From: Greg Kroah-Hartman Date: Tue, 10 Mar 2020 11:21:06 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v4.4.216~14 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bb46287e12ba580ba863cd66a411cdee21f21206;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: arm-dts-am437x-idk-evm-fix-incorrect-opp-node-names.patch arm-dts-imx6dl-colibri-eval-v3-fix-sram-compatible-properties.patch arm-dts-imx7-colibri-fix-frequency-for-sd-mmc.patch arm-imx-build-v7_cpu_resume-unconditionally.patch dmaengine-coh901318-fix-a-double-lock-bug-in-dma_tc_handle.patch efi-x86-align-guids-to-their-size-in-the-mixed-mode-runtime-wrapper.patch efi-x86-handle-by-ref-arguments-covering-multiple-pages-in-mixed-mode.patch hwmon-adt7462-fix-an-error-return-in-adt7462_reg_volt.patch powerpc-fix-hardware-pmu-exception-bug-on-powervm-compatibility-mode-systems.patch --- diff --git a/queue-4.19/arm-dts-am437x-idk-evm-fix-incorrect-opp-node-names.patch b/queue-4.19/arm-dts-am437x-idk-evm-fix-incorrect-opp-node-names.patch new file mode 100644 index 00000000000..b3beb242fdd --- /dev/null +++ b/queue-4.19/arm-dts-am437x-idk-evm-fix-incorrect-opp-node-names.patch @@ -0,0 +1,45 @@ +From 31623468be0bf57617b8057dcd335693935a9491 Mon Sep 17 00:00:00 2001 +From: Suman Anna +Date: Mon, 10 Feb 2020 15:04:23 -0600 +Subject: ARM: dts: am437x-idk-evm: Fix incorrect OPP node names + +From: Suman Anna + +commit 31623468be0bf57617b8057dcd335693935a9491 upstream. + +The commit 337c6c9a69af ("ARM: dts: am437x-idk-evm: Disable +OPP50 for MPU") adjusts couple of OPP nodes defined in the +common am4372.dtsi file, but used outdated node names. This +results in these getting treated as new OPP nodes with missing +properties. + +Fix this properly by using the correct node names as updated in +commit b9cb2ba71848 ("ARM: dts: Use - instead of @ for DT OPP +entries for TI SoCs"). + +Reported-by: Roger Quadros +Fixes: 337c6c9a69af ("ARM: dts: am437x-idk-evm: Disable OPP50 for MPU") +Signed-off-by: Suman Anna +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/am437x-idk-evm.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/am437x-idk-evm.dts ++++ b/arch/arm/boot/dts/am437x-idk-evm.dts +@@ -525,11 +525,11 @@ + * Supply voltage supervisor on board will not allow opp50 so + * disable it and set opp100 as suspend OPP. + */ +- opp50@300000000 { ++ opp50-300000000 { + status = "disabled"; + }; + +- opp100@600000000 { ++ opp100-600000000 { + opp-suspend; + }; + }; diff --git a/queue-4.19/arm-dts-imx6dl-colibri-eval-v3-fix-sram-compatible-properties.patch b/queue-4.19/arm-dts-imx6dl-colibri-eval-v3-fix-sram-compatible-properties.patch new file mode 100644 index 00000000000..10a9b23823e --- /dev/null +++ b/queue-4.19/arm-dts-imx6dl-colibri-eval-v3-fix-sram-compatible-properties.patch @@ -0,0 +1,52 @@ +From bcbf53a0dab50980867476994f6079c1ec5bb3a3 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 12 Feb 2020 11:46:29 +0100 +Subject: ARM: dts: imx6dl-colibri-eval-v3: fix sram compatible properties + +From: Johan Hovold + +commit bcbf53a0dab50980867476994f6079c1ec5bb3a3 upstream. + +The sram-node compatible properties have mistakingly combined the +model-specific string with the generic "mtd-ram" string. + +Note that neither "cy7c1019dv33-10zsxi, mtd-ram" or +"cy7c1019dv33-10zsxi" are used by any in-kernel driver and they are +not present in any binding. + +The physmap driver will however bind to platform devices that specify +"mtd-ram". + +Fixes: fc48e76489fd ("ARM: dts: imx6: Add support for Toradex Colibri iMX6 module") +Cc: Sanchayan Maity +Cc: Marcel Ziswiler +Cc: Shawn Guo +Signed-off-by: Johan Hovold +Reviewed-by: Oleksandr Suvorov +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/imx6dl-colibri-eval-v3.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/imx6dl-colibri-eval-v3.dts ++++ b/arch/arm/boot/dts/imx6dl-colibri-eval-v3.dts +@@ -234,7 +234,7 @@ + + /* SRAM on Colibri nEXT_CS0 */ + sram@0,0 { +- compatible = "cypress,cy7c1019dv33-10zsxi, mtd-ram"; ++ compatible = "cypress,cy7c1019dv33-10zsxi", "mtd-ram"; + reg = <0 0 0x00010000>; + #address-cells = <1>; + #size-cells = <1>; +@@ -245,7 +245,7 @@ + + /* SRAM on Colibri nEXT_CS1 */ + sram@1,0 { +- compatible = "cypress,cy7c1019dv33-10zsxi, mtd-ram"; ++ compatible = "cypress,cy7c1019dv33-10zsxi", "mtd-ram"; + reg = <1 0 0x00010000>; + #address-cells = <1>; + #size-cells = <1>; diff --git a/queue-4.19/arm-dts-imx7-colibri-fix-frequency-for-sd-mmc.patch b/queue-4.19/arm-dts-imx7-colibri-fix-frequency-for-sd-mmc.patch new file mode 100644 index 00000000000..c6aa059bb45 --- /dev/null +++ b/queue-4.19/arm-dts-imx7-colibri-fix-frequency-for-sd-mmc.patch @@ -0,0 +1,47 @@ +From 2773fe1d31c42ffae2a9cb9a6055d99dd86e2fee Mon Sep 17 00:00:00 2001 +From: Oleksandr Suvorov +Date: Wed, 19 Feb 2020 13:11:24 +0000 +Subject: ARM: dts: imx7-colibri: Fix frequency for sd/mmc + +From: Oleksandr Suvorov + +commit 2773fe1d31c42ffae2a9cb9a6055d99dd86e2fee upstream. + +SD/MMC on Colibri iMX7S/D modules successfully support +200Mhz frequency in HS200 mode. + +Removing the unnecessary max-frequency limit significantly +increases the performance: + +== before fix ==== +root@colibri-imx7-emmc:~# hdparm -t /dev/mmcblk0 +/dev/mmcblk0: + Timing buffered disk reads: 252 MB in 3.02 seconds = 83.54 MB/sec +================== + +=== after fix ==== +root@colibri-imx7-emmc:~# hdparm -t /dev/mmcblk0 +/dev/mmcblk0: + Timing buffered disk reads: 408 MB in 3.00 seconds = 135.94 MB/sec +================== + +Fixes: f928a4a377e4 ("ARM: dts: imx7: add Toradex Colibri iMX7D 1GB (eMMC) support") +Signed-off-by: Oleksandr Suvorov +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/imx7-colibri.dtsi | 1 - + 1 file changed, 1 deletion(-) + +--- a/arch/arm/boot/dts/imx7-colibri.dtsi ++++ b/arch/arm/boot/dts/imx7-colibri.dtsi +@@ -319,7 +319,6 @@ + assigned-clock-rates = <400000000>; + bus-width = <8>; + fsl,tuning-step = <2>; +- max-frequency = <100000000>; + vmmc-supply = <®_module_3v3>; + vqmmc-supply = <®_DCDC3>; + non-removable; diff --git a/queue-4.19/arm-imx-build-v7_cpu_resume-unconditionally.patch b/queue-4.19/arm-imx-build-v7_cpu_resume-unconditionally.patch new file mode 100644 index 00000000000..4eb8de1cafd --- /dev/null +++ b/queue-4.19/arm-imx-build-v7_cpu_resume-unconditionally.patch @@ -0,0 +1,119 @@ +From 512a928affd51c2dc631401e56ad5ee5d5dd68b6 Mon Sep 17 00:00:00 2001 +From: Ahmad Fatoum +Date: Thu, 16 Jan 2020 15:18:49 +0100 +Subject: ARM: imx: build v7_cpu_resume() unconditionally + +From: Ahmad Fatoum + +commit 512a928affd51c2dc631401e56ad5ee5d5dd68b6 upstream. + +This function is not only needed by the platform suspend code, but is also +reused as the CPU resume function when the ARM cores can be powered down +completely in deep idle, which is the case on i.MX6SX and i.MX6UL(L). + +Providing the static inline stub whenever CONFIG_SUSPEND is disabled means +that those platforms will hang on resume from cpuidle if suspend is disabled. + +So there are two problems: + + - The static inline stub masks the linker error + - The function is not available where needed + +Fix both by just building the function unconditionally, when +CONFIG_SOC_IMX6 is enabled. The actual code is three instructions long, +so it's arguably ok to just leave it in for all i.MX6 kernel configurations. + +Fixes: 05136f0897b5 ("ARM: imx: support arm power off in cpuidle for i.mx6sx") +Signed-off-by: Lucas Stach +Signed-off-by: Ahmad Fatoum +Signed-off-by: Rouven Czerwinski +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-imx/Makefile | 2 ++ + arch/arm/mach-imx/common.h | 4 ++-- + arch/arm/mach-imx/resume-imx6.S | 24 ++++++++++++++++++++++++ + arch/arm/mach-imx/suspend-imx6.S | 14 -------------- + 4 files changed, 28 insertions(+), 16 deletions(-) + +--- a/arch/arm/mach-imx/Makefile ++++ b/arch/arm/mach-imx/Makefile +@@ -89,6 +89,8 @@ AFLAGS_suspend-imx6.o :=-Wa,-march=armv7 + obj-$(CONFIG_SOC_IMX6) += suspend-imx6.o + obj-$(CONFIG_SOC_IMX53) += suspend-imx53.o + endif ++AFLAGS_resume-imx6.o :=-Wa,-march=armv7-a ++obj-$(CONFIG_SOC_IMX6) += resume-imx6.o + obj-$(CONFIG_SOC_IMX6) += pm-imx6.o + + obj-$(CONFIG_SOC_IMX1) += mach-imx1.o +--- a/arch/arm/mach-imx/common.h ++++ b/arch/arm/mach-imx/common.h +@@ -103,17 +103,17 @@ void imx_cpu_die(unsigned int cpu); + int imx_cpu_kill(unsigned int cpu); + + #ifdef CONFIG_SUSPEND +-void v7_cpu_resume(void); + void imx53_suspend(void __iomem *ocram_vbase); + extern const u32 imx53_suspend_sz; + void imx6_suspend(void __iomem *ocram_vbase); + #else +-static inline void v7_cpu_resume(void) {} + static inline void imx53_suspend(void __iomem *ocram_vbase) {} + static const u32 imx53_suspend_sz; + static inline void imx6_suspend(void __iomem *ocram_vbase) {} + #endif + ++void v7_cpu_resume(void); ++ + void imx6_pm_ccm_init(const char *ccm_compat); + void imx6q_pm_init(void); + void imx6dl_pm_init(void); +--- /dev/null ++++ b/arch/arm/mach-imx/resume-imx6.S +@@ -0,0 +1,24 @@ ++/* SPDX-License-Identifier: GPL-2.0-or-later */ ++/* ++ * Copyright 2014 Freescale Semiconductor, Inc. ++ */ ++ ++#include ++#include ++#include ++#include ++#include "hardware.h" ++ ++/* ++ * The following code must assume it is running from physical address ++ * where absolute virtual addresses to the data section have to be ++ * turned into relative ones. ++ */ ++ ++ENTRY(v7_cpu_resume) ++ bl v7_invalidate_l1 ++#ifdef CONFIG_CACHE_L2X0 ++ bl l2c310_early_resume ++#endif ++ b cpu_resume ++ENDPROC(v7_cpu_resume) +--- a/arch/arm/mach-imx/suspend-imx6.S ++++ b/arch/arm/mach-imx/suspend-imx6.S +@@ -333,17 +333,3 @@ resume: + + ret lr + ENDPROC(imx6_suspend) +- +-/* +- * The following code must assume it is running from physical address +- * where absolute virtual addresses to the data section have to be +- * turned into relative ones. +- */ +- +-ENTRY(v7_cpu_resume) +- bl v7_invalidate_l1 +-#ifdef CONFIG_CACHE_L2X0 +- bl l2c310_early_resume +-#endif +- b cpu_resume +-ENDPROC(v7_cpu_resume) diff --git a/queue-4.19/dmaengine-coh901318-fix-a-double-lock-bug-in-dma_tc_handle.patch b/queue-4.19/dmaengine-coh901318-fix-a-double-lock-bug-in-dma_tc_handle.patch new file mode 100644 index 00000000000..bae45a3129d --- /dev/null +++ b/queue-4.19/dmaengine-coh901318-fix-a-double-lock-bug-in-dma_tc_handle.patch @@ -0,0 +1,41 @@ +From 36d5d22090d13fd3a7a8c9663a711cbe6970aac8 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 17 Feb 2020 17:40:50 +0300 +Subject: dmaengine: coh901318: Fix a double lock bug in dma_tc_handle() + +From: Dan Carpenter + +commit 36d5d22090d13fd3a7a8c9663a711cbe6970aac8 upstream. + +The caller is already holding the lock so this will deadlock. + +Fixes: 0b58828c923e ("DMAENGINE: COH 901 318 remove irq counting") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20200217144050.3i4ymbytogod4ijn@kili.mountain +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/coh901318.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/drivers/dma/coh901318.c ++++ b/drivers/dma/coh901318.c +@@ -1944,8 +1944,6 @@ static void dma_tc_handle(struct coh9013 + return; + } + +- spin_lock(&cohc->lock); +- + /* + * When we reach this point, at least one queue item + * should have been moved over from cohc->queue to +@@ -1966,8 +1964,6 @@ static void dma_tc_handle(struct coh9013 + if (coh901318_queue_start(cohc) == NULL) + cohc->busy = 0; + +- spin_unlock(&cohc->lock); +- + /* + * This tasklet will remove items from cohc->active + * and thus terminates them. diff --git a/queue-4.19/efi-x86-align-guids-to-their-size-in-the-mixed-mode-runtime-wrapper.patch b/queue-4.19/efi-x86-align-guids-to-their-size-in-the-mixed-mode-runtime-wrapper.patch new file mode 100644 index 00000000000..6ed6f5dca07 --- /dev/null +++ b/queue-4.19/efi-x86-align-guids-to-their-size-in-the-mixed-mode-runtime-wrapper.patch @@ -0,0 +1,129 @@ +From 63056e8b5ebf41d52170e9f5ba1fc83d1855278c Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Fri, 21 Feb 2020 09:48:46 +0100 +Subject: efi/x86: Align GUIDs to their size in the mixed mode runtime wrapper + +From: Ard Biesheuvel + +commit 63056e8b5ebf41d52170e9f5ba1fc83d1855278c upstream. + +Hans reports that his mixed mode systems running v5.6-rc1 kernels hit +the WARN_ON() in virt_to_phys_or_null_size(), caused by the fact that +efi_guid_t objects on the vmap'ed stack happen to be misaligned with +respect to their sizes. As a quick (i.e., backportable) fix, copy GUID +pointer arguments to the local stack into a buffer that is naturally +aligned to its size, so that it is guaranteed to cover only one +physical page. + +Note that on x86, we cannot rely on the stack pointer being aligned +the way the compiler expects, so we need to allocate an 8-byte aligned +buffer of sufficient size, and copy the GUID into that buffer at an +offset that is aligned to 16 bytes. + +Fixes: f6697df36bdf0bf7 ("x86/efi: Prevent mixed mode boot corruption with CONFIG_VMAP_STACK=y") +Reported-by: Hans de Goede +Signed-off-by: Ard Biesheuvel +Signed-off-by: Ingo Molnar +Tested-by: Hans de Goede +Cc: linux-efi@vger.kernel.org +Cc: Ingo Molnar +Cc: Thomas Gleixner +Link: https://lore.kernel.org/r/20200221084849.26878-2-ardb@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/platform/efi/efi_64.c | 25 +++++++++++++++++++++---- + 1 file changed, 21 insertions(+), 4 deletions(-) + +--- a/arch/x86/platform/efi/efi_64.c ++++ b/arch/x86/platform/efi/efi_64.c +@@ -790,6 +790,8 @@ static efi_status_t + efi_thunk_get_variable(efi_char16_t *name, efi_guid_t *vendor, + u32 *attr, unsigned long *data_size, void *data) + { ++ u8 buf[24] __aligned(8); ++ efi_guid_t *vnd = PTR_ALIGN((efi_guid_t *)buf, sizeof(*vnd)); + efi_status_t status; + u32 phys_name, phys_vendor, phys_attr; + u32 phys_data_size, phys_data; +@@ -797,8 +799,10 @@ efi_thunk_get_variable(efi_char16_t *nam + + spin_lock_irqsave(&efi_runtime_lock, flags); + ++ *vnd = *vendor; ++ + phys_data_size = virt_to_phys_or_null(data_size); +- phys_vendor = virt_to_phys_or_null(vendor); ++ phys_vendor = virt_to_phys_or_null(vnd); + phys_name = virt_to_phys_or_null_size(name, efi_name_size(name)); + phys_attr = virt_to_phys_or_null(attr); + phys_data = virt_to_phys_or_null_size(data, *data_size); +@@ -815,14 +819,18 @@ static efi_status_t + efi_thunk_set_variable(efi_char16_t *name, efi_guid_t *vendor, + u32 attr, unsigned long data_size, void *data) + { ++ u8 buf[24] __aligned(8); ++ efi_guid_t *vnd = PTR_ALIGN((efi_guid_t *)buf, sizeof(*vnd)); + u32 phys_name, phys_vendor, phys_data; + efi_status_t status; + unsigned long flags; + + spin_lock_irqsave(&efi_runtime_lock, flags); + ++ *vnd = *vendor; ++ + phys_name = virt_to_phys_or_null_size(name, efi_name_size(name)); +- phys_vendor = virt_to_phys_or_null(vendor); ++ phys_vendor = virt_to_phys_or_null(vnd); + phys_data = virt_to_phys_or_null_size(data, data_size); + + /* If data_size is > sizeof(u32) we've got problems */ +@@ -839,6 +847,8 @@ efi_thunk_set_variable_nonblocking(efi_c + u32 attr, unsigned long data_size, + void *data) + { ++ u8 buf[24] __aligned(8); ++ efi_guid_t *vnd = PTR_ALIGN((efi_guid_t *)buf, sizeof(*vnd)); + u32 phys_name, phys_vendor, phys_data; + efi_status_t status; + unsigned long flags; +@@ -846,8 +856,10 @@ efi_thunk_set_variable_nonblocking(efi_c + if (!spin_trylock_irqsave(&efi_runtime_lock, flags)) + return EFI_NOT_READY; + ++ *vnd = *vendor; ++ + phys_name = virt_to_phys_or_null_size(name, efi_name_size(name)); +- phys_vendor = virt_to_phys_or_null(vendor); ++ phys_vendor = virt_to_phys_or_null(vnd); + phys_data = virt_to_phys_or_null_size(data, data_size); + + /* If data_size is > sizeof(u32) we've got problems */ +@@ -864,14 +876,18 @@ efi_thunk_get_next_variable(unsigned lon + efi_char16_t *name, + efi_guid_t *vendor) + { ++ u8 buf[24] __aligned(8); ++ efi_guid_t *vnd = PTR_ALIGN((efi_guid_t *)buf, sizeof(*vnd)); + efi_status_t status; + u32 phys_name_size, phys_name, phys_vendor; + unsigned long flags; + + spin_lock_irqsave(&efi_runtime_lock, flags); + ++ *vnd = *vendor; ++ + phys_name_size = virt_to_phys_or_null(name_size); +- phys_vendor = virt_to_phys_or_null(vendor); ++ phys_vendor = virt_to_phys_or_null(vnd); + phys_name = virt_to_phys_or_null_size(name, *name_size); + + status = efi_thunk(get_next_variable, phys_name_size, +@@ -879,6 +895,7 @@ efi_thunk_get_next_variable(unsigned lon + + spin_unlock_irqrestore(&efi_runtime_lock, flags); + ++ *vendor = *vnd; + return status; + } + diff --git a/queue-4.19/efi-x86-handle-by-ref-arguments-covering-multiple-pages-in-mixed-mode.patch b/queue-4.19/efi-x86-handle-by-ref-arguments-covering-multiple-pages-in-mixed-mode.patch new file mode 100644 index 00000000000..6348804f24e --- /dev/null +++ b/queue-4.19/efi-x86-handle-by-ref-arguments-covering-multiple-pages-in-mixed-mode.patch @@ -0,0 +1,137 @@ +From 8319e9d5ad98ffccd19f35664382c73cea216193 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Fri, 21 Feb 2020 09:48:48 +0100 +Subject: efi/x86: Handle by-ref arguments covering multiple pages in mixed mode + +From: Ard Biesheuvel + +commit 8319e9d5ad98ffccd19f35664382c73cea216193 upstream. + +The mixed mode runtime wrappers are fragile when it comes to how the +memory referred to by its pointer arguments are laid out in memory, due +to the fact that it translates these addresses to physical addresses that +the runtime services can dereference when running in 1:1 mode. Since +vmalloc'ed pages (including the vmap'ed stack) are not contiguous in the +physical address space, this scheme only works if the referenced memory +objects do not cross page boundaries. + +Currently, the mixed mode runtime service wrappers require that all by-ref +arguments that live in the vmalloc space have a size that is a power of 2, +and are aligned to that same value. While this is a sensible way to +construct an object that is guaranteed not to cross a page boundary, it is +overly strict when it comes to checking whether a given object violates +this requirement, as we can simply take the physical address of the first +and the last byte, and verify that they point into the same physical page. + +When this check fails, we emit a WARN(), but then simply proceed with the +call, which could cause data corruption if the next physical page belongs +to a mapping that is entirely unrelated. + +Given that with vmap'ed stacks, this condition is much more likely to +trigger, let's relax the condition a bit, but fail the runtime service +call if it does trigger. + +Fixes: f6697df36bdf0bf7 ("x86/efi: Prevent mixed mode boot corruption with CONFIG_VMAP_STACK=y") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Ingo Molnar +Cc: linux-efi@vger.kernel.org +Cc: Ingo Molnar +Cc: Thomas Gleixner +Link: https://lore.kernel.org/r/20200221084849.26878-4-ardb@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/platform/efi/efi_64.c | 45 +++++++++++++++++++++++------------------ + 1 file changed, 26 insertions(+), 19 deletions(-) + +--- a/arch/x86/platform/efi/efi_64.c ++++ b/arch/x86/platform/efi/efi_64.c +@@ -313,7 +313,7 @@ void efi_sync_low_kernel_mappings(void) + static inline phys_addr_t + virt_to_phys_or_null_size(void *va, unsigned long size) + { +- bool bad_size; ++ phys_addr_t pa; + + if (!va) + return 0; +@@ -321,16 +321,13 @@ virt_to_phys_or_null_size(void *va, unsi + if (virt_addr_valid(va)) + return virt_to_phys(va); + +- /* +- * A fully aligned variable on the stack is guaranteed not to +- * cross a page bounary. Try to catch strings on the stack by +- * checking that 'size' is a power of two. +- */ +- bad_size = size > PAGE_SIZE || !is_power_of_2(size); ++ pa = slow_virt_to_phys(va); + +- WARN_ON(!IS_ALIGNED((unsigned long)va, size) || bad_size); ++ /* check if the object crosses a page boundary */ ++ if (WARN_ON((pa ^ (pa + size - 1)) & PAGE_MASK)) ++ return 0; + +- return slow_virt_to_phys(va); ++ return pa; + } + + #define virt_to_phys_or_null(addr) \ +@@ -807,8 +804,11 @@ efi_thunk_get_variable(efi_char16_t *nam + phys_attr = virt_to_phys_or_null(attr); + phys_data = virt_to_phys_or_null_size(data, *data_size); + +- status = efi_thunk(get_variable, phys_name, phys_vendor, +- phys_attr, phys_data_size, phys_data); ++ if (!phys_name || (data && !phys_data)) ++ status = EFI_INVALID_PARAMETER; ++ else ++ status = efi_thunk(get_variable, phys_name, phys_vendor, ++ phys_attr, phys_data_size, phys_data); + + spin_unlock_irqrestore(&efi_runtime_lock, flags); + +@@ -833,9 +833,11 @@ efi_thunk_set_variable(efi_char16_t *nam + phys_vendor = virt_to_phys_or_null(vnd); + phys_data = virt_to_phys_or_null_size(data, data_size); + +- /* If data_size is > sizeof(u32) we've got problems */ +- status = efi_thunk(set_variable, phys_name, phys_vendor, +- attr, data_size, phys_data); ++ if (!phys_name || !phys_data) ++ status = EFI_INVALID_PARAMETER; ++ else ++ status = efi_thunk(set_variable, phys_name, phys_vendor, ++ attr, data_size, phys_data); + + spin_unlock_irqrestore(&efi_runtime_lock, flags); + +@@ -862,9 +864,11 @@ efi_thunk_set_variable_nonblocking(efi_c + phys_vendor = virt_to_phys_or_null(vnd); + phys_data = virt_to_phys_or_null_size(data, data_size); + +- /* If data_size is > sizeof(u32) we've got problems */ +- status = efi_thunk(set_variable, phys_name, phys_vendor, +- attr, data_size, phys_data); ++ if (!phys_name || !phys_data) ++ status = EFI_INVALID_PARAMETER; ++ else ++ status = efi_thunk(set_variable, phys_name, phys_vendor, ++ attr, data_size, phys_data); + + spin_unlock_irqrestore(&efi_runtime_lock, flags); + +@@ -890,8 +894,11 @@ efi_thunk_get_next_variable(unsigned lon + phys_vendor = virt_to_phys_or_null(vnd); + phys_name = virt_to_phys_or_null_size(name, *name_size); + +- status = efi_thunk(get_next_variable, phys_name_size, +- phys_name, phys_vendor); ++ if (!phys_name) ++ status = EFI_INVALID_PARAMETER; ++ else ++ status = efi_thunk(get_next_variable, phys_name_size, ++ phys_name, phys_vendor); + + spin_unlock_irqrestore(&efi_runtime_lock, flags); + diff --git a/queue-4.19/hwmon-adt7462-fix-an-error-return-in-adt7462_reg_volt.patch b/queue-4.19/hwmon-adt7462-fix-an-error-return-in-adt7462_reg_volt.patch new file mode 100644 index 00000000000..c671ca7a9a3 --- /dev/null +++ b/queue-4.19/hwmon-adt7462-fix-an-error-return-in-adt7462_reg_volt.patch @@ -0,0 +1,36 @@ +From 44f2f882909fedfc3a56e4b90026910456019743 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 3 Mar 2020 13:16:08 +0300 +Subject: hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT() + +From: Dan Carpenter + +commit 44f2f882909fedfc3a56e4b90026910456019743 upstream. + +This is only called from adt7462_update_device(). The caller expects it +to return zero on error. I fixed a similar issue earlier in commit +a4bf06d58f21 ("hwmon: (adt7462) ADT7462_REG_VOLT_MAX() should return 0") +but I missed this one. + +Fixes: c0b4e3ab0c76 ("adt7462: new hwmon driver") +Signed-off-by: Dan Carpenter +Reviewed-by: Darrick J. Wong +Link: https://lore.kernel.org/r/20200303101608.kqjwfcazu2ylhi2a@kili.mountain +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/adt7462.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/adt7462.c ++++ b/drivers/hwmon/adt7462.c +@@ -426,7 +426,7 @@ static int ADT7462_REG_VOLT(struct adt74 + return 0x95; + break; + } +- return -ENODEV; ++ return 0; + } + + /* Provide labels for sysfs */ diff --git a/queue-4.19/powerpc-fix-hardware-pmu-exception-bug-on-powervm-compatibility-mode-systems.patch b/queue-4.19/powerpc-fix-hardware-pmu-exception-bug-on-powervm-compatibility-mode-systems.patch new file mode 100644 index 00000000000..f48030cf682 --- /dev/null +++ b/queue-4.19/powerpc-fix-hardware-pmu-exception-bug-on-powervm-compatibility-mode-systems.patch @@ -0,0 +1,45 @@ +From fc37a1632d40c80c067eb1bc235139f5867a2667 Mon Sep 17 00:00:00 2001 +From: "Desnes A. Nunes do Rosario" +Date: Thu, 27 Feb 2020 10:47:15 -0300 +Subject: powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems + +From: Desnes A. Nunes do Rosario + +commit fc37a1632d40c80c067eb1bc235139f5867a2667 upstream. + +PowerVM systems running compatibility mode on a few Power8 revisions are +still vulnerable to the hardware defect that loses PMU exceptions arriving +prior to a context switch. + +The software fix for this issue is enabled through the CPU_FTR_PMAO_BUG +cpu_feature bit, nevertheless this bit also needs to be set for PowerVM +compatibility mode systems. + +Fixes: 68f2f0d431d9ea4 ("powerpc: Add a cpu feature CPU_FTR_PMAO_BUG") +Signed-off-by: Desnes A. Nunes do Rosario +Reviewed-by: Leonardo Bras +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200227134715.9715-1-desnesn@linux.ibm.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/cputable.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/powerpc/kernel/cputable.c ++++ b/arch/powerpc/kernel/cputable.c +@@ -2188,11 +2188,13 @@ static struct cpu_spec * __init setup_cp + * oprofile_cpu_type already has a value, then we are + * possibly overriding a real PVR with a logical one, + * and, in that case, keep the current value for +- * oprofile_cpu_type. ++ * oprofile_cpu_type. Futhermore, let's ensure that the ++ * fix for the PMAO bug is enabled on compatibility mode. + */ + if (old.oprofile_cpu_type != NULL) { + t->oprofile_cpu_type = old.oprofile_cpu_type; + t->oprofile_type = old.oprofile_type; ++ t->cpu_features |= old.cpu_features & CPU_FTR_PMAO_BUG; + } + } + diff --git a/queue-4.19/series b/queue-4.19/series index f3952120558..0951b75e858 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -74,3 +74,12 @@ arm-dts-imx6-phycore-som-fix-emmc-supply.patch rdma-iwcm-fix-iwcm-work-deallocation.patch rmda-cm-fix-missing-ib_cm_destroy_id-in-ib_cm_insert_listen.patch ib-hfi1-qib-ensure-rcu-is-locked-when-accessing-list.patch +arm-imx-build-v7_cpu_resume-unconditionally.patch +arm-dts-am437x-idk-evm-fix-incorrect-opp-node-names.patch +arm-dts-imx6dl-colibri-eval-v3-fix-sram-compatible-properties.patch +arm-dts-imx7-colibri-fix-frequency-for-sd-mmc.patch +hwmon-adt7462-fix-an-error-return-in-adt7462_reg_volt.patch +dmaengine-coh901318-fix-a-double-lock-bug-in-dma_tc_handle.patch +powerpc-fix-hardware-pmu-exception-bug-on-powervm-compatibility-mode-systems.patch +efi-x86-align-guids-to-their-size-in-the-mixed-mode-runtime-wrapper.patch +efi-x86-handle-by-ref-arguments-covering-multiple-pages-in-mixed-mode.patch