From a6e09ab7eb7a961f2945410a8ed8a04157197017 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Thu, 29 Aug 2019 22:30:29 -0400 Subject: [PATCH] fixes for 4.14 Signed-off-by: Sasha Levin --- ...-need-to-delete-scan_timer-when-misc.patch | 35 ++++ ..._dma40-fix-unneeded-variable-warning.patch | 54 ++++++ ...-reboot-test-may-cause-system-hanged.patch | 74 ++++++++ ...idge-tfp410-fix-memleak-in-get_modes.patch | 40 +++++ ...ter-cpufreq-notifier-after-we-have-i.patch | 87 +++++++++ ...race-when-unregistering-slave-client.patch | 78 ++++++++ ...race-when-unregistering-slave-client.patch | 70 ++++++++ ...dma-handle-sg-length-overflow-better.patch | 45 +++++ ...termination_force_enable-define-valu.patch | 34 ++++ queue-4.14/series | 15 ++ ...hv-fix-kvp-and-vss-daemons-exit-code.patch | 52 ++++++ ...site-clear-suspended-on-reset-discon.patch | 33 ++++ ...storage-fix-races-between-fsg_disabl.patch | 168 ++++++++++++++++++ ...t-fotg2-restart-hcd-after-port-reset.patch | 37 ++++ ...hdog-bcm2835_wdt-fix-module-autoload.patch | 35 ++++ queue-4.14/xen-blkback-fix-memory-leaks.patch | 59 ++++++ 16 files changed, 916 insertions(+) create mode 100644 queue-4.14/auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch create mode 100644 queue-4.14/dmaengine-ste_dma40-fix-unneeded-variable-warning.patch create mode 100644 queue-4.14/drm-ast-fixed-reboot-test-may-cause-system-hanged.patch create mode 100644 queue-4.14/drm-bridge-tfp410-fix-memleak-in-get_modes.patch create mode 100644 queue-4.14/drm-tilcdc-register-cpufreq-notifier-after-we-have-i.patch create mode 100644 queue-4.14/i2c-emev2-avoid-race-when-unregistering-slave-client.patch create mode 100644 queue-4.14/i2c-rcar-avoid-race-when-unregistering-slave-client.patch create mode 100644 queue-4.14/iommu-dma-handle-sg-length-overflow-better.patch create mode 100644 queue-4.14/scsi-ufs-fix-rx_termination_force_enable-define-valu.patch create mode 100644 queue-4.14/series create mode 100644 queue-4.14/tools-hv-fix-kvp-and-vss-daemons-exit-code.patch create mode 100644 queue-4.14/usb-gadget-composite-clear-suspended-on-reset-discon.patch create mode 100644 queue-4.14/usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch create mode 100644 queue-4.14/usb-host-fotg2-restart-hcd-after-port-reset.patch create mode 100644 queue-4.14/watchdog-bcm2835_wdt-fix-module-autoload.patch create mode 100644 queue-4.14/xen-blkback-fix-memory-leaks.patch diff --git a/queue-4.14/auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch b/queue-4.14/auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch new file mode 100644 index 00000000000..94870f3649f --- /dev/null +++ b/queue-4.14/auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch @@ -0,0 +1,35 @@ +From e6b26e30e277ccf1f8276392e7fce4aa99e961d1 Mon Sep 17 00:00:00 2001 +From: zhengbin +Date: Mon, 8 Jul 2019 20:42:18 +0800 +Subject: auxdisplay: panel: need to delete scan_timer when misc_register fails + in panel_attach + +[ Upstream commit b33d567560c1aadf3033290d74d4fd67af47aa61 ] + +In panel_attach, if misc_register fails, we need to delete scan_timer, +which was setup in keypad_init->init_scan_timer. + +Reported-by: Hulk Robot +Signed-off-by: zhengbin +Signed-off-by: Miguel Ojeda +Signed-off-by: Sasha Levin +--- + drivers/auxdisplay/panel.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c +index 6911acd896d93..e30953ceb7dfd 100644 +--- a/drivers/auxdisplay/panel.c ++++ b/drivers/auxdisplay/panel.c +@@ -1622,6 +1622,8 @@ static void panel_attach(struct parport *port) + return; + + err_lcd_unreg: ++ if (scan_timer.function) ++ del_timer_sync(&scan_timer); + if (lcd.enabled) + charlcd_unregister(lcd.charlcd); + err_unreg_device: +-- +2.20.1 + diff --git a/queue-4.14/dmaengine-ste_dma40-fix-unneeded-variable-warning.patch b/queue-4.14/dmaengine-ste_dma40-fix-unneeded-variable-warning.patch new file mode 100644 index 00000000000..88151b90721 --- /dev/null +++ b/queue-4.14/dmaengine-ste_dma40-fix-unneeded-variable-warning.patch @@ -0,0 +1,54 @@ +From a9cd4a5249f521fffec83c267c52fd2934f1394b Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Fri, 12 Jul 2019 11:13:30 +0200 +Subject: dmaengine: ste_dma40: fix unneeded variable warning + +[ Upstream commit 5d6fb560729a5d5554e23db8d00eb57cd0021083 ] + +clang-9 points out that there are two variables that depending on the +configuration may only be used in an ARRAY_SIZE() expression but not +referenced: + +drivers/dma/ste_dma40.c:145:12: error: variable 'd40_backup_regs' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration] +static u32 d40_backup_regs[] = { + ^ +drivers/dma/ste_dma40.c:214:12: error: variable 'd40_backup_regs_chan' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration] +static u32 d40_backup_regs_chan[] = { + +Mark these __maybe_unused to shut up the warning. + +Signed-off-by: Arnd Bergmann +Reviewed-by: Nathan Chancellor +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20190712091357.744515-1-arnd@arndb.de +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ste_dma40.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c +index c2b089af04208..90feb6a05e59b 100644 +--- a/drivers/dma/ste_dma40.c ++++ b/drivers/dma/ste_dma40.c +@@ -142,7 +142,7 @@ enum d40_events { + * when the DMA hw is powered off. + * TODO: Add save/restore of D40_DREG_GCC on dma40 v3 or later, if that works. + */ +-static u32 d40_backup_regs[] = { ++static __maybe_unused u32 d40_backup_regs[] = { + D40_DREG_LCPA, + D40_DREG_LCLA, + D40_DREG_PRMSE, +@@ -211,7 +211,7 @@ static u32 d40_backup_regs_v4b[] = { + + #define BACKUP_REGS_SZ_V4B ARRAY_SIZE(d40_backup_regs_v4b) + +-static u32 d40_backup_regs_chan[] = { ++static __maybe_unused u32 d40_backup_regs_chan[] = { + D40_CHAN_REG_SSCFG, + D40_CHAN_REG_SSELT, + D40_CHAN_REG_SSPTR, +-- +2.20.1 + diff --git a/queue-4.14/drm-ast-fixed-reboot-test-may-cause-system-hanged.patch b/queue-4.14/drm-ast-fixed-reboot-test-may-cause-system-hanged.patch new file mode 100644 index 00000000000..c390897531c --- /dev/null +++ b/queue-4.14/drm-ast-fixed-reboot-test-may-cause-system-hanged.patch @@ -0,0 +1,74 @@ +From 8bd708a43e8e28c73b92e76d24fe90cd1f0593a1 Mon Sep 17 00:00:00 2001 +From: "Y.C. Chen" +Date: Wed, 11 Apr 2018 09:27:39 +0800 +Subject: drm/ast: Fixed reboot test may cause system hanged + +[ Upstream commit 05b439711f6ff8700e8660f97a1179650778b9cb ] + +There is another thread still access standard VGA I/O while loading drm driver. +Disable standard VGA I/O decode to avoid this issue. + +Signed-off-by: Y.C. Chen +Reviewed-by: Benjamin Herrenschmidt +Signed-off-by: Dave Airlie +Link: https://patchwork.freedesktop.org/patch/msgid/1523410059-18415-1-git-send-email-yc_chen@aspeedtech.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ast/ast_main.c | 5 ++++- + drivers/gpu/drm/ast/ast_mode.c | 2 +- + drivers/gpu/drm/ast/ast_post.c | 2 +- + 3 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c +index 373700c05a00f..224fa1ef87ff9 100644 +--- a/drivers/gpu/drm/ast/ast_main.c ++++ b/drivers/gpu/drm/ast/ast_main.c +@@ -131,8 +131,8 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post) + + + /* Enable extended register access */ +- ast_enable_mmio(dev); + ast_open_key(ast); ++ ast_enable_mmio(dev); + + /* Find out whether P2A works or whether to use device-tree */ + ast_detect_config_mode(dev, &scu_rev); +@@ -576,6 +576,9 @@ void ast_driver_unload(struct drm_device *dev) + { + struct ast_private *ast = dev->dev_private; + ++ /* enable standard VGA decode */ ++ ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x04); ++ + ast_release_firmware(dev); + kfree(ast->dp501_fw_addr); + ast_mode_fini(dev); +diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c +index 343867b182dd8..a09fafa270822 100644 +--- a/drivers/gpu/drm/ast/ast_mode.c ++++ b/drivers/gpu/drm/ast/ast_mode.c +@@ -600,7 +600,7 @@ static int ast_crtc_mode_set(struct drm_crtc *crtc, + return -EINVAL; + ast_open_key(ast); + +- ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa1, 0xff, 0x04); ++ ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x06); + + ast_set_std_reg(crtc, adjusted_mode, &vbios_mode); + ast_set_crtc_reg(crtc, adjusted_mode, &vbios_mode); +diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c +index f7d421359d564..c1d1ac51d1c20 100644 +--- a/drivers/gpu/drm/ast/ast_post.c ++++ b/drivers/gpu/drm/ast/ast_post.c +@@ -46,7 +46,7 @@ void ast_enable_mmio(struct drm_device *dev) + { + struct ast_private *ast = dev->dev_private; + +- ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa1, 0xff, 0x04); ++ ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x06); + } + + +-- +2.20.1 + diff --git a/queue-4.14/drm-bridge-tfp410-fix-memleak-in-get_modes.patch b/queue-4.14/drm-bridge-tfp410-fix-memleak-in-get_modes.patch new file mode 100644 index 00000000000..2199460d477 --- /dev/null +++ b/queue-4.14/drm-bridge-tfp410-fix-memleak-in-get_modes.patch @@ -0,0 +1,40 @@ +From ce9e934c1a66df2e74bc62a520779db9353e2698 Mon Sep 17 00:00:00 2001 +From: Tomi Valkeinen +Date: Mon, 10 Jun 2019 16:57:38 +0300 +Subject: drm/bridge: tfp410: fix memleak in get_modes() + +[ Upstream commit c08f99c39083ab55a9c93b3e93cef48711294dad ] + +We don't free the edid blob allocated by the call to drm_get_edid(), +causing a memleak. Fix this by calling kfree(edid) at the end of the +get_modes(). + +Signed-off-by: Tomi Valkeinen +Signed-off-by: Andrzej Hajda +Link: https://patchwork.freedesktop.org/patch/msgid/20190610135739.6077-1-tomi.valkeinen@ti.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-tfp410.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/ti-tfp410.c b/drivers/gpu/drm/bridge/ti-tfp410.c +index acb857030951a..1bb01905be8e3 100644 +--- a/drivers/gpu/drm/bridge/ti-tfp410.c ++++ b/drivers/gpu/drm/bridge/ti-tfp410.c +@@ -64,7 +64,12 @@ static int tfp410_get_modes(struct drm_connector *connector) + + drm_mode_connector_update_edid_property(connector, edid); + +- return drm_add_edid_modes(connector, edid); ++ ret = drm_add_edid_modes(connector, edid); ++ ++ kfree(edid); ++ ++ return ret; ++ + fallback: + /* No EDID, fallback on the XGA standard modes */ + ret = drm_add_modes_noedid(connector, 1920, 1200); +-- +2.20.1 + diff --git a/queue-4.14/drm-tilcdc-register-cpufreq-notifier-after-we-have-i.patch b/queue-4.14/drm-tilcdc-register-cpufreq-notifier-after-we-have-i.patch new file mode 100644 index 00000000000..daabc1f3d91 --- /dev/null +++ b/queue-4.14/drm-tilcdc-register-cpufreq-notifier-after-we-have-i.patch @@ -0,0 +1,87 @@ +From c3ab3782358257bdad61ffa55c5ec03b94c54388 Mon Sep 17 00:00:00 2001 +From: Jyri Sarha +Date: Wed, 12 Dec 2018 19:26:32 +0200 +Subject: drm/tilcdc: Register cpufreq notifier after we have initialized crtc + +[ Upstream commit 432973fd3a20102840d5f7e61af9f1a03c217a4c ] + +Register cpufreq notifier after we have initialized the crtc and +unregister it before we remove the ctrc. Receiving a cpufreq notify +without crtc causes a crash. + +Reported-by: Peter Ujfalusi +Signed-off-by: Jyri Sarha +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tilcdc/tilcdc_drv.c | 34 ++++++++++++++--------------- + 1 file changed, 17 insertions(+), 17 deletions(-) + +diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c +index b0d70f943cec5..56039897607c6 100644 +--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c ++++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c +@@ -189,6 +189,12 @@ static void tilcdc_fini(struct drm_device *dev) + { + struct tilcdc_drm_private *priv = dev->dev_private; + ++#ifdef CONFIG_CPU_FREQ ++ if (priv->freq_transition.notifier_call) ++ cpufreq_unregister_notifier(&priv->freq_transition, ++ CPUFREQ_TRANSITION_NOTIFIER); ++#endif ++ + if (priv->crtc) + tilcdc_crtc_shutdown(priv->crtc); + +@@ -204,12 +210,6 @@ static void tilcdc_fini(struct drm_device *dev) + drm_mode_config_cleanup(dev); + tilcdc_remove_external_device(dev); + +-#ifdef CONFIG_CPU_FREQ +- if (priv->freq_transition.notifier_call) +- cpufreq_unregister_notifier(&priv->freq_transition, +- CPUFREQ_TRANSITION_NOTIFIER); +-#endif +- + if (priv->clk) + clk_put(priv->clk); + +@@ -282,17 +282,6 @@ static int tilcdc_init(struct drm_driver *ddrv, struct device *dev) + goto init_failed; + } + +-#ifdef CONFIG_CPU_FREQ +- priv->freq_transition.notifier_call = cpufreq_transition; +- ret = cpufreq_register_notifier(&priv->freq_transition, +- CPUFREQ_TRANSITION_NOTIFIER); +- if (ret) { +- dev_err(dev, "failed to register cpufreq notifier\n"); +- priv->freq_transition.notifier_call = NULL; +- goto init_failed; +- } +-#endif +- + if (of_property_read_u32(node, "max-bandwidth", &priv->max_bandwidth)) + priv->max_bandwidth = TILCDC_DEFAULT_MAX_BANDWIDTH; + +@@ -369,6 +358,17 @@ static int tilcdc_init(struct drm_driver *ddrv, struct device *dev) + } + modeset_init(ddev); + ++#ifdef CONFIG_CPU_FREQ ++ priv->freq_transition.notifier_call = cpufreq_transition; ++ ret = cpufreq_register_notifier(&priv->freq_transition, ++ CPUFREQ_TRANSITION_NOTIFIER); ++ if (ret) { ++ dev_err(dev, "failed to register cpufreq notifier\n"); ++ priv->freq_transition.notifier_call = NULL; ++ goto init_failed; ++ } ++#endif ++ + if (priv->is_componentized) { + ret = component_bind_all(dev, ddev); + if (ret < 0) +-- +2.20.1 + diff --git a/queue-4.14/i2c-emev2-avoid-race-when-unregistering-slave-client.patch b/queue-4.14/i2c-emev2-avoid-race-when-unregistering-slave-client.patch new file mode 100644 index 00000000000..4690ac61f98 --- /dev/null +++ b/queue-4.14/i2c-emev2-avoid-race-when-unregistering-slave-client.patch @@ -0,0 +1,78 @@ +From 7fb7693004160bccff13b8d65ada815d93bb2385 Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Thu, 8 Aug 2019 21:54:17 +0200 +Subject: i2c: emev2: avoid race when unregistering slave client + +[ Upstream commit d7437fc0d8291181debe032671a289b6bd93f46f ] + +After we disabled interrupts, there might still be an active one +running. Sync before clearing the pointer to the slave device. + +Fixes: c31d0a00021d ("i2c: emev2: add slave support") +Reported-by: Krzysztof Adamski +Signed-off-by: Wolfram Sang +Reviewed-by: Krzysztof Adamski +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-emev2.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-emev2.c b/drivers/i2c/busses/i2c-emev2.c +index d2e84480fbe96..dd97e5d9f49a2 100644 +--- a/drivers/i2c/busses/i2c-emev2.c ++++ b/drivers/i2c/busses/i2c-emev2.c +@@ -72,6 +72,7 @@ struct em_i2c_device { + struct completion msg_done; + struct clk *sclk; + struct i2c_client *slave; ++ int irq; + }; + + static inline void em_clear_set_bit(struct em_i2c_device *priv, u8 clear, u8 set, u8 reg) +@@ -342,6 +343,12 @@ static int em_i2c_unreg_slave(struct i2c_client *slave) + + writeb(0, priv->base + I2C_OFS_SVA0); + ++ /* ++ * Wait for interrupt to finish. New slave irqs cannot happen because we ++ * cleared the slave address and, thus, only extension codes will be ++ * detected which do not use the slave ptr. ++ */ ++ synchronize_irq(priv->irq); + priv->slave = NULL; + + return 0; +@@ -358,7 +365,7 @@ static int em_i2c_probe(struct platform_device *pdev) + { + struct em_i2c_device *priv; + struct resource *r; +- int irq, ret; ++ int ret; + + priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL); + if (!priv) +@@ -393,8 +400,8 @@ static int em_i2c_probe(struct platform_device *pdev) + + em_i2c_reset(&priv->adap); + +- irq = platform_get_irq(pdev, 0); +- ret = devm_request_irq(&pdev->dev, irq, em_i2c_irq_handler, 0, ++ priv->irq = platform_get_irq(pdev, 0); ++ ret = devm_request_irq(&pdev->dev, priv->irq, em_i2c_irq_handler, 0, + "em_i2c", priv); + if (ret) + goto err_clk; +@@ -404,7 +411,8 @@ static int em_i2c_probe(struct platform_device *pdev) + if (ret) + goto err_clk; + +- dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr, irq); ++ dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr, ++ priv->irq); + + return 0; + +-- +2.20.1 + diff --git a/queue-4.14/i2c-rcar-avoid-race-when-unregistering-slave-client.patch b/queue-4.14/i2c-rcar-avoid-race-when-unregistering-slave-client.patch new file mode 100644 index 00000000000..0ba2157605c --- /dev/null +++ b/queue-4.14/i2c-rcar-avoid-race-when-unregistering-slave-client.patch @@ -0,0 +1,70 @@ +From 5c67e498ff6bfab272fa9419a82591127caf4230 Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Thu, 8 Aug 2019 21:39:10 +0200 +Subject: i2c: rcar: avoid race when unregistering slave client + +[ Upstream commit 7b814d852af6944657c2961039f404c4490771c0 ] + +After we disabled interrupts, there might still be an active one +running. Sync before clearing the pointer to the slave device. + +Fixes: de20d1857dd6 ("i2c: rcar: add slave support") +Reported-by: Krzysztof Adamski +Signed-off-by: Wolfram Sang +Reviewed-by: Krzysztof Adamski +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rcar.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index 3415733a93645..132c4a405bf83 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -144,6 +144,7 @@ struct rcar_i2c_priv { + enum dma_data_direction dma_direction; + + struct reset_control *rstc; ++ int irq; + }; + + #define rcar_i2c_priv_to_dev(p) ((p)->adap.dev.parent) +@@ -813,9 +814,11 @@ static int rcar_unreg_slave(struct i2c_client *slave) + + WARN_ON(!priv->slave); + ++ /* disable irqs and ensure none is running before clearing ptr */ + rcar_i2c_write(priv, ICSIER, 0); + rcar_i2c_write(priv, ICSCR, 0); + ++ synchronize_irq(priv->irq); + priv->slave = NULL; + + pm_runtime_put(rcar_i2c_priv_to_dev(priv)); +@@ -866,7 +869,7 @@ static int rcar_i2c_probe(struct platform_device *pdev) + struct i2c_adapter *adap; + struct device *dev = &pdev->dev; + struct i2c_timings i2c_t; +- int irq, ret; ++ int ret; + + priv = devm_kzalloc(dev, sizeof(struct rcar_i2c_priv), GFP_KERNEL); + if (!priv) +@@ -927,10 +930,10 @@ static int rcar_i2c_probe(struct platform_device *pdev) + pm_runtime_put(dev); + + +- irq = platform_get_irq(pdev, 0); +- ret = devm_request_irq(dev, irq, rcar_i2c_irq, 0, dev_name(dev), priv); ++ priv->irq = platform_get_irq(pdev, 0); ++ ret = devm_request_irq(dev, priv->irq, rcar_i2c_irq, 0, dev_name(dev), priv); + if (ret < 0) { +- dev_err(dev, "cannot get irq %d\n", irq); ++ dev_err(dev, "cannot get irq %d\n", priv->irq); + goto out_pm_disable; + } + +-- +2.20.1 + diff --git a/queue-4.14/iommu-dma-handle-sg-length-overflow-better.patch b/queue-4.14/iommu-dma-handle-sg-length-overflow-better.patch new file mode 100644 index 00000000000..27cc65bb85f --- /dev/null +++ b/queue-4.14/iommu-dma-handle-sg-length-overflow-better.patch @@ -0,0 +1,45 @@ +From 2f83769d3ef83676838820d4ccf252d2ba7454ff Mon Sep 17 00:00:00 2001 +From: Robin Murphy +Date: Mon, 29 Jul 2019 17:46:00 +0100 +Subject: iommu/dma: Handle SG length overflow better + +[ Upstream commit ab2cbeb0ed301a9f0460078e91b09f39958212ef ] + +Since scatterlist dimensions are all unsigned ints, in the relatively +rare cases where a device's max_segment_size is set to UINT_MAX, then +the "cur_len + s_length <= max_len" check in __finalise_sg() will always +return true. As a result, the corner case of such a device mapping an +excessively large scatterlist which is mergeable to or beyond a total +length of 4GB can lead to overflow and a bogus truncated dma_length in +the resulting segment. + +As we already assume that any single segment must be no longer than +max_len to begin with, this can easily be addressed by reshuffling the +comparison. + +Fixes: 809eac54cdd6 ("iommu/dma: Implement scatterlist segment merging") +Reported-by: Nicolin Chen +Tested-by: Nicolin Chen +Signed-off-by: Robin Murphy +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/dma-iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c +index 9d1cebe7f6cbb..c87764a4e2126 100644 +--- a/drivers/iommu/dma-iommu.c ++++ b/drivers/iommu/dma-iommu.c +@@ -684,7 +684,7 @@ static int __finalise_sg(struct device *dev, struct scatterlist *sg, int nents, + * - and wouldn't make the resulting output segment too long + */ + if (cur_len && !s_iova_off && (dma_addr & seg_mask) && +- (cur_len + s_length <= max_len)) { ++ (max_len - cur_len >= s_length)) { + /* ...then concatenate it with the previous one */ + cur_len += s_length; + } else { +-- +2.20.1 + diff --git a/queue-4.14/scsi-ufs-fix-rx_termination_force_enable-define-valu.patch b/queue-4.14/scsi-ufs-fix-rx_termination_force_enable-define-valu.patch new file mode 100644 index 00000000000..079334e83e4 --- /dev/null +++ b/queue-4.14/scsi-ufs-fix-rx_termination_force_enable-define-valu.patch @@ -0,0 +1,34 @@ +From c94ece35822be7248fb4bd231cbfbf9d6de4eb15 Mon Sep 17 00:00:00 2001 +From: Pedro Sousa +Date: Thu, 18 Apr 2019 21:13:34 +0200 +Subject: scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value + +[ Upstream commit ebcb8f8508c5edf428f52525cec74d28edea7bcb ] + +Fix RX_TERMINATION_FORCE_ENABLE define value from 0x0089 to 0x00A9 +according to MIPI Alliance MPHY specification. + +Fixes: e785060ea3a1 ("ufs: definitions for phy interface") +Signed-off-by: Pedro Sousa +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/unipro.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/ufs/unipro.h b/drivers/scsi/ufs/unipro.h +index 23129d7b2678d..c77e365264478 100644 +--- a/drivers/scsi/ufs/unipro.h ++++ b/drivers/scsi/ufs/unipro.h +@@ -52,7 +52,7 @@ + #define RX_HS_UNTERMINATED_ENABLE 0x00A6 + #define RX_ENTER_HIBERN8 0x00A7 + #define RX_BYPASS_8B10B_ENABLE 0x00A8 +-#define RX_TERMINATION_FORCE_ENABLE 0x0089 ++#define RX_TERMINATION_FORCE_ENABLE 0x00A9 + #define RX_MIN_ACTIVATETIME_CAPABILITY 0x008F + #define RX_HIBERN8TIME_CAPABILITY 0x0092 + #define RX_REFCLKFREQ 0x00EB +-- +2.20.1 + diff --git a/queue-4.14/series b/queue-4.14/series new file mode 100644 index 00000000000..30aa7f51509 --- /dev/null +++ b/queue-4.14/series @@ -0,0 +1,15 @@ +dmaengine-ste_dma40-fix-unneeded-variable-warning.patch +auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch +iommu-dma-handle-sg-length-overflow-better.patch +usb-gadget-composite-clear-suspended-on-reset-discon.patch +usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch +xen-blkback-fix-memory-leaks.patch +i2c-rcar-avoid-race-when-unregistering-slave-client.patch +i2c-emev2-avoid-race-when-unregistering-slave-client.patch +drm-ast-fixed-reboot-test-may-cause-system-hanged.patch +usb-host-fotg2-restart-hcd-after-port-reset.patch +tools-hv-fix-kvp-and-vss-daemons-exit-code.patch +watchdog-bcm2835_wdt-fix-module-autoload.patch +drm-bridge-tfp410-fix-memleak-in-get_modes.patch +scsi-ufs-fix-rx_termination_force_enable-define-valu.patch +drm-tilcdc-register-cpufreq-notifier-after-we-have-i.patch diff --git a/queue-4.14/tools-hv-fix-kvp-and-vss-daemons-exit-code.patch b/queue-4.14/tools-hv-fix-kvp-and-vss-daemons-exit-code.patch new file mode 100644 index 00000000000..a10e0cc04a7 --- /dev/null +++ b/queue-4.14/tools-hv-fix-kvp-and-vss-daemons-exit-code.patch @@ -0,0 +1,52 @@ +From f573b3ac50d2d5db2fd046b8b429e1aa7b63fd5b Mon Sep 17 00:00:00 2001 +From: Adrian Vladu +Date: Mon, 6 May 2019 16:50:58 +0000 +Subject: tools: hv: fix KVP and VSS daemons exit code + +[ Upstream commit b0995156071b0ff29a5902964a9dc8cfad6f81c0 ] + +HyperV KVP and VSS daemons should exit with 0 when the '--help' +or '-h' flags are used. + +Signed-off-by: Adrian Vladu + +Cc: "K. Y. Srinivasan" +Cc: Haiyang Zhang +Cc: Stephen Hemminger +Cc: Sasha Levin +Cc: Alessandro Pilotti +Signed-off-by: Sasha Levin +--- + tools/hv/hv_kvp_daemon.c | 2 ++ + tools/hv/hv_vss_daemon.c | 2 ++ + 2 files changed, 4 insertions(+) + +diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c +index 62c9a503ae052..0ef215061fb50 100644 +--- a/tools/hv/hv_kvp_daemon.c ++++ b/tools/hv/hv_kvp_daemon.c +@@ -1380,6 +1380,8 @@ int main(int argc, char *argv[]) + daemonize = 0; + break; + case 'h': ++ print_usage(argv); ++ exit(0); + default: + print_usage(argv); + exit(EXIT_FAILURE); +diff --git a/tools/hv/hv_vss_daemon.c b/tools/hv/hv_vss_daemon.c +index 34031a297f024..514d29966ac67 100644 +--- a/tools/hv/hv_vss_daemon.c ++++ b/tools/hv/hv_vss_daemon.c +@@ -172,6 +172,8 @@ int main(int argc, char *argv[]) + daemonize = 0; + break; + case 'h': ++ print_usage(argv); ++ exit(0); + default: + print_usage(argv); + exit(EXIT_FAILURE); +-- +2.20.1 + diff --git a/queue-4.14/usb-gadget-composite-clear-suspended-on-reset-discon.patch b/queue-4.14/usb-gadget-composite-clear-suspended-on-reset-discon.patch new file mode 100644 index 00000000000..dc6caaddeff --- /dev/null +++ b/queue-4.14/usb-gadget-composite-clear-suspended-on-reset-discon.patch @@ -0,0 +1,33 @@ +From f9fbb05d34246a84c11229f347a860ea068505f1 Mon Sep 17 00:00:00 2001 +From: Benjamin Herrenschmidt +Date: Fri, 26 Jul 2019 14:59:03 +1000 +Subject: usb: gadget: composite: Clear "suspended" on reset/disconnect + +[ Upstream commit 602fda17c7356bb7ae98467d93549057481d11dd ] + +In some cases, one can get out of suspend with a reset or +a disconnect followed by a reconnect. Previously we would +leave a stale suspended flag set. + +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/composite.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c +index b805962f51543..75c42393b64ba 100644 +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -2008,6 +2008,7 @@ void composite_disconnect(struct usb_gadget *gadget) + * disconnect callbacks? + */ + spin_lock_irqsave(&cdev->lock, flags); ++ cdev->suspended = 0; + if (cdev->config) + reset_config(cdev); + if (cdev->driver->disconnect) +-- +2.20.1 + diff --git a/queue-4.14/usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch b/queue-4.14/usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch new file mode 100644 index 00000000000..3a16f7ea781 --- /dev/null +++ b/queue-4.14/usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch @@ -0,0 +1,168 @@ +From f98d34e9bcb09c44c325d18aa4f4626f68accb3f Mon Sep 17 00:00:00 2001 +From: Benjamin Herrenschmidt +Date: Fri, 26 Jul 2019 14:59:04 +1000 +Subject: usb: gadget: mass_storage: Fix races between fsg_disable and + fsg_set_alt + +[ Upstream commit 4a56a478a525d6427be90753451c40e1327caa1a ] + +If fsg_disable() and fsg_set_alt() are called too closely to each +other (for example due to a quick reset/reconnect), what can happen +is that fsg_set_alt sets common->new_fsg from an interrupt while +handle_exception is trying to process the config change caused by +fsg_disable(): + + fsg_disable() + ... + handle_exception() + sets state back to FSG_STATE_NORMAL + hasn't yet called do_set_interface() + or is inside it. + + ---> interrupt + fsg_set_alt + sets common->new_fsg + queues a new FSG_STATE_CONFIG_CHANGE + <--- + +Now, the first handle_exception can "see" the updated +new_fsg, treats it as if it was a fsg_set_alt() response, +call usb_composite_setup_continue() etc... + +But then, the thread sees the second FSG_STATE_CONFIG_CHANGE, +and goes back down the same path, wipes and reattaches a now +active fsg, and .. calls usb_composite_setup_continue() which +at this point is wrong. + +Not only we get a backtrace, but I suspect the second set_interface +wrecks some state causing the host to get upset in my case. + +This fixes it by replacing "new_fsg" by a "state argument" (same +principle) which is set in the same lock section as the state +update, and retrieved similarly. + +That way, there is never any discrepancy between the dequeued +state and the observed value of it. We keep the ability to have +the latest reconfig operation take precedence, but we guarantee +that once "dequeued" the argument (new_fsg) will not be clobbered +by any new event. + +Signed-off-by: Benjamin Herrenschmidt +Acked-by: Alan Stern +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_mass_storage.c | 28 +++++++++++++------- + 1 file changed, 18 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c +index 25ba303295332..41b5baa1f43b7 100644 +--- a/drivers/usb/gadget/function/f_mass_storage.c ++++ b/drivers/usb/gadget/function/f_mass_storage.c +@@ -261,7 +261,7 @@ struct fsg_common; + struct fsg_common { + struct usb_gadget *gadget; + struct usb_composite_dev *cdev; +- struct fsg_dev *fsg, *new_fsg; ++ struct fsg_dev *fsg; + wait_queue_head_t io_wait; + wait_queue_head_t fsg_wait; + +@@ -290,6 +290,7 @@ struct fsg_common { + unsigned int bulk_out_maxpacket; + enum fsg_state state; /* For exception handling */ + unsigned int exception_req_tag; ++ void *exception_arg; + + enum data_direction data_dir; + u32 data_size; +@@ -393,7 +394,8 @@ static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep) + + /* These routines may be called in process context or in_irq */ + +-static void raise_exception(struct fsg_common *common, enum fsg_state new_state) ++static void __raise_exception(struct fsg_common *common, enum fsg_state new_state, ++ void *arg) + { + unsigned long flags; + +@@ -406,6 +408,7 @@ static void raise_exception(struct fsg_common *common, enum fsg_state new_state) + if (common->state <= new_state) { + common->exception_req_tag = common->ep0_req_tag; + common->state = new_state; ++ common->exception_arg = arg; + if (common->thread_task) + send_sig_info(SIGUSR1, SEND_SIG_FORCED, + common->thread_task); +@@ -413,6 +416,10 @@ static void raise_exception(struct fsg_common *common, enum fsg_state new_state) + spin_unlock_irqrestore(&common->lock, flags); + } + ++static void raise_exception(struct fsg_common *common, enum fsg_state new_state) ++{ ++ __raise_exception(common, new_state, NULL); ++} + + /*-------------------------------------------------------------------------*/ + +@@ -2287,16 +2294,16 @@ reset: + static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt) + { + struct fsg_dev *fsg = fsg_from_func(f); +- fsg->common->new_fsg = fsg; +- raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE); ++ ++ __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, fsg); + return USB_GADGET_DELAYED_STATUS; + } + + static void fsg_disable(struct usb_function *f) + { + struct fsg_dev *fsg = fsg_from_func(f); +- fsg->common->new_fsg = NULL; +- raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE); ++ ++ __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL); + } + + +@@ -2309,6 +2316,7 @@ static void handle_exception(struct fsg_common *common) + enum fsg_state old_state; + struct fsg_lun *curlun; + unsigned int exception_req_tag; ++ struct fsg_dev *new_fsg; + + /* + * Clear the existing signals. Anything but SIGUSR1 is converted +@@ -2362,6 +2370,7 @@ static void handle_exception(struct fsg_common *common) + common->next_buffhd_to_fill = &common->buffhds[0]; + common->next_buffhd_to_drain = &common->buffhds[0]; + exception_req_tag = common->exception_req_tag; ++ new_fsg = common->exception_arg; + old_state = common->state; + common->state = FSG_STATE_NORMAL; + +@@ -2415,8 +2424,8 @@ static void handle_exception(struct fsg_common *common) + break; + + case FSG_STATE_CONFIG_CHANGE: +- do_set_interface(common, common->new_fsg); +- if (common->new_fsg) ++ do_set_interface(common, new_fsg); ++ if (new_fsg) + usb_composite_setup_continue(common->cdev); + break; + +@@ -3007,8 +3016,7 @@ static void fsg_unbind(struct usb_configuration *c, struct usb_function *f) + + DBG(fsg, "unbind\n"); + if (fsg->common->fsg == fsg) { +- fsg->common->new_fsg = NULL; +- raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE); ++ __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL); + /* FIXME: make interruptible or killable somehow? */ + wait_event(common->fsg_wait, common->fsg != fsg); + } +-- +2.20.1 + diff --git a/queue-4.14/usb-host-fotg2-restart-hcd-after-port-reset.patch b/queue-4.14/usb-host-fotg2-restart-hcd-after-port-reset.patch new file mode 100644 index 00000000000..209c6c5bbf9 --- /dev/null +++ b/queue-4.14/usb-host-fotg2-restart-hcd-after-port-reset.patch @@ -0,0 +1,37 @@ +From 7e7d16b40733aabd133af1ba0df8950ad6b94659 Mon Sep 17 00:00:00 2001 +From: Hans Ulli Kroll +Date: Sat, 10 Aug 2019 17:04:58 +0200 +Subject: usb: host: fotg2: restart hcd after port reset + +[ Upstream commit 777758888ffe59ef754cc39ab2f275dc277732f4 ] + +On the Gemini SoC the FOTG2 stalls after port reset +so restart the HCD after each port reset. + +Signed-off-by: Hans Ulli Kroll +Signed-off-by: Linus Walleij +Link: https://lore.kernel.org/r/20190810150458.817-1-linus.walleij@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/fotg210-hcd.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c +index 457cc6525abd6..aa21036828084 100644 +--- a/drivers/usb/host/fotg210-hcd.c ++++ b/drivers/usb/host/fotg210-hcd.c +@@ -1652,6 +1652,10 @@ static int fotg210_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + /* see what we found out */ + temp = check_reset_complete(fotg210, wIndex, status_reg, + fotg210_readl(fotg210, status_reg)); ++ ++ /* restart schedule */ ++ fotg210->command |= CMD_RUN; ++ fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command); + } + + if (!(temp & (PORT_RESUME|PORT_RESET))) { +-- +2.20.1 + diff --git a/queue-4.14/watchdog-bcm2835_wdt-fix-module-autoload.patch b/queue-4.14/watchdog-bcm2835_wdt-fix-module-autoload.patch new file mode 100644 index 00000000000..c06153cf634 --- /dev/null +++ b/queue-4.14/watchdog-bcm2835_wdt-fix-module-autoload.patch @@ -0,0 +1,35 @@ +From f87117b85eb5d2f9706b350f5a5321f061e1313f Mon Sep 17 00:00:00 2001 +From: Stefan Wahren +Date: Wed, 15 May 2019 19:14:18 +0200 +Subject: watchdog: bcm2835_wdt: Fix module autoload + +[ Upstream commit 215e06f0d18d5d653d6ea269e4dfc684854d48bf ] + +The commit 5e6acc3e678e ("bcm2835-pm: Move bcm2835-watchdog's DT probe +to an MFD.") broke module autoloading on Raspberry Pi. So add a +module alias this fix this. + +Signed-off-by: Stefan Wahren +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/bcm2835_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c +index b339e0e67b4c1..adb699145a071 100644 +--- a/drivers/watchdog/bcm2835_wdt.c ++++ b/drivers/watchdog/bcm2835_wdt.c +@@ -252,6 +252,7 @@ module_param(nowayout, bool, 0); + MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" + __MODULE_STRING(WATCHDOG_NOWAYOUT) ")"); + ++MODULE_ALIAS("platform:bcm2835-wdt"); + MODULE_AUTHOR("Lubomir Rintel "); + MODULE_DESCRIPTION("Driver for Broadcom BCM2835 watchdog timer"); + MODULE_LICENSE("GPL"); +-- +2.20.1 + diff --git a/queue-4.14/xen-blkback-fix-memory-leaks.patch b/queue-4.14/xen-blkback-fix-memory-leaks.patch new file mode 100644 index 00000000000..0729af1eab2 --- /dev/null +++ b/queue-4.14/xen-blkback-fix-memory-leaks.patch @@ -0,0 +1,59 @@ +From 8b8be3a2433c03e6a8778195b1e7a675e95eecbb Mon Sep 17 00:00:00 2001 +From: Wenwen Wang +Date: Sun, 11 Aug 2019 12:23:22 -0500 +Subject: xen/blkback: fix memory leaks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit ae78ca3cf3d9e9f914bfcd0bc5c389ff18b9c2e0 ] + +In read_per_ring_refs(), after 'req' and related memory regions are +allocated, xen_blkif_map() is invoked to map the shared frame, irq, and +etc. However, if this mapping process fails, no cleanup is performed, +leading to memory leaks. To fix this issue, invoke the cleanup before +returning the error. + +Acked-by: Roger Pau Monné +Reviewed-by: Boris Ostrovsky +Signed-off-by: Wenwen Wang +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/xen-blkback/xenbus.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c +index 21c1be1eb2260..ed4e807791243 100644 +--- a/drivers/block/xen-blkback/xenbus.c ++++ b/drivers/block/xen-blkback/xenbus.c +@@ -973,6 +973,7 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir) + } + blkif->nr_ring_pages = nr_grefs; + ++ err = -ENOMEM; + for (i = 0; i < nr_grefs * XEN_BLKIF_REQS_PER_PAGE; i++) { + req = kzalloc(sizeof(*req), GFP_KERNEL); + if (!req) +@@ -995,7 +996,7 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir) + err = xen_blkif_map(ring, ring_ref, nr_grefs, evtchn); + if (err) { + xenbus_dev_fatal(dev, err, "mapping ring-ref port %u", evtchn); +- return err; ++ goto fail; + } + + return 0; +@@ -1015,8 +1016,7 @@ fail: + } + kfree(req); + } +- return -ENOMEM; +- ++ return err; + } + + static int connect_ring(struct backend_info *be) +-- +2.20.1 + -- 2.47.3