1. 18 Aug, 2019 3 commits
    • Linus Torvalds's avatar
      Merge tag 'usb-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 359334ca
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are number of small USB fixes for 5.3-rc5.
      
        Syzbot has been on a tear recently now that it has some good USB
        debugging hooks integrated, so there's a number of fixes in here found
        by those tools for some _very_ old bugs. Also a handful of gadget
        driver fixes for reported issues, some hopefully-final dma fixes for
        host controller drivers, and some new USB serial gadget driver ids.
      
        All of these have been in linux-next this week with no reported issues
        (the usb-serial ones were in linux-next in its own branch, but merged
        into mine on Friday)"
      
      * tag 'usb-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        usb: add a hcd_uses_dma helper
        usb: don't create dma pools for HCDs with a localmem_pool
        usb: chipidea: imx: fix EPROBE_DEFER support during driver probe
        usb: host: fotg2: restart hcd after port reset
        USB: CDC: fix sanity checks in CDC union parser
        usb: cdc-acm: make sure a refcount is taken early enough
        USB: serial: option: add the BroadMobi BM818 card
        USB: serial: option: Add Motorola modem UARTs
        USB: core: Fix races in character device registration and deregistraion
        usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt
        usb: gadget: composite: Clear "suspended" on reset/disconnect
        usb: gadget: udc: renesas_usb3: Fix sysfs interface of "role"
        USB: serial: option: add D-Link DWM-222 device ID
        USB: serial: option: Add support for ZTE MF871A
      359334ca
    • Linus Torvalds's avatar
      Merge tag 'for-linus-2019-08-17' of git://git.kernel.dk/linux-block · 8fde2832
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "A collection of fixes that should go into this series. This contains:
      
         - Revert of the REQ_NOWAIT_INLINE and associated dio changes. There
           were still corner cases there, and even though I had a solution for
           it, it's too involved for this stage. (me)
      
         - Set of NVMe fixes (via Sagi)
      
         - io_uring fix for fixed buffers (Anthony)
      
         - io_uring defer issue fix (Jackie)
      
         - Regression fix for queue sync at exit time (zhengbin)
      
         - xen blk-back memory leak fix (Wenwen)"
      
      * tag 'for-linus-2019-08-17' of git://git.kernel.dk/linux-block:
        io_uring: fix an issue when IOSQE_IO_LINK is inserted into defer list
        block: remove REQ_NOWAIT_INLINE
        io_uring: fix manual setup of iov_iter for fixed buffers
        xen/blkback: fix memory leaks
        blk-mq: move cancel of requeue_work to the front of blk_exit_queue
        nvme-pci: Fix async probe remove race
        nvme: fix controller removal race with scan work
        nvme-rdma: fix possible use-after-free in connect error flow
        nvme: fix a possible deadlock when passthru commands sent to a multipath device
        nvme-core: Fix extra device_put() call on error path
        nvmet-file: fix nvmet_file_flush() always returning an error
        nvmet-loop: Flush nvme_delete_wq when removing the port
        nvmet: Fix use-after-free bug when a port is removed
        nvme-multipath: revalidate nvme_ns_head gendisk in nvme_validate_ns
      8fde2832
    • Linus Torvalds's avatar
      Merge tag 'hyperv-fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux · 85d8d3b1
      Linus Torvalds authored
      Pull Hyper-V fixes from Sasha Levin:
      
       - A few fixes for the userspace hyper-v tools from Adrian Vladu.
      
       - A fix for the hyper-v MAINTAINERs entry from Lan Tianyu.
      
       - Fix for SPDX license identifier in the userspace tools from Nishad
         Kamdar.
      
      * tag 'hyperv-fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:
        MAINTAINERS: Fix Hyperv vIOMMU driver file name
        tools: hv: Use the correct style for SPDX License Identifier
        tools: hv: fix typos in toolchain
        tools: hv: fix KVP and VSS daemons exit code
        tools: hv: fixed Python pep8/flake8 warnings for lsvmbus
      85d8d3b1
  2. 17 Aug, 2019 9 commits
  3. 16 Aug, 2019 8 commits
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · b7e7c85d
      Linus Torvalds authored
      Pull arm64 fixes from Catalin Marinas:
      
       - Don't taint the kernel if CPUs have different sets of page sizes
         supported (other than the one in use).
      
       - Issue I-cache maintenance for module ftrace trampoline.
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64: ftrace: Ensure module ftrace trampoline is coherent with I-side
        arm64: cpufeature: Don't treat granule sizes as strict
      b7e7c85d
    • Will Deacon's avatar
      arm64: ftrace: Ensure module ftrace trampoline is coherent with I-side · b6143d10
      Will Deacon authored
      The initial support for dynamic ftrace trampolines in modules made use
      of an indirect branch which loaded its target from the beginning of
      a special section (e71a4e1b ("arm64: ftrace: add support for far
      branches to dynamic ftrace")). Since no instructions were being patched,
      no cache maintenance was needed. However, later in be0f272b ("arm64:
      ftrace: emit ftrace-mod.o contents through code") this code was reworked
      to output the trampoline instructions directly into the PLT entry but,
      unfortunately, the necessary cache maintenance was overlooked.
      
      Add a call to __flush_icache_range() after writing the new trampoline
      instructions but before patching in the branch to the trampoline.
      
      Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
      Cc: James Morse <james.morse@arm.com>
      Cc: <stable@vger.kernel.org>
      Fixes: be0f272b
      
       ("arm64: ftrace: emit ftrace-mod.o contents through code")
      Signed-off-by: default avatarWill Deacon <will@kernel.org>
      Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      b6143d10
    • Linus Torvalds's avatar
      Merge tag 'pm-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 2d63ba3e
      Linus Torvalds authored
      Pull power management fixes from Rafael Wysocki:
       "These add a check to avoid recent suspend-to-idle power regression on
        systems with NVMe drives where the PCIe ASPM policy is "performance"
        (or when the kernel is built without ASPM support), fix an issue
        related to frequency limits in the schedutil cpufreq governor and fix
        a mistake related to the PM QoS usage in the cpufreq core introduced
        recently.
      
        Specifics:
      
         - Disable NVMe power optimization related to suspend-to-idle added
           recently on systems where PCIe ASPM is not able to put PCIe links
           into low-power states to prevent excess power from being drawn by
           the system while suspended (Rafael Wysocki).
      
         - Make the schedutil governor handle frequency limits changes
           properly in all cases (Viresh Kumar).
      
         - Prevent the cpufreq core from treating positive values returned by
           dev_pm_qos_update_request() as errors (Viresh Kumar)"
      
      * tag 'pm-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        nvme-pci: Allow PCI bus-level PM to be used if ASPM is disabled
        PCI/ASPM: Add pcie_aspm_enabled()
        cpufreq: schedutil: Don't skip freq update when limits change
        cpufreq: dev_pm_qos_update_request() can return 1 on success
      2d63ba3e
    • Linus Torvalds's avatar
      Merge tag 'dmaengine-fix-5.3-rc5' of git://git.infradead.org/users/vkoul/slave-dma · 9da5bb24
      Linus Torvalds authored
      Pull dmaengine fixes from Vinod Koul:
       "Fixes in dmaengine drivers for:
      
         - dw-edma: endianess, _iomem type and stack usages
      
         - ste_dma40: unneeded variable and null-pointer dereference
      
         - tegra210-adma: unused function
      
         - omap-dma: off-by-one fix"
      
      * tag 'dmaengine-fix-5.3-rc5' of git://git.infradead.org/users/vkoul/slave-dma:
        omap-dma/omap_vout_vrfb: fix off-by-one fi value
        dmaengine: stm32-mdma: Fix a possible null-pointer dereference in stm32_mdma_irq_handler()
        dmaengine: tegra210-adma: Fix unused function warnings
        dmaengine: ste_dma40: fix unneeded variable warning
        dmaengine: dw-edma: fix endianess confusion
        dmaengine: dw-edma: fix __iomem type confusion
        dmaengine: dw-edma: fix unnecessary stack usage
      9da5bb24
    • Linus Torvalds's avatar
      Merge tag 'sound-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · cfa0bb2a
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "All small fixes targeted for stable:
      
         - Two fixes for USB-audio with malformed descriptor, spotted by
           fuzzers
      
         - Two fixes Conexant HD-audio codec wrt power management
      
         - Quirks for HD-audio AMD platform and HP laptop
      
         - HD-audio memory leak fix"
      
      * tag 'sound-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
        ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit
        ALSA: hda - Add a generic reboot_notify
        ALSA: hda - Let all conexant codec enter D3 when rebooting
        ALSA: hda/realtek - Add quirk for HP Envy x360
        ALSA: hda - Fix a memory leak bug
        ALSA: hda - Apply workaround for another AMD chip 1022:1487
      cfa0bb2a
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2019-08-16' of git://anongit.freedesktop.org/drm/drm · ec037ac2
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Nothing too crazy this week, one amdgpu fix to use vmalloc for a
        struct that grew in size, and another MST fix for nouveau, and some
        other misc fixes:
      
        i915:
         - single GVT use after free fix
      
        scheduler:
         - entity destruction race fix
      
        amdgpu:
         - struct allocation fix
         - gfx9 soft recovery fix
      
        nouveau:
         - followup MST fix
      
        ast:
         - vga register race fix"
      
      * tag 'drm-fixes-2019-08-16' of git://anongit.freedesktop.org/drm/drm:
        drm/nouveau: Only recalculate PBN/VCPI on mode/connector changes
        drm/ast: Fixed reboot test may cause system hanged
        drm/scheduler: use job count instead of peek
        drm/amd/display: use kvmalloc for dc_state (v2)
        drm/amdgpu: fix gfx9 soft recovery
        drm/i915: Use after free in error path in intel_vgpu_create_workload()
      ec037ac2
    • Rafael J. Wysocki's avatar
      Merge branch 'pm-cpufreq' · a3ee2477
      Rafael J. Wysocki authored
      * pm-cpufreq:
        cpufreq: schedutil: Don't skip freq update when limits change
        cpufreq: dev_pm_qos_update_request() can return 1 on success
      a3ee2477
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2019-08-15' of... · a85abd5d
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2019-08-15' of git://anongit.freedesktop.org/drm/drm-intel
      
       into drm-fixes
      
      drm/i915 fixes for v5.4-rc5:
      - GVT use-after-free fix
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Jani Nikula <jani.nikula@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/87zhkag9ic.fsf@intel.com
      a85abd5d
  4. 15 Aug, 2019 20 commits
    • Hui Peng's avatar
      ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term · 19bce474
      Hui Peng authored
      
      
      `check_input_term` recursively calls itself with input from
      device side (e.g., uac_input_terminal_descriptor.bCSourceID)
      as argument (id). In `check_input_term`, if `check_input_term`
      is called with the same `id` argument as the caller, it triggers
      endless recursive call, resulting kernel space stack overflow.
      
      This patch fixes the bug by adding a bitmap to `struct mixer_build`
      to keep track of the checked ids and stop the execution if some id
      has been checked (similar to how parse_audio_unit handles unitid
      argument).
      Reported-by: default avatarHui Peng <benquike@gmail.com>
      Reported-by: default avatarMathias Payer <mathias.payer@nebelwelt.net>
      Signed-off-by: default avatarHui Peng <benquike@gmail.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      19bce474
    • Linus Torvalds's avatar
      Merge tag 'xfs-5.3-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · a69e9051
      Linus Torvalds authored
      Pull xfs fixes from Darrick Wong:
      
       - Fix crashes when the attr fork isn't present due to errors but inode
         inactivation tries to zap the attr data anyway.
      
       - Convert more directory corruption debugging asserts to actual
         EFSCORRUPTED returns instead of blowing up later on.
      
       - Don't fail writeback just because we ran out of memory allocating
         metadata log data.
      
      * tag 'xfs-5.3-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        xfs: don't crash on null attr fork xfs_bmapi_read
        xfs: remove more ondisk directory corruption asserts
        fs: xfs: xfs_log: Don't use KM_MAYFAIL at xfs_log_reserve().
      a69e9051
    • Linus Torvalds's avatar
      Merge tag 'iomap-5.3-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · 4ec1fa69
      Linus Torvalds authored
      Pull iomap fixlet from Darrick Wong:
       "A single update to the MAINTAINERS entry for iomap now that we've
        removed fs/iomap.c"
      
      * tag 'iomap-5.3-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        MAINTAINERS: iomap: Remove fs/iomap.c record
      4ec1fa69
    • Jackie Liu's avatar
      io_uring: fix an issue when IOSQE_IO_LINK is inserted into defer list · a982eeb0
      Jackie Liu authored
      This patch may fix two issues:
      
      First, when IOSQE_IO_DRAIN set, the next IOs need to be inserted into
      defer list to delay execution, but link io will be actively scheduled to
      run by calling io_queue_sqe.
      
      Second, when multiple LINK_IOs are inserted together with defer_list,
      the LINK_IO is no longer keep order.
      
         |-------------|
         |   LINK_IO   |      ----> insert to defer_list  -----------
         |-------------|                                            |
         |   LINK_IO   |      ----> insert to defer_list  ----------|
         |-------------|                                            |
         |   LINK_IO   |      ----> insert to defer_list  ----------|
         |-------------|                                            |
         |   NORMAL_IO |      ----> insert to defer_list  ----------|
         |-------------|                                            |
                                                                    |
                                    queue_work at same time   <-----|
      
      Fixes: 9e645e11
      
       ("io_uring: add support for sqe links")
      Signed-off-by: default avatarJackie Liu <liuyun01@kylinos.cn>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      a982eeb0
    • Jens Axboe's avatar
      block: remove REQ_NOWAIT_INLINE · 7b6620d7
      Jens Axboe authored
      We had a few issues with this code, and there's still a problem around
      how we deal with error handling for chained/split bios. For now, just
      revert the code and we'll try again with a thoroug solution. This
      reverts commits:
      
      e15c2ffa ("block: fix O_DIRECT error handling for bio fragments")
      0eb6ddfb ("block: Fix __blkdev_direct_IO() for bio fragments")
      6a43074e ("block: properly handle IOCB_NOWAIT for async O_DIRECT IO")
      893a1c97
      
       ("blk-mq: allow REQ_NOWAIT to return an error inline")
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      7b6620d7
    • Aleix Roca Nonell's avatar
      io_uring: fix manual setup of iov_iter for fixed buffers · 99c79f66
      Aleix Roca Nonell authored
      Commit bd11b3a3 ("io_uring: don't use iov_iter_advance() for fixed
      buffers") introduced an optimization to avoid using the slow
      iov_iter_advance by manually populating the iov_iter iterator in some
      cases.
      
      However, the computation of the iterator count field was erroneous: The
      first bvec was always accounted for an extent of page size even if the
      bvec length was smaller.
      
      In consequence, some I/O operations on fixed buffers were unable to
      operate on the full extent of the buffer, consistently skipping some
      bytes at the end of it.
      
      Fixes: bd11b3a3
      
       ("io_uring: don't use iov_iter_advance() for fixed buffers")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAleix Roca Nonell <aleix.rocanonell@bsc.es>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      99c79f66
    • Linus Torvalds's avatar
      Merge tag 'auxdisplay-for-linus-v5.3-rc5' of git://github.com/ojeda/linux · 32912042
      Linus Torvalds authored
      Pull auxdisplay fixes from Miguel Ojeda:
       "A few minor auxdisplay improvements:
      
         - A couple of small header cleanups for charlcd (Masahiro Yamada)
      
         - A trivial typo fix for the examples of cfag12864b (Masahiro Yamada)
      
         - An Kconfig help text improvement for charlcd (Mans Rullgard)
      
         - An error path fix for panel (zhengbin)"
      
      * tag 'auxdisplay-for-linus-v5.3-rc5' of git://github.com/ojeda/linux:
        auxdisplay: Fix a typo in cfag12864b-example.c
        auxdisplay: charlcd: add include guard to charlcd.h
        auxdisplay: charlcd: move charlcd.h to drivers/auxdisplay
        auxdisplay: charlcd: add help text for backlight initial state
        auxdisplay: panel: need to delete scan_timer when misc_register fails in panel_attach
      32912042
    • Linus Torvalds's avatar
      Merge tag 'devicetree-fixes-for-5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux · 2b245b8b
      Linus Torvalds authored
      Pull devicetree fixes from Rob Herring:
      
       - Fix building DT binding examples for in tree builds
      
       - Correct some refcounting in adjust_local_phandle_references()
      
       - Update FSL FEC binding with deprecated properties
      
       - Schema fix in stm32 pinctrl
      
       - Fix typo in of_irq_parse_one docbook comment
      
      * tag 'devicetree-fixes-for-5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
        of: irq: fix a trivial typo in a doc comment
        dt-bindings: pinctrl: stm32: Fix 'st,syscfg' schema
        dt-bindings: fec: explicitly mark deprecated properties
        of: resolver: Add of_node_put() before return and break
        dt-bindings: Fix generated example files getting added to schemas
      2b245b8b
    • Christoph Hellwig's avatar
      usb: add a hcd_uses_dma helper · edfbcb32
      Christoph Hellwig authored
      
      
      The USB buffer allocation code is the only place in the usb core (and in
      fact the whole kernel) that uses is_device_dma_capable, while the URB
      mapping code uses the uses_dma flag in struct usb_bus.  Switch the buffer
      allocation to use the uses_dma flag used by the rest of the USB code,
      and create a helper in hcd.h that checks this flag as well as the
      CONFIG_HAS_DMA to simplify the caller a bit.
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Link: https://lore.kernel.org/r/20190811080520.21712-3-hch@lst.de
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      edfbcb32
    • Christoph Hellwig's avatar
      usb: don't create dma pools for HCDs with a localmem_pool · dd3ecf17
      Christoph Hellwig authored
      If the HCD provides a localmem pool we will never use the DMA pools, so
      don't create them.
      
      Fixes: b0310c2f
      
       ("USB: use genalloc for USB HCs with local memory")
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Link: https://lore.kernel.org/r/20190811080520.21712-2-hch@lst.de
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      dd3ecf17
    • André Draszik's avatar
      usb: chipidea: imx: fix EPROBE_DEFER support during driver probe · 141822aa
      André Draszik authored
      If driver probe needs to be deferred, e.g. because ci_hdrc_add_device()
      isn't ready yet, this driver currently misbehaves badly:
          a) success is still reported to the driver core (meaning a 2nd
             probe attempt will never be done), leaving the driver in
             a dysfunctional state and the hardware unusable
      
          b) driver remove / shutdown OOPSes:
          [  206.786916] Unable to handle kernel paging request at virtual address fffffdff
          [  206.794148] pgd = 880b9f82
          [  206.796890] [fffffdff] *pgd=abf5e861, *pte=00000000, *ppte=00000000
          [  206.803179] Internal error: Oops: 37 [#1] PREEMPT SMP ARM
          [  206.808581] Modules linked in: wl18xx evbug
          [  206.813308] CPU: 1 PID: 1 Comm: systemd-shutdow Not tainted 4.19.35+gf345c93b4195 #1
          [  206.821053] Hardware name: Freescale i.MX7 Dual (Device Tree)
          [  206.826813] PC is at ci_hdrc_remove_device+0x4/0x20
          [  206.831699] LR is at ci_hdrc_imx_remove+0x20/0xe8
          [  206.836407] pc : [<805cd4b0>]    lr : [<805d62cc>]    psr: 20000013
          [  206.842678] sp : a806be40  ip : 00000001  fp : 80adbd3c
          [  206.847906] r10: 80b1b794  r9 : 80d5dfe0  r8 : a8192c44
          [  206.853136] r7 : 80db93a0  r6 : a8192c10  r5 : a8192c00  r4 : a93a4a00
          [  206.859668] r3 : 00000000  r2 : a8192ce4  r1 : ffffffff  r0 : fffffdfb
          [  206.866201] Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
          [  206.873341] Control: 10c5387d  Table: a9e0c06a  DAC: 00000051
          [  206.879092] Process systemd-shutdow (pid: 1, stack limit = 0xb271353c)
          [  206.885624] Stack: (0xa806be40 to 0xa806c000)
          [  206.889992] be40: a93a4a00 805d62cc a8192c1c a8170e10 a8192c10 8049a490 80d04d08 00000000
          [  206.898179] be60: 00000000 80d0da2c fee1dead 00000000 a806a000 00000058 00000000 80148b08
          [  206.906366] be80: 01234567 80148d8c a9858600 00000000 00000000 00000000 00000000 80d04d08
          [  206.914553] bea0: 00000000 00000000 a82741e0 a9858600 00000024 00000002 a9858608 00000005
          [  206.922740] bec0: 0000001e 8022c058 00000000 00000000 a806bf14 a9858600 00000000 a806befc
          [  206.930927] bee0: a806bf78 00000000 7ee12c30 8022c18c a806bef8 a806befc 00000000 00000001
          [  206.939115] bf00: 00000000 00000024 a806bf14 00000005 7ee13b34 7ee12c68 00000004 7ee13f20
          [  206.947302] bf20: 00000010 7ee12c7c 00000005 7ee12d04 0000000a 76e7dc00 00000001 80d0f140
          [  206.955490] bf40: ab637880 a974de40 60000013 80d0f140 ab6378a0 80d04d08 a8080470 a9858600
          [  206.963677] bf60: a9858600 00000000 00000000 8022c24c 00000000 80144310 00000000 00000000
          [  206.971864] bf80: 80101204 80d04d08 00000000 80d04d08 00000000 00000000 00000003 00000058
          [  206.980051] bfa0: 80101204 80101000 00000000 00000000 fee1dead 28121969 01234567 00000000
          [  206.988237] bfc0: 00000000 00000000 00000003 00000058 00000000 00000000 00000000 00000000
          [  206.996425] bfe0: 0049ffb0 7ee13d58 0048a84b 76f245a6 60000030 fee1dead 00000000 00000000
          [  207.004622] [<805cd4b0>] (ci_hdrc_remove_device) from [<805d62cc>] (ci_hdrc_imx_remove+0x20/0xe8)
          [  207.013509] [<805d62cc>] (ci_hdrc_imx_remove) from [<8049a490>] (device_shutdown+0x16c/0x218)
          [  207.022050] [<8049a490>] (device_shutdown) from [<80148b08>] (kernel_restart+0xc/0x50)
          [  207.029980] [<80148b08>] (kernel_restart) from [<80148d8c>] (sys_reboot+0xf4/0x1f0)
          [  207.037648] [<80148d8c>] (sys_reboot) from [<80101000>] (ret_fast_syscall+0x0/0x54)
          [  207.045308] Exception stack(0xa806bfa8 to 0xa806bff0)
          [  207.050368] bfa0:                   00000000 00000000 fee1dead 28121969 01234567 00000000
          [  207.058554] bfc0: 00000000 00000000 00000003 00000058 00000000 00000000 00000000 00000000
          [  207.066737] bfe0: 0049ffb0 7ee13d58 0048a84b 76f245a6
          [  207.071799] Code: ebffffa8 e3a00000 e8bd8010 e92d4010 (e5904004)
          [  207.078021] ---[ end trace be47424e3fd46e9f ]---
          [  207.082647] Kernel panic - not syncing: Fatal exception
          [  207.087894] ---[ end Kernel panic - not syncing: Fatal exception ]---
      
          c) the error path in combination with driver removal causes
             imbalanced calls to the clk_*() and pm_()* APIs
      
      a) happens because the original intended return value is
         overwritten (with 0) by the return code of
         regulator_disable() in ci_hdrc_imx_probe()'s error path
      b) happens because ci_pdev is -EPROBE_DEFER, which causes
         ci_hdrc_remove_device() to OOPS
      
      Fix a) by being more careful in ci_hdrc_imx_probe()'s error
      path and not overwriting the real error code
      
      Fix b) by calling the respective cleanup functions during
      remove only when needed (when ci_pdev != NULL, i.e. when
      everything was initialised correctly). This also has the
      side effect of not causing imbalanced clk_*() and pm_*()
      API calls as part of the error code path.
      
      Fixes: 7c8e8909
      
       ("usb: chipidea: imx: add HSIC support")
      Signed-off-by: default avatarAndré Draszik <git@andred.net>
      Cc: stable <stable@vger.kernel.org>
      CC: Peter Chen <Peter.Chen@nxp.com>
      CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      CC: Shawn Guo <shawnguo@kernel.org>
      CC: Sascha Hauer <s.hauer@pengutronix.de>
      CC: Pengutronix Kernel Team <kernel@pengutronix.de>
      CC: Fabio Estevam <festevam@gmail.com>
      CC: NXP Linux Team <linux-imx@nxp.com>
      CC: linux-usb@vger.kernel.org
      CC: linux-arm-kernel@lists.infradead.org
      CC: linux-kernel@vger.kernel.org
      Link: https://lore.kernel.org/r/20190810150758.17694-1-git@andred.net
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      141822aa
    • Hans Ulli Kroll's avatar
      usb: host: fotg2: restart hcd after port reset · 77775888
      Hans Ulli Kroll authored
      
      
      On the Gemini SoC the FOTG2 stalls after port reset
      so restart the HCD after each port reset.
      Signed-off-by: default avatarHans Ulli Kroll <ulli.kroll@googlemail.com>
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Link: https://lore.kernel.org/r/20190810150458.817-1-linus.walleij@linaro.org
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      77775888
    • Oliver Neukum's avatar
      USB: CDC: fix sanity checks in CDC union parser · 54364278
      Oliver Neukum authored
      A few checks checked for the size of the pointer to a structure
      instead of the structure itself. Copy & paste issue presumably.
      
      Fixes: e4c6fb77
      
       ("usbnet: move the CDC parser into USB core")
      Cc: stable <stable@vger.kernel.org>
      Reported-by: syzbot+45a53506b65321c1fe91@syzkaller.appspotmail.com
      Signed-off-by: default avatarOliver Neukum <oneukum@suse.com>
      Link: https://lore.kernel.org/r/20190813093541.18889-1-oneukum@suse.com
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      54364278
    • Oliver Neukum's avatar
      usb: cdc-acm: make sure a refcount is taken early enough · c52873e5
      Oliver Neukum authored
      destroy() will decrement the refcount on the interface, so that
      it needs to be taken so early that it never undercounts.
      
      Fixes: 7fb57a01
      
       ("USB: cdc-acm: Fix potential deadlock (lockdep warning)")
      Cc: stable <stable@vger.kernel.org>
      Reported-and-tested-by: syzbot+1b2449b7b5dc240d107a@syzkaller.appspotmail.com
      Signed-off-by: default avatarOliver Neukum <oneukum@suse.com>
      Link: https://lore.kernel.org/r/20190808142119.7998-1-oneukum@suse.com
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c52873e5
    • Bob Ham's avatar
      USB: serial: option: add the BroadMobi BM818 card · e5d8badf
      Bob Ham authored
      
      
      Add a VID:PID for the BroadMobi BM818 M.2 card
      
      T:  Bus=01 Lev=03 Prnt=40 Port=03 Cnt=01 Dev#= 44 Spd=480 MxCh= 0
      D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
      P:  Vendor=2020 ProdID=2060 Rev=00.00
      S:  Manufacturer=Qualcomm, Incorporated
      S:  Product=Qualcomm CDMA Technologies MSM
      C:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
      I:  If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
      I:  If#=0x1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
      I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
      I:  If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=(none)
      I:  If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
      Signed-off-by: default avatarBob Ham <bob.ham@puri.sm>
      Signed-off-by: default avatarAngus Ainslie (Purism) <angus@akkea.ca>
      Cc: stable <stable@vger.kernel.org>
      [ johan: use USB_DEVICE_INTERFACE_CLASS() ]
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      e5d8badf
    • Tony Lindgren's avatar
      USB: serial: option: Add Motorola modem UARTs · 6caf0be4
      Tony Lindgren authored
      
      
      On Motorola Mapphone devices such as Droid 4 there are five USB ports
      that do not use the same layout as Gobi 1K/2K/etc devices listed in
      qcserial.c. So we should use qcaux.c or option.c as noted by
      Dan Williams <dan.j.williams@intel.com>.
      
      As the Motorola USB serial ports have an interrupt endpoint as shown
      with lsusb -v, we should use option.c instead of qcaux.c as pointed out
      by Johan Hovold <johan@kernel.org>.
      
      The ff/ff/ff interfaces seem to always be UARTs on Motorola devices.
      For the other interfaces, class 0x0a (CDC Data) should not in general
      be added as they are typically part of a multi-interface function as
      noted earlier by Bjørn Mork <bjorn@mork.no>.
      
      However, looking at the Motorola mapphone kernel code, the mdm6600 0x0a
      class is only used for flashing the modem firmware, and there are no
      other interfaces. So I've added that too with more details below as it
      works just fine.
      
      The ttyUSB ports on Droid 4 are:
      
      ttyUSB0 DIAG, CQDM-capable
      ttyUSB1 MUX or NMEA, no response
      ttyUSB2 MUX or NMEA, no response
      ttyUSB3 TCMD
      ttyUSB4 AT-capable
      
      The ttyUSB0 is detected as QCDM capable by ModemManager. I think
      it's only used for debugging with ModemManager --debug for sending
      custom AT commands though. ModemManager already can manage data
      connection using the USB QMI ports that are already handled by the
      qmi_wwan.c driver.
      
      To enable the MUX or NMEA ports, it seems that something needs to be
      done additionally to enable them, maybe via the DIAG or TCMD port.
      It might be just a NVRAM setting somewhere, but I have no idea what
      NVRAM settings may need changing for that.
      
      The TCMD port seems to be a Motorola custom protocol for testing
      the modem and to configure it's NVRAM and seems to work just fine
      based on a quick test with a minimal tcmdrw tool I wrote.
      
      The voice modem AT-capable port seems to provide only partial
      support, and no PM support compared to the TS 27.010 based UART
      wired directly to the modem.
      
      The UARTs added with this change are the same product IDs as the
      Motorola Mapphone Android Linux kernel mdm6600_id_table. I don't
      have any mdm9600 based devices, so I have only tested these on
      mdm6600 based droid 4.
      
      Then for the class 0x0a (CDC Data) mode, the Motorola Mapphone Android
      Linux kernel driver moto_flashqsc.c just seems to change the
      port->bulk_out_size to 8K from the default. And is only used for
      flashing the modem firmware it seems.
      
      I've verified that flashing the modem with signed firmware works just
      fine with the option driver after manually toggling the GPIO pins, so
      I've added droid 4 modem flashing mode to the option driver. I've not
      added the other devices listed in moto_flashqsc.c in case they really
      need different port->bulk_out_size. Those can be added as they get
      tested to work for flashing the modem.
      
      After this patch the output of /sys/kernel/debug/usb/devices has
      the following for normal 22b8:2a70 mode including the related qmi_wwan
      interfaces:
      
      T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
      D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
      P:  Vendor=22b8 ProdID=2a70 Rev= 0.00
      S:  Manufacturer=Motorola, Incorporated
      S:  Product=Flash MZ600
      C:* #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA
      I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
      E:  Ad=81(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      E:  Ad=01(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
      E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
      E:  Ad=83(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      E:  Ad=03(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
      E:  Ad=84(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      E:  Ad=04(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
      E:  Ad=85(I) Atr=03(Int.) MxPS=  64 Ivl=5ms
      E:  Ad=86(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      E:  Ad=05(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fb Prot=ff Driver=qmi_wwan
      E:  Ad=87(I) Atr=03(Int.) MxPS=  64 Ivl=5ms
      E:  Ad=88(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      E:  Ad=06(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fb Prot=ff Driver=qmi_wwan
      E:  Ad=89(I) Atr=03(Int.) MxPS=  64 Ivl=5ms
      E:  Ad=8a(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      E:  Ad=07(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      I:* If#= 7 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fb Prot=ff Driver=qmi_wwan
      E:  Ad=8b(I) Atr=03(Int.) MxPS=  64 Ivl=5ms
      E:  Ad=8c(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      E:  Ad=08(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      I:* If#= 8 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fb Prot=ff Driver=qmi_wwan
      E:  Ad=8d(I) Atr=03(Int.) MxPS=  64 Ivl=5ms
      E:  Ad=8e(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      E:  Ad=09(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      
      In 22b8:900e "qc_dload" mode the device shows up as:
      
      T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
      D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
      P:  Vendor=22b8 ProdID=900e Rev= 0.00
      S:  Manufacturer=Motorola, Incorporated
      S:  Product=Flash MZ600
      C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=500mA
      I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
      E:  Ad=81(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      E:  Ad=01(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      
      And in 22b8:4281 "ram_downloader" mode the device shows up as:
      
      T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
      D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
      P:  Vendor=22b8 ProdID=4281 Rev= 0.00
      S:  Manufacturer=Motorola, Incorporated
      S:  Product=Flash MZ600
      C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=500mA
      I:* If#= 0 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=fc Driver=option
      E:  Ad=81(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      E:  Ad=01(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      
      Cc: Bjørn Mork <bjorn@mork.no>
      Cc: Dan Williams <dan.j.williams@intel.com>
      Cc: Lars Melin <larsm17@gmail.com>
      Cc: Marcel Partap <mpartap@gmx.net>
      Cc: Merlijn Wajer <merlijn@wizzup.org>
      Cc: Michael Scott <hashcode0f@gmail.com>
      Cc: NeKit <nekit1000@gmail.com>
      Cc: Pavel Machek <pavel@ucw.cz>
      Cc: Sebastian Reichel <sre@kernel.org>
      Tested-by: default avatarPavel Machek <pavel@ucw.cz>
      Signed-off-by: default avatarTony Lindgren <tony@atomide.com>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      6caf0be4
    • Dave Airlie's avatar
      Merge tag 'drm-fixes-5.3-2019-08-14' of git://people.freedesktop.org/~agd5f/linux into drm-fixes · 2f62c5d6
      Dave Airlie authored
      
      
      drm-fixes-5.3-2019-08-14:
      
      amdgpu:
      - Use kvalloc for dc_state to avoid allocation
        failures in some cases.
      - Fix gfx9 soft recovery
      
      scheduler:
      - Fix a race condition when destroying entities
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexdeucher@gmail.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190815024919.3434-1-alexander.deucher@amd.com
      2f62c5d6
    • Lyude Paul's avatar
      drm/nouveau: Only recalculate PBN/VCPI on mode/connector changes · db1231dd
      Lyude Paul authored
      
      
      I -thought- I had fixed this entirely, but it looks like that I didn't
      test this thoroughly enough as we apparently still make one big mistake
      with nv50_msto_atomic_check() - we don't handle the following scenario:
      
      * CRTC #1 has n VCPI allocated to it, is attached to connector DP-4
        which is attached to encoder #1. enabled=y active=n
      * CRTC #1 is changed from DP-4 to DP-5, causing:
        * DP-4 crtc=#1→NULL (VCPI n→0)
        * DP-5 crtc=NULL→#1
        * CRTC #1 steals encoder #1 back from DP-4 and gives it to DP-5
        * CRTC #1 maintains the same mode as before, just with a different
          connector
      * mode_changed=n connectors_changed=y
        (we _SHOULD_ do VCPI 0→n here, but don't)
      
      Once the above scenario is repeated once, we'll attempt freeing VCPI
      from the connector that we didn't allocate due to the connectors
      changing, but the mode staying the same. Sigh.
      
      Since nv50_msto_atomic_check() has broken a few times now, let's rethink
      things a bit to be more careful: limit both VCPI/PBN allocations to
      mode_changed || connectors_changed, since neither VCPI or PBN should
      ever need to change outside of routing and mode changes.
      
      Changes since v1:
      * Fix accidental reversal of clock and bpp arguments in
        drm_dp_calc_pbn_mode() - William Lewis
      Signed-off-by: default avatarLyude Paul <lyude@redhat.com>
      Reported-by: default avatarBohdan Milar <bmilar@redhat.com>
      Tested-by: default avatarBohdan Milar <bmilar@redhat.com>
      Fixes: 232c9eec ("drm/nouveau: Use atomic VCPI helpers for MST")
      References: 412e85b6
      
       ("drm/nouveau: Only release VCPI slots on mode changes")
      Cc: Lyude Paul <lyude@redhat.com>
      Cc: Ben Skeggs <bskeggs@redhat.com>
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Cc: David Airlie <airlied@redhat.com>
      Cc: Jerry Zuo <Jerry.Zuo@amd.com>
      Cc: Harry Wentland <harry.wentland@amd.com>
      Cc: Juston Li <juston.li@intel.com>
      Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
      Cc: Karol Herbst <karolherbst@gmail.com>
      Cc: Ilia Mirkin <imirkin@alum.mit.edu>
      Cc: <stable@vger.kernel.org> # v5.1+
      Acked-by: default avatarBen Skeggs <bskeggs@redhat.com>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190809005307.18391-1-lyude@redhat.com
      db1231dd
    • Y.C. Chen's avatar
      drm/ast: Fixed reboot test may cause system hanged · 05b43971
      Y.C. Chen authored
      
      
      There is another thread still access standard VGA I/O while loading drm driver.
      Disable standard VGA I/O decode to avoid this issue.
      Signed-off-by: default avatarY.C. Chen <yc_chen@aspeedtech.com>
      Reviewed-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/1523410059-18415-1-git-send-email-yc_chen@aspeedtech.com
      05b43971
    • Lubomir Rintel's avatar
      of: irq: fix a trivial typo in a doc comment · 83f82d7a
      Lubomir Rintel authored
      Diverged from what the code does with commit 530210c7
      
       ("of/irq: Replace
      of_irq with of_phandle_args").
      Signed-off-by: default avatarLubomir Rintel <lkundrak@v3.sk>
      Signed-off-by: default avatarRob Herring <robh@kernel.org>
      83f82d7a