From: Greg Kroah-Hartman Date: Mon, 27 Apr 2020 18:30:07 +0000 (+0200) Subject: 5.6-stable patches X-Git-Tag: v4.19.119~10 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=17e6ef65e1f000598bae519921823a251a4f4fa3;p=thirdparty%2Fkernel%2Fstable-queue.git 5.6-stable patches added patches: arm-imx-provide-v7_cpu_resume-only-on-arm_cpu_suspend-y.patch cdc-acm-close-race-betrween-suspend-and-acm_softint.patch cdc-acm-introduce-a-cool-down.patch cifs-fix-uninitialised-lease_key-in-open_shroot.patch fpga-dfl-pci-fix-return-value-of-cci_pci_sriov_configure.patch mei-me-fix-irq-number-stored-in-hw-struct.patch powerpc-8xx-fix-strict_kernel_rwx-startup-test-failure.patch powerpc-setup_64-set-cache-line-size-based-on-cache-block-size.patch revert-serial-uartps-change-uart-id-port-allocation.patch revert-serial-uartps-do-not-allow-use-aliases-max_uart_instances.patch revert-serial-uartps-fix-error-path-when-alloc-failed.patch revert-serial-uartps-fix-uartps_major-handling.patch revert-serial-uartps-move-port-id-to-device-data-structure.patch revert-serial-uartps-register-own-uart-console-and-driver-structures.patch revert-serial-uartps-use-the-same-dynamic-major-number-for-all-ports.patch serial-sh-sci-make-sure-status-register-scxsr-is-read-in-correct-sequence.patch staging-comedi-dt2815-fix-writing-hi-byte-of-analog-output.patch staging-comedi-fix-comedi_device-refcnt-leak-in-comedi_open.patch staging-vt6656-don-t-set-rcr_multicast-or-rcr_broadcast-by-default.patch staging-vt6656-fix-calling-conditions-of-vnt_set_bss_mode.patch staging-vt6656-fix-drivers-tbtt-timing-counter.patch staging-vt6656-fix-pairwise-key-entry-save.patch staging-vt6656-power-save-stop-wake_up_count-wrap-around.patch uas-fix-deadlock-in-error-handling-and-pm-flushing-work.patch uas-no-use-logging-any-details-in-case-of-enodev.patch usb-dwc3-gadget-fix-request-completion-check.patch usb-f_fs-clear-os-extended-descriptor-counts-to-zero-in-ffs_data_reset.patch usb-typec-altmode-fix-typec_altmode_get_partner-sometimes-returning-an-invalid-pointer.patch usb-typec-tcpm-ignore-cc-and-vbus-changes-in-port_reset-change.patch vt-don-t-hardcode-the-mem-allocation-upper-bound.patch vt-don-t-use-kmalloc-for-the-unicode-screen-buffer.patch xhci-don-t-clear-hub-tt-buffer-on-ep0-protocol-stall.patch xhci-fix-handling-halted-endpoint-even-if-endpoint-ring-appears-empty.patch xhci-prevent-bus-suspend-if-a-roothub-port-detected-a-over-current-condition.patch --- diff --git a/queue-5.6/arm-imx-provide-v7_cpu_resume-only-on-arm_cpu_suspend-y.patch b/queue-5.6/arm-imx-provide-v7_cpu_resume-only-on-arm_cpu_suspend-y.patch new file mode 100644 index 00000000000..2e931b3063b --- /dev/null +++ b/queue-5.6/arm-imx-provide-v7_cpu_resume-only-on-arm_cpu_suspend-y.patch @@ -0,0 +1,46 @@ +From f1baca8896ae18e12c45552a4c4ae2086aa7e02c Mon Sep 17 00:00:00 2001 +From: Ahmad Fatoum +Date: Mon, 23 Mar 2020 09:19:33 +0100 +Subject: ARM: imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y + +From: Ahmad Fatoum + +commit f1baca8896ae18e12c45552a4c4ae2086aa7e02c upstream. + +512a928affd5 ("ARM: imx: build v7_cpu_resume() unconditionally") +introduced an unintended linker error for i.MX6 configurations that have +ARM_CPU_SUSPEND=n which can happen if neither CONFIG_PM, CONFIG_CPU_IDLE, +nor ARM_PSCI_FW are selected. + +Fix this by having v7_cpu_resume() compiled only when cpu_resume() it +calls is available as well. + +The C declaration for the function remains unguarded to avoid future code +inadvertently using a stub and introducing a regression to the bug the +original commit fixed. + +Cc: +Fixes: 512a928affd5 ("ARM: imx: build v7_cpu_resume() unconditionally") +Reported-by: Clemens Gruber +Signed-off-by: Ahmad Fatoum +Tested-by: Roland Hieber +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-imx/Makefile | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm/mach-imx/Makefile ++++ b/arch/arm/mach-imx/Makefile +@@ -91,8 +91,10 @@ AFLAGS_suspend-imx6.o :=-Wa,-march=armv7 + obj-$(CONFIG_SOC_IMX6) += suspend-imx6.o + obj-$(CONFIG_SOC_IMX53) += suspend-imx53.o + endif ++ifeq ($(CONFIG_ARM_CPU_SUSPEND),y) + AFLAGS_resume-imx6.o :=-Wa,-march=armv7-a + obj-$(CONFIG_SOC_IMX6) += resume-imx6.o ++endif + obj-$(CONFIG_SOC_IMX6) += pm-imx6.o + + obj-$(CONFIG_SOC_IMX1) += mach-imx1.o diff --git a/queue-5.6/cdc-acm-close-race-betrween-suspend-and-acm_softint.patch b/queue-5.6/cdc-acm-close-race-betrween-suspend-and-acm_softint.patch new file mode 100644 index 00000000000..aceb79f5272 --- /dev/null +++ b/queue-5.6/cdc-acm-close-race-betrween-suspend-and-acm_softint.patch @@ -0,0 +1,44 @@ +From 0afccd7601514c4b83d8cc58c740089cc447051d Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 15 Apr 2020 17:13:57 +0200 +Subject: cdc-acm: close race betrween suspend() and acm_softint + +From: Oliver Neukum + +commit 0afccd7601514c4b83d8cc58c740089cc447051d upstream. + +Suspend increments a counter, then kills the URBs, +then kills the scheduled work. The scheduled work, however, +may reschedule the URBs. Fix this by having the work +check the counter. + +Signed-off-by: Oliver Neukum +Cc: stable +Tested-by: Jonas Karlsson +Link: https://lore.kernel.org/r/20200415151358.32664-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -557,14 +557,14 @@ static void acm_softint(struct work_stru + struct acm *acm = container_of(work, struct acm, work); + + if (test_bit(EVENT_RX_STALL, &acm->flags)) { +- if (!(usb_autopm_get_interface(acm->data))) { ++ smp_mb(); /* against acm_suspend() */ ++ if (!acm->susp_count) { + for (i = 0; i < acm->rx_buflimit; i++) + usb_kill_urb(acm->read_urbs[i]); + usb_clear_halt(acm->dev, acm->in); + acm_submit_read_urbs(acm, GFP_KERNEL); +- usb_autopm_put_interface(acm->data); ++ clear_bit(EVENT_RX_STALL, &acm->flags); + } +- clear_bit(EVENT_RX_STALL, &acm->flags); + } + + if (test_and_clear_bit(EVENT_TTY_WAKEUP, &acm->flags)) diff --git a/queue-5.6/cdc-acm-introduce-a-cool-down.patch b/queue-5.6/cdc-acm-introduce-a-cool-down.patch new file mode 100644 index 00000000000..29a8a5dbd85 --- /dev/null +++ b/queue-5.6/cdc-acm-introduce-a-cool-down.patch @@ -0,0 +1,137 @@ +From a4e7279cd1d19f48f0af2a10ed020febaa9ac092 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 15 Apr 2020 17:13:58 +0200 +Subject: cdc-acm: introduce a cool down + +From: Oliver Neukum + +commit a4e7279cd1d19f48f0af2a10ed020febaa9ac092 upstream. + +Immediate submission in case of a babbling device can lead +to a busy loop. Introducing a delayed work. + +Signed-off-by: Oliver Neukum +Cc: stable +Tested-by: Jonas Karlsson +Link: https://lore.kernel.org/r/20200415151358.32664-2-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 30 ++++++++++++++++++++++++++++-- + drivers/usb/class/cdc-acm.h | 5 ++++- + 2 files changed, 32 insertions(+), 3 deletions(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -412,9 +412,12 @@ static void acm_ctrl_irq(struct urb *urb + + exit: + retval = usb_submit_urb(urb, GFP_ATOMIC); +- if (retval && retval != -EPERM) ++ if (retval && retval != -EPERM && retval != -ENODEV) + dev_err(&acm->control->dev, + "%s - usb_submit_urb failed: %d\n", __func__, retval); ++ else ++ dev_vdbg(&acm->control->dev, ++ "control resubmission terminated %d\n", retval); + } + + static int acm_submit_read_urb(struct acm *acm, int index, gfp_t mem_flags) +@@ -430,6 +433,8 @@ static int acm_submit_read_urb(struct ac + dev_err(&acm->data->dev, + "urb %d failed submission with %d\n", + index, res); ++ } else { ++ dev_vdbg(&acm->data->dev, "intended failure %d\n", res); + } + set_bit(index, &acm->read_urbs_free); + return res; +@@ -471,6 +476,7 @@ static void acm_read_bulk_callback(struc + int status = urb->status; + bool stopped = false; + bool stalled = false; ++ bool cooldown = false; + + dev_vdbg(&acm->data->dev, "got urb %d, len %d, status %d\n", + rb->index, urb->actual_length, status); +@@ -497,6 +503,14 @@ static void acm_read_bulk_callback(struc + __func__, status); + stopped = true; + break; ++ case -EOVERFLOW: ++ case -EPROTO: ++ dev_dbg(&acm->data->dev, ++ "%s - cooling babbling device\n", __func__); ++ usb_mark_last_busy(acm->dev); ++ set_bit(rb->index, &acm->urbs_in_error_delay); ++ cooldown = true; ++ break; + default: + dev_dbg(&acm->data->dev, + "%s - nonzero urb status received: %d\n", +@@ -518,9 +532,11 @@ static void acm_read_bulk_callback(struc + */ + smp_mb__after_atomic(); + +- if (stopped || stalled) { ++ if (stopped || stalled || cooldown) { + if (stalled) + schedule_work(&acm->work); ++ else if (cooldown) ++ schedule_delayed_work(&acm->dwork, HZ / 2); + return; + } + +@@ -567,6 +583,12 @@ static void acm_softint(struct work_stru + } + } + ++ if (test_and_clear_bit(ACM_ERROR_DELAY, &acm->flags)) { ++ for (i = 0; i < ACM_NR; i++) ++ if (test_and_clear_bit(i, &acm->urbs_in_error_delay)) ++ acm_submit_read_urb(acm, i, GFP_NOIO); ++ } ++ + if (test_and_clear_bit(EVENT_TTY_WAKEUP, &acm->flags)) + tty_port_tty_wakeup(&acm->port); + } +@@ -1333,6 +1355,7 @@ made_compressed_probe: + acm->readsize = readsize; + acm->rx_buflimit = num_rx_buf; + INIT_WORK(&acm->work, acm_softint); ++ INIT_DELAYED_WORK(&acm->dwork, acm_softint); + init_waitqueue_head(&acm->wioctl); + spin_lock_init(&acm->write_lock); + spin_lock_init(&acm->read_lock); +@@ -1542,6 +1565,7 @@ static void acm_disconnect(struct usb_in + + acm_kill_urbs(acm); + cancel_work_sync(&acm->work); ++ cancel_delayed_work_sync(&acm->dwork); + + tty_unregister_device(acm_tty_driver, acm->minor); + +@@ -1584,6 +1608,8 @@ static int acm_suspend(struct usb_interf + + acm_kill_urbs(acm); + cancel_work_sync(&acm->work); ++ cancel_delayed_work_sync(&acm->dwork); ++ acm->urbs_in_error_delay = 0; + + return 0; + } +--- a/drivers/usb/class/cdc-acm.h ++++ b/drivers/usb/class/cdc-acm.h +@@ -109,8 +109,11 @@ struct acm { + # define EVENT_TTY_WAKEUP 0 + # define EVENT_RX_STALL 1 + # define ACM_THROTTLED 2 ++# define ACM_ERROR_DELAY 3 ++ unsigned long urbs_in_error_delay; /* these need to be restarted after a delay */ + struct usb_cdc_line_coding line; /* bits, stop, parity */ +- struct work_struct work; /* work queue entry for line discipline waking up */ ++ struct work_struct work; /* work queue entry for various purposes*/ ++ struct delayed_work dwork; /* for cool downs needed in error recovery */ + unsigned int ctrlin; /* input control lines (DCD, DSR, RI, break, overruns) */ + unsigned int ctrlout; /* output control lines (DTR, RTS) */ + struct async_icount iocount; /* counters for control line changes */ diff --git a/queue-5.6/cifs-fix-uninitialised-lease_key-in-open_shroot.patch b/queue-5.6/cifs-fix-uninitialised-lease_key-in-open_shroot.patch new file mode 100644 index 00000000000..a235cbd29f3 --- /dev/null +++ b/queue-5.6/cifs-fix-uninitialised-lease_key-in-open_shroot.patch @@ -0,0 +1,41 @@ +From 0fe0781f29dd8ab618999e6bda33c782ebbdb109 Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Mon, 20 Apr 2020 23:44:24 -0300 +Subject: cifs: fix uninitialised lease_key in open_shroot() + +From: Paulo Alcantara + +commit 0fe0781f29dd8ab618999e6bda33c782ebbdb109 upstream. + +SMB2_open_init() expects a pre-initialised lease_key when opening a +file with a lease, so set pfid->lease_key prior to calling it in +open_shroot(). + +This issue was observed when performing some DFS failover tests and +the lease key was never randomly generated. + +Signed-off-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Reviewed-by: Ronnie Sahlberg +Reviewed-by: Aurelien Aptel +CC: Stable +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/smb2ops.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -693,6 +693,11 @@ int open_shroot(unsigned int xid, struct + if (smb3_encryption_required(tcon)) + flags |= CIFS_TRANSFORM_REQ; + ++ if (!server->ops->new_lease_key) ++ return -EIO; ++ ++ server->ops->new_lease_key(pfid); ++ + memset(rqst, 0, sizeof(rqst)); + resp_buftype[0] = resp_buftype[1] = CIFS_NO_BUFFER; + memset(rsp_iov, 0, sizeof(rsp_iov)); diff --git a/queue-5.6/fpga-dfl-pci-fix-return-value-of-cci_pci_sriov_configure.patch b/queue-5.6/fpga-dfl-pci-fix-return-value-of-cci_pci_sriov_configure.patch new file mode 100644 index 00000000000..b3748633e3b --- /dev/null +++ b/queue-5.6/fpga-dfl-pci-fix-return-value-of-cci_pci_sriov_configure.patch @@ -0,0 +1,46 @@ +From 3c2760b78f90db874401d97e3c17829e2e36f400 Mon Sep 17 00:00:00 2001 +From: Xu Yilun +Date: Tue, 25 Feb 2020 14:07:18 +0800 +Subject: fpga: dfl: pci: fix return value of cci_pci_sriov_configure + +From: Xu Yilun + +commit 3c2760b78f90db874401d97e3c17829e2e36f400 upstream. + +pci_driver.sriov_configure should return negative value on error and +number of enabled VFs on success. But now the driver returns 0 on +success. The sriov configure still works but will cause a warning +message: + + XX VFs requested; only 0 enabled + +This patch changes the return value accordingly. + +Cc: stable@vger.kernel.org +Signed-off-by: Xu Yilun +Signed-off-by: Wu Hao +Signed-off-by: Moritz Fischer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/fpga/dfl-pci.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/fpga/dfl-pci.c ++++ b/drivers/fpga/dfl-pci.c +@@ -248,11 +248,13 @@ static int cci_pci_sriov_configure(struc + return ret; + + ret = pci_enable_sriov(pcidev, num_vfs); +- if (ret) ++ if (ret) { + dfl_fpga_cdev_config_ports_pf(cdev); ++ return ret; ++ } + } + +- return ret; ++ return num_vfs; + } + + static void cci_pci_remove(struct pci_dev *pcidev) diff --git a/queue-5.6/mei-me-fix-irq-number-stored-in-hw-struct.patch b/queue-5.6/mei-me-fix-irq-number-stored-in-hw-struct.patch new file mode 100644 index 00000000000..2fc08d188b0 --- /dev/null +++ b/queue-5.6/mei-me-fix-irq-number-stored-in-hw-struct.patch @@ -0,0 +1,41 @@ +From fec874a81b3ec280b91034d892a432fc71fd1522 Mon Sep 17 00:00:00 2001 +From: Benjamin Lee +Date: Fri, 17 Apr 2020 11:45:38 -0700 +Subject: mei: me: fix irq number stored in hw struct + +From: Benjamin Lee + +commit fec874a81b3ec280b91034d892a432fc71fd1522 upstream. + +Commit 261b3e1f2a01 ("mei: me: store irq number in the hw struct.") +stores the irq number in the hw struct before MSI is enabled. This +caused a regression for mei_me_synchronize_irq() waiting for the wrong +irq number. On my laptop this causes a hang on shutdown. Fix the issue +by storing the irq number after enabling MSI. + +Fixes: 261b3e1f2a01 ("mei: me: store irq number in the hw struct.") +Signed-off-by: Benjamin Lee +Cc: stable +Link: https://lore.kernel.org/r/20200417184538.349550-1-ben@b1c1l1.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/mei/pci-me.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/misc/mei/pci-me.c ++++ b/drivers/misc/mei/pci-me.c +@@ -212,11 +212,12 @@ static int mei_me_probe(struct pci_dev * + } + hw = to_me_hw(dev); + hw->mem_addr = pcim_iomap_table(pdev)[0]; +- hw->irq = pdev->irq; + hw->read_fws = mei_me_read_fws; + + pci_enable_msi(pdev); + ++ hw->irq = pdev->irq; ++ + /* request and enable interrupt */ + irqflags = pci_dev_msi_enabled(pdev) ? IRQF_ONESHOT : IRQF_SHARED; + diff --git a/queue-5.6/powerpc-8xx-fix-strict_kernel_rwx-startup-test-failure.patch b/queue-5.6/powerpc-8xx-fix-strict_kernel_rwx-startup-test-failure.patch new file mode 100644 index 00000000000..fe3f3125eca --- /dev/null +++ b/queue-5.6/powerpc-8xx-fix-strict_kernel_rwx-startup-test-failure.patch @@ -0,0 +1,49 @@ +From b61c38baa98056d4802ff5be5cfb979efc2d0f7a Mon Sep 17 00:00:00 2001 +From: Christophe Leroy +Date: Mon, 20 Apr 2020 05:37:42 +0000 +Subject: powerpc/8xx: Fix STRICT_KERNEL_RWX startup test failure + +From: Christophe Leroy + +commit b61c38baa98056d4802ff5be5cfb979efc2d0f7a upstream. + +WRITE_RO lkdtm test works. + +But when selecting CONFIG_DEBUG_RODATA_TEST, the kernel reports + rodata_test: test data was not read only + +This is because when rodata test runs, there are still old entries +in TLB. + +Flush TLB after setting kernel pages RO or NX. + +Fixes: d5f17ee96447 ("powerpc/8xx: don't disable large TLBs with CONFIG_STRICT_KERNEL_RWX") +Cc: stable@vger.kernel.org # v5.1+ +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/485caac75f195f18c11eb077b0031fdd2bb7fb9e.1587361039.git.christophe.leroy@c-s.fr +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/mm/nohash/8xx.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/powerpc/mm/nohash/8xx.c ++++ b/arch/powerpc/mm/nohash/8xx.c +@@ -185,6 +185,7 @@ void mmu_mark_initmem_nx(void) + mmu_mapin_ram_chunk(etext8, einittext8, PAGE_KERNEL); + } + } ++ _tlbil_all(); + } + + #ifdef CONFIG_STRICT_KERNEL_RWX +@@ -199,6 +200,8 @@ void mmu_mark_rodata_ro(void) + ~(LARGE_PAGE_SIZE_8M - 1))); + mmu_patch_addis(&patch__dtlbmiss_romem_top, -__pa(_sinittext)); + ++ _tlbil_all(); ++ + /* Update page tables for PTDUMP and BDI */ + mmu_mapin_ram_chunk(0, sinittext, __pgprot(0)); + mmu_mapin_ram_chunk(0, etext, PAGE_KERNEL_ROX); diff --git a/queue-5.6/powerpc-setup_64-set-cache-line-size-based-on-cache-block-size.patch b/queue-5.6/powerpc-setup_64-set-cache-line-size-based-on-cache-block-size.patch new file mode 100644 index 00000000000..39bb6c74e55 --- /dev/null +++ b/queue-5.6/powerpc-setup_64-set-cache-line-size-based-on-cache-block-size.patch @@ -0,0 +1,53 @@ +From 94c0b013c98583614e1ad911e8795ca36da34a85 Mon Sep 17 00:00:00 2001 +From: Chris Packham +Date: Fri, 17 Apr 2020 10:19:08 +1200 +Subject: powerpc/setup_64: Set cache-line-size based on cache-block-size + +From: Chris Packham + +commit 94c0b013c98583614e1ad911e8795ca36da34a85 upstream. + +If {i,d}-cache-block-size is set and {i,d}-cache-line-size is not, use +the block-size value for both. Per the devicetree spec cache-line-size +is only needed if it differs from the block size. + +Originally the code would fallback from block size to line size. An +error message was printed if both properties were missing. + +Later the code was refactored to use clearer names and logic but it +inadvertently made line size a required property, meaning on systems +without a line size property we fall back to the default from the +cputable. + +On powernv (OPAL) platforms, since the introduction of device tree CPU +features (5a61ef74f269 ("powerpc/64s: Support new device tree binding +for discovering CPU features")), that has led to the wrong value being +used, as the fallback value is incorrect for Power8/Power9 CPUs. + +The incorrect values flow through to the VDSO and also to the sysconf +values, SC_LEVEL1_ICACHE_LINESIZE etc. + +Fixes: bd067f83b084 ("powerpc/64: Fix naming of cache block vs. cache line") +Cc: stable@vger.kernel.org # v4.11+ +Signed-off-by: Chris Packham +Reported-by: Qian Cai +[mpe: Add even more detail to change log] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200416221908.7886-1-chris.packham@alliedtelesis.co.nz +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/setup_64.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/powerpc/kernel/setup_64.c ++++ b/arch/powerpc/kernel/setup_64.c +@@ -534,6 +534,8 @@ static bool __init parse_cache_info(stru + lsizep = of_get_property(np, propnames[3], NULL); + if (bsizep == NULL) + bsizep = lsizep; ++ if (lsizep == NULL) ++ lsizep = bsizep; + if (lsizep != NULL) + lsize = be32_to_cpu(*lsizep); + if (bsizep != NULL) diff --git a/queue-5.6/revert-serial-uartps-change-uart-id-port-allocation.patch b/queue-5.6/revert-serial-uartps-change-uart-id-port-allocation.patch new file mode 100644 index 00000000000..5b6e97b2d3d --- /dev/null +++ b/queue-5.6/revert-serial-uartps-change-uart-id-port-allocation.patch @@ -0,0 +1,188 @@ +From 72d68197281e2ad313960504d10b0c41ff87fd55 Mon Sep 17 00:00:00 2001 +From: Michal Simek +Date: Fri, 3 Apr 2020 11:24:34 +0200 +Subject: Revert "serial: uartps: Change uart ID port allocation" + +From: Michal Simek + +commit 72d68197281e2ad313960504d10b0c41ff87fd55 upstream. + +This reverts commit ae1cca3fa3478be92948dbbcd722390272032ade. + +With setting up NR_PORTS to 16 to be able to use serial2 and higher +aliases and don't loose functionality which was intended by these changes. + +As Johan says, this driver needs a lot more work and these changes are +only going in the wrong direction: + https://lkml.kernel.org/r/20190523091839.GC568@localhost + +Reported-by: Johan Hovold +Signed-off-by: Michal Simek +Cc: stable +Link: https://lore.kernel.org/r/a94931b65ce0089f76fb1fe6b446a08731bff754.1585905873.git.michal.simek@xilinx.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/xilinx_uartps.c | 111 ++++--------------------------------- + 1 file changed, 13 insertions(+), 98 deletions(-) + +--- a/drivers/tty/serial/xilinx_uartps.c ++++ b/drivers/tty/serial/xilinx_uartps.c +@@ -27,6 +27,7 @@ + #define CDNS_UART_TTY_NAME "ttyPS" + #define CDNS_UART_NAME "xuartps" + #define CDNS_UART_MAJOR 0 /* use dynamic node allocation */ ++#define CDNS_UART_NR_PORTS 16 + #define CDNS_UART_FIFO_SIZE 64 /* FIFO size */ + #define CDNS_UART_REGISTER_SPACE 0x1000 + #define TX_TIMEOUT 500000 +@@ -1415,90 +1416,6 @@ static const struct of_device_id cdns_ua + }; + MODULE_DEVICE_TABLE(of, cdns_uart_of_match); + +-/* +- * Maximum number of instances without alias IDs but if there is alias +- * which target "< MAX_UART_INSTANCES" range this ID can't be used. +- */ +-#define MAX_UART_INSTANCES 32 +- +-/* Stores static aliases list */ +-static DECLARE_BITMAP(alias_bitmap, MAX_UART_INSTANCES); +-static int alias_bitmap_initialized; +- +-/* Stores actual bitmap of allocated IDs with alias IDs together */ +-static DECLARE_BITMAP(bitmap, MAX_UART_INSTANCES); +-/* Protect bitmap operations to have unique IDs */ +-static DEFINE_MUTEX(bitmap_lock); +- +-static int cdns_get_id(struct platform_device *pdev) +-{ +- int id, ret; +- +- mutex_lock(&bitmap_lock); +- +- /* Alias list is stable that's why get alias bitmap only once */ +- if (!alias_bitmap_initialized) { +- ret = of_alias_get_alias_list(cdns_uart_of_match, "serial", +- alias_bitmap, MAX_UART_INSTANCES); +- if (ret && ret != -EOVERFLOW) { +- mutex_unlock(&bitmap_lock); +- return ret; +- } +- +- alias_bitmap_initialized++; +- } +- +- /* Make sure that alias ID is not taken by instance without alias */ +- bitmap_or(bitmap, bitmap, alias_bitmap, MAX_UART_INSTANCES); +- +- dev_dbg(&pdev->dev, "Alias bitmap: %*pb\n", +- MAX_UART_INSTANCES, bitmap); +- +- /* Look for a serialN alias */ +- id = of_alias_get_id(pdev->dev.of_node, "serial"); +- if (id < 0) { +- dev_warn(&pdev->dev, +- "No serial alias passed. Using the first free id\n"); +- +- /* +- * Start with id 0 and check if there is no serial0 alias +- * which points to device which is compatible with this driver. +- * If alias exists then try next free position. +- */ +- id = 0; +- +- for (;;) { +- dev_info(&pdev->dev, "Checking id %d\n", id); +- id = find_next_zero_bit(bitmap, MAX_UART_INSTANCES, id); +- +- /* No free empty instance */ +- if (id == MAX_UART_INSTANCES) { +- dev_err(&pdev->dev, "No free ID\n"); +- mutex_unlock(&bitmap_lock); +- return -EINVAL; +- } +- +- dev_dbg(&pdev->dev, "The empty id is %d\n", id); +- /* Check if ID is empty */ +- if (!test_and_set_bit(id, bitmap)) { +- /* Break the loop if bit is taken */ +- dev_dbg(&pdev->dev, +- "Selected ID %d allocation passed\n", +- id); +- break; +- } +- dev_dbg(&pdev->dev, +- "Selected ID %d allocation failed\n", id); +- /* if taking bit fails then try next one */ +- id++; +- } +- } +- +- mutex_unlock(&bitmap_lock); +- +- return id; +-} +- + /** + * cdns_uart_probe - Platform driver probe + * @pdev: Pointer to the platform device structure +@@ -1532,17 +1449,21 @@ static int cdns_uart_probe(struct platfo + if (!cdns_uart_uart_driver) + return -ENOMEM; + +- cdns_uart_data->id = cdns_get_id(pdev); ++ /* Look for a serialN alias */ ++ cdns_uart_data->id = of_alias_get_id(pdev->dev.of_node, "serial"); + if (cdns_uart_data->id < 0) +- return cdns_uart_data->id; ++ cdns_uart_data->id = 0; ++ ++ if (cdns_uart_data->id >= CDNS_UART_NR_PORTS) { ++ dev_err(&pdev->dev, "Cannot get uart_port structure\n"); ++ return -ENODEV; ++ } + + /* There is a need to use unique driver name */ + driver_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s%d", + CDNS_UART_NAME, cdns_uart_data->id); +- if (!driver_name) { +- rc = -ENOMEM; +- goto err_out_id; +- } ++ if (!driver_name) ++ return -ENOMEM; + + cdns_uart_uart_driver->owner = THIS_MODULE; + cdns_uart_uart_driver->driver_name = driver_name; +@@ -1571,7 +1492,7 @@ static int cdns_uart_probe(struct platfo + rc = uart_register_driver(cdns_uart_uart_driver); + if (rc < 0) { + dev_err(&pdev->dev, "Failed to register driver\n"); +- goto err_out_id; ++ return rc; + } + + cdns_uart_data->cdns_uart_driver = cdns_uart_uart_driver; +@@ -1722,10 +1643,7 @@ err_out_clk_dis_pclk: + clk_disable_unprepare(cdns_uart_data->pclk); + err_out_unregister_driver: + uart_unregister_driver(cdns_uart_data->cdns_uart_driver); +-err_out_id: +- mutex_lock(&bitmap_lock); +- clear_bit(cdns_uart_data->id, bitmap); +- mutex_unlock(&bitmap_lock); ++ + return rc; + } + +@@ -1748,9 +1666,6 @@ static int cdns_uart_remove(struct platf + #endif + rc = uart_remove_one_port(cdns_uart_data->cdns_uart_driver, port); + port->mapbase = 0; +- mutex_lock(&bitmap_lock); +- clear_bit(cdns_uart_data->id, bitmap); +- mutex_unlock(&bitmap_lock); + clk_disable_unprepare(cdns_uart_data->uartclk); + clk_disable_unprepare(cdns_uart_data->pclk); + pm_runtime_disable(&pdev->dev); diff --git a/queue-5.6/revert-serial-uartps-do-not-allow-use-aliases-max_uart_instances.patch b/queue-5.6/revert-serial-uartps-do-not-allow-use-aliases-max_uart_instances.patch new file mode 100644 index 00000000000..244d85157ef --- /dev/null +++ b/queue-5.6/revert-serial-uartps-do-not-allow-use-aliases-max_uart_instances.patch @@ -0,0 +1,47 @@ +From 91c9dfa25c7f95b543c280e0edf1fd8de6e90985 Mon Sep 17 00:00:00 2001 +From: Michal Simek +Date: Fri, 3 Apr 2020 11:24:33 +0200 +Subject: Revert "serial: uartps: Do not allow use aliases >= MAX_UART_INSTANCES" + +From: Michal Simek + +commit 91c9dfa25c7f95b543c280e0edf1fd8de6e90985 upstream. + +This reverts commit 2088cfd882d0403609bdf426e9b24372fe1b8337. + +As Johan says, this driver needs a lot more work and these changes are +only going in the wrong direction: + https://lkml.kernel.org/r/20190523091839.GC568@localhost + +Reported-by: Johan Hovold +Signed-off-by: Michal Simek +Cc: stable +Link: https://lore.kernel.org/r/dac3898e3e32d963f357fb436ac9a7ac3cbcf933.1585905873.git.michal.simek@xilinx.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/xilinx_uartps.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/tty/serial/xilinx_uartps.c ++++ b/drivers/tty/serial/xilinx_uartps.c +@@ -1724,8 +1724,7 @@ err_out_unregister_driver: + uart_unregister_driver(cdns_uart_data->cdns_uart_driver); + err_out_id: + mutex_lock(&bitmap_lock); +- if (cdns_uart_data->id < MAX_UART_INSTANCES) +- clear_bit(cdns_uart_data->id, bitmap); ++ clear_bit(cdns_uart_data->id, bitmap); + mutex_unlock(&bitmap_lock); + return rc; + } +@@ -1750,8 +1749,7 @@ static int cdns_uart_remove(struct platf + rc = uart_remove_one_port(cdns_uart_data->cdns_uart_driver, port); + port->mapbase = 0; + mutex_lock(&bitmap_lock); +- if (cdns_uart_data->id < MAX_UART_INSTANCES) +- clear_bit(cdns_uart_data->id, bitmap); ++ clear_bit(cdns_uart_data->id, bitmap); + mutex_unlock(&bitmap_lock); + clk_disable_unprepare(cdns_uart_data->uartclk); + clk_disable_unprepare(cdns_uart_data->pclk); diff --git a/queue-5.6/revert-serial-uartps-fix-error-path-when-alloc-failed.patch b/queue-5.6/revert-serial-uartps-fix-error-path-when-alloc-failed.patch new file mode 100644 index 00000000000..bb109221a90 --- /dev/null +++ b/queue-5.6/revert-serial-uartps-fix-error-path-when-alloc-failed.patch @@ -0,0 +1,40 @@ +From b6fd2dbbd649b89a3998528994665ded1e3fbf7f Mon Sep 17 00:00:00 2001 +From: Michal Simek +Date: Fri, 3 Apr 2020 11:24:32 +0200 +Subject: Revert "serial: uartps: Fix error path when alloc failed" + +From: Michal Simek + +commit b6fd2dbbd649b89a3998528994665ded1e3fbf7f upstream. + +This reverts commit 32cf21ac4edd6c0d5b9614368a83bcdc68acb031. + +As Johan says, this driver needs a lot more work and these changes are +only going in the wrong direction: + https://lkml.kernel.org/r/20190523091839.GC568@localhost + +Reported-by: Johan Hovold +Signed-off-by: Michal Simek +Cc: stable +Link: https://lore.kernel.org/r/46cd7f039db847c08baa6508edd7854f7c8ff80f.1585905873.git.michal.simek@xilinx.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/xilinx_uartps.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/tty/serial/xilinx_uartps.c ++++ b/drivers/tty/serial/xilinx_uartps.c +@@ -1554,10 +1554,8 @@ static int cdns_uart_probe(struct platfo + #ifdef CONFIG_SERIAL_XILINX_PS_UART_CONSOLE + cdns_uart_console = devm_kzalloc(&pdev->dev, sizeof(*cdns_uart_console), + GFP_KERNEL); +- if (!cdns_uart_console) { +- rc = -ENOMEM; +- goto err_out_id; +- } ++ if (!cdns_uart_console) ++ return -ENOMEM; + + strncpy(cdns_uart_console->name, CDNS_UART_TTY_NAME, + sizeof(cdns_uart_console->name)); diff --git a/queue-5.6/revert-serial-uartps-fix-uartps_major-handling.patch b/queue-5.6/revert-serial-uartps-fix-uartps_major-handling.patch new file mode 100644 index 00000000000..0429c39d13f --- /dev/null +++ b/queue-5.6/revert-serial-uartps-fix-uartps_major-handling.patch @@ -0,0 +1,56 @@ +From 2e01911b7cf7aa07a304a809eca1b11a4bd35859 Mon Sep 17 00:00:00 2001 +From: Michal Simek +Date: Fri, 3 Apr 2020 11:24:30 +0200 +Subject: Revert "serial: uartps: Fix uartps_major handling" + +From: Michal Simek + +commit 2e01911b7cf7aa07a304a809eca1b11a4bd35859 upstream. + +This reverts commit 5e9bd2d70ae7c00a95a22994abf1eef728649e64. + +As Johan says, this driver needs a lot more work and these changes are +only going in the wrong direction: + https://lkml.kernel.org/r/20190523091839.GC568@localhost + +Reported-by: Johan Hovold +Signed-off-by: Michal Simek +Cc: stable +Link: https://lore.kernel.org/r/310999ab5342f788a7bc1b0e68294d4f052cad07.1585905873.git.michal.simek@xilinx.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/xilinx_uartps.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +--- a/drivers/tty/serial/xilinx_uartps.c ++++ b/drivers/tty/serial/xilinx_uartps.c +@@ -1576,6 +1576,7 @@ static int cdns_uart_probe(struct platfo + goto err_out_id; + } + ++ uartps_major = cdns_uart_uart_driver->tty_driver->major; + cdns_uart_data->cdns_uart_driver = cdns_uart_uart_driver; + + /* +@@ -1706,7 +1707,6 @@ static int cdns_uart_probe(struct platfo + console_port = NULL; + #endif + +- uartps_major = cdns_uart_uart_driver->tty_driver->major; + cdns_uart_data->cts_override = of_property_read_bool(pdev->dev.of_node, + "cts-override"); + return 0; +@@ -1768,12 +1768,6 @@ static int cdns_uart_remove(struct platf + console_port = NULL; + #endif + +- /* If this is last instance major number should be initialized */ +- mutex_lock(&bitmap_lock); +- if (bitmap_empty(bitmap, MAX_UART_INSTANCES)) +- uartps_major = 0; +- mutex_unlock(&bitmap_lock); +- + uart_unregister_driver(cdns_uart_data->cdns_uart_driver); + return rc; + } diff --git a/queue-5.6/revert-serial-uartps-move-port-id-to-device-data-structure.patch b/queue-5.6/revert-serial-uartps-move-port-id-to-device-data-structure.patch new file mode 100644 index 00000000000..0ced4871754 --- /dev/null +++ b/queue-5.6/revert-serial-uartps-move-port-id-to-device-data-structure.patch @@ -0,0 +1,103 @@ +From 492cc08bc16c44e2e587362ada3f6269dee2be22 Mon Sep 17 00:00:00 2001 +From: Michal Simek +Date: Fri, 3 Apr 2020 11:24:35 +0200 +Subject: Revert "serial: uartps: Move Port ID to device data structure" + +From: Michal Simek + +commit 492cc08bc16c44e2e587362ada3f6269dee2be22 upstream. + +This reverts commit bed25ac0e2b6ab8f9aed2d20bc9c3a2037311800. + +As Johan says, this driver needs a lot more work and these changes are +only going in the wrong direction: + https://lkml.kernel.org/r/20190523091839.GC568@localhost + +Reported-by: Johan Hovold +Signed-off-by: Michal Simek +Cc: stable +Link: https://lore.kernel.org/r/eb0ec98fecdca9b79c1a3ac0c30c668b6973b193.1585905873.git.michal.simek@xilinx.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/xilinx_uartps.c | 20 +++++++++----------- + 1 file changed, 9 insertions(+), 11 deletions(-) + +--- a/drivers/tty/serial/xilinx_uartps.c ++++ b/drivers/tty/serial/xilinx_uartps.c +@@ -189,7 +189,6 @@ MODULE_PARM_DESC(rx_timeout, "Rx timeout + * @pclk: APB clock + * @cdns_uart_driver: Pointer to UART driver + * @baud: Current baud rate +- * @id: Port ID + * @clk_rate_change_nb: Notifier block for clock changes + * @quirks: Flags for RXBS support. + */ +@@ -199,7 +198,6 @@ struct cdns_uart { + struct clk *pclk; + struct uart_driver *cdns_uart_driver; + unsigned int baud; +- int id; + struct notifier_block clk_rate_change_nb; + u32 quirks; + bool cts_override; +@@ -1424,7 +1422,7 @@ MODULE_DEVICE_TABLE(of, cdns_uart_of_mat + */ + static int cdns_uart_probe(struct platform_device *pdev) + { +- int rc, irq; ++ int rc, id, irq; + struct uart_port *port; + struct resource *res; + struct cdns_uart *cdns_uart_data; +@@ -1450,18 +1448,18 @@ static int cdns_uart_probe(struct platfo + return -ENOMEM; + + /* Look for a serialN alias */ +- cdns_uart_data->id = of_alias_get_id(pdev->dev.of_node, "serial"); +- if (cdns_uart_data->id < 0) +- cdns_uart_data->id = 0; ++ id = of_alias_get_id(pdev->dev.of_node, "serial"); ++ if (id < 0) ++ id = 0; + +- if (cdns_uart_data->id >= CDNS_UART_NR_PORTS) { ++ if (id >= CDNS_UART_NR_PORTS) { + dev_err(&pdev->dev, "Cannot get uart_port structure\n"); + return -ENODEV; + } + + /* There is a need to use unique driver name */ + driver_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s%d", +- CDNS_UART_NAME, cdns_uart_data->id); ++ CDNS_UART_NAME, id); + if (!driver_name) + return -ENOMEM; + +@@ -1469,7 +1467,7 @@ static int cdns_uart_probe(struct platfo + cdns_uart_uart_driver->driver_name = driver_name; + cdns_uart_uart_driver->dev_name = CDNS_UART_TTY_NAME; + cdns_uart_uart_driver->major = CDNS_UART_MAJOR; +- cdns_uart_uart_driver->minor = cdns_uart_data->id; ++ cdns_uart_uart_driver->minor = id; + cdns_uart_uart_driver->nr = 1; + + #ifdef CONFIG_SERIAL_XILINX_PS_UART_CONSOLE +@@ -1480,7 +1478,7 @@ static int cdns_uart_probe(struct platfo + + strncpy(cdns_uart_console->name, CDNS_UART_TTY_NAME, + sizeof(cdns_uart_console->name)); +- cdns_uart_console->index = cdns_uart_data->id; ++ cdns_uart_console->index = id; + cdns_uart_console->write = cdns_uart_console_write; + cdns_uart_console->device = uart_console_device; + cdns_uart_console->setup = cdns_uart_console_setup; +@@ -1502,7 +1500,7 @@ static int cdns_uart_probe(struct platfo + * registration because tty_driver structure is not filled. + * name_base is 0 by default. + */ +- cdns_uart_uart_driver->tty_driver->name_base = cdns_uart_data->id; ++ cdns_uart_uart_driver->tty_driver->name_base = id; + + match = of_match_node(cdns_uart_of_match, pdev->dev.of_node); + if (match && match->data) { diff --git a/queue-5.6/revert-serial-uartps-register-own-uart-console-and-driver-structures.patch b/queue-5.6/revert-serial-uartps-register-own-uart-console-and-driver-structures.patch new file mode 100644 index 00000000000..e1eac6fa1f4 --- /dev/null +++ b/queue-5.6/revert-serial-uartps-register-own-uart-console-and-driver-structures.patch @@ -0,0 +1,216 @@ +From 18cc7ac8a28e28cd005c2475f52576cfe10cabfb Mon Sep 17 00:00:00 2001 +From: Michal Simek +Date: Fri, 3 Apr 2020 11:24:36 +0200 +Subject: Revert "serial: uartps: Register own uart console and driver structures" + +From: Michal Simek + +commit 18cc7ac8a28e28cd005c2475f52576cfe10cabfb upstream. + +This reverts commit 024ca329bfb9a948f76eaff3243e21b7e70182f2. + +As Johan says, this driver needs a lot more work and these changes are +only going in the wrong direction: + https://lkml.kernel.org/r/20190523091839.GC568@localhost + +Reported-by: Johan Hovold +Signed-off-by: Michal Simek +Cc: stable +Link: https://lore.kernel.org/r/1ee35667e36a8efddee381df5fe495ad65f4d15c.1585905873.git.michal.simek@xilinx.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/xilinx_uartps.c | 95 +++++++++++++++---------------------- + 1 file changed, 40 insertions(+), 55 deletions(-) + +--- a/drivers/tty/serial/xilinx_uartps.c ++++ b/drivers/tty/serial/xilinx_uartps.c +@@ -27,6 +27,7 @@ + #define CDNS_UART_TTY_NAME "ttyPS" + #define CDNS_UART_NAME "xuartps" + #define CDNS_UART_MAJOR 0 /* use dynamic node allocation */ ++#define CDNS_UART_MINOR 0 /* works best with devtmpfs */ + #define CDNS_UART_NR_PORTS 16 + #define CDNS_UART_FIFO_SIZE 64 /* FIFO size */ + #define CDNS_UART_REGISTER_SPACE 0x1000 +@@ -1144,6 +1145,8 @@ static const struct uart_ops cdns_uart_o + #endif + }; + ++static struct uart_driver cdns_uart_uart_driver; ++ + #ifdef CONFIG_SERIAL_XILINX_PS_UART_CONSOLE + /** + * cdns_uart_console_putchar - write the character to the FIFO buffer +@@ -1283,6 +1286,16 @@ static int cdns_uart_console_setup(struc + + return uart_set_options(port, co, baud, parity, bits, flow); + } ++ ++static struct console cdns_uart_console = { ++ .name = CDNS_UART_TTY_NAME, ++ .write = cdns_uart_console_write, ++ .device = uart_console_device, ++ .setup = cdns_uart_console_setup, ++ .flags = CON_PRINTBUFFER, ++ .index = -1, /* Specified on the cmdline (e.g. console=ttyPS ) */ ++ .data = &cdns_uart_uart_driver, ++}; + #endif /* CONFIG_SERIAL_XILINX_PS_UART_CONSOLE */ + + #ifdef CONFIG_PM_SLEEP +@@ -1414,6 +1427,9 @@ static const struct of_device_id cdns_ua + }; + MODULE_DEVICE_TABLE(of, cdns_uart_of_match); + ++/* Temporary variable for storing number of instances */ ++static int instances; ++ + /** + * cdns_uart_probe - Platform driver probe + * @pdev: Pointer to the platform device structure +@@ -1427,11 +1443,6 @@ static int cdns_uart_probe(struct platfo + struct resource *res; + struct cdns_uart *cdns_uart_data; + const struct of_device_id *match; +- struct uart_driver *cdns_uart_uart_driver; +- char *driver_name; +-#ifdef CONFIG_SERIAL_XILINX_PS_UART_CONSOLE +- struct console *cdns_uart_console; +-#endif + + cdns_uart_data = devm_kzalloc(&pdev->dev, sizeof(*cdns_uart_data), + GFP_KERNEL); +@@ -1441,12 +1452,6 @@ static int cdns_uart_probe(struct platfo + if (!port) + return -ENOMEM; + +- cdns_uart_uart_driver = devm_kzalloc(&pdev->dev, +- sizeof(*cdns_uart_uart_driver), +- GFP_KERNEL); +- if (!cdns_uart_uart_driver) +- return -ENOMEM; +- + /* Look for a serialN alias */ + id = of_alias_get_id(pdev->dev.of_node, "serial"); + if (id < 0) +@@ -1457,50 +1462,25 @@ static int cdns_uart_probe(struct platfo + return -ENODEV; + } + +- /* There is a need to use unique driver name */ +- driver_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s%d", +- CDNS_UART_NAME, id); +- if (!driver_name) +- return -ENOMEM; +- +- cdns_uart_uart_driver->owner = THIS_MODULE; +- cdns_uart_uart_driver->driver_name = driver_name; +- cdns_uart_uart_driver->dev_name = CDNS_UART_TTY_NAME; +- cdns_uart_uart_driver->major = CDNS_UART_MAJOR; +- cdns_uart_uart_driver->minor = id; +- cdns_uart_uart_driver->nr = 1; +- ++ if (!cdns_uart_uart_driver.state) { ++ cdns_uart_uart_driver.owner = THIS_MODULE; ++ cdns_uart_uart_driver.driver_name = CDNS_UART_NAME; ++ cdns_uart_uart_driver.dev_name = CDNS_UART_TTY_NAME; ++ cdns_uart_uart_driver.major = CDNS_UART_MAJOR; ++ cdns_uart_uart_driver.minor = CDNS_UART_MINOR; ++ cdns_uart_uart_driver.nr = CDNS_UART_NR_PORTS; + #ifdef CONFIG_SERIAL_XILINX_PS_UART_CONSOLE +- cdns_uart_console = devm_kzalloc(&pdev->dev, sizeof(*cdns_uart_console), +- GFP_KERNEL); +- if (!cdns_uart_console) +- return -ENOMEM; +- +- strncpy(cdns_uart_console->name, CDNS_UART_TTY_NAME, +- sizeof(cdns_uart_console->name)); +- cdns_uart_console->index = id; +- cdns_uart_console->write = cdns_uart_console_write; +- cdns_uart_console->device = uart_console_device; +- cdns_uart_console->setup = cdns_uart_console_setup; +- cdns_uart_console->flags = CON_PRINTBUFFER; +- cdns_uart_console->data = cdns_uart_uart_driver; +- cdns_uart_uart_driver->cons = cdns_uart_console; ++ cdns_uart_uart_driver.cons = &cdns_uart_console; + #endif + +- rc = uart_register_driver(cdns_uart_uart_driver); +- if (rc < 0) { +- dev_err(&pdev->dev, "Failed to register driver\n"); +- return rc; ++ rc = uart_register_driver(&cdns_uart_uart_driver); ++ if (rc < 0) { ++ dev_err(&pdev->dev, "Failed to register driver\n"); ++ return rc; ++ } + } + +- cdns_uart_data->cdns_uart_driver = cdns_uart_uart_driver; +- +- /* +- * Setting up proper name_base needs to be done after uart +- * registration because tty_driver structure is not filled. +- * name_base is 0 by default. +- */ +- cdns_uart_uart_driver->tty_driver->name_base = id; ++ cdns_uart_data->cdns_uart_driver = &cdns_uart_uart_driver; + + match = of_match_node(cdns_uart_of_match, pdev->dev.of_node); + if (match && match->data) { +@@ -1578,6 +1558,7 @@ static int cdns_uart_probe(struct platfo + port->ops = &cdns_uart_ops; + port->fifosize = CDNS_UART_FIFO_SIZE; + port->has_sysrq = IS_ENABLED(CONFIG_SERIAL_XILINX_PS_UART_CONSOLE); ++ port->line = id; + + /* + * Register the port. +@@ -1609,7 +1590,7 @@ static int cdns_uart_probe(struct platfo + console_port = port; + #endif + +- rc = uart_add_one_port(cdns_uart_uart_driver, port); ++ rc = uart_add_one_port(&cdns_uart_uart_driver, port); + if (rc) { + dev_err(&pdev->dev, + "uart_add_one_port() failed; err=%i\n", rc); +@@ -1619,12 +1600,15 @@ static int cdns_uart_probe(struct platfo + #ifdef CONFIG_SERIAL_XILINX_PS_UART_CONSOLE + /* This is not port which is used for console that's why clean it up */ + if (console_port == port && +- !(cdns_uart_uart_driver->cons->flags & CON_ENABLED)) ++ !(cdns_uart_uart_driver.cons->flags & CON_ENABLED)) + console_port = NULL; + #endif + + cdns_uart_data->cts_override = of_property_read_bool(pdev->dev.of_node, + "cts-override"); ++ ++ instances++; ++ + return 0; + + err_out_pm_disable: +@@ -1640,8 +1624,8 @@ err_out_clk_disable: + err_out_clk_dis_pclk: + clk_disable_unprepare(cdns_uart_data->pclk); + err_out_unregister_driver: +- uart_unregister_driver(cdns_uart_data->cdns_uart_driver); +- ++ if (!instances) ++ uart_unregister_driver(cdns_uart_data->cdns_uart_driver); + return rc; + } + +@@ -1676,7 +1660,8 @@ static int cdns_uart_remove(struct platf + console_port = NULL; + #endif + +- uart_unregister_driver(cdns_uart_data->cdns_uart_driver); ++ if (!--instances) ++ uart_unregister_driver(cdns_uart_data->cdns_uart_driver); + return rc; + } + diff --git a/queue-5.6/revert-serial-uartps-use-the-same-dynamic-major-number-for-all-ports.patch b/queue-5.6/revert-serial-uartps-use-the-same-dynamic-major-number-for-all-ports.patch new file mode 100644 index 00000000000..23e52b18884 --- /dev/null +++ b/queue-5.6/revert-serial-uartps-use-the-same-dynamic-major-number-for-all-ports.patch @@ -0,0 +1,59 @@ +From 8da1a3940da4b0e82848ec29b835486890bc9232 Mon Sep 17 00:00:00 2001 +From: Michal Simek +Date: Fri, 3 Apr 2020 11:24:31 +0200 +Subject: Revert "serial: uartps: Use the same dynamic major number for all ports" + +From: Michal Simek + +commit 8da1a3940da4b0e82848ec29b835486890bc9232 upstream. + +This reverts commit ab262666018de6f4e206b021386b93ed0c164316. + +As Johan says, this driver needs a lot more work and these changes are +only going in the wrong direction: + https://lkml.kernel.org/r/20190523091839.GC568@localhost + +Reported-by: Johan Hovold +Signed-off-by: Michal Simek +Cc: stable +Link: https://lore.kernel.org/r/14a565fc1e14a5ec6cc6a6710deb878ae8305f22.1585905873.git.michal.simek@xilinx.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/xilinx_uartps.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/tty/serial/xilinx_uartps.c ++++ b/drivers/tty/serial/xilinx_uartps.c +@@ -26,13 +26,13 @@ + + #define CDNS_UART_TTY_NAME "ttyPS" + #define CDNS_UART_NAME "xuartps" ++#define CDNS_UART_MAJOR 0 /* use dynamic node allocation */ + #define CDNS_UART_FIFO_SIZE 64 /* FIFO size */ + #define CDNS_UART_REGISTER_SPACE 0x1000 + #define TX_TIMEOUT 500000 + + /* Rx Trigger level */ + static int rx_trigger_level = 56; +-static int uartps_major; + module_param(rx_trigger_level, uint, 0444); + MODULE_PARM_DESC(rx_trigger_level, "Rx trigger level, 1-63 bytes"); + +@@ -1547,7 +1547,7 @@ static int cdns_uart_probe(struct platfo + cdns_uart_uart_driver->owner = THIS_MODULE; + cdns_uart_uart_driver->driver_name = driver_name; + cdns_uart_uart_driver->dev_name = CDNS_UART_TTY_NAME; +- cdns_uart_uart_driver->major = uartps_major; ++ cdns_uart_uart_driver->major = CDNS_UART_MAJOR; + cdns_uart_uart_driver->minor = cdns_uart_data->id; + cdns_uart_uart_driver->nr = 1; + +@@ -1576,7 +1576,6 @@ static int cdns_uart_probe(struct platfo + goto err_out_id; + } + +- uartps_major = cdns_uart_uart_driver->tty_driver->major; + cdns_uart_data->cdns_uart_driver = cdns_uart_uart_driver; + + /* diff --git a/queue-5.6/serial-sh-sci-make-sure-status-register-scxsr-is-read-in-correct-sequence.patch b/queue-5.6/serial-sh-sci-make-sure-status-register-scxsr-is-read-in-correct-sequence.patch new file mode 100644 index 00000000000..8ecfcbc6ce2 --- /dev/null +++ b/queue-5.6/serial-sh-sci-make-sure-status-register-scxsr-is-read-in-correct-sequence.patch @@ -0,0 +1,51 @@ +From 3dc4db3662366306e54ddcbda4804acb1258e4ba Mon Sep 17 00:00:00 2001 +From: Kazuhiro Fujita +Date: Fri, 27 Mar 2020 18:17:28 +0000 +Subject: serial: sh-sci: Make sure status register SCxSR is read in correct sequence + +From: Kazuhiro Fujita + +commit 3dc4db3662366306e54ddcbda4804acb1258e4ba upstream. + +For SCIF and HSCIF interfaces the SCxSR register holds the status of +data that is to be read next from SCxRDR register, But where as for +SCIFA and SCIFB interfaces SCxSR register holds status of data that is +previously read from SCxRDR register. + +This patch makes sure the status register is read depending on the port +types so that errors are caught accordingly. + +Cc: +Signed-off-by: Kazuhiro Fujita +Signed-off-by: Hao Bui +Signed-off-by: KAZUMI HARADA +Signed-off-by: Lad Prabhakar +Tested-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/1585333048-31828-1-git-send-email-kazuhiro.fujita.jg@renesas.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/sh-sci.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -870,9 +870,16 @@ static void sci_receive_chars(struct uar + tty_insert_flip_char(tport, c, TTY_NORMAL); + } else { + for (i = 0; i < count; i++) { +- char c = serial_port_in(port, SCxRDR); ++ char c; + +- status = serial_port_in(port, SCxSR); ++ if (port->type == PORT_SCIF || ++ port->type == PORT_HSCIF) { ++ status = serial_port_in(port, SCxSR); ++ c = serial_port_in(port, SCxRDR); ++ } else { ++ c = serial_port_in(port, SCxRDR); ++ status = serial_port_in(port, SCxSR); ++ } + if (uart_handle_sysrq_char(port, c)) { + count--; i--; + continue; diff --git a/queue-5.6/series b/queue-5.6/series index 8824b036553..ba3ef382ebc 100644 --- a/queue-5.6/series +++ b/queue-5.6/series @@ -127,3 +127,37 @@ iwlwifi-mvm-limit-maximum-queue-appropriately.patch iwlwifi-mvm-do-not-declare-support-for-ack-enabled-aggregation.patch iwlwifi-mvm-fix-inactive-tid-removal-return-value-usage.patch iwlwifi-fix-wgds-check-when-wrds-is-disabled.patch +cifs-fix-uninitialised-lease_key-in-open_shroot.patch +arm-imx-provide-v7_cpu_resume-only-on-arm_cpu_suspend-y.patch +powerpc-8xx-fix-strict_kernel_rwx-startup-test-failure.patch +powerpc-setup_64-set-cache-line-size-based-on-cache-block-size.patch +staging-comedi-dt2815-fix-writing-hi-byte-of-analog-output.patch +staging-comedi-fix-comedi_device-refcnt-leak-in-comedi_open.patch +vt-don-t-hardcode-the-mem-allocation-upper-bound.patch +vt-don-t-use-kmalloc-for-the-unicode-screen-buffer.patch +staging-vt6656-don-t-set-rcr_multicast-or-rcr_broadcast-by-default.patch +staging-vt6656-fix-calling-conditions-of-vnt_set_bss_mode.patch +staging-vt6656-fix-drivers-tbtt-timing-counter.patch +staging-vt6656-fix-pairwise-key-entry-save.patch +staging-vt6656-power-save-stop-wake_up_count-wrap-around.patch +mei-me-fix-irq-number-stored-in-hw-struct.patch +cdc-acm-close-race-betrween-suspend-and-acm_softint.patch +cdc-acm-introduce-a-cool-down.patch +uas-no-use-logging-any-details-in-case-of-enodev.patch +uas-fix-deadlock-in-error-handling-and-pm-flushing-work.patch +fpga-dfl-pci-fix-return-value-of-cci_pci_sriov_configure.patch +usb-dwc3-gadget-fix-request-completion-check.patch +usb-f_fs-clear-os-extended-descriptor-counts-to-zero-in-ffs_data_reset.patch +usb-typec-tcpm-ignore-cc-and-vbus-changes-in-port_reset-change.patch +usb-typec-altmode-fix-typec_altmode_get_partner-sometimes-returning-an-invalid-pointer.patch +xhci-fix-handling-halted-endpoint-even-if-endpoint-ring-appears-empty.patch +xhci-prevent-bus-suspend-if-a-roothub-port-detected-a-over-current-condition.patch +xhci-don-t-clear-hub-tt-buffer-on-ep0-protocol-stall.patch +serial-sh-sci-make-sure-status-register-scxsr-is-read-in-correct-sequence.patch +revert-serial-uartps-fix-uartps_major-handling.patch +revert-serial-uartps-use-the-same-dynamic-major-number-for-all-ports.patch +revert-serial-uartps-fix-error-path-when-alloc-failed.patch +revert-serial-uartps-do-not-allow-use-aliases-max_uart_instances.patch +revert-serial-uartps-change-uart-id-port-allocation.patch +revert-serial-uartps-move-port-id-to-device-data-structure.patch +revert-serial-uartps-register-own-uart-console-and-driver-structures.patch diff --git a/queue-5.6/staging-comedi-dt2815-fix-writing-hi-byte-of-analog-output.patch b/queue-5.6/staging-comedi-dt2815-fix-writing-hi-byte-of-analog-output.patch new file mode 100644 index 00000000000..50e7074afe8 --- /dev/null +++ b/queue-5.6/staging-comedi-dt2815-fix-writing-hi-byte-of-analog-output.patch @@ -0,0 +1,62 @@ +From ed87d33ddbcd9a1c3b5ae87995da34e6f51a862c Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Mon, 6 Apr 2020 15:20:15 +0100 +Subject: staging: comedi: dt2815: fix writing hi byte of analog output + +From: Ian Abbott + +commit ed87d33ddbcd9a1c3b5ae87995da34e6f51a862c upstream. + +The DT2815 analog output command is 16 bits wide, consisting of the +12-bit sample value in bits 15 to 4, the channel number in bits 3 to 1, +and a voltage or current selector in bit 0. Both bytes of the 16-bit +command need to be written in turn to a single 8-bit data register. +However, the driver currently only writes the low 8-bits. It is broken +and appears to have always been broken. + +Electronic copies of the DT2815 User's Manual seem impossible to find +online, but looking at the source code, a best guess for the sequence +the driver intended to use to write the analog output command is as +follows: + +1. Wait for the status register to read 0x00. +2. Write the low byte of the command to the data register. +3. Wait for the status register to read 0x80. +4. Write the high byte of the command to the data register. + +Step 4 is missing from the driver. Add step 4 to (hopefully) fix the +driver. + +Also add a "FIXME" comment about setting bit 0 of the low byte of the +command. Supposedly, it is used to choose between voltage output and +current output, but the current driver always sets it to 1. + +Signed-off-by: Ian Abbott +Cc: stable +Link: https://lore.kernel.org/r/20200406142015.126982-1-abbotti@mev.co.uk +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/dt2815.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/staging/comedi/drivers/dt2815.c ++++ b/drivers/staging/comedi/drivers/dt2815.c +@@ -92,6 +92,7 @@ static int dt2815_ao_insn(struct comedi_ + int ret; + + for (i = 0; i < insn->n; i++) { ++ /* FIXME: lo bit 0 chooses voltage output or current output */ + lo = ((data[i] & 0x0f) << 4) | (chan << 1) | 0x01; + hi = (data[i] & 0xff0) >> 4; + +@@ -105,6 +106,8 @@ static int dt2815_ao_insn(struct comedi_ + if (ret) + return ret; + ++ outb(hi, dev->iobase + DT2815_DATA); ++ + devpriv->ao_readback[chan] = data[i]; + } + return i; diff --git a/queue-5.6/staging-comedi-fix-comedi_device-refcnt-leak-in-comedi_open.patch b/queue-5.6/staging-comedi-fix-comedi_device-refcnt-leak-in-comedi_open.patch new file mode 100644 index 00000000000..3e65ab982bb --- /dev/null +++ b/queue-5.6/staging-comedi-fix-comedi_device-refcnt-leak-in-comedi_open.patch @@ -0,0 +1,49 @@ +From 332e0e17ad49e084b7db670ef43b5eb59abd9e34 Mon Sep 17 00:00:00 2001 +From: Xiyu Yang +Date: Mon, 20 Apr 2020 13:44:16 +0800 +Subject: staging: comedi: Fix comedi_device refcnt leak in comedi_open + +From: Xiyu Yang + +commit 332e0e17ad49e084b7db670ef43b5eb59abd9e34 upstream. + +comedi_open() invokes comedi_dev_get_from_minor(), which returns a +reference of the COMEDI device to "dev" with increased refcount. + +When comedi_open() returns, "dev" becomes invalid, so the refcount +should be decreased to keep refcount balanced. + +The reference counting issue happens in one exception handling path of +comedi_open(). When "cfp" allocation is failed, the refcnt increased by +comedi_dev_get_from_minor() is not decreased, causing a refcnt leak. + +Fix this issue by calling comedi_dev_put() on this error path when "cfp" +allocation is failed. + +Fixes: 20f083c07565 ("staging: comedi: prepare support for per-file read and write subdevices") +Signed-off-by: Xiyu Yang +Cc: stable +Signed-off-by: Xin Tan +Signed-off-by: Ian Abbott +Link: https://lore.kernel.org/r/1587361459-83622-1-git-send-email-xiyuyang19@fudan.edu.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/comedi_fops.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/staging/comedi/comedi_fops.c ++++ b/drivers/staging/comedi/comedi_fops.c +@@ -2725,8 +2725,10 @@ static int comedi_open(struct inode *ino + } + + cfp = kzalloc(sizeof(*cfp), GFP_KERNEL); +- if (!cfp) ++ if (!cfp) { ++ comedi_dev_put(dev); + return -ENOMEM; ++ } + + cfp->dev = dev; + diff --git a/queue-5.6/staging-vt6656-don-t-set-rcr_multicast-or-rcr_broadcast-by-default.patch b/queue-5.6/staging-vt6656-don-t-set-rcr_multicast-or-rcr_broadcast-by-default.patch new file mode 100644 index 00000000000..d11ed754e2c --- /dev/null +++ b/queue-5.6/staging-vt6656-don-t-set-rcr_multicast-or-rcr_broadcast-by-default.patch @@ -0,0 +1,45 @@ +From 0f8240bfc070033a4823b19883efd3d38c7735cc Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sat, 18 Apr 2020 17:24:50 +0100 +Subject: staging: vt6656: Don't set RCR_MULTICAST or RCR_BROADCAST by default. + +From: Malcolm Priestley + +commit 0f8240bfc070033a4823b19883efd3d38c7735cc upstream. + +mac80211/users control whether multicast is on or off don't enable it by default. + +Fixes an issue when multicast/broadcast is always on allowing other beacons through +in power save. + +Fixes: db8f37fa3355 ("staging: vt6656: mac80211 conversion: main_usb add functions...") +Cc: stable +Signed-off-by: Malcolm Priestley +Link: https://lore.kernel.org/r/2c24c33d-68c4-f343-bd62-105422418eac@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/main_usb.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/drivers/staging/vt6656/main_usb.c ++++ b/drivers/staging/vt6656/main_usb.c +@@ -817,15 +817,11 @@ static void vnt_configure(struct ieee802 + { + struct vnt_private *priv = hw->priv; + u8 rx_mode = 0; +- int rc; + + *total_flags &= FIF_ALLMULTI | FIF_OTHER_BSS | FIF_BCN_PRBRESP_PROMISC; + +- rc = vnt_control_in(priv, MESSAGE_TYPE_READ, MAC_REG_RCR, +- MESSAGE_REQUEST_MACREG, sizeof(u8), &rx_mode); +- +- if (!rc) +- rx_mode = RCR_MULTICAST | RCR_BROADCAST; ++ vnt_control_in(priv, MESSAGE_TYPE_READ, MAC_REG_RCR, ++ MESSAGE_REQUEST_MACREG, sizeof(u8), &rx_mode); + + dev_dbg(&priv->usb->dev, "rx mode in = %x\n", rx_mode); + diff --git a/queue-5.6/staging-vt6656-fix-calling-conditions-of-vnt_set_bss_mode.patch b/queue-5.6/staging-vt6656-fix-calling-conditions-of-vnt_set_bss_mode.patch new file mode 100644 index 00000000000..9954f9e94b0 --- /dev/null +++ b/queue-5.6/staging-vt6656-fix-calling-conditions-of-vnt_set_bss_mode.patch @@ -0,0 +1,61 @@ +From 664ba5180234593b4b8517530e8198bf2f7359e2 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sat, 18 Apr 2020 18:37:18 +0100 +Subject: staging: vt6656: Fix calling conditions of vnt_set_bss_mode + +From: Malcolm Priestley + +commit 664ba5180234593b4b8517530e8198bf2f7359e2 upstream. + +vnt_set_bss_mode needs to be called on all changes to BSS_CHANGED_BASIC_RATES, +BSS_CHANGED_ERP_PREAMBLE and BSS_CHANGED_ERP_SLOT + +Remove all other calls and vnt_update_ifs which is called in vnt_set_bss_mode. + +Fixes an issue that preamble mode is not being updated correctly. + +Fixes: c12603576e06 ("staging: vt6656: Only call vnt_set_bss_mode on basic rates change.") +Cc: stable +Signed-off-by: Malcolm Priestley +Link: https://lore.kernel.org/r/44110801-6234-50d8-c583-9388f04b486c@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/main_usb.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/staging/vt6656/main_usb.c ++++ b/drivers/staging/vt6656/main_usb.c +@@ -632,8 +632,6 @@ static int vnt_add_interface(struct ieee + + priv->op_mode = vif->type; + +- vnt_set_bss_mode(priv); +- + /* LED blink on TX */ + vnt_mac_set_led(priv, LEDSTS_STS, LEDSTS_INTER); + +@@ -720,7 +718,6 @@ static void vnt_bss_info_changed(struct + priv->basic_rates = conf->basic_rates; + + vnt_update_top_rates(priv); +- vnt_set_bss_mode(priv); + + dev_dbg(&priv->usb->dev, "basic rates %x\n", conf->basic_rates); + } +@@ -749,11 +746,14 @@ static void vnt_bss_info_changed(struct + priv->short_slot_time = false; + + vnt_set_short_slot_time(priv); +- vnt_update_ifs(priv); + vnt_set_vga_gain_offset(priv, priv->bb_vga[0]); + vnt_update_pre_ed_threshold(priv, false); + } + ++ if (changed & (BSS_CHANGED_BASIC_RATES | BSS_CHANGED_ERP_PREAMBLE | ++ BSS_CHANGED_ERP_SLOT)) ++ vnt_set_bss_mode(priv); ++ + if (changed & BSS_CHANGED_TXPOWER) + vnt_rf_setpower(priv, priv->current_rate, + conf->chandef.chan->hw_value); diff --git a/queue-5.6/staging-vt6656-fix-drivers-tbtt-timing-counter.patch b/queue-5.6/staging-vt6656-fix-drivers-tbtt-timing-counter.patch new file mode 100644 index 00000000000..0388d6fd6d3 --- /dev/null +++ b/queue-5.6/staging-vt6656-fix-drivers-tbtt-timing-counter.patch @@ -0,0 +1,45 @@ +From 09057742af98a39ebffa27fac4f889dc873132de Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sat, 18 Apr 2020 17:43:24 +0100 +Subject: staging: vt6656: Fix drivers TBTT timing counter. + +From: Malcolm Priestley + +commit 09057742af98a39ebffa27fac4f889dc873132de upstream. + +The drivers TBTT counter is not synchronized with mac80211 timestamp. + +Reorder the functions and use vnt_update_next_tbtt to do the final +synchronize. + +Fixes: c15158797df6 ("staging: vt6656: implement TSF counter") +Cc: stable +Signed-off-by: Malcolm Priestley +Link: https://lore.kernel.org/r/375d0b25-e8bc-c8f7-9b10-6cc705d486ee@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/main_usb.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/staging/vt6656/main_usb.c ++++ b/drivers/staging/vt6656/main_usb.c +@@ -777,12 +777,15 @@ static void vnt_bss_info_changed(struct + vnt_mac_reg_bits_on(priv, MAC_REG_TFTCTL, + TFTCTL_TSFCNTREN); + +- vnt_adjust_tsf(priv, conf->beacon_rate->hw_value, +- conf->sync_tsf, priv->current_tsf); +- + vnt_mac_set_beacon_interval(priv, conf->beacon_int); + + vnt_reset_next_tbtt(priv, conf->beacon_int); ++ ++ vnt_adjust_tsf(priv, conf->beacon_rate->hw_value, ++ conf->sync_tsf, priv->current_tsf); ++ ++ vnt_update_next_tbtt(priv, ++ conf->sync_tsf, conf->beacon_int); + } else { + vnt_clear_current_tsf(priv); + diff --git a/queue-5.6/staging-vt6656-fix-pairwise-key-entry-save.patch b/queue-5.6/staging-vt6656-fix-pairwise-key-entry-save.patch new file mode 100644 index 00000000000..7d1e8823032 --- /dev/null +++ b/queue-5.6/staging-vt6656-fix-pairwise-key-entry-save.patch @@ -0,0 +1,86 @@ +From 0b59f10b1d8fe8d50944f21f5d403df9303095a8 Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sat, 18 Apr 2020 22:01:49 +0100 +Subject: staging: vt6656: Fix pairwise key entry save. + +From: Malcolm Priestley + +commit 0b59f10b1d8fe8d50944f21f5d403df9303095a8 upstream. + +The problem is that the group key was saved as VNT_KEY_DEFAULTKEY +was over written by the VNT_KEY_GROUP_ADDRESS index. + +mac80211 could not clear the mac_addr in the default key. + +The VNT_KEY_DEFAULTKEY is not necesscary so remove it and set as +VNT_KEY_GROUP_ADDRESS. + +mac80211 can clear any key using vnt_mac_disable_keyentry. + +Fixes: f9ef05ce13e4 ("staging: vt6656: Fix pairwise key for non station modes") +Cc: stable +Signed-off-by: Malcolm Priestley +Link: https://lore.kernel.org/r/da2f7e7f-1658-1320-6eee-0f55770ca391@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/key.c | 14 +++----------- + drivers/staging/vt6656/main_usb.c | 6 +++++- + 2 files changed, 8 insertions(+), 12 deletions(-) + +--- a/drivers/staging/vt6656/key.c ++++ b/drivers/staging/vt6656/key.c +@@ -83,9 +83,6 @@ static int vnt_set_keymode(struct ieee80 + case VNT_KEY_PAIRWISE: + key_mode |= mode; + key_inx = 4; +- /* Don't save entry for pairwise key for station mode */ +- if (priv->op_mode == NL80211_IFTYPE_STATION) +- clear_bit(entry, &priv->key_entry_inuse); + break; + default: + return -EINVAL; +@@ -109,7 +106,6 @@ static int vnt_set_keymode(struct ieee80 + int vnt_set_keys(struct ieee80211_hw *hw, struct ieee80211_sta *sta, + struct ieee80211_vif *vif, struct ieee80211_key_conf *key) + { +- struct ieee80211_bss_conf *conf = &vif->bss_conf; + struct vnt_private *priv = hw->priv; + u8 *mac_addr = NULL; + u8 key_dec_mode = 0; +@@ -151,16 +147,12 @@ int vnt_set_keys(struct ieee80211_hw *hw + key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV; + } + +- if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) { ++ if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) + vnt_set_keymode(hw, mac_addr, key, VNT_KEY_PAIRWISE, + key_dec_mode, true); +- } else { +- vnt_set_keymode(hw, mac_addr, key, VNT_KEY_DEFAULTKEY, ++ else ++ vnt_set_keymode(hw, mac_addr, key, VNT_KEY_GROUP_ADDRESS, + key_dec_mode, true); + +- vnt_set_keymode(hw, (u8 *)conf->bssid, key, +- VNT_KEY_GROUP_ADDRESS, key_dec_mode, true); +- } +- + return 0; + } +--- a/drivers/staging/vt6656/main_usb.c ++++ b/drivers/staging/vt6656/main_usb.c +@@ -865,8 +865,12 @@ static int vnt_set_key(struct ieee80211_ + return -EOPNOTSUPP; + break; + case DISABLE_KEY: +- if (test_bit(key->hw_key_idx, &priv->key_entry_inuse)) ++ if (test_bit(key->hw_key_idx, &priv->key_entry_inuse)) { + clear_bit(key->hw_key_idx, &priv->key_entry_inuse); ++ ++ vnt_mac_disable_keyentry(priv, key->hw_key_idx); ++ } ++ + default: + break; + } diff --git a/queue-5.6/staging-vt6656-power-save-stop-wake_up_count-wrap-around.patch b/queue-5.6/staging-vt6656-power-save-stop-wake_up_count-wrap-around.patch new file mode 100644 index 00000000000..8e6d19cfe15 --- /dev/null +++ b/queue-5.6/staging-vt6656-power-save-stop-wake_up_count-wrap-around.patch @@ -0,0 +1,37 @@ +From ea81c3486442f4643fc9825a2bb1b430b829bccd Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Tue, 14 Apr 2020 11:39:23 +0100 +Subject: staging: vt6656: Power save stop wake_up_count wrap around. + +From: Malcolm Priestley + +commit ea81c3486442f4643fc9825a2bb1b430b829bccd upstream. + +conf.listen_interval can sometimes be zero causing wake_up_count +to wrap around up to many beacons too late causing +CTRL-EVENT-BEACON-LOSS as in. + +wpa_supplicant[795]: message repeated 45 times: [..CTRL-EVENT-BEACON-LOSS ] + +Fixes: 43c93d9bf5e2 ("staging: vt6656: implement power saving code.") +Cc: stable +Signed-off-by: Malcolm Priestley +Link: https://lore.kernel.org/r/fce47bb5-7ca6-7671-5094-5c6107302f2b@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6656/int.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/staging/vt6656/int.c ++++ b/drivers/staging/vt6656/int.c +@@ -145,7 +145,8 @@ void vnt_int_process_data(struct vnt_pri + priv->wake_up_count = + priv->hw->conf.listen_interval; + +- --priv->wake_up_count; ++ if (priv->wake_up_count) ++ --priv->wake_up_count; + + /* Turn on wake up to listen next beacon */ + if (priv->wake_up_count == 1) diff --git a/queue-5.6/uas-fix-deadlock-in-error-handling-and-pm-flushing-work.patch b/queue-5.6/uas-fix-deadlock-in-error-handling-and-pm-flushing-work.patch new file mode 100644 index 00000000000..28280dc7563 --- /dev/null +++ b/queue-5.6/uas-fix-deadlock-in-error-handling-and-pm-flushing-work.patch @@ -0,0 +1,99 @@ +From f6cc6093a729ede1ff5658b493237c42b82ba107 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 15 Apr 2020 16:17:50 +0200 +Subject: UAS: fix deadlock in error handling and PM flushing work + +From: Oliver Neukum + +commit f6cc6093a729ede1ff5658b493237c42b82ba107 upstream. + +A SCSI error handler and block runtime PM must not allocate +memory with GFP_KERNEL. Furthermore they must not wait for +tasks allocating memory with GFP_KERNEL. +That means that they cannot share a workqueue with arbitrary tasks. + +Fix this for UAS using a private workqueue. + +Signed-off-by: Oliver Neukum +Fixes: f9dc024a2da1f ("uas: pre_reset and suspend: Fix a few races") +Cc: stable +Link: https://lore.kernel.org/r/20200415141750.811-2-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/uas.c | 43 ++++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 40 insertions(+), 3 deletions(-) + +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -81,6 +81,19 @@ static void uas_free_streams(struct uas_ + static void uas_log_cmd_state(struct scsi_cmnd *cmnd, const char *prefix, + int status); + ++/* ++ * This driver needs its own workqueue, as we need to control memory allocation. ++ * ++ * In the course of error handling and power management uas_wait_for_pending_cmnds() ++ * needs to flush pending work items. In these contexts we cannot allocate memory ++ * by doing block IO as we would deadlock. For the same reason we cannot wait ++ * for anything allocating memory not heeding these constraints. ++ * ++ * So we have to control all work items that can be on the workqueue we flush. ++ * Hence we cannot share a queue and need our own. ++ */ ++static struct workqueue_struct *workqueue; ++ + static void uas_do_work(struct work_struct *work) + { + struct uas_dev_info *devinfo = +@@ -109,7 +122,7 @@ static void uas_do_work(struct work_stru + if (!err) + cmdinfo->state &= ~IS_IN_WORK_LIST; + else +- schedule_work(&devinfo->work); ++ queue_work(workqueue, &devinfo->work); + } + out: + spin_unlock_irqrestore(&devinfo->lock, flags); +@@ -134,7 +147,7 @@ static void uas_add_work(struct uas_cmd_ + + lockdep_assert_held(&devinfo->lock); + cmdinfo->state |= IS_IN_WORK_LIST; +- schedule_work(&devinfo->work); ++ queue_work(workqueue, &devinfo->work); + } + + static void uas_zap_pending(struct uas_dev_info *devinfo, int result) +@@ -1229,7 +1242,31 @@ static struct usb_driver uas_driver = { + .id_table = uas_usb_ids, + }; + +-module_usb_driver(uas_driver); ++static int __init uas_init(void) ++{ ++ int rv; ++ ++ workqueue = alloc_workqueue("uas", WQ_MEM_RECLAIM, 0); ++ if (!workqueue) ++ return -ENOMEM; ++ ++ rv = usb_register(&uas_driver); ++ if (rv) { ++ destroy_workqueue(workqueue); ++ return -ENOMEM; ++ } ++ ++ return 0; ++} ++ ++static void __exit uas_exit(void) ++{ ++ usb_deregister(&uas_driver); ++ destroy_workqueue(workqueue); ++} ++ ++module_init(uas_init); ++module_exit(uas_exit); + + MODULE_LICENSE("GPL"); + MODULE_IMPORT_NS(USB_STORAGE); diff --git a/queue-5.6/uas-no-use-logging-any-details-in-case-of-enodev.patch b/queue-5.6/uas-no-use-logging-any-details-in-case-of-enodev.patch new file mode 100644 index 00000000000..14123f99b64 --- /dev/null +++ b/queue-5.6/uas-no-use-logging-any-details-in-case-of-enodev.patch @@ -0,0 +1,33 @@ +From 5963dec98dc52d52476390485f07a29c30c6a582 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 15 Apr 2020 16:17:49 +0200 +Subject: UAS: no use logging any details in case of ENODEV + +From: Oliver Neukum + +commit 5963dec98dc52d52476390485f07a29c30c6a582 upstream. + +Once a device is gone, the internal state does not matter anymore. +There is no need to spam the logs. + +Signed-off-by: Oliver Neukum +Cc: stable +Fixes: 326349f824619 ("uas: add dead request list") +Link: https://lore.kernel.org/r/20200415141750.811-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/storage/uas.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -190,6 +190,9 @@ static void uas_log_cmd_state(struct scs + struct uas_cmd_info *ci = (void *)&cmnd->SCp; + struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp; + ++ if (status == -ENODEV) /* too late */ ++ return; ++ + scmd_printk(KERN_INFO, cmnd, + "%s %d uas-tag %d inflight:%s%s%s%s%s%s%s%s%s%s%s%s ", + prefix, status, cmdinfo->uas_tag, diff --git a/queue-5.6/usb-dwc3-gadget-fix-request-completion-check.patch b/queue-5.6/usb-dwc3-gadget-fix-request-completion-check.patch new file mode 100644 index 00000000000..51b1b095b05 --- /dev/null +++ b/queue-5.6/usb-dwc3-gadget-fix-request-completion-check.patch @@ -0,0 +1,54 @@ +From 49e0590e3a60e75b493e5df879e216e5073c7663 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Tue, 31 Mar 2020 01:40:35 -0700 +Subject: usb: dwc3: gadget: Fix request completion check + +From: Thinh Nguyen + +commit 49e0590e3a60e75b493e5df879e216e5073c7663 upstream. + +A request may not be completed because not all the TRBs are prepared for +it. This happens when we run out of available TRBs. When some TRBs are +completed, the driver needs to prepare the rest of the TRBs for the +request. The check dwc3_gadget_ep_request_completed() shouldn't be +checking the amount of data received but rather the number of pending +TRBs. Revise this request completion check. + +Cc: stable@vger.kernel.org +Fixes: e0c42ce590fe ("usb: dwc3: gadget: simplify IOC handling") +Signed-off-by: Thinh Nguyen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 12 ++---------- + 1 file changed, 2 insertions(+), 10 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2484,14 +2484,7 @@ static int dwc3_gadget_ep_reclaim_trb_li + + static bool dwc3_gadget_ep_request_completed(struct dwc3_request *req) + { +- /* +- * For OUT direction, host may send less than the setup +- * length. Return true for all OUT requests. +- */ +- if (!req->direction) +- return true; +- +- return req->request.actual == req->request.length; ++ return req->num_pending_sgs == 0; + } + + static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep, +@@ -2515,8 +2508,7 @@ static int dwc3_gadget_ep_cleanup_comple + + req->request.actual = req->request.length - req->remaining; + +- if (!dwc3_gadget_ep_request_completed(req) || +- req->num_pending_sgs) { ++ if (!dwc3_gadget_ep_request_completed(req)) { + __dwc3_gadget_kick_transfer(dep); + goto out; + } diff --git a/queue-5.6/usb-f_fs-clear-os-extended-descriptor-counts-to-zero-in-ffs_data_reset.patch b/queue-5.6/usb-f_fs-clear-os-extended-descriptor-counts-to-zero-in-ffs_data_reset.patch new file mode 100644 index 00000000000..5ab17ac7de5 --- /dev/null +++ b/queue-5.6/usb-f_fs-clear-os-extended-descriptor-counts-to-zero-in-ffs_data_reset.patch @@ -0,0 +1,46 @@ +From 1c2e54fbf1da5e5445a0ab132c862b02ccd8d230 Mon Sep 17 00:00:00 2001 +From: Udipto Goswami +Date: Thu, 2 Apr 2020 10:15:21 +0530 +Subject: usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset() + +From: Udipto Goswami + +commit 1c2e54fbf1da5e5445a0ab132c862b02ccd8d230 upstream. + +For userspace functions using OS Descriptors, if a function also supplies +Extended Property descriptors currently the counts and lengths stored in +the ms_os_descs_ext_prop_{count,name_len,data_len} variables are not +getting reset to 0 during an unbind or when the epfiles are closed. If +the same function is re-bound and the descriptors are re-written, this +results in those count/length variables to monotonically increase +causing the VLA allocation in _ffs_func_bind() to grow larger and larger +at each bind/unbind cycle and eventually fail to allocate. + +Fix this by clearing the ms_os_descs_ext_prop count & lengths to 0 in +ffs_data_reset(). + +Fixes: f0175ab51993 ("usb: gadget: f_fs: OS descriptors support") +Cc: stable@vger.kernel.org +Signed-off-by: Udipto Goswami +Signed-off-by: Sriharsha Allenki +Reviewed-by: Manu Gautam +Link: https://lore.kernel.org/r/20200402044521.9312-1-sallenki@codeaurora.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_fs.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1813,6 +1813,10 @@ static void ffs_data_reset(struct ffs_da + ffs->state = FFS_READ_DESCRIPTORS; + ffs->setup_state = FFS_NO_SETUP; + ffs->flags = 0; ++ ++ ffs->ms_os_descs_ext_prop_count = 0; ++ ffs->ms_os_descs_ext_prop_name_len = 0; ++ ffs->ms_os_descs_ext_prop_data_len = 0; + } + + diff --git a/queue-5.6/usb-typec-altmode-fix-typec_altmode_get_partner-sometimes-returning-an-invalid-pointer.patch b/queue-5.6/usb-typec-altmode-fix-typec_altmode_get_partner-sometimes-returning-an-invalid-pointer.patch new file mode 100644 index 00000000000..47522ceaeb1 --- /dev/null +++ b/queue-5.6/usb-typec-altmode-fix-typec_altmode_get_partner-sometimes-returning-an-invalid-pointer.patch @@ -0,0 +1,42 @@ +From 0df9433fcae02215c8fd79690c134d535c7bb905 Mon Sep 17 00:00:00 2001 +From: Naoki Kiryu +Date: Wed, 22 Apr 2020 16:43:45 +0200 +Subject: usb: typec: altmode: Fix typec_altmode_get_partner sometimes returning an invalid pointer + +From: Naoki Kiryu + +commit 0df9433fcae02215c8fd79690c134d535c7bb905 upstream. + +Before this commit, typec_altmode_get_partner would return a +const struct typec_altmode * pointing to address 0x08 when +to_altmode(adev)->partner was NULL. + +Add a check for to_altmode(adev)->partner being NULL to fix this. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206365 +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1785972 +Fixes: 5f54a85db5df ("usb: typec: Make sure an alt mode exist before getting its partner") +Cc: stable@vger.kernel.org +Signed-off-by: Naoki Kiryu +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20200422144345.43262-1-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/typec/bus.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/usb/typec/bus.c ++++ b/drivers/usb/typec/bus.c +@@ -208,7 +208,10 @@ EXPORT_SYMBOL_GPL(typec_altmode_vdm); + const struct typec_altmode * + typec_altmode_get_partner(struct typec_altmode *adev) + { +- return adev ? &to_altmode(adev)->partner->adev : NULL; ++ if (!adev || !to_altmode(adev)->partner) ++ return NULL; ++ ++ return &to_altmode(adev)->partner->adev; + } + EXPORT_SYMBOL_GPL(typec_altmode_get_partner); + diff --git a/queue-5.6/usb-typec-tcpm-ignore-cc-and-vbus-changes-in-port_reset-change.patch b/queue-5.6/usb-typec-tcpm-ignore-cc-and-vbus-changes-in-port_reset-change.patch new file mode 100644 index 00000000000..580064c6579 --- /dev/null +++ b/queue-5.6/usb-typec-tcpm-ignore-cc-and-vbus-changes-in-port_reset-change.patch @@ -0,0 +1,93 @@ +From 901789745a053286e0ced37960d44fa60267b940 Mon Sep 17 00:00:00 2001 +From: Badhri Jagan Sridharan +Date: Thu, 2 Apr 2020 14:59:47 -0700 +Subject: usb: typec: tcpm: Ignore CC and vbus changes in PORT_RESET change + +From: Badhri Jagan Sridharan + +commit 901789745a053286e0ced37960d44fa60267b940 upstream. + +After PORT_RESET, the port is set to the appropriate +default_state. Ignore processing CC changes here as this +could cause the port to be switched into sink states +by default. + +echo source > /sys/class/typec/port0/port_type + +Before: +[ 154.528547] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms +[ 154.528560] CC1: 0 -> 0, CC2: 3 -> 0 [state PORT_RESET, polarity 0, disconnected] +[ 154.528564] state change PORT_RESET -> SNK_UNATTACHED + +After: +[ 151.068814] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms [rev3 NONE_AMS] +[ 151.072440] CC1: 3 -> 0, CC2: 0 -> 0 [state PORT_RESET, polarity 0, disconnected] +[ 151.172117] state change PORT_RESET -> PORT_RESET_WAIT_OFF [delayed 100 ms] +[ 151.172136] pending state change PORT_RESET_WAIT_OFF -> SRC_UNATTACHED @ 870 ms [rev3 NONE_AMS] +[ 152.060106] state change PORT_RESET_WAIT_OFF -> SRC_UNATTACHED [delayed 870 ms] +[ 152.060118] Start toggling + +Signed-off-by: Badhri Jagan Sridharan +Cc: stable +Reviewed-by: Heikki Krogerus +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20200402215947.176577-1-badhri@google.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/typec/tcpm/tcpm.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -3759,6 +3759,14 @@ static void _tcpm_cc_change(struct tcpm_ + */ + break; + ++ case PORT_RESET: ++ case PORT_RESET_WAIT_OFF: ++ /* ++ * State set back to default mode once the timer completes. ++ * Ignore CC changes here. ++ */ ++ break; ++ + default: + if (tcpm_port_is_disconnected(port)) + tcpm_set_state(port, unattached_state(port), 0); +@@ -3820,6 +3828,15 @@ static void _tcpm_pd_vbus_on(struct tcpm + case SRC_TRY_DEBOUNCE: + /* Do nothing, waiting for sink detection */ + break; ++ ++ case PORT_RESET: ++ case PORT_RESET_WAIT_OFF: ++ /* ++ * State set back to default mode once the timer completes. ++ * Ignore vbus changes here. ++ */ ++ break; ++ + default: + break; + } +@@ -3873,10 +3890,19 @@ static void _tcpm_pd_vbus_off(struct tcp + case PORT_RESET_WAIT_OFF: + tcpm_set_state(port, tcpm_default_state(port), 0); + break; ++ + case SRC_TRY_WAIT: + case SRC_TRY_DEBOUNCE: + /* Do nothing, waiting for sink detection */ + break; ++ ++ case PORT_RESET: ++ /* ++ * State set back to default mode once the timer completes. ++ * Ignore vbus changes here. ++ */ ++ break; ++ + default: + if (port->pwr_role == TYPEC_SINK && + port->attached) diff --git a/queue-5.6/vt-don-t-hardcode-the-mem-allocation-upper-bound.patch b/queue-5.6/vt-don-t-hardcode-the-mem-allocation-upper-bound.patch new file mode 100644 index 00000000000..0df20c79814 --- /dev/null +++ b/queue-5.6/vt-don-t-hardcode-the-mem-allocation-upper-bound.patch @@ -0,0 +1,40 @@ +From 2717769e204e83e65b8819c5e2ef3e5b6639b270 Mon Sep 17 00:00:00 2001 +From: Nicolas Pitre +Date: Sat, 28 Mar 2020 17:32:42 -0400 +Subject: vt: don't hardcode the mem allocation upper bound + +From: Nicolas Pitre + +commit 2717769e204e83e65b8819c5e2ef3e5b6639b270 upstream. + +The code in vc_do_resize() bounds the memory allocation size to avoid +exceeding MAX_ORDER down the kzalloc() call chain and generating a +runtime warning triggerable from user space. However, not only is it +unwise to use a literal value here, but MAX_ORDER may also be +configurable based on CONFIG_FORCE_MAX_ZONEORDER. +Let's use KMALLOC_MAX_SIZE instead. + +Note that prior commit bb1107f7c605 ("mm, slab: make sure that +KMALLOC_MAX_SIZE will fit into MAX_ORDER") the KMALLOC_MAX_SIZE value +could not be relied upon. + +Signed-off-by: Nicolas Pitre +Cc: # v4.10+ +Link: https://lore.kernel.org/r/nycvar.YSQ.7.76.2003281702410.2671@knanqh.ubzr +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/vt/vt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -1206,7 +1206,7 @@ static int vc_do_resize(struct tty_struc + if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) + return 0; + +- if (new_screen_size > (4 << 20)) ++ if (new_screen_size > KMALLOC_MAX_SIZE) + return -EINVAL; + newscreen = kzalloc(new_screen_size, GFP_USER); + if (!newscreen) diff --git a/queue-5.6/vt-don-t-use-kmalloc-for-the-unicode-screen-buffer.patch b/queue-5.6/vt-don-t-use-kmalloc-for-the-unicode-screen-buffer.patch new file mode 100644 index 00000000000..619e9f3c8e4 --- /dev/null +++ b/queue-5.6/vt-don-t-use-kmalloc-for-the-unicode-screen-buffer.patch @@ -0,0 +1,56 @@ +From 9a98e7a80f95378c9ee0c644705e3b5aa54745f1 Mon Sep 17 00:00:00 2001 +From: Nicolas Pitre +Date: Sat, 28 Mar 2020 22:25:11 -0400 +Subject: vt: don't use kmalloc() for the unicode screen buffer + +From: Nicolas Pitre + +commit 9a98e7a80f95378c9ee0c644705e3b5aa54745f1 upstream. + +Even if the actual screen size is bounded in vc_do_resize(), the unicode +buffer is still a little more than twice the size of the glyph buffer +and may exceed MAX_ORDER down the kmalloc() path. This can be triggered +from user space. + +Since there is no point having a physically contiguous buffer here, +let's avoid the above issue as well as reducing pressure on high order +allocations by using vmalloc() instead. + +Signed-off-by: Nicolas Pitre +Cc: +Acked-by: Sam Ravnborg +Link: https://lore.kernel.org/r/nycvar.YSQ.7.76.2003282214210.2671@knanqh.ubzr +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/vt/vt.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -81,6 +81,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -350,7 +351,7 @@ static struct uni_screen *vc_uniscr_allo + /* allocate everything in one go */ + memsize = cols * rows * sizeof(char32_t); + memsize += rows * sizeof(char32_t *); +- p = kmalloc(memsize, GFP_KERNEL); ++ p = vmalloc(memsize); + if (!p) + return NULL; + +@@ -366,7 +367,7 @@ static struct uni_screen *vc_uniscr_allo + + static void vc_uniscr_set(struct vc_data *vc, struct uni_screen *new_uniscr) + { +- kfree(vc->vc_uni_screen); ++ vfree(vc->vc_uni_screen); + vc->vc_uni_screen = new_uniscr; + } + diff --git a/queue-5.6/xhci-don-t-clear-hub-tt-buffer-on-ep0-protocol-stall.patch b/queue-5.6/xhci-don-t-clear-hub-tt-buffer-on-ep0-protocol-stall.patch new file mode 100644 index 00000000000..5724324dd49 --- /dev/null +++ b/queue-5.6/xhci-don-t-clear-hub-tt-buffer-on-ep0-protocol-stall.patch @@ -0,0 +1,68 @@ +From 8f97250c21f0cf36434bf5b7ddf4377406534cd1 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 21 Apr 2020 17:08:22 +0300 +Subject: xhci: Don't clear hub TT buffer on ep0 protocol stall + +From: Mathias Nyman + +commit 8f97250c21f0cf36434bf5b7ddf4377406534cd1 upstream. + +The default control endpoint ep0 can return a STALL indicating the +device does not support the control transfer requests. This is called +a protocol stall and does not halt the endpoint. + +xHC behaves a bit different. Its internal endpoint state will always +be halted on any stall, even if the device side of the endpiont is not +halted. So we do need to issue the reset endpoint command to clear the +xHC host intenal endpoint halt state, but should not request the HS hub +to clear the TT buffer unless device side of endpoint is halted. + +Clearing the hub TT buffer at protocol stall caused ep0 to become +unresponsive for some FS/LS devices behind HS hubs, and class drivers +failed to set the interface due to timeout: + +usb 1-2.1: 1:1: usb_set_interface failed (-110) + +Fixes: ef513be0a905 ("usb: xhci: Add Clear_TT_Buffer") +Cc: # v5.3 +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20200421140822.28233-4-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-ring.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1872,7 +1872,6 @@ static void xhci_cleanup_halted_endpoint + ep->ep_state |= EP_HARD_CLEAR_TOGGLE; + xhci_cleanup_stalled_ring(xhci, slot_id, ep_index, stream_id, + td); +- xhci_clear_hub_tt_buffer(xhci, td, ep); + } + xhci_ring_cmd_db(xhci); + } +@@ -1993,11 +1992,18 @@ static int finish_td(struct xhci_hcd *xh + if (trb_comp_code == COMP_STALL_ERROR || + xhci_requires_manual_halt_cleanup(xhci, ep_ctx, + trb_comp_code)) { +- /* Issue a reset endpoint command to clear the host side +- * halt, followed by a set dequeue command to move the +- * dequeue pointer past the TD. +- * The class driver clears the device side halt later. ++ /* ++ * xhci internal endpoint state will go to a "halt" state for ++ * any stall, including default control pipe protocol stall. ++ * To clear the host side halt we need to issue a reset endpoint ++ * command, followed by a set dequeue command to move past the ++ * TD. ++ * Class drivers clear the device side halt from a functional ++ * stall later. Hub TT buffer should only be cleared for FS/LS ++ * devices behind HS hubs for functional stalls. + */ ++ if ((ep_index != 0) || (trb_comp_code != COMP_STALL_ERROR)) ++ xhci_clear_hub_tt_buffer(xhci, td, ep); + xhci_cleanup_halted_endpoint(xhci, slot_id, ep_index, + ep_ring->stream_id, td, EP_HARD_RESET); + } else { diff --git a/queue-5.6/xhci-fix-handling-halted-endpoint-even-if-endpoint-ring-appears-empty.patch b/queue-5.6/xhci-fix-handling-halted-endpoint-even-if-endpoint-ring-appears-empty.patch new file mode 100644 index 00000000000..e3a6f4372fd --- /dev/null +++ b/queue-5.6/xhci-fix-handling-halted-endpoint-even-if-endpoint-ring-appears-empty.patch @@ -0,0 +1,155 @@ +From 93ceaa808e8defc67ebca1396e2f42f812a2efc0 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 21 Apr 2020 17:08:20 +0300 +Subject: xhci: Fix handling halted endpoint even if endpoint ring appears empty + +From: Mathias Nyman + +commit 93ceaa808e8defc67ebca1396e2f42f812a2efc0 upstream. + +If a class driver cancels its only URB then the endpoint ring buffer will +appear empty to the xhci driver. xHC hardware may still process cached +TRBs, and complete with a STALL, halting the endpoint. + +This halted endpoint was not handled correctly by xhci driver as events on +empty rings were all assumed to be spurious events. +xhci driver refused to restart the ring with EP_HALTED flag set, so class +driver was never informed the endpoint halted even if it queued new URBs. + +The host side of the endpoint needs to be reset, and dequeue pointer should +be moved in order to clear the cached TRBs and resetart the endpoint. + +Small adjustments in finding the new dequeue pointer are needed to support +the case of stall on an empty ring and unknown current TD. + +Cc: +cc: Jeremy Compostella +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20200421140822.28233-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-ring.c | 30 +++++++++++++++++++++++++++++- + drivers/usb/host/xhci.c | 14 +++++++------- + drivers/usb/host/xhci.h | 5 +++-- + 3 files changed, 39 insertions(+), 10 deletions(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -547,6 +547,23 @@ void xhci_find_new_dequeue_state(struct + stream_id); + return; + } ++ /* ++ * A cancelled TD can complete with a stall if HW cached the trb. ++ * In this case driver can't find cur_td, but if the ring is empty we ++ * can move the dequeue pointer to the current enqueue position. ++ */ ++ if (!cur_td) { ++ if (list_empty(&ep_ring->td_list)) { ++ state->new_deq_seg = ep_ring->enq_seg; ++ state->new_deq_ptr = ep_ring->enqueue; ++ state->new_cycle_state = ep_ring->cycle_state; ++ goto done; ++ } else { ++ xhci_warn(xhci, "Can't find new dequeue state, missing cur_td\n"); ++ return; ++ } ++ } ++ + /* Dig out the cycle state saved by the xHC during the stop ep cmd */ + xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb, + "Finding endpoint context"); +@@ -592,6 +609,7 @@ void xhci_find_new_dequeue_state(struct + state->new_deq_seg = new_seg; + state->new_deq_ptr = new_deq; + ++done: + /* Don't update the ring cycle state for the producer (us). */ + xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb, + "Cycle state = 0x%x", state->new_cycle_state); +@@ -1852,7 +1870,8 @@ static void xhci_cleanup_halted_endpoint + + if (reset_type == EP_HARD_RESET) { + ep->ep_state |= EP_HARD_CLEAR_TOGGLE; +- xhci_cleanup_stalled_ring(xhci, ep_index, stream_id, td); ++ xhci_cleanup_stalled_ring(xhci, slot_id, ep_index, stream_id, ++ td); + xhci_clear_hub_tt_buffer(xhci, td, ep); + } + xhci_ring_cmd_db(xhci); +@@ -2531,6 +2550,15 @@ static int handle_tx_event(struct xhci_h + xhci_dbg(xhci, "td_list is empty while skip flag set. Clear skip flag for slot %u ep %u.\n", + slot_id, ep_index); + } ++ if (trb_comp_code == COMP_STALL_ERROR || ++ xhci_requires_manual_halt_cleanup(xhci, ep_ctx, ++ trb_comp_code)) { ++ xhci_cleanup_halted_endpoint(xhci, slot_id, ++ ep_index, ++ ep_ring->stream_id, ++ NULL, ++ EP_HARD_RESET); ++ } + goto cleanup; + } + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3031,19 +3031,19 @@ static void xhci_setup_input_ctx_for_qui + added_ctxs, added_ctxs); + } + +-void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci, unsigned int ep_index, +- unsigned int stream_id, struct xhci_td *td) ++void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci, unsigned int slot_id, ++ unsigned int ep_index, unsigned int stream_id, ++ struct xhci_td *td) + { + struct xhci_dequeue_state deq_state; +- struct usb_device *udev = td->urb->dev; + + xhci_dbg_trace(xhci, trace_xhci_dbg_reset_ep, + "Cleaning up stalled endpoint ring"); + /* We need to move the HW's dequeue pointer past this TD, + * or it will attempt to resend it on the next doorbell ring. + */ +- xhci_find_new_dequeue_state(xhci, udev->slot_id, +- ep_index, stream_id, td, &deq_state); ++ xhci_find_new_dequeue_state(xhci, slot_id, ep_index, stream_id, td, ++ &deq_state); + + if (!deq_state.new_deq_ptr || !deq_state.new_deq_seg) + return; +@@ -3054,7 +3054,7 @@ void xhci_cleanup_stalled_ring(struct xh + if (!(xhci->quirks & XHCI_RESET_EP_QUIRK)) { + xhci_dbg_trace(xhci, trace_xhci_dbg_reset_ep, + "Queueing new dequeue state"); +- xhci_queue_new_dequeue_state(xhci, udev->slot_id, ++ xhci_queue_new_dequeue_state(xhci, slot_id, + ep_index, &deq_state); + } else { + /* Better hope no one uses the input context between now and the +@@ -3065,7 +3065,7 @@ void xhci_cleanup_stalled_ring(struct xh + xhci_dbg_trace(xhci, trace_xhci_dbg_quirks, + "Setting up input context for " + "configure endpoint command"); +- xhci_setup_input_ctx_for_quirk(xhci, udev->slot_id, ++ xhci_setup_input_ctx_for_quirk(xhci, slot_id, + ep_index, &deq_state); + } + } +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -2116,8 +2116,9 @@ void xhci_find_new_dequeue_state(struct + void xhci_queue_new_dequeue_state(struct xhci_hcd *xhci, + unsigned int slot_id, unsigned int ep_index, + struct xhci_dequeue_state *deq_state); +-void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci, unsigned int ep_index, +- unsigned int stream_id, struct xhci_td *td); ++void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci, unsigned int slot_id, ++ unsigned int ep_index, unsigned int stream_id, ++ struct xhci_td *td); + void xhci_stop_endpoint_command_watchdog(struct timer_list *t); + void xhci_handle_command_timeout(struct work_struct *work); + diff --git a/queue-5.6/xhci-prevent-bus-suspend-if-a-roothub-port-detected-a-over-current-condition.patch b/queue-5.6/xhci-prevent-bus-suspend-if-a-roothub-port-detected-a-over-current-condition.patch new file mode 100644 index 00000000000..3f3590ee6d3 --- /dev/null +++ b/queue-5.6/xhci-prevent-bus-suspend-if-a-roothub-port-detected-a-over-current-condition.patch @@ -0,0 +1,47 @@ +From e9fb08d617bfae5471d902112667d0eeb9dee3c4 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 21 Apr 2020 17:08:21 +0300 +Subject: xhci: prevent bus suspend if a roothub port detected a over-current condition + +From: Mathias Nyman + +commit e9fb08d617bfae5471d902112667d0eeb9dee3c4 upstream. + +Suspending the bus and host controller while a port is in a over-current +condition may halt the host. +Also keep the roothub running if over-current is active. + +Cc: +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20200421140822.28233-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-hub.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -1569,6 +1569,8 @@ int xhci_hub_status_data(struct usb_hcd + } + if ((temp & PORT_RC)) + reset_change = true; ++ if (temp & PORT_OC) ++ status = 1; + } + if (!status && !reset_change) { + xhci_dbg(xhci, "%s: stopping port polling.\n", __func__); +@@ -1634,6 +1636,13 @@ retry: + port_index); + goto retry; + } ++ /* bail out if port detected a over-current condition */ ++ if (t1 & PORT_OC) { ++ bus_state->bus_suspended = 0; ++ spin_unlock_irqrestore(&xhci->lock, flags); ++ xhci_dbg(xhci, "Bus suspend bailout, port over-current detected\n"); ++ return -EBUSY; ++ } + /* suspend ports in U0, or bail out for new connect changes */ + if ((t1 & PORT_PE) && (t1 & PORT_PLS_MASK) == XDEV_U0) { + if ((t1 & PORT_CSC) && wake_enabled) {