From a1cbf3d1774b713ebbc5662c625219cf45487ed8 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 26 Mar 2019 10:40:05 +0900 Subject: [PATCH] 4.4-stable patches added patches: arm64-traps-disable-irq-in-die.patch lib-int_sqrt-optimize-small-argument.patch serial-sprd-clear-timeout-interrupt-only-rather-than-all-interrupts.patch usb-core-only-clean-up-what-we-allocated.patch usb-renesas_usbhs-gadget-fix-unused-but-set-variable-warning.patch --- .../arm64-traps-disable-irq-in-die.patch | 62 ++++++++++++ ...lib-int_sqrt-optimize-small-argument.patch | 94 +++++++++++++++++++ ...rupt-only-rather-than-all-interrupts.patch | 46 +++++++++ queue-4.4/series | 5 + ...core-only-clean-up-what-we-allocated.patch | 48 ++++++++++ ...-fix-unused-but-set-variable-warning.patch | 45 +++++++++ 6 files changed, 300 insertions(+) create mode 100644 queue-4.4/arm64-traps-disable-irq-in-die.patch create mode 100644 queue-4.4/lib-int_sqrt-optimize-small-argument.patch create mode 100644 queue-4.4/serial-sprd-clear-timeout-interrupt-only-rather-than-all-interrupts.patch create mode 100644 queue-4.4/usb-core-only-clean-up-what-we-allocated.patch create mode 100644 queue-4.4/usb-renesas_usbhs-gadget-fix-unused-but-set-variable-warning.patch diff --git a/queue-4.4/arm64-traps-disable-irq-in-die.patch b/queue-4.4/arm64-traps-disable-irq-in-die.patch new file mode 100644 index 00000000000..f8544c5d8b4 --- /dev/null +++ b/queue-4.4/arm64-traps-disable-irq-in-die.patch @@ -0,0 +1,62 @@ +From 6f44a0bacb79a03972c83759711832b382b1b8ac Mon Sep 17 00:00:00 2001 +From: Qiao Zhou +Date: Fri, 7 Jul 2017 17:29:34 +0800 +Subject: arm64: traps: disable irq in die() + +From: Qiao Zhou + +commit 6f44a0bacb79a03972c83759711832b382b1b8ac upstream. + +In current die(), the irq is disabled for __die() handle, not +including the possible panic() handling. Since the log in __die() +can take several hundreds ms, new irq might come and interrupt +current die(). + +If the process calling die() holds some critical resource, and some +other process scheduled later also needs it, then it would deadlock. +The first panic will not be executed. + +So here disable irq for the whole flow of die(). + +Signed-off-by: Qiao Zhou +Signed-off-by: Will Deacon +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kernel/traps.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/arch/arm64/kernel/traps.c ++++ b/arch/arm64/kernel/traps.c +@@ -239,10 +239,12 @@ void die(const char *str, struct pt_regs + { + struct thread_info *thread = current_thread_info(); + int ret; ++ unsigned long flags; ++ ++ raw_spin_lock_irqsave(&die_lock, flags); + + oops_enter(); + +- raw_spin_lock_irq(&die_lock); + console_verbose(); + bust_spinlocks(1); + ret = __die(str, err, thread, regs); +@@ -252,13 +254,15 @@ void die(const char *str, struct pt_regs + + bust_spinlocks(0); + add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); +- raw_spin_unlock_irq(&die_lock); + oops_exit(); + + if (in_interrupt()) + panic("Fatal exception in interrupt"); + if (panic_on_oops) + panic("Fatal exception"); ++ ++ raw_spin_unlock_irqrestore(&die_lock, flags); ++ + if (ret != NOTIFY_STOP) + do_exit(SIGSEGV); + } diff --git a/queue-4.4/lib-int_sqrt-optimize-small-argument.patch b/queue-4.4/lib-int_sqrt-optimize-small-argument.patch new file mode 100644 index 00000000000..4e3d7e20d48 --- /dev/null +++ b/queue-4.4/lib-int_sqrt-optimize-small-argument.patch @@ -0,0 +1,94 @@ +From 3f3295709edea6268ff1609855f498035286af73 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Fri, 17 Nov 2017 15:28:04 -0800 +Subject: lib/int_sqrt: optimize small argument + +From: Peter Zijlstra + +commit 3f3295709edea6268ff1609855f498035286af73 upstream. + +The current int_sqrt() computation is sub-optimal for the case of small +@x. Which is the interesting case when we're going to do cumulative +distribution functions on idle times, which we assume to be a random +variable, where the target residency of the deepest idle state gives an +upper bound on the variable (5e6ns on recent Intel chips). + +In the case of small @x, the compute loop: + + while (m != 0) { + b = y + m; + y >>= 1; + + if (x >= b) { + x -= b; + y += m; + } + m >>= 2; + } + +can be reduced to: + + while (m > x) + m >>= 2; + +Because y==0, b==m and until x>=m y will remain 0. + +And while this is computationally equivalent, it runs much faster +because there's less code, in particular less branches. + + cycles: branches: branch-misses: + +OLD: + +hot: 45.109444 +- 0.044117 44.333392 +- 0.002254 0.018723 +- 0.000593 +cold: 187.737379 +- 0.156678 44.333407 +- 0.002254 6.272844 +- 0.004305 + +PRE: + +hot: 67.937492 +- 0.064124 66.999535 +- 0.000488 0.066720 +- 0.001113 +cold: 232.004379 +- 0.332811 66.999527 +- 0.000488 6.914634 +- 0.006568 + +POST: + +hot: 43.633557 +- 0.034373 45.333132 +- 0.002277 0.023529 +- 0.000681 +cold: 207.438411 +- 0.125840 45.333132 +- 0.002277 6.976486 +- 0.004219 + +Averages computed over all values <128k using a LFSR to generate order. +Cold numbers have a LFSR based branch trace buffer 'confuser' ran between +each int_sqrt() invocation. + +Link: http://lkml.kernel.org/r/20171020164644.876503355@infradead.org +Fixes: 30493cc9dddb ("lib/int_sqrt.c: optimize square root algorithm") +Signed-off-by: Peter Zijlstra (Intel) +Suggested-by: Anshul Garg +Acked-by: Linus Torvalds +Cc: Davidlohr Bueso +Cc: Thomas Gleixner +Cc: Ingo Molnar +Cc: Will Deacon +Cc: Joe Perches +Cc: David Miller +Cc: Matthew Wilcox +Cc: Kees Cook +Cc: Michael Davidson +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman + +--- + lib/int_sqrt.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/lib/int_sqrt.c ++++ b/lib/int_sqrt.c +@@ -22,6 +22,9 @@ unsigned long int_sqrt(unsigned long x) + return x; + + m = 1UL << (BITS_PER_LONG - 2); ++ while (m > x) ++ m >>= 2; ++ + while (m != 0) { + b = y + m; + y >>= 1; diff --git a/queue-4.4/serial-sprd-clear-timeout-interrupt-only-rather-than-all-interrupts.patch b/queue-4.4/serial-sprd-clear-timeout-interrupt-only-rather-than-all-interrupts.patch new file mode 100644 index 00000000000..b0b30c7ae4a --- /dev/null +++ b/queue-4.4/serial-sprd-clear-timeout-interrupt-only-rather-than-all-interrupts.patch @@ -0,0 +1,46 @@ +From 4350782570b919f254c1e083261a21c19fcaee90 Mon Sep 17 00:00:00 2001 +From: Lanqing Liu +Date: Tue, 18 Jul 2017 17:58:13 +0800 +Subject: serial: sprd: clear timeout interrupt only rather than all interrupts + +From: Lanqing Liu + +commit 4350782570b919f254c1e083261a21c19fcaee90 upstream. + +On Spreadtrum's serial device, nearly all of interrupts would be cleared +by hardware except timeout interrupt. This patch removed the operation +of clearing all interrupt in irq handler, instead added an if statement +to check if the timeout interrupt is supposed to be cleared. + +Wrongly clearing timeout interrupt would lead to uart data stay in rx +fifo, that means the driver cannot read them out anymore. + +Signed-off-by: Lanqing Liu +Signed-off-by: Chunyan Zhang +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/sprd_serial.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/sprd_serial.c ++++ b/drivers/tty/serial/sprd_serial.c +@@ -63,6 +63,7 @@ + + /* interrupt clear register */ + #define SPRD_ICLR 0x0014 ++#define SPRD_ICLR_TIMEOUT BIT(13) + + /* line control register */ + #define SPRD_LCR 0x0018 +@@ -298,7 +299,8 @@ static irqreturn_t sprd_handle_irq(int i + return IRQ_NONE; + } + +- serial_out(port, SPRD_ICLR, ~0); ++ if (ims & SPRD_IMSR_TIMEOUT) ++ serial_out(port, SPRD_ICLR, SPRD_ICLR_TIMEOUT); + + if (ims & (SPRD_IMSR_RX_FIFO_FULL | + SPRD_IMSR_BREAK_DETECT | SPRD_IMSR_TIMEOUT)) diff --git a/queue-4.4/series b/queue-4.4/series index 6bc9378d658..1e4d36ab969 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -28,3 +28,8 @@ usb-gadget-add-the-gserial-port-checking-in-gs_start_tx.patch tcp-dccp-drop-syn-packets-if-accept-queue-is-full.patch serial-sprd-adjust-timeout-to-a-big-value.patch hang-soft-lockup-in-d_invalidate-with-simultaneous-calls.patch +arm64-traps-disable-irq-in-die.patch +usb-renesas_usbhs-gadget-fix-unused-but-set-variable-warning.patch +serial-sprd-clear-timeout-interrupt-only-rather-than-all-interrupts.patch +lib-int_sqrt-optimize-small-argument.patch +usb-core-only-clean-up-what-we-allocated.patch diff --git a/queue-4.4/usb-core-only-clean-up-what-we-allocated.patch b/queue-4.4/usb-core-only-clean-up-what-we-allocated.patch new file mode 100644 index 00000000000..a27626e6530 --- /dev/null +++ b/queue-4.4/usb-core-only-clean-up-what-we-allocated.patch @@ -0,0 +1,48 @@ +From 32fd87b3bbf5f7a045546401dfe2894dbbf4d8c3 Mon Sep 17 00:00:00 2001 +From: Andrey Konovalov +Date: Mon, 11 Dec 2017 22:48:41 +0100 +Subject: USB: core: only clean up what we allocated + +From: Andrey Konovalov + +commit 32fd87b3bbf5f7a045546401dfe2894dbbf4d8c3 upstream. + +When cleaning up the configurations, make sure we only free the number +of configurations and interfaces that we could have allocated. + +Reported-by: Andrey Konovalov +Cc: stable +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/config.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -734,18 +734,21 @@ void usb_destroy_configuration(struct us + return; + + if (dev->rawdescriptors) { +- for (i = 0; i < dev->descriptor.bNumConfigurations; i++) ++ for (i = 0; i < dev->descriptor.bNumConfigurations && ++ i < USB_MAXCONFIG; i++) + kfree(dev->rawdescriptors[i]); + + kfree(dev->rawdescriptors); + dev->rawdescriptors = NULL; + } + +- for (c = 0; c < dev->descriptor.bNumConfigurations; c++) { ++ for (c = 0; c < dev->descriptor.bNumConfigurations && ++ c < USB_MAXCONFIG; c++) { + struct usb_host_config *cf = &dev->config[c]; + + kfree(cf->string); +- for (i = 0; i < cf->desc.bNumInterfaces; i++) { ++ for (i = 0; i < cf->desc.bNumInterfaces && ++ i < USB_MAXINTERFACES; i++) { + if (cf->intf_cache[i]) + kref_put(&cf->intf_cache[i]->ref, + usb_release_interface_cache); diff --git a/queue-4.4/usb-renesas_usbhs-gadget-fix-unused-but-set-variable-warning.patch b/queue-4.4/usb-renesas_usbhs-gadget-fix-unused-but-set-variable-warning.patch new file mode 100644 index 00000000000..fe3d4e0244d --- /dev/null +++ b/queue-4.4/usb-renesas_usbhs-gadget-fix-unused-but-set-variable-warning.patch @@ -0,0 +1,45 @@ +From b7d44c36a6f6d956e1539e0dd42f98b26e5a4684 Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Fri, 28 Jul 2017 19:28:57 +0900 +Subject: usb: renesas_usbhs: gadget: fix unused-but-set-variable warning + +From: Yoshihiro Shimoda + +commit b7d44c36a6f6d956e1539e0dd42f98b26e5a4684 upstream. + +The commit b8b9c974afee ("usb: renesas_usbhs: gadget: disable all eps +when the driver stops") causes the unused-but-set-variable warning. +But, if the usbhsg_ep_disable() will return non-zero value, udc/core.c +doesn't clear the ep->enabled flag. So, this driver should not return +non-zero value, if the pipe is zero because this means the pipe is +already disabled. Otherwise, the ep->enabled flag is never cleared +when the usbhsg_ep_disable() is called by the renesas_usbhs driver first. + +Fixes: b8b9c974afee ("usb: renesas_usbhs: gadget: disable all eps when the driver stops") +Fixes: 11432050f070 ("usb: renesas_usbhs: gadget: fix NULL pointer dereference in ep_disable()") +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/renesas_usbhs/mod_gadget.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +--- a/drivers/usb/renesas_usbhs/mod_gadget.c ++++ b/drivers/usb/renesas_usbhs/mod_gadget.c +@@ -641,14 +641,11 @@ static int usbhsg_ep_disable(struct usb_ + struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep); + struct usbhs_pipe *pipe; + unsigned long flags; +- int ret = 0; + + spin_lock_irqsave(&uep->lock, flags); + pipe = usbhsg_uep_to_pipe(uep); +- if (!pipe) { +- ret = -EINVAL; ++ if (!pipe) + goto out; +- } + + usbhsg_pipe_disable(uep); + usbhs_pipe_free(pipe); -- 2.47.2