From: Greg Kroah-Hartman Date: Sat, 5 Jan 2019 08:35:35 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v4.9.149~60 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3f6f84af6cb95d81e005a5f19868487710173de8;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: alsa-emu10k1-fix-potential-spectre-v1-vulnerabilities.patch alsa-emux-fix-potential-spectre-v1-vulnerabilities.patch alsa-fireface-fix-for-state-to-fetch-pcm-frames.patch alsa-firewire-lib-fix-wrong-assignment-for-out_packet_without_header-tracepoint.patch alsa-firewire-lib-fix-wrong-handling-payload_length-as-payload_quadlet.patch alsa-firewire-lib-use-the-same-print-format-for-without_header-tracepoints.patch alsa-hda-add-mute-led-support-for-hp-elitebook-840-g4.patch alsa-hda-realtek-enable-audio-jacks-of-asus-ux391ua-with-alc294.patch alsa-hda-realtek-enable-the-headset-mic-auto-detection-for-asus-laptops.patch alsa-hda-tegra-clear-pending-irq-handlers.patch alsa-pcm-fix-potential-spectre-v1-vulnerability.patch alsa-rme9652-fix-potential-spectre-v1-vulnerability.patch ib-hfi1-incorrect-sizing-of-sge-for-pio-will-oops.patch media-dvb-usb-v2-fix-incorrect-use-of-transfer_flags-urb_free_buffer.patch mtd-atmel-quadspi-disallow-building-on-ebsa110.patch mtd-rawnand-marvell-prevent-timeouts-on-a-loaded-machine.patch mtd-rawnand-omap2-pass-the-parent-of-pdev-to-dma_request_chan.patch powerpc-fsl-fix-spectre_v2-mitigations-reporting.patch revert-usb-dwc3-pci-use-devm-functions-to-get-the-phy-gpios.patch usb-dwc2-disable-power_down-on-amlogic-devices.patch usb-dwc2-host-use-hrtimer-for-nak-retries.patch usb-r8a66597-fix-a-possible-concurrency-use-after-free-bug-in-r8a66597_endpoint_disable.patch usb-roles-add-a-description-for-the-class-to-kconfig.patch usb-serial-option-add-fibocom-nl678-series.patch usb-serial-pl2303-add-ids-for-hewlett-packard-hp-pos-pole-displays.patch --- diff --git a/queue-4.19/alsa-emu10k1-fix-potential-spectre-v1-vulnerabilities.patch b/queue-4.19/alsa-emu10k1-fix-potential-spectre-v1-vulnerabilities.patch new file mode 100644 index 00000000000..0ab3431c580 --- /dev/null +++ b/queue-4.19/alsa-emu10k1-fix-potential-spectre-v1-vulnerabilities.patch @@ -0,0 +1,62 @@ +From 5ae4f61f012a097df93de2285070ec8e34716d29 Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Tue, 18 Dec 2018 11:52:16 -0600 +Subject: ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities + +From: Gustavo A. R. Silva + +commit 5ae4f61f012a097df93de2285070ec8e34716d29 upstream. + +ipcm->substream is indirectly controlled by user-space, hence leading to +a potential exploitation of the Spectre variant 1 vulnerability. + +This issue was detected with the help of Smatch: + +sound/pci/emu10k1/emufx.c:1031 snd_emu10k1_ipcm_poke() warn: potential spectre issue 'emu->fx8010.pcm' [r] (local cap) +sound/pci/emu10k1/emufx.c:1075 snd_emu10k1_ipcm_peek() warn: potential spectre issue 'emu->fx8010.pcm' [r] (local cap) + +Fix this by sanitizing ipcm->substream before using it to index emu->fx8010.pcm + +Notice that given that speculation windows are large, the policy is +to kill the speculation on the first load and not worry if it can be +completed with a dependent load/store [1]. + +[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 + +Cc: stable@vger.kernel.org +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/emu10k1/emufx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/sound/pci/emu10k1/emufx.c ++++ b/sound/pci/emu10k1/emufx.c +@@ -36,6 +36,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -1026,6 +1027,8 @@ static int snd_emu10k1_ipcm_poke(struct + + if (ipcm->substream >= EMU10K1_FX8010_PCM_COUNT) + return -EINVAL; ++ ipcm->substream = array_index_nospec(ipcm->substream, ++ EMU10K1_FX8010_PCM_COUNT); + if (ipcm->channels > 32) + return -EINVAL; + pcm = &emu->fx8010.pcm[ipcm->substream]; +@@ -1072,6 +1075,8 @@ static int snd_emu10k1_ipcm_peek(struct + + if (ipcm->substream >= EMU10K1_FX8010_PCM_COUNT) + return -EINVAL; ++ ipcm->substream = array_index_nospec(ipcm->substream, ++ EMU10K1_FX8010_PCM_COUNT); + pcm = &emu->fx8010.pcm[ipcm->substream]; + mutex_lock(&emu->fx8010.lock); + spin_lock_irq(&emu->reg_lock); diff --git a/queue-4.19/alsa-emux-fix-potential-spectre-v1-vulnerabilities.patch b/queue-4.19/alsa-emux-fix-potential-spectre-v1-vulnerabilities.patch new file mode 100644 index 00000000000..3eded9009f1 --- /dev/null +++ b/queue-4.19/alsa-emux-fix-potential-spectre-v1-vulnerabilities.patch @@ -0,0 +1,69 @@ +From 4aea96f4237cea0c51a8bc87c0db31f0f932f1f0 Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Wed, 12 Dec 2018 11:20:49 -0600 +Subject: ALSA: emux: Fix potential Spectre v1 vulnerabilities + +From: Gustavo A. R. Silva + +commit 4aea96f4237cea0c51a8bc87c0db31f0f932f1f0 upstream. + +info.mode and info.port are indirectly controlled by user-space, +hence leading to a potential exploitation of the Spectre variant 1 +vulnerability. + +These issues were detected with the help of Smatch: + +sound/synth/emux/emux_hwdep.c:72 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs[i]->ctrls' [w] (local cap) +sound/synth/emux/emux_hwdep.c:75 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs' [w] (local cap) +sound/synth/emux/emux_hwdep.c:75 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs[info.port]->ctrls' [w] (local cap) + +Fix this by sanitizing both info.mode and info.port before using them +to index emu->portptrs[i]->ctrls, emu->portptrs[info.port]->ctrls and +emu->portptrs. + +Notice that given that speculation windows are large, the policy is +to kill the speculation on the first load and not worry if it can be +completed with a dependent load/store [1]. + +[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 + +Signed-off-by: Gustavo A. R. Silva +Cc: stable@vger.kernel.org +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/synth/emux/emux_hwdep.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/sound/synth/emux/emux_hwdep.c ++++ b/sound/synth/emux/emux_hwdep.c +@@ -22,9 +22,9 @@ + #include + #include + #include ++#include + #include "emux_voice.h" + +- + #define TMP_CLIENT_ID 0x1001 + + /* +@@ -66,13 +66,16 @@ snd_emux_hwdep_misc_mode(struct snd_emux + return -EFAULT; + if (info.mode < 0 || info.mode >= EMUX_MD_END) + return -EINVAL; ++ info.mode = array_index_nospec(info.mode, EMUX_MD_END); + + if (info.port < 0) { + for (i = 0; i < emu->num_ports; i++) + emu->portptrs[i]->ctrls[info.mode] = info.value; + } else { +- if (info.port < emu->num_ports) ++ if (info.port < emu->num_ports) { ++ info.port = array_index_nospec(info.port, emu->num_ports); + emu->portptrs[info.port]->ctrls[info.mode] = info.value; ++ } + } + return 0; + } diff --git a/queue-4.19/alsa-fireface-fix-for-state-to-fetch-pcm-frames.patch b/queue-4.19/alsa-fireface-fix-for-state-to-fetch-pcm-frames.patch new file mode 100644 index 00000000000..97fbebe8755 --- /dev/null +++ b/queue-4.19/alsa-fireface-fix-for-state-to-fetch-pcm-frames.patch @@ -0,0 +1,37 @@ +From 3d16200a3e55a39caa1c88419cb559c00316f721 Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Sat, 15 Dec 2018 19:06:48 +0900 +Subject: ALSA: fireface: fix for state to fetch PCM frames + +From: Takashi Sakamoto + +commit 3d16200a3e55a39caa1c88419cb559c00316f721 upstream. + +According to my memo at hand and saved records, writing 0x00000001 to +SND_FF_REG_FETCH_PCM_FRAMES disables fetching PCM frames in corresponding +channel, however current implement uses reversed logic. This results in +muted volume in device side during playback. + +This commit corrects the bug. + +Cc: # v4.12+ +Fixes: 76fdb3a9e13a ('ALSA: fireface: add support for Fireface 400') +Signed-off-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/firewire/fireface/ff-protocol-ff400.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/firewire/fireface/ff-protocol-ff400.c ++++ b/sound/firewire/fireface/ff-protocol-ff400.c +@@ -152,7 +152,7 @@ static int ff400_switch_fetching_mode(st + if (reg == NULL) + return -ENOMEM; + +- if (enable) { ++ if (!enable) { + /* + * Each quadlet is corresponding to data channels in a data + * blocks in reverse order. Precisely, quadlets for available diff --git a/queue-4.19/alsa-firewire-lib-fix-wrong-assignment-for-out_packet_without_header-tracepoint.patch b/queue-4.19/alsa-firewire-lib-fix-wrong-assignment-for-out_packet_without_header-tracepoint.patch new file mode 100644 index 00000000000..f7c885e03d2 --- /dev/null +++ b/queue-4.19/alsa-firewire-lib-fix-wrong-assignment-for-out_packet_without_header-tracepoint.patch @@ -0,0 +1,36 @@ +From aa9a9e39b4f65733bf19d90cbd026e85a74efb99 Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Sat, 15 Dec 2018 19:03:20 +0900 +Subject: ALSA: firewire-lib: fix wrong assignment for 'out_packet_without_header' tracepoint + +From: Takashi Sakamoto + +commit aa9a9e39b4f65733bf19d90cbd026e85a74efb99 upstream. + +An initial commit to add tracepoints for packets without CIP headers +introduces a wrong assignment to 'data_blocks' value of +'out_packet_without_header' tracepoint. + +This commit fixes the bug. + +Cc: # v4.12+ +Fixes: b164d2fd6e49 ('ALSA: firewire_lib: add tracepoints for packets without CIP headers') +Signed-off-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/firewire/amdtp-stream-trace.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/firewire/amdtp-stream-trace.h ++++ b/sound/firewire/amdtp-stream-trace.h +@@ -169,7 +169,7 @@ TRACE_EVENT(out_packet_without_header, + __entry->dest = fw_parent_device(s->unit)->node_id; + __entry->payload_quadlets = payload_length / 4; + __entry->data_blocks = data_blocks, +- __entry->data_blocks = s->data_block_counter, ++ __entry->data_block_counter = s->data_block_counter, + __entry->packet_index = s->packet_index; + __entry->irq = !!in_interrupt(); + __entry->index = index; diff --git a/queue-4.19/alsa-firewire-lib-fix-wrong-handling-payload_length-as-payload_quadlet.patch b/queue-4.19/alsa-firewire-lib-fix-wrong-handling-payload_length-as-payload_quadlet.patch new file mode 100644 index 00000000000..a477aa9fa3e --- /dev/null +++ b/queue-4.19/alsa-firewire-lib-fix-wrong-handling-payload_length-as-payload_quadlet.patch @@ -0,0 +1,49 @@ +From ada79fa5a0b374dd2c2262137c734da7524a8263 Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Sat, 15 Dec 2018 19:03:19 +0900 +Subject: ALSA: firewire-lib: fix wrong handling payload_length as payload_quadlet + +From: Takashi Sakamoto + +commit ada79fa5a0b374dd2c2262137c734da7524a8263 upstream. + +In IEC 61883-1/6 engine of ALSA firewire stack, a packet handler has a +second argument for 'the number of bytes in payload of isochronous +packet'. However, an incoming packet handler without CIP header uses the +value as 'the number of quadlets in the payload'. This brings userspace +applications to receive the number of PCM frames as four times against +real time. + +This commit fixes the bug. + +Cc: # v4.12+ +Fixes: 3b196c394dd ('ALSA: firewire-lib: add no-header packet processing') +Signed-off-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/firewire/amdtp-stream.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/firewire/amdtp-stream.c ++++ b/sound/firewire/amdtp-stream.c +@@ -629,15 +629,17 @@ end: + } + + static int handle_in_packet_without_header(struct amdtp_stream *s, +- unsigned int payload_quadlets, unsigned int cycle, ++ unsigned int payload_length, unsigned int cycle, + unsigned int index) + { + __be32 *buffer; ++ unsigned int payload_quadlets; + unsigned int data_blocks; + struct snd_pcm_substream *pcm; + unsigned int pcm_frames; + + buffer = s->buffer.packets[s->packet_index].buffer; ++ payload_quadlets = payload_length / 4; + data_blocks = payload_quadlets / s->data_block_quadlets; + + trace_in_packet_without_header(s, cycle, payload_quadlets, data_blocks, diff --git a/queue-4.19/alsa-firewire-lib-use-the-same-print-format-for-without_header-tracepoints.patch b/queue-4.19/alsa-firewire-lib-use-the-same-print-format-for-without_header-tracepoints.patch new file mode 100644 index 00000000000..e815fdf911d --- /dev/null +++ b/queue-4.19/alsa-firewire-lib-use-the-same-print-format-for-without_header-tracepoints.patch @@ -0,0 +1,36 @@ +From 5ef108c53e6efd695e32aad969638ccbc35b4be9 Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Sat, 15 Dec 2018 19:03:21 +0900 +Subject: ALSA: firewire-lib: use the same print format for 'without_header' tracepoints + +From: Takashi Sakamoto + +commit 5ef108c53e6efd695e32aad969638ccbc35b4be9 upstream. + +An initial commit to add tracepoints for packets without CIP headers +uses different print formats for added tracepoints. However this is not +convenient for users/developers to prepare debug tools. + +This commit uses the same format for the two tracepoints. + +Cc: # v4.12+ +Fixes: b164d2fd6e49 ('ALSA: firewire_lib: add tracepoints for packets without CIP headers') +Signed-off-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/firewire/amdtp-stream-trace.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/firewire/amdtp-stream-trace.h ++++ b/sound/firewire/amdtp-stream-trace.h +@@ -131,7 +131,7 @@ TRACE_EVENT(in_packet_without_header, + __entry->index = index; + ), + TP_printk( +- "%02u %04u %04x %04x %02d %03u %3u %3u %02u %01u %02u", ++ "%02u %04u %04x %04x %02d %03u %02u %03u %02u %01u %02u", + __entry->second, + __entry->cycle, + __entry->src, diff --git a/queue-4.19/alsa-hda-add-mute-led-support-for-hp-elitebook-840-g4.patch b/queue-4.19/alsa-hda-add-mute-led-support-for-hp-elitebook-840-g4.patch new file mode 100644 index 00000000000..f9c43084af2 --- /dev/null +++ b/queue-4.19/alsa-hda-add-mute-led-support-for-hp-elitebook-840-g4.patch @@ -0,0 +1,36 @@ +From 40906ebe3af6a48457151b3c6726b480f6a6cb13 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Mantas=20Mikul=C4=97nas?= +Date: Sun, 16 Dec 2018 15:44:47 +0200 +Subject: ALSA: hda: add mute LED support for HP EliteBook 840 G4 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mantas Mikulėnas + +commit 40906ebe3af6a48457151b3c6726b480f6a6cb13 upstream. + +Tested with 4.19.9. + +v2: Changed from CXT_FIXUP_MUTE_LED_GPIO to CXT_FIXUP_HP_DOCK because + that's what the existing fixups for EliteBooks use. + +Signed-off-by: Mantas Mikulėnas +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_conexant.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -923,6 +923,7 @@ static const struct snd_pci_quirk cxt506 + SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK), ++ SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE), diff --git a/queue-4.19/alsa-hda-realtek-enable-audio-jacks-of-asus-ux391ua-with-alc294.patch b/queue-4.19/alsa-hda-realtek-enable-audio-jacks-of-asus-ux391ua-with-alc294.patch new file mode 100644 index 00000000000..29bc062fc33 --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-enable-audio-jacks-of-asus-ux391ua-with-alc294.patch @@ -0,0 +1,36 @@ +From 9cf6533e8060d3896b88ea14b27f620e6504b84b Mon Sep 17 00:00:00 2001 +From: Wandrille RONCE +Date: Wed, 19 Dec 2018 14:52:44 +0100 +Subject: ALSA: hda/realtek: Enable audio jacks of ASUS UX391UA with ALC294 + +From: Wandrille RONCE + +commit 9cf6533e8060d3896b88ea14b27f620e6504b84b upstream. + +By default, there is no sound on Asus UX391UA on Linux. + +This patch adds sound support on Asus UX391UA. Tested working by three +different users. + +The problem has also been described at +https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/1784485 + +Signed-off-by: Wandrille RONCE +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6573,6 +6573,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), + SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), ++ SND_PCI_QUIRK(0x1043, 0x10a1, "ASUS UX391UA", ALC294_FIXUP_ASUS_SPK), + SND_PCI_QUIRK(0x1043, 0x10c0, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), diff --git a/queue-4.19/alsa-hda-realtek-enable-the-headset-mic-auto-detection-for-asus-laptops.patch b/queue-4.19/alsa-hda-realtek-enable-the-headset-mic-auto-detection-for-asus-laptops.patch new file mode 100644 index 00000000000..3219f7bbad5 --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-enable-the-headset-mic-auto-detection-for-asus-laptops.patch @@ -0,0 +1,35 @@ +From 82b01149ec94d746867d7f9156c44d775d4d2d67 Mon Sep 17 00:00:00 2001 +From: Jian-Hong Pan +Date: Thu, 27 Dec 2018 16:46:31 +0800 +Subject: ALSA: hda/realtek: Enable the headset mic auto detection for ASUS laptops + +From: Jian-Hong Pan + +commit 82b01149ec94d746867d7f9156c44d775d4d2d67 upstream. + +The headset mic of ASUS laptops like UX533FD, UX433FN and UX333FA, whose +CODEC is Realtek ALC294 has jack auto detection feature. This patch +enables the feature. + +Fixes: 4e051106730d ("ALSA: hda/realtek: Enable audio jacks of ASUS UX533FD with ALC294") +Signed-off-by: Daniel Drake +Signed-off-by: Jian-Hong Pan +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6424,7 +6424,7 @@ static const struct hda_fixup alc269_fix + [ALC294_FIXUP_ASUS_HEADSET_MIC] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +- { 0x19, 0x01a1113c }, /* use as headset mic, without its own jack detect */ ++ { 0x19, 0x01a1103c }, /* use as headset mic */ + { } + }, + .chained = true, diff --git a/queue-4.19/alsa-hda-tegra-clear-pending-irq-handlers.patch b/queue-4.19/alsa-hda-tegra-clear-pending-irq-handlers.patch new file mode 100644 index 00000000000..de68b5b334b --- /dev/null +++ b/queue-4.19/alsa-hda-tegra-clear-pending-irq-handlers.patch @@ -0,0 +1,43 @@ +From 63d2a9ec310d8bcc955574220d4631aa55c1a80c Mon Sep 17 00:00:00 2001 +From: Sameer Pujar +Date: Wed, 26 Dec 2018 16:04:49 +0530 +Subject: ALSA: hda/tegra: clear pending irq handlers + +From: Sameer Pujar + +commit 63d2a9ec310d8bcc955574220d4631aa55c1a80c upstream. + +Even after disabling interrupts on the module, it could be possible +that irq handlers are still running. System hang is seen during +suspend path. It was found that, there were pending writes on the +HDA bus and clock was disabled by that time. + +Above mentioned issue is fixed by clearing any pending irq handlers +before disabling clocks and returning from hda suspend. + +Suggested-by: Mohan Kumar +Suggested-by: Dara Ramesh +Signed-off-by: Sameer Pujar +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_tegra.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/hda_tegra.c ++++ b/sound/pci/hda/hda_tegra.c +@@ -249,10 +249,12 @@ static int hda_tegra_suspend(struct devi + struct snd_card *card = dev_get_drvdata(dev); + struct azx *chip = card->private_data; + struct hda_tegra *hda = container_of(chip, struct hda_tegra, chip); ++ struct hdac_bus *bus = azx_bus(chip); + + snd_power_change_state(card, SNDRV_CTL_POWER_D3hot); + + azx_stop_chip(chip); ++ synchronize_irq(bus->irq); + azx_enter_link_reset(chip); + hda_tegra_disable_clocks(hda); + diff --git a/queue-4.19/alsa-pcm-fix-potential-spectre-v1-vulnerability.patch b/queue-4.19/alsa-pcm-fix-potential-spectre-v1-vulnerability.patch new file mode 100644 index 00000000000..c8332b07cdd --- /dev/null +++ b/queue-4.19/alsa-pcm-fix-potential-spectre-v1-vulnerability.patch @@ -0,0 +1,51 @@ +From 94ffb030b6d31ec840bb811be455dd2e26a4f43e Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Wed, 12 Dec 2018 15:36:28 -0600 +Subject: ALSA: pcm: Fix potential Spectre v1 vulnerability + +From: Gustavo A. R. Silva + +commit 94ffb030b6d31ec840bb811be455dd2e26a4f43e upstream. + +stream is indirectly controlled by user-space, hence leading to +a potential exploitation of the Spectre variant 1 vulnerability. + +This issue was detected with the help of Smatch: + +sound/core/pcm.c:140 snd_pcm_control_ioctl() warn: potential spectre issue 'pcm->streams' [r] (local cap) + +Fix this by sanitizing stream before using it to index pcm->streams + +Notice that given that speculation windows are large, the policy is +to kill the speculation on the first load and not worry if it can be +completed with a dependent load/store [1]. + +[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 + +Signed-off-by: Gustavo A. R. Silva +Cc: stable@vger.kernel.org +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/pcm.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/core/pcm.c ++++ b/sound/core/pcm.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -129,6 +130,7 @@ static int snd_pcm_control_ioctl(struct + return -EFAULT; + if (stream < 0 || stream > 1) + return -EINVAL; ++ stream = array_index_nospec(stream, 2); + if (get_user(subdevice, &info->subdevice)) + return -EFAULT; + mutex_lock(®ister_mutex); diff --git a/queue-4.19/alsa-rme9652-fix-potential-spectre-v1-vulnerability.patch b/queue-4.19/alsa-rme9652-fix-potential-spectre-v1-vulnerability.patch new file mode 100644 index 00000000000..12be992eb11 --- /dev/null +++ b/queue-4.19/alsa-rme9652-fix-potential-spectre-v1-vulnerability.patch @@ -0,0 +1,71 @@ +From 0b84304ef5da92add8dc75a1b07879c5374cdb05 Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Tue, 18 Dec 2018 11:18:34 -0600 +Subject: ALSA: rme9652: Fix potential Spectre v1 vulnerability + +From: Gustavo A. R. Silva + +commit 0b84304ef5da92add8dc75a1b07879c5374cdb05 upstream. + +info->channel is indirectly controlled by user-space, hence leading to +a potential exploitation of the Spectre variant 1 vulnerability. + +This issue was detected with the help of Smatch: + +sound/pci/rme9652/hdsp.c:4100 snd_hdsp_channel_info() warn: potential spectre issue 'hdsp->channel_map' [r] (local cap) + +Fix this by sanitizing info->channel before using it to index hdsp->channel_map + +Notice that given that speculation windows are large, the policy is +to kill the speculation on the first load and not worry if it can be +completed with a dependent load/store [1]. + +Also, notice that I refactored the code a bit in order to get rid of the +following checkpatch warning: + +ERROR: do not use assignment in if condition +FILE: sound/pci/rme9652/hdsp.c:4103: + if ((mapped_channel = hdsp->channel_map[info->channel]) < 0) + +[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 + +Cc: stable@vger.kernel.org +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/rme9652/hdsp.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/sound/pci/rme9652/hdsp.c ++++ b/sound/pci/rme9652/hdsp.c +@@ -30,6 +30,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -4092,15 +4093,16 @@ static int snd_hdsp_channel_info(struct + struct snd_pcm_channel_info *info) + { + struct hdsp *hdsp = snd_pcm_substream_chip(substream); +- int mapped_channel; ++ unsigned int channel = info->channel; + +- if (snd_BUG_ON(info->channel >= hdsp->max_channels)) ++ if (snd_BUG_ON(channel >= hdsp->max_channels)) + return -EINVAL; ++ channel = array_index_nospec(channel, hdsp->max_channels); + +- if ((mapped_channel = hdsp->channel_map[info->channel]) < 0) ++ if (hdsp->channel_map[channel] < 0) + return -EINVAL; + +- info->offset = mapped_channel * HDSP_CHANNEL_BUFFER_BYTES; ++ info->offset = hdsp->channel_map[channel] * HDSP_CHANNEL_BUFFER_BYTES; + info->first = 0; + info->step = 32; + return 0; diff --git a/queue-4.19/ib-hfi1-incorrect-sizing-of-sge-for-pio-will-oops.patch b/queue-4.19/ib-hfi1-incorrect-sizing-of-sge-for-pio-will-oops.patch new file mode 100644 index 00000000000..e0c1bd2996a --- /dev/null +++ b/queue-4.19/ib-hfi1-incorrect-sizing-of-sge-for-pio-will-oops.patch @@ -0,0 +1,56 @@ +From dbc2970caef74e8ff41923d302aa6fb5a4812d0e Mon Sep 17 00:00:00 2001 +From: "Michael J. Ruhl" +Date: Wed, 28 Nov 2018 10:19:36 -0800 +Subject: IB/hfi1: Incorrect sizing of sge for PIO will OOPs + +From: Michael J. Ruhl + +commit dbc2970caef74e8ff41923d302aa6fb5a4812d0e upstream. + +An incorrect sge sizing in the HFI PIO path will cause an OOPs similar to +this: + +BUG: unable to handle kernel NULL pointer dereference at (null) +IP: [] hfi1_verbs_send_pio+0x3d8/0x530 [hfi1] +PGD 0 +Oops: 0000 1 SMP + Call Trace: + ? hfi1_verbs_send_dma+0xad0/0xad0 [hfi1] + hfi1_verbs_send+0xdf/0x250 [hfi1] + ? make_rc_ack+0xa80/0xa80 [hfi1] + hfi1_do_send+0x192/0x430 [hfi1] + hfi1_do_send_from_rvt+0x10/0x20 [hfi1] + rvt_post_send+0x369/0x820 [rdmavt] + ib_uverbs_post_send+0x317/0x570 [ib_uverbs] + ib_uverbs_write+0x26f/0x420 [ib_uverbs] + ? security_file_permission+0x21/0xa0 + vfs_write+0xbd/0x1e0 + ? mntput+0x24/0x40 + SyS_write+0x7f/0xe0 + system_call_fastpath+0x16/0x1b + +Fix by adding the missing sizing check to correctly determine the sge +length. + +Fixes: 7724105686e7 ("IB/hfi1: add driver files") +Reviewed-by: Mike Marciniszyn +Signed-off-by: Michael J. Ruhl +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/hfi1/verbs.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/infiniband/hw/hfi1/verbs.c ++++ b/drivers/infiniband/hw/hfi1/verbs.c +@@ -1141,6 +1141,8 @@ int hfi1_verbs_send_pio(struct rvt_qp *q + + if (slen > len) + slen = len; ++ if (slen > ss->sge.sge_length) ++ slen = ss->sge.sge_length; + rvt_update_sge(ss, slen, false); + seg_pio_copy_mid(pbuf, addr, slen); + len -= slen; diff --git a/queue-4.19/media-dvb-usb-v2-fix-incorrect-use-of-transfer_flags-urb_free_buffer.patch b/queue-4.19/media-dvb-usb-v2-fix-incorrect-use-of-transfer_flags-urb_free_buffer.patch new file mode 100644 index 00000000000..688f50a8b4b --- /dev/null +++ b/queue-4.19/media-dvb-usb-v2-fix-incorrect-use-of-transfer_flags-urb_free_buffer.patch @@ -0,0 +1,56 @@ +From 255095fa7f62ff09b6f61393414535c59c6b4cb0 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Mon, 26 Nov 2018 15:18:25 -0500 +Subject: media: dvb-usb-v2: Fix incorrect use of transfer_flags URB_FREE_BUFFER + +From: Malcolm Priestley + +commit 255095fa7f62ff09b6f61393414535c59c6b4cb0 upstream. + +commit 1a0c10ed7bb1 ("media: dvb-usb-v2: stop using coherent memory for +URBs") incorrectly adds URB_FREE_BUFFER after every urb transfer. + +It cannot use this flag because it reconfigures the URBs accordingly +to suit connected devices. In doing a call to usb_free_urb is made and +invertedly frees the buffers. + +The stream buffer should remain constant while driver is up. + +Signed-off-by: Malcolm Priestley +CC: stable@vger.kernel.org # v4.18+ +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/dvb-usb-v2/usb_urb.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/media/usb/dvb-usb-v2/usb_urb.c ++++ b/drivers/media/usb/dvb-usb-v2/usb_urb.c +@@ -155,7 +155,6 @@ static int usb_urb_alloc_bulk_urbs(struc + stream->props.u.bulk.buffersize, + usb_urb_complete, stream); + +- stream->urb_list[i]->transfer_flags = URB_FREE_BUFFER; + stream->urbs_initialized++; + } + return 0; +@@ -186,7 +185,7 @@ static int usb_urb_alloc_isoc_urbs(struc + urb->complete = usb_urb_complete; + urb->pipe = usb_rcvisocpipe(stream->udev, + stream->props.endpoint); +- urb->transfer_flags = URB_ISO_ASAP | URB_FREE_BUFFER; ++ urb->transfer_flags = URB_ISO_ASAP; + urb->interval = stream->props.u.isoc.interval; + urb->number_of_packets = stream->props.u.isoc.framesperurb; + urb->transfer_buffer_length = stream->props.u.isoc.framesize * +@@ -210,7 +209,7 @@ static int usb_free_stream_buffers(struc + if (stream->state & USB_STATE_URB_BUF) { + while (stream->buf_num) { + stream->buf_num--; +- stream->buf_list[stream->buf_num] = NULL; ++ kfree(stream->buf_list[stream->buf_num]); + } + } + diff --git a/queue-4.19/mtd-atmel-quadspi-disallow-building-on-ebsa110.patch b/queue-4.19/mtd-atmel-quadspi-disallow-building-on-ebsa110.patch new file mode 100644 index 00000000000..86b7da91e3d --- /dev/null +++ b/queue-4.19/mtd-atmel-quadspi-disallow-building-on-ebsa110.patch @@ -0,0 +1,46 @@ +From 2a9d92fb3a1282a4659f1bb6d5684018846537b7 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 10 Dec 2018 21:38:16 +0100 +Subject: mtd: atmel-quadspi: disallow building on ebsa110 + +From: Arnd Bergmann + +commit 2a9d92fb3a1282a4659f1bb6d5684018846537b7 upstream. + +I ran into a link-time error with the atmel-quadspi driver on the +EBSA110 platform: + +drivers/mtd/built-in.o: In function `atmel_qspi_run_command': +:(.text+0x1ee3c): undefined reference to `_memcpy_toio' +:(.text+0x1ee48): undefined reference to `_memcpy_fromio' + +The problem is that _memcpy_toio/_memcpy_fromio are not available on +that platform, and we have to prevent building the driver there. + +In case we want to backport this to older kernels: between linux-4.8 +and linux-4.20, the Kconfig entry was in drivers/mtd/spi-nor/Kconfig +but had the same problem. + +Link: https://lore.kernel.org/patchwork/patch/812860/ +Fixes: 161aaab8a067 ("mtd: atmel-quadspi: add driver for Atmel QSPI controller") +Signed-off-by: Arnd Bergmann +Reviewed-by: Boris Brezillon +Signed-off-by: Mark Brown +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/spi-nor/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/spi-nor/Kconfig ++++ b/drivers/mtd/spi-nor/Kconfig +@@ -41,7 +41,7 @@ config SPI_ASPEED_SMC + + config SPI_ATMEL_QUADSPI + tristate "Atmel Quad SPI Controller" +- depends on ARCH_AT91 || (ARM && COMPILE_TEST) ++ depends on ARCH_AT91 || (ARM && COMPILE_TEST && !ARCH_EBSA110) + depends on OF && HAS_IOMEM + help + This enables support for the Quad SPI controller in master mode. diff --git a/queue-4.19/mtd-rawnand-marvell-prevent-timeouts-on-a-loaded-machine.patch b/queue-4.19/mtd-rawnand-marvell-prevent-timeouts-on-a-loaded-machine.patch new file mode 100644 index 00000000000..04721efa9d0 --- /dev/null +++ b/queue-4.19/mtd-rawnand-marvell-prevent-timeouts-on-a-loaded-machine.patch @@ -0,0 +1,82 @@ +From cafb56dd741e61c99709bcd2b193a9a1d36def3b Mon Sep 17 00:00:00 2001 +From: Miquel Raynal +Date: Tue, 11 Dec 2018 18:38:28 +0100 +Subject: mtd: rawnand: marvell: prevent timeouts on a loaded machine + +From: Miquel Raynal + +commit cafb56dd741e61c99709bcd2b193a9a1d36def3b upstream. + +marvell_nfc_wait_op() waits for completion during 'timeout_ms' +milliseconds before throwing an error. While the logic is fine, the +value of 'timeout_ms' is given by the core and actually correspond to +the maximum time the NAND chip will take to complete the +operation. Assuming there is no overhead in the propagation of the +interrupt signal to the the NAND controller (through the Ready/Busy +line), this delay does not take into account the latency of the +operating system. For instance, for a page write, the delay given by +the core is rounded up to 1ms. Hence, when the machine is over loaded, +there is chances that this timeout will be reached. + +There are two ways to solve this issue that are not incompatible: +1/ Enlarge the timeout value (if so, how much?). +2/ Check after the waiting method if we did not miss any interrupt +because of the OS latency (an interrupt is still pending). In this +case, we assume the operation exited successfully. + +We choose the second approach that is a must in all cases, with the +possibility to also modify the timeout value to be, e.g. at least 1 +second in all cases. + +Fixes: 02f26ecf8c77 ("mtd: nand: add reworked Marvell NAND controller driver") +Cc: stable@vger.kernel.org +Signed-off-by: Miquel Raynal +Reviewed-by: Boris Brezillon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/nand/raw/marvell_nand.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +--- a/drivers/mtd/nand/raw/marvell_nand.c ++++ b/drivers/mtd/nand/raw/marvell_nand.c +@@ -444,9 +444,14 @@ static void marvell_nfc_enable_int(struc + writel_relaxed(reg & ~int_mask, nfc->regs + NDCR); + } + +-static void marvell_nfc_clear_int(struct marvell_nfc *nfc, u32 int_mask) ++static u32 marvell_nfc_clear_int(struct marvell_nfc *nfc, u32 int_mask) + { ++ u32 reg; ++ ++ reg = readl_relaxed(nfc->regs + NDSR); + writel_relaxed(int_mask, nfc->regs + NDSR); ++ ++ return reg & int_mask; + } + + static void marvell_nfc_force_byte_access(struct nand_chip *chip, +@@ -613,6 +618,7 @@ static int marvell_nfc_wait_cmdd(struct + static int marvell_nfc_wait_op(struct nand_chip *chip, unsigned int timeout_ms) + { + struct marvell_nfc *nfc = to_marvell_nfc(chip->controller); ++ u32 pending; + int ret; + + /* Timeout is expressed in ms */ +@@ -625,8 +631,13 @@ static int marvell_nfc_wait_op(struct na + ret = wait_for_completion_timeout(&nfc->complete, + msecs_to_jiffies(timeout_ms)); + marvell_nfc_disable_int(nfc, NDCR_RDYM); +- marvell_nfc_clear_int(nfc, NDSR_RDY(0) | NDSR_RDY(1)); +- if (!ret) { ++ pending = marvell_nfc_clear_int(nfc, NDSR_RDY(0) | NDSR_RDY(1)); ++ ++ /* ++ * In case the interrupt was not served in the required time frame, ++ * check if the ISR was not served or if something went actually wrong. ++ */ ++ if (ret && !pending) { + dev_err(nfc->dev, "Timeout waiting for RB signal\n"); + return -ETIMEDOUT; + } diff --git a/queue-4.19/mtd-rawnand-omap2-pass-the-parent-of-pdev-to-dma_request_chan.patch b/queue-4.19/mtd-rawnand-omap2-pass-the-parent-of-pdev-to-dma_request_chan.patch new file mode 100644 index 00000000000..3861ecacd85 --- /dev/null +++ b/queue-4.19/mtd-rawnand-omap2-pass-the-parent-of-pdev-to-dma_request_chan.patch @@ -0,0 +1,37 @@ +From 9b432630e0150b777c423fdef6a7b8d17dfa70b6 Mon Sep 17 00:00:00 2001 +From: Boris Brezillon +Date: Thu, 13 Dec 2018 20:22:27 +0100 +Subject: mtd: rawnand: omap2: Pass the parent of pdev to dma_request_chan() + +From: Boris Brezillon + +commit 9b432630e0150b777c423fdef6a7b8d17dfa70b6 upstream. + +Commit e1e6255c311b ("mtd: rawnand: omap2: convert driver to +nand_scan()") moved part of the init code in the ->attach_chip hook +and at the same time changed the struct device object passed to +dma_request_chan() (&pdev->dev instead of pdev->dev.parent). + +Fixes: e1e6255c311b ("mtd: rawnand: omap2: convert driver to nand_scan()") +Reported-by: Alexander Sverdlin +Cc: +Signed-off-by: Boris Brezillon +Tested-by: Alexander Sverdlin +Signed-off-by: Miquel Raynal +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/nand/raw/omap2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/nand/raw/omap2.c ++++ b/drivers/mtd/nand/raw/omap2.c +@@ -1938,7 +1938,7 @@ static int omap_nand_attach_chip(struct + case NAND_OMAP_PREFETCH_DMA: + dma_cap_zero(mask); + dma_cap_set(DMA_SLAVE, mask); +- info->dma = dma_request_chan(dev, "rxtx"); ++ info->dma = dma_request_chan(dev->parent, "rxtx"); + + if (IS_ERR(info->dma)) { + dev_err(dev, "DMA engine request failed\n"); diff --git a/queue-4.19/powerpc-fsl-fix-spectre_v2-mitigations-reporting.patch b/queue-4.19/powerpc-fsl-fix-spectre_v2-mitigations-reporting.patch new file mode 100644 index 00000000000..bda99dd972e --- /dev/null +++ b/queue-4.19/powerpc-fsl-fix-spectre_v2-mitigations-reporting.patch @@ -0,0 +1,37 @@ +From 7d8bad99ba5a22892f0cad6881289fdc3875a930 Mon Sep 17 00:00:00 2001 +From: Diana Craciun +Date: Wed, 12 Dec 2018 16:03:02 +0200 +Subject: powerpc/fsl: Fix spectre_v2 mitigations reporting + +From: Diana Craciun + +commit 7d8bad99ba5a22892f0cad6881289fdc3875a930 upstream. + +Currently for CONFIG_PPC_FSL_BOOK3E the spectre_v2 file is incorrect: + + $ cat /sys/devices/system/cpu/vulnerabilities/spectre_v2 + "Mitigation: Software count cache flush" + +Which is wrong. Fix it to report vulnerable for now. + +Fixes: ee13cb249fab ("powerpc/64s: Add support for software count cache flush") +Cc: stable@vger.kernel.org # v4.19+ +Signed-off-by: Diana Craciun +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/security.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/kernel/security.c ++++ b/arch/powerpc/kernel/security.c +@@ -22,7 +22,7 @@ enum count_cache_flush_type { + COUNT_CACHE_FLUSH_SW = 0x2, + COUNT_CACHE_FLUSH_HW = 0x4, + }; +-static enum count_cache_flush_type count_cache_flush_type; ++static enum count_cache_flush_type count_cache_flush_type = COUNT_CACHE_FLUSH_NONE; + + bool barrier_nospec_enabled; + static bool no_nospec; diff --git a/queue-4.19/revert-usb-dwc3-pci-use-devm-functions-to-get-the-phy-gpios.patch b/queue-4.19/revert-usb-dwc3-pci-use-devm-functions-to-get-the-phy-gpios.patch new file mode 100644 index 00000000000..b49375d3ff4 --- /dev/null +++ b/queue-4.19/revert-usb-dwc3-pci-use-devm-functions-to-get-the-phy-gpios.patch @@ -0,0 +1,62 @@ +From 3004cfd6204927c1294060b849029cf0c2651074 Mon Sep 17 00:00:00 2001 +From: Stephan Gerhold +Date: Thu, 6 Dec 2018 19:42:28 +0100 +Subject: Revert "usb: dwc3: pci: Use devm functions to get the phy GPIOs" + +From: Stephan Gerhold + +commit 3004cfd6204927c1294060b849029cf0c2651074 upstream. + +Commit 211f658b7b40 ("usb: dwc3: pci: Use devm functions to get +the phy GPIOs") changed the code to claim the PHY GPIOs permanently +for Intel Baytrail devices. + +This causes issues when the actual PHY driver attempts to claim the +same GPIO descriptors. For example, tusb1210 now fails to probe with: + + tusb1210: probe of dwc3.0.auto.ulpi failed with error -16 (EBUSY) + +dwc3-pci needs to turn on the PHY once before dwc3 is loaded, but +usually the PHY driver will then hold the GPIOs to turn off the +PHY when requested (e.g. during suspend). + +To fix the problem, this reverts the commit to restore the old +behavior to put the GPIOs immediately after usage. + +Link: https://www.spinics.net/lists/linux-usb/msg174681.html +Cc: stable@vger.kernel.org +Signed-off-by: Stephan Gerhold +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/dwc3-pci.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -170,20 +170,20 @@ static int dwc3_pci_quirks(struct dwc3_p + * put the gpio descriptors again here because the phy driver + * might want to grab them, too. + */ +- gpio = devm_gpiod_get_optional(&pdev->dev, "cs", +- GPIOD_OUT_LOW); ++ gpio = gpiod_get_optional(&pdev->dev, "cs", GPIOD_OUT_LOW); + if (IS_ERR(gpio)) + return PTR_ERR(gpio); + + gpiod_set_value_cansleep(gpio, 1); ++ gpiod_put(gpio); + +- gpio = devm_gpiod_get_optional(&pdev->dev, "reset", +- GPIOD_OUT_LOW); ++ gpio = gpiod_get_optional(&pdev->dev, "reset", GPIOD_OUT_LOW); + if (IS_ERR(gpio)) + return PTR_ERR(gpio); + + if (gpio) { + gpiod_set_value_cansleep(gpio, 1); ++ gpiod_put(gpio); + usleep_range(10000, 11000); + } + } diff --git a/queue-4.19/series b/queue-4.19/series index e69873154a6..6a47c499b30 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -56,3 +56,28 @@ net-mlx5e-rx-fix-wrong-early-return-in-receive-queue-poll.patch net-mvneta-fix-operation-for-64k-page_size.patch net-use-__kernel_clockid_t-in-uapi-net_stamp.h.patch r8169-fix-wol-device-wakeup-enable.patch +ib-hfi1-incorrect-sizing-of-sge-for-pio-will-oops.patch +alsa-rme9652-fix-potential-spectre-v1-vulnerability.patch +alsa-emu10k1-fix-potential-spectre-v1-vulnerabilities.patch +alsa-pcm-fix-potential-spectre-v1-vulnerability.patch +alsa-emux-fix-potential-spectre-v1-vulnerabilities.patch +powerpc-fsl-fix-spectre_v2-mitigations-reporting.patch +mtd-atmel-quadspi-disallow-building-on-ebsa110.patch +mtd-rawnand-marvell-prevent-timeouts-on-a-loaded-machine.patch +mtd-rawnand-omap2-pass-the-parent-of-pdev-to-dma_request_chan.patch +alsa-hda-add-mute-led-support-for-hp-elitebook-840-g4.patch +alsa-hda-realtek-enable-audio-jacks-of-asus-ux391ua-with-alc294.patch +alsa-fireface-fix-for-state-to-fetch-pcm-frames.patch +alsa-firewire-lib-fix-wrong-handling-payload_length-as-payload_quadlet.patch +alsa-firewire-lib-fix-wrong-assignment-for-out_packet_without_header-tracepoint.patch +alsa-firewire-lib-use-the-same-print-format-for-without_header-tracepoints.patch +alsa-hda-realtek-enable-the-headset-mic-auto-detection-for-asus-laptops.patch +alsa-hda-tegra-clear-pending-irq-handlers.patch +usb-dwc2-host-use-hrtimer-for-nak-retries.patch +usb-serial-pl2303-add-ids-for-hewlett-packard-hp-pos-pole-displays.patch +usb-serial-option-add-fibocom-nl678-series.patch +usb-r8a66597-fix-a-possible-concurrency-use-after-free-bug-in-r8a66597_endpoint_disable.patch +usb-dwc2-disable-power_down-on-amlogic-devices.patch +revert-usb-dwc3-pci-use-devm-functions-to-get-the-phy-gpios.patch +usb-roles-add-a-description-for-the-class-to-kconfig.patch +media-dvb-usb-v2-fix-incorrect-use-of-transfer_flags-urb_free_buffer.patch diff --git a/queue-4.19/usb-dwc2-disable-power_down-on-amlogic-devices.patch b/queue-4.19/usb-dwc2-disable-power_down-on-amlogic-devices.patch new file mode 100644 index 00000000000..fc132596e56 --- /dev/null +++ b/queue-4.19/usb-dwc2-disable-power_down-on-amlogic-devices.patch @@ -0,0 +1,45 @@ +From cc10ce0c51b13d1566d0ec1dcb472fb86330b391 Mon Sep 17 00:00:00 2001 +From: Martin Blumenstingl +Date: Sun, 9 Dec 2018 20:01:29 +0100 +Subject: usb: dwc2: disable power_down on Amlogic devices + +From: Martin Blumenstingl + +commit cc10ce0c51b13d1566d0ec1dcb472fb86330b391 upstream. + +Disable power_down by setting the parameter to +DWC2_POWER_DOWN_PARAM_NONE. This fixes a problem on various Amlogic +Meson SoCs where USB devices are only recognized when plugged in before +booting Linux. A hot-plugged USB device was not detected even though the +device got power (my USB thumb drive for example has an LED which lit +up). + +A similar fix was implemented for Rockchip SoCs in commit c216765d3a1def +("usb: dwc2: disable power_down on rockchip devices"). That commit +suggests that a change in the dwc2 driver is the cause because the +default value for the "hibernate" parameter (which then got renamed to +"power_down" to support other modes) was changed in the v4.17 merge +window with: +commit 6d23ee9caa6790 ("Merge tag 'usb-for-v4.17' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-testing"). + +Cc: # 4.19 +Acked-by: Minas Harutyunyan +Suggested-by: Christian Hewitt +Signed-off-by: Martin Blumenstingl +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc2/params.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/dwc2/params.c ++++ b/drivers/usb/dwc2/params.c +@@ -110,6 +110,7 @@ static void dwc2_set_amlogic_params(stru + p->phy_type = DWC2_PHY_TYPE_PARAM_UTMI; + p->ahbcfg = GAHBCFG_HBSTLEN_INCR8 << + GAHBCFG_HBSTLEN_SHIFT; ++ p->power_down = DWC2_POWER_DOWN_PARAM_NONE; + } + + static void dwc2_set_amcc_params(struct dwc2_hsotg *hsotg) diff --git a/queue-4.19/usb-dwc2-host-use-hrtimer-for-nak-retries.patch b/queue-4.19/usb-dwc2-host-use-hrtimer-for-nak-retries.patch new file mode 100644 index 00000000000..8c77a5fa434 --- /dev/null +++ b/queue-4.19/usb-dwc2-host-use-hrtimer-for-nak-retries.patch @@ -0,0 +1,140 @@ +From 6ed30a7d8ec29d3aba46e47aa8b4a44f077dda4e Mon Sep 17 00:00:00 2001 +From: Terin Stock +Date: Sun, 9 Sep 2018 21:24:31 -0700 +Subject: usb: dwc2: host: use hrtimer for NAK retries + +From: Terin Stock + +commit 6ed30a7d8ec29d3aba46e47aa8b4a44f077dda4e upstream. + +Modify the wait delay utilize the high resolution timer API to allow for +more precisely scheduled callbacks. + +A previous commit added a 1ms retry delay after multiple consecutive +NAKed transactions using jiffies. On systems with a low timer interrupt +frequency, this delay may be significantly longer than specified, +resulting in misbehavior with some USB devices. + +This scenario was reached on a Raspberry Pi 3B with a Macally FDD-USB +floppy drive (identified as 0424:0fdc Standard Microsystems Corp. +Floppy, based on the USB97CFDC USB FDC). With the relay delay, the drive +would be unable to mount a disk, replying with NAKs until the device was +reset. + +Using ktime, the delta between starting the timer (in dwc2_hcd_qh_add) +and the callback function can be determined. With the original delay +implementation, this value was consistently approximately 12ms. (output +in us). + + -0 [000] ..s. 1600.559974: dwc2_wait_timer_fn: wait_timer delta: 11976 + -0 [000] ..s. 1600.571974: dwc2_wait_timer_fn: wait_timer delta: 11977 + -0 [000] ..s. 1600.583974: dwc2_wait_timer_fn: wait_timer delta: 11976 + -0 [000] ..s. 1600.595974: dwc2_wait_timer_fn: wait_timer delta: 11977 + +After converting the relay delay to using a higher resolution timer, the +delay was much closer to 1ms. + + -0 [000] d.h. 1956.553017: dwc2_wait_timer_fn: wait_timer delta: 1002 + -0 [000] d.h. 1956.554114: dwc2_wait_timer_fn: wait_timer delta: 1002 + -0 [000] d.h. 1957.542660: dwc2_wait_timer_fn: wait_timer delta: 1004 + -0 [000] d.h. 1957.543701: dwc2_wait_timer_fn: wait_timer delta: 1002 + +The floppy drive operates properly with delays up to approximately 5ms, +and sends NAKs for any delays that are longer. + +Fixes: 38d2b5fb75c1 ("usb: dwc2: host: Don't retry NAKed transactions right away") +Cc: +Reviewed-by: Douglas Anderson +Acked-by: Minas Harutyunyan +Signed-off-by: Terin Stock +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc2/hcd.h | 2 +- + drivers/usb/dwc2/hcd_queue.c | 19 ++++++++++++------- + 2 files changed, 13 insertions(+), 8 deletions(-) + +--- a/drivers/usb/dwc2/hcd.h ++++ b/drivers/usb/dwc2/hcd.h +@@ -366,7 +366,7 @@ struct dwc2_qh { + u32 desc_list_sz; + u32 *n_bytes; + struct timer_list unreserve_timer; +- struct timer_list wait_timer; ++ struct hrtimer wait_timer; + struct dwc2_tt *dwc_tt; + int ttport; + unsigned tt_buffer_dirty:1; +--- a/drivers/usb/dwc2/hcd_queue.c ++++ b/drivers/usb/dwc2/hcd_queue.c +@@ -59,7 +59,7 @@ + #define DWC2_UNRESERVE_DELAY (msecs_to_jiffies(5)) + + /* If we get a NAK, wait this long before retrying */ +-#define DWC2_RETRY_WAIT_DELAY (msecs_to_jiffies(1)) ++#define DWC2_RETRY_WAIT_DELAY 1*1E6L + + /** + * dwc2_periodic_channel_available() - Checks that a channel is available for a +@@ -1464,10 +1464,12 @@ static void dwc2_deschedule_periodic(str + * qh back to the "inactive" list, then queues transactions. + * + * @t: Pointer to wait_timer in a qh. ++ * ++ * Return: HRTIMER_NORESTART to not automatically restart this timer. + */ +-static void dwc2_wait_timer_fn(struct timer_list *t) ++static enum hrtimer_restart dwc2_wait_timer_fn(struct hrtimer *t) + { +- struct dwc2_qh *qh = from_timer(qh, t, wait_timer); ++ struct dwc2_qh *qh = container_of(t, struct dwc2_qh, wait_timer); + struct dwc2_hsotg *hsotg = qh->hsotg; + unsigned long flags; + +@@ -1491,6 +1493,7 @@ static void dwc2_wait_timer_fn(struct ti + } + + spin_unlock_irqrestore(&hsotg->lock, flags); ++ return HRTIMER_NORESTART; + } + + /** +@@ -1521,7 +1524,8 @@ static void dwc2_qh_init(struct dwc2_hso + /* Initialize QH */ + qh->hsotg = hsotg; + timer_setup(&qh->unreserve_timer, dwc2_unreserve_timer_fn, 0); +- timer_setup(&qh->wait_timer, dwc2_wait_timer_fn, 0); ++ hrtimer_init(&qh->wait_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); ++ qh->wait_timer.function = &dwc2_wait_timer_fn; + qh->ep_type = ep_type; + qh->ep_is_in = ep_is_in; + +@@ -1690,7 +1694,7 @@ void dwc2_hcd_qh_free(struct dwc2_hsotg + * won't do anything anyway, but we want it to finish before we free + * memory. + */ +- del_timer_sync(&qh->wait_timer); ++ hrtimer_cancel(&qh->wait_timer); + + dwc2_host_put_tt_info(hsotg, qh->dwc_tt); + +@@ -1716,6 +1720,7 @@ int dwc2_hcd_qh_add(struct dwc2_hsotg *h + { + int status; + u32 intr_mask; ++ ktime_t delay; + + if (dbg_qh(qh)) + dev_vdbg(hsotg->dev, "%s()\n", __func__); +@@ -1734,8 +1739,8 @@ int dwc2_hcd_qh_add(struct dwc2_hsotg *h + list_add_tail(&qh->qh_list_entry, + &hsotg->non_periodic_sched_waiting); + qh->wait_timer_cancel = false; +- mod_timer(&qh->wait_timer, +- jiffies + DWC2_RETRY_WAIT_DELAY + 1); ++ delay = ktime_set(0, DWC2_RETRY_WAIT_DELAY); ++ hrtimer_start(&qh->wait_timer, delay, HRTIMER_MODE_REL); + } else { + list_add_tail(&qh->qh_list_entry, + &hsotg->non_periodic_sched_inactive); diff --git a/queue-4.19/usb-r8a66597-fix-a-possible-concurrency-use-after-free-bug-in-r8a66597_endpoint_disable.patch b/queue-4.19/usb-r8a66597-fix-a-possible-concurrency-use-after-free-bug-in-r8a66597_endpoint_disable.patch new file mode 100644 index 00000000000..5cbf4d45df4 --- /dev/null +++ b/queue-4.19/usb-r8a66597-fix-a-possible-concurrency-use-after-free-bug-in-r8a66597_endpoint_disable.patch @@ -0,0 +1,67 @@ +From c85400f886e3d41e69966470879f635a2b50084c Mon Sep 17 00:00:00 2001 +From: Jia-Ju Bai +Date: Tue, 18 Dec 2018 20:04:25 +0800 +Subject: usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable() + +From: Jia-Ju Bai + +commit c85400f886e3d41e69966470879f635a2b50084c upstream. + +The function r8a66597_endpoint_disable() and r8a66597_urb_enqueue() may +be concurrently executed. +The two functions both access a possible shared variable "hep->hcpriv". + +This shared variable is freed by r8a66597_endpoint_disable() via the +call path: +r8a66597_endpoint_disable + kfree(hep->hcpriv) (line 1995 in Linux-4.19) + +This variable is read by r8a66597_urb_enqueue() via the call path: +r8a66597_urb_enqueue + spin_lock_irqsave(&r8a66597->lock) + init_pipe_info + enable_r8a66597_pipe + pipe = hep->hcpriv (line 802 in Linux-4.19) + +The read operation is protected by a spinlock, but the free operation +is not protected by this spinlock, thus a concurrency use-after-free bug +may occur. + +To fix this bug, the spin-lock and spin-unlock function calls in +r8a66597_endpoint_disable() are moved to protect the free operation. + +Signed-off-by: Jia-Ju Bai +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/r8a66597-hcd.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/r8a66597-hcd.c ++++ b/drivers/usb/host/r8a66597-hcd.c +@@ -1979,6 +1979,8 @@ static int r8a66597_urb_dequeue(struct u + + static void r8a66597_endpoint_disable(struct usb_hcd *hcd, + struct usb_host_endpoint *hep) ++__acquires(r8a66597->lock) ++__releases(r8a66597->lock) + { + struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd); + struct r8a66597_pipe *pipe = (struct r8a66597_pipe *)hep->hcpriv; +@@ -1991,13 +1993,14 @@ static void r8a66597_endpoint_disable(st + return; + pipenum = pipe->info.pipenum; + ++ spin_lock_irqsave(&r8a66597->lock, flags); + if (pipenum == 0) { + kfree(hep->hcpriv); + hep->hcpriv = NULL; ++ spin_unlock_irqrestore(&r8a66597->lock, flags); + return; + } + +- spin_lock_irqsave(&r8a66597->lock, flags); + pipe_stop(r8a66597, pipe); + pipe_irq_disable(r8a66597, pipenum); + disable_irq_empty(r8a66597, pipenum); diff --git a/queue-4.19/usb-roles-add-a-description-for-the-class-to-kconfig.patch b/queue-4.19/usb-roles-add-a-description-for-the-class-to-kconfig.patch new file mode 100644 index 00000000000..84e0321260e --- /dev/null +++ b/queue-4.19/usb-roles-add-a-description-for-the-class-to-kconfig.patch @@ -0,0 +1,718 @@ +From c3788cd9963eb2e77de3c24142fb7c67b61f1a26 Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Wed, 12 Dec 2018 20:13:55 +0300 +Subject: usb: roles: Add a description for the class to Kconfig + +From: Heikki Krogerus + +commit c3788cd9963eb2e77de3c24142fb7c67b61f1a26 upstream. + +That makes the USB role switch support option visible and +selectable for the user. The class driver is also moved to +drivers/usb/roles/ directory. + +This will fix an issue that we have with the Intel USB role +switch driver on systems that don't have USB Type-C connectors: + +Intel USB role switch driver depends on the USB role switch +class as it should, but since there was no way for the user +to enable the USB role switch class, there was also no way +to select that driver. USB Type-C drivers select the USB +role switch class which makes the Intel USB role switch +driver available and therefore hides the problem. + +So in practice Intel USB role switch driver was depending on +USB Type-C drivers. + +Fixes: f6fb9ec02be1 ("usb: roles: Add Intel xHCI USB role switch driver") +Cc: +Signed-off-by: Heikki Krogerus +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/Kconfig | 4 + drivers/usb/common/Makefile | 1 + drivers/usb/common/roles.c | 314 -------------------------------------------- + drivers/usb/roles/Kconfig | 13 + + drivers/usb/roles/Makefile | 4 + drivers/usb/roles/class.c | 314 ++++++++++++++++++++++++++++++++++++++++++++ + 6 files changed, 330 insertions(+), 320 deletions(-) + +--- a/drivers/usb/Kconfig ++++ b/drivers/usb/Kconfig +@@ -205,8 +205,4 @@ config USB_ULPI_BUS + To compile this driver as a module, choose M here: the module will + be called ulpi. + +-config USB_ROLE_SWITCH +- tristate +- select USB_COMMON +- + endif # USB_SUPPORT +--- a/drivers/usb/common/Makefile ++++ b/drivers/usb/common/Makefile +@@ -9,4 +9,3 @@ usb-common-$(CONFIG_USB_LED_TRIG) += led + + obj-$(CONFIG_USB_OTG_FSM) += usb-otg-fsm.o + obj-$(CONFIG_USB_ULPI_BUS) += ulpi.o +-obj-$(CONFIG_USB_ROLE_SWITCH) += roles.o +--- a/drivers/usb/common/roles.c ++++ /dev/null +@@ -1,314 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0 +-/* +- * USB Role Switch Support +- * +- * Copyright (C) 2018 Intel Corporation +- * Author: Heikki Krogerus +- * Hans de Goede +- */ +- +-#include +-#include +-#include +-#include +-#include +- +-static struct class *role_class; +- +-struct usb_role_switch { +- struct device dev; +- struct mutex lock; /* device lock*/ +- enum usb_role role; +- +- /* From descriptor */ +- struct device *usb2_port; +- struct device *usb3_port; +- struct device *udc; +- usb_role_switch_set_t set; +- usb_role_switch_get_t get; +- bool allow_userspace_control; +-}; +- +-#define to_role_switch(d) container_of(d, struct usb_role_switch, dev) +- +-/** +- * usb_role_switch_set_role - Set USB role for a switch +- * @sw: USB role switch +- * @role: USB role to be switched to +- * +- * Set USB role @role for @sw. +- */ +-int usb_role_switch_set_role(struct usb_role_switch *sw, enum usb_role role) +-{ +- int ret; +- +- if (IS_ERR_OR_NULL(sw)) +- return 0; +- +- mutex_lock(&sw->lock); +- +- ret = sw->set(sw->dev.parent, role); +- if (!ret) +- sw->role = role; +- +- mutex_unlock(&sw->lock); +- +- return ret; +-} +-EXPORT_SYMBOL_GPL(usb_role_switch_set_role); +- +-/** +- * usb_role_switch_get_role - Get the USB role for a switch +- * @sw: USB role switch +- * +- * Depending on the role-switch-driver this function returns either a cached +- * value of the last set role, or reads back the actual value from the hardware. +- */ +-enum usb_role usb_role_switch_get_role(struct usb_role_switch *sw) +-{ +- enum usb_role role; +- +- if (IS_ERR_OR_NULL(sw)) +- return USB_ROLE_NONE; +- +- mutex_lock(&sw->lock); +- +- if (sw->get) +- role = sw->get(sw->dev.parent); +- else +- role = sw->role; +- +- mutex_unlock(&sw->lock); +- +- return role; +-} +-EXPORT_SYMBOL_GPL(usb_role_switch_get_role); +- +-static int __switch_match(struct device *dev, const void *name) +-{ +- return !strcmp((const char *)name, dev_name(dev)); +-} +- +-static void *usb_role_switch_match(struct device_connection *con, int ep, +- void *data) +-{ +- struct device *dev; +- +- dev = class_find_device(role_class, NULL, con->endpoint[ep], +- __switch_match); +- +- return dev ? to_role_switch(dev) : ERR_PTR(-EPROBE_DEFER); +-} +- +-/** +- * usb_role_switch_get - Find USB role switch linked with the caller +- * @dev: The caller device +- * +- * Finds and returns role switch linked with @dev. The reference count for the +- * found switch is incremented. +- */ +-struct usb_role_switch *usb_role_switch_get(struct device *dev) +-{ +- struct usb_role_switch *sw; +- +- sw = device_connection_find_match(dev, "usb-role-switch", NULL, +- usb_role_switch_match); +- +- if (!IS_ERR_OR_NULL(sw)) +- WARN_ON(!try_module_get(sw->dev.parent->driver->owner)); +- +- return sw; +-} +-EXPORT_SYMBOL_GPL(usb_role_switch_get); +- +-/** +- * usb_role_switch_put - Release handle to a switch +- * @sw: USB Role Switch +- * +- * Decrement reference count for @sw. +- */ +-void usb_role_switch_put(struct usb_role_switch *sw) +-{ +- if (!IS_ERR_OR_NULL(sw)) { +- put_device(&sw->dev); +- module_put(sw->dev.parent->driver->owner); +- } +-} +-EXPORT_SYMBOL_GPL(usb_role_switch_put); +- +-static umode_t +-usb_role_switch_is_visible(struct kobject *kobj, struct attribute *attr, int n) +-{ +- struct device *dev = container_of(kobj, typeof(*dev), kobj); +- struct usb_role_switch *sw = to_role_switch(dev); +- +- if (sw->allow_userspace_control) +- return attr->mode; +- +- return 0; +-} +- +-static const char * const usb_roles[] = { +- [USB_ROLE_NONE] = "none", +- [USB_ROLE_HOST] = "host", +- [USB_ROLE_DEVICE] = "device", +-}; +- +-static ssize_t +-role_show(struct device *dev, struct device_attribute *attr, char *buf) +-{ +- struct usb_role_switch *sw = to_role_switch(dev); +- enum usb_role role = usb_role_switch_get_role(sw); +- +- return sprintf(buf, "%s\n", usb_roles[role]); +-} +- +-static ssize_t role_store(struct device *dev, struct device_attribute *attr, +- const char *buf, size_t size) +-{ +- struct usb_role_switch *sw = to_role_switch(dev); +- int ret; +- +- ret = sysfs_match_string(usb_roles, buf); +- if (ret < 0) { +- bool res; +- +- /* Extra check if the user wants to disable the switch */ +- ret = kstrtobool(buf, &res); +- if (ret || res) +- return -EINVAL; +- } +- +- ret = usb_role_switch_set_role(sw, ret); +- if (ret) +- return ret; +- +- return size; +-} +-static DEVICE_ATTR_RW(role); +- +-static struct attribute *usb_role_switch_attrs[] = { +- &dev_attr_role.attr, +- NULL, +-}; +- +-static const struct attribute_group usb_role_switch_group = { +- .is_visible = usb_role_switch_is_visible, +- .attrs = usb_role_switch_attrs, +-}; +- +-static const struct attribute_group *usb_role_switch_groups[] = { +- &usb_role_switch_group, +- NULL, +-}; +- +-static int +-usb_role_switch_uevent(struct device *dev, struct kobj_uevent_env *env) +-{ +- int ret; +- +- ret = add_uevent_var(env, "USB_ROLE_SWITCH=%s", dev_name(dev)); +- if (ret) +- dev_err(dev, "failed to add uevent USB_ROLE_SWITCH\n"); +- +- return ret; +-} +- +-static void usb_role_switch_release(struct device *dev) +-{ +- struct usb_role_switch *sw = to_role_switch(dev); +- +- kfree(sw); +-} +- +-static const struct device_type usb_role_dev_type = { +- .name = "usb_role_switch", +- .groups = usb_role_switch_groups, +- .uevent = usb_role_switch_uevent, +- .release = usb_role_switch_release, +-}; +- +-/** +- * usb_role_switch_register - Register USB Role Switch +- * @parent: Parent device for the switch +- * @desc: Description of the switch +- * +- * USB Role Switch is a device capable or choosing the role for USB connector. +- * On platforms where the USB controller is dual-role capable, the controller +- * driver will need to register the switch. On platforms where the USB host and +- * USB device controllers behind the connector are separate, there will be a +- * mux, and the driver for that mux will need to register the switch. +- * +- * Returns handle to a new role switch or ERR_PTR. The content of @desc is +- * copied. +- */ +-struct usb_role_switch * +-usb_role_switch_register(struct device *parent, +- const struct usb_role_switch_desc *desc) +-{ +- struct usb_role_switch *sw; +- int ret; +- +- if (!desc || !desc->set) +- return ERR_PTR(-EINVAL); +- +- sw = kzalloc(sizeof(*sw), GFP_KERNEL); +- if (!sw) +- return ERR_PTR(-ENOMEM); +- +- mutex_init(&sw->lock); +- +- sw->allow_userspace_control = desc->allow_userspace_control; +- sw->usb2_port = desc->usb2_port; +- sw->usb3_port = desc->usb3_port; +- sw->udc = desc->udc; +- sw->set = desc->set; +- sw->get = desc->get; +- +- sw->dev.parent = parent; +- sw->dev.class = role_class; +- sw->dev.type = &usb_role_dev_type; +- dev_set_name(&sw->dev, "%s-role-switch", dev_name(parent)); +- +- ret = device_register(&sw->dev); +- if (ret) { +- put_device(&sw->dev); +- return ERR_PTR(ret); +- } +- +- /* TODO: Symlinks for the host port and the device controller. */ +- +- return sw; +-} +-EXPORT_SYMBOL_GPL(usb_role_switch_register); +- +-/** +- * usb_role_switch_unregister - Unregsiter USB Role Switch +- * @sw: USB Role Switch +- * +- * Unregister switch that was registered with usb_role_switch_register(). +- */ +-void usb_role_switch_unregister(struct usb_role_switch *sw) +-{ +- if (!IS_ERR_OR_NULL(sw)) +- device_unregister(&sw->dev); +-} +-EXPORT_SYMBOL_GPL(usb_role_switch_unregister); +- +-static int __init usb_roles_init(void) +-{ +- role_class = class_create(THIS_MODULE, "usb_role"); +- return PTR_ERR_OR_ZERO(role_class); +-} +-subsys_initcall(usb_roles_init); +- +-static void __exit usb_roles_exit(void) +-{ +- class_destroy(role_class); +-} +-module_exit(usb_roles_exit); +- +-MODULE_AUTHOR("Heikki Krogerus "); +-MODULE_AUTHOR("Hans de Goede "); +-MODULE_LICENSE("GPL v2"); +-MODULE_DESCRIPTION("USB Role Class"); +--- a/drivers/usb/roles/Kconfig ++++ b/drivers/usb/roles/Kconfig +@@ -1,3 +1,16 @@ ++config USB_ROLE_SWITCH ++ tristate "USB Role Switch Support" ++ help ++ USB Role Switch is a device that can select the USB role - host or ++ device - for a USB port (connector). In most cases dual-role capable ++ USB controller will also represent the switch, but on some platforms ++ multiplexer/demultiplexer switch is used to route the data lines on ++ the USB connector between separate USB host and device controllers. ++ ++ Say Y here if your USB connectors support both device and host roles. ++ To compile the driver as module, choose M here: the module will be ++ called roles.ko. ++ + if USB_ROLE_SWITCH + + config USB_ROLES_INTEL_XHCI +--- a/drivers/usb/roles/Makefile ++++ b/drivers/usb/roles/Makefile +@@ -1 +1,3 @@ +-obj-$(CONFIG_USB_ROLES_INTEL_XHCI) += intel-xhci-usb-role-switch.o ++obj-$(CONFIG_USB_ROLE_SWITCH) += roles.o ++roles-y := class.o ++obj-$(CONFIG_USB_ROLES_INTEL_XHCI) += intel-xhci-usb-role-switch.o +--- /dev/null ++++ b/drivers/usb/roles/class.c +@@ -0,0 +1,314 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* ++ * USB Role Switch Support ++ * ++ * Copyright (C) 2018 Intel Corporation ++ * Author: Heikki Krogerus ++ * Hans de Goede ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++ ++static struct class *role_class; ++ ++struct usb_role_switch { ++ struct device dev; ++ struct mutex lock; /* device lock*/ ++ enum usb_role role; ++ ++ /* From descriptor */ ++ struct device *usb2_port; ++ struct device *usb3_port; ++ struct device *udc; ++ usb_role_switch_set_t set; ++ usb_role_switch_get_t get; ++ bool allow_userspace_control; ++}; ++ ++#define to_role_switch(d) container_of(d, struct usb_role_switch, dev) ++ ++/** ++ * usb_role_switch_set_role - Set USB role for a switch ++ * @sw: USB role switch ++ * @role: USB role to be switched to ++ * ++ * Set USB role @role for @sw. ++ */ ++int usb_role_switch_set_role(struct usb_role_switch *sw, enum usb_role role) ++{ ++ int ret; ++ ++ if (IS_ERR_OR_NULL(sw)) ++ return 0; ++ ++ mutex_lock(&sw->lock); ++ ++ ret = sw->set(sw->dev.parent, role); ++ if (!ret) ++ sw->role = role; ++ ++ mutex_unlock(&sw->lock); ++ ++ return ret; ++} ++EXPORT_SYMBOL_GPL(usb_role_switch_set_role); ++ ++/** ++ * usb_role_switch_get_role - Get the USB role for a switch ++ * @sw: USB role switch ++ * ++ * Depending on the role-switch-driver this function returns either a cached ++ * value of the last set role, or reads back the actual value from the hardware. ++ */ ++enum usb_role usb_role_switch_get_role(struct usb_role_switch *sw) ++{ ++ enum usb_role role; ++ ++ if (IS_ERR_OR_NULL(sw)) ++ return USB_ROLE_NONE; ++ ++ mutex_lock(&sw->lock); ++ ++ if (sw->get) ++ role = sw->get(sw->dev.parent); ++ else ++ role = sw->role; ++ ++ mutex_unlock(&sw->lock); ++ ++ return role; ++} ++EXPORT_SYMBOL_GPL(usb_role_switch_get_role); ++ ++static int __switch_match(struct device *dev, const void *name) ++{ ++ return !strcmp((const char *)name, dev_name(dev)); ++} ++ ++static void *usb_role_switch_match(struct device_connection *con, int ep, ++ void *data) ++{ ++ struct device *dev; ++ ++ dev = class_find_device(role_class, NULL, con->endpoint[ep], ++ __switch_match); ++ ++ return dev ? to_role_switch(dev) : ERR_PTR(-EPROBE_DEFER); ++} ++ ++/** ++ * usb_role_switch_get - Find USB role switch linked with the caller ++ * @dev: The caller device ++ * ++ * Finds and returns role switch linked with @dev. The reference count for the ++ * found switch is incremented. ++ */ ++struct usb_role_switch *usb_role_switch_get(struct device *dev) ++{ ++ struct usb_role_switch *sw; ++ ++ sw = device_connection_find_match(dev, "usb-role-switch", NULL, ++ usb_role_switch_match); ++ ++ if (!IS_ERR_OR_NULL(sw)) ++ WARN_ON(!try_module_get(sw->dev.parent->driver->owner)); ++ ++ return sw; ++} ++EXPORT_SYMBOL_GPL(usb_role_switch_get); ++ ++/** ++ * usb_role_switch_put - Release handle to a switch ++ * @sw: USB Role Switch ++ * ++ * Decrement reference count for @sw. ++ */ ++void usb_role_switch_put(struct usb_role_switch *sw) ++{ ++ if (!IS_ERR_OR_NULL(sw)) { ++ put_device(&sw->dev); ++ module_put(sw->dev.parent->driver->owner); ++ } ++} ++EXPORT_SYMBOL_GPL(usb_role_switch_put); ++ ++static umode_t ++usb_role_switch_is_visible(struct kobject *kobj, struct attribute *attr, int n) ++{ ++ struct device *dev = container_of(kobj, typeof(*dev), kobj); ++ struct usb_role_switch *sw = to_role_switch(dev); ++ ++ if (sw->allow_userspace_control) ++ return attr->mode; ++ ++ return 0; ++} ++ ++static const char * const usb_roles[] = { ++ [USB_ROLE_NONE] = "none", ++ [USB_ROLE_HOST] = "host", ++ [USB_ROLE_DEVICE] = "device", ++}; ++ ++static ssize_t ++role_show(struct device *dev, struct device_attribute *attr, char *buf) ++{ ++ struct usb_role_switch *sw = to_role_switch(dev); ++ enum usb_role role = usb_role_switch_get_role(sw); ++ ++ return sprintf(buf, "%s\n", usb_roles[role]); ++} ++ ++static ssize_t role_store(struct device *dev, struct device_attribute *attr, ++ const char *buf, size_t size) ++{ ++ struct usb_role_switch *sw = to_role_switch(dev); ++ int ret; ++ ++ ret = sysfs_match_string(usb_roles, buf); ++ if (ret < 0) { ++ bool res; ++ ++ /* Extra check if the user wants to disable the switch */ ++ ret = kstrtobool(buf, &res); ++ if (ret || res) ++ return -EINVAL; ++ } ++ ++ ret = usb_role_switch_set_role(sw, ret); ++ if (ret) ++ return ret; ++ ++ return size; ++} ++static DEVICE_ATTR_RW(role); ++ ++static struct attribute *usb_role_switch_attrs[] = { ++ &dev_attr_role.attr, ++ NULL, ++}; ++ ++static const struct attribute_group usb_role_switch_group = { ++ .is_visible = usb_role_switch_is_visible, ++ .attrs = usb_role_switch_attrs, ++}; ++ ++static const struct attribute_group *usb_role_switch_groups[] = { ++ &usb_role_switch_group, ++ NULL, ++}; ++ ++static int ++usb_role_switch_uevent(struct device *dev, struct kobj_uevent_env *env) ++{ ++ int ret; ++ ++ ret = add_uevent_var(env, "USB_ROLE_SWITCH=%s", dev_name(dev)); ++ if (ret) ++ dev_err(dev, "failed to add uevent USB_ROLE_SWITCH\n"); ++ ++ return ret; ++} ++ ++static void usb_role_switch_release(struct device *dev) ++{ ++ struct usb_role_switch *sw = to_role_switch(dev); ++ ++ kfree(sw); ++} ++ ++static const struct device_type usb_role_dev_type = { ++ .name = "usb_role_switch", ++ .groups = usb_role_switch_groups, ++ .uevent = usb_role_switch_uevent, ++ .release = usb_role_switch_release, ++}; ++ ++/** ++ * usb_role_switch_register - Register USB Role Switch ++ * @parent: Parent device for the switch ++ * @desc: Description of the switch ++ * ++ * USB Role Switch is a device capable or choosing the role for USB connector. ++ * On platforms where the USB controller is dual-role capable, the controller ++ * driver will need to register the switch. On platforms where the USB host and ++ * USB device controllers behind the connector are separate, there will be a ++ * mux, and the driver for that mux will need to register the switch. ++ * ++ * Returns handle to a new role switch or ERR_PTR. The content of @desc is ++ * copied. ++ */ ++struct usb_role_switch * ++usb_role_switch_register(struct device *parent, ++ const struct usb_role_switch_desc *desc) ++{ ++ struct usb_role_switch *sw; ++ int ret; ++ ++ if (!desc || !desc->set) ++ return ERR_PTR(-EINVAL); ++ ++ sw = kzalloc(sizeof(*sw), GFP_KERNEL); ++ if (!sw) ++ return ERR_PTR(-ENOMEM); ++ ++ mutex_init(&sw->lock); ++ ++ sw->allow_userspace_control = desc->allow_userspace_control; ++ sw->usb2_port = desc->usb2_port; ++ sw->usb3_port = desc->usb3_port; ++ sw->udc = desc->udc; ++ sw->set = desc->set; ++ sw->get = desc->get; ++ ++ sw->dev.parent = parent; ++ sw->dev.class = role_class; ++ sw->dev.type = &usb_role_dev_type; ++ dev_set_name(&sw->dev, "%s-role-switch", dev_name(parent)); ++ ++ ret = device_register(&sw->dev); ++ if (ret) { ++ put_device(&sw->dev); ++ return ERR_PTR(ret); ++ } ++ ++ /* TODO: Symlinks for the host port and the device controller. */ ++ ++ return sw; ++} ++EXPORT_SYMBOL_GPL(usb_role_switch_register); ++ ++/** ++ * usb_role_switch_unregister - Unregsiter USB Role Switch ++ * @sw: USB Role Switch ++ * ++ * Unregister switch that was registered with usb_role_switch_register(). ++ */ ++void usb_role_switch_unregister(struct usb_role_switch *sw) ++{ ++ if (!IS_ERR_OR_NULL(sw)) ++ device_unregister(&sw->dev); ++} ++EXPORT_SYMBOL_GPL(usb_role_switch_unregister); ++ ++static int __init usb_roles_init(void) ++{ ++ role_class = class_create(THIS_MODULE, "usb_role"); ++ return PTR_ERR_OR_ZERO(role_class); ++} ++subsys_initcall(usb_roles_init); ++ ++static void __exit usb_roles_exit(void) ++{ ++ class_destroy(role_class); ++} ++module_exit(usb_roles_exit); ++ ++MODULE_AUTHOR("Heikki Krogerus "); ++MODULE_AUTHOR("Hans de Goede "); ++MODULE_LICENSE("GPL v2"); ++MODULE_DESCRIPTION("USB Role Class"); diff --git a/queue-4.19/usb-serial-option-add-fibocom-nl678-series.patch b/queue-4.19/usb-serial-option-add-fibocom-nl678-series.patch new file mode 100644 index 00000000000..d2fc3792bbc --- /dev/null +++ b/queue-4.19/usb-serial-option-add-fibocom-nl678-series.patch @@ -0,0 +1,67 @@ +From 4b2c01ad902ec02fa962b233decd2f14be3714ba Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= +Date: Fri, 21 Dec 2018 14:40:44 +0100 +Subject: USB: serial: option: add Fibocom NL678 series +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jörgen Storvist + +commit 4b2c01ad902ec02fa962b233decd2f14be3714ba upstream. + +Added USB serial option driver support for Fibocom NL678 series cellular +module: VID 2cb7 and PIDs 0x0104 and 0x0105. +Reserved network and ADB interfaces. + +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2cb7 ProdID=0104 Rev=03.10 +S: Manufacturer=Fibocom +S: Product=Fibocom NL678-E Modem +S: SerialNumber=12345678 +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) + +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2cb7 ProdID=0105 Rev=03.10 +S: Manufacturer=Fibocom +S: Product=Fibocom NL678-E Modem +S: SerialNumber=12345678 +C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#= 4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether +I: If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) + +Signed-off-by: Jörgen Storvist +Cc: stable +Acked-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1955,6 +1955,10 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x1b) }, + { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 */ + .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, ++ { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */ ++ .driver_info = RSVD(4) | RSVD(5) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ ++ .driver_info = RSVD(6) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); diff --git a/queue-4.19/usb-serial-pl2303-add-ids-for-hewlett-packard-hp-pos-pole-displays.patch b/queue-4.19/usb-serial-pl2303-add-ids-for-hewlett-packard-hp-pos-pole-displays.patch new file mode 100644 index 00000000000..7afb0eb0230 --- /dev/null +++ b/queue-4.19/usb-serial-pl2303-add-ids-for-hewlett-packard-hp-pos-pole-displays.patch @@ -0,0 +1,61 @@ +From 8d503f206c336677954160ac62f0c7d9c219cd89 Mon Sep 17 00:00:00 2001 +From: Scott Chen +Date: Thu, 13 Dec 2018 06:01:47 -0500 +Subject: USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays + +From: Scott Chen + +commit 8d503f206c336677954160ac62f0c7d9c219cd89 upstream. + +Add device ids to pl2303 for the HP POS pole displays: +LM920: 03f0:026b +TD620: 03f0:0956 +LD960TA: 03f0:4439 +LD220TA: 03f0:4349 +LM940: 03f0:5039 + +Signed-off-by: Scott Chen +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/pl2303.c | 5 +++++ + drivers/usb/serial/pl2303.h | 5 +++++ + 2 files changed, 10 insertions(+) + +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -91,9 +91,14 @@ static const struct usb_device_id id_tab + { USB_DEVICE(YCCABLE_VENDOR_ID, YCCABLE_PRODUCT_ID) }, + { USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) }, ++ { USB_DEVICE(HP_VENDOR_ID, HP_LD220TA_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) }, ++ { USB_DEVICE(HP_VENDOR_ID, HP_LD960TA_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) }, ++ { USB_DEVICE(HP_VENDOR_ID, HP_LM920_PRODUCT_ID) }, ++ { USB_DEVICE(HP_VENDOR_ID, HP_LM940_PRODUCT_ID) }, ++ { USB_DEVICE(HP_VENDOR_ID, HP_TD620_PRODUCT_ID) }, + { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) }, + { USB_DEVICE(ZEAGLE_VENDOR_ID, ZEAGLE_N2ITION3_PRODUCT_ID) }, + { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) }, +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -119,10 +119,15 @@ + + /* Hewlett-Packard POS Pole Displays */ + #define HP_VENDOR_ID 0x03f0 ++#define HP_LM920_PRODUCT_ID 0x026b ++#define HP_TD620_PRODUCT_ID 0x0956 + #define HP_LD960_PRODUCT_ID 0x0b39 + #define HP_LCM220_PRODUCT_ID 0x3139 + #define HP_LCM960_PRODUCT_ID 0x3239 + #define HP_LD220_PRODUCT_ID 0x3524 ++#define HP_LD220TA_PRODUCT_ID 0x4349 ++#define HP_LD960TA_PRODUCT_ID 0x4439 ++#define HP_LM940_PRODUCT_ID 0x5039 + + /* Cressi Edy (diving computer) PC interface */ + #define CRESSI_VENDOR_ID 0x04b8