From: Greg Kroah-Hartman Date: Mon, 13 Jan 2020 21:53:35 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.4.210~19 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d0ff0497dd14d2bb9ca4abfe7eb9b925c9257c11;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: arm-implement-copy_thread_tls.patch arm64-implement-copy_thread_tls.patch arm64-move-__arch_want_sys_clone3-definition-to-uapi-headers.patch can-can_dropped_invalid_skb-ensure-an-initialized-headroom-in-outgoing-can-sk_buffs.patch can-gs_usb-gs_usb_probe-use-descriptors-of-current-altsetting.patch can-kvaser_usb-fix-interface-sanity-check.patch can-mscan-mscan_rx_poll-fix-rx-path-lockup-when-returning-from-polling-to-irq-mode.patch can-tcan4x5x-tcan4x5x_can_probe-get-the-device-out-of-standby-before-register-access.patch clone3-ensure-copy_thread_tls-is-implemented.patch gpiolib-acpi-add-honor_wakeup-module-option-quirk-mechanism.patch gpiolib-acpi-turn-dmi_system_id-table-into-a-generic-quirk-table.patch iommu-vt-d-fix-adding-non-pci-devices-to-intel-iommu.patch parisc-implement-copy_thread_tls.patch pstore-ram-regularize-prz-label-allocation-lifetime.patch riscv-implement-copy_thread_tls.patch serdev-don-t-claim-unsupported-acpi-serial-devices.patch staging-comedi-adv_pci1710-fix-ai-channels-16-31-for-pci-1713.patch staging-rtl8188eu-add-device-code-for-tp-link-tl-wn727n-v5.21.patch staging-vt6656-correct-return-of-vnt_init_registers.patch staging-vt6656-fix-non-zero-logical-return-of-usb_control_msg.patch staging-vt6656-limit-reg-output-to-block-size.patch staging-vt6656-set-usb_set_intfdata-on-driver-fail.patch tty-always-relink-the-port.patch tty-link-tty-and-port-before-configuring-it-as-console.patch um-implement-copy_thread_tls.patch usb-cdns3-should-not-use-the-same-dev_id-for-shared-interrupt-handler.patch usb-musb-disable-pullup-at-init.patch usb-musb-dma-correct-parameter-passed-to-irq-handler.patch usb-musb-fix-idling-for-suspend-after-disconnect-interrupt.patch usb-ohci-da8xx-ensure-error-return-on-variable-error-is-set.patch usb-pd-tcpm-bad-warning-size-pps-adapters.patch usb-serial-option-add-zlp-support-for-0x1bc7-0x9010.patch xtensa-implement-copy_thread_tls.patch --- diff --git a/queue-5.4/arm-implement-copy_thread_tls.patch b/queue-5.4/arm-implement-copy_thread_tls.patch new file mode 100644 index 00000000000..fbce796ee00 --- /dev/null +++ b/queue-5.4/arm-implement-copy_thread_tls.patch @@ -0,0 +1,56 @@ +From 167ee0b82429cb5df272808c7a21370b7c961ab2 Mon Sep 17 00:00:00 2001 +From: Amanieu d'Antras +Date: Thu, 2 Jan 2020 18:24:09 +0100 +Subject: arm: Implement copy_thread_tls + +From: Amanieu d'Antras + +commit 167ee0b82429cb5df272808c7a21370b7c961ab2 upstream. + +This is required for clone3 which passes the TLS value through a +struct rather than a register. + +Signed-off-by: Amanieu d'Antras +Cc: linux-arm-kernel@lists.infradead.org +Cc: # 5.3.x +Link: https://lore.kernel.org/r/20200102172413.654385-4-amanieu@gmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/Kconfig | 1 + + arch/arm/kernel/process.c | 6 +++--- + 2 files changed, 4 insertions(+), 3 deletions(-) + +--- a/arch/arm/Kconfig ++++ b/arch/arm/Kconfig +@@ -73,6 +73,7 @@ config ARM + select HAVE_ARM_SMCCC if CPU_V7 + select HAVE_EBPF_JIT if !CPU_ENDIAN_BE32 + select HAVE_CONTEXT_TRACKING ++ select HAVE_COPY_THREAD_TLS + select HAVE_C_RECORDMCOUNT + select HAVE_DEBUG_KMEMLEAK + select HAVE_DMA_CONTIGUOUS if MMU +--- a/arch/arm/kernel/process.c ++++ b/arch/arm/kernel/process.c +@@ -224,8 +224,8 @@ void release_thread(struct task_struct * + asmlinkage void ret_from_fork(void) __asm__("ret_from_fork"); + + int +-copy_thread(unsigned long clone_flags, unsigned long stack_start, +- unsigned long stk_sz, struct task_struct *p) ++copy_thread_tls(unsigned long clone_flags, unsigned long stack_start, ++ unsigned long stk_sz, struct task_struct *p, unsigned long tls) + { + struct thread_info *thread = task_thread_info(p); + struct pt_regs *childregs = task_pt_regs(p); +@@ -259,7 +259,7 @@ copy_thread(unsigned long clone_flags, u + clear_ptrace_hw_breakpoint(p); + + if (clone_flags & CLONE_SETTLS) +- thread->tp_value[0] = childregs->ARM_r3; ++ thread->tp_value[0] = tls; + thread->tp_value[1] = get_tpuser(); + + thread_notify(THREAD_NOTIFY_COPY, thread); diff --git a/queue-5.4/arm64-implement-copy_thread_tls.patch b/queue-5.4/arm64-implement-copy_thread_tls.patch new file mode 100644 index 00000000000..34d7517e099 --- /dev/null +++ b/queue-5.4/arm64-implement-copy_thread_tls.patch @@ -0,0 +1,63 @@ +From a4376f2fbcc8084832f2f114577c8d68234c7903 Mon Sep 17 00:00:00 2001 +From: Amanieu d'Antras +Date: Thu, 2 Jan 2020 18:24:08 +0100 +Subject: arm64: Implement copy_thread_tls + +From: Amanieu d'Antras + +commit a4376f2fbcc8084832f2f114577c8d68234c7903 upstream. + +This is required for clone3 which passes the TLS value through a +struct rather than a register. + +Signed-off-by: Amanieu d'Antras +Cc: linux-arm-kernel@lists.infradead.org +Cc: # 5.3.x +Acked-by: Will Deacon +Link: https://lore.kernel.org/r/20200102172413.654385-3-amanieu@gmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/Kconfig | 1 + + arch/arm64/kernel/process.c | 10 +++++----- + 2 files changed, 6 insertions(+), 5 deletions(-) + +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -139,6 +139,7 @@ config ARM64 + select HAVE_CMPXCHG_DOUBLE + select HAVE_CMPXCHG_LOCAL + select HAVE_CONTEXT_TRACKING ++ select HAVE_COPY_THREAD_TLS + select HAVE_DEBUG_BUGVERBOSE + select HAVE_DEBUG_KMEMLEAK + select HAVE_DMA_CONTIGUOUS +--- a/arch/arm64/kernel/process.c ++++ b/arch/arm64/kernel/process.c +@@ -360,8 +360,8 @@ int arch_dup_task_struct(struct task_str + + asmlinkage void ret_from_fork(void) asm("ret_from_fork"); + +-int copy_thread(unsigned long clone_flags, unsigned long stack_start, +- unsigned long stk_sz, struct task_struct *p) ++int copy_thread_tls(unsigned long clone_flags, unsigned long stack_start, ++ unsigned long stk_sz, struct task_struct *p, unsigned long tls) + { + struct pt_regs *childregs = task_pt_regs(p); + +@@ -394,11 +394,11 @@ int copy_thread(unsigned long clone_flag + } + + /* +- * If a TLS pointer was passed to clone (4th argument), use it +- * for the new thread. ++ * If a TLS pointer was passed to clone, use it for the new ++ * thread. + */ + if (clone_flags & CLONE_SETTLS) +- p->thread.uw.tp_value = childregs->regs[3]; ++ p->thread.uw.tp_value = tls; + } else { + memset(childregs, 0, sizeof(struct pt_regs)); + childregs->pstate = PSR_MODE_EL1h; diff --git a/queue-5.4/arm64-move-__arch_want_sys_clone3-definition-to-uapi-headers.patch b/queue-5.4/arm64-move-__arch_want_sys_clone3-definition-to-uapi-headers.patch new file mode 100644 index 00000000000..5e246be5d5d --- /dev/null +++ b/queue-5.4/arm64-move-__arch_want_sys_clone3-definition-to-uapi-headers.patch @@ -0,0 +1,44 @@ +From 3e3c8ca5a351350031f0f3d5ecedf7048b1b9008 Mon Sep 17 00:00:00 2001 +From: Amanieu d'Antras +Date: Thu, 2 Jan 2020 18:24:07 +0100 +Subject: arm64: Move __ARCH_WANT_SYS_CLONE3 definition to uapi headers + +From: Amanieu d'Antras + +commit 3e3c8ca5a351350031f0f3d5ecedf7048b1b9008 upstream. + +Previously this was only defined in the internal headers which +resulted in __NR_clone3 not being defined in the user headers. + +Signed-off-by: Amanieu d'Antras +Cc: linux-arm-kernel@lists.infradead.org +Cc: # 5.3.x +Reviewed-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20200102172413.654385-2-amanieu@gmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/include/asm/unistd.h | 1 - + arch/arm64/include/uapi/asm/unistd.h | 1 + + 2 files changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/include/asm/unistd.h ++++ b/arch/arm64/include/asm/unistd.h +@@ -42,7 +42,6 @@ + #endif + + #define __ARCH_WANT_SYS_CLONE +-#define __ARCH_WANT_SYS_CLONE3 + + #ifndef __COMPAT_SYSCALL_NR + #include +--- a/arch/arm64/include/uapi/asm/unistd.h ++++ b/arch/arm64/include/uapi/asm/unistd.h +@@ -19,5 +19,6 @@ + #define __ARCH_WANT_NEW_STAT + #define __ARCH_WANT_SET_GET_RLIMIT + #define __ARCH_WANT_TIME32_SYSCALLS ++#define __ARCH_WANT_SYS_CLONE3 + + #include diff --git a/queue-5.4/can-can_dropped_invalid_skb-ensure-an-initialized-headroom-in-outgoing-can-sk_buffs.patch b/queue-5.4/can-can_dropped_invalid_skb-ensure-an-initialized-headroom-in-outgoing-can-sk_buffs.patch new file mode 100644 index 00000000000..94d71bdc3c5 --- /dev/null +++ b/queue-5.4/can-can_dropped_invalid_skb-ensure-an-initialized-headroom-in-outgoing-can-sk_buffs.patch @@ -0,0 +1,88 @@ +From e7153bf70c3496bac00e7e4f395bb8d8394ac0ea Mon Sep 17 00:00:00 2001 +From: Oliver Hartkopp +Date: Sat, 7 Dec 2019 19:34:18 +0100 +Subject: can: can_dropped_invalid_skb(): ensure an initialized headroom in outgoing CAN sk_buffs + +From: Oliver Hartkopp + +commit e7153bf70c3496bac00e7e4f395bb8d8394ac0ea upstream. + +KMSAN sysbot detected a read access to an untinitialized value in the +headroom of an outgoing CAN related sk_buff. When using CAN sockets this +area is filled appropriately - but when using a packet socket this +initialization is missing. + +The problematic read access occurs in the CAN receive path which can +only be triggered when the sk_buff is sent through a (virtual) CAN +interface. So we check in the sending path whether we need to perform +the missing initializations. + +Fixes: d3b58c47d330d ("can: replace timestamp as unique skb attribute") +Reported-by: syzbot+b02ff0707a97e4e79ebb@syzkaller.appspotmail.com +Signed-off-by: Oliver Hartkopp +Tested-by: Oliver Hartkopp +Cc: linux-stable # >= v4.1 +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/can/dev.h | 34 ++++++++++++++++++++++++++++++++++ + 1 file changed, 34 insertions(+) + +--- a/include/linux/can/dev.h ++++ b/include/linux/can/dev.h +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + #include + + /* +@@ -91,6 +92,36 @@ struct can_priv { + #define get_can_dlc(i) (min_t(__u8, (i), CAN_MAX_DLC)) + #define get_canfd_dlc(i) (min_t(__u8, (i), CANFD_MAX_DLC)) + ++/* Check for outgoing skbs that have not been created by the CAN subsystem */ ++static inline bool can_skb_headroom_valid(struct net_device *dev, ++ struct sk_buff *skb) ++{ ++ /* af_packet creates a headroom of HH_DATA_MOD bytes which is fine */ ++ if (WARN_ON_ONCE(skb_headroom(skb) < sizeof(struct can_skb_priv))) ++ return false; ++ ++ /* af_packet does not apply CAN skb specific settings */ ++ if (skb->ip_summed == CHECKSUM_NONE) { ++ /* init headroom */ ++ can_skb_prv(skb)->ifindex = dev->ifindex; ++ can_skb_prv(skb)->skbcnt = 0; ++ ++ skb->ip_summed = CHECKSUM_UNNECESSARY; ++ ++ /* preform proper loopback on capable devices */ ++ if (dev->flags & IFF_ECHO) ++ skb->pkt_type = PACKET_LOOPBACK; ++ else ++ skb->pkt_type = PACKET_HOST; ++ ++ skb_reset_mac_header(skb); ++ skb_reset_network_header(skb); ++ skb_reset_transport_header(skb); ++ } ++ ++ return true; ++} ++ + /* Drop a given socketbuffer if it does not contain a valid CAN frame. */ + static inline bool can_dropped_invalid_skb(struct net_device *dev, + struct sk_buff *skb) +@@ -108,6 +139,9 @@ static inline bool can_dropped_invalid_s + } else + goto inval_skb; + ++ if (!can_skb_headroom_valid(dev, skb)) ++ goto inval_skb; ++ + return false; + + inval_skb: diff --git a/queue-5.4/can-gs_usb-gs_usb_probe-use-descriptors-of-current-altsetting.patch b/queue-5.4/can-gs_usb-gs_usb_probe-use-descriptors-of-current-altsetting.patch new file mode 100644 index 00000000000..f5b0ababd7f --- /dev/null +++ b/queue-5.4/can-gs_usb-gs_usb_probe-use-descriptors-of-current-altsetting.patch @@ -0,0 +1,42 @@ +From 2f361cd9474ab2c4ab9ac8db20faf81e66c6279b Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 10 Dec 2019 12:32:31 +0100 +Subject: can: gs_usb: gs_usb_probe(): use descriptors of current altsetting + +From: Johan Hovold + +commit 2f361cd9474ab2c4ab9ac8db20faf81e66c6279b upstream. + +Make sure to always use the descriptors of the current alternate setting +to avoid future issues when accessing fields that may differ between +settings. + +Signed-off-by: Johan Hovold +Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/gs_usb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -918,7 +918,7 @@ static int gs_usb_probe(struct usb_inter + GS_USB_BREQ_HOST_FORMAT, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE, + 1, +- intf->altsetting[0].desc.bInterfaceNumber, ++ intf->cur_altsetting->desc.bInterfaceNumber, + hconf, + sizeof(*hconf), + 1000); +@@ -941,7 +941,7 @@ static int gs_usb_probe(struct usb_inter + GS_USB_BREQ_DEVICE_CONFIG, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_INTERFACE, + 1, +- intf->altsetting[0].desc.bInterfaceNumber, ++ intf->cur_altsetting->desc.bInterfaceNumber, + dconf, + sizeof(*dconf), + 1000); diff --git a/queue-5.4/can-kvaser_usb-fix-interface-sanity-check.patch b/queue-5.4/can-kvaser_usb-fix-interface-sanity-check.patch new file mode 100644 index 00000000000..62de0eca9a7 --- /dev/null +++ b/queue-5.4/can-kvaser_usb-fix-interface-sanity-check.patch @@ -0,0 +1,52 @@ +From 5660493c637c9d83786f1c9297f403eae44177b6 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 10 Dec 2019 12:32:30 +0100 +Subject: can: kvaser_usb: fix interface sanity check + +From: Johan Hovold + +commit 5660493c637c9d83786f1c9297f403eae44177b6 upstream. + +Make sure to use the current alternate setting when verifying the +interface descriptors to avoid binding to an invalid interface. + +Failing to do so could cause the driver to misbehave or trigger a WARN() +in usb_submit_urb() that kernels with panic_on_warn set would choke on. + +Fixes: aec5fb2268b7 ("can: kvaser_usb: Add support for Kvaser USB hydra family") +Cc: stable # 4.19 +Cc: Jimmy Assarsson +Cc: Christer Beskow +Cc: Nicklas Johansson +Cc: Martin Henriksson +Signed-off-by: Johan Hovold +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +- + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +@@ -1590,7 +1590,7 @@ static int kvaser_usb_hydra_setup_endpoi + struct usb_endpoint_descriptor *ep; + int i; + +- iface_desc = &dev->intf->altsetting[0]; ++ iface_desc = dev->intf->cur_altsetting; + + for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { + ep = &iface_desc->endpoint[i].desc; +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -1310,7 +1310,7 @@ static int kvaser_usb_leaf_setup_endpoin + struct usb_endpoint_descriptor *endpoint; + int i; + +- iface_desc = &dev->intf->altsetting[0]; ++ iface_desc = dev->intf->cur_altsetting; + + for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { + endpoint = &iface_desc->endpoint[i].desc; diff --git a/queue-5.4/can-mscan-mscan_rx_poll-fix-rx-path-lockup-when-returning-from-polling-to-irq-mode.patch b/queue-5.4/can-mscan-mscan_rx_poll-fix-rx-path-lockup-when-returning-from-polling-to-irq-mode.patch new file mode 100644 index 00000000000..d443ebffc14 --- /dev/null +++ b/queue-5.4/can-mscan-mscan_rx_poll-fix-rx-path-lockup-when-returning-from-polling-to-irq-mode.patch @@ -0,0 +1,75 @@ +From 2d77bd61a2927be8f4e00d9478fe6996c47e8d45 Mon Sep 17 00:00:00 2001 +From: Florian Faber +Date: Thu, 26 Dec 2019 19:51:24 +0100 +Subject: can: mscan: mscan_rx_poll(): fix rx path lockup when returning from polling to irq mode + +From: Florian Faber + +commit 2d77bd61a2927be8f4e00d9478fe6996c47e8d45 upstream. + +Under load, the RX side of the mscan driver can get stuck while TX still +works. Restarting the interface locks up the system. This behaviour +could be reproduced reliably on a MPC5121e based system. + +The patch fixes the return value of the NAPI polling function (should be +the number of processed packets, not constant 1) and the condition under +which IRQs are enabled again after polling is finished. + +With this patch, no more lockups were observed over a test period of ten +days. + +Fixes: afa17a500a36 ("net/can: add driver for mscan family & mpc52xx_mscan") +Signed-off-by: Florian Faber +Cc: linux-stable +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/mscan/mscan.c | 21 ++++++++++----------- + 1 file changed, 10 insertions(+), 11 deletions(-) + +--- a/drivers/net/can/mscan/mscan.c ++++ b/drivers/net/can/mscan/mscan.c +@@ -381,13 +381,12 @@ static int mscan_rx_poll(struct napi_str + struct net_device *dev = napi->dev; + struct mscan_regs __iomem *regs = priv->reg_base; + struct net_device_stats *stats = &dev->stats; +- int npackets = 0; +- int ret = 1; ++ int work_done = 0; + struct sk_buff *skb; + struct can_frame *frame; + u8 canrflg; + +- while (npackets < quota) { ++ while (work_done < quota) { + canrflg = in_8(®s->canrflg); + if (!(canrflg & (MSCAN_RXF | MSCAN_ERR_IF))) + break; +@@ -408,18 +407,18 @@ static int mscan_rx_poll(struct napi_str + + stats->rx_packets++; + stats->rx_bytes += frame->can_dlc; +- npackets++; ++ work_done++; + netif_receive_skb(skb); + } + +- if (!(in_8(®s->canrflg) & (MSCAN_RXF | MSCAN_ERR_IF))) { +- napi_complete(&priv->napi); +- clear_bit(F_RX_PROGRESS, &priv->flags); +- if (priv->can.state < CAN_STATE_BUS_OFF) +- out_8(®s->canrier, priv->shadow_canrier); +- ret = 0; ++ if (work_done < quota) { ++ if (likely(napi_complete_done(&priv->napi, work_done))) { ++ clear_bit(F_RX_PROGRESS, &priv->flags); ++ if (priv->can.state < CAN_STATE_BUS_OFF) ++ out_8(®s->canrier, priv->shadow_canrier); ++ } + } +- return ret; ++ return work_done; + } + + static irqreturn_t mscan_isr(int irq, void *dev_id) diff --git a/queue-5.4/can-tcan4x5x-tcan4x5x_can_probe-get-the-device-out-of-standby-before-register-access.patch b/queue-5.4/can-tcan4x5x-tcan4x5x_can_probe-get-the-device-out-of-standby-before-register-access.patch new file mode 100644 index 00000000000..576b7cc03bf --- /dev/null +++ b/queue-5.4/can-tcan4x5x-tcan4x5x_can_probe-get-the-device-out-of-standby-before-register-access.patch @@ -0,0 +1,47 @@ +From 3069ce620daed85e4ef2b0c087dca2509f809470 Mon Sep 17 00:00:00 2001 +From: Sean Nyekjaer +Date: Wed, 11 Dec 2019 14:58:52 +0100 +Subject: can: tcan4x5x: tcan4x5x_can_probe(): get the device out of standby before register access + +From: Sean Nyekjaer + +commit 3069ce620daed85e4ef2b0c087dca2509f809470 upstream. + +The m_can tries to detect if Non ISO Operation is available while in +standby mode, this function results in the following error: + +| tcan4x5x spi2.0 (unnamed net_device) (uninitialized): Failed to init module +| tcan4x5x spi2.0: m_can device registered (irq=84, version=32) +| tcan4x5x spi2.0 can2: TCAN4X5X successfully initialized. + +When the tcan device comes out of reset it goes in standby mode. The +m_can driver tries to access the control register but fails due to the +device being in standby mode. + +So this patch will put the tcan device in normal mode before the m_can +driver does the initialization. + +Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel") +Cc: stable@vger.kernel.org +Signed-off-by: Sean Nyekjaer +Acked-by: Dan Murphy +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/m_can/tcan4x5x.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/can/m_can/tcan4x5x.c ++++ b/drivers/net/can/m_can/tcan4x5x.c +@@ -445,6 +445,10 @@ static int tcan4x5x_can_probe(struct spi + + tcan4x5x_power_enable(priv->power, 1); + ++ ret = tcan4x5x_init(mcan_class); ++ if (ret) ++ goto out_power; ++ + ret = m_can_class_register(mcan_class); + if (ret) + goto out_power; diff --git a/queue-5.4/clone3-ensure-copy_thread_tls-is-implemented.patch b/queue-5.4/clone3-ensure-copy_thread_tls-is-implemented.patch new file mode 100644 index 00000000000..d0489a0af23 --- /dev/null +++ b/queue-5.4/clone3-ensure-copy_thread_tls-is-implemented.patch @@ -0,0 +1,43 @@ +From dd499f7a7e34270208350a849ef103c0b3ae477f Mon Sep 17 00:00:00 2001 +From: Amanieu d'Antras +Date: Thu, 2 Jan 2020 18:24:13 +0100 +Subject: clone3: ensure copy_thread_tls is implemented + +From: Amanieu d'Antras + +commit dd499f7a7e34270208350a849ef103c0b3ae477f upstream. + +copy_thread implementations handle CLONE_SETTLS by reading the TLS +value from the registers containing the syscall arguments for +clone. This doesn't work with clone3 since the TLS value is passed +in clone_args instead. + +Signed-off-by: Amanieu d'Antras +Cc: # 5.3.x +Link: https://lore.kernel.org/r/20200102172413.654385-8-amanieu@gmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/fork.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -2513,6 +2513,16 @@ SYSCALL_DEFINE5(clone, unsigned long, cl + #endif + + #ifdef __ARCH_WANT_SYS_CLONE3 ++ ++/* ++ * copy_thread implementations handle CLONE_SETTLS by reading the TLS value from ++ * the registers containing the syscall arguments for clone. This doesn't work ++ * with clone3 since the TLS value is passed in clone_args instead. ++ */ ++#ifndef CONFIG_HAVE_COPY_THREAD_TLS ++#error clone3 requires copy_thread_tls support in arch ++#endif ++ + noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs, + struct clone_args __user *uargs, + size_t usize) diff --git a/queue-5.4/gpiolib-acpi-add-honor_wakeup-module-option-quirk-mechanism.patch b/queue-5.4/gpiolib-acpi-add-honor_wakeup-module-option-quirk-mechanism.patch new file mode 100644 index 00000000000..2e21c26670b --- /dev/null +++ b/queue-5.4/gpiolib-acpi-add-honor_wakeup-module-option-quirk-mechanism.patch @@ -0,0 +1,106 @@ +From aa23ca3d98f756d5b1e503fb140665fb24a41a38 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sun, 5 Jan 2020 17:03:57 +0100 +Subject: gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism + +From: Hans de Goede + +commit aa23ca3d98f756d5b1e503fb140665fb24a41a38 upstream. + +On some laptops enabling wakeup on the GPIO interrupts used for ACPI _AEI +event handling causes spurious wakeups. + +This commit adds a new honor_wakeup option, defaulting to true (our current +behavior), which can be used to disable wakeup on troublesome hardware +to avoid these spurious wakeups. + +This is a workaround for an architectural problem with s2idle under Linux +where we do not have any mechanism to immediately go back to sleep after +wakeup events, other then for embedded-controller events using the standard +ACPI EC interface, for details see: +https://lore.kernel.org/linux-acpi/61450f9b-cbc6-0c09-8b3a-aff6bf9a0b3c@redhat.com/ + +One series of laptops which is not able to suspend without this workaround +is the HP x2 10 Cherry Trail models, this commit adds a DMI based quirk +which makes sets honor_wakeup to false on these models. + +Cc: stable@vger.kernel.org +Reviewed-by: Andy Shevchenko +Acked-by: Mika Westerberg +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20200105160357.97154-3-hdegoede@redhat.com +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/gpiolib-acpi.c | 32 +++++++++++++++++++++++++++++++- + 1 file changed, 31 insertions(+), 1 deletion(-) + +--- a/drivers/gpio/gpiolib-acpi.c ++++ b/drivers/gpio/gpiolib-acpi.c +@@ -22,12 +22,18 @@ + #include "gpiolib-acpi.h" + + #define QUIRK_NO_EDGE_EVENTS_ON_BOOT 0x01l ++#define QUIRK_NO_WAKEUP 0x02l + + static int run_edge_events_on_boot = -1; + module_param(run_edge_events_on_boot, int, 0444); + MODULE_PARM_DESC(run_edge_events_on_boot, + "Run edge _AEI event-handlers at boot: 0=no, 1=yes, -1=auto"); + ++static int honor_wakeup = -1; ++module_param(honor_wakeup, int, 0444); ++MODULE_PARM_DESC(honor_wakeup, ++ "Honor the ACPI wake-capable flag: 0=no, 1=yes, -1=auto"); ++ + /** + * struct acpi_gpio_event - ACPI GPIO event handler data + * +@@ -276,7 +282,7 @@ static acpi_status acpi_gpiochip_alloc_e + event->handle = evt_handle; + event->handler = handler; + event->irq = irq; +- event->irq_is_wake = agpio->wake_capable == ACPI_WAKE_CAPABLE; ++ event->irq_is_wake = honor_wakeup && agpio->wake_capable == ACPI_WAKE_CAPABLE; + event->pin = pin; + event->desc = desc; + +@@ -1330,6 +1336,23 @@ static const struct dmi_system_id gpioli + }, + .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT, + }, ++ { ++ /* ++ * Various HP X2 10 Cherry Trail models use an external ++ * embedded-controller connected via I2C + an ACPI GPIO ++ * event handler. The embedded controller generates various ++ * spurious wakeup events when suspended. So disable wakeup ++ * for its handler (it uses the only ACPI GPIO event handler). ++ * This breaks wakeup when opening the lid, the user needs ++ * to press the power-button to wakeup the system. The ++ * alternative is suspend simply not working, which is worse. ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP x2 Detachable 10-p0XX"), ++ }, ++ .driver_data = (void *)QUIRK_NO_WAKEUP, ++ }, + {} /* Terminating entry */ + }; + +@@ -1349,6 +1372,13 @@ static int acpi_gpio_setup_params(void) + run_edge_events_on_boot = 1; + } + ++ if (honor_wakeup < 0) { ++ if (quirks & QUIRK_NO_WAKEUP) ++ honor_wakeup = 0; ++ else ++ honor_wakeup = 1; ++ } ++ + return 0; + } + diff --git a/queue-5.4/gpiolib-acpi-turn-dmi_system_id-table-into-a-generic-quirk-table.patch b/queue-5.4/gpiolib-acpi-turn-dmi_system_id-table-into-a-generic-quirk-table.patch new file mode 100644 index 00000000000..fd57f2560b6 --- /dev/null +++ b/queue-5.4/gpiolib-acpi-turn-dmi_system_id-table-into-a-generic-quirk-table.patch @@ -0,0 +1,82 @@ +From 1ad1b54099c231aed8f6f257065c1b322583f264 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sun, 5 Jan 2020 17:03:56 +0100 +Subject: gpiolib: acpi: Turn dmi_system_id table into a generic quirk table + +From: Hans de Goede + +commit 1ad1b54099c231aed8f6f257065c1b322583f264 upstream. + +Turn the existing run_edge_events_on_boot_blacklist dmi_system_id table +into a generic quirk table, storing the quirks in the driver_data ptr. + +This is a preparation patch for adding other types of (DMI based) quirks. + +Cc: stable@vger.kernel.org +Reviewed-by: Andy Shevchenko +Acked-by: Mika Westerberg +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20200105160357.97154-2-hdegoede@redhat.com +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/gpiolib-acpi.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +--- a/drivers/gpio/gpiolib-acpi.c ++++ b/drivers/gpio/gpiolib-acpi.c +@@ -21,6 +21,8 @@ + #include "gpiolib.h" + #include "gpiolib-acpi.h" + ++#define QUIRK_NO_EDGE_EVENTS_ON_BOOT 0x01l ++ + static int run_edge_events_on_boot = -1; + module_param(run_edge_events_on_boot, int, 0444); + MODULE_PARM_DESC(run_edge_events_on_boot, +@@ -1302,7 +1304,7 @@ static int acpi_gpio_handle_deferred_req + /* We must use _sync so that this runs after the first deferred_probe run */ + late_initcall_sync(acpi_gpio_handle_deferred_request_irqs); + +-static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = { ++static const struct dmi_system_id gpiolib_acpi_quirks[] = { + { + /* + * The Minix Neo Z83-4 has a micro-USB-B id-pin handler for +@@ -1312,7 +1314,8 @@ static const struct dmi_system_id run_ed + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "MINIX"), + DMI_MATCH(DMI_PRODUCT_NAME, "Z83-4"), +- } ++ }, ++ .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT, + }, + { + /* +@@ -1324,15 +1327,23 @@ static const struct dmi_system_id run_ed + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Wortmann_AG"), + DMI_MATCH(DMI_PRODUCT_NAME, "TERRA_PAD_1061"), +- } ++ }, ++ .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT, + }, + {} /* Terminating entry */ + }; + + static int acpi_gpio_setup_params(void) + { ++ const struct dmi_system_id *id; ++ long quirks = 0; ++ ++ id = dmi_first_match(gpiolib_acpi_quirks); ++ if (id) ++ quirks = (long)id->driver_data; ++ + if (run_edge_events_on_boot < 0) { +- if (dmi_check_system(run_edge_events_on_boot_blacklist)) ++ if (quirks & QUIRK_NO_EDGE_EVENTS_ON_BOOT) + run_edge_events_on_boot = 0; + else + run_edge_events_on_boot = 1; diff --git a/queue-5.4/iommu-vt-d-fix-adding-non-pci-devices-to-intel-iommu.patch b/queue-5.4/iommu-vt-d-fix-adding-non-pci-devices-to-intel-iommu.patch new file mode 100644 index 00000000000..4724e752de1 --- /dev/null +++ b/queue-5.4/iommu-vt-d-fix-adding-non-pci-devices-to-intel-iommu.patch @@ -0,0 +1,87 @@ +From 4a350a0ee5b0a14f826fcdf60dd1a3199cafbfd6 Mon Sep 17 00:00:00 2001 +From: Patrick Steinhardt +Date: Fri, 27 Dec 2019 00:56:18 +0100 +Subject: iommu/vt-d: Fix adding non-PCI devices to Intel IOMMU + +From: Patrick Steinhardt + +commit 4a350a0ee5b0a14f826fcdf60dd1a3199cafbfd6 upstream. + +Starting with commit fa212a97f3a3 ("iommu/vt-d: Probe DMA-capable ACPI +name space devices"), we now probe DMA-capable ACPI name +space devices. On Dell XPS 13 9343, which has an Intel LPSS platform +device INTL9C60 enumerated via ACPI, this change leads to the following +warning: + + ------------[ cut here ]------------ + WARNING: CPU: 1 PID: 1 at pci_device_group+0x11a/0x130 + CPU: 1 PID: 1 Comm: swapper/0 Tainted: G T 5.5.0-rc3+ #22 + Hardware name: Dell Inc. XPS 13 9343/0310JH, BIOS A20 06/06/2019 + RIP: 0010:pci_device_group+0x11a/0x130 + Code: f0 ff ff 48 85 c0 49 89 c4 75 c4 48 8d 74 24 10 48 89 ef e8 48 ef ff ff 48 85 c0 49 89 c4 75 af e8 db f7 ff ff 49 89 c4 eb a5 <0f> 0b 49 c7 c4 ea ff ff ff eb 9a e8 96 1e c7 ff 66 0f 1f 44 00 00 + RSP: 0000:ffffc0d6c0043cb0 EFLAGS: 00010202 + RAX: 0000000000000000 RBX: ffffa3d1d43dd810 RCX: 0000000000000000 + RDX: ffffa3d1d4fecf80 RSI: ffffa3d12943dcc0 RDI: ffffa3d1d43dd810 + RBP: ffffa3d1d43dd810 R08: 0000000000000000 R09: ffffa3d1d4c04a80 + R10: ffffa3d1d4c00880 R11: ffffa3d1d44ba000 R12: 0000000000000000 + R13: ffffa3d1d4383b80 R14: ffffa3d1d4c090d0 R15: ffffa3d1d4324530 + FS: 0000000000000000(0000) GS:ffffa3d1d6700000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000000 CR3: 000000000460a001 CR4: 00000000003606e0 + Call Trace: + ? iommu_group_get_for_dev+0x81/0x1f0 + ? intel_iommu_add_device+0x61/0x170 + ? iommu_probe_device+0x43/0xd0 + ? intel_iommu_init+0x1fa2/0x2235 + ? pci_iommu_init+0x52/0xe7 + ? e820__memblock_setup+0x15c/0x15c + ? do_one_initcall+0xcc/0x27e + ? kernel_init_freeable+0x169/0x259 + ? rest_init+0x95/0x95 + ? kernel_init+0x5/0xeb + ? ret_from_fork+0x35/0x40 + ---[ end trace 28473e7abc25b92c ]--- + DMAR: ACPI name space devices didn't probe correctly + +The bug results from the fact that while we now enumerate ACPI devices, +we aren't able to handle any non-PCI device when generating the device +group. Fix the issue by implementing an Intel-specific callback that +returns `pci_device_group` only if the device is a PCI device. +Otherwise, it will return a generic device group. + +Fixes: fa212a97f3a3 ("iommu/vt-d: Probe DMA-capable ACPI name space devices") +Signed-off-by: Patrick Steinhardt +Cc: stable@vger.kernel.org # v5.3+ +Acked-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/intel-iommu.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -5786,6 +5786,13 @@ static void intel_iommu_apply_resv_regio + WARN_ON_ONCE(!reserve_iova(&dmar_domain->iovad, start, end)); + } + ++static struct iommu_group *intel_iommu_device_group(struct device *dev) ++{ ++ if (dev_is_pci(dev)) ++ return pci_device_group(dev); ++ return generic_device_group(dev); ++} ++ + #ifdef CONFIG_INTEL_IOMMU_SVM + struct intel_iommu *intel_svm_device_to_iommu(struct device *dev) + { +@@ -5958,7 +5965,7 @@ const struct iommu_ops intel_iommu_ops = + .get_resv_regions = intel_iommu_get_resv_regions, + .put_resv_regions = intel_iommu_put_resv_regions, + .apply_resv_region = intel_iommu_apply_resv_region, +- .device_group = pci_device_group, ++ .device_group = intel_iommu_device_group, + .dev_has_feat = intel_iommu_dev_has_feat, + .dev_feat_enabled = intel_iommu_dev_feat_enabled, + .dev_enable_feat = intel_iommu_dev_enable_feat, diff --git a/queue-5.4/parisc-implement-copy_thread_tls.patch b/queue-5.4/parisc-implement-copy_thread_tls.patch new file mode 100644 index 00000000000..2081d49f391 --- /dev/null +++ b/queue-5.4/parisc-implement-copy_thread_tls.patch @@ -0,0 +1,59 @@ +From d2f36c787b2181561d8b95814f8cdad64b348ad7 Mon Sep 17 00:00:00 2001 +From: Amanieu d'Antras +Date: Thu, 2 Jan 2020 18:24:10 +0100 +Subject: parisc: Implement copy_thread_tls + +From: Amanieu d'Antras + +commit d2f36c787b2181561d8b95814f8cdad64b348ad7 upstream. + +This is required for clone3 which passes the TLS value through a +struct rather than a register. + +Signed-off-by: Amanieu d'Antras +Cc: linux-parisc@vger.kernel.org +Cc: # 5.3.x +Link: https://lore.kernel.org/r/20200102172413.654385-5-amanieu@gmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/Kconfig | 1 + + arch/parisc/kernel/process.c | 8 ++++---- + 2 files changed, 5 insertions(+), 4 deletions(-) + +--- a/arch/parisc/Kconfig ++++ b/arch/parisc/Kconfig +@@ -62,6 +62,7 @@ config PARISC + select HAVE_FTRACE_MCOUNT_RECORD if HAVE_DYNAMIC_FTRACE + select HAVE_KPROBES_ON_FTRACE + select HAVE_DYNAMIC_FTRACE_WITH_REGS ++ select HAVE_COPY_THREAD_TLS + + help + The PA-RISC microprocessor is designed by Hewlett-Packard and used +--- a/arch/parisc/kernel/process.c ++++ b/arch/parisc/kernel/process.c +@@ -208,8 +208,8 @@ arch_initcall(parisc_idle_init); + * Copy architecture-specific thread state + */ + int +-copy_thread(unsigned long clone_flags, unsigned long usp, +- unsigned long kthread_arg, struct task_struct *p) ++copy_thread_tls(unsigned long clone_flags, unsigned long usp, ++ unsigned long kthread_arg, struct task_struct *p, unsigned long tls) + { + struct pt_regs *cregs = &(p->thread.regs); + void *stack = task_stack_page(p); +@@ -254,9 +254,9 @@ copy_thread(unsigned long clone_flags, u + cregs->ksp = (unsigned long)stack + THREAD_SZ_ALGN + FRAME_SIZE; + cregs->kpc = (unsigned long) &child_return; + +- /* Setup thread TLS area from the 4th parameter in clone */ ++ /* Setup thread TLS area */ + if (clone_flags & CLONE_SETTLS) +- cregs->cr27 = cregs->gr[23]; ++ cregs->cr27 = tls; + } + + return 0; diff --git a/queue-5.4/pstore-ram-regularize-prz-label-allocation-lifetime.patch b/queue-5.4/pstore-ram-regularize-prz-label-allocation-lifetime.patch new file mode 100644 index 00000000000..64988c9d96b --- /dev/null +++ b/queue-5.4/pstore-ram-regularize-prz-label-allocation-lifetime.patch @@ -0,0 +1,73 @@ +From e163fdb3f7f8c62dccf194f3f37a7bcb3c333aa8 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Wed, 8 Jan 2020 10:06:54 -0800 +Subject: pstore/ram: Regularize prz label allocation lifetime + +From: Kees Cook + +commit e163fdb3f7f8c62dccf194f3f37a7bcb3c333aa8 upstream. + +In my attempt to fix a memory leak, I introduced a double-free in the +pstore error path. Instead of trying to manage the allocation lifetime +between persistent_ram_new() and its callers, adjust the logic so +persistent_ram_new() always takes a kstrdup() copy, and leaves the +caller's allocation lifetime up to the caller. Therefore callers are +_always_ responsible for freeing their label. Before, it only needed +freeing when the prz itself failed to allocate, and not in any of the +other prz failure cases, which callers would have no visibility into, +which is the root design problem that lead to both the leak and now +double-free bugs. + +Reported-by: Cengiz Can +Link: https://lore.kernel.org/lkml/d4ec59002ede4aaf9928c7f7526da87c@kernel.wtf +Fixes: 8df955a32a73 ("pstore/ram: Fix error-path memory leak in persistent_ram_new() callers") +Cc: stable@vger.kernel.org +Signed-off-by: Kees Cook +Signed-off-by: Greg Kroah-Hartman + +--- + fs/pstore/ram.c | 4 ++-- + fs/pstore/ram_core.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/pstore/ram.c ++++ b/fs/pstore/ram.c +@@ -583,12 +583,12 @@ static int ramoops_init_przs(const char + prz_ar[i] = persistent_ram_new(*paddr, zone_sz, sig, + &cxt->ecc_info, + cxt->memtype, flags, label); ++ kfree(label); + if (IS_ERR(prz_ar[i])) { + err = PTR_ERR(prz_ar[i]); + dev_err(dev, "failed to request %s mem region (0x%zx@0x%llx): %d\n", + name, record_size, + (unsigned long long)*paddr, err); +- kfree(label); + + while (i > 0) { + i--; +@@ -629,12 +629,12 @@ static int ramoops_init_prz(const char * + label = kasprintf(GFP_KERNEL, "ramoops:%s", name); + *prz = persistent_ram_new(*paddr, sz, sig, &cxt->ecc_info, + cxt->memtype, PRZ_FLAG_ZAP_OLD, label); ++ kfree(label); + if (IS_ERR(*prz)) { + int err = PTR_ERR(*prz); + + dev_err(dev, "failed to request %s mem region (0x%zx@0x%llx): %d\n", + name, sz, (unsigned long long)*paddr, err); +- kfree(label); + return err; + } + +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -574,7 +574,7 @@ struct persistent_ram_zone *persistent_r + /* Initialize general buffer state. */ + raw_spin_lock_init(&prz->buffer_lock); + prz->flags = flags; +- prz->label = label; ++ prz->label = kstrdup(label, GFP_KERNEL); + + ret = persistent_ram_buffer_map(start, size, prz, memtype); + if (ret) diff --git a/queue-5.4/riscv-implement-copy_thread_tls.patch b/queue-5.4/riscv-implement-copy_thread_tls.patch new file mode 100644 index 00000000000..a179ca619c0 --- /dev/null +++ b/queue-5.4/riscv-implement-copy_thread_tls.patch @@ -0,0 +1,56 @@ +From 20bda4ed62f507ed72e30e817b43c65fdba60be7 Mon Sep 17 00:00:00 2001 +From: Amanieu d'Antras +Date: Thu, 2 Jan 2020 18:24:11 +0100 +Subject: riscv: Implement copy_thread_tls + +From: Amanieu d'Antras + +commit 20bda4ed62f507ed72e30e817b43c65fdba60be7 upstream. + +This is required for clone3 which passes the TLS value through a +struct rather than a register. + +Signed-off-by: Amanieu d'Antras +Cc: linux-riscv@lists.infradead.org +Cc: # 5.3.x +Link: https://lore.kernel.org/r/20200102172413.654385-6-amanieu@gmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Greg Kroah-Hartman + +--- + arch/riscv/Kconfig | 1 + + arch/riscv/kernel/process.c | 6 +++--- + 2 files changed, 4 insertions(+), 3 deletions(-) + +--- a/arch/riscv/Kconfig ++++ b/arch/riscv/Kconfig +@@ -61,6 +61,7 @@ config RISCV + select SPARSEMEM_STATIC if 32BIT + select ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT if MMU + select HAVE_ARCH_MMAP_RND_BITS ++ select HAVE_COPY_THREAD_TLS + + config ARCH_MMAP_RND_BITS_MIN + default 18 if 64BIT +--- a/arch/riscv/kernel/process.c ++++ b/arch/riscv/kernel/process.c +@@ -99,8 +99,8 @@ int arch_dup_task_struct(struct task_str + return 0; + } + +-int copy_thread(unsigned long clone_flags, unsigned long usp, +- unsigned long arg, struct task_struct *p) ++int copy_thread_tls(unsigned long clone_flags, unsigned long usp, ++ unsigned long arg, struct task_struct *p, unsigned long tls) + { + struct pt_regs *childregs = task_pt_regs(p); + +@@ -120,7 +120,7 @@ int copy_thread(unsigned long clone_flag + if (usp) /* User fork */ + childregs->sp = usp; + if (clone_flags & CLONE_SETTLS) +- childregs->tp = childregs->a5; ++ childregs->tp = tls; + childregs->a0 = 0; /* Return value of fork() */ + p->thread.ra = (unsigned long)ret_from_fork; + } diff --git a/queue-5.4/serdev-don-t-claim-unsupported-acpi-serial-devices.patch b/queue-5.4/serdev-don-t-claim-unsupported-acpi-serial-devices.patch new file mode 100644 index 00000000000..6ab122992a7 --- /dev/null +++ b/queue-5.4/serdev-don-t-claim-unsupported-acpi-serial-devices.patch @@ -0,0 +1,57 @@ +From c5ee0b3104e0b292d353e63fd31cb8c692645d8c Mon Sep 17 00:00:00 2001 +From: Punit Agrawal +Date: Thu, 19 Dec 2019 19:03:45 +0900 +Subject: serdev: Don't claim unsupported ACPI serial devices + +From: Punit Agrawal + +commit c5ee0b3104e0b292d353e63fd31cb8c692645d8c upstream. + +Serdev sub-system claims all ACPI serial devices that are not already +initialised. As a result, no device node is created for serial ports +on certain boards such as the Apollo Lake based UP2. This has the +unintended consequence of not being able to raise the login prompt via +serial connection. + +Introduce a blacklist to reject ACPI serial devices that should not be +claimed by serdev sub-system. Add the peripheral ids for Intel HS UART +to the blacklist to bring back serial port on SoCs carrying them. + +Cc: stable@vger.kernel.org +Signed-off-by: Punit Agrawal +Acked-by: Hans de Goede +Acked-by: Johan Hovold +Cc: Rob Herring +Link: https://lore.kernel.org/r/20191219100345.911093-1-punit1.agrawal@toshiba.co.jp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serdev/core.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/tty/serdev/core.c ++++ b/drivers/tty/serdev/core.c +@@ -582,6 +582,12 @@ static acpi_status acpi_serdev_register_ + return AE_OK; + } + ++static const struct acpi_device_id serdev_acpi_devices_blacklist[] = { ++ { "INT3511", 0 }, ++ { "INT3512", 0 }, ++ { }, ++}; ++ + static acpi_status acpi_serdev_add_device(acpi_handle handle, u32 level, + void *data, void **return_value) + { +@@ -591,6 +597,10 @@ static acpi_status acpi_serdev_add_devic + if (acpi_bus_get_device(handle, &adev)) + return AE_OK; + ++ /* Skip if black listed */ ++ if (!acpi_match_device_ids(adev, serdev_acpi_devices_blacklist)) ++ return AE_OK; ++ + return acpi_serdev_register_device(ctrl, adev); + } + diff --git a/queue-5.4/series b/queue-5.4/series index 87f03992ad8..8e3b6cfac50 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -29,3 +29,36 @@ drm-dp_mst-correct-the-shifting-in-dp_remote_i2c_read.patch drm-i915-add-wa_1407352427-icl-ehl.patch drm-i915-gt-mark-up-virtual-engine-uabi_instance.patch ib-hfi1-adjust-flow-psn-with-the-correct-resync_psn.patch +can-kvaser_usb-fix-interface-sanity-check.patch +can-gs_usb-gs_usb_probe-use-descriptors-of-current-altsetting.patch +can-tcan4x5x-tcan4x5x_can_probe-get-the-device-out-of-standby-before-register-access.patch +can-mscan-mscan_rx_poll-fix-rx-path-lockup-when-returning-from-polling-to-irq-mode.patch +can-can_dropped_invalid_skb-ensure-an-initialized-headroom-in-outgoing-can-sk_buffs.patch +gpiolib-acpi-turn-dmi_system_id-table-into-a-generic-quirk-table.patch +gpiolib-acpi-add-honor_wakeup-module-option-quirk-mechanism.patch +pstore-ram-regularize-prz-label-allocation-lifetime.patch +staging-vt6656-set-usb_set_intfdata-on-driver-fail.patch +staging-vt6656-fix-non-zero-logical-return-of-usb_control_msg.patch +usb-cdns3-should-not-use-the-same-dev_id-for-shared-interrupt-handler.patch +usb-ohci-da8xx-ensure-error-return-on-variable-error-is-set.patch +usb-pd-tcpm-bad-warning-size-pps-adapters.patch +usb-serial-option-add-zlp-support-for-0x1bc7-0x9010.patch +usb-musb-fix-idling-for-suspend-after-disconnect-interrupt.patch +usb-musb-disable-pullup-at-init.patch +usb-musb-dma-correct-parameter-passed-to-irq-handler.patch +staging-comedi-adv_pci1710-fix-ai-channels-16-31-for-pci-1713.patch +staging-vt6656-correct-return-of-vnt_init_registers.patch +staging-vt6656-limit-reg-output-to-block-size.patch +staging-rtl8188eu-add-device-code-for-tp-link-tl-wn727n-v5.21.patch +serdev-don-t-claim-unsupported-acpi-serial-devices.patch +iommu-vt-d-fix-adding-non-pci-devices-to-intel-iommu.patch +tty-link-tty-and-port-before-configuring-it-as-console.patch +tty-always-relink-the-port.patch +arm64-move-__arch_want_sys_clone3-definition-to-uapi-headers.patch +arm64-implement-copy_thread_tls.patch +arm-implement-copy_thread_tls.patch +parisc-implement-copy_thread_tls.patch +riscv-implement-copy_thread_tls.patch +xtensa-implement-copy_thread_tls.patch +clone3-ensure-copy_thread_tls-is-implemented.patch +um-implement-copy_thread_tls.patch diff --git a/queue-5.4/staging-comedi-adv_pci1710-fix-ai-channels-16-31-for-pci-1713.patch b/queue-5.4/staging-comedi-adv_pci1710-fix-ai-channels-16-31-for-pci-1713.patch new file mode 100644 index 00000000000..5d06ef65702 --- /dev/null +++ b/queue-5.4/staging-comedi-adv_pci1710-fix-ai-channels-16-31-for-pci-1713.patch @@ -0,0 +1,41 @@ +From a9d3a9cedc1330c720e0ddde1978a8e7771da5ab Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Fri, 27 Dec 2019 17:00:54 +0000 +Subject: staging: comedi: adv_pci1710: fix AI channels 16-31 for PCI-1713 + +From: Ian Abbott + +commit a9d3a9cedc1330c720e0ddde1978a8e7771da5ab upstream. + +The Advantech PCI-1713 has 32 analog input channels, but an incorrect +bit-mask in the definition of the `PCI171X_MUX_CHANH(x)` and +PCI171X_MUX_CHANL(x)` macros is causing channels 16 to 31 to be aliases +of channels 0 to 15. Change the bit-mask value from 0xf to 0xff to fix +it. Note that the channel numbers will have been range checked already, +so the bit-mask isn't really needed. + +Fixes: 92c65e5553ed ("staging: comedi: adv_pci1710: define the mux control register bits") +Reported-by: Dmytro Fil +Cc: # v4.5+ +Signed-off-by: Ian Abbott +Link: https://lore.kernel.org/r/20191227170054.32051-1-abbotti@mev.co.uk +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/adv_pci1710.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/staging/comedi/drivers/adv_pci1710.c ++++ b/drivers/staging/comedi/drivers/adv_pci1710.c +@@ -46,8 +46,8 @@ + #define PCI171X_RANGE_UNI BIT(4) + #define PCI171X_RANGE_GAIN(x) (((x) & 0x7) << 0) + #define PCI171X_MUX_REG 0x04 /* W: A/D multiplexor control */ +-#define PCI171X_MUX_CHANH(x) (((x) & 0xf) << 8) +-#define PCI171X_MUX_CHANL(x) (((x) & 0xf) << 0) ++#define PCI171X_MUX_CHANH(x) (((x) & 0xff) << 8) ++#define PCI171X_MUX_CHANL(x) (((x) & 0xff) << 0) + #define PCI171X_MUX_CHAN(x) (PCI171X_MUX_CHANH(x) | PCI171X_MUX_CHANL(x)) + #define PCI171X_STATUS_REG 0x06 /* R: status register */ + #define PCI171X_STATUS_IRQ BIT(11) /* 1=IRQ occurred */ diff --git a/queue-5.4/staging-rtl8188eu-add-device-code-for-tp-link-tl-wn727n-v5.21.patch b/queue-5.4/staging-rtl8188eu-add-device-code-for-tp-link-tl-wn727n-v5.21.patch new file mode 100644 index 00000000000..1e065deea21 --- /dev/null +++ b/queue-5.4/staging-rtl8188eu-add-device-code-for-tp-link-tl-wn727n-v5.21.patch @@ -0,0 +1,32 @@ +From 58dcc5bf4030cab548d5c98cd4cd3632a5444d5a Mon Sep 17 00:00:00 2001 +From: Michael Straube +Date: Sat, 28 Dec 2019 15:37:25 +0100 +Subject: staging: rtl8188eu: Add device code for TP-Link TL-WN727N v5.21 + +From: Michael Straube + +commit 58dcc5bf4030cab548d5c98cd4cd3632a5444d5a upstream. + +This device was added to the stand-alone driver on github. +Add it to the staging driver as well. + +Link: https://github.com/lwfinger/rtl8188eu/commit/b9b537aa25a8 +Signed-off-by: Michael Straube +Cc: stable +Link: https://lore.kernel.org/r/20191228143725.24455-1-straube.linux@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c ++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +@@ -37,6 +37,7 @@ static const struct usb_device_id rtw_us + {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */ + {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */ + {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */ ++ {USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */ + {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */ + {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */ + {} /* Terminating entry */ diff --git a/queue-5.4/staging-vt6656-correct-return-of-vnt_init_registers.patch b/queue-5.4/staging-vt6656-correct-return-of-vnt_init_registers.patch new file mode 100644 index 00000000000..2b7c4f2ac28 --- /dev/null +++ b/queue-5.4/staging-vt6656-correct-return-of-vnt_init_registers.patch @@ -0,0 +1,31 @@ +From 7de6155c8968a3342d1bef3f7a2084d31ae6e4be Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Fri, 20 Dec 2019 21:15:09 +0000 +Subject: staging: vt6656: correct return of vnt_init_registers. + +From: Malcolm Priestley + +commit 7de6155c8968a3342d1bef3f7a2084d31ae6e4be upstream. + +The driver standard error returns remove bool false conditions. + +Cc: stable # v5.3+ +Signed-off-by: Malcolm Priestley +Link: https://lore.kernel.org/r/072ec0b3-425f-277e-130c-1e3a116c90d6@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/main_usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/vt6656/main_usb.c ++++ b/drivers/staging/vt6656/main_usb.c +@@ -950,7 +950,7 @@ static const struct ieee80211_ops vnt_ma + + int vnt_init(struct vnt_private *priv) + { +- if (!(vnt_init_registers(priv))) ++ if (vnt_init_registers(priv)) + return -EAGAIN; + + SET_IEEE80211_PERM_ADDR(priv->hw, priv->permanent_net_addr); diff --git a/queue-5.4/staging-vt6656-fix-non-zero-logical-return-of-usb_control_msg.patch b/queue-5.4/staging-vt6656-fix-non-zero-logical-return-of-usb_control_msg.patch new file mode 100644 index 00000000000..c891fff7a79 --- /dev/null +++ b/queue-5.4/staging-vt6656-fix-non-zero-logical-return-of-usb_control_msg.patch @@ -0,0 +1,53 @@ +From 58c3e681b04dd57c70d0dcb7b69fe52d043ff75a Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Fri, 20 Dec 2019 21:14:59 +0000 +Subject: staging: vt6656: Fix non zero logical return of, usb_control_msg + +From: Malcolm Priestley + +commit 58c3e681b04dd57c70d0dcb7b69fe52d043ff75a upstream. + +Starting with commit 59608cb1de1856 +("staging: vt6656: clean function's error path in usbpipe.c") +the usb control functions have returned errors throughout driver +with only logical variable checking. + +However, usb_control_msg return the amount of bytes transferred +this means that normal operation causes errors. + +Correct the return function so only return zero when transfer +is successful. + +Cc: stable # v5.3+ +Signed-off-by: Malcolm Priestley +Link: https://lore.kernel.org/r/08e88842-6f78-a2e3-a7a0-139fec960b2b@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/usbpipe.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/staging/vt6656/usbpipe.c ++++ b/drivers/staging/vt6656/usbpipe.c +@@ -59,7 +59,9 @@ int vnt_control_out(struct vnt_private * + + kfree(usb_buffer); + +- if (ret >= 0 && ret < (int)length) ++ if (ret == (int)length) ++ ret = 0; ++ else + ret = -EIO; + + end_unlock: +@@ -103,7 +105,9 @@ int vnt_control_in(struct vnt_private *p + + kfree(usb_buffer); + +- if (ret >= 0 && ret < (int)length) ++ if (ret == (int)length) ++ ret = 0; ++ else + ret = -EIO; + + end_unlock: diff --git a/queue-5.4/staging-vt6656-limit-reg-output-to-block-size.patch b/queue-5.4/staging-vt6656-limit-reg-output-to-block-size.patch new file mode 100644 index 00000000000..9c9336669c7 --- /dev/null +++ b/queue-5.4/staging-vt6656-limit-reg-output-to-block-size.patch @@ -0,0 +1,88 @@ +From 69cc1f925e1aa74b96e2ace67e3453a50d091d2f Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Fri, 20 Dec 2019 21:15:24 +0000 +Subject: staging: vt6656: limit reg output to block size + +From: Malcolm Priestley + +commit 69cc1f925e1aa74b96e2ace67e3453a50d091d2f upstream. + +vnt_control_out appears to fail when BBREG is greater than 64 writes. + +Create new function that will relay an array in no larger than +the indicated block size. + +It appears that this command has always failed but was ignored by +driver until the introduction of error checking. + +Cc: stable # v5.3+ +Signed-off-by: Malcolm Priestley +Link: https://lore.kernel.org/r/a41f0601-df46-ce6e-ab7c-35e697946e2a@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/baseband.c | 4 ++-- + drivers/staging/vt6656/usbpipe.c | 17 +++++++++++++++++ + drivers/staging/vt6656/usbpipe.h | 5 +++++ + 3 files changed, 24 insertions(+), 2 deletions(-) + +--- a/drivers/staging/vt6656/baseband.c ++++ b/drivers/staging/vt6656/baseband.c +@@ -449,8 +449,8 @@ int vnt_vt3184_init(struct vnt_private * + + memcpy(array, addr, length); + +- ret = vnt_control_out(priv, MESSAGE_TYPE_WRITE, 0, +- MESSAGE_REQUEST_BBREG, length, array); ++ ret = vnt_control_out_blocks(priv, VNT_REG_BLOCK_SIZE, ++ MESSAGE_REQUEST_BBREG, length, array); + if (ret) + goto end; + +--- a/drivers/staging/vt6656/usbpipe.c ++++ b/drivers/staging/vt6656/usbpipe.c +@@ -76,6 +76,23 @@ int vnt_control_out_u8(struct vnt_privat + reg_off, reg, sizeof(u8), &data); + } + ++int vnt_control_out_blocks(struct vnt_private *priv, ++ u16 block, u8 reg, u16 length, u8 *data) ++{ ++ int ret = 0, i; ++ ++ for (i = 0; i < length; i += block) { ++ u16 len = min_t(int, length - i, block); ++ ++ ret = vnt_control_out(priv, MESSAGE_TYPE_WRITE, ++ i, reg, len, data + i); ++ if (ret) ++ goto end; ++ } ++end: ++ return ret; ++} ++ + int vnt_control_in(struct vnt_private *priv, u8 request, u16 value, + u16 index, u16 length, u8 *buffer) + { +--- a/drivers/staging/vt6656/usbpipe.h ++++ b/drivers/staging/vt6656/usbpipe.h +@@ -18,6 +18,8 @@ + + #include "device.h" + ++#define VNT_REG_BLOCK_SIZE 64 ++ + int vnt_control_out(struct vnt_private *priv, u8 request, u16 value, + u16 index, u16 length, u8 *buffer); + int vnt_control_in(struct vnt_private *priv, u8 request, u16 value, +@@ -26,6 +28,9 @@ int vnt_control_in(struct vnt_private *p + int vnt_control_out_u8(struct vnt_private *priv, u8 reg, u8 ref_off, u8 data); + int vnt_control_in_u8(struct vnt_private *priv, u8 reg, u8 reg_off, u8 *data); + ++int vnt_control_out_blocks(struct vnt_private *priv, ++ u16 block, u8 reg, u16 len, u8 *data); ++ + int vnt_start_interrupt_urb(struct vnt_private *priv); + int vnt_submit_rx_urb(struct vnt_private *priv, struct vnt_rcb *rcb); + int vnt_tx_context(struct vnt_private *priv, diff --git a/queue-5.4/staging-vt6656-set-usb_set_intfdata-on-driver-fail.patch b/queue-5.4/staging-vt6656-set-usb_set_intfdata-on-driver-fail.patch new file mode 100644 index 00000000000..82664e0ba51 --- /dev/null +++ b/queue-5.4/staging-vt6656-set-usb_set_intfdata-on-driver-fail.patch @@ -0,0 +1,55 @@ +From c0bcf9f3f5b661d4ace2a64a79ef661edd2a4dc8 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Fri, 20 Dec 2019 21:15:59 +0000 +Subject: staging: vt6656: set usb_set_intfdata on driver fail. + +From: Malcolm Priestley + +commit c0bcf9f3f5b661d4ace2a64a79ef661edd2a4dc8 upstream. + +intfdata will contain stale pointer when the device is detached after +failed initialization when referenced in vt6656_disconnect + +Provide driver access to it here and NULL it. + +Cc: stable +Signed-off-by: Malcolm Priestley +Link: https://lore.kernel.org/r/6de448d7-d833-ef2e-dd7b-3ef9992fee0e@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/device.h | 1 + + drivers/staging/vt6656/main_usb.c | 1 + + drivers/staging/vt6656/wcmd.c | 1 + + 3 files changed, 3 insertions(+) + +--- a/drivers/staging/vt6656/device.h ++++ b/drivers/staging/vt6656/device.h +@@ -259,6 +259,7 @@ struct vnt_private { + u8 mac_hw; + /* netdev */ + struct usb_device *usb; ++ struct usb_interface *intf; + + u64 tsf_time; + u8 rx_rate; +--- a/drivers/staging/vt6656/main_usb.c ++++ b/drivers/staging/vt6656/main_usb.c +@@ -993,6 +993,7 @@ vt6656_probe(struct usb_interface *intf, + priv = hw->priv; + priv->hw = hw; + priv->usb = udev; ++ priv->intf = intf; + + vnt_set_options(priv); + +--- a/drivers/staging/vt6656/wcmd.c ++++ b/drivers/staging/vt6656/wcmd.c +@@ -99,6 +99,7 @@ void vnt_run_command(struct work_struct + if (vnt_init(priv)) { + /* If fail all ends TODO retry */ + dev_err(&priv->usb->dev, "failed to start\n"); ++ usb_set_intfdata(priv->intf, NULL); + ieee80211_free_hw(priv->hw); + return; + } diff --git a/queue-5.4/tty-always-relink-the-port.patch b/queue-5.4/tty-always-relink-the-port.patch new file mode 100644 index 00000000000..aa7b2f1421e --- /dev/null +++ b/queue-5.4/tty-always-relink-the-port.patch @@ -0,0 +1,37 @@ +From 273f632912f1b24b642ba5b7eb5022e43a72f3b5 Mon Sep 17 00:00:00 2001 +From: Sudip Mukherjee +Date: Fri, 27 Dec 2019 17:44:34 +0000 +Subject: tty: always relink the port + +From: Sudip Mukherjee + +commit 273f632912f1b24b642ba5b7eb5022e43a72f3b5 upstream. + +If the serial device is disconnected and reconnected, it re-enumerates +properly but does not link it. fwiw, linking means just saving the port +index, so allow it always as there is no harm in saving the same value +again even if it tries to relink with the same port. + +Fixes: fb2b90014d78 ("tty: link tty and port before configuring it as console") +Reported-by: Kenneth R. Crudup +Signed-off-by: Sudip Mukherjee +Cc: stable +Link: https://lore.kernel.org/r/20191227174434.12057-1-sudipm.mukherjee@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/tty_port.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/tty/tty_port.c ++++ b/drivers/tty/tty_port.c +@@ -89,8 +89,7 @@ void tty_port_link_device(struct tty_por + { + if (WARN_ON(index >= driver->num)) + return; +- if (!driver->ports[index]) +- driver->ports[index] = port; ++ driver->ports[index] = port; + } + EXPORT_SYMBOL_GPL(tty_port_link_device); + diff --git a/queue-5.4/tty-link-tty-and-port-before-configuring-it-as-console.patch b/queue-5.4/tty-link-tty-and-port-before-configuring-it-as-console.patch new file mode 100644 index 00000000000..4db96a7a84d --- /dev/null +++ b/queue-5.4/tty-link-tty-and-port-before-configuring-it-as-console.patch @@ -0,0 +1,69 @@ +From fb2b90014d782d80d7ebf663e50f96d8c507a73c Mon Sep 17 00:00:00 2001 +From: Sudip Mukherjee +Date: Thu, 12 Dec 2019 13:16:02 +0000 +Subject: tty: link tty and port before configuring it as console + +From: Sudip Mukherjee + +commit fb2b90014d782d80d7ebf663e50f96d8c507a73c upstream. + +There seems to be a race condition in tty drivers and I could see on +many boot cycles a NULL pointer dereference as tty_init_dev() tries to +do 'tty->port->itty = tty' even though tty->port is NULL. +'tty->port' will be set by the driver and if the driver has not yet done +it before we open the tty device we can get to this situation. By adding +some extra debug prints, I noticed that: + +6.650130: uart_add_one_port +6.663849: register_console +6.664846: tty_open +6.674391: tty_init_dev +6.675456: tty_port_link_device + +uart_add_one_port() registers the console, as soon as it registers, the +userspace tries to use it and that leads to tty_open() but +uart_add_one_port() has not yet done tty_port_link_device() and so +tty->port is not yet configured when control reaches tty_init_dev(). + +Further look into the code and tty_port_link_device() is done by +uart_add_one_port(). After registering the console uart_add_one_port() +will call tty_port_register_device_attr_serdev() and +tty_port_link_device() is called from this. + +Call add tty_port_link_device() before uart_configure_port() is done and +add a check in tty_port_link_device() so that it only links the port if +it has not been done yet. + +Suggested-by: Jiri Slaby +Signed-off-by: Sudip Mukherjee +Cc: stable +Link: https://lore.kernel.org/r/20191212131602.29504-1-sudipm.mukherjee@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/serial_core.c | 1 + + drivers/tty/tty_port.c | 3 ++- + 2 files changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -2834,6 +2834,7 @@ int uart_add_one_port(struct uart_driver + if (uport->cons && uport->dev) + of_console_check(uport->dev->of_node, uport->cons->name, uport->line); + ++ tty_port_link_device(port, drv->tty_driver, uport->line); + uart_configure_port(drv, state, uport); + + port->console = uart_console(uport); +--- a/drivers/tty/tty_port.c ++++ b/drivers/tty/tty_port.c +@@ -89,7 +89,8 @@ void tty_port_link_device(struct tty_por + { + if (WARN_ON(index >= driver->num)) + return; +- driver->ports[index] = port; ++ if (!driver->ports[index]) ++ driver->ports[index] = port; + } + EXPORT_SYMBOL_GPL(tty_port_link_device); + diff --git a/queue-5.4/um-implement-copy_thread_tls.patch b/queue-5.4/um-implement-copy_thread_tls.patch new file mode 100644 index 00000000000..b8d96849807 --- /dev/null +++ b/queue-5.4/um-implement-copy_thread_tls.patch @@ -0,0 +1,109 @@ +From 457677c70c7672a4586b0b8abc396cc1ecdd376d Mon Sep 17 00:00:00 2001 +From: Amanieu d'Antras +Date: Sat, 4 Jan 2020 13:39:30 +0100 +Subject: um: Implement copy_thread_tls + +From: Amanieu d'Antras + +commit 457677c70c7672a4586b0b8abc396cc1ecdd376d upstream. + +This is required for clone3 which passes the TLS value through a +struct rather than a register. + +Signed-off-by: Amanieu d'Antras +Cc: linux-um@lists.infradead.org +Cc: # 5.3.x +Link: https://lore.kernel.org/r/20200104123928.1048822-1-amanieu@gmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Greg Kroah-Hartman + +--- + arch/um/Kconfig | 1 + + arch/um/include/asm/ptrace-generic.h | 2 +- + arch/um/kernel/process.c | 6 +++--- + arch/x86/um/tls_32.c | 6 ++---- + arch/x86/um/tls_64.c | 7 +++---- + 5 files changed, 10 insertions(+), 12 deletions(-) + +--- a/arch/um/Kconfig ++++ b/arch/um/Kconfig +@@ -14,6 +14,7 @@ config UML + select HAVE_FUTEX_CMPXCHG if FUTEX + select HAVE_DEBUG_KMEMLEAK + select HAVE_DEBUG_BUGVERBOSE ++ select HAVE_COPY_THREAD_TLS + select GENERIC_IRQ_SHOW + select GENERIC_CPU_DEVICES + select GENERIC_CLOCKEVENTS +--- a/arch/um/include/asm/ptrace-generic.h ++++ b/arch/um/include/asm/ptrace-generic.h +@@ -36,7 +36,7 @@ extern long subarch_ptrace(struct task_s + extern unsigned long getreg(struct task_struct *child, int regno); + extern int putreg(struct task_struct *child, int regno, unsigned long value); + +-extern int arch_copy_tls(struct task_struct *new); ++extern int arch_set_tls(struct task_struct *new, unsigned long tls); + extern void clear_flushed_tls(struct task_struct *task); + extern int syscall_trace_enter(struct pt_regs *regs); + extern void syscall_trace_leave(struct pt_regs *regs); +--- a/arch/um/kernel/process.c ++++ b/arch/um/kernel/process.c +@@ -153,8 +153,8 @@ void fork_handler(void) + userspace(¤t->thread.regs.regs, current_thread_info()->aux_fp_regs); + } + +-int copy_thread(unsigned long clone_flags, unsigned long sp, +- unsigned long arg, struct task_struct * p) ++int copy_thread_tls(unsigned long clone_flags, unsigned long sp, ++ unsigned long arg, struct task_struct * p, unsigned long tls) + { + void (*handler)(void); + int kthread = current->flags & PF_KTHREAD; +@@ -188,7 +188,7 @@ int copy_thread(unsigned long clone_flag + * Set a new TLS for the child thread? + */ + if (clone_flags & CLONE_SETTLS) +- ret = arch_copy_tls(p); ++ ret = arch_set_tls(p, tls); + } + + return ret; +--- a/arch/x86/um/tls_32.c ++++ b/arch/x86/um/tls_32.c +@@ -215,14 +215,12 @@ static int set_tls_entry(struct task_str + return 0; + } + +-int arch_copy_tls(struct task_struct *new) ++int arch_set_tls(struct task_struct *new, unsigned long tls) + { + struct user_desc info; + int idx, ret = -EFAULT; + +- if (copy_from_user(&info, +- (void __user *) UPT_SI(&new->thread.regs.regs), +- sizeof(info))) ++ if (copy_from_user(&info, (void __user *) tls, sizeof(info))) + goto out; + + ret = -EINVAL; +--- a/arch/x86/um/tls_64.c ++++ b/arch/x86/um/tls_64.c +@@ -6,14 +6,13 @@ void clear_flushed_tls(struct task_struc + { + } + +-int arch_copy_tls(struct task_struct *t) ++int arch_set_tls(struct task_struct *t, unsigned long tls) + { + /* + * If CLONE_SETTLS is set, we need to save the thread id +- * (which is argument 5, child_tid, of clone) so it can be set +- * during context switches. ++ * so it can be set during context switches. + */ +- t->thread.arch.fs = t->thread.regs.regs.gp[R8 / sizeof(long)]; ++ t->thread.arch.fs = tls; + + return 0; + } diff --git a/queue-5.4/usb-cdns3-should-not-use-the-same-dev_id-for-shared-interrupt-handler.patch b/queue-5.4/usb-cdns3-should-not-use-the-same-dev_id-for-shared-interrupt-handler.patch new file mode 100644 index 00000000000..de4af9a077d --- /dev/null +++ b/queue-5.4/usb-cdns3-should-not-use-the-same-dev_id-for-shared-interrupt-handler.patch @@ -0,0 +1,138 @@ +From af58e1fca9840192f14b6f03c59595d64bff9127 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Fri, 27 Dec 2019 17:10:04 +0800 +Subject: usb: cdns3: should not use the same dev_id for shared interrupt handler + +From: Peter Chen + +commit af58e1fca9840192f14b6f03c59595d64bff9127 upstream. + +Both drd and gadget interrupt handler use the struct cdns3 pointer as +dev_id, it causes devm_free_irq at cdns3_gadget_exit doesn't free +gadget's interrupt handler, it freed drd's handler. So, when the +host interrupt occurs, the gadget's interrupt hanlder is still +called, and causes below oops. To fix it, we use gadget's private +data priv_dev as interrupt dev_id for gadget. + +Unable to handle kernel NULL pointer dereference at virtual address 0000000000000380 +Mem abort info: + ESR = 0x96000006 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 +Data abort info: + ISV = 0, ISS = 0x00000006 + CM = 0, WnR = 0 +user pgtable: 4k pages, 48-bit VAs, pgdp=0000000971d79000 +[0000000000000380] pgd=0000000971d6f003, pud=0000000971d6e003, pmd=0000000000000000 +Internal error: Oops: 96000006 [#1] PREEMPT SMP +Modules linked in: mxc_jpeg_encdec crct10dif_ce fsl_imx8_ddr_perf +CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.0-03486-g69f4e7d9c54a-dirty #254 +Hardware name: Freescale i.MX8QM MEK (DT) +pstate: 00000085 (nzcv daIf -PAN -UAO) +pc : cdns3_device_irq_handler+0x1c/0xb8 +lr : __handle_irq_event_percpu+0x78/0x2c0 +sp : ffff800010003e30 +x29: ffff800010003e30 x28: ffff8000129bb000 +x27: ffff8000126e9000 x26: ffff0008f61b5600 +x25: ffff800011fe1018 x24: ffff8000126ea120 +x23: ffff800010003f04 x22: 0000000000000000 +x21: 0000000000000093 x20: ffff0008f61b5600 +x19: ffff0008f5061a80 x18: 0000000000000000 +x17: 0000000000000000 x16: 0000000000000000 +x15: 0000000000000000 x14: 003d090000000000 +x13: 00003d0900000000 x12: 0000000000000000 +x11: 00003d0900000000 x10: 0000000000000040 +x9 : ffff800012708cb8 x8 : ffff800012708cb0 +x7 : ffff0008f7c7a9d0 x6 : 0000000000000000 +x5 : ffff0008f7c7a910 x4 : ffff8008ed359000 +x3 : ffff800010003f40 x2 : 0000000000000000 +x1 : ffff0008f5061a80 x0 : ffff800010161a60 +Call trace: + cdns3_device_irq_handler+0x1c/0xb8 + __handle_irq_event_percpu+0x78/0x2c0 + handle_irq_event_percpu+0x40/0x98 + handle_irq_event+0x4c/0xd0 + handle_fasteoi_irq+0xbc/0x168 + generic_handle_irq+0x34/0x50 + __handle_domain_irq+0x6c/0xc0 + gic_handle_irq+0xd4/0x174 + el1_irq+0xb8/0x180 + arch_cpu_idle+0x3c/0x230 + default_idle_call+0x38/0x40 + do_idle+0x20c/0x298 + cpu_startup_entry+0x28/0x48 + rest_init+0xdc/0xe8 + arch_call_rest_init+0x14/0x1c + start_kernel+0x48c/0x4b8 +Code: aa0103f3 aa1e03e0 d503201f f9409662 (f941c040) +---[ end trace 091dcf4dee011b0e ]--- +Kernel panic - not syncing: Fatal exception in interrupt +SMP: stopping secondary CPUs +Kernel Offset: disabled +CPU features: 0x0002,2100600c +Memory Limit: none +---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- + +Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") +Cc: #v5.4 +Signed-off-by: Peter Chen +Link: https://lore.kernel.org/r/1577437804-18146-1-git-send-email-peter.chen@nxp.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/cdns3/gadget.c | 14 +++++--------- + 1 file changed, 5 insertions(+), 9 deletions(-) + +--- a/drivers/usb/cdns3/gadget.c ++++ b/drivers/usb/cdns3/gadget.c +@@ -1375,13 +1375,10 @@ static void cdns3_check_usb_interrupt_pr + */ + static irqreturn_t cdns3_device_irq_handler(int irq, void *data) + { +- struct cdns3_device *priv_dev; +- struct cdns3 *cdns = data; ++ struct cdns3_device *priv_dev = data; + irqreturn_t ret = IRQ_NONE; + u32 reg; + +- priv_dev = cdns->gadget_dev; +- + /* check USB device interrupt */ + reg = readl(&priv_dev->regs->usb_ists); + if (reg) { +@@ -1419,14 +1416,12 @@ static irqreturn_t cdns3_device_irq_hand + */ + static irqreturn_t cdns3_device_thread_irq_handler(int irq, void *data) + { +- struct cdns3_device *priv_dev; +- struct cdns3 *cdns = data; ++ struct cdns3_device *priv_dev = data; + irqreturn_t ret = IRQ_NONE; + unsigned long flags; + int bit; + u32 reg; + +- priv_dev = cdns->gadget_dev; + spin_lock_irqsave(&priv_dev->lock, flags); + + reg = readl(&priv_dev->regs->usb_ists); +@@ -2539,7 +2534,7 @@ void cdns3_gadget_exit(struct cdns3 *cdn + + priv_dev = cdns->gadget_dev; + +- devm_free_irq(cdns->dev, cdns->dev_irq, cdns); ++ devm_free_irq(cdns->dev, cdns->dev_irq, priv_dev); + + pm_runtime_mark_last_busy(cdns->dev); + pm_runtime_put_autosuspend(cdns->dev); +@@ -2710,7 +2705,8 @@ static int __cdns3_gadget_init(struct cd + ret = devm_request_threaded_irq(cdns->dev, cdns->dev_irq, + cdns3_device_irq_handler, + cdns3_device_thread_irq_handler, +- IRQF_SHARED, dev_name(cdns->dev), cdns); ++ IRQF_SHARED, dev_name(cdns->dev), ++ cdns->gadget_dev); + + if (ret) + goto err0; diff --git a/queue-5.4/usb-musb-disable-pullup-at-init.patch b/queue-5.4/usb-musb-disable-pullup-at-init.patch new file mode 100644 index 00000000000..86da95e46c0 --- /dev/null +++ b/queue-5.4/usb-musb-disable-pullup-at-init.patch @@ -0,0 +1,37 @@ +From 96a0c12843109e5c4d5eb1e09d915fdd0ce31d25 Mon Sep 17 00:00:00 2001 +From: Paul Cercueil +Date: Tue, 7 Jan 2020 09:26:25 -0600 +Subject: usb: musb: Disable pullup at init + +From: Paul Cercueil + +commit 96a0c12843109e5c4d5eb1e09d915fdd0ce31d25 upstream. + +The pullup may be already enabled before the driver is initialized. This +happens for instance on JZ4740. + +It has to be disabled at init time, as we cannot guarantee that a gadget +driver will be bound to the UDC. + +Signed-off-by: Paul Cercueil +Suggested-by: Bin Liu +Cc: stable@vger.kernel.org +Signed-off-by: Bin Liu +Link: https://lore.kernel.org/r/20200107152625.857-3-b-liu@ti.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/musb/musb_core.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -2318,6 +2318,9 @@ musb_init_controller(struct device *dev, + musb_disable_interrupts(musb); + musb_writeb(musb->mregs, MUSB_DEVCTL, 0); + ++ /* MUSB_POWER_SOFTCONN might be already set, JZ4740 does this. */ ++ musb_writeb(musb->mregs, MUSB_POWER, 0); ++ + /* Init IRQ workqueue before request_irq */ + INIT_DELAYED_WORK(&musb->irq_work, musb_irq_work); + INIT_DELAYED_WORK(&musb->deassert_reset_work, musb_deassert_reset); diff --git a/queue-5.4/usb-musb-dma-correct-parameter-passed-to-irq-handler.patch b/queue-5.4/usb-musb-dma-correct-parameter-passed-to-irq-handler.patch new file mode 100644 index 00000000000..9c35c7e9b75 --- /dev/null +++ b/queue-5.4/usb-musb-dma-correct-parameter-passed-to-irq-handler.patch @@ -0,0 +1,35 @@ +From c80d0f4426c7fdc7efd6ae8d8b021dcfc89b4254 Mon Sep 17 00:00:00 2001 +From: Paul Cercueil +Date: Mon, 16 Dec 2019 10:18:43 -0600 +Subject: usb: musb: dma: Correct parameter passed to IRQ handler + +From: Paul Cercueil + +commit c80d0f4426c7fdc7efd6ae8d8b021dcfc89b4254 upstream. + +The IRQ handler was passed a pointer to a struct dma_controller, but the +argument was then casted to a pointer to a struct musb_dma_controller. + +Fixes: 427c4f333474 ("usb: struct device - replace bus_id with dev_name(), dev_set_name()") +Signed-off-by: Paul Cercueil +Tested-by: Artur Rojek +Cc: stable@vger.kernel.org +Signed-off-by: Bin Liu +Link: https://lore.kernel.org/r/20191216161844.772-2-b-liu@ti.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musbhsdma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/musb/musbhsdma.c ++++ b/drivers/usb/musb/musbhsdma.c +@@ -425,7 +425,7 @@ struct dma_controller *musbhs_dma_contro + controller->controller.channel_abort = dma_channel_abort; + + if (request_irq(irq, dma_controller_irq, 0, +- dev_name(musb->controller), &controller->controller)) { ++ dev_name(musb->controller), controller)) { + dev_err(dev, "request_irq %d failed!\n", irq); + musb_dma_controller_destroy(&controller->controller); + diff --git a/queue-5.4/usb-musb-fix-idling-for-suspend-after-disconnect-interrupt.patch b/queue-5.4/usb-musb-fix-idling-for-suspend-after-disconnect-interrupt.patch new file mode 100644 index 00000000000..1c1499e310f --- /dev/null +++ b/queue-5.4/usb-musb-fix-idling-for-suspend-after-disconnect-interrupt.patch @@ -0,0 +1,62 @@ +From 5fbf7a2534703fd71159d3d71504b0ad01b43394 Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Tue, 7 Jan 2020 09:26:24 -0600 +Subject: usb: musb: fix idling for suspend after disconnect interrupt + +From: Tony Lindgren + +commit 5fbf7a2534703fd71159d3d71504b0ad01b43394 upstream. + +When disconnected as USB B-device, suspend interrupt should come before +diconnect interrupt, because the DP/DM pins are shorter than the +VBUS/GND pins on the USB connectors. But we sometimes get a suspend +interrupt after disconnect interrupt. In that case we have devctl set to +99 with VBUS still valid and musb_pm_runtime_check_session() wrongly +thinks we have an active session. We have no other interrupts after +disconnect coming in this case at least with the omap2430 glue. + +Let's fix the issue by checking the interrupt status again with +delayed work for the devctl 99 case. In the suspend after disconnect +case the devctl session bit has cleared by then and musb can idle. +For a typical USB B-device connect case we just continue with normal +interrupts. + +Fixes: 467d5c980709 ("usb: musb: Implement session bit based runtime PM for musb-core") + +Cc: Merlijn Wajer +Cc: Pavel Machek +Cc: Sebastian Reichel +Cc: stable@vger.kernel.org +Signed-off-by: Tony Lindgren +Signed-off-by: Bin Liu +Link: https://lore.kernel.org/r/20200107152625.857-2-b-liu@ti.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_core.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -1840,6 +1840,9 @@ ATTRIBUTE_GROUPS(musb); + #define MUSB_QUIRK_B_INVALID_VBUS_91 (MUSB_DEVCTL_BDEVICE | \ + (2 << MUSB_DEVCTL_VBUS_SHIFT) | \ + MUSB_DEVCTL_SESSION) ++#define MUSB_QUIRK_B_DISCONNECT_99 (MUSB_DEVCTL_BDEVICE | \ ++ (3 << MUSB_DEVCTL_VBUS_SHIFT) | \ ++ MUSB_DEVCTL_SESSION) + #define MUSB_QUIRK_A_DISCONNECT_19 ((3 << MUSB_DEVCTL_VBUS_SHIFT) | \ + MUSB_DEVCTL_SESSION) + +@@ -1862,6 +1865,11 @@ static void musb_pm_runtime_check_sessio + s = MUSB_DEVCTL_FSDEV | MUSB_DEVCTL_LSDEV | + MUSB_DEVCTL_HR; + switch (devctl & ~s) { ++ case MUSB_QUIRK_B_DISCONNECT_99: ++ musb_dbg(musb, "Poll devctl in case of suspend after disconnect\n"); ++ schedule_delayed_work(&musb->irq_work, ++ msecs_to_jiffies(1000)); ++ break; + case MUSB_QUIRK_B_INVALID_VBUS_91: + if (musb->quirk_retries && !musb->flush_irq_work) { + musb_dbg(musb, diff --git a/queue-5.4/usb-ohci-da8xx-ensure-error-return-on-variable-error-is-set.patch b/queue-5.4/usb-ohci-da8xx-ensure-error-return-on-variable-error-is-set.patch new file mode 100644 index 00000000000..956ffb34c40 --- /dev/null +++ b/queue-5.4/usb-ohci-da8xx-ensure-error-return-on-variable-error-is-set.patch @@ -0,0 +1,51 @@ +From ba9b40810bb43e6bf73b395012b98633c03f7f59 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Tue, 7 Jan 2020 12:39:01 +0000 +Subject: usb: ohci-da8xx: ensure error return on variable error is set + +From: Colin Ian King + +commit ba9b40810bb43e6bf73b395012b98633c03f7f59 upstream. + +Currently when an error occurs when calling devm_gpiod_get_optional or +calling gpiod_to_irq it causes an uninitialized error return in variable +'error' to be returned. Fix this by ensuring the error variable is set +from da8xx_ohci->oc_gpio and oc_irq. + +Thanks to Dan Carpenter for spotting the uninitialized error in the +gpiod_to_irq failure case. + +Addresses-Coverity: ("Uninitialized scalar variable") +Fixes: d193abf1c913 ("usb: ohci-da8xx: add vbus and overcurrent gpios") +Signed-off-by: Colin Ian King +Cc: stable +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/20200107123901.101190-1-colin.king@canonical.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ohci-da8xx.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/ohci-da8xx.c ++++ b/drivers/usb/host/ohci-da8xx.c +@@ -415,13 +415,17 @@ static int ohci_da8xx_probe(struct platf + } + + da8xx_ohci->oc_gpio = devm_gpiod_get_optional(dev, "oc", GPIOD_IN); +- if (IS_ERR(da8xx_ohci->oc_gpio)) ++ if (IS_ERR(da8xx_ohci->oc_gpio)) { ++ error = PTR_ERR(da8xx_ohci->oc_gpio); + goto err; ++ } + + if (da8xx_ohci->oc_gpio) { + oc_irq = gpiod_to_irq(da8xx_ohci->oc_gpio); +- if (oc_irq < 0) ++ if (oc_irq < 0) { ++ error = oc_irq; + goto err; ++ } + + error = devm_request_threaded_irq(dev, oc_irq, NULL, + ohci_da8xx_oc_thread, IRQF_TRIGGER_RISING | diff --git a/queue-5.4/usb-pd-tcpm-bad-warning-size-pps-adapters.patch b/queue-5.4/usb-pd-tcpm-bad-warning-size-pps-adapters.patch new file mode 100644 index 00000000000..000411fc107 --- /dev/null +++ b/queue-5.4/usb-pd-tcpm-bad-warning-size-pps-adapters.patch @@ -0,0 +1,76 @@ +From c215e48e97d232249a33849fc46fc50311043e11 Mon Sep 17 00:00:00 2001 +From: Douglas Gilbert +Date: Sun, 29 Dec 2019 22:35:44 -0500 +Subject: USB-PD tcpm: bad warning+size, PPS adapters + +From: Douglas Gilbert + +commit c215e48e97d232249a33849fc46fc50311043e11 upstream. + +Augmented Power Delivery Objects (A)PDO_s are used by USB-C +PD power adapters to advertize the voltages and currents +they support. There can be up to 7 PDO_s but before PPS +(programmable power supply) there were seldom more than 4 +or 5. Recently Samsung released an optional PPS 45 Watt power +adapter (EP-TA485) that has 7 PDO_s. It is for the Galaxy 10+ +tablet and charges it quicker than the adapter supplied at +purchase. The EP-TA485 causes an overzealous WARN_ON to soil +the log plus it miscalculates the number of bytes to read. + +So this bug has been there for some time but goes +undetected for the majority of USB-C PD power adapters on +the market today that have 6 or less PDO_s. That may soon +change as more USB-C PD adapters with PPS come to market. + +Tested on a EP-TA485 and an older Lenovo PN: SA10M13950 +USB-C 65 Watt adapter (without PPS and has 4 PDO_s) plus +several other PD power adapters. + +Signed-off-by: Douglas Gilbert +Reviewed-by: Guenter Roeck +Cc: stable +Link: https://lore.kernel.org/r/20191230033544.1809-1-dgilbert@interlog.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/typec/tcpm/tcpci.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- a/drivers/usb/typec/tcpm/tcpci.c ++++ b/drivers/usb/typec/tcpm/tcpci.c +@@ -432,20 +432,30 @@ irqreturn_t tcpci_irq(struct tcpci *tcpc + + if (status & TCPC_ALERT_RX_STATUS) { + struct pd_message msg; +- unsigned int cnt; ++ unsigned int cnt, payload_cnt; + u16 header; + + regmap_read(tcpci->regmap, TCPC_RX_BYTE_CNT, &cnt); ++ /* ++ * 'cnt' corresponds to READABLE_BYTE_COUNT in section 4.4.14 ++ * of the TCPCI spec [Rev 2.0 Ver 1.0 October 2017] and is ++ * defined in table 4-36 as one greater than the number of ++ * bytes received. And that number includes the header. So: ++ */ ++ if (cnt > 3) ++ payload_cnt = cnt - (1 + sizeof(msg.header)); ++ else ++ payload_cnt = 0; + + tcpci_read16(tcpci, TCPC_RX_HDR, &header); + msg.header = cpu_to_le16(header); + +- if (WARN_ON(cnt > sizeof(msg.payload))) +- cnt = sizeof(msg.payload); ++ if (WARN_ON(payload_cnt > sizeof(msg.payload))) ++ payload_cnt = sizeof(msg.payload); + +- if (cnt > 0) ++ if (payload_cnt > 0) + regmap_raw_read(tcpci->regmap, TCPC_RX_DATA, +- &msg.payload, cnt); ++ &msg.payload, payload_cnt); + + /* Read complete, clear RX status alert bit */ + tcpci_write16(tcpci, TCPC_ALERT, TCPC_ALERT_RX_STATUS); diff --git a/queue-5.4/usb-serial-option-add-zlp-support-for-0x1bc7-0x9010.patch b/queue-5.4/usb-serial-option-add-zlp-support-for-0x1bc7-0x9010.patch new file mode 100644 index 00000000000..1d0d229a645 --- /dev/null +++ b/queue-5.4/usb-serial-option-add-zlp-support-for-0x1bc7-0x9010.patch @@ -0,0 +1,85 @@ +From 2438c3a19dec5e98905fd3ffcc2f24716aceda6b Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Thu, 19 Dec 2019 11:07:07 +0100 +Subject: USB: serial: option: add ZLP support for 0x1bc7/0x9010 + +From: Daniele Palmas + +commit 2438c3a19dec5e98905fd3ffcc2f24716aceda6b upstream. + +Telit FN980 flashing device 0x1bc7/0x9010 requires zero packet +to be sent if out data size is is equal to the endpoint max size. + +Signed-off-by: Daniele Palmas +[ johan: switch operands in conditional ] +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 8 ++++++++ + drivers/usb/serial/usb-wwan.h | 1 + + drivers/usb/serial/usb_wwan.c | 4 ++++ + 3 files changed, 13 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -567,6 +567,9 @@ static void option_instat_callback(struc + /* Interface must have two endpoints */ + #define NUMEP2 BIT(16) + ++/* Device needs ZLP */ ++#define ZLP BIT(17) ++ + + static const struct usb_device_id option_ids[] = { + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, +@@ -1198,6 +1201,8 @@ static const struct usb_device_id option + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */ + .driver_info = NCTRL(0) }, ++ { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ ++ .driver_info = NCTRL(0) | ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) }, +@@ -2099,6 +2104,9 @@ static int option_attach(struct usb_seri + if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber))) + data->use_send_setup = 1; + ++ if (device_flags & ZLP) ++ data->use_zlp = 1; ++ + spin_lock_init(&data->susp_lock); + + usb_set_serial_data(serial, data); +--- a/drivers/usb/serial/usb-wwan.h ++++ b/drivers/usb/serial/usb-wwan.h +@@ -38,6 +38,7 @@ struct usb_wwan_intf_private { + spinlock_t susp_lock; + unsigned int suspended:1; + unsigned int use_send_setup:1; ++ unsigned int use_zlp:1; + int in_flight; + unsigned int open_ports; + void *private; +--- a/drivers/usb/serial/usb_wwan.c ++++ b/drivers/usb/serial/usb_wwan.c +@@ -461,6 +461,7 @@ static struct urb *usb_wwan_setup_urb(st + void (*callback) (struct urb *)) + { + struct usb_serial *serial = port->serial; ++ struct usb_wwan_intf_private *intfdata = usb_get_serial_data(serial); + struct urb *urb; + + urb = usb_alloc_urb(0, GFP_KERNEL); /* No ISO */ +@@ -471,6 +472,9 @@ static struct urb *usb_wwan_setup_urb(st + usb_sndbulkpipe(serial->dev, endpoint) | dir, + buf, len, callback, ctx); + ++ if (intfdata->use_zlp && dir == USB_DIR_OUT) ++ urb->transfer_flags |= URB_ZERO_PACKET; ++ + return urb; + } + diff --git a/queue-5.4/xtensa-implement-copy_thread_tls.patch b/queue-5.4/xtensa-implement-copy_thread_tls.patch new file mode 100644 index 00000000000..9cab0df9dbb --- /dev/null +++ b/queue-5.4/xtensa-implement-copy_thread_tls.patch @@ -0,0 +1,59 @@ +From c346b94f8c5d1b7d637522c908209de93305a8eb Mon Sep 17 00:00:00 2001 +From: Amanieu d'Antras +Date: Thu, 2 Jan 2020 18:24:12 +0100 +Subject: xtensa: Implement copy_thread_tls + +From: Amanieu d'Antras + +commit c346b94f8c5d1b7d637522c908209de93305a8eb upstream. + +This is required for clone3 which passes the TLS value through a +struct rather than a register. + +Signed-off-by: Amanieu d'Antras +Cc: linux-xtensa@linux-xtensa.org +Cc: # 5.3.x +Link: https://lore.kernel.org/r/20200102172413.654385-7-amanieu@gmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Greg Kroah-Hartman + +--- + arch/xtensa/Kconfig | 1 + + arch/xtensa/kernel/process.c | 8 ++++---- + 2 files changed, 5 insertions(+), 4 deletions(-) + +--- a/arch/xtensa/Kconfig ++++ b/arch/xtensa/Kconfig +@@ -22,6 +22,7 @@ config XTENSA + select HAVE_ARCH_JUMP_LABEL + select HAVE_ARCH_KASAN if MMU + select HAVE_ARCH_TRACEHOOK ++ select HAVE_COPY_THREAD_TLS + select HAVE_DEBUG_KMEMLEAK + select HAVE_DMA_CONTIGUOUS + select HAVE_EXIT_THREAD +--- a/arch/xtensa/kernel/process.c ++++ b/arch/xtensa/kernel/process.c +@@ -202,8 +202,9 @@ int arch_dup_task_struct(struct task_str + * involved. Much simpler to just not copy those live frames across. + */ + +-int copy_thread(unsigned long clone_flags, unsigned long usp_thread_fn, +- unsigned long thread_fn_arg, struct task_struct *p) ++int copy_thread_tls(unsigned long clone_flags, unsigned long usp_thread_fn, ++ unsigned long thread_fn_arg, struct task_struct *p, ++ unsigned long tls) + { + struct pt_regs *childregs = task_pt_regs(p); + +@@ -264,9 +265,8 @@ int copy_thread(unsigned long clone_flag + ®s->areg[XCHAL_NUM_AREGS - len/4], len); + } + +- /* The thread pointer is passed in the '4th argument' (= a5) */ + if (clone_flags & CLONE_SETTLS) +- childregs->threadptr = childregs->areg[5]; ++ childregs->threadptr = tls; + } else { + p->thread.ra = MAKE_RA_FOR_CALL( + (unsigned long)ret_from_kernel_thread, 1);