From: Sasha Levin Date: Sun, 22 Mar 2020 17:53:24 +0000 (-0400) Subject: Fixes for 4.9 X-Git-Tag: v4.19.113~38 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e443b06e9accabc0551fb97281587585b4b5d86d;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.9 Signed-off-by: Sasha Levin --- diff --git a/queue-4.9/altera-stapl-altera_get_note-prevent-write-beyond-en.patch b/queue-4.9/altera-stapl-altera_get_note-prevent-write-beyond-en.patch new file mode 100644 index 00000000000..1cb1b27a39f --- /dev/null +++ b/queue-4.9/altera-stapl-altera_get_note-prevent-write-beyond-en.patch @@ -0,0 +1,102 @@ +From be6f4bc27dba471a84ddb54b6e884d2c6ffe0c0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Feb 2020 10:44:27 -0800 +Subject: altera-stapl: altera_get_note: prevent write beyond end of 'key' +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Axtens + +[ Upstream commit 3745488e9d599916a0b40d45d3f30e3d4720288e ] + +altera_get_note is called from altera_init, where key is kzalloc(33). + +When the allocation functions are annotated to allow the compiler to see +the sizes of objects, and with FORTIFY_SOURCE, we see: + +In file included from drivers/misc/altera-stapl/altera.c:14:0: +In function ‘strlcpy’, + inlined from ‘altera_init’ at drivers/misc/altera-stapl/altera.c:2189:5: +include/linux/string.h:378:4: error: call to ‘__write_overflow’ declared with attribute error: detected write beyond size of object passed as 1st parameter + __write_overflow(); + ^~~~~~~~~~~~~~~~~~ + +That refers to this code in altera_get_note: + + if (key != NULL) + strlcpy(key, &p[note_strings + + get_unaligned_be32( + &p[note_table + (8 * i)])], + length); + +The error triggers because the length of 'key' is 33, but the copy +uses length supplied as the 'length' parameter, which is always +256. Split the size parameter into key_len and val_len, and use the +appropriate length depending on what is being copied. + +Detected by compiler error, only compile-tested. + +Cc: "Igor M. Liplianin" +Signed-off-by: Daniel Axtens +Link: https://lore.kernel.org/r/20200120074344.504-2-dja@axtens.net +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/202002251042.D898E67AC@keescook +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/altera-stapl/altera.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c +index 494e263daa748..b7ee8043a133e 100644 +--- a/drivers/misc/altera-stapl/altera.c ++++ b/drivers/misc/altera-stapl/altera.c +@@ -2126,8 +2126,8 @@ static int altera_execute(struct altera_state *astate, + return status; + } + +-static int altera_get_note(u8 *p, s32 program_size, +- s32 *offset, char *key, char *value, int length) ++static int altera_get_note(u8 *p, s32 program_size, s32 *offset, ++ char *key, char *value, int keylen, int vallen) + /* + * Gets key and value of NOTE fields in the JBC file. + * Can be called in two modes: if offset pointer is NULL, +@@ -2184,7 +2184,7 @@ static int altera_get_note(u8 *p, s32 program_size, + &p[note_table + (8 * i) + 4])]; + + if (value != NULL) +- strlcpy(value, value_ptr, length); ++ strlcpy(value, value_ptr, vallen); + + } + } +@@ -2203,13 +2203,13 @@ static int altera_get_note(u8 *p, s32 program_size, + strlcpy(key, &p[note_strings + + get_unaligned_be32( + &p[note_table + (8 * i)])], +- length); ++ keylen); + + if (value != NULL) + strlcpy(value, &p[note_strings + + get_unaligned_be32( + &p[note_table + (8 * i) + 4])], +- length); ++ vallen); + + *offset = i + 1; + } +@@ -2463,7 +2463,7 @@ int altera_init(struct altera_config *config, const struct firmware *fw) + __func__, (format_version == 2) ? "Jam STAPL" : + "pre-standardized Jam 1.1"); + while (altera_get_note((u8 *)fw->data, fw->size, +- &offset, key, value, 256) == 0) ++ &offset, key, value, 32, 256) == 0) + printk(KERN_INFO "%s: NOTE \"%s\" = \"%s\"\n", + __func__, key, value); + } +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-dra7-add-dma-ranges-property-to-pcie-rc-dt-n.patch b/queue-4.9/arm-dts-dra7-add-dma-ranges-property-to-pcie-rc-dt-n.patch new file mode 100644 index 00000000000..4d2ed2d045c --- /dev/null +++ b/queue-4.9/arm-dts-dra7-add-dma-ranges-property-to-pcie-rc-dt-n.patch @@ -0,0 +1,46 @@ +From c43b74fd48f70828eae1e7542649126bb096d1f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jan 2020 12:11:47 +0530 +Subject: ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes + +From: Kishon Vijay Abraham I + +[ Upstream commit 27f13774654ea6bd0b6fc9b97cce8d19e5735661 ] + +'dma-ranges' in a PCI bridge node does correctly set dma masks for PCI +devices not described in the DT. Certain DRA7 platforms (e.g., DRA76) +has RAM above 32-bit boundary (accessible with LPAE config) though the +PCIe bridge will be able to access only 32-bits. Add 'dma-ranges' +property in PCIe RC DT nodes to indicate the host bridge can access +only 32 bits. + +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/dra7.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi +index a1a928064b53d..f94064c687789 100644 +--- a/arch/arm/boot/dts/dra7.dtsi ++++ b/arch/arm/boot/dts/dra7.dtsi +@@ -282,6 +282,7 @@ + device_type = "pci"; + ranges = <0x81000000 0 0 0x03000 0 0x00010000 + 0x82000000 0 0x20013000 0x13000 0 0xffed000>; ++ dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>; + bus-range = <0x00 0xff>; + #interrupt-cells = <1>; + num-lanes = <1>; +@@ -319,6 +320,7 @@ + device_type = "pci"; + ranges = <0x81000000 0 0 0x03000 0 0x00010000 + 0x82000000 0 0x30013000 0x13000 0 0xffed000>; ++ dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>; + bus-range = <0x00 0xff>; + #interrupt-cells = <1>; + num-lanes = <1>; +-- +2.20.1 + diff --git a/queue-4.9/drm-exynos-dsi-fix-workaround-for-the-legacy-clock-n.patch b/queue-4.9/drm-exynos-dsi-fix-workaround-for-the-legacy-clock-n.patch new file mode 100644 index 00000000000..ff67583c448 --- /dev/null +++ b/queue-4.9/drm-exynos-dsi-fix-workaround-for-the-legacy-clock-n.patch @@ -0,0 +1,74 @@ +From 1a33d9a41d55b53b3a88db20f03a63b53c61a61c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Feb 2020 13:30:12 +0100 +Subject: drm/exynos: dsi: fix workaround for the legacy clock name + +From: Marek Szyprowski + +[ Upstream commit c0fd99d659ba5582e09625c7a985d63fc2ca74b5 ] + +Writing to the built-in strings arrays doesn't work if driver is loaded +as kernel module. This is also considered as a bad pattern. Fix this by +adding a call to clk_get() with legacy clock name. This fixes following +kernel oops if driver is loaded as module: + +Unable to handle kernel paging request at virtual address bf047978 + pgd = (ptrval) + [bf047978] *pgd=59344811, *pte=5903c6df, *ppte=5903c65f + Internal error: Oops: 80f [#1] SMP ARM + Modules linked in: mc exynosdrm(+) analogix_dp rtc_s3c exynos_ppmu i2c_gpio + CPU: 1 PID: 212 Comm: systemd-udevd Not tainted 5.6.0-rc2-next-20200219 #326 + videodev: Linux video capture interface: v2.00 + Hardware name: Samsung Exynos (Flattened Device Tree) + PC is at exynos_dsi_probe+0x1f0/0x384 [exynosdrm] + LR is at exynos_dsi_probe+0x1dc/0x384 [exynosdrm] + ... + Process systemd-udevd (pid: 212, stack limit = 0x(ptrval)) + ... + [] (exynos_dsi_probe [exynosdrm]) from [] (platform_drv_probe+0x6c/0xa4) + [] (platform_drv_probe) from [] (really_probe+0x210/0x350) + [] (really_probe) from [] (driver_probe_device+0x60/0x1a0) + [] (driver_probe_device) from [] (device_driver_attach+0x58/0x60) + [] (device_driver_attach) from [] (__driver_attach+0x80/0xbc) + [] (__driver_attach) from [] (bus_for_each_dev+0x68/0xb4) + [] (bus_for_each_dev) from [] (bus_add_driver+0x130/0x1e8) + [] (bus_add_driver) from [] (driver_register+0x78/0x110) + [] (driver_register) from [] (exynos_drm_init+0xe8/0x11c [exynosdrm]) + [] (exynos_drm_init [exynosdrm]) from [] (do_one_initcall+0x50/0x220) + [] (do_one_initcall) from [] (do_init_module+0x60/0x210) + [] (do_init_module) from [] (load_module+0x1c0c/0x2310) + [] (load_module) from [] (sys_finit_module+0xac/0xbc) + [] (sys_finit_module) from [] (ret_fast_syscall+0x0/0x54) + Exception stack(0xd979bfa8 to 0xd979bff0) + ... + ---[ end trace db16efe05faab470 ]--- + +Signed-off-by: Marek Szyprowski +Reviewed-by: Andrzej Hajda +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_drm_dsi.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c +index 5e202af7fbf53..2b6c04acb24f5 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c +@@ -1790,9 +1790,10 @@ static int exynos_dsi_probe(struct platform_device *pdev) + dsi->clks[i] = devm_clk_get(dev, clk_names[i]); + if (IS_ERR(dsi->clks[i])) { + if (strcmp(clk_names[i], "sclk_mipi") == 0) { +- strcpy(clk_names[i], OLD_SCLK_MIPI_CLK_NAME); +- i--; +- continue; ++ dsi->clks[i] = devm_clk_get(dev, ++ OLD_SCLK_MIPI_CLK_NAME); ++ if (!IS_ERR(dsi->clks[i])) ++ continue; + } + + dev_info(dev, "failed to get the clock: %s\n", +-- +2.20.1 + diff --git a/queue-4.9/drm-exynos-dsi-propagate-error-value-and-silence-mea.patch b/queue-4.9/drm-exynos-dsi-propagate-error-value-and-silence-mea.patch new file mode 100644 index 00000000000..435d67bd84b --- /dev/null +++ b/queue-4.9/drm-exynos-dsi-propagate-error-value-and-silence-mea.patch @@ -0,0 +1,41 @@ +From 8d28804a4330ce64f4032a19f60241d74dd60cbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Feb 2020 08:06:37 +0100 +Subject: drm/exynos: dsi: propagate error value and silence meaningless + warning + +From: Marek Szyprowski + +[ Upstream commit 0a9d1e3f3f038785ebc72d53f1c409d07f6b4ff5 ] + +Properly propagate error value from devm_regulator_bulk_get() and don't +confuse user with meaningless warning about failure in getting regulators +in case of deferred probe. + +Signed-off-by: Marek Szyprowski +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_drm_dsi.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c +index e07cb1fe48604..5e202af7fbf53 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c +@@ -1775,8 +1775,9 @@ static int exynos_dsi_probe(struct platform_device *pdev) + ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(dsi->supplies), + dsi->supplies); + if (ret) { +- dev_info(dev, "failed to get regulators: %d\n", ret); +- return -EPROBE_DEFER; ++ if (ret != -EPROBE_DEFER) ++ dev_info(dev, "failed to get regulators: %d\n", ret); ++ return ret; + } + + dsi->clks = devm_kzalloc(dev, +-- +2.20.1 + diff --git a/queue-4.9/powerpc-include-.btf-section.patch b/queue-4.9/powerpc-include-.btf-section.patch new file mode 100644 index 00000000000..00a8261bf72 --- /dev/null +++ b/queue-4.9/powerpc-include-.btf-section.patch @@ -0,0 +1,42 @@ +From 893d9f99cd5fb060685aefcf5940194d0847aa2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Feb 2020 17:01:32 +0530 +Subject: powerpc: Include .BTF section + +From: Naveen N. Rao + +[ Upstream commit cb0cc635c7a9fa8a3a0f75d4d896721819c63add ] + +Selecting CONFIG_DEBUG_INFO_BTF results in the below warning from ld: + ld: warning: orphan section `.BTF' from `.btf.vmlinux.bin.o' being placed in section `.BTF' + +Include .BTF section in vmlinux explicitly to fix the same. + +Signed-off-by: Naveen N. Rao +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200220113132.857132-1-naveen.n.rao@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/vmlinux.lds.S | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S +index 50d3650608558..c20510497c49d 100644 +--- a/arch/powerpc/kernel/vmlinux.lds.S ++++ b/arch/powerpc/kernel/vmlinux.lds.S +@@ -315,6 +315,12 @@ SECTIONS + *(.branch_lt) + } + ++#ifdef CONFIG_DEBUG_INFO_BTF ++ .BTF : AT(ADDR(.BTF) - LOAD_OFFSET) { ++ *(.BTF) ++ } ++#endif ++ + .opd : AT(ADDR(.opd) - LOAD_OFFSET) { + *(.opd) + } +-- +2.20.1 + diff --git a/queue-4.9/series b/queue-4.9/series new file mode 100644 index 00000000000..be87440f641 --- /dev/null +++ b/queue-4.9/series @@ -0,0 +1,7 @@ +spi-qup-call-spi_qup_pm_resume_runtime-before-suspen.patch +powerpc-include-.btf-section.patch +arm-dts-dra7-add-dma-ranges-property-to-pcie-rc-dt-n.patch +spi-zynqmp-remove-entry-that-causes-a-cs-glitch.patch +drm-exynos-dsi-propagate-error-value-and-silence-mea.patch +drm-exynos-dsi-fix-workaround-for-the-legacy-clock-n.patch +altera-stapl-altera_get_note-prevent-write-beyond-en.patch diff --git a/queue-4.9/spi-qup-call-spi_qup_pm_resume_runtime-before-suspen.patch b/queue-4.9/spi-qup-call-spi_qup_pm_resume_runtime-before-suspen.patch new file mode 100644 index 00000000000..135f67c66ef --- /dev/null +++ b/queue-4.9/spi-qup-call-spi_qup_pm_resume_runtime-before-suspen.patch @@ -0,0 +1,55 @@ +From b4f1d6604d36ced634e00e57ac1da355ee1774e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Feb 2020 13:13:40 +0530 +Subject: spi: qup: call spi_qup_pm_resume_runtime before suspending + +From: Yuji Sasaki + +[ Upstream commit 136b5cd2e2f97581ae560cff0db2a3b5369112da ] + +spi_qup_suspend() will cause synchronous external abort when +runtime suspend is enabled and applied, as it tries to +access SPI controller register while clock is already disabled +in spi_qup_pm_suspend_runtime(). + +Signed-off-by: Yuji sasaki +Signed-off-by: Vinod Koul +Link: https://lore.kernel.org/r/20200214074340.2286170-1-vkoul@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-qup.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c +index 1bfa889b8427a..88b108e1c85fe 100644 +--- a/drivers/spi/spi-qup.c ++++ b/drivers/spi/spi-qup.c +@@ -974,6 +974,11 @@ static int spi_qup_suspend(struct device *device) + struct spi_qup *controller = spi_master_get_devdata(master); + int ret; + ++ if (pm_runtime_suspended(device)) { ++ ret = spi_qup_pm_resume_runtime(device); ++ if (ret) ++ return ret; ++ } + ret = spi_master_suspend(master); + if (ret) + return ret; +@@ -982,10 +987,8 @@ static int spi_qup_suspend(struct device *device) + if (ret) + return ret; + +- if (!pm_runtime_suspended(device)) { +- clk_disable_unprepare(controller->cclk); +- clk_disable_unprepare(controller->iclk); +- } ++ clk_disable_unprepare(controller->cclk); ++ clk_disable_unprepare(controller->iclk); + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.9/spi-zynqmp-remove-entry-that-causes-a-cs-glitch.patch b/queue-4.9/spi-zynqmp-remove-entry-that-causes-a-cs-glitch.patch new file mode 100644 index 00000000000..1d1a7fd944c --- /dev/null +++ b/queue-4.9/spi-zynqmp-remove-entry-that-causes-a-cs-glitch.patch @@ -0,0 +1,58 @@ +From 7f4aab51ef79f4f784d53de6ca25cbed07c9998d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Feb 2020 17:26:43 +0100 +Subject: spi/zynqmp: remove entry that causes a cs glitch + +From: Thommy Jakobsson + +[ Upstream commit 5dd8304981ecffa77bb72b1c57c4be5dfe6cfae9 ] + +In the public interface for chipselect, there is always an entry +commented as "Dummy generic FIFO entry" pushed down to the fifo right +after the activate/deactivate command. The dummy entry is 0x0, +irregardless if the intention was to activate or deactive the cs. This +causes the cs line to glitch rather than beeing activated in the case +when there was an activate command. + +This has been observed on oscilloscope, and have caused problems for at +least one specific flash device type connected to the qspi port. After +the change the glitch is gone and cs goes active when intended. + +The reason why this worked before (except for the glitch) was because +when sending the actual data, the CS bits are once again set. Since +most flashes uses mode 0, there is always a half clk period anyway for +cs to clk active setup time. If someone would rely on timing from a +chip_select call to a transfer_one, it would fail though. + +It is unknown why the dummy entry was there in the first place, git log +seems to be of no help in this case. The reference manual gives no +indication of the necessity of this. In fact the lower 8 bits are a +setup (or hold in case of deactivate) time expressed in cycles. So this +should not be needed to fulfill any setup/hold timings. + +Signed-off-by: Thommy Jakobsson +Reviewed-by: Naga Sureshkumar Relli +Link: https://lore.kernel.org/r/20200224162643.29102-1-thommyj@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-zynqmp-gqspi.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c +index 18aeaceee2862..d26c0eda2d9ea 100644 +--- a/drivers/spi/spi-zynqmp-gqspi.c ++++ b/drivers/spi/spi-zynqmp-gqspi.c +@@ -415,9 +415,6 @@ static void zynqmp_qspi_chipselect(struct spi_device *qspi, bool is_high) + + zynqmp_gqspi_write(xqspi, GQSPI_GEN_FIFO_OFST, genfifoentry); + +- /* Dummy generic FIFO entry */ +- zynqmp_gqspi_write(xqspi, GQSPI_GEN_FIFO_OFST, 0x0); +- + /* Manually start the generic FIFO command */ + zynqmp_gqspi_write(xqspi, GQSPI_CONFIG_OFST, + zynqmp_gqspi_read(xqspi, GQSPI_CONFIG_OFST) | +-- +2.20.1 +