From: Greg Kroah-Hartman Date: Mon, 27 Apr 2020 14:30:40 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v4.19.119~24 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4f21f7fe475025576f8c9fc597f3b08a81740727;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: iio-adc-stm32-adc-fix-sleep-in-atomic-context.patch iio-adc-ti-ads8344-properly-byte-swap-value.patch iio-core-remove-extra-semi-colon-from-devm_iio_device_register-macro.patch iio-st_sensors-rely-on-odr-mask-to-know-if-odr-can-be-set.patch iio-xilinx-xadc-fix-adc-b-powerdown.patch iio-xilinx-xadc-fix-clearing-interrupt-when-enabling-trigger.patch iio-xilinx-xadc-fix-sequencer-configuration-for-aux-channels-in-simultaneous-mode.patch iio-xilinx-xadc-make-sure-not-exceed-maximum-samplerate.patch tty-serial-owl-add-much-needed-clk_prepare_enable.patch usb-add-usb_quirk_delay_ctrl_msg-and-usb_quirk_delay_init-for-corsair-k70-rgb-rapidfire.patch usb-core-fix-free-while-in-use-bug-in-the-usb-s-glibrary.patch usb-early-handle-amd-s-spec-compliant-identifiers-too.patch usb-hub-fix-handling-of-connect-changes-during-sleep.patch usb-hub-revert-commit-bd0e6c9614b9-usb-hub-try-old-enumeration-scheme-first-for-high-speed-devices.patch usb-sisusbvga-change-port-variable-from-signed-to-unsigned.patch --- diff --git a/queue-5.4/iio-adc-stm32-adc-fix-sleep-in-atomic-context.patch b/queue-5.4/iio-adc-stm32-adc-fix-sleep-in-atomic-context.patch new file mode 100644 index 00000000000..f034cd1077b --- /dev/null +++ b/queue-5.4/iio-adc-stm32-adc-fix-sleep-in-atomic-context.patch @@ -0,0 +1,82 @@ +From e2042d2936dfc84e9c600fe9b9d0039ca0e54b7d Mon Sep 17 00:00:00 2001 +From: Olivier Moysan +Date: Mon, 9 Mar 2020 11:02:12 +0100 +Subject: iio: adc: stm32-adc: fix sleep in atomic context + +From: Olivier Moysan + +commit e2042d2936dfc84e9c600fe9b9d0039ca0e54b7d upstream. + +This commit fixes the following error: +"BUG: sleeping function called from invalid context at kernel/irq/chip.c" + +In DMA mode suppress the trigger irq handler, and make the buffer +transfers directly in DMA callback, instead. + +Fixes: 2763ea0585c9 ("iio: adc: stm32: add optional dma support") +Signed-off-by: Olivier Moysan +Acked-by: Fabrice Gasnier +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/stm32-adc.c | 31 ++++++++++++++++++++++++++++--- + 1 file changed, 28 insertions(+), 3 deletions(-) + +--- a/drivers/iio/adc/stm32-adc.c ++++ b/drivers/iio/adc/stm32-adc.c +@@ -1367,8 +1367,30 @@ static unsigned int stm32_adc_dma_residu + static void stm32_adc_dma_buffer_done(void *data) + { + struct iio_dev *indio_dev = data; ++ struct stm32_adc *adc = iio_priv(indio_dev); ++ int residue = stm32_adc_dma_residue(adc); ++ ++ /* ++ * In DMA mode the trigger services of IIO are not used ++ * (e.g. no call to iio_trigger_poll). ++ * Calling irq handler associated to the hardware trigger is not ++ * relevant as the conversions have already been done. Data ++ * transfers are performed directly in DMA callback instead. ++ * This implementation avoids to call trigger irq handler that ++ * may sleep, in an atomic context (DMA irq handler context). ++ */ ++ dev_dbg(&indio_dev->dev, "%s bufi=%d\n", __func__, adc->bufi); ++ ++ while (residue >= indio_dev->scan_bytes) { ++ u16 *buffer = (u16 *)&adc->rx_buf[adc->bufi]; + +- iio_trigger_poll_chained(indio_dev->trig); ++ iio_push_to_buffers(indio_dev, buffer); ++ ++ residue -= indio_dev->scan_bytes; ++ adc->bufi += indio_dev->scan_bytes; ++ if (adc->bufi >= adc->rx_buf_sz) ++ adc->bufi = 0; ++ } + } + + static int stm32_adc_dma_start(struct iio_dev *indio_dev) +@@ -1778,6 +1800,7 @@ static int stm32_adc_probe(struct platfo + { + struct iio_dev *indio_dev; + struct device *dev = &pdev->dev; ++ irqreturn_t (*handler)(int irq, void *p) = NULL; + struct stm32_adc *adc; + int ret; + +@@ -1843,9 +1866,11 @@ static int stm32_adc_probe(struct platfo + if (ret < 0) + return ret; + ++ if (!adc->dma_chan) ++ handler = &stm32_adc_trigger_handler; ++ + ret = iio_triggered_buffer_setup(indio_dev, +- &iio_pollfunc_store_time, +- &stm32_adc_trigger_handler, ++ &iio_pollfunc_store_time, handler, + &stm32_adc_buffer_setup_ops); + if (ret) { + dev_err(&pdev->dev, "buffer setup failed\n"); diff --git a/queue-5.4/iio-adc-ti-ads8344-properly-byte-swap-value.patch b/queue-5.4/iio-adc-ti-ads8344-properly-byte-swap-value.patch new file mode 100644 index 00000000000..711be163d40 --- /dev/null +++ b/queue-5.4/iio-adc-ti-ads8344-properly-byte-swap-value.patch @@ -0,0 +1,50 @@ +From dd7de4c0023e7564cabe39d64b2822a522890792 Mon Sep 17 00:00:00 2001 +From: Alexandre Belloni +Date: Thu, 16 Apr 2020 22:54:27 +0200 +Subject: iio: adc: ti-ads8344: properly byte swap value + +From: Alexandre Belloni + +commit dd7de4c0023e7564cabe39d64b2822a522890792 upstream. + +The first received byte is the MSB, followed by the LSB so the value needs +to be byte swapped. + +Also, the ADC actually has a delay of one clock on the SPI bus. Read three +bytes to get the last bit. + +Fixes: 8dd2d7c0fed7 ("iio: adc: Add driver for the TI ADS8344 A/DC chips") +Signed-off-by: Alexandre Belloni +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/ti-ads8344.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/iio/adc/ti-ads8344.c ++++ b/drivers/iio/adc/ti-ads8344.c +@@ -29,7 +29,7 @@ struct ads8344 { + struct mutex lock; + + u8 tx_buf ____cacheline_aligned; +- u16 rx_buf; ++ u8 rx_buf[3]; + }; + + #define ADS8344_VOLTAGE_CHANNEL(chan, si) \ +@@ -89,11 +89,11 @@ static int ads8344_adc_conversion(struct + + udelay(9); + +- ret = spi_read(spi, &adc->rx_buf, 2); ++ ret = spi_read(spi, adc->rx_buf, sizeof(adc->rx_buf)); + if (ret) + return ret; + +- return adc->rx_buf; ++ return adc->rx_buf[0] << 9 | adc->rx_buf[1] << 1 | adc->rx_buf[2] >> 7; + } + + static int ads8344_read_raw(struct iio_dev *iio, diff --git a/queue-5.4/iio-core-remove-extra-semi-colon-from-devm_iio_device_register-macro.patch b/queue-5.4/iio-core-remove-extra-semi-colon-from-devm_iio_device_register-macro.patch new file mode 100644 index 00000000000..da6635e5fa6 --- /dev/null +++ b/queue-5.4/iio-core-remove-extra-semi-colon-from-devm_iio_device_register-macro.patch @@ -0,0 +1,34 @@ +From a07479147be03d2450376ebaff9ea1a0682f25d6 Mon Sep 17 00:00:00 2001 +From: Lars Engebretsen +Date: Wed, 15 Apr 2020 12:10:43 +0200 +Subject: iio: core: remove extra semi-colon from devm_iio_device_register() macro + +From: Lars Engebretsen + +commit a07479147be03d2450376ebaff9ea1a0682f25d6 upstream. + +This change removes the semi-colon from the devm_iio_device_register() +macro which seems to have been added by accident. + +Fixes: 63b19547cc3d9 ("iio: Use macro magic to avoid manual assign of driver_module") +Signed-off-by: Lars Engebretsen +Cc: +Reviewed-by: Alexandru Ardelean +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/iio/iio.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/iio/iio.h ++++ b/include/linux/iio/iio.h +@@ -596,7 +596,7 @@ void iio_device_unregister(struct iio_de + * 0 on success, negative error number on failure. + */ + #define devm_iio_device_register(dev, indio_dev) \ +- __devm_iio_device_register((dev), (indio_dev), THIS_MODULE); ++ __devm_iio_device_register((dev), (indio_dev), THIS_MODULE) + int __devm_iio_device_register(struct device *dev, struct iio_dev *indio_dev, + struct module *this_mod); + void devm_iio_device_unregister(struct device *dev, struct iio_dev *indio_dev); diff --git a/queue-5.4/iio-st_sensors-rely-on-odr-mask-to-know-if-odr-can-be-set.patch b/queue-5.4/iio-st_sensors-rely-on-odr-mask-to-know-if-odr-can-be-set.patch new file mode 100644 index 00000000000..5333787c87d --- /dev/null +++ b/queue-5.4/iio-st_sensors-rely-on-odr-mask-to-know-if-odr-can-be-set.patch @@ -0,0 +1,36 @@ +From e450e07c14abae563ad13b064cbce9fdccc6bc8d Mon Sep 17 00:00:00 2001 +From: Lary Gibaud +Date: Sat, 11 Apr 2020 17:16:06 +0200 +Subject: iio: st_sensors: rely on odr mask to know if odr can be set + +From: Lary Gibaud + +commit e450e07c14abae563ad13b064cbce9fdccc6bc8d upstream. + +Indeed, relying on addr being not 0 cannot work because some device have +their register to set odr at address 0. As a matter of fact, if the odr +can be set, then there is a mask. + +Sensors with ODR register at address 0 are: lsm303dlh, lsm303dlhc, lsm303dlm + +Fixes: 7d245172675a ("iio: common: st_sensors: check odr address value in st_sensors_set_odr()") +Signed-off-by: Lary Gibaud +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/common/st_sensors/st_sensors_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/common/st_sensors/st_sensors_core.c ++++ b/drivers/iio/common/st_sensors/st_sensors_core.c +@@ -80,7 +80,7 @@ int st_sensors_set_odr(struct iio_dev *i + struct st_sensor_odr_avl odr_out = {0, 0}; + struct st_sensor_data *sdata = iio_priv(indio_dev); + +- if (!sdata->sensor_settings->odr.addr) ++ if (!sdata->sensor_settings->odr.mask) + return 0; + + err = st_sensors_match_odr(sdata->sensor_settings, odr, &odr_out); diff --git a/queue-5.4/iio-xilinx-xadc-fix-adc-b-powerdown.patch b/queue-5.4/iio-xilinx-xadc-fix-adc-b-powerdown.patch new file mode 100644 index 00000000000..0e354d853f4 --- /dev/null +++ b/queue-5.4/iio-xilinx-xadc-fix-adc-b-powerdown.patch @@ -0,0 +1,42 @@ +From e44ec7794d88f918805d700240211a9ec05ed89d Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Fri, 3 Apr 2020 15:27:13 +0200 +Subject: iio: xilinx-xadc: Fix ADC-B powerdown + +From: Lars-Peter Clausen + +commit e44ec7794d88f918805d700240211a9ec05ed89d upstream. + +The check for shutting down the second ADC is inverted. This causes it to +be powered down when it should be enabled. As a result channels that are +supposed to be handled by the second ADC return invalid conversion results. + +Signed-off-by: Lars-Peter Clausen +Fixes: bdc8cda1d010 ("iio:adc: Add Xilinx XADC driver") +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/xilinx-xadc-core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/iio/adc/xilinx-xadc-core.c ++++ b/drivers/iio/adc/xilinx-xadc-core.c +@@ -722,13 +722,14 @@ static int xadc_power_adc_b(struct xadc + { + uint16_t val; + ++ /* Powerdown the ADC-B when it is not needed. */ + switch (seq_mode) { + case XADC_CONF1_SEQ_SIMULTANEOUS: + case XADC_CONF1_SEQ_INDEPENDENT: +- val = XADC_CONF2_PD_ADC_B; ++ val = 0; + break; + default: +- val = 0; ++ val = XADC_CONF2_PD_ADC_B; + break; + } + diff --git a/queue-5.4/iio-xilinx-xadc-fix-clearing-interrupt-when-enabling-trigger.patch b/queue-5.4/iio-xilinx-xadc-fix-clearing-interrupt-when-enabling-trigger.patch new file mode 100644 index 00000000000..9e45c671af8 --- /dev/null +++ b/queue-5.4/iio-xilinx-xadc-fix-clearing-interrupt-when-enabling-trigger.patch @@ -0,0 +1,42 @@ +From f954b098fbac4d183219ce5b42d76d6df2aed50a Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Fri, 3 Apr 2020 15:27:14 +0200 +Subject: iio: xilinx-xadc: Fix clearing interrupt when enabling trigger + +From: Lars-Peter Clausen + +commit f954b098fbac4d183219ce5b42d76d6df2aed50a upstream. + +When enabling the trigger and unmasking the end-of-sequence (EOS) interrupt +the EOS interrupt should be cleared from the status register. Otherwise it +is possible that it was still set from a previous capture. If that is the +case the interrupt would fire immediately even though no conversion has +been done yet and stale data is being read from the device. + +The old code only clears the interrupt if the interrupt was previously +unmasked. Which does not make much sense since the interrupt is always +masked at this point and in addition masking the interrupt does not clear +the interrupt from the status register. So the clearing needs to be done +unconditionally. + +Signed-off-by: Lars-Peter Clausen +Fixes: bdc8cda1d010 ("iio:adc: Add Xilinx XADC driver") +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/xilinx-xadc-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/xilinx-xadc-core.c ++++ b/drivers/iio/adc/xilinx-xadc-core.c +@@ -674,7 +674,7 @@ static int xadc_trigger_set_state(struct + + spin_lock_irqsave(&xadc->lock, flags); + xadc_read_reg(xadc, XADC_AXI_REG_IPIER, &val); +- xadc_write_reg(xadc, XADC_AXI_REG_IPISR, val & XADC_AXI_INT_EOS); ++ xadc_write_reg(xadc, XADC_AXI_REG_IPISR, XADC_AXI_INT_EOS); + if (state) + val |= XADC_AXI_INT_EOS; + else diff --git a/queue-5.4/iio-xilinx-xadc-fix-sequencer-configuration-for-aux-channels-in-simultaneous-mode.patch b/queue-5.4/iio-xilinx-xadc-fix-sequencer-configuration-for-aux-channels-in-simultaneous-mode.patch new file mode 100644 index 00000000000..439eae2ebd6 --- /dev/null +++ b/queue-5.4/iio-xilinx-xadc-fix-sequencer-configuration-for-aux-channels-in-simultaneous-mode.patch @@ -0,0 +1,58 @@ +From 8bef455c8b1694547ee59e8b1939205ed9d901a6 Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Fri, 3 Apr 2020 15:27:15 +0200 +Subject: iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode + +From: Lars-Peter Clausen + +commit 8bef455c8b1694547ee59e8b1939205ed9d901a6 upstream. + +The XADC has two internal ADCs. Depending on the mode it is operating in +either one or both of them are used. The device manual calls this +continuous (one ADC) and simultaneous (both ADCs) mode. + +The meaning of the sequencing register for the aux channels changes +depending on the mode. + +In continuous mode each bit corresponds to one of the 16 aux channels. And +the single ADC will convert them one by one in order. + +In simultaneous mode the aux channels are split into two groups the first 8 +channels are assigned to the first ADC and the other 8 channels to the +second ADC. The upper 8 bits of the sequencing register are unused and the +lower 8 bits control both ADCs. This means a bit needs to be set if either +the corresponding channel from the first group or the second group (or +both) are set. + +Currently the driver does not have the special handling required for +simultaneous mode. Add it. + +Signed-off-by: Lars-Peter Clausen +Fixes: bdc8cda1d010 ("iio:adc: Add Xilinx XADC driver") +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/xilinx-xadc-core.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/iio/adc/xilinx-xadc-core.c ++++ b/drivers/iio/adc/xilinx-xadc-core.c +@@ -798,6 +798,16 @@ static int xadc_preenable(struct iio_dev + if (ret) + goto err; + ++ /* ++ * In simultaneous mode the upper and lower aux channels are samples at ++ * the same time. In this mode the upper 8 bits in the sequencer ++ * register are don't care and the lower 8 bits control two channels ++ * each. As such we must set the bit if either the channel in the lower ++ * group or the upper group is enabled. ++ */ ++ if (seq_mode == XADC_CONF1_SEQ_SIMULTANEOUS) ++ scan_mask = ((scan_mask >> 8) | scan_mask) & 0xff0000; ++ + ret = xadc_write_adc_reg(xadc, XADC_REG_SEQ(1), scan_mask >> 16); + if (ret) + goto err; diff --git a/queue-5.4/iio-xilinx-xadc-make-sure-not-exceed-maximum-samplerate.patch b/queue-5.4/iio-xilinx-xadc-make-sure-not-exceed-maximum-samplerate.patch new file mode 100644 index 00000000000..d88eaeecb51 --- /dev/null +++ b/queue-5.4/iio-xilinx-xadc-make-sure-not-exceed-maximum-samplerate.patch @@ -0,0 +1,180 @@ +From 3b7f9dbb827ce8680b98490215e698b6079a9ec5 Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Fri, 3 Apr 2020 15:27:16 +0200 +Subject: iio: xilinx-xadc: Make sure not exceed maximum samplerate + +From: Lars-Peter Clausen + +commit 3b7f9dbb827ce8680b98490215e698b6079a9ec5 upstream. + +The XADC supports a samplerate of up to 1MSPS. Unfortunately the hardware +does not have a FIFO, which means it generates an interrupt for each +conversion sequence. At one 1MSPS this creates an interrupt storm that +causes the system to soft-lock. + +For this reason the driver limits the maximum samplerate to 150kSPS. +Currently this check is only done when setting a new samplerate. But it is +also possible that the initial samplerate configured in the FPGA bitstream +exceeds the limit. + +In this case when starting to capture data without first changing the +samplerate the system can overload. + +To prevent this check the currently configured samplerate in the probe +function and reduce it to the maximum if necessary. + +Signed-off-by: Lars-Peter Clausen +Fixes: bdc8cda1d010 ("iio:adc: Add Xilinx XADC driver") +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/xilinx-xadc-core.c | 78 ++++++++++++++++++++++++++++--------- + 1 file changed, 60 insertions(+), 18 deletions(-) + +--- a/drivers/iio/adc/xilinx-xadc-core.c ++++ b/drivers/iio/adc/xilinx-xadc-core.c +@@ -102,6 +102,16 @@ static const unsigned int XADC_ZYNQ_UNMA + + #define XADC_FLAGS_BUFFERED BIT(0) + ++/* ++ * The XADC hardware supports a samplerate of up to 1MSPS. Unfortunately it does ++ * not have a hardware FIFO. Which means an interrupt is generated for each ++ * conversion sequence. At 1MSPS sample rate the CPU in ZYNQ7000 is completely ++ * overloaded by the interrupts that it soft-lockups. For this reason the driver ++ * limits the maximum samplerate 150kSPS. At this rate the CPU is fairly busy, ++ * but still responsive. ++ */ ++#define XADC_MAX_SAMPLERATE 150000 ++ + static void xadc_write_reg(struct xadc *xadc, unsigned int reg, + uint32_t val) + { +@@ -834,11 +844,27 @@ static const struct iio_buffer_setup_ops + .postdisable = &xadc_postdisable, + }; + ++static int xadc_read_samplerate(struct xadc *xadc) ++{ ++ unsigned int div; ++ uint16_t val16; ++ int ret; ++ ++ ret = xadc_read_adc_reg(xadc, XADC_REG_CONF2, &val16); ++ if (ret) ++ return ret; ++ ++ div = (val16 & XADC_CONF2_DIV_MASK) >> XADC_CONF2_DIV_OFFSET; ++ if (div < 2) ++ div = 2; ++ ++ return xadc_get_dclk_rate(xadc) / div / 26; ++} ++ + static int xadc_read_raw(struct iio_dev *indio_dev, + struct iio_chan_spec const *chan, int *val, int *val2, long info) + { + struct xadc *xadc = iio_priv(indio_dev); +- unsigned int div; + uint16_t val16; + int ret; + +@@ -891,41 +917,31 @@ static int xadc_read_raw(struct iio_dev + *val = -((273150 << 12) / 503975); + return IIO_VAL_INT; + case IIO_CHAN_INFO_SAMP_FREQ: +- ret = xadc_read_adc_reg(xadc, XADC_REG_CONF2, &val16); +- if (ret) ++ ret = xadc_read_samplerate(xadc); ++ if (ret < 0) + return ret; + +- div = (val16 & XADC_CONF2_DIV_MASK) >> XADC_CONF2_DIV_OFFSET; +- if (div < 2) +- div = 2; +- +- *val = xadc_get_dclk_rate(xadc) / div / 26; +- ++ *val = ret; + return IIO_VAL_INT; + default: + return -EINVAL; + } + } + +-static int xadc_write_raw(struct iio_dev *indio_dev, +- struct iio_chan_spec const *chan, int val, int val2, long info) ++static int xadc_write_samplerate(struct xadc *xadc, int val) + { +- struct xadc *xadc = iio_priv(indio_dev); + unsigned long clk_rate = xadc_get_dclk_rate(xadc); + unsigned int div; + + if (!clk_rate) + return -EINVAL; + +- if (info != IIO_CHAN_INFO_SAMP_FREQ) +- return -EINVAL; +- + if (val <= 0) + return -EINVAL; + + /* Max. 150 kSPS */ +- if (val > 150000) +- val = 150000; ++ if (val > XADC_MAX_SAMPLERATE) ++ val = XADC_MAX_SAMPLERATE; + + val *= 26; + +@@ -938,7 +954,7 @@ static int xadc_write_raw(struct iio_dev + * limit. + */ + div = clk_rate / val; +- if (clk_rate / div / 26 > 150000) ++ if (clk_rate / div / 26 > XADC_MAX_SAMPLERATE) + div++; + if (div < 2) + div = 2; +@@ -949,6 +965,17 @@ static int xadc_write_raw(struct iio_dev + div << XADC_CONF2_DIV_OFFSET); + } + ++static int xadc_write_raw(struct iio_dev *indio_dev, ++ struct iio_chan_spec const *chan, int val, int val2, long info) ++{ ++ struct xadc *xadc = iio_priv(indio_dev); ++ ++ if (info != IIO_CHAN_INFO_SAMP_FREQ) ++ return -EINVAL; ++ ++ return xadc_write_samplerate(xadc, val); ++} ++ + static const struct iio_event_spec xadc_temp_events[] = { + { + .type = IIO_EV_TYPE_THRESH, +@@ -1236,6 +1263,21 @@ static int xadc_probe(struct platform_de + if (ret) + goto err_free_samplerate_trigger; + ++ /* ++ * Make sure not to exceed the maximum samplerate since otherwise the ++ * resulting interrupt storm will soft-lock the system. ++ */ ++ if (xadc->ops->flags & XADC_FLAGS_BUFFERED) { ++ ret = xadc_read_samplerate(xadc); ++ if (ret < 0) ++ goto err_free_samplerate_trigger; ++ if (ret > XADC_MAX_SAMPLERATE) { ++ ret = xadc_write_samplerate(xadc, XADC_MAX_SAMPLERATE); ++ if (ret < 0) ++ goto err_free_samplerate_trigger; ++ } ++ } ++ + ret = request_irq(xadc->irq, xadc->ops->interrupt_handler, 0, + dev_name(&pdev->dev), indio_dev); + if (ret) diff --git a/queue-5.4/series b/queue-5.4/series index fe4f3396d5c..cf5023dbbcb 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -84,3 +84,18 @@ keys-avoid-false-positive-enomem-error-on-key-read.patch alsa-hda-remove-asus-rog-zenith-from-the-blacklist.patch alsa-usb-audio-add-static-mapping-table-for-alc1220-.patch alsa-usb-audio-add-connector-notifier-delegation.patch +iio-core-remove-extra-semi-colon-from-devm_iio_device_register-macro.patch +iio-st_sensors-rely-on-odr-mask-to-know-if-odr-can-be-set.patch +iio-adc-stm32-adc-fix-sleep-in-atomic-context.patch +iio-adc-ti-ads8344-properly-byte-swap-value.patch +iio-xilinx-xadc-fix-adc-b-powerdown.patch +iio-xilinx-xadc-fix-clearing-interrupt-when-enabling-trigger.patch +iio-xilinx-xadc-fix-sequencer-configuration-for-aux-channels-in-simultaneous-mode.patch +iio-xilinx-xadc-make-sure-not-exceed-maximum-samplerate.patch +usb-sisusbvga-change-port-variable-from-signed-to-unsigned.patch +usb-add-usb_quirk_delay_ctrl_msg-and-usb_quirk_delay_init-for-corsair-k70-rgb-rapidfire.patch +usb-early-handle-amd-s-spec-compliant-identifiers-too.patch +usb-core-fix-free-while-in-use-bug-in-the-usb-s-glibrary.patch +usb-hub-fix-handling-of-connect-changes-during-sleep.patch +usb-hub-revert-commit-bd0e6c9614b9-usb-hub-try-old-enumeration-scheme-first-for-high-speed-devices.patch +tty-serial-owl-add-much-needed-clk_prepare_enable.patch diff --git a/queue-5.4/tty-serial-owl-add-much-needed-clk_prepare_enable.patch b/queue-5.4/tty-serial-owl-add-much-needed-clk_prepare_enable.patch new file mode 100644 index 00000000000..540bed19127 --- /dev/null +++ b/queue-5.4/tty-serial-owl-add-much-needed-clk_prepare_enable.patch @@ -0,0 +1,51 @@ +From abf42d2f333b21bf8d33b2fbb8a85fa62037ac01 Mon Sep 17 00:00:00 2001 +From: Amit Singh Tomar +Date: Fri, 17 Apr 2020 01:41:57 +0530 +Subject: tty: serial: owl: add "much needed" clk_prepare_enable() + +From: Amit Singh Tomar + +commit abf42d2f333b21bf8d33b2fbb8a85fa62037ac01 upstream. + +commit 8ba92cf59335 ("arm64: dts: actions: s700: Add Clock Management Unit") +breaks the UART on Cubieboard7-lite (based on S700 SoC), This is due to the +fact that generic clk routine clk_disable_unused() disables the gate clks, +and that in turns disables OWL UART (but UART driver never enables it). To +prove this theory, Andre suggested to use "clk_ignore_unused" in kernel +commnd line and it worked (Kernel happily lands into RAMFS world :)). + +This commit fix this up by adding clk_prepare_enable(). + +Fixes: 8ba92cf59335 ("arm64: dts: actions: s700: Add Clock Management Unit") +Signed-off-by: Amit Singh Tomar +Cc: stable +Link: https://lore.kernel.org/r/1587067917-1400-1-git-send-email-amittomer25@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/owl-uart.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/tty/serial/owl-uart.c ++++ b/drivers/tty/serial/owl-uart.c +@@ -680,6 +680,12 @@ static int owl_uart_probe(struct platfor + return PTR_ERR(owl_port->clk); + } + ++ ret = clk_prepare_enable(owl_port->clk); ++ if (ret) { ++ dev_err(&pdev->dev, "could not enable clk\n"); ++ return ret; ++ } ++ + owl_port->port.dev = &pdev->dev; + owl_port->port.line = pdev->id; + owl_port->port.type = PORT_OWL; +@@ -712,6 +718,7 @@ static int owl_uart_remove(struct platfo + + uart_remove_one_port(&owl_uart_driver, &owl_port->port); + owl_uart_ports[pdev->id] = NULL; ++ clk_disable_unprepare(owl_port->clk); + + return 0; + } diff --git a/queue-5.4/usb-add-usb_quirk_delay_ctrl_msg-and-usb_quirk_delay_init-for-corsair-k70-rgb-rapidfire.patch b/queue-5.4/usb-add-usb_quirk_delay_ctrl_msg-and-usb_quirk_delay_init-for-corsair-k70-rgb-rapidfire.patch new file mode 100644 index 00000000000..94eea5ccf46 --- /dev/null +++ b/queue-5.4/usb-add-usb_quirk_delay_ctrl_msg-and-usb_quirk_delay_init-for-corsair-k70-rgb-rapidfire.patch @@ -0,0 +1,35 @@ +From be34a5854b4606bd7a160ad3cb43415d623596c7 Mon Sep 17 00:00:00 2001 +From: Jonathan Cox +Date: Fri, 10 Apr 2020 14:24:27 -0700 +Subject: USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair K70 RGB RAPIDFIRE + +From: Jonathan Cox + +commit be34a5854b4606bd7a160ad3cb43415d623596c7 upstream. + +The Corsair K70 RGB RAPIDFIRE needs the USB_QUIRK_DELAY_INIT and +USB_QUIRK_DELAY_CTRL_MSG to function or it will randomly not +respond on boot, just like other Corsair keyboards + +Signed-off-by: Jonathan Cox +Cc: stable +Link: https://lore.kernel.org/r/20200410212427.2886-1-jonathan@jdcox.net +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -430,6 +430,10 @@ static const struct usb_device_id usb_qu + /* Corsair K70 LUX */ + { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT }, + ++ /* Corsair K70 RGB RAPDIFIRE */ ++ { USB_DEVICE(0x1b1c, 0x1b38), .driver_info = USB_QUIRK_DELAY_INIT | ++ USB_QUIRK_DELAY_CTRL_MSG }, ++ + /* MIDI keyboard WORLDE MINI */ + { USB_DEVICE(0x1c75, 0x0204), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, diff --git a/queue-5.4/usb-core-fix-free-while-in-use-bug-in-the-usb-s-glibrary.patch b/queue-5.4/usb-core-fix-free-while-in-use-bug-in-the-usb-s-glibrary.patch new file mode 100644 index 00000000000..9a116148851 --- /dev/null +++ b/queue-5.4/usb-core-fix-free-while-in-use-bug-in-the-usb-s-glibrary.patch @@ -0,0 +1,90 @@ +From 056ad39ee9253873522f6469c3364964a322912b Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Sat, 28 Mar 2020 16:18:11 -0400 +Subject: USB: core: Fix free-while-in-use bug in the USB S-Glibrary + +From: Alan Stern + +commit 056ad39ee9253873522f6469c3364964a322912b upstream. + +FuzzUSB (a variant of syzkaller) found a free-while-still-in-use bug +in the USB scatter-gather library: + +BUG: KASAN: use-after-free in atomic_read +include/asm-generic/atomic-instrumented.h:26 [inline] +BUG: KASAN: use-after-free in usb_hcd_unlink_urb+0x5f/0x170 +drivers/usb/core/hcd.c:1607 +Read of size 4 at addr ffff888065379610 by task kworker/u4:1/27 + +CPU: 1 PID: 27 Comm: kworker/u4:1 Not tainted 5.5.11 #2 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS +1.10.2-1ubuntu1 04/01/2014 +Workqueue: scsi_tmf_2 scmd_eh_abort_handler +Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0xce/0x128 lib/dump_stack.c:118 + print_address_description.constprop.4+0x21/0x3c0 mm/kasan/report.c:374 + __kasan_report+0x153/0x1cb mm/kasan/report.c:506 + kasan_report+0x12/0x20 mm/kasan/common.c:639 + check_memory_region_inline mm/kasan/generic.c:185 [inline] + check_memory_region+0x152/0x1b0 mm/kasan/generic.c:192 + __kasan_check_read+0x11/0x20 mm/kasan/common.c:95 + atomic_read include/asm-generic/atomic-instrumented.h:26 [inline] + usb_hcd_unlink_urb+0x5f/0x170 drivers/usb/core/hcd.c:1607 + usb_unlink_urb+0x72/0xb0 drivers/usb/core/urb.c:657 + usb_sg_cancel+0x14e/0x290 drivers/usb/core/message.c:602 + usb_stor_stop_transport+0x5e/0xa0 drivers/usb/storage/transport.c:937 + +This bug occurs when cancellation of the S-G transfer races with +transfer completion. When that happens, usb_sg_cancel() may continue +to access the transfer's URBs after usb_sg_wait() has freed them. + +The bug is caused by the fact that usb_sg_cancel() does not take any +sort of reference to the transfer, and so there is nothing to prevent +the URBs from being deallocated while the routine is trying to use +them. The fix is to take such a reference by incrementing the +transfer's io->count field while the cancellation is in progres and +decrementing it afterward. The transfer's URBs are not deallocated +until io->complete is triggered, which happens when io->count reaches +zero. + +Signed-off-by: Alan Stern +Reported-and-tested-by: Kyungtae Kim +CC: +Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.2003281615140.14837-100000@netrider.rowland.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/message.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -588,12 +588,13 @@ void usb_sg_cancel(struct usb_sg_request + int i, retval; + + spin_lock_irqsave(&io->lock, flags); +- if (io->status) { ++ if (io->status || io->count == 0) { + spin_unlock_irqrestore(&io->lock, flags); + return; + } + /* shut everything down */ + io->status = -ECONNRESET; ++ io->count++; /* Keep the request alive until we're done */ + spin_unlock_irqrestore(&io->lock, flags); + + for (i = io->entries - 1; i >= 0; --i) { +@@ -607,6 +608,12 @@ void usb_sg_cancel(struct usb_sg_request + dev_warn(&io->dev->dev, "%s, unlink --> %d\n", + __func__, retval); + } ++ ++ spin_lock_irqsave(&io->lock, flags); ++ io->count--; ++ if (!io->count) ++ complete(&io->complete); ++ spin_unlock_irqrestore(&io->lock, flags); + } + EXPORT_SYMBOL_GPL(usb_sg_cancel); + diff --git a/queue-5.4/usb-early-handle-amd-s-spec-compliant-identifiers-too.patch b/queue-5.4/usb-early-handle-amd-s-spec-compliant-identifiers-too.patch new file mode 100644 index 00000000000..2b226db7bd9 --- /dev/null +++ b/queue-5.4/usb-early-handle-amd-s-spec-compliant-identifiers-too.patch @@ -0,0 +1,98 @@ +From 7dbdb53d72a51cea9b921d9dbba54be00752212a Mon Sep 17 00:00:00 2001 +From: Jann Horn +Date: Wed, 1 Apr 2020 09:46:19 +0200 +Subject: USB: early: Handle AMD's spec-compliant identifiers, too + +From: Jann Horn + +commit 7dbdb53d72a51cea9b921d9dbba54be00752212a upstream. + +This fixes a bug that causes the USB3 early console to freeze after +printing a single line on AMD machines because it can't parse the +Transfer TRB properly. + +The spec at +https://www.intel.com/content/dam/www/public/us/en/documents/technical-specifications/extensible-host-controler-interface-usb-xhci.pdf +says in section "4.5.1 Device Context Index" that the Context Index, +also known as Endpoint ID according to +section "1.6 Terms and Abbreviations", is normally computed as +`DCI = (Endpoint Number * 2) + Direction`, which matches the current +definitions of XDBC_EPID_OUT and XDBC_EPID_IN. + +However, the numbering in a Debug Capability Context data structure is +supposed to be different: +Section "7.6.3.2 Endpoint Contexts and Transfer Rings" explains that a +Debug Capability Context data structure has the endpoints mapped to indices +0 and 1. + +Change XDBC_EPID_OUT/XDBC_EPID_IN to the spec-compliant values, add +XDBC_EPID_OUT_INTEL/XDBC_EPID_IN_INTEL with Intel's incorrect values, and +let xdbc_handle_tx_event() handle both. + +I have verified that with this patch applied, the USB3 early console works +on both an Intel and an AMD machine. + +Fixes: aeb9dd1de98c ("usb/early: Add driver for xhci debug capability") +Cc: stable@vger.kernel.org +Signed-off-by: Jann Horn +Link: https://lore.kernel.org/r/20200401074619.8024-1-jannh@google.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/early/xhci-dbc.c | 8 ++++---- + drivers/usb/early/xhci-dbc.h | 18 ++++++++++++++++-- + 2 files changed, 20 insertions(+), 6 deletions(-) + +--- a/drivers/usb/early/xhci-dbc.c ++++ b/drivers/usb/early/xhci-dbc.c +@@ -728,19 +728,19 @@ static void xdbc_handle_tx_event(struct + case COMP_USB_TRANSACTION_ERROR: + case COMP_STALL_ERROR: + default: +- if (ep_id == XDBC_EPID_OUT) ++ if (ep_id == XDBC_EPID_OUT || ep_id == XDBC_EPID_OUT_INTEL) + xdbc.flags |= XDBC_FLAGS_OUT_STALL; +- if (ep_id == XDBC_EPID_IN) ++ if (ep_id == XDBC_EPID_IN || ep_id == XDBC_EPID_IN_INTEL) + xdbc.flags |= XDBC_FLAGS_IN_STALL; + + xdbc_trace("endpoint %d stalled\n", ep_id); + break; + } + +- if (ep_id == XDBC_EPID_IN) { ++ if (ep_id == XDBC_EPID_IN || ep_id == XDBC_EPID_IN_INTEL) { + xdbc.flags &= ~XDBC_FLAGS_IN_PROCESS; + xdbc_bulk_transfer(NULL, XDBC_MAX_PACKET, true); +- } else if (ep_id == XDBC_EPID_OUT) { ++ } else if (ep_id == XDBC_EPID_OUT || ep_id == XDBC_EPID_OUT_INTEL) { + xdbc.flags &= ~XDBC_FLAGS_OUT_PROCESS; + } else { + xdbc_trace("invalid endpoint id %d\n", ep_id); +--- a/drivers/usb/early/xhci-dbc.h ++++ b/drivers/usb/early/xhci-dbc.h +@@ -120,8 +120,22 @@ struct xdbc_ring { + u32 cycle_state; + }; + +-#define XDBC_EPID_OUT 2 +-#define XDBC_EPID_IN 3 ++/* ++ * These are the "Endpoint ID" (also known as "Context Index") values for the ++ * OUT Transfer Ring and the IN Transfer Ring of a Debug Capability Context data ++ * structure. ++ * According to the "eXtensible Host Controller Interface for Universal Serial ++ * Bus (xHCI)" specification, section "7.6.3.2 Endpoint Contexts and Transfer ++ * Rings", these should be 0 and 1, and those are the values AMD machines give ++ * you; but Intel machines seem to use the formula from section "4.5.1 Device ++ * Context Index", which is supposed to be used for the Device Context only. ++ * Luckily the values from Intel don't overlap with those from AMD, so we can ++ * just test for both. ++ */ ++#define XDBC_EPID_OUT 0 ++#define XDBC_EPID_IN 1 ++#define XDBC_EPID_OUT_INTEL 2 ++#define XDBC_EPID_IN_INTEL 3 + + struct xdbc_state { + u16 vendor; diff --git a/queue-5.4/usb-hub-fix-handling-of-connect-changes-during-sleep.patch b/queue-5.4/usb-hub-fix-handling-of-connect-changes-during-sleep.patch new file mode 100644 index 00000000000..ed781b0c464 --- /dev/null +++ b/queue-5.4/usb-hub-fix-handling-of-connect-changes-during-sleep.patch @@ -0,0 +1,78 @@ +From 9f952e26295d977dbfc6fedeaf8c4f112c818d37 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 22 Apr 2020 16:09:51 -0400 +Subject: USB: hub: Fix handling of connect changes during sleep + +From: Alan Stern + +commit 9f952e26295d977dbfc6fedeaf8c4f112c818d37 upstream. + +Commit 8099f58f1ecd ("USB: hub: Don't record a connect-change event +during reset-resume") wasn't very well conceived. The problem it +tried to fix was that if a connect-change event occurred while the +system was asleep (such as a device disconnecting itself from the bus +when it is suspended and then reconnecting when it resumes) +requiring a reset-resume during the system wakeup transition, the hub +port's change_bit entry would remain set afterward. This would cause +the hub driver to believe another connect-change event had occurred +after the reset-resume, which was wrong and would lead the driver to +send unnecessary requests to the device (which could interfere with a +firmware update). + +The commit tried to fix this by not setting the change_bit during the +wakeup. But this was the wrong thing to do; it means that when a +device is unplugged while the system is asleep, the hub driver doesn't +realize anything has happened: The change_bit flag which would tell it +to handle the disconnect event is clear. + +The commit needs to be reverted and the problem fixed in a different +way. Fortunately an alternative solution was noted in the commit's +Changelog: We can continue to set the change_bit entry in +hub_activate() but then clear it when a reset-resume occurs. That way +the the hub driver will see the change_bit when a device is +disconnected but won't see it when the device is still present. + +That's what this patch does. + +Reported-and-tested-by: Peter Chen +Signed-off-by: Alan Stern +Fixes: 8099f58f1ecd ("USB: hub: Don't record a connect-change event during reset-resume") +Tested-by: Paul Zimmerman +CC: +Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.2004221602480.11262-100000@iolanthe.rowland.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1222,6 +1222,11 @@ static void hub_activate(struct usb_hub + #ifdef CONFIG_PM + udev->reset_resume = 1; + #endif ++ /* Don't set the change_bits when the device ++ * was powered off. ++ */ ++ if (test_bit(port1, hub->power_bits)) ++ set_bit(port1, hub->change_bits); + + } else { + /* The power session is gone; tell hub_wq */ +@@ -3087,6 +3092,15 @@ static int check_port_resume_type(struct + if (portchange & USB_PORT_STAT_C_ENABLE) + usb_clear_port_feature(hub->hdev, port1, + USB_PORT_FEAT_C_ENABLE); ++ ++ /* ++ * Whatever made this reset-resume necessary may have ++ * turned on the port1 bit in hub->change_bits. But after ++ * a successful reset-resume we want the bit to be clear; ++ * if it was on it would indicate that something happened ++ * following the reset-resume. ++ */ ++ clear_bit(port1, hub->change_bits); + } + + return status; diff --git a/queue-5.4/usb-hub-revert-commit-bd0e6c9614b9-usb-hub-try-old-enumeration-scheme-first-for-high-speed-devices.patch b/queue-5.4/usb-hub-revert-commit-bd0e6c9614b9-usb-hub-try-old-enumeration-scheme-first-for-high-speed-devices.patch new file mode 100644 index 00000000000..a794b28bd19 --- /dev/null +++ b/queue-5.4/usb-hub-revert-commit-bd0e6c9614b9-usb-hub-try-old-enumeration-scheme-first-for-high-speed-devices.patch @@ -0,0 +1,71 @@ +From 3155f4f40811c5d7e3c686215051acf504e05565 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 22 Apr 2020 16:13:08 -0400 +Subject: USB: hub: Revert commit bd0e6c9614b9 ("usb: hub: try old enumeration scheme first for high speed devices") + +From: Alan Stern + +commit 3155f4f40811c5d7e3c686215051acf504e05565 upstream. + +Commit bd0e6c9614b9 ("usb: hub: try old enumeration scheme first for +high speed devices") changed the way the hub driver enumerates +high-speed devices. Instead of using the "new" enumeration scheme +first and switching to the "old" scheme if that doesn't work, we start +with the "old" scheme. In theory this is better because the "old" +scheme is slightly faster -- it involves resetting the device only +once instead of twice. + +However, for a long time Windows used only the "new" scheme. Zeng Tao +said that Windows 8 and later use the "old" scheme for high-speed +devices, but apparently there are some devices that don't like it. +William Bader reports that the Ricoh webcam built into his Sony Vaio +laptop not only doesn't enumerate under the "old" scheme, it gets hung +up so badly that it won't then enumerate under the "new" scheme! Only +a cold reset will fix it. + +Therefore we will revert the commit and go back to trying the "new" +scheme first for high-speed devices. + +Reported-and-tested-by: William Bader +Ref: https://bugzilla.kernel.org/show_bug.cgi?id=207219 +Signed-off-by: Alan Stern +Fixes: bd0e6c9614b9 ("usb: hub: try old enumeration scheme first for high speed devices") +CC: Zeng Tao +CC: +Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.2004221611230.11262-100000@iolanthe.rowland.org +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/admin-guide/kernel-parameters.txt | 3 +-- + drivers/usb/core/hub.c | 4 +--- + 2 files changed, 2 insertions(+), 5 deletions(-) + +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -5005,8 +5005,7 @@ + + usbcore.old_scheme_first= + [USB] Start with the old device initialization +- scheme, applies only to low and full-speed devices +- (default 0 = off). ++ scheme (default 0 = off). + + usbcore.usbfs_memory_mb= + [USB] Memory limit (in MB) for buffers allocated by +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2727,13 +2727,11 @@ static bool use_new_scheme(struct usb_de + { + int old_scheme_first_port = + port_dev->quirks & USB_PORT_QUIRK_OLD_SCHEME; +- int quick_enumeration = (udev->speed == USB_SPEED_HIGH); + + if (udev->speed >= USB_SPEED_SUPER) + return false; + +- return USE_NEW_SCHEME(retry, old_scheme_first_port || old_scheme_first +- || quick_enumeration); ++ return USE_NEW_SCHEME(retry, old_scheme_first_port || old_scheme_first); + } + + /* Is a USB 3.0 port in the Inactive or Compliance Mode state? diff --git a/queue-5.4/usb-sisusbvga-change-port-variable-from-signed-to-unsigned.patch b/queue-5.4/usb-sisusbvga-change-port-variable-from-signed-to-unsigned.patch new file mode 100644 index 00000000000..177c35bf095 --- /dev/null +++ b/queue-5.4/usb-sisusbvga-change-port-variable-from-signed-to-unsigned.patch @@ -0,0 +1,128 @@ +From 2df7405f79ce1674d73c2786fe1a8727c905d65b Mon Sep 17 00:00:00 2001 +From: Changming Liu +Date: Mon, 20 Apr 2020 23:41:25 -0400 +Subject: USB: sisusbvga: Change port variable from signed to unsigned + +From: Changming Liu + +commit 2df7405f79ce1674d73c2786fe1a8727c905d65b upstream. + +Change a bunch of arguments of wrapper functions which pass signed +integer to an unsigned integer which might cause undefined behaviors +when sign integer overflow. + +Signed-off-by: Changming Liu +Cc: stable +Link: https://lore.kernel.org/r/BL0PR06MB45482D71EA822D75A0E60A2EE5D50@BL0PR06MB4548.namprd06.prod.outlook.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/sisusbvga/sisusb.c | 20 ++++++++++---------- + drivers/usb/misc/sisusbvga/sisusb_init.h | 14 +++++++------- + 2 files changed, 17 insertions(+), 17 deletions(-) + +--- a/drivers/usb/misc/sisusbvga/sisusb.c ++++ b/drivers/usb/misc/sisusbvga/sisusb.c +@@ -1199,18 +1199,18 @@ static int sisusb_read_mem_bulk(struct s + /* High level: Gfx (indexed) register access */ + + #ifdef CONFIG_USB_SISUSBVGA_CON +-int sisusb_setreg(struct sisusb_usb_data *sisusb, int port, u8 data) ++int sisusb_setreg(struct sisusb_usb_data *sisusb, u32 port, u8 data) + { + return sisusb_write_memio_byte(sisusb, SISUSB_TYPE_IO, port, data); + } + +-int sisusb_getreg(struct sisusb_usb_data *sisusb, int port, u8 *data) ++int sisusb_getreg(struct sisusb_usb_data *sisusb, u32 port, u8 *data) + { + return sisusb_read_memio_byte(sisusb, SISUSB_TYPE_IO, port, data); + } + #endif + +-int sisusb_setidxreg(struct sisusb_usb_data *sisusb, int port, ++int sisusb_setidxreg(struct sisusb_usb_data *sisusb, u32 port, + u8 index, u8 data) + { + int ret; +@@ -1220,7 +1220,7 @@ int sisusb_setidxreg(struct sisusb_usb_d + return ret; + } + +-int sisusb_getidxreg(struct sisusb_usb_data *sisusb, int port, ++int sisusb_getidxreg(struct sisusb_usb_data *sisusb, u32 port, + u8 index, u8 *data) + { + int ret; +@@ -1230,7 +1230,7 @@ int sisusb_getidxreg(struct sisusb_usb_d + return ret; + } + +-int sisusb_setidxregandor(struct sisusb_usb_data *sisusb, int port, u8 idx, ++int sisusb_setidxregandor(struct sisusb_usb_data *sisusb, u32 port, u8 idx, + u8 myand, u8 myor) + { + int ret; +@@ -1245,7 +1245,7 @@ int sisusb_setidxregandor(struct sisusb_ + } + + static int sisusb_setidxregmask(struct sisusb_usb_data *sisusb, +- int port, u8 idx, u8 data, u8 mask) ++ u32 port, u8 idx, u8 data, u8 mask) + { + int ret; + u8 tmp; +@@ -1258,13 +1258,13 @@ static int sisusb_setidxregmask(struct s + return ret; + } + +-int sisusb_setidxregor(struct sisusb_usb_data *sisusb, int port, ++int sisusb_setidxregor(struct sisusb_usb_data *sisusb, u32 port, + u8 index, u8 myor) + { + return sisusb_setidxregandor(sisusb, port, index, 0xff, myor); + } + +-int sisusb_setidxregand(struct sisusb_usb_data *sisusb, int port, ++int sisusb_setidxregand(struct sisusb_usb_data *sisusb, u32 port, + u8 idx, u8 myand) + { + return sisusb_setidxregandor(sisusb, port, idx, myand, 0x00); +@@ -2785,8 +2785,8 @@ static loff_t sisusb_lseek(struct file * + static int sisusb_handle_command(struct sisusb_usb_data *sisusb, + struct sisusb_command *y, unsigned long arg) + { +- int retval, port, length; +- u32 address; ++ int retval, length; ++ u32 port, address; + + /* All our commands require the device + * to be initialized. +--- a/drivers/usb/misc/sisusbvga/sisusb_init.h ++++ b/drivers/usb/misc/sisusbvga/sisusb_init.h +@@ -812,17 +812,17 @@ static const struct SiS_VCLKData SiSUSB_ + int SiSUSBSetMode(struct SiS_Private *SiS_Pr, unsigned short ModeNo); + int SiSUSBSetVESAMode(struct SiS_Private *SiS_Pr, unsigned short VModeNo); + +-extern int sisusb_setreg(struct sisusb_usb_data *sisusb, int port, u8 data); +-extern int sisusb_getreg(struct sisusb_usb_data *sisusb, int port, u8 * data); +-extern int sisusb_setidxreg(struct sisusb_usb_data *sisusb, int port, ++extern int sisusb_setreg(struct sisusb_usb_data *sisusb, u32 port, u8 data); ++extern int sisusb_getreg(struct sisusb_usb_data *sisusb, u32 port, u8 * data); ++extern int sisusb_setidxreg(struct sisusb_usb_data *sisusb, u32 port, + u8 index, u8 data); +-extern int sisusb_getidxreg(struct sisusb_usb_data *sisusb, int port, ++extern int sisusb_getidxreg(struct sisusb_usb_data *sisusb, u32 port, + u8 index, u8 * data); +-extern int sisusb_setidxregandor(struct sisusb_usb_data *sisusb, int port, ++extern int sisusb_setidxregandor(struct sisusb_usb_data *sisusb, u32 port, + u8 idx, u8 myand, u8 myor); +-extern int sisusb_setidxregor(struct sisusb_usb_data *sisusb, int port, ++extern int sisusb_setidxregor(struct sisusb_usb_data *sisusb, u32 port, + u8 index, u8 myor); +-extern int sisusb_setidxregand(struct sisusb_usb_data *sisusb, int port, ++extern int sisusb_setidxregand(struct sisusb_usb_data *sisusb, u32 port, + u8 idx, u8 myand); + + void sisusb_delete(struct kref *kref);