From: Greg Kroah-Hartman Date: Mon, 9 Nov 2020 10:43:07 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.4.242~8 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=47054e9c17f345a23383b9161c6be47ebcd25725;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: arc-stack-unwinding-avoid-indefinite-looping.patch drm-panfrost-fix-a-deadlock-between-the-shrinker-and-madvise-path.patch fork-fix-copy_process-clone_parent-race-with-the-exiting-real_parent.patch pm-runtime-drop-pm_runtime_clean_up_links.patch pm-runtime-drop-runtime-pm-references-to-supplier-on-link-removal.patch pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch s390-pkey-fix-paes-selftest-failure-with-paes-and-pkey-static-build.patch serial-8250_mtk-fix-uart_get_baud_rate-warning.patch serial-txx9-add-missing-platform_driver_unregister-on-error-in-serial_txx9_init.patch tty-serial-fsl_lpuart-add-ls1028a-support.patch tty-serial-fsl_lpuart-ls1021a-has-a-fifo-size-of-16-words-like-ls1028a.patch usb-add-no_lpm-quirk-for-kingston-flash-drive.patch usb-dwc3-ep0-fix-delay-status-handling.patch usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch usb-serial-cyberjack-fix-write-urb-completion-race.patch usb-serial-option-add-le910cx-compositions-0x1203-0x1230-0x1231.patch usb-serial-option-add-quectel-ec200t-module-support.patch usb-serial-option-add-telit-fn980-composition-0x1055.patch xfs-flush-for-older-xfs-specific-ioctls.patch --- diff --git a/queue-5.4/arc-stack-unwinding-avoid-indefinite-looping.patch b/queue-5.4/arc-stack-unwinding-avoid-indefinite-looping.patch new file mode 100644 index 00000000000..2c794ff2c61 --- /dev/null +++ b/queue-5.4/arc-stack-unwinding-avoid-indefinite-looping.patch @@ -0,0 +1,72 @@ +From 328d2168ca524d501fc4b133d6be076142bd305c Mon Sep 17 00:00:00 2001 +From: Vineet Gupta +Date: Tue, 27 Oct 2020 15:01:17 -0700 +Subject: ARC: stack unwinding: avoid indefinite looping + +From: Vineet Gupta + +commit 328d2168ca524d501fc4b133d6be076142bd305c upstream. + +Currently stack unwinder is a while(1) loop which relies on the dwarf +unwinder to signal termination, which in turn relies on dwarf info to do +so. This in theory could cause an infinite loop if the dwarf info was +somehow messed up or the register contents were etc. + +This fix thus detects the excessive looping and breaks the loop. + +| Mem: 26184K used, 1009136K free, 0K shrd, 0K buff, 14416K cached +| CPU: 0.0% usr 72.8% sys 0.0% nic 27.1% idle 0.0% io 0.0% irq 0.0% sirq +| Load average: 4.33 2.60 1.11 2/74 139 +| PID PPID USER STAT VSZ %VSZ CPU %CPU COMMAND +| 133 2 root SWN 0 0.0 3 22.9 [rcu_torture_rea] +| 132 2 root SWN 0 0.0 0 22.0 [rcu_torture_rea] +| 131 2 root SWN 0 0.0 3 21.5 [rcu_torture_rea] +| 126 2 root RW 0 0.0 2 5.4 [rcu_torture_wri] +| 129 2 root SWN 0 0.0 0 0.2 [rcu_torture_fak] +| 137 2 root SW 0 0.0 0 0.2 [rcu_torture_cbf] +| 127 2 root SWN 0 0.0 0 0.1 [rcu_torture_fak] +| 138 115 root R 1464 0.1 2 0.1 top +| 130 2 root SWN 0 0.0 0 0.1 [rcu_torture_fak] +| 128 2 root SWN 0 0.0 0 0.1 [rcu_torture_fak] +| 115 1 root S 1472 0.1 1 0.0 -/bin/sh +| 104 1 root S 1464 0.1 0 0.0 inetd +| 1 0 root S 1456 0.1 2 0.0 init +| 78 1 root S 1456 0.1 0 0.0 syslogd -O /var/log/messages +| 134 2 root SW 0 0.0 2 0.0 [rcu_torture_sta] +| 10 2 root IW 0 0.0 1 0.0 [rcu_preempt] +| 88 2 root IW 0 0.0 1 0.0 [kworker/1:1-eve] +| 66 2 root IW 0 0.0 2 0.0 [kworker/2:2-eve] +| 39 2 root IW 0 0.0 2 0.0 [kworker/2:1-eve] +| unwinder looping too long, aborting ! + +Cc: +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/kernel/stacktrace.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/arch/arc/kernel/stacktrace.c ++++ b/arch/arc/kernel/stacktrace.c +@@ -112,7 +112,7 @@ arc_unwind_core(struct task_struct *tsk, + int (*consumer_fn) (unsigned int, void *), void *arg) + { + #ifdef CONFIG_ARC_DW2_UNWIND +- int ret = 0; ++ int ret = 0, cnt = 0; + unsigned int address; + struct unwind_frame_info frame_info; + +@@ -132,6 +132,11 @@ arc_unwind_core(struct task_struct *tsk, + break; + + frame_info.regs.r63 = frame_info.regs.r31; ++ ++ if (cnt++ > 128) { ++ printk("unwinder looping too long, aborting !\n"); ++ return 0; ++ } + } + + return address; /* return the last address it saw */ diff --git a/queue-5.4/drm-panfrost-fix-a-deadlock-between-the-shrinker-and-madvise-path.patch b/queue-5.4/drm-panfrost-fix-a-deadlock-between-the-shrinker-and-madvise-path.patch new file mode 100644 index 00000000000..25e2baf238e --- /dev/null +++ b/queue-5.4/drm-panfrost-fix-a-deadlock-between-the-shrinker-and-madvise-path.patch @@ -0,0 +1,89 @@ +From 7d2d6d01293e6d9b42a6cb410be4158571f7fe9d Mon Sep 17 00:00:00 2001 +From: Boris Brezillon +Date: Sun, 1 Nov 2020 18:40:16 +0100 +Subject: drm/panfrost: Fix a deadlock between the shrinker and madvise path + +From: Boris Brezillon + +commit 7d2d6d01293e6d9b42a6cb410be4158571f7fe9d upstream. + +panfrost_ioctl_madvise() and panfrost_gem_purge() acquire the mappings +and shmem locks in different orders, thus leading to a potential +the mappings lock first. + +Fixes: bdefca2d8dc0 ("drm/panfrost: Add the panfrost_gem_mapping concept") +Cc: +Cc: Christian Hewitt +Reported-by: Christian Hewitt +Signed-off-by: Boris Brezillon +Reviewed-by: Steven Price +Link: https://patchwork.freedesktop.org/patch/msgid/20201101174016.839110-1-boris.brezillon@collabora.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/panfrost/panfrost_gem.c | 4 +--- + drivers/gpu/drm/panfrost/panfrost_gem.h | 2 +- + drivers/gpu/drm/panfrost/panfrost_gem_shrinker.c | 14 +++++++++++--- + 3 files changed, 13 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/panfrost/panfrost_gem.c ++++ b/drivers/gpu/drm/panfrost/panfrost_gem.c +@@ -105,14 +105,12 @@ void panfrost_gem_mapping_put(struct pan + kref_put(&mapping->refcount, panfrost_gem_mapping_release); + } + +-void panfrost_gem_teardown_mappings(struct panfrost_gem_object *bo) ++void panfrost_gem_teardown_mappings_locked(struct panfrost_gem_object *bo) + { + struct panfrost_gem_mapping *mapping; + +- mutex_lock(&bo->mappings.lock); + list_for_each_entry(mapping, &bo->mappings.list, node) + panfrost_gem_teardown_mapping(mapping); +- mutex_unlock(&bo->mappings.lock); + } + + int panfrost_gem_open(struct drm_gem_object *obj, struct drm_file *file_priv) +--- a/drivers/gpu/drm/panfrost/panfrost_gem.h ++++ b/drivers/gpu/drm/panfrost/panfrost_gem.h +@@ -82,7 +82,7 @@ struct panfrost_gem_mapping * + panfrost_gem_mapping_get(struct panfrost_gem_object *bo, + struct panfrost_file_priv *priv); + void panfrost_gem_mapping_put(struct panfrost_gem_mapping *mapping); +-void panfrost_gem_teardown_mappings(struct panfrost_gem_object *bo); ++void panfrost_gem_teardown_mappings_locked(struct panfrost_gem_object *bo); + + void panfrost_gem_shrinker_init(struct drm_device *dev); + void panfrost_gem_shrinker_cleanup(struct drm_device *dev); +--- a/drivers/gpu/drm/panfrost/panfrost_gem_shrinker.c ++++ b/drivers/gpu/drm/panfrost/panfrost_gem_shrinker.c +@@ -40,18 +40,26 @@ static bool panfrost_gem_purge(struct dr + { + struct drm_gem_shmem_object *shmem = to_drm_gem_shmem_obj(obj); + struct panfrost_gem_object *bo = to_panfrost_bo(obj); ++ bool ret = false; + + if (atomic_read(&bo->gpu_usecount)) + return false; + +- if (!mutex_trylock(&shmem->pages_lock)) ++ if (!mutex_trylock(&bo->mappings.lock)) + return false; + +- panfrost_gem_teardown_mappings(bo); ++ if (!mutex_trylock(&shmem->pages_lock)) ++ goto unlock_mappings; ++ ++ panfrost_gem_teardown_mappings_locked(bo); + drm_gem_shmem_purge_locked(obj); ++ ret = true; + + mutex_unlock(&shmem->pages_lock); +- return true; ++ ++unlock_mappings: ++ mutex_unlock(&bo->mappings.lock); ++ return ret; + } + + static unsigned long diff --git a/queue-5.4/fork-fix-copy_process-clone_parent-race-with-the-exiting-real_parent.patch b/queue-5.4/fork-fix-copy_process-clone_parent-race-with-the-exiting-real_parent.patch new file mode 100644 index 00000000000..f6eba97ccba --- /dev/null +++ b/queue-5.4/fork-fix-copy_process-clone_parent-race-with-the-exiting-real_parent.patch @@ -0,0 +1,55 @@ +From b4e00444cab4c3f3fec876dc0cccc8cbb0d1a948 Mon Sep 17 00:00:00 2001 +From: Eddy Wu +Date: Sat, 7 Nov 2020 14:47:22 +0800 +Subject: fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent + +From: Eddy Wu + +commit b4e00444cab4c3f3fec876dc0cccc8cbb0d1a948 upstream. + +current->group_leader->exit_signal may change during copy_process() if +current->real_parent exits. + +Move the assignment inside tasklist_lock to avoid the race. + +Signed-off-by: Eddy Wu +Acked-by: Oleg Nesterov +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/fork.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -2100,14 +2100,9 @@ static __latent_entropy struct task_stru + /* ok, now we should be set up.. */ + p->pid = pid_nr(pid); + if (clone_flags & CLONE_THREAD) { +- p->exit_signal = -1; + p->group_leader = current->group_leader; + p->tgid = current->tgid; + } else { +- if (clone_flags & CLONE_PARENT) +- p->exit_signal = current->group_leader->exit_signal; +- else +- p->exit_signal = args->exit_signal; + p->group_leader = p; + p->tgid = p->pid; + } +@@ -2152,9 +2147,14 @@ static __latent_entropy struct task_stru + if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) { + p->real_parent = current->real_parent; + p->parent_exec_id = current->parent_exec_id; ++ if (clone_flags & CLONE_THREAD) ++ p->exit_signal = -1; ++ else ++ p->exit_signal = current->group_leader->exit_signal; + } else { + p->real_parent = current; + p->parent_exec_id = current->self_exec_id; ++ p->exit_signal = args->exit_signal; + } + + klp_copy_process(p); diff --git a/queue-5.4/pm-runtime-drop-pm_runtime_clean_up_links.patch b/queue-5.4/pm-runtime-drop-pm_runtime_clean_up_links.patch new file mode 100644 index 00000000000..193b00273c0 --- /dev/null +++ b/queue-5.4/pm-runtime-drop-pm_runtime_clean_up_links.patch @@ -0,0 +1,106 @@ +From d6e36668598154820177bfd78c1621d8e6c580a2 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Wed, 21 Oct 2020 21:13:10 +0200 +Subject: PM: runtime: Drop pm_runtime_clean_up_links() + +From: Rafael J. Wysocki + +commit d6e36668598154820177bfd78c1621d8e6c580a2 upstream. + +After commit d12544fb2aa9 ("PM: runtime: Remove link state checks in +rpm_get/put_supplier()") nothing prevents the consumer device's +runtime PM from acquiring additional references to the supplier +device after pm_runtime_clean_up_links() has run (or even while it +is running), so calling this function from __device_release_driver() +may be pointless (or even harmful). + +Moreover, it ignores stateless device links, so the runtime PM +handling of managed and stateless device links is inconsistent +because of it, so better get rid of it entirely. + +Fixes: d12544fb2aa9 ("PM: runtime: Remove link state checks in rpm_get/put_supplier()") +Signed-off-by: Rafael J. Wysocki +Cc: 5.1+ # 5.1+ +Tested-by: Xiang Chen +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/dd.c | 1 - + drivers/base/power/runtime.c | 36 ------------------------------------ + include/linux/pm_runtime.h | 2 -- + 3 files changed, 39 deletions(-) + +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -1121,7 +1121,6 @@ static void __device_release_driver(stru + } + + pm_runtime_get_sync(dev); +- pm_runtime_clean_up_links(dev); + + driver_sysfs_remove(dev); + +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -1616,42 +1616,6 @@ void pm_runtime_remove(struct device *de + } + + /** +- * pm_runtime_clean_up_links - Prepare links to consumers for driver removal. +- * @dev: Device whose driver is going to be removed. +- * +- * Check links from this device to any consumers and if any of them have active +- * runtime PM references to the device, drop the usage counter of the device +- * (as many times as needed). +- * +- * Links with the DL_FLAG_MANAGED flag unset are ignored. +- * +- * Since the device is guaranteed to be runtime-active at the point this is +- * called, nothing else needs to be done here. +- * +- * Moreover, this is called after device_links_busy() has returned 'false', so +- * the status of each link is guaranteed to be DL_STATE_SUPPLIER_UNBIND and +- * therefore rpm_active can't be manipulated concurrently. +- */ +-void pm_runtime_clean_up_links(struct device *dev) +-{ +- struct device_link *link; +- int idx; +- +- idx = device_links_read_lock(); +- +- list_for_each_entry_rcu(link, &dev->links.consumers, s_node, +- device_links_read_lock_held()) { +- if (!(link->flags & DL_FLAG_MANAGED)) +- continue; +- +- while (refcount_dec_not_one(&link->rpm_active)) +- pm_runtime_put_noidle(dev); +- } +- +- device_links_read_unlock(idx); +-} +- +-/** + * pm_runtime_get_suppliers - Resume and reference-count supplier devices. + * @dev: Consumer device. + */ +--- a/include/linux/pm_runtime.h ++++ b/include/linux/pm_runtime.h +@@ -54,7 +54,6 @@ extern u64 pm_runtime_autosuspend_expira + extern void pm_runtime_update_max_time_suspended(struct device *dev, + s64 delta_ns); + extern void pm_runtime_set_memalloc_noio(struct device *dev, bool enable); +-extern void pm_runtime_clean_up_links(struct device *dev); + extern void pm_runtime_get_suppliers(struct device *dev); + extern void pm_runtime_put_suppliers(struct device *dev); + extern void pm_runtime_new_link(struct device *dev); +@@ -173,7 +172,6 @@ static inline u64 pm_runtime_autosuspend + struct device *dev) { return 0; } + static inline void pm_runtime_set_memalloc_noio(struct device *dev, + bool enable){} +-static inline void pm_runtime_clean_up_links(struct device *dev) {} + static inline void pm_runtime_get_suppliers(struct device *dev) {} + static inline void pm_runtime_put_suppliers(struct device *dev) {} + static inline void pm_runtime_new_link(struct device *dev) {} diff --git a/queue-5.4/pm-runtime-drop-runtime-pm-references-to-supplier-on-link-removal.patch b/queue-5.4/pm-runtime-drop-runtime-pm-references-to-supplier-on-link-removal.patch new file mode 100644 index 00000000000..1920ad9e627 --- /dev/null +++ b/queue-5.4/pm-runtime-drop-runtime-pm-references-to-supplier-on-link-removal.patch @@ -0,0 +1,106 @@ +From e0e398e204634db8fb71bd89cf2f6e3e5bd09b51 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Wed, 21 Oct 2020 21:12:15 +0200 +Subject: PM: runtime: Drop runtime PM references to supplier on link removal + +From: Rafael J. Wysocki + +commit e0e398e204634db8fb71bd89cf2f6e3e5bd09b51 upstream. + +While removing a device link, drop the supplier device's runtime PM +usage counter as many times as needed to drop all of the runtime PM +references to it from the consumer in addition to dropping the +consumer's link count. + +Fixes: baa8809f6097 ("PM / runtime: Optimize the use of device links") +Signed-off-by: Rafael J. Wysocki +Cc: 5.1+ # 5.1+ +Tested-by: Xiang Chen +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/core.c | 6 ++---- + drivers/base/power/runtime.c | 21 ++++++++++++++++++++- + include/linux/pm_runtime.h | 4 ++-- + 3 files changed, 24 insertions(+), 7 deletions(-) + +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -454,8 +454,7 @@ static void __device_link_del(struct kre + dev_dbg(link->consumer, "Dropping the link to %s\n", + dev_name(link->supplier)); + +- if (link->flags & DL_FLAG_PM_RUNTIME) +- pm_runtime_drop_link(link->consumer); ++ pm_runtime_drop_link(link); + + list_del_rcu(&link->s_node); + list_del_rcu(&link->c_node); +@@ -469,8 +468,7 @@ static void __device_link_del(struct kre + dev_info(link->consumer, "Dropping the link to %s\n", + dev_name(link->supplier)); + +- if (link->flags & DL_FLAG_PM_RUNTIME) +- pm_runtime_drop_link(link->consumer); ++ pm_runtime_drop_link(link); + + list_del(&link->s_node); + list_del(&link->c_node); +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -1702,7 +1702,7 @@ void pm_runtime_new_link(struct device * + spin_unlock_irq(&dev->power.lock); + } + +-void pm_runtime_drop_link(struct device *dev) ++static void pm_runtime_drop_link_count(struct device *dev) + { + spin_lock_irq(&dev->power.lock); + WARN_ON(dev->power.links_count == 0); +@@ -1710,6 +1710,25 @@ void pm_runtime_drop_link(struct device + spin_unlock_irq(&dev->power.lock); + } + ++/** ++ * pm_runtime_drop_link - Prepare for device link removal. ++ * @link: Device link going away. ++ * ++ * Drop the link count of the consumer end of @link and decrement the supplier ++ * device's runtime PM usage counter as many times as needed to drop all of the ++ * PM runtime reference to it from the consumer. ++ */ ++void pm_runtime_drop_link(struct device_link *link) ++{ ++ if (!(link->flags & DL_FLAG_PM_RUNTIME)) ++ return; ++ ++ pm_runtime_drop_link_count(link->consumer); ++ ++ while (refcount_dec_not_one(&link->rpm_active)) ++ pm_runtime_put(link->supplier); ++} ++ + static bool pm_runtime_need_not_resume(struct device *dev) + { + return atomic_read(&dev->power.usage_count) <= 1 && +--- a/include/linux/pm_runtime.h ++++ b/include/linux/pm_runtime.h +@@ -58,7 +58,7 @@ extern void pm_runtime_clean_up_links(st + extern void pm_runtime_get_suppliers(struct device *dev); + extern void pm_runtime_put_suppliers(struct device *dev); + extern void pm_runtime_new_link(struct device *dev); +-extern void pm_runtime_drop_link(struct device *dev); ++extern void pm_runtime_drop_link(struct device_link *link); + + static inline void pm_suspend_ignore_children(struct device *dev, bool enable) + { +@@ -177,7 +177,7 @@ static inline void pm_runtime_clean_up_l + static inline void pm_runtime_get_suppliers(struct device *dev) {} + static inline void pm_runtime_put_suppliers(struct device *dev) {} + static inline void pm_runtime_new_link(struct device *dev) {} +-static inline void pm_runtime_drop_link(struct device *dev) {} ++static inline void pm_runtime_drop_link(struct device_link *link) {} + + #endif /* !CONFIG_PM */ + diff --git a/queue-5.4/pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch b/queue-5.4/pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch new file mode 100644 index 00000000000..49d7af0aa84 --- /dev/null +++ b/queue-5.4/pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch @@ -0,0 +1,60 @@ +From 9226c504e364158a17a68ff1fe9d67d266922f50 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Thu, 22 Oct 2020 17:38:22 +0200 +Subject: PM: runtime: Resume the device earlier in __device_release_driver() + +From: Rafael J. Wysocki + +commit 9226c504e364158a17a68ff1fe9d67d266922f50 upstream. + +Since the device is resumed from runtime-suspend in +__device_release_driver() anyway, it is better to do that before +looking for busy managed device links from it to consumers, because +if there are any, device_links_unbind_consumers() will be called +and it will cause the consumer devices' drivers to unbind, so the +consumer devices will be runtime-resumed. In turn, resuming each +consumer device will cause the supplier to be resumed and when the +runtime PM references from the given consumer to it are dropped, it +may be suspended. Then, the runtime-resume of the next consumer +will cause the supplier to resume again and so on. + +Update the code accordingly. + +Signed-off-by: Rafael J. Wysocki +Fixes: 9ed9895370ae ("driver core: Functional dependencies tracking support") +Cc: All applicable # All applicable +Tested-by: Xiang Chen +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/dd.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -1105,6 +1105,8 @@ static void __device_release_driver(stru + + drv = dev->driver; + if (drv) { ++ pm_runtime_get_sync(dev); ++ + while (device_links_busy(dev)) { + __device_driver_unlock(dev, parent); + +@@ -1116,12 +1118,12 @@ static void __device_release_driver(stru + * have released the driver successfully while this one + * was waiting, so check for that. + */ +- if (dev->driver != drv) ++ if (dev->driver != drv) { ++ pm_runtime_put(dev); + return; ++ } + } + +- pm_runtime_get_sync(dev); +- + driver_sysfs_remove(dev); + + if (dev->bus) diff --git a/queue-5.4/s390-pkey-fix-paes-selftest-failure-with-paes-and-pkey-static-build.patch b/queue-5.4/s390-pkey-fix-paes-selftest-failure-with-paes-and-pkey-static-build.patch new file mode 100644 index 00000000000..a616f8752a1 --- /dev/null +++ b/queue-5.4/s390-pkey-fix-paes-selftest-failure-with-paes-and-pkey-static-build.patch @@ -0,0 +1,104 @@ +From 5b35047eb467c8cdd38a31beb9ac109221777843 Mon Sep 17 00:00:00 2001 +From: Harald Freudenberger +Date: Tue, 15 Sep 2020 11:00:17 +0200 +Subject: s390/pkey: fix paes selftest failure with paes and pkey static build + +From: Harald Freudenberger + +commit 5b35047eb467c8cdd38a31beb9ac109221777843 upstream. + +When both the paes and the pkey kernel module are statically build +into the kernel, the paes cipher selftests run before the pkey +kernel module is initialized. So a static variable set in the pkey +init function and used in the pkey_clr2protkey function is not +initialized when the paes cipher's selftests request to call pckmo for +transforming a clear key value into a protected key. + +This patch moves the initial setup of the static variable into +the function pck_clr2protkey. So it's possible, to use the function +for transforming a clear to a protected key even before the pkey +init function has been called and the paes selftests may run +successful. + +Reported-by: Alexander Egorenkov +Cc: # 4.20 +Fixes: f822ad2c2c03 ("s390/pkey: move pckmo subfunction available checks away from module init") +Signed-off-by: Harald Freudenberger +Signed-off-by: Heiko Carstens +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/crypto/pkey_api.c | 30 ++++++++++++++++-------------- + 1 file changed, 16 insertions(+), 14 deletions(-) + +--- a/drivers/s390/crypto/pkey_api.c ++++ b/drivers/s390/crypto/pkey_api.c +@@ -33,9 +33,6 @@ MODULE_DESCRIPTION("s390 protected key i + #define KEYBLOBBUFSIZE 8192 /* key buffer size used for internal processing */ + #define MAXAPQNSINLIST 64 /* max 64 apqns within a apqn list */ + +-/* mask of available pckmo subfunctions, fetched once at module init */ +-static cpacf_mask_t pckmo_functions; +- + /* + * debug feature data and functions + */ +@@ -78,6 +75,9 @@ static int pkey_clr2protkey(u32 keytype, + const struct pkey_clrkey *clrkey, + struct pkey_protkey *protkey) + { ++ /* mask of available pckmo subfunctions */ ++ static cpacf_mask_t pckmo_functions; ++ + long fc; + int keysize; + u8 paramblock[64]; +@@ -101,11 +101,13 @@ static int pkey_clr2protkey(u32 keytype, + return -EINVAL; + } + +- /* +- * Check if the needed pckmo subfunction is available. +- * These subfunctions can be enabled/disabled by customers +- * in the LPAR profile or may even change on the fly. +- */ ++ /* Did we already check for PCKMO ? */ ++ if (!pckmo_functions.bytes[0]) { ++ /* no, so check now */ ++ if (!cpacf_query(CPACF_PCKMO, &pckmo_functions)) ++ return -ENODEV; ++ } ++ /* check for the pckmo subfunction we need now */ + if (!cpacf_test_func(&pckmo_functions, fc)) { + DEBUG_ERR("%s pckmo functions not available\n", __func__); + return -ENODEV; +@@ -1504,7 +1506,7 @@ static struct miscdevice pkey_dev = { + */ + static int __init pkey_init(void) + { +- cpacf_mask_t kmc_functions; ++ cpacf_mask_t func_mask; + + /* + * The pckmo instruction should be available - even if we don't +@@ -1512,15 +1514,15 @@ static int __init pkey_init(void) + * is also the minimum level for the kmc instructions which + * are able to work with protected keys. + */ +- if (!cpacf_query(CPACF_PCKMO, &pckmo_functions)) ++ if (!cpacf_query(CPACF_PCKMO, &func_mask)) + return -ENODEV; + + /* check for kmc instructions available */ +- if (!cpacf_query(CPACF_KMC, &kmc_functions)) ++ if (!cpacf_query(CPACF_KMC, &func_mask)) + return -ENODEV; +- if (!cpacf_test_func(&kmc_functions, CPACF_KMC_PAES_128) || +- !cpacf_test_func(&kmc_functions, CPACF_KMC_PAES_192) || +- !cpacf_test_func(&kmc_functions, CPACF_KMC_PAES_256)) ++ if (!cpacf_test_func(&func_mask, CPACF_KMC_PAES_128) || ++ !cpacf_test_func(&func_mask, CPACF_KMC_PAES_192) || ++ !cpacf_test_func(&func_mask, CPACF_KMC_PAES_256)) + return -ENODEV; + + pkey_debug_init(); diff --git a/queue-5.4/serial-8250_mtk-fix-uart_get_baud_rate-warning.patch b/queue-5.4/serial-8250_mtk-fix-uart_get_baud_rate-warning.patch new file mode 100644 index 00000000000..27d3cb3ce63 --- /dev/null +++ b/queue-5.4/serial-8250_mtk-fix-uart_get_baud_rate-warning.patch @@ -0,0 +1,38 @@ +From 912ab37c798770f21b182d656937072b58553378 Mon Sep 17 00:00:00 2001 +From: Claire Chang +Date: Mon, 2 Nov 2020 20:07:49 +0800 +Subject: serial: 8250_mtk: Fix uart_get_baud_rate warning + +From: Claire Chang + +commit 912ab37c798770f21b182d656937072b58553378 upstream. + +Mediatek 8250 port supports speed higher than uartclk / 16. If the baud +rates in both the new and the old termios setting are higher than +uartclk / 16, the WARN_ON in uart_get_baud_rate() will be triggered. +Passing NULL as the old termios so uart_get_baud_rate() will use +uartclk / 16 - 1 as the new baud rate which will be replaced by the +original baud rate later by tty_termios_encode_baud_rate() in +mtk8250_set_termios(). + +Fixes: 551e553f0d4a ("serial: 8250_mtk: Fix high-speed baud rates clamping") +Signed-off-by: Claire Chang +Link: https://lore.kernel.org/r/20201102120749.374458-1-tientzu@chromium.org +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/8250/8250_mtk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_mtk.c ++++ b/drivers/tty/serial/8250/8250_mtk.c +@@ -316,7 +316,7 @@ mtk8250_set_termios(struct uart_port *po + */ + baud = tty_termios_baud_rate(termios); + +- serial8250_do_set_termios(port, termios, old); ++ serial8250_do_set_termios(port, termios, NULL); + + tty_termios_encode_baud_rate(termios, baud, baud); + diff --git a/queue-5.4/serial-txx9-add-missing-platform_driver_unregister-on-error-in-serial_txx9_init.patch b/queue-5.4/serial-txx9-add-missing-platform_driver_unregister-on-error-in-serial_txx9_init.patch new file mode 100644 index 00000000000..59a7e209bc9 --- /dev/null +++ b/queue-5.4/serial-txx9-add-missing-platform_driver_unregister-on-error-in-serial_txx9_init.patch @@ -0,0 +1,36 @@ +From 0c5fc92622ed5531ff324b20f014e9e3092f0187 Mon Sep 17 00:00:00 2001 +From: Qinglang Miao +Date: Tue, 3 Nov 2020 16:49:42 +0800 +Subject: serial: txx9: add missing platform_driver_unregister() on error in serial_txx9_init + +From: Qinglang Miao + +commit 0c5fc92622ed5531ff324b20f014e9e3092f0187 upstream. + +Add the missing platform_driver_unregister() before return +from serial_txx9_init in the error handling case when failed +to register serial_txx9_pci_driver with macro ENABLE_SERIAL_TXX9_PCI +defined. + +Fixes: ab4382d27412 ("tty: move drivers/serial/ to drivers/tty/serial/") +Signed-off-by: Qinglang Miao +Link: https://lore.kernel.org/r/20201103084942.109076-1-miaoqinglang@huawei.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/serial_txx9.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/tty/serial/serial_txx9.c ++++ b/drivers/tty/serial/serial_txx9.c +@@ -1283,6 +1283,9 @@ static int __init serial_txx9_init(void) + + #ifdef ENABLE_SERIAL_TXX9_PCI + ret = pci_register_driver(&serial_txx9_pci_driver); ++ if (ret) { ++ platform_driver_unregister(&serial_txx9_plat_driver); ++ } + #endif + if (ret == 0) + goto out; diff --git a/queue-5.4/series b/queue-5.4/series index 85da4f514e0..a74bd3a7b96 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -62,3 +62,22 @@ drm-nouveau-gem-fix-refcount_t-underflow-use-after-f.patch arm64-smp-move-rcu_cpu_starting-earlier.patch revert-coresight-make-sysfs-functional-on-topologies.patch vt-disable-kd_font_op_copy.patch +fork-fix-copy_process-clone_parent-race-with-the-exiting-real_parent.patch +s390-pkey-fix-paes-selftest-failure-with-paes-and-pkey-static-build.patch +serial-8250_mtk-fix-uart_get_baud_rate-warning.patch +serial-txx9-add-missing-platform_driver_unregister-on-error-in-serial_txx9_init.patch +usb-serial-cyberjack-fix-write-urb-completion-race.patch +usb-serial-option-add-quectel-ec200t-module-support.patch +usb-serial-option-add-le910cx-compositions-0x1203-0x1230-0x1231.patch +usb-serial-option-add-telit-fn980-composition-0x1055.patch +tty-serial-fsl_lpuart-add-ls1028a-support.patch +tty-serial-fsl_lpuart-ls1021a-has-a-fifo-size-of-16-words-like-ls1028a.patch +usb-dwc3-ep0-fix-delay-status-handling.patch +usb-add-no_lpm-quirk-for-kingston-flash-drive.patch +usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch +drm-panfrost-fix-a-deadlock-between-the-shrinker-and-madvise-path.patch +arc-stack-unwinding-avoid-indefinite-looping.patch +pm-runtime-drop-runtime-pm-references-to-supplier-on-link-removal.patch +pm-runtime-drop-pm_runtime_clean_up_links.patch +pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch +xfs-flush-for-older-xfs-specific-ioctls.patch diff --git a/queue-5.4/tty-serial-fsl_lpuart-add-ls1028a-support.patch b/queue-5.4/tty-serial-fsl_lpuart-add-ls1028a-support.patch new file mode 100644 index 00000000000..28be880ea92 --- /dev/null +++ b/queue-5.4/tty-serial-fsl_lpuart-add-ls1028a-support.patch @@ -0,0 +1,88 @@ +From c2f448cff22a7ed09281f02bde084b0ce3bc61ed Mon Sep 17 00:00:00 2001 +From: Michael Walle +Date: Fri, 6 Mar 2020 22:44:32 +0100 +Subject: tty: serial: fsl_lpuart: add LS1028A support + +From: Michael Walle + +commit c2f448cff22a7ed09281f02bde084b0ce3bc61ed upstream. + +The LS1028A uses little endian register access and has a different FIFO +size encoding. + +Signed-off-by: Michael Walle +Link: https://lore.kernel.org/r/20200306214433.23215-4-michael@walle.cc +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/fsl_lpuart.c | 27 +++++++++++++++++++++++++-- + 1 file changed, 25 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -238,6 +238,7 @@ static DEFINE_IDA(fsl_lpuart_ida); + enum lpuart_type { + VF610_LPUART, + LS1021A_LPUART, ++ LS1028A_LPUART, + IMX7ULP_LPUART, + IMX8QXP_LPUART, + }; +@@ -282,11 +283,16 @@ static const struct lpuart_soc_data vf_d + .iotype = UPIO_MEM, + }; + +-static const struct lpuart_soc_data ls_data = { ++static const struct lpuart_soc_data ls1021a_data = { + .devtype = LS1021A_LPUART, + .iotype = UPIO_MEM32BE, + }; + ++static const struct lpuart_soc_data ls1028a_data = { ++ .devtype = LS1028A_LPUART, ++ .iotype = UPIO_MEM32, ++}; ++ + static struct lpuart_soc_data imx7ulp_data = { + .devtype = IMX7ULP_LPUART, + .iotype = UPIO_MEM32, +@@ -301,7 +307,8 @@ static struct lpuart_soc_data imx8qxp_da + + static const struct of_device_id lpuart_dt_ids[] = { + { .compatible = "fsl,vf610-lpuart", .data = &vf_data, }, +- { .compatible = "fsl,ls1021a-lpuart", .data = &ls_data, }, ++ { .compatible = "fsl,ls1021a-lpuart", .data = &ls1021a_data, }, ++ { .compatible = "fsl,ls1028a-lpuart", .data = &ls1028a_data, }, + { .compatible = "fsl,imx7ulp-lpuart", .data = &imx7ulp_data, }, + { .compatible = "fsl,imx8qxp-lpuart", .data = &imx8qxp_data, }, + { /* sentinel */ } +@@ -311,6 +318,11 @@ MODULE_DEVICE_TABLE(of, lpuart_dt_ids); + /* Forward declare this for the dma callbacks*/ + static void lpuart_dma_tx_complete(void *arg); + ++static inline bool is_ls1028a_lpuart(struct lpuart_port *sport) ++{ ++ return sport->devtype == LS1028A_LPUART; ++} ++ + static inline bool is_imx8qxp_lpuart(struct lpuart_port *sport) + { + return sport->devtype == IMX8QXP_LPUART; +@@ -1553,6 +1565,17 @@ static int lpuart32_startup(struct uart_ + sport->rxfifo_size = UARTFIFO_DEPTH((temp >> UARTFIFO_RXSIZE_OFF) & + UARTFIFO_FIFOSIZE_MASK); + ++ /* ++ * The LS1028A has a fixed length of 16 words. Although it supports the ++ * RX/TXSIZE fields their encoding is different. Eg the reference manual ++ * states 0b101 is 16 words. ++ */ ++ if (is_ls1028a_lpuart(sport)) { ++ sport->rxfifo_size = 16; ++ sport->txfifo_size = 16; ++ sport->port.fifosize = sport->txfifo_size; ++ } ++ + spin_lock_irqsave(&sport->port.lock, flags); + + lpuart32_setup_watermark_enable(sport); diff --git a/queue-5.4/tty-serial-fsl_lpuart-ls1021a-has-a-fifo-size-of-16-words-like-ls1028a.patch b/queue-5.4/tty-serial-fsl_lpuart-ls1021a-has-a-fifo-size-of-16-words-like-ls1028a.patch new file mode 100644 index 00000000000..4c7b0fd3f24 --- /dev/null +++ b/queue-5.4/tty-serial-fsl_lpuart-ls1021a-has-a-fifo-size-of-16-words-like-ls1028a.patch @@ -0,0 +1,86 @@ +From c97f2a6fb3dfbfbbc88edc8ea62ef2b944e18849 Mon Sep 17 00:00:00 2001 +From: Vladimir Oltean +Date: Fri, 23 Oct 2020 04:34:29 +0300 +Subject: tty: serial: fsl_lpuart: LS1021A has a FIFO size of 16 words, like LS1028A +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vladimir Oltean + +commit c97f2a6fb3dfbfbbc88edc8ea62ef2b944e18849 upstream. + +Prior to the commit that this one fixes, the FIFO size was derived from +the read-only register LPUARTx_FIFO[TXFIFOSIZE] using the following +formula: + +TX FIFO size = 2 ^ (LPUARTx_FIFO[TXFIFOSIZE] - 1) + +The documentation for LS1021A is a mess. Under chapter 26.1.3 LS1021A +LPUART module special consideration, it mentions TXFIFO_SZ and RXFIFO_SZ +being equal to 4, and in the register description for LPUARTx_FIFO, it +shows the out-of-reset value of TXFIFOSIZE and RXFIFOSIZE fields as "011", +even though these registers read as "101" in reality. + +And when LPUART on LS1021A was working, the "101" value did correspond +to "16 datawords", by applying the formula above, even though the +documentation is wrong again (!!!!) and says that "101" means 64 datawords +(hint: it doesn't). + +So the "new" formula created by commit f77ebb241ce0 has all the premises +of being wrong for LS1021A, because it relied only on false data and no +actual experimentation. + +Interestingly, in commit c2f448cff22a ("tty: serial: fsl_lpuart: add +LS1028A support"), Michael Walle applied a workaround to this by manually +setting the FIFO widths for LS1028A. It looks like the same values are +used by LS1021A as well, in fact. + +When the driver thinks that it has a deeper FIFO than it really has, +getty (user space) output gets truncated. + +Many thanks to Michael for pointing out where to look. + +Fixes: f77ebb241ce0 ("tty: serial: fsl_lpuart: correct the FIFO depth size") +Suggested-by: Michael Walle +Signed-off-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20201023013429.3551026-1-vladimir.oltean@nxp.com +Reviewed-by：Fugang Duan +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/fsl_lpuart.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -318,9 +318,10 @@ MODULE_DEVICE_TABLE(of, lpuart_dt_ids); + /* Forward declare this for the dma callbacks*/ + static void lpuart_dma_tx_complete(void *arg); + +-static inline bool is_ls1028a_lpuart(struct lpuart_port *sport) ++static inline bool is_layerscape_lpuart(struct lpuart_port *sport) + { +- return sport->devtype == LS1028A_LPUART; ++ return (sport->devtype == LS1021A_LPUART || ++ sport->devtype == LS1028A_LPUART); + } + + static inline bool is_imx8qxp_lpuart(struct lpuart_port *sport) +@@ -1566,11 +1567,11 @@ static int lpuart32_startup(struct uart_ + UARTFIFO_FIFOSIZE_MASK); + + /* +- * The LS1028A has a fixed length of 16 words. Although it supports the +- * RX/TXSIZE fields their encoding is different. Eg the reference manual +- * states 0b101 is 16 words. ++ * The LS1021A and LS1028A have a fixed FIFO depth of 16 words. ++ * Although they support the RX/TXSIZE fields, their encoding is ++ * different. Eg the reference manual states 0b101 is 16 words. + */ +- if (is_ls1028a_lpuart(sport)) { ++ if (is_layerscape_lpuart(sport)) { + sport->rxfifo_size = 16; + sport->txfifo_size = 16; + sport->port.fifosize = sport->txfifo_size; diff --git a/queue-5.4/usb-add-no_lpm-quirk-for-kingston-flash-drive.patch b/queue-5.4/usb-add-no_lpm-quirk-for-kingston-flash-drive.patch new file mode 100644 index 00000000000..f8b379d0d73 --- /dev/null +++ b/queue-5.4/usb-add-no_lpm-quirk-for-kingston-flash-drive.patch @@ -0,0 +1,39 @@ +From afaa2e745a246c5ab95103a65b1ed00101e1bc63 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 2 Nov 2020 09:58:21 -0500 +Subject: USB: Add NO_LPM quirk for Kingston flash drive + +From: Alan Stern + +commit afaa2e745a246c5ab95103a65b1ed00101e1bc63 upstream. + +In Bugzilla #208257, Julien Humbert reports that a 32-GB Kingston +flash drive spontaneously disconnects and reconnects, over and over. +Testing revealed that disabling Link Power Management for the drive +fixed the problem. + +This patch adds a quirk entry for that drive to turn off LPM permanently. + +CC: Hans de Goede +CC: +Reported-and-tested-by: Julien Humbert +Signed-off-by: Alan Stern +Link: https://lore.kernel.org/r/20201102145821.GA1478741@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -378,6 +378,9 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x0926, 0x3333), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + ++ /* Kingston DataTraveler 3.0 */ ++ { USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */ + { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF }, + diff --git a/queue-5.4/usb-dwc3-ep0-fix-delay-status-handling.patch b/queue-5.4/usb-dwc3-ep0-fix-delay-status-handling.patch new file mode 100644 index 00000000000..b28dab7ff80 --- /dev/null +++ b/queue-5.4/usb-dwc3-ep0-fix-delay-status-handling.patch @@ -0,0 +1,43 @@ +From fa27e2f6c5e674f3f1225f9ca7a7821faaf393bb Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Thu, 22 Oct 2020 15:44:59 -0700 +Subject: usb: dwc3: ep0: Fix delay status handling + +From: Thinh Nguyen + +commit fa27e2f6c5e674f3f1225f9ca7a7821faaf393bb upstream. + +If we want to send a control status on our own time (through +delayed_status), make sure to handle a case where we may queue the +delayed status before the host requesting for it (when XferNotReady +is generated). Otherwise, the driver won't send anything because it's +not EP0_STATUS_PHASE yet. To resolve this, regardless whether +dwc->ep0state is EP0_STATUS_PHASE, make sure to clear the +dwc->delayed_status flag if dwc3_ep0_send_delayed_status() is called. +The control status can be sent when the host requests it later. + +Cc: +Fixes: d97c78a1908e ("usb: dwc3: gadget: END_TRANSFER before CLEAR_STALL command") +Signed-off-by: Thinh Nguyen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/ep0.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/ep0.c ++++ b/drivers/usb/dwc3/ep0.c +@@ -1058,10 +1058,11 @@ void dwc3_ep0_send_delayed_status(struct + { + unsigned int direction = !dwc->ep0_expect_in; + ++ dwc->delayed_status = false; ++ + if (dwc->ep0state != EP0_STATUS_PHASE) + return; + +- dwc->delayed_status = false; + __dwc3_ep0_do_control_status(dwc, dwc->eps[direction]); + } + diff --git a/queue-5.4/usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch b/queue-5.4/usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch new file mode 100644 index 00000000000..9ae69e709b5 --- /dev/null +++ b/queue-5.4/usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch @@ -0,0 +1,71 @@ +From 20914919ad31849ee2b9cfe0428f4a20335c9e2a Mon Sep 17 00:00:00 2001 +From: Macpaul Lin +Date: Fri, 6 Nov 2020 13:54:29 +0800 +Subject: usb: mtu3: fix panic in mtu3_gadget_stop() + +From: Macpaul Lin + +commit 20914919ad31849ee2b9cfe0428f4a20335c9e2a upstream. + +This patch fixes a possible issue when mtu3_gadget_stop() +already assigned NULL to mtu->gadget_driver during mtu_gadget_disconnect(). + +[] notifier_call_chain+0xa4/0x128 +[] __atomic_notifier_call_chain+0x84/0x138 +[] notify_die+0xb0/0x120 +[] die+0x1f8/0x5d0 +[] __do_kernel_fault+0x19c/0x280 +[] do_bad_area+0x44/0x140 +[] do_translation_fault+0x4c/0x90 +[] do_mem_abort+0xb8/0x258 +[] el1_da+0x24/0x3c +[] mtu3_gadget_disconnect+0xac/0x128 +[] mtu3_irq+0x34c/0xc18 +[] __handle_irq_event_percpu+0x2ac/0xcd0 +[] handle_irq_event_percpu+0x80/0x138 +[] handle_irq_event+0xac/0x148 +[] handle_fasteoi_irq+0x234/0x568 +[] generic_handle_irq+0x48/0x68 +[] __handle_domain_irq+0x264/0x1740 +[] gic_handle_irq+0x14c/0x250 +[] el1_irq+0xec/0x194 +[] dma_pool_alloc+0x6e4/0xae0 +[] cmdq_mbox_pool_alloc_impl+0xb0/0x238 +[] cmdq_pkt_alloc_buf+0x2dc/0x7c0 +[] cmdq_pkt_add_cmd_buffer+0x178/0x270 +[] cmdq_pkt_perf_begin+0x108/0x148 +[] cmdq_pkt_create+0x178/0x1f0 +[] mtk_crtc_config_default_path+0x328/0x7a0 +[] mtk_drm_idlemgr_kick+0xa6c/0x1460 +[] mtk_drm_crtc_atomic_begin+0x1a4/0x1a68 +[] drm_atomic_helper_commit_planes+0x154/0x878 +[] mtk_atomic_complete.isra.16+0xe80/0x19c8 +[] mtk_atomic_commit+0x258/0x898 +[] drm_atomic_commit+0xcc/0x108 +[] drm_mode_atomic_ioctl+0x1c20/0x2580 +[] drm_ioctl_kernel+0x118/0x1b0 +[] drm_ioctl+0x5c0/0x920 +[] do_vfs_ioctl+0x188/0x1820 +[] SyS_ioctl+0x8c/0xa0 + +Fixes: df2069acb005 ("usb: Add MediaTek USB3 DRD driver") +Signed-off-by: Macpaul Lin +Acked-by: Chunfeng Yun +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/1604642069-20961-1-git-send-email-macpaul.lin@mediatek.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/mtu3/mtu3_gadget.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/mtu3/mtu3_gadget.c ++++ b/drivers/usb/mtu3/mtu3_gadget.c +@@ -587,6 +587,7 @@ static int mtu3_gadget_stop(struct usb_g + + spin_unlock_irqrestore(&mtu->lock, flags); + ++ synchronize_irq(mtu->irq); + return 0; + } + diff --git a/queue-5.4/usb-serial-cyberjack-fix-write-urb-completion-race.patch b/queue-5.4/usb-serial-cyberjack-fix-write-urb-completion-race.patch new file mode 100644 index 00000000000..a061e347ce9 --- /dev/null +++ b/queue-5.4/usb-serial-cyberjack-fix-write-urb-completion-race.patch @@ -0,0 +1,57 @@ +From 985616f0457d9f555fff417d0da56174f70cc14f Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 26 Oct 2020 09:25:48 +0100 +Subject: USB: serial: cyberjack: fix write-URB completion race + +From: Johan Hovold + +commit 985616f0457d9f555fff417d0da56174f70cc14f upstream. + +The write-URB busy flag was being cleared before the completion handler +was done with the URB, something which could lead to corrupt transfers +due to a racing write request if the URB is resubmitted. + +Fixes: 507ca9bc0476 ("[PATCH] USB: add ability for usb-serial drivers to determine if their write urb is currently being used.") +Cc: stable # 2.6.13 +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cyberjack.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/cyberjack.c ++++ b/drivers/usb/serial/cyberjack.c +@@ -357,11 +357,12 @@ static void cyberjack_write_bulk_callbac + struct device *dev = &port->dev; + int status = urb->status; + unsigned long flags; ++ bool resubmitted = false; + +- set_bit(0, &port->write_urbs_free); + if (status) { + dev_dbg(dev, "%s - nonzero write bulk status received: %d\n", + __func__, status); ++ set_bit(0, &port->write_urbs_free); + return; + } + +@@ -394,6 +395,8 @@ static void cyberjack_write_bulk_callbac + goto exit; + } + ++ resubmitted = true; ++ + dev_dbg(dev, "%s - priv->wrsent=%d\n", __func__, priv->wrsent); + dev_dbg(dev, "%s - priv->wrfilled=%d\n", __func__, priv->wrfilled); + +@@ -410,6 +413,8 @@ static void cyberjack_write_bulk_callbac + + exit: + spin_unlock_irqrestore(&priv->lock, flags); ++ if (!resubmitted) ++ set_bit(0, &port->write_urbs_free); + usb_serial_port_softint(port); + } + diff --git a/queue-5.4/usb-serial-option-add-le910cx-compositions-0x1203-0x1230-0x1231.patch b/queue-5.4/usb-serial-option-add-le910cx-compositions-0x1203-0x1230-0x1231.patch new file mode 100644 index 00000000000..9cad0460b41 --- /dev/null +++ b/queue-5.4/usb-serial-option-add-le910cx-compositions-0x1203-0x1230-0x1231.patch @@ -0,0 +1,48 @@ +From 489979b4aab490b6b917c11dc02d81b4b742784a Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Sat, 31 Oct 2020 23:54:58 +0100 +Subject: USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231 + +From: Daniele Palmas + +commit 489979b4aab490b6b917c11dc02d81b4b742784a upstream. + +Add following Telit LE910Cx compositions: + +0x1203: rndis, tty, adb, tty, tty, tty, tty +0x1230: tty, adb, rmnet, audio, tty, tty, tty, tty +0x1231: rndis, tty, adb, audio, tty, tty, tty, tty + +Signed-off-by: Daniele Palmas +Link: https://lore.kernel.org/r/20201031225458.10512-1-dnlplm@gmail.com +[ johan: add comments after entries ] +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1203,6 +1203,8 @@ static const struct usb_device_id option + .driver_info = NCTRL(0) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1203, 0xff), /* Telit LE910Cx (RNDIS) */ ++ .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), +@@ -1217,6 +1219,10 @@ static const struct usb_device_id option + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1230, 0xff), /* Telit LE910Cx (rmnet) */ ++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff), /* Telit LE910Cx (RNDIS) */ ++ .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x1260), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x1261), diff --git a/queue-5.4/usb-serial-option-add-quectel-ec200t-module-support.patch b/queue-5.4/usb-serial-option-add-quectel-ec200t-module-support.patch new file mode 100644 index 00000000000..d398d0a6184 --- /dev/null +++ b/queue-5.4/usb-serial-option-add-quectel-ec200t-module-support.patch @@ -0,0 +1,39 @@ +From a46b973bced1ba57420752bf38426acd9f6cbfa6 Mon Sep 17 00:00:00 2001 +From: Ziyi Cao +Date: Tue, 20 Oct 2020 00:08:06 +0800 +Subject: USB: serial: option: add Quectel EC200T module support + +From: Ziyi Cao + +commit a46b973bced1ba57420752bf38426acd9f6cbfa6 upstream. + +Add usb product id of the Quectel EC200T module. + +Signed-off-by: Ziyi Cao +Link: https://lore.kernel.org/r/17f8a2a3-ce0f-4be7-8544-8fdf286907d0@www.fastmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -250,6 +250,7 @@ static void option_instat_callback(struc + #define QUECTEL_PRODUCT_EP06 0x0306 + #define QUECTEL_PRODUCT_EM12 0x0512 + #define QUECTEL_PRODUCT_RM500Q 0x0800 ++#define QUECTEL_PRODUCT_EC200T 0x6026 + + #define CMOTECH_VENDOR_ID 0x16d8 + #define CMOTECH_PRODUCT_6001 0x6001 +@@ -1117,6 +1118,7 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10), + .driver_info = ZLP }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) }, + + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, diff --git a/queue-5.4/usb-serial-option-add-telit-fn980-composition-0x1055.patch b/queue-5.4/usb-serial-option-add-telit-fn980-composition-0x1055.patch new file mode 100644 index 00000000000..c7d40874ec4 --- /dev/null +++ b/queue-5.4/usb-serial-option-add-telit-fn980-composition-0x1055.patch @@ -0,0 +1,34 @@ +From db0362eeb22992502764e825c79b922d7467e0eb Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Tue, 3 Nov 2020 13:44:25 +0100 +Subject: USB: serial: option: add Telit FN980 composition 0x1055 + +From: Daniele Palmas + +commit db0362eeb22992502764e825c79b922d7467e0eb upstream. + +Add the following Telit FN980 composition: + +0x1055: tty, adb, tty, tty, tty, tty + +Signed-off-by: Daniele Palmas +Link: https://lore.kernel.org/r/20201103124425.12940-1-dnlplm@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1191,6 +1191,8 @@ static const struct usb_device_id option + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1054, 0xff), /* Telit FT980-KS */ + .driver_info = NCTRL(2) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1055, 0xff), /* Telit FN980 (PCIe) */ ++ .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), diff --git a/queue-5.4/xfs-flush-for-older-xfs-specific-ioctls.patch b/queue-5.4/xfs-flush-for-older-xfs-specific-ioctls.patch new file mode 100644 index 00000000000..962e90c5fc3 --- /dev/null +++ b/queue-5.4/xfs-flush-for-older-xfs-specific-ioctls.patch @@ -0,0 +1,71 @@ +From astroh@amazon.com Mon Nov 9 11:33:21 2020 +From: Andy Strohman +Date: Thu, 5 Nov 2020 20:28:50 +0000 +Subject: xfs: flush for older, xfs specific ioctls +To: +Cc: , , +Message-ID: <20201105202850.20216-1-astroh@amazon.com> + +From: Andy Strohman + +837a6e7f5cdb ("fs: add generic UNRESVSP and ZERO_RANGE ioctl handlers") changed +ioctls XFS_IOC_UNRESVSP XFS_IOC_UNRESVSP64 and XFS_IOC_ZERO_RANGE to be generic +instead of xfs specific. + +Because of this change, 36f11775da75 ("xfs: properly serialise fallocate against +AIO+DIO") needed adaptation, as 5.4 still uses the xfs specific ioctls. + +Without this, xfstests xfs/242 and xfs/290 fail. Both of these tests test +XFS_IOC_ZERO_RANGE. + +Fixes: 36f11775da75 ("xfs: properly serialise fallocate against AIO+DIO") +Tested-by: Andy Strohman +Signed-off-by: Darrick J. Wong +Reviewed-by: Darrick J. Wong +Signed-off-by: Greg Kroah-Hartman +--- + fs/xfs/xfs_ioctl.c | 26 +++++++++++++++++++++++++- + 1 file changed, 25 insertions(+), 1 deletion(-) + +--- a/fs/xfs/xfs_ioctl.c ++++ b/fs/xfs/xfs_ioctl.c +@@ -622,7 +622,6 @@ xfs_ioc_space( + error = xfs_break_layouts(inode, &iolock, BREAK_UNMAP); + if (error) + goto out_unlock; +- inode_dio_wait(inode); + + switch (bf->l_whence) { + case 0: /*SEEK_SET*/ +@@ -668,6 +667,31 @@ xfs_ioc_space( + goto out_unlock; + } + ++ /* ++ * Must wait for all AIO to complete before we continue as AIO can ++ * change the file size on completion without holding any locks we ++ * currently hold. We must do this first because AIO can update both ++ * the on disk and in memory inode sizes, and the operations that follow ++ * require the in-memory size to be fully up-to-date. ++ */ ++ inode_dio_wait(inode); ++ ++ /* ++ * Now that AIO and DIO has drained we can flush and (if necessary) ++ * invalidate the cached range over the first operation we are about to ++ * run. We include zero range here because it starts with a hole punch ++ * over the target range. ++ */ ++ switch (cmd) { ++ case XFS_IOC_ZERO_RANGE: ++ case XFS_IOC_UNRESVSP: ++ case XFS_IOC_UNRESVSP64: ++ error = xfs_flush_unmap_range(ip, bf->l_start, bf->l_len); ++ if (error) ++ goto out_unlock; ++ break; ++ } ++ + switch (cmd) { + case XFS_IOC_ZERO_RANGE: + flags |= XFS_PREALLOC_SET;