,10 @@ static int fotg210_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + /* see what we found out */ + temp = check_reset_complete(fotg210, wIndex, status_reg, + fotg210_readl(fotg210, status_reg)); ++ ++ /* restart schedule */ ++ fotg210->command |= CMD_RUN; ++ fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command); + } + + if (!(temp & (PORT_RESUME|PORT_RESET))) { +-- +2.20.1 + diff --git a/queue-4.19/watchdog-bcm2835_wdt-fix-module-autoload.patch b/queue-4.19/watchdog-bcm2835_wdt-fix-module-autoload.patch new file mode 100644 index 00000000000..276f2303ad7 --- /dev/null +++ b/queue-4.19/watchdog-bcm2835_wdt-fix-module-autoload.patch @@ -0,0 +1,35 @@ +From 10ae237e046e2e2f8fc6540bb397bbe052aa4c45 Mon Sep 17 00:00:00 2001 +From: Stefan Wahren +Date: Wed, 15 May 2019 19:14:18 +0200 +Subject: watchdog: bcm2835_wdt: Fix module autoload + +[ Upstream commit 215e06f0d18d5d653d6ea269e4dfc684854d48bf ] + +The commit 5e6acc3e678e ("bcm2835-pm: Move bcm2835-watchdog's DT probe +to an MFD.") broke module autoloading on Raspberry Pi. So add a +module alias this fix this. + +Signed-off-by: Stefan Wahren +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/bcm2835_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c +index ed05514cc2dce..e6c27b71b136d 100644 +--- a/drivers/watchdog/bcm2835_wdt.c ++++ b/drivers/watchdog/bcm2835_wdt.c +@@ -249,6 +249,7 @@ module_param(nowayout, bool, 0); + MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" + __MODULE_STRING(WATCHDOG_NOWAYOUT) ")"); + ++MODULE_ALIAS("platform:bcm2835-wdt"); + MODULE_AUTHOR("Lubomir Rintel "); + MODULE_DESCRIPTION("Driver for Broadcom BCM2835 watchdog timer"); + MODULE_LICENSE("GPL"); +-- +2.20.1 + diff --git a/queue-4.19/xen-blkback-fix-memory-leaks.patch b/queue-4.19/xen-blkback-fix-memory-leaks.patch new file mode 100644 index 00000000000..311952c6c36 --- /dev/null +++ b/queue-4.19/xen-blkback-fix-memory-leaks.patch @@ -0,0 +1,59 @@ +From 372dd8959cd769eebce676cd177a18677f43ffab Mon Sep 17 00:00:00 2001 +From: Wenwen Wang +Date: Sun, 11 Aug 2019 12:23:22 -0500 +Subject: xen/blkback: fix memory leaks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit ae78ca3cf3d9e9f914bfcd0bc5c389ff18b9c2e0 ] + +In read_per_ring_refs(), after 'req' and related memory regions are +allocated, xen_blkif_map() is invoked to map the shared frame, irq, and +etc. However, if this mapping process fails, no cleanup is performed, +leading to memory leaks. To fix this issue, invoke the cleanup before +returning the error. + +Acked-by: Roger Pau Monné +Reviewed-by: Boris Ostrovsky +Signed-off-by: Wenwen Wang +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/xen-blkback/xenbus.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c +index a4bc74e72c394..55869b362fdfb 100644 +--- a/drivers/block/xen-blkback/xenbus.c ++++ b/drivers/block/xen-blkback/xenbus.c +@@ -974,6 +974,7 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir) + } + blkif->nr_ring_pages = nr_grefs; + ++ err = -ENOMEM; + for (i = 0; i < nr_grefs * XEN_BLKIF_REQS_PER_PAGE; i++) { + req = kzalloc(sizeof(*req), GFP_KERNEL); + if (!req) +@@ -996,7 +997,7 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir) + err = xen_blkif_map(ring, ring_ref, nr_grefs, evtchn); + if (err) { + xenbus_dev_fatal(dev, err, "mapping ring-ref port %u", evtchn); +- return err; ++ goto fail; + } + + return 0; +@@ -1016,8 +1017,7 @@ fail: + } + kfree(req); + } +- return -ENOMEM; +- ++ return err; + } + + static int connect_ring(struct backend_info *be) +-- +2.20.1 + -- 2.47.3