From: Sasha Levin Date: Mon, 20 Jul 2020 03:53:05 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v4.4.231~51 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=49434bf7f4f5d44f7632f0b96810581dcf61d0b9;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/arm-dts-fix-dcan-driver-probe-failed-on-am437x-platf.patch b/queue-5.4/arm-dts-fix-dcan-driver-probe-failed-on-am437x-platf.patch new file mode 100644 index 00000000000..505535a1144 --- /dev/null +++ b/queue-5.4/arm-dts-fix-dcan-driver-probe-failed-on-am437x-platf.patch @@ -0,0 +1,89 @@ +From 7c63665a921b945a5abc81494d6db30f135aed0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jul 2020 14:35:07 +0800 +Subject: ARM: dts: Fix dcan driver probe failed on am437x platform + +From: dillon min + +[ Upstream commit 2a4117df9b436a0e4c79d211284ab2097bcd00dc ] + +Got following d_can probe errors with kernel 5.8-rc1 on am437x + +[ 10.730822] CAN device driver interface +Starting Wait for Network to be Configured... +[ OK ] Reached target Network. +[ 10.787363] c_can_platform 481cc000.can: probe failed +[ 10.792484] c_can_platform: probe of 481cc000.can failed with error -2 +[ 10.799457] c_can_platform 481d0000.can: probe failed +[ 10.804617] c_can_platform: probe of 481d0000.can failed with error -2 + +actually, Tony has fixed this issue on am335x with the patch [3] + +Since am437x has the same clock structure with am335x +[1][2], so reuse the code from Tony Lindgren's patch [3] to fix it. + +[1]: https://www.ti.com/lit/pdf/spruh73 Chapter-23, Figure 23-1. DCAN + Integration +[2]: https://www.ti.com/lit/pdf/spruhl7 Chapter-25, Figure 25-1. DCAN + Integration +[3]: commit 516f1117d0fb ("ARM: dts: Configure osc clock for d_can on + am335x") + +Fixes: 1a5cd7c23cc5 ("bus: ti-sysc: Enable all clocks directly during init to read revision") +Signed-off-by: dillon min +[tony@atomide.com: aligned commit message a bit for readability] +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am437x-l4.dtsi | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/am437x-l4.dtsi b/arch/arm/boot/dts/am437x-l4.dtsi +index 59770dd3785ee..bbe15775fccd5 100644 +--- a/arch/arm/boot/dts/am437x-l4.dtsi ++++ b/arch/arm/boot/dts/am437x-l4.dtsi +@@ -1576,8 +1576,9 @@ target-module@cc000 { /* 0x481cc000, ap 50 46.0 */ + reg-names = "rev"; + ti,hwmods = "d_can0"; + /* Domains (P, C): per_pwrdm, l4ls_clkdm */ +- clocks = <&l4ls_clkctrl AM4_L4LS_D_CAN0_CLKCTRL 0>; +- clock-names = "fck"; ++ clocks = <&l4ls_clkctrl AM4_L4LS_D_CAN0_CLKCTRL 0>, ++ <&dcan0_fck>; ++ clock-names = "fck", "osc"; + #address-cells = <1>; + #size-cells = <1>; + ranges = <0x0 0xcc000 0x2000>; +@@ -1585,6 +1586,8 @@ target-module@cc000 { /* 0x481cc000, ap 50 46.0 */ + dcan0: can@0 { + compatible = "ti,am4372-d_can", "ti,am3352-d_can"; + reg = <0x0 0x2000>; ++ clocks = <&dcan0_fck>; ++ clock-names = "fck"; + syscon-raminit = <&scm_conf 0x644 0>; + interrupts = ; + status = "disabled"; +@@ -1597,8 +1600,9 @@ target-module@d0000 { /* 0x481d0000, ap 52 3a.0 */ + reg-names = "rev"; + ti,hwmods = "d_can1"; + /* Domains (P, C): per_pwrdm, l4ls_clkdm */ +- clocks = <&l4ls_clkctrl AM4_L4LS_D_CAN1_CLKCTRL 0>; +- clock-names = "fck"; ++ clocks = <&l4ls_clkctrl AM4_L4LS_D_CAN1_CLKCTRL 0>, ++ <&dcan1_fck>; ++ clock-names = "fck", "osc"; + #address-cells = <1>; + #size-cells = <1>; + ranges = <0x0 0xd0000 0x2000>; +@@ -1606,6 +1610,8 @@ target-module@d0000 { /* 0x481d0000, ap 52 3a.0 */ + dcan1: can@0 { + compatible = "ti,am4372-d_can", "ti,am3352-d_can"; + reg = <0x0 0x2000>; ++ clocks = <&dcan1_fck>; ++ clock-name = "fck"; + syscon-raminit = <&scm_conf 0x644 1>; + interrupts = ; + status = "disabled"; +-- +2.25.1 + diff --git a/queue-5.4/arm-dts-socfpga-align-l2-cache-controller-nodename-w.patch b/queue-5.4/arm-dts-socfpga-align-l2-cache-controller-nodename-w.patch new file mode 100644 index 00000000000..bfa244a5ce4 --- /dev/null +++ b/queue-5.4/arm-dts-socfpga-align-l2-cache-controller-nodename-w.patch @@ -0,0 +1,51 @@ +From 887b776f7d05d6b3c09612b6d207f2a551fb0430 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jun 2020 10:06:02 +0200 +Subject: ARM: dts: socfpga: Align L2 cache-controller nodename with dtschema + +From: Krzysztof Kozlowski + +[ Upstream commit d7adfe5ffed9faa05f8926223086b101e14f700d ] + +Fix dtschema validator warnings like: + l2-cache@fffff000: $nodename:0: + 'l2-cache@fffff000' does not match '^(cache-controller|cpu)(@[0-9a-f,]+)*$' + +Fixes: 475dc86d08de ("arm: dts: socfpga: Add a base DTSI for Altera's Arria10 SOC") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Dinh Nguyen +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/socfpga.dtsi | 2 +- + arch/arm/boot/dts/socfpga_arria10.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi +index 4f3993cc02279..4510308972209 100644 +--- a/arch/arm/boot/dts/socfpga.dtsi ++++ b/arch/arm/boot/dts/socfpga.dtsi +@@ -710,7 +710,7 @@ ocram-ecc@ffd08144 { + }; + }; + +- L2: l2-cache@fffef000 { ++ L2: cache-controller@fffef000 { + compatible = "arm,pl310-cache"; + reg = <0xfffef000 0x1000>; + interrupts = <0 38 0x04>; +diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi +index 2a86e72d97918..906bfb580e9e7 100644 +--- a/arch/arm/boot/dts/socfpga_arria10.dtsi ++++ b/arch/arm/boot/dts/socfpga_arria10.dtsi +@@ -636,7 +636,7 @@ sdr: sdr@ffcfb100 { + reg = <0xffcfb100 0x80>; + }; + +- L2: l2-cache@fffff000 { ++ L2: cache-controller@fffff000 { + compatible = "arm,pl310-cache"; + reg = <0xfffff000 0x1000>; + interrupts = <0 18 IRQ_TYPE_LEVEL_HIGH>; +-- +2.25.1 + diff --git a/queue-5.4/arm64-dts-meson-add-missing-gxl-rng-clock.patch b/queue-5.4/arm64-dts-meson-add-missing-gxl-rng-clock.patch new file mode 100644 index 00000000000..d3518fbf3bb --- /dev/null +++ b/queue-5.4/arm64-dts-meson-add-missing-gxl-rng-clock.patch @@ -0,0 +1,41 @@ +From eacee819dc563ed858e29045c203c378e3eba9d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 14:53:46 +0200 +Subject: arm64: dts: meson: add missing gxl rng clock + +From: Jerome Brunet + +[ Upstream commit 95ca6f06dd4827ff63be5154120c7a8511cd9a41 ] + +The peripheral clock of the RNG is missing for gxl while it is present +for gxbb. + +Fixes: 1b3f6d148692 ("ARM64: dts: meson-gx: add clock CLKID_RNG0 to hwrng node") +Signed-off-by: Jerome Brunet +Signed-off-by: Kevin Hilman +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20200617125346.1163527-1-jbrunet@baylibre.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +index 49ff0a7d0210f..e3cfa24dca5ab 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +@@ -288,6 +288,11 @@ clkc: clock-controller { + }; + }; + ++&hwrng { ++ clocks = <&clkc CLKID_RNG0>; ++ clock-names = "core"; ++}; ++ + &i2c_A { + clocks = <&clkc CLKID_I2C>; + }; +-- +2.25.1 + diff --git a/queue-5.4/arm64-dts-meson-gxl-s805x-reduce-initial-mali450-cor.patch b/queue-5.4/arm64-dts-meson-gxl-s805x-reduce-initial-mali450-cor.patch new file mode 100644 index 00000000000..8871ab881aa --- /dev/null +++ b/queue-5.4/arm64-dts-meson-gxl-s805x-reduce-initial-mali450-cor.patch @@ -0,0 +1,104 @@ +From 7cd94a5079b89e38ddc5749c6ebc8d52c5ff4f11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jun 2020 15:27:37 +0200 +Subject: arm64: dts: meson-gxl-s805x: reduce initial Mali450 core frequency + +From: Neil Armstrong + +[ Upstream commit b2037dafcf082cd24b88ae9283af628235df36e1 ] + +When starting at 744MHz, the Mali 450 core crashes on S805X based boards: + lima d00c0000.gpu: IRQ ppmmu3 not found + lima d00c0000.gpu: IRQ ppmmu4 not found + lima d00c0000.gpu: IRQ ppmmu5 not found + lima d00c0000.gpu: IRQ ppmmu6 not found + lima d00c0000.gpu: IRQ ppmmu7 not found + Internal error: synchronous external abort: 96000210 [#1] PREEMPT SMP + Modules linked in: + CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.7.2+ #492 + Hardware name: Libre Computer AML-S805X-AC (DT) + pstate: 40000005 (nZcv daif -PAN -UAO) + pc : lima_gp_init+0x28/0x188 + ... + Call trace: + lima_gp_init+0x28/0x188 + lima_device_init+0x334/0x534 + lima_pdev_probe+0xa4/0xe4 + ... + Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b + +Reverting to a safer 666Mhz frequency on the S805X that doesn't use the +GP0 PLL makes it more stable. + +Fixes: fd47716479f5 ("ARM64: dts: add S805X based P241 board") +Fixes: 0449b8e371ac ("arm64: dts: meson: add libretech aml-s805x-ac board") +Signed-off-by: Neil Armstrong +Signed-off-by: Kevin Hilman +Link: https://lore.kernel.org/r/20200618132737.14243-1-narmstrong@baylibre.com +Signed-off-by: Sasha Levin +--- + .../amlogic/meson-gxl-s805x-libretech-ac.dts | 2 +- + .../boot/dts/amlogic/meson-gxl-s805x-p241.dts | 2 +- + .../boot/dts/amlogic/meson-gxl-s805x.dtsi | 24 +++++++++++++++++++ + 3 files changed, 26 insertions(+), 2 deletions(-) + create mode 100644 arch/arm64/boot/dts/amlogic/meson-gxl-s805x.dtsi + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s805x-libretech-ac.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s805x-libretech-ac.dts +index 82b1c48511478..e034bbff8e66e 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s805x-libretech-ac.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s805x-libretech-ac.dts +@@ -9,7 +9,7 @@ + + #include + +-#include "meson-gxl-s905x.dtsi" ++#include "meson-gxl-s805x.dtsi" + + / { + compatible = "libretech,aml-s805x-ac", "amlogic,s805x", +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s805x-p241.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s805x-p241.dts +index 3a1484e5b8e1d..fbc687c9ff839 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s805x-p241.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s805x-p241.dts +@@ -9,7 +9,7 @@ + + #include + +-#include "meson-gxl-s905x.dtsi" ++#include "meson-gxl-s805x.dtsi" + + / { + compatible = "amlogic,p241", "amlogic,s805x", "amlogic,meson-gxl"; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s805x.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl-s805x.dtsi +new file mode 100644 +index 0000000000000..f9d705648426e +--- /dev/null ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s805x.dtsi +@@ -0,0 +1,24 @@ ++// SPDX-License-Identifier: (GPL-2.0+ OR MIT) ++/* ++ * Copyright (c) 2020 BayLibre SAS ++ * Author: Neil Armstrong ++ */ ++ ++#include "meson-gxl-s905x.dtsi" ++ ++/ { ++ compatible = "amlogic,s805x", "amlogic,meson-gxl"; ++}; ++ ++/* The S805X Package doesn't seem to handle the 744MHz OPP correctly */ ++&mali { ++ assigned-clocks = <&clkc CLKID_MALI_0_SEL>, ++ <&clkc CLKID_MALI_0>, ++ <&clkc CLKID_MALI>; /* Glitch free mux */ ++ assigned-clock-parents = <&clkc CLKID_FCLK_DIV3>, ++ <0>, /* Do Nothing */ ++ <&clkc CLKID_MALI_0>; ++ assigned-clock-rates = <0>, /* Do Nothing */ ++ <666666666>, ++ <0>; /* Do Nothing */ ++}; +-- +2.25.1 + diff --git a/queue-5.4/arm64-dts-spcfpga-align-gic-nand-and-uart-nodenames-.patch b/queue-5.4/arm64-dts-spcfpga-align-gic-nand-and-uart-nodenames-.patch new file mode 100644 index 00000000000..e17ba1bb364 --- /dev/null +++ b/queue-5.4/arm64-dts-spcfpga-align-gic-nand-and-uart-nodenames-.patch @@ -0,0 +1,64 @@ +From 01836ac7af3dab2dda2a994ef1ccf68e682b50f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jun 2020 10:16:29 +0200 +Subject: arm64: dts: spcfpga: Align GIC, NAND and UART nodenames with dtschema + +From: Krzysztof Kozlowski + +[ Upstream commit 681a5c71fb829fc2193e3bb524af41525477f5c3 ] + +Fix dtschema validator warnings like: + intc@fffc1000: $nodename:0: + 'intc@fffc1000' does not match '^interrupt-controller(@[0-9a-f,]+)*$' + +Fixes: 78cd6a9d8e15 ("arm64: dts: Add base stratix 10 dtsi") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Dinh Nguyen +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi +index d1fc9c2055f49..9498d1de730ce 100644 +--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi ++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi +@@ -77,7 +77,7 @@ psci { + method = "smc"; + }; + +- intc: intc@fffc1000 { ++ intc: interrupt-controller@fffc1000 { + compatible = "arm,gic-400", "arm,cortex-a15-gic"; + #interrupt-cells = <3>; + interrupt-controller; +@@ -302,7 +302,7 @@ mmc: dwmmc0@ff808000 { + status = "disabled"; + }; + +- nand: nand@ffb90000 { ++ nand: nand-controller@ffb90000 { + #address-cells = <1>; + #size-cells = <0>; + compatible = "altr,socfpga-denali-nand"; +@@ -445,7 +445,7 @@ timer3: timer3@ffd00100 { + clock-names = "timer"; + }; + +- uart0: serial0@ffc02000 { ++ uart0: serial@ffc02000 { + compatible = "snps,dw-apb-uart"; + reg = <0xffc02000 0x100>; + interrupts = <0 108 4>; +@@ -456,7 +456,7 @@ uart0: serial0@ffc02000 { + status = "disabled"; + }; + +- uart1: serial1@ffc02100 { ++ uart1: serial@ffc02100 { + compatible = "snps,dw-apb-uart"; + reg = <0xffc02100 0x100>; + interrupts = <0 109 4>; +-- +2.25.1 + diff --git a/queue-5.4/bus-ti-sysc-do-not-disable-on-suspend-for-no-idle.patch b/queue-5.4/bus-ti-sysc-do-not-disable-on-suspend-for-no-idle.patch new file mode 100644 index 00000000000..c4cb3206369 --- /dev/null +++ b/queue-5.4/bus-ti-sysc-do-not-disable-on-suspend-for-no-idle.patch @@ -0,0 +1,47 @@ +From 925d05ebace55dc1ee10a7dc1f8b3253d9147c89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jul 2020 13:57:14 -0700 +Subject: bus: ti-sysc: Do not disable on suspend for no-idle + +From: Tony Lindgren + +[ Upstream commit a55de412228cc5a2b4bf8d2a09849898102633e2 ] + +If we have "ti,no-idle" specified for a module we must not disable +the the module on suspend to keep things backwards compatible. + +Fixes: 386cb76681ca ("bus: ti-sysc: Handle missed no-idle property in addition to no-idle-on-init") +Reported-by: Grygorii Strashko +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 76e749dfc4fd1..f8bc052cd853a 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -1245,7 +1245,8 @@ static int __maybe_unused sysc_noirq_suspend(struct device *dev) + + ddata = dev_get_drvdata(dev); + +- if (ddata->cfg.quirks & SYSC_QUIRK_LEGACY_IDLE) ++ if (ddata->cfg.quirks & ++ (SYSC_QUIRK_LEGACY_IDLE | SYSC_QUIRK_NO_IDLE)) + return 0; + + return pm_runtime_force_suspend(dev); +@@ -1257,7 +1258,8 @@ static int __maybe_unused sysc_noirq_resume(struct device *dev) + + ddata = dev_get_drvdata(dev); + +- if (ddata->cfg.quirks & SYSC_QUIRK_LEGACY_IDLE) ++ if (ddata->cfg.quirks & ++ (SYSC_QUIRK_LEGACY_IDLE | SYSC_QUIRK_NO_IDLE)) + return 0; + + return pm_runtime_force_resume(dev); +-- +2.25.1 + diff --git a/queue-5.4/bus-ti-sysc-fix-sleeping-function-called-from-invali.patch b/queue-5.4/bus-ti-sysc-fix-sleeping-function-called-from-invali.patch new file mode 100644 index 00000000000..65895cc9fec --- /dev/null +++ b/queue-5.4/bus-ti-sysc-fix-sleeping-function-called-from-invali.patch @@ -0,0 +1,44 @@ +From 07754056f5e8a0b5731aece1d3a2ccad7201bbbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jul 2020 10:41:02 -0700 +Subject: bus: ti-sysc: Fix sleeping function called from invalid context for + RTC quirk + +From: Tony Lindgren + +[ Upstream commit afe6f1eeb08f85e57f0a02b71efb5a0839606aac ] + +With CONFIG_DEBUG_ATOMIC_SLEEP enabled we can see the following with RTC probe: + +BUG: sleeping function called from invalid context at drivers/bus/ti-sysc.c:1736 +... +(sysc_quirk_rtc) from [] (sysc_write_sysconfig+0x1c/0x60) +(sysc_write_sysconfig) from [] (sysc_enable_module+0x11c/0x274) +(sysc_enable_module) from [] (sysc_probe+0xe9c/0x1380) +(sysc_probe) from [] (platform_drv_probe+0x48/0x98) + +Fixes: e8639e1c986a ("bus: ti-sysc: Handle module unlock quirk needed for some RTC") +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index da586d75962fd..76e749dfc4fd1 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -1571,8 +1571,8 @@ static void sysc_quirk_rtc(struct sysc *ddata, bool lock) + + local_irq_save(flags); + /* RTC_STATUS BUSY bit may stay active for 1/32768 seconds (~30 usec) */ +- error = readl_poll_timeout(ddata->module_va + 0x44, val, +- !(val & BIT(0)), 100, 50); ++ error = readl_poll_timeout_atomic(ddata->module_va + 0x44, val, ++ !(val & BIT(0)), 100, 50); + if (error) + dev_warn(ddata->dev, "rtc busy timeout\n"); + /* Now we have ~15 microseconds to read/write various registers */ +-- +2.25.1 + diff --git a/queue-5.4/bus-ti-sysc-fix-wakeirq-sleeping-function-called-fro.patch b/queue-5.4/bus-ti-sysc-fix-wakeirq-sleeping-function-called-fro.patch new file mode 100644 index 00000000000..de58fa91fc4 --- /dev/null +++ b/queue-5.4/bus-ti-sysc-fix-wakeirq-sleeping-function-called-fro.patch @@ -0,0 +1,65 @@ +From d059ac8c59782cfaf2e1f994122b916276916060 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jul 2020 10:44:20 -0700 +Subject: bus: ti-sysc: Fix wakeirq sleeping function called from invalid + context + +From: Tony Lindgren + +[ Upstream commit 9f9113925018d500a95df539014d9ff11ac2c02d ] + +With CONFIG_DEBUG_ATOMIC_SLEEP enabled we can see the following with +wakeirqs and serial console idled: + +BUG: sleeping function called from invalid context at drivers/bus/ti-sysc.c:242 +... +(sysc_wait_softreset) from [] (sysc_enable_module+0x48/0x274) +(sysc_enable_module) from [] (sysc_runtime_resume+0x19c/0x1d8) +(sysc_runtime_resume) from [] (sysc_child_runtime_resume+0x58/0x84) +(sysc_child_runtime_resume) from [] (__rpm_callback+0x30/0x12c) +(__rpm_callback) from [] (rpm_callback+0x20/0x80) +(rpm_callback) from [] (rpm_resume+0x638/0x7fc) +(rpm_resume) from [] (__pm_runtime_resume+0x60/0x9c) +(__pm_runtime_resume) from [] (handle_threaded_wake_irq+0x24/0x60) +(handle_threaded_wake_irq) from [] (irq_thread_fn+0x1c/0x78) +(irq_thread_fn) from [] (irq_thread+0x140/0x26c) + +We have __pm_runtime_resume() call the sysc_runtime_resume() with spinlock +held and interrupts disabled. + +Fixes: d46f9fbec719 ("bus: ti-sysc: Use optional clocks on for enable and wait for softreset bit") +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index bb3e3310865bd..da586d75962fd 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -201,15 +201,14 @@ static int sysc_wait_softreset(struct sysc *ddata) + syss_done = ddata->cfg.syss_mask; + + if (syss_offset >= 0) { +- error = readx_poll_timeout(sysc_read_sysstatus, ddata, rstval, +- (rstval & ddata->cfg.syss_mask) == +- syss_done, +- 100, MAX_MODULE_SOFTRESET_WAIT); ++ error = readx_poll_timeout_atomic(sysc_read_sysstatus, ddata, ++ rstval, (rstval & ddata->cfg.syss_mask) == ++ syss_done, 100, MAX_MODULE_SOFTRESET_WAIT); + + } else if (ddata->cfg.quirks & SYSC_QUIRK_RESET_STATUS) { +- error = readx_poll_timeout(sysc_read_sysconfig, ddata, rstval, +- !(rstval & sysc_mask), +- 100, MAX_MODULE_SOFTRESET_WAIT); ++ error = readx_poll_timeout_atomic(sysc_read_sysconfig, ddata, ++ rstval, !(rstval & sysc_mask), ++ 100, MAX_MODULE_SOFTRESET_WAIT); + } + + return error; +-- +2.25.1 + diff --git a/queue-5.4/clk-ast2600-add-mux-for-emmc-clock.patch b/queue-5.4/clk-ast2600-add-mux-for-emmc-clock.patch new file mode 100644 index 00000000000..439453ec8bf --- /dev/null +++ b/queue-5.4/clk-ast2600-add-mux-for-emmc-clock.patch @@ -0,0 +1,103 @@ +From 4e08b80bb650345f7be8d2ec2d65ba0ee126bea6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jul 2020 14:57:05 -0500 +Subject: clk: AST2600: Add mux for EMMC clock + +From: Eddie James + +[ Upstream commit c2407ab3bd55064d459bc822efd1c134e852798c ] + +The EMMC clock can be derived from either the HPLL or the MPLL. Register +a clock mux so that the rate is calculated correctly based upon the +parent. + +Signed-off-by: Eddie James +Reviewed-by: Andrew Jeffery +Link: https://lore.kernel.org/r/20200709195706.12741-2-eajames@linux.ibm.com +Acked-by: Joel Stanley +Fixes: d3d04f6c330a ("clk: Add support for AST2600 SoC") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-ast2600.c | 49 ++++++++++++++++++++++++++++++++------- + 1 file changed, 41 insertions(+), 8 deletions(-) + +diff --git a/drivers/clk/clk-ast2600.c b/drivers/clk/clk-ast2600.c +index 675cab6fa7814..7015974f24b43 100644 +--- a/drivers/clk/clk-ast2600.c ++++ b/drivers/clk/clk-ast2600.c +@@ -130,6 +130,18 @@ static const struct clk_div_table ast2600_eclk_div_table[] = { + { 0 } + }; + ++static const struct clk_div_table ast2600_emmc_extclk_div_table[] = { ++ { 0x0, 2 }, ++ { 0x1, 4 }, ++ { 0x2, 6 }, ++ { 0x3, 8 }, ++ { 0x4, 10 }, ++ { 0x5, 12 }, ++ { 0x6, 14 }, ++ { 0x7, 16 }, ++ { 0 } ++}; ++ + static const struct clk_div_table ast2600_mac_div_table[] = { + { 0x0, 4 }, + { 0x1, 4 }, +@@ -389,6 +401,11 @@ static struct clk_hw *aspeed_g6_clk_hw_register_gate(struct device *dev, + return hw; + } + ++static const char *const emmc_extclk_parent_names[] = { ++ "emmc_extclk_hpll_in", ++ "mpll", ++}; ++ + static const char * const vclk_parent_names[] = { + "dpll", + "d1pll", +@@ -458,16 +475,32 @@ static int aspeed_g6_clk_probe(struct platform_device *pdev) + return PTR_ERR(hw); + aspeed_g6_clk_data->hws[ASPEED_CLK_UARTX] = hw; + +- /* EMMC ext clock divider */ +- hw = clk_hw_register_gate(dev, "emmc_extclk_gate", "hpll", 0, +- scu_g6_base + ASPEED_G6_CLK_SELECTION1, 15, 0, +- &aspeed_g6_clk_lock); ++ /* EMMC ext clock */ ++ hw = clk_hw_register_fixed_factor(dev, "emmc_extclk_hpll_in", "hpll", ++ 0, 1, 2); + if (IS_ERR(hw)) + return PTR_ERR(hw); +- hw = clk_hw_register_divider_table(dev, "emmc_extclk", "emmc_extclk_gate", 0, +- scu_g6_base + ASPEED_G6_CLK_SELECTION1, 12, 3, 0, +- ast2600_div_table, +- &aspeed_g6_clk_lock); ++ ++ hw = clk_hw_register_mux(dev, "emmc_extclk_mux", ++ emmc_extclk_parent_names, ++ ARRAY_SIZE(emmc_extclk_parent_names), 0, ++ scu_g6_base + ASPEED_G6_CLK_SELECTION1, 11, 1, ++ 0, &aspeed_g6_clk_lock); ++ if (IS_ERR(hw)) ++ return PTR_ERR(hw); ++ ++ hw = clk_hw_register_gate(dev, "emmc_extclk_gate", "emmc_extclk_mux", ++ 0, scu_g6_base + ASPEED_G6_CLK_SELECTION1, ++ 15, 0, &aspeed_g6_clk_lock); ++ if (IS_ERR(hw)) ++ return PTR_ERR(hw); ++ ++ hw = clk_hw_register_divider_table(dev, "emmc_extclk", ++ "emmc_extclk_gate", 0, ++ scu_g6_base + ++ ASPEED_G6_CLK_SELECTION1, 12, ++ 3, 0, ast2600_emmc_extclk_div_table, ++ &aspeed_g6_clk_lock); + if (IS_ERR(hw)) + return PTR_ERR(hw); + aspeed_g6_clk_data->hws[ASPEED_CLK_EMMC] = hw; +-- +2.25.1 + diff --git a/queue-5.4/clk-mvebu-armada_ap_cpu_clk-needs-to-select-armada_a.patch b/queue-5.4/clk-mvebu-armada_ap_cpu_clk-needs-to-select-armada_a.patch new file mode 100644 index 00000000000..407e72de969 --- /dev/null +++ b/queue-5.4/clk-mvebu-armada_ap_cpu_clk-needs-to-select-armada_a.patch @@ -0,0 +1,47 @@ +From f13535778d0905c2dbd68f16cd34a06d42076fde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jul 2020 13:11:29 -0700 +Subject: clk: mvebu: ARMADA_AP_CPU_CLK needs to select ARMADA_AP_CP_HELPER + +From: Nathan Chancellor + +[ Upstream commit 8e3709d7e3a67e2d3f42bd1fc2052353a5678944 ] + +When building arm32 allmodconfig: + +ld.lld: error: undefined symbol: ap_cp_unique_name +>>> referenced by ap-cpu-clk.c +>>> clk/mvebu/ap-cpu-clk.o:(ap_cpu_clock_probe) in archive drivers/built-in.a + +ap_cp_unique_name is only compiled into the kernel image when +CONFIG_ARMADA_AP_CP_HELPER is selected (as it is not user selectable). +However, CONFIG_ARMADA_AP_CPU_CLK does not select it. + +This has been a problem since the driver was added to the kernel but it +was not built before commit c318ea261749 ("cpufreq: ap806: fix cpufreq +driver needs ap cpu clk") so it was never noticed. + +Fixes: f756e362d938 ("clk: mvebu: add CPU clock driver for Armada 7K/8K") +Signed-off-by: Nathan Chancellor +Link: https://lore.kernel.org/r/20200701201128.2448427-1-natechancellor@gmail.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mvebu/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/mvebu/Kconfig b/drivers/clk/mvebu/Kconfig +index 415e6906a113f..76cd06f4ed62a 100644 +--- a/drivers/clk/mvebu/Kconfig ++++ b/drivers/clk/mvebu/Kconfig +@@ -42,6 +42,7 @@ config ARMADA_AP806_SYSCON + + config ARMADA_AP_CPU_CLK + bool ++ select ARMADA_AP_CP_HELPER + + config ARMADA_CP110_SYSCON + bool +-- +2.25.1 + diff --git a/queue-5.4/dmaengine-dmatest-stop-completed-threads-when-runnin.patch b/queue-5.4/dmaengine-dmatest-stop-completed-threads-when-runnin.patch new file mode 100644 index 00000000000..8395bd31d4c --- /dev/null +++ b/queue-5.4/dmaengine-dmatest-stop-completed-threads-when-runnin.patch @@ -0,0 +1,64 @@ +From 196280768ea5c33122b0048eaa027f8923023027 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jul 2020 13:12:25 +0300 +Subject: dmaengine: dmatest: stop completed threads when running without set + channel + +From: Peter Ujfalusi + +[ Upstream commit fd17d1abce426b4224a916a242b57be94272771b ] + +The completed threads were not cleared and consequent run would result +threads accumulating: + +echo 800000 > /sys/module/dmatest/parameters/test_buf_size +echo 2000 > /sys/module/dmatest/parameters/timeout +echo 50 > /sys/module/dmatest/parameters/iterations +echo 1 > /sys/module/dmatest/parameters/max_channels +echo "" > /sys/module/dmatest/parameters/channel +[ 237.507265] dmatest: Added 1 threads using dma1chan2 +echo 1 > /sys/module/dmatest/parameters/run +[ 244.713360] dmatest: Started 1 threads using dma1chan2 +[ 246.117680] dmatest: dma1chan2-copy0: summary 50 tests, 0 failures 2437.47 iops 977623 KB/s (0) + +echo 1 > /sys/module/dmatest/parameters/run +[ 292.381471] dmatest: No channels configured, continue with any +[ 292.389307] dmatest: Added 1 threads using dma1chan3 +[ 292.394302] dmatest: Started 1 threads using dma1chan2 +[ 292.399454] dmatest: Started 1 threads using dma1chan3 +[ 293.800835] dmatest: dma1chan3-copy0: summary 50 tests, 0 failures 2624.53 iops 975014 KB/s (0) + +echo 1 > /sys/module/dmatest/parameters/run +[ 307.301429] dmatest: No channels configured, continue with any +[ 307.309212] dmatest: Added 1 threads using dma1chan4 +[ 307.314197] dmatest: Started 1 threads using dma1chan2 +[ 307.319343] dmatest: Started 1 threads using dma1chan3 +[ 307.324492] dmatest: Started 1 threads using dma1chan4 +[ 308.730773] dmatest: dma1chan4-copy0: summary 50 tests, 0 failures 2390.28 iops 965436 KB/s (0) + +Fixes: 6b41030fdc79 ("dmaengine: dmatest: Restore default for channel") +Reported-by: Grygorii Strashko +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20200701101225.8607-1-peter.ujfalusi@ti.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dmatest.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c +index 0425984db118a..62d9825a49e9d 100644 +--- a/drivers/dma/dmatest.c ++++ b/drivers/dma/dmatest.c +@@ -1168,6 +1168,8 @@ static int dmatest_run_set(const char *val, const struct kernel_param *kp) + } else if (dmatest_run) { + if (!is_threaded_test_pending(info)) { + pr_info("No channels configured, continue with any\n"); ++ if (!is_threaded_test_run(info)) ++ stop_threaded_test(info); + add_threaded_test(info); + } + start_threaded_tests(info); +-- +2.25.1 + diff --git a/queue-5.4/dmaengine-dw-initialize-channel-before-each-transfer.patch b/queue-5.4/dmaengine-dw-initialize-channel-before-each-transfer.patch new file mode 100644 index 00000000000..d7ad60b1488 --- /dev/null +++ b/queue-5.4/dmaengine-dw-initialize-channel-before-each-transfer.patch @@ -0,0 +1,79 @@ +From e72246b20481c0810e34fcad4c707833f325e6fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Jul 2020 14:56:20 +0300 +Subject: dmaengine: dw: Initialize channel before each transfer + +From: Andy Shevchenko + +[ Upstream commit 99ba8b9b0d9780e9937eb1d488d120e9e5c2533d ] + +In some cases DMA can be used only with a consumer which does runtime power +management and on the platforms, that have DMA auto power gating logic +(see comments in the drivers/acpi/acpi_lpss.c), may result in DMA losing +its context. Simple mitigation of this issue is to initialize channel +each time the consumer initiates a transfer. + +Fixes: cfdf5b6cc598 ("dw_dmac: add support for Lynxpoint DMA controllers") +Reported-by: Tsuchiya Yuto +Signed-off-by: Andy Shevchenko +Acked-by: Viresh Kumar +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206403 +Link: https://lore.kernel.org/r/20200705115620.51929-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw/core.c | 12 ------------ + 1 file changed, 12 deletions(-) + +diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c +index 21cb2a58dbd29..a1b56f52db2f2 100644 +--- a/drivers/dma/dw/core.c ++++ b/drivers/dma/dw/core.c +@@ -118,16 +118,11 @@ static void dwc_initialize(struct dw_dma_chan *dwc) + { + struct dw_dma *dw = to_dw_dma(dwc->chan.device); + +- if (test_bit(DW_DMA_IS_INITIALIZED, &dwc->flags)) +- return; +- + dw->initialize_chan(dwc); + + /* Enable interrupts */ + channel_set_bit(dw, MASK.XFER, dwc->mask); + channel_set_bit(dw, MASK.ERROR, dwc->mask); +- +- set_bit(DW_DMA_IS_INITIALIZED, &dwc->flags); + } + + /*----------------------------------------------------------------------*/ +@@ -954,8 +949,6 @@ static void dwc_issue_pending(struct dma_chan *chan) + + void do_dw_dma_off(struct dw_dma *dw) + { +- unsigned int i; +- + dma_writel(dw, CFG, 0); + + channel_clear_bit(dw, MASK.XFER, dw->all_chan_mask); +@@ -966,9 +959,6 @@ void do_dw_dma_off(struct dw_dma *dw) + + while (dma_readl(dw, CFG) & DW_CFG_DMA_EN) + cpu_relax(); +- +- for (i = 0; i < dw->dma.chancnt; i++) +- clear_bit(DW_DMA_IS_INITIALIZED, &dw->chan[i].flags); + } + + void do_dw_dma_on(struct dw_dma *dw) +@@ -1032,8 +1022,6 @@ static void dwc_free_chan_resources(struct dma_chan *chan) + /* Clear custom channel configuration */ + memset(&dwc->dws, 0, sizeof(struct dw_dma_slave)); + +- clear_bit(DW_DMA_IS_INITIALIZED, &dwc->flags); +- + /* Disable interrupts */ + channel_clear_bit(dw, MASK.XFER, dwc->mask); + channel_clear_bit(dw, MASK.BLOCK, dwc->mask); +-- +2.25.1 + diff --git a/queue-5.4/dmaengine-sh-usb-dmac-set-tx_result-parameters.patch b/queue-5.4/dmaengine-sh-usb-dmac-set-tx_result-parameters.patch new file mode 100644 index 00000000000..fe1bb7f33f7 --- /dev/null +++ b/queue-5.4/dmaengine-sh-usb-dmac-set-tx_result-parameters.patch @@ -0,0 +1,52 @@ +From 0fb41dbf92780b454e51bd4af14e7a9a737fa970 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jun 2020 21:07:33 +0900 +Subject: dmaengine: sh: usb-dmac: set tx_result parameters + +From: Yoshihiro Shimoda + +[ Upstream commit 466257d9968ac79575831250b039dc07566c7b13 ] + +A client driver (renesas_usbhs) assumed that +dmaengine_tx_status() could return the residue even if +the transfer was completed. However, this was not correct +usage [1] and this caused to break getting the residue after +the commit 24461d9792c2 ("dmaengine: virt-dma: Fix access after +free in vchan_complete()") actually. So, this is possible to get +wrong received size if the usb controller gets a short packet. +For example, g_zero driver causes "bad OUT byte" errors. + +To use the tx_result from the renesas_usbhs driver when +the transfer is completed, set the tx_result parameters. + +Notes that the renesas_usbhs driver needs to update for it. + +[1] +https://lore.kernel.org/dmaengine/20200616165550.GP2324254@vkoul-mobl/ + +Reported-by: Hien Dang +Fixes: 24461d9792c2 ("dmaengine: virt-dma: Fix access after free in vchan_complete()") +Signed-off-by: Yoshihiro Shimoda +Link: https://lore.kernel.org/r/1592482053-19433-1-git-send-email-yoshihiro.shimoda.uh@renesas.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/sh/usb-dmac.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c +index b218a013c2600..8f7ceb698226c 100644 +--- a/drivers/dma/sh/usb-dmac.c ++++ b/drivers/dma/sh/usb-dmac.c +@@ -586,6 +586,8 @@ static void usb_dmac_isr_transfer_end(struct usb_dmac_chan *chan) + desc->residue = usb_dmac_get_current_residue(chan, desc, + desc->sg_index - 1); + desc->done_cookie = desc->vd.tx.cookie; ++ desc->vd.tx_result.result = DMA_TRANS_NOERROR; ++ desc->vd.tx_result.residue = desc->residue; + vchan_cookie_complete(&desc->vd); + + /* Restart the next transfer if this driver has a next desc */ +-- +2.25.1 + diff --git a/queue-5.4/fuse-don-t-ignore-errors-from-fuse_writepages_fill.patch b/queue-5.4/fuse-don-t-ignore-errors-from-fuse_writepages_fill.patch new file mode 100644 index 00000000000..943a3b4f411 --- /dev/null +++ b/queue-5.4/fuse-don-t-ignore-errors-from-fuse_writepages_fill.patch @@ -0,0 +1,39 @@ +From 4ec7ca78e3cc32dadffe89ef50c9270630a6779e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jun 2020 12:39:51 +0300 +Subject: fuse: don't ignore errors from fuse_writepages_fill() + +From: Vasily Averin + +[ Upstream commit 7779b047a57f6824a43d0e1f70de2741b7426b9d ] + +fuse_writepages() ignores some errors taken from fuse_writepages_fill() I +believe it is a bug: if .writepages is called with WB_SYNC_ALL it should +either guarantee that all data was successfully saved or return error. + +Fixes: 26d614df1da9 ("fuse: Implement writepages callback") +Signed-off-by: Vasily Averin +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/fuse/file.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index 66214707a9456..d5963ef65c389 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -2148,10 +2148,8 @@ static int fuse_writepages(struct address_space *mapping, + + err = write_cache_pages(mapping, wbc, fuse_writepages_fill, &data); + if (data.wpa) { +- /* Ignore errors if we can write at least one page */ + WARN_ON(!data.wpa->ia.ap.num_pages); + fuse_writepages_send(&data); +- err = 0; + } + if (data.ff) + fuse_file_put(data.ff, false, false); +-- +2.25.1 + diff --git a/queue-5.4/iio-adc-ad7780-fix-a-resource-handling-path-in-ad778.patch b/queue-5.4/iio-adc-ad7780-fix-a-resource-handling-path-in-ad778.patch new file mode 100644 index 00000000000..b5ab6279880 --- /dev/null +++ b/queue-5.4/iio-adc-ad7780-fix-a-resource-handling-path-in-ad778.patch @@ -0,0 +1,38 @@ +From 5b877d1159a0e3c7884220912f36e47936b7fd1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 May 2020 11:59:53 +0200 +Subject: iio: adc: ad7780: Fix a resource handling path in 'ad7780_probe()' + +From: Christophe JAILLET + +[ Upstream commit b0536f9826a5ed3328d527b4fc1686867a9f3041 ] + +If 'ad7780_init_gpios()' fails, we must not release some resources that +have not been allocated yet. Return directly instead. + +Fixes: 5bb30e7daf00 ("staging: iio: ad7780: move regulator to after GPIO init") +Fixes: 9085daa4abcc ("staging: iio: ad7780: add gain & filter gpio support") +Signed-off-by: Christophe JAILLET +Acked-by: Renato Lui Geh +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/ad7780.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/ad7780.c b/drivers/iio/adc/ad7780.c +index 217a5a5c3c6d9..7e741294de7b8 100644 +--- a/drivers/iio/adc/ad7780.c ++++ b/drivers/iio/adc/ad7780.c +@@ -309,7 +309,7 @@ static int ad7780_probe(struct spi_device *spi) + + ret = ad7780_init_gpios(&spi->dev, st); + if (ret) +- goto error_cleanup_buffer_and_trigger; ++ return ret; + + st->reg = devm_regulator_get(&spi->dev, "avdd"); + if (IS_ERR(st->reg)) +-- +2.25.1 + diff --git a/queue-5.4/iio-health-afe4404-fix-timestamp-alignment-and-preve.patch b/queue-5.4/iio-health-afe4404-fix-timestamp-alignment-and-preve.patch new file mode 100644 index 00000000000..b91c2b14fe0 --- /dev/null +++ b/queue-5.4/iio-health-afe4404-fix-timestamp-alignment-and-preve.patch @@ -0,0 +1,73 @@ +From 266b9428e01a38f0a52f4e397df2696c4dbd55df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 May 2020 18:29:57 +0100 +Subject: iio:health:afe4404 Fix timestamp alignment and prevent data leak. + +From: Jonathan Cameron + +[ Upstream commit f88ecccac4be348bbcc6d056bdbc622a8955c04d ] + +One of a class of bugs pointed out by Lars in a recent review. +iio_push_to_buffers_with_timestamp assumes the buffer used is aligned +to the size of the timestamp (8 bytes). This is not guaranteed in +this driver which uses a 40 byte array of smaller elements on the stack. +As Lars also noted this anti pattern can involve a leak of data to +userspace and that indeed can happen here. We close both issues by +moving to a suitable structure in the iio_priv() data with alignment +explicitly requested. This data is allocated with kzalloc so no +data can leak appart from previous readings. + +Fixes: 87aec56e27ef ("iio: health: Add driver for the TI AFE4404 heart monitor") +Reported-by: Lars-Peter Clausen +Signed-off-by: Jonathan Cameron +Acked-by: Andrew F. Davis +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/health/afe4404.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/iio/health/afe4404.c b/drivers/iio/health/afe4404.c +index e728bbb21ca88..cebb1fd4d0b15 100644 +--- a/drivers/iio/health/afe4404.c ++++ b/drivers/iio/health/afe4404.c +@@ -83,6 +83,7 @@ static const struct reg_field afe4404_reg_fields[] = { + * @regulator: Pointer to the regulator for the IC + * @trig: IIO trigger for this device + * @irq: ADC_RDY line interrupt number ++ * @buffer: Used to construct a scan to push to the iio buffer. + */ + struct afe4404_data { + struct device *dev; +@@ -91,6 +92,7 @@ struct afe4404_data { + struct regulator *regulator; + struct iio_trigger *trig; + int irq; ++ s32 buffer[10] __aligned(8); + }; + + enum afe4404_chan_id { +@@ -328,17 +330,17 @@ static irqreturn_t afe4404_trigger_handler(int irq, void *private) + struct iio_dev *indio_dev = pf->indio_dev; + struct afe4404_data *afe = iio_priv(indio_dev); + int ret, bit, i = 0; +- s32 buffer[10]; + + for_each_set_bit(bit, indio_dev->active_scan_mask, + indio_dev->masklength) { + ret = regmap_read(afe->regmap, afe4404_channel_values[bit], +- &buffer[i++]); ++ &afe->buffer[i++]); + if (ret) + goto err; + } + +- iio_push_to_buffers_with_timestamp(indio_dev, buffer, pf->timestamp); ++ iio_push_to_buffers_with_timestamp(indio_dev, afe->buffer, ++ pf->timestamp); + err: + iio_trigger_notify_done(indio_dev->trig); + +-- +2.25.1 + diff --git a/queue-5.4/keys-asymmetric-fix-error-return-code-in-software_ke.patch b/queue-5.4/keys-asymmetric-fix-error-return-code-in-software_ke.patch new file mode 100644 index 00000000000..b74b040609e --- /dev/null +++ b/queue-5.4/keys-asymmetric-fix-error-return-code-in-software_ke.patch @@ -0,0 +1,36 @@ +From a0879edb10e653d9268a886de6eba6edc05d45c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jul 2020 23:28:38 +0100 +Subject: keys: asymmetric: fix error return code in software_key_query() + +From: Wei Yongjun + +[ Upstream commit 6cbba1f9114a8134cff9138c79add15012fd52b9 ] + +Fix to return negative error code -ENOMEM from kmalloc() error handling +case instead of 0, as done elsewhere in this function. + +Fixes: f1774cb8956a ("X.509: parse public key parameters from x509 for akcipher") +Signed-off-by: Wei Yongjun +Signed-off-by: David Howells +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + crypto/asymmetric_keys/public_key.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c +index d7f43d4ea925a..e5fae4e838c06 100644 +--- a/crypto/asymmetric_keys/public_key.c ++++ b/crypto/asymmetric_keys/public_key.c +@@ -119,6 +119,7 @@ static int software_key_query(const struct kernel_pkey_params *params, + if (IS_ERR(tfm)) + return PTR_ERR(tfm); + ++ ret = -ENOMEM; + key = kmalloc(pkey->keylen + sizeof(u32) * 2 + pkey->paramlen, + GFP_KERNEL); + if (!key) +-- +2.25.1 + diff --git a/queue-5.4/nfs-fix-interrupted-slots-by-sending-a-solo-sequence.patch b/queue-5.4/nfs-fix-interrupted-slots-by-sending-a-solo-sequence.patch new file mode 100644 index 00000000000..c2742098f54 --- /dev/null +++ b/queue-5.4/nfs-fix-interrupted-slots-by-sending-a-solo-sequence.patch @@ -0,0 +1,84 @@ +From 5b9ef92e2d43ad7f3e34e9f82578b88ce0fcc4d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jul 2020 10:33:40 -0400 +Subject: NFS: Fix interrupted slots by sending a solo SEQUENCE operation + +From: Anna Schumaker + +[ Upstream commit 913fadc5b105c3619d9e8d0fe8899ff1593cc737 ] + +We used to do this before 3453d5708b33, but this was changed to better +handle the NFS4ERR_SEQ_MISORDERED error code. This commit fixed the slot +re-use case when the server doesn't receive the interrupted operation, +but if the server does receive the operation then it could still end up +replying to the client with mis-matched operations from the reply cache. + +We can fix this by sending a SEQUENCE to the server while recovering from +a SEQ_MISORDERED error when we detect that we are in an interrupted slot +situation. + +Fixes: 3453d5708b33 (NFSv4.1: Avoid false retries when RPC calls are interrupted) +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 20 ++++++++++++++++++-- + 1 file changed, 18 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 33c17c69aeaa3..1a1bd2fe6e98d 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -774,6 +774,14 @@ static void nfs4_slot_sequence_acked(struct nfs4_slot *slot, + slot->seq_nr_last_acked = seqnr; + } + ++static void nfs4_probe_sequence(struct nfs_client *client, const struct cred *cred, ++ struct nfs4_slot *slot) ++{ ++ struct rpc_task *task = _nfs41_proc_sequence(client, cred, slot, true); ++ if (!IS_ERR(task)) ++ rpc_put_task_async(task); ++} ++ + static int nfs41_sequence_process(struct rpc_task *task, + struct nfs4_sequence_res *res) + { +@@ -790,6 +798,7 @@ static int nfs41_sequence_process(struct rpc_task *task, + goto out; + + session = slot->table->session; ++ clp = session->clp; + + trace_nfs4_sequence_done(session, res); + +@@ -804,7 +813,6 @@ static int nfs41_sequence_process(struct rpc_task *task, + nfs4_slot_sequence_acked(slot, slot->seq_nr); + /* Update the slot's sequence and clientid lease timer */ + slot->seq_done = 1; +- clp = session->clp; + do_renew_lease(clp, res->sr_timestamp); + /* Check sequence flags */ + nfs41_handle_sequence_flag_errors(clp, res->sr_status_flags, +@@ -852,10 +860,18 @@ static int nfs41_sequence_process(struct rpc_task *task, + /* + * Were one or more calls using this slot interrupted? + * If the server never received the request, then our +- * transmitted slot sequence number may be too high. ++ * transmitted slot sequence number may be too high. However, ++ * if the server did receive the request then it might ++ * accidentally give us a reply with a mismatched operation. ++ * We can sort this out by sending a lone sequence operation ++ * to the server on the same slot. + */ + if ((s32)(slot->seq_nr - slot->seq_nr_last_acked) > 1) { + slot->seq_nr--; ++ if (task->tk_msg.rpc_proc != &nfs4_procedures[NFSPROC4_CLNT_SEQUENCE]) { ++ nfs4_probe_sequence(clp, task->tk_msg.rpc_cred, slot); ++ res->sr_slot = NULL; ++ } + goto retry_nowait; + } + /* +-- +2.25.1 + diff --git a/queue-5.4/phy-sun4i-usb-fix-dereference-of-pointer-phy0-before.patch b/queue-5.4/phy-sun4i-usb-fix-dereference-of-pointer-phy0-before.patch new file mode 100644 index 00000000000..6294346ae82 --- /dev/null +++ b/queue-5.4/phy-sun4i-usb-fix-dereference-of-pointer-phy0-before.patch @@ -0,0 +1,50 @@ +From c517e3294eec6c4d5afa53c8ad6bd428955cbe2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jun 2020 13:44:28 +0100 +Subject: phy: sun4i-usb: fix dereference of pointer phy0 before it is null + checked + +From: Colin Ian King + +[ Upstream commit 38b1927e5bf9bcad4a2e33189ef1c5569f9599ba ] + +Currently pointer phy0 is being dereferenced via the assignment of +phy on the call to phy_get_drvdata before phy0 is null checked, this +can lead to a null pointer dereference. Fix this by performing the +null check on phy0 before the call to phy_get_drvdata. Also replace +the phy0 == NULL check with the more usual !phy0 idiom. + +Addresses-Coverity: ("Dereference before null check") +Fixes: e6f32efb1b12 ("phy: sun4i-usb: Make sure to disable PHY0 passby for peripheral mode") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20200625124428.83564-1-colin.king@canonical.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/allwinner/phy-sun4i-usb.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c +index 8569273822487..e5842e48a5e07 100644 +--- a/drivers/phy/allwinner/phy-sun4i-usb.c ++++ b/drivers/phy/allwinner/phy-sun4i-usb.c +@@ -545,13 +545,14 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work) + struct sun4i_usb_phy_data *data = + container_of(work, struct sun4i_usb_phy_data, detect.work); + struct phy *phy0 = data->phys[0].phy; +- struct sun4i_usb_phy *phy = phy_get_drvdata(phy0); ++ struct sun4i_usb_phy *phy; + bool force_session_end, id_notify = false, vbus_notify = false; + int id_det, vbus_det; + +- if (phy0 == NULL) ++ if (!phy0) + return; + ++ phy = phy_get_drvdata(phy0); + id_det = sun4i_usb_phy0_get_id_det(data); + vbus_det = sun4i_usb_phy0_get_vbus_det(data); + +-- +2.25.1 + diff --git a/queue-5.4/regmap-debugfs-don-t-sleep-while-atomic-for-fast_io-.patch b/queue-5.4/regmap-debugfs-don-t-sleep-while-atomic-for-fast_io-.patch new file mode 100644 index 00000000000..392ab78e8cf --- /dev/null +++ b/queue-5.4/regmap-debugfs-don-t-sleep-while-atomic-for-fast_io-.patch @@ -0,0 +1,137 @@ +From b82610e09ea14200752eef7ed42cb3aea2a1eaee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jul 2020 16:46:15 -0700 +Subject: regmap: debugfs: Don't sleep while atomic for fast_io regmaps + +From: Douglas Anderson + +[ Upstream commit 299632e54b2e692d2830af84be51172480dc1e26 ] + +If a regmap has "fast_io" set then its lock function uses a spinlock. +That doesn't work so well with the functions: +* regmap_cache_only_write_file() +* regmap_cache_bypass_write_file() + +Both of the above functions have the pattern: +1. Lock the regmap. +2. Call: + debugfs_write_file_bool() + copy_from_user() + __might_fault() + __might_sleep() + +Let's reorder things a bit so that we do all of our sleepable +functions before we grab the lock. + +Fixes: d3dc5430d68f ("regmap: debugfs: Allow writes to cache state settings") +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20200715164611.1.I35b3533e8a80efde0cec1cc70f71e1e74b2fa0da@changeid +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap-debugfs.c | 52 ++++++++++++++++------------ + 1 file changed, 29 insertions(+), 23 deletions(-) + +diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c +index e72843fe41dfe..e16afa27700db 100644 +--- a/drivers/base/regmap/regmap-debugfs.c ++++ b/drivers/base/regmap/regmap-debugfs.c +@@ -457,29 +457,31 @@ static ssize_t regmap_cache_only_write_file(struct file *file, + { + struct regmap *map = container_of(file->private_data, + struct regmap, cache_only); +- ssize_t result; +- bool was_enabled, require_sync = false; ++ bool new_val, require_sync = false; + int err; + +- map->lock(map->lock_arg); ++ err = kstrtobool_from_user(user_buf, count, &new_val); ++ /* Ignore malforned data like debugfs_write_file_bool() */ ++ if (err) ++ return count; + +- was_enabled = map->cache_only; ++ err = debugfs_file_get(file->f_path.dentry); ++ if (err) ++ return err; + +- result = debugfs_write_file_bool(file, user_buf, count, ppos); +- if (result < 0) { +- map->unlock(map->lock_arg); +- return result; +- } ++ map->lock(map->lock_arg); + +- if (map->cache_only && !was_enabled) { ++ if (new_val && !map->cache_only) { + dev_warn(map->dev, "debugfs cache_only=Y forced\n"); + add_taint(TAINT_USER, LOCKDEP_STILL_OK); +- } else if (!map->cache_only && was_enabled) { ++ } else if (!new_val && map->cache_only) { + dev_warn(map->dev, "debugfs cache_only=N forced: syncing cache\n"); + require_sync = true; + } ++ map->cache_only = new_val; + + map->unlock(map->lock_arg); ++ debugfs_file_put(file->f_path.dentry); + + if (require_sync) { + err = regcache_sync(map); +@@ -487,7 +489,7 @@ static ssize_t regmap_cache_only_write_file(struct file *file, + dev_err(map->dev, "Failed to sync cache %d\n", err); + } + +- return result; ++ return count; + } + + static const struct file_operations regmap_cache_only_fops = { +@@ -502,28 +504,32 @@ static ssize_t regmap_cache_bypass_write_file(struct file *file, + { + struct regmap *map = container_of(file->private_data, + struct regmap, cache_bypass); +- ssize_t result; +- bool was_enabled; ++ bool new_val; ++ int err; + +- map->lock(map->lock_arg); ++ err = kstrtobool_from_user(user_buf, count, &new_val); ++ /* Ignore malforned data like debugfs_write_file_bool() */ ++ if (err) ++ return count; + +- was_enabled = map->cache_bypass; ++ err = debugfs_file_get(file->f_path.dentry); ++ if (err) ++ return err; + +- result = debugfs_write_file_bool(file, user_buf, count, ppos); +- if (result < 0) +- goto out; ++ map->lock(map->lock_arg); + +- if (map->cache_bypass && !was_enabled) { ++ if (new_val && !map->cache_bypass) { + dev_warn(map->dev, "debugfs cache_bypass=Y forced\n"); + add_taint(TAINT_USER, LOCKDEP_STILL_OK); +- } else if (!map->cache_bypass && was_enabled) { ++ } else if (!new_val && map->cache_bypass) { + dev_warn(map->dev, "debugfs cache_bypass=N forced\n"); + } ++ map->cache_bypass = new_val; + +-out: + map->unlock(map->lock_arg); ++ debugfs_file_put(file->f_path.dentry); + +- return result; ++ return count; + } + + static const struct file_operations regmap_cache_bypass_fops = { +-- +2.25.1 + diff --git a/queue-5.4/revert-thermal-mediatek-fix-register-index-error.patch b/queue-5.4/revert-thermal-mediatek-fix-register-index-error.patch new file mode 100644 index 00000000000..69b5c0a1b13 --- /dev/null +++ b/queue-5.4/revert-thermal-mediatek-fix-register-index-error.patch @@ -0,0 +1,130 @@ +From a7b02b5ccf9263a2463dc2c27b1cbb0e72add238 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jul 2020 12:34:12 +0200 +Subject: Revert "thermal: mediatek: fix register index error" + +From: Enric Balletbo i Serra + +[ Upstream commit a8f62f183021be389561570ab5f8c701a5e70298 ] + +This reverts commit eb9aecd90d1a39601e91cd08b90d5fee51d321a6 + +The above patch is supposed to fix a register index error on mt2701. It +is not clear if the problem solved is a hang or just an invalid value +returned, my guess is the second. The patch introduces, though, a new +hang on MT8173 device making them unusable. So, seems reasonable, revert +the patch because introduces a worst issue. + +The reason I send a revert instead of trying to fix the issue for MT8173 +is because the information needed to fix the issue is in the datasheet +and is not public. So I am not really able to fix it. + +Fixes the following bug when CONFIG_MTK_THERMAL is set on MT8173 +devices. + +[ 2.222488] Unable to handle kernel paging request at virtual address ffff8000125f5001 +[ 2.230421] Mem abort info: +[ 2.233207] ESR = 0x96000021 +[ 2.236261] EC = 0x25: DABT (current EL), IL = 32 bits +[ 2.241571] SET = 0, FnV = 0 +[ 2.244623] EA = 0, S1PTW = 0 +[ 2.247762] Data abort info: +[ 2.250640] ISV = 0, ISS = 0x00000021 +[ 2.254473] CM = 0, WnR = 0 +[ 2.257544] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000041850000 +[ 2.264251] [ffff8000125f5001] pgd=000000013ffff003, pud=000000013fffe003, pmd=000000013fff9003, pte=006800001100b707 +[ 2.274867] Internal error: Oops: 96000021 [#1] PREEMPT SMP +[ 2.280432] Modules linked in: +[ 2.283483] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.7.0-rc6+ #162 +[ 2.289914] Hardware name: Google Elm (DT) +[ 2.294003] pstate: 20000005 (nzCv daif -PAN -UAO) +[ 2.298792] pc : mtk_read_temp+0xb8/0x1c8 +[ 2.302793] lr : mtk_read_temp+0x7c/0x1c8 +[ 2.306794] sp : ffff80001003b930 +[ 2.310100] x29: ffff80001003b930 x28: 0000000000000000 +[ 2.315404] x27: 0000000000000002 x26: ffff0000f9550b10 +[ 2.320709] x25: ffff0000f9550a80 x24: 0000000000000090 +[ 2.326014] x23: ffff80001003ba24 x22: 00000000610344c0 +[ 2.331318] x21: 0000000000002710 x20: 00000000000001f4 +[ 2.336622] x19: 0000000000030d40 x18: ffff800011742ec0 +[ 2.341926] x17: 0000000000000001 x16: 0000000000000001 +[ 2.347230] x15: ffffffffffffffff x14: ffffff0000000000 +[ 2.352535] x13: ffffffffffffffff x12: 0000000000000028 +[ 2.357839] x11: 0000000000000003 x10: ffff800011295ec8 +[ 2.363143] x9 : 000000000000291b x8 : 0000000000000002 +[ 2.368447] x7 : 00000000000000a8 x6 : 0000000000000004 +[ 2.373751] x5 : 0000000000000000 x4 : ffff800011295cb0 +[ 2.379055] x3 : 0000000000000002 x2 : ffff8000125f5001 +[ 2.384359] x1 : 0000000000000001 x0 : ffff0000f9550a80 +[ 2.389665] Call trace: +[ 2.392105] mtk_read_temp+0xb8/0x1c8 +[ 2.395760] of_thermal_get_temp+0x2c/0x40 +[ 2.399849] thermal_zone_get_temp+0x78/0x160 +[ 2.404198] thermal_zone_device_update.part.0+0x3c/0x1f8 +[ 2.409589] thermal_zone_device_update+0x34/0x48 +[ 2.414286] of_thermal_set_mode+0x58/0x88 +[ 2.418375] thermal_zone_of_sensor_register+0x1a8/0x1d8 +[ 2.423679] devm_thermal_zone_of_sensor_register+0x64/0xb0 +[ 2.429242] mtk_thermal_probe+0x690/0x7d0 +[ 2.433333] platform_drv_probe+0x5c/0xb0 +[ 2.437335] really_probe+0xe4/0x448 +[ 2.440901] driver_probe_device+0xe8/0x140 +[ 2.445077] device_driver_attach+0x7c/0x88 +[ 2.449252] __driver_attach+0xac/0x178 +[ 2.453082] bus_for_each_dev+0x78/0xc8 +[ 2.456909] driver_attach+0x2c/0x38 +[ 2.460476] bus_add_driver+0x14c/0x230 +[ 2.464304] driver_register+0x6c/0x128 +[ 2.468131] __platform_driver_register+0x50/0x60 +[ 2.472831] mtk_thermal_driver_init+0x24/0x30 +[ 2.477268] do_one_initcall+0x50/0x298 +[ 2.481098] kernel_init_freeable+0x1ec/0x264 +[ 2.485450] kernel_init+0x1c/0x110 +[ 2.488931] ret_from_fork+0x10/0x1c +[ 2.492502] Code: f9401081 f9400402 b8a67821 8b010042 (b9400042) +[ 2.498599] ---[ end trace e43e3105ed27dc99 ]--- +[ 2.503367] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b +[ 2.511020] SMP: stopping secondary CPUs +[ 2.514941] Kernel Offset: disabled +[ 2.518421] CPU features: 0x090002,25006005 +[ 2.522595] Memory Limit: none +[ 2.525644] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]-- + +Cc: Michael Kao +Fixes: eb9aecd90d1a ("thermal: mediatek: fix register index error") +Signed-off-by: Enric Balletbo i Serra +Reviewed-by: Matthias Brugger +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20200707103412.1010823-1-enric.balletbo@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/thermal/mtk_thermal.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c +index d6fabd0a7da69..2783973b101c3 100644 +--- a/drivers/thermal/mtk_thermal.c ++++ b/drivers/thermal/mtk_thermal.c +@@ -594,8 +594,7 @@ static int mtk_thermal_bank_temperature(struct mtk_thermal_bank *bank) + u32 raw; + + for (i = 0; i < conf->bank_data[bank->id].num_sensors; i++) { +- raw = readl(mt->thermal_base + +- conf->msr[conf->bank_data[bank->id].sensors[i]]); ++ raw = readl(mt->thermal_base + conf->msr[i]); + + temp = raw_to_mcelsius(mt, + conf->bank_data[bank->id].sensors[i], +@@ -736,8 +735,7 @@ static void mtk_thermal_init_bank(struct mtk_thermal *mt, int num, + + for (i = 0; i < conf->bank_data[num].num_sensors; i++) + writel(conf->sensor_mux_values[conf->bank_data[num].sensors[i]], +- mt->thermal_base + +- conf->adcpnp[conf->bank_data[num].sensors[i]]); ++ mt->thermal_base + conf->adcpnp[i]); + + writel((1 << conf->bank_data[num].num_sensors) - 1, + controller_base + TEMP_MONCTL0); +-- +2.25.1 + diff --git a/queue-5.4/series b/queue-5.4/series index 0f823776667..8bc65727272 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -91,3 +91,29 @@ input-mms114-add-extra-compatible-for-mms345l.patch acpi-video-use-native-backlight-on-acer-travelmate-5.patch bus-ti-sysc-use-optional-clocks-on-for-enable-and-wa.patch alsa-usb-audio-add-registration-quirk-for-kingston-h.patch-6661 +iio-health-afe4404-fix-timestamp-alignment-and-preve.patch +soundwire-intel-fix-memory-leak-with-devm_kasprintf.patch +dmaengine-sh-usb-dmac-set-tx_result-parameters.patch +phy-sun4i-usb-fix-dereference-of-pointer-phy0-before.patch +arm64-dts-meson-add-missing-gxl-rng-clock.patch +arm64-dts-meson-gxl-s805x-reduce-initial-mali450-cor.patch +bus-ti-sysc-fix-wakeirq-sleeping-function-called-fro.patch +bus-ti-sysc-fix-sleeping-function-called-from-invali.patch +bus-ti-sysc-do-not-disable-on-suspend-for-no-idle.patch +iio-adc-ad7780-fix-a-resource-handling-path-in-ad778.patch +dmaengine-dw-initialize-channel-before-each-transfer.patch +dmaengine-dmatest-stop-completed-threads-when-runnin.patch +spi-spi-sun6i-sun6i_spi_transfer_one-fix-setting-of-.patch +usb-gadget-udc-atmel-fix-uninitialized-read-in-debug.patch +staging-comedi-verify-array-index-is-correct-before-.patch +clk-mvebu-armada_ap_cpu_clk-needs-to-select-armada_a.patch +clk-ast2600-add-mux-for-emmc-clock.patch +nfs-fix-interrupted-slots-by-sending-a-solo-sequence.patch +fuse-don-t-ignore-errors-from-fuse_writepages_fill.patch +arm-dts-fix-dcan-driver-probe-failed-on-am437x-platf.patch +revert-thermal-mediatek-fix-register-index-error.patch +xprtrdma-fix-incorrect-header-size-calculations.patch +arm-dts-socfpga-align-l2-cache-controller-nodename-w.patch +arm64-dts-spcfpga-align-gic-nand-and-uart-nodenames-.patch +keys-asymmetric-fix-error-return-code-in-software_ke.patch +regmap-debugfs-don-t-sleep-while-atomic-for-fast_io-.patch diff --git a/queue-5.4/soundwire-intel-fix-memory-leak-with-devm_kasprintf.patch b/queue-5.4/soundwire-intel-fix-memory-leak-with-devm_kasprintf.patch new file mode 100644 index 00000000000..3d52ee10b68 --- /dev/null +++ b/queue-5.4/soundwire-intel-fix-memory-leak-with-devm_kasprintf.patch @@ -0,0 +1,46 @@ +From e8bf139dcb1e4b634b395b4a7d54274bb1c2a115 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 11:35:36 -0500 +Subject: soundwire: intel: fix memory leak with devm_kasprintf + +From: Pierre-Louis Bossart + +[ Upstream commit bf6d6e68d2028a2d82f4c106f50ec75cc1e6ef89 ] + +The dais are allocated with devm_kcalloc() but their name isn't +resourced managed and never freed. Fix by also using devm_ for the dai +names as well. + +Fixes: c46302ec554c5 ('soundwire: intel: Add audio DAI ops') +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Daniel Baluta +Reviewed-by: Kai Vehmanen +Reviewed-by: Rander Wang +Reviewed-by: Guennadi Liakhovetski +Reviewed-by: Bard Liao +Link: https://lore.kernel.org/r/20200617163536.17401-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/intel.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c +index d1839707128a8..243af8198d1c6 100644 +--- a/drivers/soundwire/intel.c ++++ b/drivers/soundwire/intel.c +@@ -842,8 +842,9 @@ static int intel_create_dai(struct sdw_cdns *cdns, + + /* TODO: Read supported rates/formats from hardware */ + for (i = off; i < (off + num); i++) { +- dais[i].name = kasprintf(GFP_KERNEL, "SDW%d Pin%d", +- cdns->instance, i); ++ dais[i].name = devm_kasprintf(cdns->dev, GFP_KERNEL, ++ "SDW%d Pin%d", ++ cdns->instance, i); + if (!dais[i].name) + return -ENOMEM; + +-- +2.25.1 + diff --git a/queue-5.4/spi-spi-sun6i-sun6i_spi_transfer_one-fix-setting-of-.patch b/queue-5.4/spi-spi-sun6i-sun6i_spi_transfer_one-fix-setting-of-.patch new file mode 100644 index 00000000000..8052b689dde --- /dev/null +++ b/queue-5.4/spi-spi-sun6i-sun6i_spi_transfer_one-fix-setting-of-.patch @@ -0,0 +1,70 @@ +From e2095aa5d86f1fc529ad463132a8f05901431c9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jul 2020 16:34:34 +0200 +Subject: spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock rate + +From: Marc Kleine-Budde + +[ Upstream commit ed7815db70d17b1741883f2da8e1d80bc2efe517 ] + +A SPI transfer defines the _maximum_ speed of the SPI transfer. However the +driver doesn't take into account that the clock divider is always rounded down +(due to integer arithmetics). This results in a too high clock rate for the SPI +transfer. + +E.g.: with a mclk_rate of 24 MHz and a SPI transfer speed of 10 MHz, the +original code calculates a reg of "0", which results in a effective divider of +"2" and a 12 MHz clock for the SPI transfer. + +This patch fixes the issue by using DIV_ROUND_UP() instead of a plain +integer division. + +While there simplify the divider calculation for the CDR1 case, use +order_base_2() instead of two ilog2() calculations. + +Fixes: 3558fe900e8a ("spi: sunxi: Add Allwinner A31 SPI controller driver") +Signed-off-by: Marc Kleine-Budde +Acked-by: Maxime Ripard +Link: https://lore.kernel.org/r/20200706143443.9855-2-mkl@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-sun6i.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c +index ec7967be9e2f5..956df79035d56 100644 +--- a/drivers/spi/spi-sun6i.c ++++ b/drivers/spi/spi-sun6i.c +@@ -198,7 +198,7 @@ static int sun6i_spi_transfer_one(struct spi_master *master, + struct spi_transfer *tfr) + { + struct sun6i_spi *sspi = spi_master_get_devdata(master); +- unsigned int mclk_rate, div, timeout; ++ unsigned int mclk_rate, div, div_cdr1, div_cdr2, timeout; + unsigned int start, end, tx_time; + unsigned int trig_level; + unsigned int tx_len = 0; +@@ -287,14 +287,12 @@ static int sun6i_spi_transfer_one(struct spi_master *master, + * First try CDR2, and if we can't reach the expected + * frequency, fall back to CDR1. + */ +- div = mclk_rate / (2 * tfr->speed_hz); +- if (div <= (SUN6I_CLK_CTL_CDR2_MASK + 1)) { +- if (div > 0) +- div--; +- +- reg = SUN6I_CLK_CTL_CDR2(div) | SUN6I_CLK_CTL_DRS; ++ div_cdr1 = DIV_ROUND_UP(mclk_rate, tfr->speed_hz); ++ div_cdr2 = DIV_ROUND_UP(div_cdr1, 2); ++ if (div_cdr2 <= (SUN6I_CLK_CTL_CDR2_MASK + 1)) { ++ reg = SUN6I_CLK_CTL_CDR2(div_cdr2 - 1) | SUN6I_CLK_CTL_DRS; + } else { +- div = ilog2(mclk_rate) - ilog2(tfr->speed_hz); ++ div = min(SUN6I_CLK_CTL_CDR1_MASK, order_base_2(div_cdr1)); + reg = SUN6I_CLK_CTL_CDR1(div); + } + +-- +2.25.1 + diff --git a/queue-5.4/staging-comedi-verify-array-index-is-correct-before-.patch b/queue-5.4/staging-comedi-verify-array-index-is-correct-before-.patch new file mode 100644 index 00000000000..e6ebdc1462b --- /dev/null +++ b/queue-5.4/staging-comedi-verify-array-index-is-correct-before-.patch @@ -0,0 +1,54 @@ +From fbca94ba564ef6605c4602713a32f67eaa33a1eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jul 2020 13:29:36 +0300 +Subject: staging: comedi: verify array index is correct before using it + +From: Dan Carpenter + +[ Upstream commit ef75e14a6c935eec82abac07ab68e388514e39bc ] + +This code reads from the array before verifying that "trig" is a valid +index. If the index is wildly out of bounds then reading from an +invalid address could lead to an Oops. + +Fixes: a8c66b684efa ("staging: comedi: addi_apci_1500: rewrite the subdevice support functions") +Signed-off-by: Dan Carpenter +Reviewed-by: Ian Abbott +Link: https://lore.kernel.org/r/20200709102936.GA20875@mwanda +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/comedi/drivers/addi_apci_1500.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c b/drivers/staging/comedi/drivers/addi_apci_1500.c +index 45ad4ba92f94f..689acd69a1b9c 100644 +--- a/drivers/staging/comedi/drivers/addi_apci_1500.c ++++ b/drivers/staging/comedi/drivers/addi_apci_1500.c +@@ -456,9 +456,9 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev, + unsigned int lo_mask = data[5] << shift; + unsigned int chan_mask = hi_mask | lo_mask; + unsigned int old_mask = (1 << shift) - 1; +- unsigned int pm = devpriv->pm[trig] & old_mask; +- unsigned int pt = devpriv->pt[trig] & old_mask; +- unsigned int pp = devpriv->pp[trig] & old_mask; ++ unsigned int pm; ++ unsigned int pt; ++ unsigned int pp; + + if (trig > 1) { + dev_dbg(dev->class_dev, +@@ -471,6 +471,10 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev, + return -EINVAL; + } + ++ pm = devpriv->pm[trig] & old_mask; ++ pt = devpriv->pt[trig] & old_mask; ++ pp = devpriv->pp[trig] & old_mask; ++ + switch (data[2]) { + case COMEDI_DIGITAL_TRIG_DISABLE: + /* clear trigger configuration */ +-- +2.25.1 + diff --git a/queue-5.4/usb-gadget-udc-atmel-fix-uninitialized-read-in-debug.patch b/queue-5.4/usb-gadget-udc-atmel-fix-uninitialized-read-in-debug.patch new file mode 100644 index 00000000000..01e4926f8d8 --- /dev/null +++ b/queue-5.4/usb-gadget-udc-atmel-fix-uninitialized-read-in-debug.patch @@ -0,0 +1,39 @@ +From 99a92c175df3fafee2f1f9b0bf97aa02afaa4d08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 May 2020 20:35:54 +0200 +Subject: usb: gadget: udc: atmel: fix uninitialized read in debug printk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Mirosław + +[ Upstream commit 30517ffeb3bff842e1355cbc32f1959d9dbb5414 ] + +Fixed commit moved the assignment of 'req', but did not update a +reference in the DBG() call. Use the argument as it was renamed. + +Fixes: 5fb694f96e7c ("usb: gadget: udc: atmel: fix possible oops when unloading module") +Signed-off-by: Michał Mirosław +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/atmel_usba_udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c +index 58e5b015d40e6..bebe814f55e6a 100644 +--- a/drivers/usb/gadget/udc/atmel_usba_udc.c ++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c +@@ -870,7 +870,7 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req) + u32 status; + + DBG(DBG_GADGET | DBG_QUEUE, "ep_dequeue: %s, req %p\n", +- ep->ep.name, req); ++ ep->ep.name, _req); + + spin_lock_irqsave(&udc->lock, flags); + +-- +2.25.1 + diff --git a/queue-5.4/xprtrdma-fix-incorrect-header-size-calculations.patch b/queue-5.4/xprtrdma-fix-incorrect-header-size-calculations.patch new file mode 100644 index 00000000000..573c775629d --- /dev/null +++ b/queue-5.4/xprtrdma-fix-incorrect-header-size-calculations.patch @@ -0,0 +1,49 @@ +From 83ba506a120d9f191b98b550ee615c0ff726c6f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jul 2020 17:26:04 +0100 +Subject: xprtrdma: fix incorrect header size calculations + +From: Colin Ian King + +[ Upstream commit 912288442cb2f431bf3c8cb097a5de83bc6dbac1 ] + +Currently the header size calculations are using an assignment +operator instead of a += operator when accumulating the header +size leading to incorrect sizes. Fix this by using the correct +operator. + +Addresses-Coverity: ("Unused value") +Fixes: 302d3deb2068 ("xprtrdma: Prevent inline overflow") +Signed-off-by: Colin Ian King +Reviewed-by: Chuck Lever +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprtrdma/rpc_rdma.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c +index c56e6cfc4a623..21970185485fc 100644 +--- a/net/sunrpc/xprtrdma/rpc_rdma.c ++++ b/net/sunrpc/xprtrdma/rpc_rdma.c +@@ -71,7 +71,7 @@ static unsigned int rpcrdma_max_call_header_size(unsigned int maxsegs) + size = RPCRDMA_HDRLEN_MIN; + + /* Maximum Read list size */ +- size = maxsegs * rpcrdma_readchunk_maxsz * sizeof(__be32); ++ size += maxsegs * rpcrdma_readchunk_maxsz * sizeof(__be32); + + /* Minimal Read chunk size */ + size += sizeof(__be32); /* segment count */ +@@ -96,7 +96,7 @@ static unsigned int rpcrdma_max_reply_header_size(unsigned int maxsegs) + size = RPCRDMA_HDRLEN_MIN; + + /* Maximum Write list size */ +- size = sizeof(__be32); /* segment count */ ++ size += sizeof(__be32); /* segment count */ + size += maxsegs * rpcrdma_segment_maxsz * sizeof(__be32); + size += sizeof(__be32); /* list discriminator */ + +-- +2.25.1 +