From: Sasha Levin Date: Mon, 20 Jul 2020 03:53:05 +0000 (-0400) Subject: Fixes for 4.19 X-Git-Tag: v4.4.231~50 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=01122690b236545bd63df05561af7e80b80ac9b4;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/arm-dts-socfpga-align-l2-cache-controller-nodename-w.patch b/queue-4.19/arm-dts-socfpga-align-l2-cache-controller-nodename-w.patch new file mode 100644 index 00000000000..e90adf4e8fb --- /dev/null +++ b/queue-4.19/arm-dts-socfpga-align-l2-cache-controller-nodename-w.patch @@ -0,0 +1,51 @@ +From aeb5da6515a630eea160074124e4a47f6badbe68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jun 2020 10:06:02 +0200 +Subject: ARM: dts: socfpga: Align L2 cache-controller nodename with dtschema + +From: Krzysztof Kozlowski + +[ Upstream commit d7adfe5ffed9faa05f8926223086b101e14f700d ] + +Fix dtschema validator warnings like: + l2-cache@fffff000: $nodename:0: + 'l2-cache@fffff000' does not match '^(cache-controller|cpu)(@[0-9a-f,]+)*$' + +Fixes: 475dc86d08de ("arm: dts: socfpga: Add a base DTSI for Altera's Arria10 SOC") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Dinh Nguyen +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/socfpga.dtsi | 2 +- + arch/arm/boot/dts/socfpga_arria10.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi +index b38f8c2405580..602511ccad6f6 100644 +--- a/arch/arm/boot/dts/socfpga.dtsi ++++ b/arch/arm/boot/dts/socfpga.dtsi +@@ -710,7 +710,7 @@ ocram-ecc@ffd08144 { + }; + }; + +- L2: l2-cache@fffef000 { ++ L2: cache-controller@fffef000 { + compatible = "arm,pl310-cache"; + reg = <0xfffef000 0x1000>; + interrupts = <0 38 0x04>; +diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi +index b4dd3846e8cc9..ba5657574d9bb 100644 +--- a/arch/arm/boot/dts/socfpga_arria10.dtsi ++++ b/arch/arm/boot/dts/socfpga_arria10.dtsi +@@ -618,7 +618,7 @@ sdr: sdr@ffcfb100 { + reg = <0xffcfb100 0x80>; + }; + +- L2: l2-cache@fffff000 { ++ L2: cache-controller@fffff000 { + compatible = "arm,pl310-cache"; + reg = <0xfffff000 0x1000>; + interrupts = <0 18 IRQ_TYPE_LEVEL_HIGH>; +-- +2.25.1 + diff --git a/queue-4.19/arm64-dts-meson-add-missing-gxl-rng-clock.patch b/queue-4.19/arm64-dts-meson-add-missing-gxl-rng-clock.patch new file mode 100644 index 00000000000..3bfd2b5ecb3 --- /dev/null +++ b/queue-4.19/arm64-dts-meson-add-missing-gxl-rng-clock.patch @@ -0,0 +1,41 @@ +From 5d0c3d363ca1fc4bf421d4ad5acaa35b71d2bd21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 14:53:46 +0200 +Subject: arm64: dts: meson: add missing gxl rng clock + +From: Jerome Brunet + +[ Upstream commit 95ca6f06dd4827ff63be5154120c7a8511cd9a41 ] + +The peripheral clock of the RNG is missing for gxl while it is present +for gxbb. + +Fixes: 1b3f6d148692 ("ARM64: dts: meson-gx: add clock CLKID_RNG0 to hwrng node") +Signed-off-by: Jerome Brunet +Signed-off-by: Kevin Hilman +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20200617125346.1163527-1-jbrunet@baylibre.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +index 8f0bb3c44bd6d..5d7724b3a6123 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +@@ -266,6 +266,11 @@ clkc: clock-controller { + }; + }; + ++&hwrng { ++ clocks = <&clkc CLKID_RNG0>; ++ clock-names = "core"; ++}; ++ + &i2c_A { + clocks = <&clkc CLKID_I2C>; + }; +-- +2.25.1 + diff --git a/queue-4.19/iio-health-afe4404-fix-timestamp-alignment-and-preve.patch b/queue-4.19/iio-health-afe4404-fix-timestamp-alignment-and-preve.patch new file mode 100644 index 00000000000..0c53b1ad089 --- /dev/null +++ b/queue-4.19/iio-health-afe4404-fix-timestamp-alignment-and-preve.patch @@ -0,0 +1,73 @@ +From d50b0e63b04f08d0cbbf8085ca96f469180682cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 May 2020 18:29:57 +0100 +Subject: iio:health:afe4404 Fix timestamp alignment and prevent data leak. + +From: Jonathan Cameron + +[ Upstream commit f88ecccac4be348bbcc6d056bdbc622a8955c04d ] + +One of a class of bugs pointed out by Lars in a recent review. +iio_push_to_buffers_with_timestamp assumes the buffer used is aligned +to the size of the timestamp (8 bytes). This is not guaranteed in +this driver which uses a 40 byte array of smaller elements on the stack. +As Lars also noted this anti pattern can involve a leak of data to +userspace and that indeed can happen here. We close both issues by +moving to a suitable structure in the iio_priv() data with alignment +explicitly requested. This data is allocated with kzalloc so no +data can leak appart from previous readings. + +Fixes: 87aec56e27ef ("iio: health: Add driver for the TI AFE4404 heart monitor") +Reported-by: Lars-Peter Clausen +Signed-off-by: Jonathan Cameron +Acked-by: Andrew F. Davis +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/health/afe4404.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/iio/health/afe4404.c b/drivers/iio/health/afe4404.c +index 11910922e6556..23e1ac6501a1a 100644 +--- a/drivers/iio/health/afe4404.c ++++ b/drivers/iio/health/afe4404.c +@@ -91,6 +91,7 @@ static const struct reg_field afe4404_reg_fields[] = { + * @regulator: Pointer to the regulator for the IC + * @trig: IIO trigger for this device + * @irq: ADC_RDY line interrupt number ++ * @buffer: Used to construct a scan to push to the iio buffer. + */ + struct afe4404_data { + struct device *dev; +@@ -99,6 +100,7 @@ struct afe4404_data { + struct regulator *regulator; + struct iio_trigger *trig; + int irq; ++ s32 buffer[10] __aligned(8); + }; + + enum afe4404_chan_id { +@@ -336,17 +338,17 @@ static irqreturn_t afe4404_trigger_handler(int irq, void *private) + struct iio_dev *indio_dev = pf->indio_dev; + struct afe4404_data *afe = iio_priv(indio_dev); + int ret, bit, i = 0; +- s32 buffer[10]; + + for_each_set_bit(bit, indio_dev->active_scan_mask, + indio_dev->masklength) { + ret = regmap_read(afe->regmap, afe4404_channel_values[bit], +- &buffer[i++]); ++ &afe->buffer[i++]); + if (ret) + goto err; + } + +- iio_push_to_buffers_with_timestamp(indio_dev, buffer, pf->timestamp); ++ iio_push_to_buffers_with_timestamp(indio_dev, afe->buffer, ++ pf->timestamp); + err: + iio_trigger_notify_done(indio_dev->trig); + +-- +2.25.1 + diff --git a/queue-4.19/phy-sun4i-usb-fix-dereference-of-pointer-phy0-before.patch b/queue-4.19/phy-sun4i-usb-fix-dereference-of-pointer-phy0-before.patch new file mode 100644 index 00000000000..9faf34090ac --- /dev/null +++ b/queue-4.19/phy-sun4i-usb-fix-dereference-of-pointer-phy0-before.patch @@ -0,0 +1,50 @@ +From d1758a60576ed6c651b4f2027fd9247dab0878d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jun 2020 13:44:28 +0100 +Subject: phy: sun4i-usb: fix dereference of pointer phy0 before it is null + checked + +From: Colin Ian King + +[ Upstream commit 38b1927e5bf9bcad4a2e33189ef1c5569f9599ba ] + +Currently pointer phy0 is being dereferenced via the assignment of +phy on the call to phy_get_drvdata before phy0 is null checked, this +can lead to a null pointer dereference. Fix this by performing the +null check on phy0 before the call to phy_get_drvdata. Also replace +the phy0 == NULL check with the more usual !phy0 idiom. + +Addresses-Coverity: ("Dereference before null check") +Fixes: e6f32efb1b12 ("phy: sun4i-usb: Make sure to disable PHY0 passby for peripheral mode") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20200625124428.83564-1-colin.king@canonical.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/allwinner/phy-sun4i-usb.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c +index 1f8809bab002c..920f61eff9cd4 100644 +--- a/drivers/phy/allwinner/phy-sun4i-usb.c ++++ b/drivers/phy/allwinner/phy-sun4i-usb.c +@@ -550,13 +550,14 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work) + struct sun4i_usb_phy_data *data = + container_of(work, struct sun4i_usb_phy_data, detect.work); + struct phy *phy0 = data->phys[0].phy; +- struct sun4i_usb_phy *phy = phy_get_drvdata(phy0); ++ struct sun4i_usb_phy *phy; + bool force_session_end, id_notify = false, vbus_notify = false; + int id_det, vbus_det; + +- if (phy0 == NULL) ++ if (!phy0) + return; + ++ phy = phy_get_drvdata(phy0); + id_det = sun4i_usb_phy0_get_id_det(data); + vbus_det = sun4i_usb_phy0_get_vbus_det(data); + +-- +2.25.1 + diff --git a/queue-4.19/regmap-debugfs-don-t-sleep-while-atomic-for-fast_io-.patch b/queue-4.19/regmap-debugfs-don-t-sleep-while-atomic-for-fast_io-.patch new file mode 100644 index 00000000000..aa9f144b5b4 --- /dev/null +++ b/queue-4.19/regmap-debugfs-don-t-sleep-while-atomic-for-fast_io-.patch @@ -0,0 +1,137 @@ +From fbed18aff22b8a702f2e408942574470ebbdbb8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jul 2020 16:46:15 -0700 +Subject: regmap: debugfs: Don't sleep while atomic for fast_io regmaps + +From: Douglas Anderson + +[ Upstream commit 299632e54b2e692d2830af84be51172480dc1e26 ] + +If a regmap has "fast_io" set then its lock function uses a spinlock. +That doesn't work so well with the functions: +* regmap_cache_only_write_file() +* regmap_cache_bypass_write_file() + +Both of the above functions have the pattern: +1. Lock the regmap. +2. Call: + debugfs_write_file_bool() + copy_from_user() + __might_fault() + __might_sleep() + +Let's reorder things a bit so that we do all of our sleepable +functions before we grab the lock. + +Fixes: d3dc5430d68f ("regmap: debugfs: Allow writes to cache state settings") +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20200715164611.1.I35b3533e8a80efde0cec1cc70f71e1e74b2fa0da@changeid +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap-debugfs.c | 52 ++++++++++++++++------------ + 1 file changed, 29 insertions(+), 23 deletions(-) + +diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c +index c9687c8b23478..056e34ce1eddd 100644 +--- a/drivers/base/regmap/regmap-debugfs.c ++++ b/drivers/base/regmap/regmap-debugfs.c +@@ -453,29 +453,31 @@ static ssize_t regmap_cache_only_write_file(struct file *file, + { + struct regmap *map = container_of(file->private_data, + struct regmap, cache_only); +- ssize_t result; +- bool was_enabled, require_sync = false; ++ bool new_val, require_sync = false; + int err; + +- map->lock(map->lock_arg); ++ err = kstrtobool_from_user(user_buf, count, &new_val); ++ /* Ignore malforned data like debugfs_write_file_bool() */ ++ if (err) ++ return count; + +- was_enabled = map->cache_only; ++ err = debugfs_file_get(file->f_path.dentry); ++ if (err) ++ return err; + +- result = debugfs_write_file_bool(file, user_buf, count, ppos); +- if (result < 0) { +- map->unlock(map->lock_arg); +- return result; +- } ++ map->lock(map->lock_arg); + +- if (map->cache_only && !was_enabled) { ++ if (new_val && !map->cache_only) { + dev_warn(map->dev, "debugfs cache_only=Y forced\n"); + add_taint(TAINT_USER, LOCKDEP_STILL_OK); +- } else if (!map->cache_only && was_enabled) { ++ } else if (!new_val && map->cache_only) { + dev_warn(map->dev, "debugfs cache_only=N forced: syncing cache\n"); + require_sync = true; + } ++ map->cache_only = new_val; + + map->unlock(map->lock_arg); ++ debugfs_file_put(file->f_path.dentry); + + if (require_sync) { + err = regcache_sync(map); +@@ -483,7 +485,7 @@ static ssize_t regmap_cache_only_write_file(struct file *file, + dev_err(map->dev, "Failed to sync cache %d\n", err); + } + +- return result; ++ return count; + } + + static const struct file_operations regmap_cache_only_fops = { +@@ -498,28 +500,32 @@ static ssize_t regmap_cache_bypass_write_file(struct file *file, + { + struct regmap *map = container_of(file->private_data, + struct regmap, cache_bypass); +- ssize_t result; +- bool was_enabled; ++ bool new_val; ++ int err; + +- map->lock(map->lock_arg); ++ err = kstrtobool_from_user(user_buf, count, &new_val); ++ /* Ignore malforned data like debugfs_write_file_bool() */ ++ if (err) ++ return count; + +- was_enabled = map->cache_bypass; ++ err = debugfs_file_get(file->f_path.dentry); ++ if (err) ++ return err; + +- result = debugfs_write_file_bool(file, user_buf, count, ppos); +- if (result < 0) +- goto out; ++ map->lock(map->lock_arg); + +- if (map->cache_bypass && !was_enabled) { ++ if (new_val && !map->cache_bypass) { + dev_warn(map->dev, "debugfs cache_bypass=Y forced\n"); + add_taint(TAINT_USER, LOCKDEP_STILL_OK); +- } else if (!map->cache_bypass && was_enabled) { ++ } else if (!new_val && map->cache_bypass) { + dev_warn(map->dev, "debugfs cache_bypass=N forced\n"); + } ++ map->cache_bypass = new_val; + +-out: + map->unlock(map->lock_arg); ++ debugfs_file_put(file->f_path.dentry); + +- return result; ++ return count; + } + + static const struct file_operations regmap_cache_bypass_fops = { +-- +2.25.1 + diff --git a/queue-4.19/revert-thermal-mediatek-fix-register-index-error.patch b/queue-4.19/revert-thermal-mediatek-fix-register-index-error.patch new file mode 100644 index 00000000000..328f3905cc7 --- /dev/null +++ b/queue-4.19/revert-thermal-mediatek-fix-register-index-error.patch @@ -0,0 +1,130 @@ +From a7f1a2281a6cd4e03ca2273eb90a65809d94d979 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jul 2020 12:34:12 +0200 +Subject: Revert "thermal: mediatek: fix register index error" + +From: Enric Balletbo i Serra + +[ Upstream commit a8f62f183021be389561570ab5f8c701a5e70298 ] + +This reverts commit eb9aecd90d1a39601e91cd08b90d5fee51d321a6 + +The above patch is supposed to fix a register index error on mt2701. It +is not clear if the problem solved is a hang or just an invalid value +returned, my guess is the second. The patch introduces, though, a new +hang on MT8173 device making them unusable. So, seems reasonable, revert +the patch because introduces a worst issue. + +The reason I send a revert instead of trying to fix the issue for MT8173 +is because the information needed to fix the issue is in the datasheet +and is not public. So I am not really able to fix it. + +Fixes the following bug when CONFIG_MTK_THERMAL is set on MT8173 +devices. + +[ 2.222488] Unable to handle kernel paging request at virtual address ffff8000125f5001 +[ 2.230421] Mem abort info: +[ 2.233207] ESR = 0x96000021 +[ 2.236261] EC = 0x25: DABT (current EL), IL = 32 bits +[ 2.241571] SET = 0, FnV = 0 +[ 2.244623] EA = 0, S1PTW = 0 +[ 2.247762] Data abort info: +[ 2.250640] ISV = 0, ISS = 0x00000021 +[ 2.254473] CM = 0, WnR = 0 +[ 2.257544] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041850000 +[ 2.264251] [ffff8000125f5001] pgd=000000013ffff003, pud=000000013fffe003, pmd=000000013fff9003, pte=006800001100b707 +[ 2.274867] Internal error: Oops: 96000021 [#1] PREEMPT SMP +[ 2.280432] Modules linked in: +[ 2.283483] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.7.0-rc6+ #162 +[ 2.289914] Hardware name: Google Elm (DT) +[ 2.294003] pstate: 20000005 (nzCv daif -PAN -UAO) +[ 2.298792] pc : mtk_read_temp+0xb8/0x1c8 +[ 2.302793] lr : mtk_read_temp+0x7c/0x1c8 +[ 2.306794] sp : ffff80001003b930 +[ 2.310100] x29: ffff80001003b930 x28: 0000000000000000 +[ 2.315404] x27: 0000000000000002 x26: ffff0000f9550b10 +[ 2.320709] x25: ffff0000f9550a80 x24: 0000000000000090 +[ 2.326014] x23: ffff80001003ba24 x22: 00000000610344c0 +[ 2.331318] x21: 0000000000002710 x20: 00000000000001f4 +[ 2.336622] x19: 0000000000030d40 x18: ffff800011742ec0 +[ 2.341926] x17: 0000000000000001 x16: 0000000000000001 +[ 2.347230] x15: ffffffffffffffff x14: ffffff0000000000 +[ 2.352535] x13: ffffffffffffffff x12: 0000000000000028 +[ 2.357839] x11: 0000000000000003 x10: ffff800011295ec8 +[ 2.363143] x9 : 000000000000291b x8 : 0000000000000002 +[ 2.368447] x7 : 00000000000000a8 x6 : 0000000000000004 +[ 2.373751] x5 : 0000000000000000 x4 : ffff800011295cb0 +[ 2.379055] x3 : 0000000000000002 x2 : ffff8000125f5001 +[ 2.384359] x1 : 0000000000000001 x0 : ffff0000f9550a80 +[ 2.389665] Call trace: +[ 2.392105] mtk_read_temp+0xb8/0x1c8 +[ 2.395760] of_thermal_get_temp+0x2c/0x40 +[ 2.399849] thermal_zone_get_temp+0x78/0x160 +[ 2.404198] thermal_zone_device_update.part.0+0x3c/0x1f8 +[ 2.409589] thermal_zone_device_update+0x34/0x48 +[ 2.414286] of_thermal_set_mode+0x58/0x88 +[ 2.418375] thermal_zone_of_sensor_register+0x1a8/0x1d8 +[ 2.423679] devm_thermal_zone_of_sensor_register+0x64/0xb0 +[ 2.429242] mtk_thermal_probe+0x690/0x7d0 +[ 2.433333] platform_drv_probe+0x5c/0xb0 +[ 2.437335] really_probe+0xe4/0x448 +[ 2.440901] driver_probe_device+0xe8/0x140 +[ 2.445077] device_driver_attach+0x7c/0x88 +[ 2.449252] __driver_attach+0xac/0x178 +[ 2.453082] bus_for_each_dev+0x78/0xc8 +[ 2.456909] driver_attach+0x2c/0x38 +[ 2.460476] bus_add_driver+0x14c/0x230 +[ 2.464304] driver_register+0x6c/0x128 +[ 2.468131] __platform_driver_register+0x50/0x60 +[ 2.472831] mtk_thermal_driver_init+0x24/0x30 +[ 2.477268] do_one_initcall+0x50/0x298 +[ 2.481098] kernel_init_freeable+0x1ec/0x264 +[ 2.485450] kernel_init+0x1c/0x110 +[ 2.488931] ret_from_fork+0x10/0x1c +[ 2.492502] Code: f9401081 f9400402 b8a67821 8b010042 (b9400042) +[ 2.498599] ---[ end trace e43e3105ed27dc99 ]--- +[ 2.503367] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b +[ 2.511020] SMP: stopping secondary CPUs +[ 2.514941] Kernel Offset: disabled +[ 2.518421] CPU features: 0x090002,25006005 +[ 2.522595] Memory Limit: none +[ 2.525644] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]-- + +Cc: Michael Kao +Fixes: eb9aecd90d1a ("thermal: mediatek: fix register index error") +Signed-off-by: Enric Balletbo i Serra +Reviewed-by: Matthias Brugger +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20200707103412.1010823-1-enric.balletbo@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/thermal/mtk_thermal.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c +index f64643629d8b5..0691f260f6eab 100644 +--- a/drivers/thermal/mtk_thermal.c ++++ b/drivers/thermal/mtk_thermal.c +@@ -431,8 +431,7 @@ static int mtk_thermal_bank_temperature(struct mtk_thermal_bank *bank) + u32 raw; + + for (i = 0; i < conf->bank_data[bank->id].num_sensors; i++) { +- raw = readl(mt->thermal_base + +- conf->msr[conf->bank_data[bank->id].sensors[i]]); ++ raw = readl(mt->thermal_base + conf->msr[i]); + + temp = raw_to_mcelsius(mt, + conf->bank_data[bank->id].sensors[i], +@@ -569,8 +568,7 @@ static void mtk_thermal_init_bank(struct mtk_thermal *mt, int num, + + for (i = 0; i < conf->bank_data[num].num_sensors; i++) + writel(conf->sensor_mux_values[conf->bank_data[num].sensors[i]], +- mt->thermal_base + +- conf->adcpnp[conf->bank_data[num].sensors[i]]); ++ mt->thermal_base + conf->adcpnp[i]); + + writel((1 << conf->bank_data[num].num_sensors) - 1, + mt->thermal_base + TEMP_MONCTL0); +-- +2.25.1 + diff --git a/queue-4.19/series b/queue-4.19/series index 095d5500b6f..429c6e9f22c 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -57,3 +57,12 @@ alsa-usb-audio-add-registration-quirk-for-kingston-h.patch input-mms114-add-extra-compatible-for-mms345l.patch acpi-video-use-native-backlight-on-acer-travelmate-5.patch alsa-usb-audio-add-registration-quirk-for-kingston-h.patch-7751 +iio-health-afe4404-fix-timestamp-alignment-and-preve.patch +phy-sun4i-usb-fix-dereference-of-pointer-phy0-before.patch +arm64-dts-meson-add-missing-gxl-rng-clock.patch +spi-spi-sun6i-sun6i_spi_transfer_one-fix-setting-of-.patch +usb-gadget-udc-atmel-fix-uninitialized-read-in-debug.patch +staging-comedi-verify-array-index-is-correct-before-.patch +revert-thermal-mediatek-fix-register-index-error.patch +arm-dts-socfpga-align-l2-cache-controller-nodename-w.patch +regmap-debugfs-don-t-sleep-while-atomic-for-fast_io-.patch diff --git a/queue-4.19/spi-spi-sun6i-sun6i_spi_transfer_one-fix-setting-of-.patch b/queue-4.19/spi-spi-sun6i-sun6i_spi_transfer_one-fix-setting-of-.patch new file mode 100644 index 00000000000..f0d880baf5a --- /dev/null +++ b/queue-4.19/spi-spi-sun6i-sun6i_spi_transfer_one-fix-setting-of-.patch @@ -0,0 +1,70 @@ +From 50690a2557b4efc41c93f23fb6070f829bdda431 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jul 2020 16:34:34 +0200 +Subject: spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock rate + +From: Marc Kleine-Budde + +[ Upstream commit ed7815db70d17b1741883f2da8e1d80bc2efe517 ] + +A SPI transfer defines the _maximum_ speed of the SPI transfer. However the +driver doesn't take into account that the clock divider is always rounded down +(due to integer arithmetics). This results in a too high clock rate for the SPI +transfer. + +E.g.: with a mclk_rate of 24 MHz and a SPI transfer speed of 10 MHz, the +original code calculates a reg of "0", which results in a effective divider of +"2" and a 12 MHz clock for the SPI transfer. + +This patch fixes the issue by using DIV_ROUND_UP() instead of a plain +integer division. + +While there simplify the divider calculation for the CDR1 case, use +order_base_2() instead of two ilog2() calculations. + +Fixes: 3558fe900e8a ("spi: sunxi: Add Allwinner A31 SPI controller driver") +Signed-off-by: Marc Kleine-Budde +Acked-by: Maxime Ripard +Link: https://lore.kernel.org/r/20200706143443.9855-2-mkl@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-sun6i.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c +index 8533f4edd00af..21a22d42818c8 100644 +--- a/drivers/spi/spi-sun6i.c ++++ b/drivers/spi/spi-sun6i.c +@@ -202,7 +202,7 @@ static int sun6i_spi_transfer_one(struct spi_master *master, + struct spi_transfer *tfr) + { + struct sun6i_spi *sspi = spi_master_get_devdata(master); +- unsigned int mclk_rate, div, timeout; ++ unsigned int mclk_rate, div, div_cdr1, div_cdr2, timeout; + unsigned int start, end, tx_time; + unsigned int trig_level; + unsigned int tx_len = 0; +@@ -291,14 +291,12 @@ static int sun6i_spi_transfer_one(struct spi_master *master, + * First try CDR2, and if we can't reach the expected + * frequency, fall back to CDR1. + */ +- div = mclk_rate / (2 * tfr->speed_hz); +- if (div <= (SUN6I_CLK_CTL_CDR2_MASK + 1)) { +- if (div > 0) +- div--; +- +- reg = SUN6I_CLK_CTL_CDR2(div) | SUN6I_CLK_CTL_DRS; ++ div_cdr1 = DIV_ROUND_UP(mclk_rate, tfr->speed_hz); ++ div_cdr2 = DIV_ROUND_UP(div_cdr1, 2); ++ if (div_cdr2 <= (SUN6I_CLK_CTL_CDR2_MASK + 1)) { ++ reg = SUN6I_CLK_CTL_CDR2(div_cdr2 - 1) | SUN6I_CLK_CTL_DRS; + } else { +- div = ilog2(mclk_rate) - ilog2(tfr->speed_hz); ++ div = min(SUN6I_CLK_CTL_CDR1_MASK, order_base_2(div_cdr1)); + reg = SUN6I_CLK_CTL_CDR1(div); + } + +-- +2.25.1 + diff --git a/queue-4.19/staging-comedi-verify-array-index-is-correct-before-.patch b/queue-4.19/staging-comedi-verify-array-index-is-correct-before-.patch new file mode 100644 index 00000000000..832453ef767 --- /dev/null +++ b/queue-4.19/staging-comedi-verify-array-index-is-correct-before-.patch @@ -0,0 +1,54 @@ +From 290957a81165c1501637208dc1ba2ee1184e415e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jul 2020 13:29:36 +0300 +Subject: staging: comedi: verify array index is correct before using it + +From: Dan Carpenter + +[ Upstream commit ef75e14a6c935eec82abac07ab68e388514e39bc ] + +This code reads from the array before verifying that "trig" is a valid +index. If the index is wildly out of bounds then reading from an +invalid address could lead to an Oops. + +Fixes: a8c66b684efa ("staging: comedi: addi_apci_1500: rewrite the subdevice support functions") +Signed-off-by: Dan Carpenter +Reviewed-by: Ian Abbott +Link: https://lore.kernel.org/r/20200709102936.GA20875@mwanda +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/comedi/drivers/addi_apci_1500.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c +index 45ad4ba92f94f..689acd69a1b9c 100644 +--- a/drivers/staging/comedi/drivers/addi_apci_1500.c ++++ b/drivers/staging/comedi/drivers/addi_apci_1500.c +@@ -456,9 +456,9 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev, + unsigned int lo_mask = data[5] << shift; + unsigned int chan_mask = hi_mask | lo_mask; + unsigned int old_mask = (1 << shift) - 1; +- unsigned int pm = devpriv->pm[trig] & old_mask; +- unsigned int pt = devpriv->pt[trig] & old_mask; +- unsigned int pp = devpriv->pp[trig] & old_mask; ++ unsigned int pm; ++ unsigned int pt; ++ unsigned int pp; + + if (trig > 1) { + dev_dbg(dev->class_dev, +@@ -471,6 +471,10 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev, + return -EINVAL; + } + ++ pm = devpriv->pm[trig] & old_mask; ++ pt = devpriv->pt[trig] & old_mask; ++ pp = devpriv->pp[trig] & old_mask; ++ + switch (data[2]) { + case COMEDI_DIGITAL_TRIG_DISABLE: + /* clear trigger configuration */ +-- +2.25.1 + diff --git a/queue-4.19/usb-gadget-udc-atmel-fix-uninitialized-read-in-debug.patch b/queue-4.19/usb-gadget-udc-atmel-fix-uninitialized-read-in-debug.patch new file mode 100644 index 00000000000..d7473d45adb --- /dev/null +++ b/queue-4.19/usb-gadget-udc-atmel-fix-uninitialized-read-in-debug.patch @@ -0,0 +1,39 @@ +From 60e5bdfb55b286febd026e2311d3cba8ea85a89c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 May 2020 20:35:54 +0200 +Subject: usb: gadget: udc: atmel: fix uninitialized read in debug printk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Mirosław + +[ Upstream commit 30517ffeb3bff842e1355cbc32f1959d9dbb5414 ] + +Fixed commit moved the assignment of 'req', but did not update a +reference in the DBG() call. Use the argument as it was renamed. + +Fixes: 5fb694f96e7c ("usb: gadget: udc: atmel: fix possible oops when unloading module") +Signed-off-by: Michał Mirosław +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/atmel_usba_udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c +index a4ab230335786..23691a32759fe 100644 +--- a/drivers/usb/gadget/udc/atmel_usba_udc.c ++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c +@@ -860,7 +860,7 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req) + u32 status; + + DBG(DBG_GADGET | DBG_QUEUE, "ep_dequeue: %s, req %p\n", +- ep->ep.name, req); ++ ep->ep.name, _req); + + spin_lock_irqsave(&udc->lock, flags); + +-- +2.25.1 +