--- /dev/null
+From eec13b42d41b0f3339dcf0c4da43734427c68620 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will@kernel.org>
+Date: Thu, 18 Jun 2020 11:16:45 +0100
+Subject: ARM: 8986/1: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints
+
+From: Will Deacon <will@kernel.org>
+
+commit eec13b42d41b0f3339dcf0c4da43734427c68620 upstream.
+
+Unprivileged memory accesses generated by the so-called "translated"
+instructions (e.g. LDRT) in kernel mode can cause user watchpoints to fire
+unexpectedly. In such cases, the hw_breakpoint logic will invoke the user
+overflow handler which will typically raise a SIGTRAP back to the current
+task. This is futile when returning back to the kernel because (a) the
+signal won't have been delivered and (b) userspace can't handle the thing
+anyway.
+
+Avoid invoking the user overflow handler for watchpoints triggered by
+kernel uaccess routines, and instead single-step over the faulting
+instruction as we would if no overflow handler had been installed.
+
+Cc: <stable@vger.kernel.org>
+Fixes: f81ef4a920c8 ("ARM: 6356/1: hw-breakpoint: add ARM backend for the hw-breakpoint framework")
+Reported-by: Luis Machado <luis.machado@linaro.org>
+Tested-by: Luis Machado <luis.machado@linaro.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/kernel/hw_breakpoint.c | 27 ++++++++++++++++++++++-----
+ 1 file changed, 22 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/kernel/hw_breakpoint.c
++++ b/arch/arm/kernel/hw_breakpoint.c
+@@ -680,6 +680,12 @@ static void disable_single_step(struct p
+ arch_install_hw_breakpoint(bp);
+ }
+
++static int watchpoint_fault_on_uaccess(struct pt_regs *regs,
++ struct arch_hw_breakpoint *info)
++{
++ return !user_mode(regs) && info->ctrl.privilege == ARM_BREAKPOINT_USER;
++}
++
+ static void watchpoint_handler(unsigned long addr, unsigned int fsr,
+ struct pt_regs *regs)
+ {
+@@ -739,16 +745,27 @@ static void watchpoint_handler(unsigned
+ }
+
+ pr_debug("watchpoint fired: address = 0x%x\n", info->trigger);
++
++ /*
++ * If we triggered a user watchpoint from a uaccess routine,
++ * then handle the stepping ourselves since userspace really
++ * can't help us with this.
++ */
++ if (watchpoint_fault_on_uaccess(regs, info))
++ goto step;
++
+ perf_bp_event(wp, regs);
+
+ /*
+- * If no overflow handler is present, insert a temporary
+- * mismatch breakpoint so we can single-step over the
+- * watchpoint trigger.
++ * Defer stepping to the overflow handler if one is installed.
++ * Otherwise, insert a temporary mismatch breakpoint so that
++ * we can single-step over the watchpoint trigger.
+ */
+- if (is_default_overflow_handler(wp))
+- enable_single_step(wp, instruction_pointer(regs));
++ if (!is_default_overflow_handler(wp))
++ goto unlock;
+
++step:
++ enable_single_step(wp, instruction_pointer(regs));
+ unlock:
+ rcu_read_unlock();
+ }
--- /dev/null
+From 4a601da92c2a782e5c022680d476104586b74994 Mon Sep 17 00:00:00 2001
+From: Michael Trimarchi <michael@amarulasolutions.com>
+Date: Fri, 17 Jul 2020 13:33:52 +0530
+Subject: ARM: dts: imx6qdl-icore: Fix OTG_ID pin and sdcard detect
+
+From: Michael Trimarchi <michael@amarulasolutions.com>
+
+commit 4a601da92c2a782e5c022680d476104586b74994 upstream.
+
+The current pin muxing scheme muxes GPIO_1 pad for USB_OTG_ID
+because of which when card is inserted, usb otg is enumerated
+and the card is never detected.
+
+[ 64.492645] cfg80211: failed to load regulatory.db
+[ 64.492657] imx-sdma 20ec000.sdma: external firmware not found, using ROM firmware
+[ 76.343711] ci_hdrc ci_hdrc.0: EHCI Host Controller
+[ 76.349742] ci_hdrc ci_hdrc.0: new USB bus registered, assigned bus number 2
+[ 76.388862] ci_hdrc ci_hdrc.0: USB 2.0 started, EHCI 1.00
+[ 76.396650] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 5.08
+[ 76.405412] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
+[ 76.412763] usb usb2: Product: EHCI Host Controller
+[ 76.417666] usb usb2: Manufacturer: Linux 5.8.0-rc1-next-20200618 ehci_hcd
+[ 76.424623] usb usb2: SerialNumber: ci_hdrc.0
+[ 76.431755] hub 2-0:1.0: USB hub found
+[ 76.435862] hub 2-0:1.0: 1 port detected
+
+The TRM mentions GPIO_1 pad should be muxed/assigned for card detect
+and ENET_RX_ER pad for USB_OTG_ID for proper operation.
+
+This patch fixes pin muxing as per TRM and is tested on a
+i.Core 1.5 MX6 DL SOM.
+
+[ 22.449165] mmc0: host does not support reading read-only switch, assuming write-enable
+[ 22.459992] mmc0: new high speed SDHC card at address 0001
+[ 22.469725] mmcblk0: mmc0:0001 EB1QT 29.8 GiB
+[ 22.478856] mmcblk0: p1 p2
+
+Fixes: 6df11287f7c9 ("ARM: dts: imx6q: Add Engicam i.CoreM6 Quad/Dual initial support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
+Signed-off-by: Suniel Mahesh <sunil@amarulasolutions.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx6qdl-icore.dtsi | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/imx6qdl-icore.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-icore.dtsi
+@@ -384,7 +384,7 @@
+
+ pinctrl_usbotg: usbotggrp {
+ fsl,pins = <
+- MX6QDL_PAD_GPIO_1__USB_OTG_ID 0x17059
++ MX6QDL_PAD_ENET_RX_ER__USB_OTG_ID 0x17059
+ >;
+ };
+
+@@ -396,6 +396,7 @@
+ MX6QDL_PAD_SD1_DAT1__SD1_DATA1 0x17070
+ MX6QDL_PAD_SD1_DAT2__SD1_DATA2 0x17070
+ MX6QDL_PAD_SD1_DAT3__SD1_DATA3 0x17070
++ MX6QDL_PAD_GPIO_1__GPIO1_IO01 0x1b0b0
+ >;
+ };
+
--- /dev/null
+From d36f260718d83928e6012247a7e1b9791cdb12ff Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <festevam@gmail.com>
+Date: Mon, 13 Jul 2020 11:23:25 -0300
+Subject: ARM: dts: imx6sx-sabreauto: Fix the phy-mode on fec2
+
+From: Fabio Estevam <festevam@gmail.com>
+
+commit d36f260718d83928e6012247a7e1b9791cdb12ff upstream.
+
+Commit 0672d22a1924 ("ARM: dts: imx: Fix the AR803X phy-mode") fixed the
+phy-mode for fec1, but missed to fix it for the fec2 node.
+
+Fix fec2 to also use "rgmii-id" as the phy-mode.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 0672d22a1924 ("ARM: dts: imx: Fix the AR803X phy-mode")
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx6sx-sabreauto.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/imx6sx-sabreauto.dts
++++ b/arch/arm/boot/dts/imx6sx-sabreauto.dts
+@@ -99,7 +99,7 @@
+ &fec2 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_enet2>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-handle = <ðphy0>;
+ fsl,magic-packet;
+ status = "okay";
--- /dev/null
+From c696afd331be1acb39206aba53048f2386b781fc Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <festevam@gmail.com>
+Date: Mon, 13 Jul 2020 11:23:24 -0300
+Subject: ARM: dts: imx6sx-sdb: Fix the phy-mode on fec2
+
+From: Fabio Estevam <festevam@gmail.com>
+
+commit c696afd331be1acb39206aba53048f2386b781fc upstream.
+
+Commit 0672d22a1924 ("ARM: dts: imx: Fix the AR803X phy-mode") fixed the
+phy-mode for fec1, but missed to fix it for the fec2 node.
+
+Fix fec2 to also use "rgmii-id" as the phy-mode.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 0672d22a1924 ("ARM: dts: imx: Fix the AR803X phy-mode")
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx6sx-sdb.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/imx6sx-sdb.dtsi
++++ b/arch/arm/boot/dts/imx6sx-sdb.dtsi
+@@ -213,7 +213,7 @@
+ &fec2 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_enet2>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-handle = <ðphy2>;
+ status = "okay";
+ };
--- /dev/null
+From aa54ea903abb02303bf55855fb51e3fcee135d70 Mon Sep 17 00:00:00 2001
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+Date: Thu, 30 Jul 2020 22:05:01 +0300
+Subject: ARM: percpu.h: fix build error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+commit aa54ea903abb02303bf55855fb51e3fcee135d70 upstream.
+
+Fix build error for the case:
+ defined(CONFIG_SMP) && !defined(CONFIG_CPU_V6)
+
+config: keystone_defconfig
+
+ CC arch/arm/kernel/signal.o
+ In file included from ../include/linux/random.h:14,
+ from ../arch/arm/kernel/signal.c:8:
+ ../arch/arm/include/asm/percpu.h: In function ‘__my_cpu_offset’:
+ ../arch/arm/include/asm/percpu.h:29:34: error: ‘current_stack_pointer’ undeclared (first use in this function); did you mean ‘user_stack_pointer’?
+ : "Q" (*(const unsigned long *)current_stack_pointer));
+ ^~~~~~~~~~~~~~~~~~~~~
+ user_stack_pointer
+
+Fixes: f227e3ec3b5c ("random32: update the net random state on interrupt and activity")
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/include/asm/percpu.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/include/asm/percpu.h
++++ b/arch/arm/include/asm/percpu.h
+@@ -5,6 +5,8 @@
+ #ifndef _ASM_ARM_PERCPU_H_
+ #define _ASM_ARM_PERCPU_H_
+
++#include <asm/thread_info.h>
++
+ /*
+ * Same as asm-generic/percpu.h, except that we store the per cpu offset
+ * in the TPIDRPRW. TPIDRPRW only exists on V6K and V7
--- /dev/null
+From f227e3ec3b5cad859ad15666874405e8c1bbc1d4 Mon Sep 17 00:00:00 2001
+From: Willy Tarreau <w@1wt.eu>
+Date: Fri, 10 Jul 2020 15:23:19 +0200
+Subject: random32: update the net random state on interrupt and activity
+
+From: Willy Tarreau <w@1wt.eu>
+
+commit f227e3ec3b5cad859ad15666874405e8c1bbc1d4 upstream.
+
+This modifies the first 32 bits out of the 128 bits of a random CPU's
+net_rand_state on interrupt or CPU activity to complicate remote
+observations that could lead to guessing the network RNG's internal
+state.
+
+Note that depending on some network devices' interrupt rate moderation
+or binding, this re-seeding might happen on every packet or even almost
+never.
+
+In addition, with NOHZ some CPUs might not even get timer interrupts,
+leaving their local state rarely updated, while they are running
+networked processes making use of the random state. For this reason, we
+also perform this update in update_process_times() in order to at least
+update the state when there is user or system activity, since it's the
+only case we care about.
+
+Reported-by: Amit Klein <aksecurity@gmail.com>
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Willy Tarreau <w@1wt.eu>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/random.c | 1 +
+ include/linux/random.h | 3 +++
+ kernel/time/timer.c | 8 ++++++++
+ lib/random32.c | 2 +-
+ 4 files changed, 13 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -1330,6 +1330,7 @@ void add_interrupt_randomness(int irq, i
+
+ fast_mix(fast_pool);
+ add_interrupt_bench(cycles);
++ this_cpu_add(net_rand_state.s1, fast_pool->pool[cycles & 3]);
+
+ if (unlikely(crng_init == 0)) {
+ if ((fast_pool->count >= 64) &&
+--- a/include/linux/random.h
++++ b/include/linux/random.h
+@@ -9,6 +9,7 @@
+
+ #include <linux/list.h>
+ #include <linux/once.h>
++#include <linux/percpu.h>
+
+ #include <uapi/linux/random.h>
+
+@@ -117,6 +118,8 @@ struct rnd_state {
+ __u32 s1, s2, s3, s4;
+ };
+
++DECLARE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy;
++
+ u32 prandom_u32_state(struct rnd_state *state);
+ void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes);
+ void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state);
+--- a/kernel/time/timer.c
++++ b/kernel/time/timer.c
+@@ -43,6 +43,7 @@
+ #include <linux/sched/debug.h>
+ #include <linux/slab.h>
+ #include <linux/compat.h>
++#include <linux/random.h>
+
+ #include <linux/uaccess.h>
+ #include <asm/unistd.h>
+@@ -1742,6 +1743,13 @@ void update_process_times(int user_tick)
+ scheduler_tick();
+ if (IS_ENABLED(CONFIG_POSIX_TIMERS))
+ run_posix_cpu_timers();
++
++ /* The current CPU might make use of net randoms without receiving IRQs
++ * to renew them often enough. Let's update the net_rand_state from a
++ * non-constant value that's not affine to the number of calls to make
++ * sure it's updated when there's some activity (we don't care in idle).
++ */
++ this_cpu_add(net_rand_state.s1, rol32(jiffies, 24) + user_tick);
+ }
+
+ /**
+--- a/lib/random32.c
++++ b/lib/random32.c
+@@ -48,7 +48,7 @@ static inline void prandom_state_selftes
+ }
+ #endif
+
+-static DEFINE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy;
++DEFINE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy;
+
+ /**
+ * prandom_u32_state - seeded pseudo-random number generator.
vhost-scsi-fix-up-req-type-endian-ness.patch
9p-trans_fd-fix-concurrency-del-of-req_list-in-p9_fd_cancelled-p9_read_work.patch
wireless-use-offsetof-instead-of-custom-macro.patch
+arm-8986-1-hw_breakpoint-don-t-invoke-overflow-handler-on-uaccess-watchpoints.patch
+arm-dts-imx6sx-sabreauto-fix-the-phy-mode-on-fec2.patch
+arm-dts-imx6sx-sdb-fix-the-phy-mode-on-fec2.patch
+arm-dts-imx6qdl-icore-fix-otg_id-pin-and-sdcard-detect.patch
+virtio_balloon-fix-up-endian-ness-for-free-cmd-id.patch
+random32-update-the-net-random-state-on-interrupt-and-activity.patch
+arm-percpu.h-fix-build-error.patch
--- /dev/null
+From 168c358af2f8c5a37f8b5f877ba2cc93995606ee Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Mon, 27 Jul 2020 12:01:27 -0400
+Subject: virtio_balloon: fix up endian-ness for free cmd id
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+commit 168c358af2f8c5a37f8b5f877ba2cc93995606ee upstream.
+
+free cmd id is read using virtio endian, spec says all fields
+in balloon are LE. Fix it up.
+
+Fixes: 86a559787e6f ("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT")
+Cc: stable@vger.kernel.org
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Wei Wang <wei.w.wang@intel.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/virtio/virtio_balloon.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/virtio/virtio_balloon.c
++++ b/drivers/virtio/virtio_balloon.c
+@@ -529,10 +529,14 @@ static int init_vqs(struct virtio_balloo
+ static u32 virtio_balloon_cmd_id_received(struct virtio_balloon *vb)
+ {
+ if (test_and_clear_bit(VIRTIO_BALLOON_CONFIG_READ_CMD_ID,
+- &vb->config_read_bitmap))
++ &vb->config_read_bitmap)) {
+ virtio_cread(vb->vdev, struct virtio_balloon_config,
+ free_page_report_cmd_id,
+ &vb->cmd_id_received_cache);
++ /* Legacy balloon config space is LE, unlike all other devices. */
++ if (!virtio_has_feature(vb->vdev, VIRTIO_F_VERSION_1))
++ vb->cmd_id_received_cache = le32_to_cpu((__force __le32)vb->cmd_id_received_cache);
++ }
+
+ return vb->cmd_id_received_cache;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
