]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.4-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 9 Aug 2021 09:21:53 +0000 (11:21 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 9 Aug 2021 09:21:53 +0000 (11:21 +0200)
added patches:
clk-fix-leak-on-devm_clk_bulk_get_all-unwind.patch
optee-clear-stale-cache-entries-during-initialization.patch
optee-fix-memory-leak-when-failing-to-register-shm-pages.patch
scripts-tracing-fix-the-bug-that-can-t-parse-raw_trace_func.patch
tee-add-tee_shm_alloc_kernel_buf.patch
tpm_ftpm_tee-free-and-unregister-tee-shared-memory-during-kexec.patch
tracing-histogram-give-calculation-hist_fields-a-size.patch

queue-5.4/clk-fix-leak-on-devm_clk_bulk_get_all-unwind.patch [new file with mode: 0644]
queue-5.4/optee-clear-stale-cache-entries-during-initialization.patch [new file with mode: 0644]
queue-5.4/optee-fix-memory-leak-when-failing-to-register-shm-pages.patch [new file with mode: 0644]
queue-5.4/scripts-tracing-fix-the-bug-that-can-t-parse-raw_trace_func.patch [new file with mode: 0644]
queue-5.4/series
queue-5.4/tee-add-tee_shm_alloc_kernel_buf.patch [new file with mode: 0644]
queue-5.4/tpm_ftpm_tee-free-and-unregister-tee-shared-memory-during-kexec.patch [new file with mode: 0644]
queue-5.4/tracing-histogram-give-calculation-hist_fields-a-size.patch [new file with mode: 0644]

diff --git a/queue-5.4/clk-fix-leak-on-devm_clk_bulk_get_all-unwind.patch b/queue-5.4/clk-fix-leak-on-devm_clk_bulk_get_all-unwind.patch
new file mode 100644 (file)
index 0000000..e63bf46
--- /dev/null
@@ -0,0 +1,73 @@
+From f828b0bcacef189edbd247e9f48864fc36bfbe33 Mon Sep 17 00:00:00 2001
+From: Brian Norris <briannorris@chromium.org>
+Date: Fri, 30 Jul 2021 19:59:50 -0700
+Subject: clk: fix leak on devm_clk_bulk_get_all() unwind
+
+From: Brian Norris <briannorris@chromium.org>
+
+commit f828b0bcacef189edbd247e9f48864fc36bfbe33 upstream.
+
+clk_bulk_get_all() allocates an array of struct clk_bulk data for us
+(unlike clk_bulk_get()), so we need to free it. Let's use the
+clk_bulk_put_all() helper.
+
+kmemleak complains, on an RK3399 Gru/Kevin system:
+
+unreferenced object 0xffffff80045def00 (size 128):
+  comm "swapper/0", pid 1, jiffies 4294667682 (age 86.394s)
+  hex dump (first 32 bytes):
+    44 32 60 fe fe ff ff ff 00 00 00 00 00 00 00 00  D2`.............
+    48 32 60 fe fe ff ff ff 00 00 00 00 00 00 00 00  H2`.............
+  backtrace:
+    [<00000000742860d6>] __kmalloc+0x22c/0x39c
+    [<00000000b0493f2c>] clk_bulk_get_all+0x64/0x188
+    [<00000000325f5900>] devm_clk_bulk_get_all+0x58/0xa8
+    [<00000000175b9bc5>] dwc3_probe+0x8ac/0xb5c
+    [<000000009169e2f9>] platform_drv_probe+0x9c/0xbc
+    [<000000005c51e2ee>] really_probe+0x13c/0x378
+    [<00000000c47b1f24>] driver_probe_device+0x84/0xc0
+    [<00000000f870fcfb>] __device_attach_driver+0x94/0xb0
+    [<000000004d1b92ae>] bus_for_each_drv+0x8c/0xd8
+    [<00000000481d60c3>] __device_attach+0xc4/0x150
+    [<00000000a163bd36>] device_initial_probe+0x1c/0x28
+    [<00000000accb6bad>] bus_probe_device+0x3c/0x9c
+    [<000000001a199f89>] device_add+0x218/0x3cc
+    [<000000001bd84952>] of_device_add+0x40/0x50
+    [<000000009c658c29>] of_platform_device_create_pdata+0xac/0x100
+    [<0000000021c69ba4>] of_platform_bus_create+0x190/0x224
+
+Fixes: f08c2e2865f6 ("clk: add managed version of clk_bulk_get_all")
+Cc: Dong Aisheng <aisheng.dong@nxp.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Link: https://lore.kernel.org/r/20210731025950.2238582-1-briannorris@chromium.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/clk-devres.c |    9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/clk-devres.c
++++ b/drivers/clk/clk-devres.c
+@@ -92,13 +92,20 @@ int __must_check devm_clk_bulk_get_optio
+ }
+ EXPORT_SYMBOL_GPL(devm_clk_bulk_get_optional);
++static void devm_clk_bulk_release_all(struct device *dev, void *res)
++{
++      struct clk_bulk_devres *devres = res;
++
++      clk_bulk_put_all(devres->num_clks, devres->clks);
++}
++
+ int __must_check devm_clk_bulk_get_all(struct device *dev,
+                                      struct clk_bulk_data **clks)
+ {
+       struct clk_bulk_devres *devres;
+       int ret;
+-      devres = devres_alloc(devm_clk_bulk_release,
++      devres = devres_alloc(devm_clk_bulk_release_all,
+                             sizeof(*devres), GFP_KERNEL);
+       if (!devres)
+               return -ENOMEM;
diff --git a/queue-5.4/optee-clear-stale-cache-entries-during-initialization.patch b/queue-5.4/optee-clear-stale-cache-entries-during-initialization.patch
new file mode 100644 (file)
index 0000000..995fa1e
--- /dev/null
@@ -0,0 +1,121 @@
+From b5c10dd04b7418793517e3286cde5c04759a86de Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks@linux.microsoft.com>
+Date: Mon, 14 Jun 2021 17:33:13 -0500
+Subject: optee: Clear stale cache entries during initialization
+
+From: Tyler Hicks <tyhicks@linux.microsoft.com>
+
+commit b5c10dd04b7418793517e3286cde5c04759a86de upstream.
+
+The shm cache could contain invalid addresses if
+optee_disable_shm_cache() was not called from the .shutdown hook of the
+previous kernel before a kexec. These addresses could be unmapped or
+they could point to mapped but unintended locations in memory.
+
+Clear the shared memory cache, while being careful to not translate the
+addresses returned from OPTEE_SMC_DISABLE_SHM_CACHE, during driver
+initialization. Once all pre-cache shm objects are removed, proceed with
+enabling the cache so that we know that we can handle cached shm objects
+with confidence later in the .shutdown hook.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
+Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tee/optee/call.c          |   36 +++++++++++++++++++++++++++++++++---
+ drivers/tee/optee/core.c          |    9 +++++++++
+ drivers/tee/optee/optee_private.h |    1 +
+ 3 files changed, 43 insertions(+), 3 deletions(-)
+
+--- a/drivers/tee/optee/call.c
++++ b/drivers/tee/optee/call.c
+@@ -407,11 +407,13 @@ void optee_enable_shm_cache(struct optee
+ }
+ /**
+- * optee_disable_shm_cache() - Disables caching of some shared memory allocation
+- *                          in OP-TEE
++ * __optee_disable_shm_cache() - Disables caching of some shared memory
++ *                               allocation in OP-TEE
+  * @optee:    main service struct
++ * @is_mapped:        true if the cached shared memory addresses were mapped by this
++ *            kernel, are safe to dereference, and should be freed
+  */
+-void optee_disable_shm_cache(struct optee *optee)
++static void __optee_disable_shm_cache(struct optee *optee, bool is_mapped)
+ {
+       struct optee_call_waiter w;
+@@ -430,6 +432,13 @@ void optee_disable_shm_cache(struct opte
+               if (res.result.status == OPTEE_SMC_RETURN_OK) {
+                       struct tee_shm *shm;
++                      /*
++                       * Shared memory references that were not mapped by
++                       * this kernel must be ignored to prevent a crash.
++                       */
++                      if (!is_mapped)
++                              continue;
++
+                       shm = reg_pair_to_ptr(res.result.shm_upper32,
+                                             res.result.shm_lower32);
+                       tee_shm_free(shm);
+@@ -440,6 +449,27 @@ void optee_disable_shm_cache(struct opte
+       optee_cq_wait_final(&optee->call_queue, &w);
+ }
++/**
++ * optee_disable_shm_cache() - Disables caching of mapped shared memory
++ *                             allocations in OP-TEE
++ * @optee:    main service struct
++ */
++void optee_disable_shm_cache(struct optee *optee)
++{
++      return __optee_disable_shm_cache(optee, true);
++}
++
++/**
++ * optee_disable_unmapped_shm_cache() - Disables caching of shared memory
++ *                                      allocations in OP-TEE which are not
++ *                                      currently mapped
++ * @optee:    main service struct
++ */
++void optee_disable_unmapped_shm_cache(struct optee *optee)
++{
++      return __optee_disable_shm_cache(optee, false);
++}
++
+ #define PAGELIST_ENTRIES_PER_PAGE                             \
+       ((OPTEE_MSG_NONCONTIG_PAGE_SIZE / sizeof(u64)) - 1)
+--- a/drivers/tee/optee/core.c
++++ b/drivers/tee/optee/core.c
+@@ -628,6 +628,15 @@ static struct optee *optee_probe(struct
+       optee->memremaped_shm = memremaped_shm;
+       optee->pool = pool;
++      /*
++       * Ensure that there are no pre-existing shm objects before enabling
++       * the shm cache so that there's no chance of receiving an invalid
++       * address during shutdown. This could occur, for example, if we're
++       * kexec booting from an older kernel that did not properly cleanup the
++       * shm cache.
++       */
++      optee_disable_unmapped_shm_cache(optee);
++
+       optee_enable_shm_cache(optee);
+       if (optee->sec_caps & OPTEE_SMC_SEC_CAP_DYNAMIC_SHM)
+--- a/drivers/tee/optee/optee_private.h
++++ b/drivers/tee/optee/optee_private.h
+@@ -152,6 +152,7 @@ int optee_cancel_req(struct tee_context
+ void optee_enable_shm_cache(struct optee *optee);
+ void optee_disable_shm_cache(struct optee *optee);
++void optee_disable_unmapped_shm_cache(struct optee *optee);
+ int optee_shm_register(struct tee_context *ctx, struct tee_shm *shm,
+                      struct page **pages, size_t num_pages,
diff --git a/queue-5.4/optee-fix-memory-leak-when-failing-to-register-shm-pages.patch b/queue-5.4/optee-fix-memory-leak-when-failing-to-register-shm-pages.patch
new file mode 100644 (file)
index 0000000..1bc35ee
--- /dev/null
@@ -0,0 +1,54 @@
+From ec185dd3ab257dc2a60953fdf1b6622f524cc5b7 Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks@linux.microsoft.com>
+Date: Mon, 14 Jun 2021 17:33:10 -0500
+Subject: optee: Fix memory leak when failing to register shm pages
+
+From: Tyler Hicks <tyhicks@linux.microsoft.com>
+
+commit ec185dd3ab257dc2a60953fdf1b6622f524cc5b7 upstream.
+
+Free the previously allocated pages when we encounter an error condition
+while attempting to register the pages with the secure world.
+
+Fixes: a249dd200d03 ("tee: optee: Fix dynamic shm pool allocations")
+Fixes: 5a769f6ff439 ("optee: Fix multi page dynamic shm pool alloc")
+Cc: stable@vger.kernel.org
+Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
+Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tee/optee/shm_pool.c |   12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/tee/optee/shm_pool.c
++++ b/drivers/tee/optee/shm_pool.c
+@@ -32,8 +32,10 @@ static int pool_op_alloc(struct tee_shm_
+               struct page **pages;
+               pages = kcalloc(nr_pages, sizeof(pages), GFP_KERNEL);
+-              if (!pages)
+-                      return -ENOMEM;
++              if (!pages) {
++                      rc = -ENOMEM;
++                      goto err;
++              }
+               for (i = 0; i < nr_pages; i++) {
+                       pages[i] = page;
+@@ -44,8 +46,14 @@ static int pool_op_alloc(struct tee_shm_
+               rc = optee_shm_register(shm->ctx, shm, pages, nr_pages,
+                                       (unsigned long)shm->kaddr);
+               kfree(pages);
++              if (rc)
++                      goto err;
+       }
++      return 0;
++
++err:
++      __free_pages(page, order);
+       return rc;
+ }
diff --git a/queue-5.4/scripts-tracing-fix-the-bug-that-can-t-parse-raw_trace_func.patch b/queue-5.4/scripts-tracing-fix-the-bug-that-can-t-parse-raw_trace_func.patch
new file mode 100644 (file)
index 0000000..c82bd7a
--- /dev/null
@@ -0,0 +1,66 @@
+From 1c0cec64a7cc545eb49f374a43e9f7190a14defa Mon Sep 17 00:00:00 2001
+From: Hui Su <suhui@zeku.com>
+Date: Fri, 11 Jun 2021 10:21:07 +0800
+Subject: scripts/tracing: fix the bug that can't parse raw_trace_func
+
+From: Hui Su <suhui@zeku.com>
+
+commit 1c0cec64a7cc545eb49f374a43e9f7190a14defa upstream.
+
+Since commit 77271ce4b2c0 ("tracing: Add irq, preempt-count and need resched info
+to default trace output"), the default trace output format has been changed to:
+          <idle>-0       [009] d.h. 22420.068695: _raw_spin_lock_irqsave <-hrtimer_interrupt
+          <idle>-0       [000] ..s. 22420.068695: _nohz_idle_balance <-run_rebalance_domains
+          <idle>-0       [011] d.h. 22420.068695: account_process_tick <-update_process_times
+
+origin trace output format:(before v3.2.0)
+     # tracer: nop
+     #
+     #           TASK-PID    CPU#    TIMESTAMP  FUNCTION
+     #              | |       |          |         |
+          migration/0-6     [000]    50.025810: rcu_note_context_switch <-__schedule
+          migration/0-6     [000]    50.025812: trace_rcu_utilization <-rcu_note_context_switch
+          migration/0-6     [000]    50.025813: rcu_sched_qs <-rcu_note_context_switch
+          migration/0-6     [000]    50.025815: rcu_preempt_qs <-rcu_note_context_switch
+          migration/0-6     [000]    50.025817: trace_rcu_utilization <-rcu_note_context_switch
+          migration/0-6     [000]    50.025818: debug_lockdep_rcu_enabled <-__schedule
+          migration/0-6     [000]    50.025820: debug_lockdep_rcu_enabled <-__schedule
+
+The draw_functrace.py(introduced in v2.6.28) can't parse the new version format trace_func,
+So we need modify draw_functrace.py to adapt the new version trace output format.
+
+Link: https://lkml.kernel.org/r/20210611022107.608787-1-suhui@zeku.com
+
+Cc: stable@vger.kernel.org
+Fixes: 77271ce4b2c0 tracing: Add irq, preempt-count and need resched info to default trace output
+Signed-off-by: Hui Su <suhui@zeku.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ scripts/tracing/draw_functrace.py |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/scripts/tracing/draw_functrace.py
++++ b/scripts/tracing/draw_functrace.py
+@@ -17,7 +17,7 @@ Usage:
+       $ cat /sys/kernel/debug/tracing/trace_pipe > ~/raw_trace_func
+       Wait some times but not too much, the script is a bit slow.
+       Break the pipe (Ctrl + Z)
+-      $ scripts/draw_functrace.py < raw_trace_func > draw_functrace
++      $ scripts/tracing/draw_functrace.py < ~/raw_trace_func > draw_functrace
+       Then you have your drawn trace in draw_functrace
+ """
+@@ -103,10 +103,10 @@ def parseLine(line):
+       line = line.strip()
+       if line.startswith("#"):
+               raise CommentLineException
+-      m = re.match("[^]]+?\\] +([0-9.]+): (\\w+) <-(\\w+)", line)
++      m = re.match("[^]]+?\\] +([a-z.]+) +([0-9.]+): (\\w+) <-(\\w+)", line)
+       if m is None:
+               raise BrokenLineException
+-      return (m.group(1), m.group(2), m.group(3))
++      return (m.group(2), m.group(3), m.group(4))
+ def main():
index 6e5a2ed796b0547ff9eb3caea90b1fcce3fe4c3a..15193172dd875d3bc1dea8b18c5a2484b7572fa9 100644 (file)
@@ -46,3 +46,10 @@ usb-gadget-f_hid-added-get_idle-and-set_idle-handlers.patch
 usb-gadget-f_hid-fixed-null-pointer-dereference.patch
 usb-gadget-f_hid-idle-uses-the-highest-byte-for-duration.patch
 usb-otg-fsm-fix-hrtimer-list-corruption.patch
+clk-fix-leak-on-devm_clk_bulk_get_all-unwind.patch
+scripts-tracing-fix-the-bug-that-can-t-parse-raw_trace_func.patch
+tracing-histogram-give-calculation-hist_fields-a-size.patch
+optee-clear-stale-cache-entries-during-initialization.patch
+tee-add-tee_shm_alloc_kernel_buf.patch
+optee-fix-memory-leak-when-failing-to-register-shm-pages.patch
+tpm_ftpm_tee-free-and-unregister-tee-shared-memory-during-kexec.patch
diff --git a/queue-5.4/tee-add-tee_shm_alloc_kernel_buf.patch b/queue-5.4/tee-add-tee_shm_alloc_kernel_buf.patch
new file mode 100644 (file)
index 0000000..60e78b7
--- /dev/null
@@ -0,0 +1,60 @@
+From dc7019b7d0e188d4093b34bd0747ed0d668c63bf Mon Sep 17 00:00:00 2001
+From: Jens Wiklander <jens.wiklander@linaro.org>
+Date: Mon, 14 Jun 2021 17:33:14 -0500
+Subject: tee: add tee_shm_alloc_kernel_buf()
+
+From: Jens Wiklander <jens.wiklander@linaro.org>
+
+commit dc7019b7d0e188d4093b34bd0747ed0d668c63bf upstream.
+
+Adds a new function tee_shm_alloc_kernel_buf() to allocate shared memory
+from a kernel driver. This function can later be made more lightweight
+by unnecessary dma-buf export.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tee/tee_shm.c   |   18 ++++++++++++++++++
+ include/linux/tee_drv.h |    1 +
+ 2 files changed, 19 insertions(+)
+
+--- a/drivers/tee/tee_shm.c
++++ b/drivers/tee/tee_shm.c
+@@ -219,6 +219,24 @@ struct tee_shm *tee_shm_priv_alloc(struc
+ }
+ EXPORT_SYMBOL_GPL(tee_shm_priv_alloc);
++/**
++ * tee_shm_alloc_kernel_buf() - Allocate shared memory for kernel buffer
++ * @ctx:      Context that allocates the shared memory
++ * @size:     Requested size of shared memory
++ *
++ * The returned memory registered in secure world and is suitable to be
++ * passed as a memory buffer in parameter argument to
++ * tee_client_invoke_func(). The memory allocated is later freed with a
++ * call to tee_shm_free().
++ *
++ * @returns a pointer to 'struct tee_shm'
++ */
++struct tee_shm *tee_shm_alloc_kernel_buf(struct tee_context *ctx, size_t size)
++{
++      return tee_shm_alloc(ctx, size, TEE_SHM_MAPPED | TEE_SHM_DMA_BUF);
++}
++EXPORT_SYMBOL_GPL(tee_shm_alloc_kernel_buf);
++
+ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr,
+                                size_t length, u32 flags)
+ {
+--- a/include/linux/tee_drv.h
++++ b/include/linux/tee_drv.h
+@@ -317,6 +317,7 @@ void *tee_get_drvdata(struct tee_device
+  * @returns a pointer to 'struct tee_shm'
+  */
+ struct tee_shm *tee_shm_alloc(struct tee_context *ctx, size_t size, u32 flags);
++struct tee_shm *tee_shm_alloc_kernel_buf(struct tee_context *ctx, size_t size);
+ /**
+  * tee_shm_priv_alloc() - Allocate shared memory privately
diff --git a/queue-5.4/tpm_ftpm_tee-free-and-unregister-tee-shared-memory-during-kexec.patch b/queue-5.4/tpm_ftpm_tee-free-and-unregister-tee-shared-memory-during-kexec.patch
new file mode 100644 (file)
index 0000000..f929d99
--- /dev/null
@@ -0,0 +1,53 @@
+From dfb703ad2a8d366b829818a558337be779746575 Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks@linux.microsoft.com>
+Date: Mon, 14 Jun 2021 17:33:16 -0500
+Subject: tpm_ftpm_tee: Free and unregister TEE shared memory during kexec
+
+From: Tyler Hicks <tyhicks@linux.microsoft.com>
+
+commit dfb703ad2a8d366b829818a558337be779746575 upstream.
+
+dma-buf backed shared memory cannot be reliably freed and unregistered
+during a kexec operation even when tee_shm_free() is called on the shm
+from a .shutdown hook. The problem occurs because dma_buf_put() calls
+fput() which then uses task_work_add(), with the TWA_RESUME parameter,
+to queue tee_shm_release() to be called before the current task returns
+to user mode. However, the current task never returns to user mode
+before the kexec completes so the memory is never freed nor
+unregistered.
+
+Use tee_shm_alloc_kernel_buf() to avoid dma-buf backed shared memory
+allocation so that tee_shm_free() can directly call tee_shm_release().
+This will ensure that the shm can be freed and unregistered during a
+kexec operation.
+
+Fixes: 09e574831b27 ("tpm/tpm_ftpm_tee: A driver for firmware TPM running inside TEE")
+Fixes: 1760eb689ed6 ("tpm/tpm_ftpm_tee: add shutdown call back")
+Cc: stable@vger.kernel.org
+Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
+Acked-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/tpm/tpm_ftpm_tee.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/char/tpm/tpm_ftpm_tee.c
++++ b/drivers/char/tpm/tpm_ftpm_tee.c
+@@ -255,11 +255,11 @@ static int ftpm_tee_probe(struct platfor
+       pvt_data->session = sess_arg.session;
+       /* Allocate dynamic shared memory with fTPM TA */
+-      pvt_data->shm = tee_shm_alloc(pvt_data->ctx,
+-                                    MAX_COMMAND_SIZE + MAX_RESPONSE_SIZE,
+-                                    TEE_SHM_MAPPED | TEE_SHM_DMA_BUF);
++      pvt_data->shm = tee_shm_alloc_kernel_buf(pvt_data->ctx,
++                                               MAX_COMMAND_SIZE +
++                                               MAX_RESPONSE_SIZE);
+       if (IS_ERR(pvt_data->shm)) {
+-              dev_err(dev, "%s: tee_shm_alloc failed\n", __func__);
++              dev_err(dev, "%s: tee_shm_alloc_kernel_buf failed\n", __func__);
+               rc = -ENOMEM;
+               goto out_shm_alloc;
+       }
diff --git a/queue-5.4/tracing-histogram-give-calculation-hist_fields-a-size.patch b/queue-5.4/tracing-histogram-give-calculation-hist_fields-a-size.patch
new file mode 100644 (file)
index 0000000..3b3bea9
--- /dev/null
@@ -0,0 +1,65 @@
+From 2c05caa7ba8803209769b9e4fe02c38d77ae88d0 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Fri, 30 Jul 2021 17:19:51 -0400
+Subject: tracing / histogram: Give calculation hist_fields a size
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+commit 2c05caa7ba8803209769b9e4fe02c38d77ae88d0 upstream.
+
+When working on my user space applications, I found a bug in the synthetic
+event code where the automated synthetic event field was not matching the
+event field calculation it was attached to. Looking deeper into it, it was
+because the calculation hist_field was not given a size.
+
+The synthetic event fields are matched to their hist_fields either by
+having the field have an identical string type, or if that does not match,
+then the size and signed values are used to match the fields.
+
+The problem arose when I tried to match a calculation where the fields
+were "unsigned int". My tool created a synthetic event of type "u32". But
+it failed to match. The string was:
+
+  diff=field1-field2:onmatch(event).trace(synth,$diff)
+
+Adding debugging into the kernel, I found that the size of "diff" was 0.
+And since it was given "unsigned int" as a type, the histogram fallback
+code used size and signed. The signed matched, but the size of u32 (4) did
+not match zero, and the event failed to be created.
+
+This can be worse if the field you want to match is not one of the
+acceptable fields for a synthetic event. As event fields can have any type
+that is supported in Linux, this can cause an issue. For example, if a
+type is an enum. Then there's no way to use that with any calculations.
+
+Have the calculation field simply take on the size of what it is
+calculating.
+
+Link: https://lkml.kernel.org/r/20210730171951.59c7743f@oasis.local.home
+
+Cc: Tom Zanussi <zanussi@kernel.org>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: stable@vger.kernel.org
+Fixes: 100719dcef447 ("tracing: Add simple expression support to hist triggers")
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_events_hist.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -3169,6 +3169,10 @@ static struct hist_field *parse_expr(str
+       expr->operands[0] = operand1;
+       expr->operands[1] = operand2;
++
++      /* The operand sizes should be the same, so just pick one */
++      expr->size = operand1->size;
++
+       expr->operator = field_op;
+       expr->name = expr_str(expr, 0);
+       expr->type = kstrdup(operand1->type, GFP_KERNEL);