From 39b185e763fa6e1039b3ac73db3b3ca1ec4be133 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 23 Dec 2020 12:37:39 +0100 Subject: [PATCH] 5.10-stable patches added patches: arm-dts-exynos-fix-roles-of-usb-3.0-ports-on-odroid-xu.patch arm-dts-exynos-fix-usb-3.0-pins-supply-being-turned-off-on-odroid-xu.patch arm-dts-exynos-fix-usb-3.0-vbus-control-and-over-current-pins-on-exynos5410.patch coresight-etb10-fix-possible-null-ptr-dereference-in-etb_enable_perf.patch coresight-etm4x-fix-accesses-to-trccidctlr1.patch coresight-etm4x-fix-accesses-to-trcprocselr.patch coresight-etm4x-fix-accesses-to-trcvmidctlr1.patch coresight-etm4x-handle-trcvipcssctlr-accesses.patch coresight-etm4x-skip-setting-lpoverride-bit-for-qcom-skip-power-up.patch coresight-tmc-etf-fix-null-ptr-dereference-in-tmc_enable_etf_sink_perf.patch coresight-tmc-etr-check-if-page-is-valid-before-dma_map_page.patch coresight-tmc-etr-fix-barrier-packet-insertion-for-perf-buffer.patch exfat-avoid-allocating-upcase-table-using-kcalloc.patch soc-tegra-fuse-fix-index-bug-in-get_process_id.patch usb-chipidea-ci_hdrc_imx-pass-disable_device_streaming-flag-to-imx6ul.patch usb-gadget-f_acm-add-support-for-superspeed-plus.patch usb-gadget-f_fs-re-use-ss-descriptors-for-superspeedplus.patch usb-gadget-f_midi-setup-superspeed-plus-descriptors.patch usb-gadget-f_rndis-fix-bitrate-for-superspeed-and-above.patch usb-mtu3-fix-memory-corruption-in-mtu3_debugfs_regset.patch usb-serial-option-add-interface-number-sanity-check-to-flag-handling.patch x86-split-lock-avoid-returning-with-interrupts-enabled.patch --- ...-roles-of-usb-3.0-ports-on-odroid-xu.patch | 40 ++++++ ...supply-being-turned-off-on-odroid-xu.patch | 38 ++++++ ...-and-over-current-pins-on-exynos5410.patch | 89 +++++++++++++ ...l-ptr-dereference-in-etb_enable_perf.patch | 61 +++++++++ ...ht-etm4x-fix-accesses-to-trccidctlr1.patch | 56 +++++++++ ...ht-etm4x-fix-accesses-to-trcprocselr.patch | 57 +++++++++ ...t-etm4x-fix-accesses-to-trcvmidctlr1.patch | 56 +++++++++ ...-etm4x-handle-trcvipcssctlr-accesses.patch | 57 +++++++++ ...poverride-bit-for-qcom-skip-power-up.patch | 38 ++++++ ...eference-in-tmc_enable_etf_sink_perf.patch | 119 ++++++++++++++++++ ...if-page-is-valid-before-dma_map_page.patch | 58 +++++++++ ...ier-packet-insertion-for-perf-buffer.patch | 43 +++++++ ...llocating-upcase-table-using-kcalloc.patch | 80 ++++++++++++ queue-5.10/series | 22 ++++ ...fuse-fix-index-bug-in-get_process_id.patch | 33 +++++ ...able_device_streaming-flag-to-imx6ul.patch | 38 ++++++ ..._acm-add-support-for-superspeed-plus.patch | 35 ++++++ ...se-ss-descriptors-for-superspeedplus.patch | 68 ++++++++++ ...di-setup-superspeed-plus-descriptors.patch | 38 ++++++ ...fix-bitrate-for-superspeed-and-above.patch | 40 ++++++ ...ry-corruption-in-mtu3_debugfs_regset.patch | 33 +++++ ...number-sanity-check-to-flag-handling.patch | 85 +++++++++++++ ...id-returning-with-interrupts-enabled.patch | 49 ++++++++ 23 files changed, 1233 insertions(+) create mode 100644 queue-5.10/arm-dts-exynos-fix-roles-of-usb-3.0-ports-on-odroid-xu.patch create mode 100644 queue-5.10/arm-dts-exynos-fix-usb-3.0-pins-supply-being-turned-off-on-odroid-xu.patch create mode 100644 queue-5.10/arm-dts-exynos-fix-usb-3.0-vbus-control-and-over-current-pins-on-exynos5410.patch create mode 100644 queue-5.10/coresight-etb10-fix-possible-null-ptr-dereference-in-etb_enable_perf.patch create mode 100644 queue-5.10/coresight-etm4x-fix-accesses-to-trccidctlr1.patch create mode 100644 queue-5.10/coresight-etm4x-fix-accesses-to-trcprocselr.patch create mode 100644 queue-5.10/coresight-etm4x-fix-accesses-to-trcvmidctlr1.patch create mode 100644 queue-5.10/coresight-etm4x-handle-trcvipcssctlr-accesses.patch create mode 100644 queue-5.10/coresight-etm4x-skip-setting-lpoverride-bit-for-qcom-skip-power-up.patch create mode 100644 queue-5.10/coresight-tmc-etf-fix-null-ptr-dereference-in-tmc_enable_etf_sink_perf.patch create mode 100644 queue-5.10/coresight-tmc-etr-check-if-page-is-valid-before-dma_map_page.patch create mode 100644 queue-5.10/coresight-tmc-etr-fix-barrier-packet-insertion-for-perf-buffer.patch create mode 100644 queue-5.10/exfat-avoid-allocating-upcase-table-using-kcalloc.patch create mode 100644 queue-5.10/soc-tegra-fuse-fix-index-bug-in-get_process_id.patch create mode 100644 queue-5.10/usb-chipidea-ci_hdrc_imx-pass-disable_device_streaming-flag-to-imx6ul.patch create mode 100644 queue-5.10/usb-gadget-f_acm-add-support-for-superspeed-plus.patch create mode 100644 queue-5.10/usb-gadget-f_fs-re-use-ss-descriptors-for-superspeedplus.patch create mode 100644 queue-5.10/usb-gadget-f_midi-setup-superspeed-plus-descriptors.patch create mode 100644 queue-5.10/usb-gadget-f_rndis-fix-bitrate-for-superspeed-and-above.patch create mode 100644 queue-5.10/usb-mtu3-fix-memory-corruption-in-mtu3_debugfs_regset.patch create mode 100644 queue-5.10/usb-serial-option-add-interface-number-sanity-check-to-flag-handling.patch create mode 100644 queue-5.10/x86-split-lock-avoid-returning-with-interrupts-enabled.patch diff --git a/queue-5.10/arm-dts-exynos-fix-roles-of-usb-3.0-ports-on-odroid-xu.patch b/queue-5.10/arm-dts-exynos-fix-roles-of-usb-3.0-ports-on-odroid-xu.patch new file mode 100644 index 00000000000..21e13559c70 --- /dev/null +++ b/queue-5.10/arm-dts-exynos-fix-roles-of-usb-3.0-ports-on-odroid-xu.patch @@ -0,0 +1,40 @@ +From ecc1ff532b499d20304a4f682247137025814c34 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Thu, 15 Oct 2020 20:20:41 +0200 +Subject: ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU + +From: Krzysztof Kozlowski + +commit ecc1ff532b499d20304a4f682247137025814c34 upstream. + +On Odroid XU board the USB3-0 port is a microUSB and USB3-1 port is USB +type A (host). The roles were copied from Odroid XU3 (Exynos5422) +design which has it reversed. + +Fixes: 8149afe4dbf9 ("ARM: dts: exynos: Add initial support for Odroid XU board") +Signed-off-by: Krzysztof Kozlowski +Cc: +Link: https://lore.kernel.org/r/20201015182044.480562-1-krzk@kernel.org +Tested-by: Gabriel Ribba Esteva +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/exynos5410-odroidxu.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts ++++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts +@@ -637,11 +637,11 @@ + }; + + &usbdrd_dwc3_0 { +- dr_mode = "host"; ++ dr_mode = "peripheral"; + }; + + &usbdrd_dwc3_1 { +- dr_mode = "peripheral"; ++ dr_mode = "host"; + }; + + &usbdrd3_0 { diff --git a/queue-5.10/arm-dts-exynos-fix-usb-3.0-pins-supply-being-turned-off-on-odroid-xu.patch b/queue-5.10/arm-dts-exynos-fix-usb-3.0-pins-supply-being-turned-off-on-odroid-xu.patch new file mode 100644 index 00000000000..4c1ee37587b --- /dev/null +++ b/queue-5.10/arm-dts-exynos-fix-usb-3.0-pins-supply-being-turned-off-on-odroid-xu.patch @@ -0,0 +1,38 @@ +From bd7e7ff56feea7810df900fb09c9741d259861d9 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Thu, 15 Oct 2020 20:20:43 +0200 +Subject: ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU + +From: Krzysztof Kozlowski + +commit bd7e7ff56feea7810df900fb09c9741d259861d9 upstream. + +On Odroid XU LDO12 and LDO15 supplies the power to USB 3.0 blocks but +the GPK GPIO pins are supplied by LDO7 (VDDQ_LCD). LDO7 also supplies +GPJ GPIO pins. + +The Exynos pinctrl driver does not take any supplies, so to have entire +GPIO block always available, make the regulator always on. + +Fixes: 88644b4c750b ("ARM: dts: exynos: Configure PWM, usb3503, PMIC and thermal on Odroid XU board") +Signed-off-by: Krzysztof Kozlowski +Cc: +Link: https://lore.kernel.org/r/20201015182044.480562-3-krzk@kernel.org +Tested-by: Gabriel Ribba Esteva +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/exynos5410-odroidxu.dts | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts ++++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts +@@ -327,6 +327,8 @@ + regulator-name = "vddq_lcd"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; ++ /* Supplies also GPK and GPJ */ ++ regulator-always-on; + }; + + ldo8_reg: LDO8 { diff --git a/queue-5.10/arm-dts-exynos-fix-usb-3.0-vbus-control-and-over-current-pins-on-exynos5410.patch b/queue-5.10/arm-dts-exynos-fix-usb-3.0-vbus-control-and-over-current-pins-on-exynos5410.patch new file mode 100644 index 00000000000..708f2a0d65b --- /dev/null +++ b/queue-5.10/arm-dts-exynos-fix-usb-3.0-vbus-control-and-over-current-pins-on-exynos5410.patch @@ -0,0 +1,89 @@ +From 3d992fd8f4e0f09c980726308d2f2725587b32d6 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Thu, 15 Oct 2020 20:20:42 +0200 +Subject: ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410 + +From: Krzysztof Kozlowski + +commit 3d992fd8f4e0f09c980726308d2f2725587b32d6 upstream. + +The VBUS control (PWREN) and over-current pins of USB 3.0 DWC3 +controllers are on Exynos5410 regular GPIOs. This is different than for +example on Exynos5422 where these are special ETC pins with proper reset +values (pulls, functions). + +Therefore these pins should be configured to enable proper USB 3.0 +peripheral and host modes. This also fixes over-current warning: + + [ 6.024658] usb usb4-port1: over-current condition + [ 6.028271] usb usb3-port1: over-current condition + +Fixes: cb0896562228 ("ARM: dts: exynos: Add USB to Exynos5410") +Signed-off-by: Krzysztof Kozlowski +Cc: +Link: https://lore.kernel.org/r/20201015182044.480562-2-krzk@kernel.org +Tested-by: Gabriel Ribba Esteva +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/exynos5410-pinctrl.dtsi | 28 ++++++++++++++++++++++++++++ + arch/arm/boot/dts/exynos5410.dtsi | 4 ++++ + 2 files changed, 32 insertions(+) + +--- a/arch/arm/boot/dts/exynos5410-pinctrl.dtsi ++++ b/arch/arm/boot/dts/exynos5410-pinctrl.dtsi +@@ -560,6 +560,34 @@ + interrupt-controller; + #interrupt-cells = <2>; + }; ++ ++ usb3_1_oc: usb3-1-oc { ++ samsung,pins = "gpk2-4", "gpk2-5"; ++ samsung,pin-function = ; ++ samsung,pin-pud = ; ++ samsung,pin-drv = ; ++ }; ++ ++ usb3_1_vbusctrl: usb3-1-vbusctrl { ++ samsung,pins = "gpk2-6", "gpk2-7"; ++ samsung,pin-function = ; ++ samsung,pin-pud = ; ++ samsung,pin-drv = ; ++ }; ++ ++ usb3_0_oc: usb3-0-oc { ++ samsung,pins = "gpk3-0", "gpk3-1"; ++ samsung,pin-function = ; ++ samsung,pin-pud = ; ++ samsung,pin-drv = ; ++ }; ++ ++ usb3_0_vbusctrl: usb3-0-vbusctrl { ++ samsung,pins = "gpk3-2", "gpk3-3"; ++ samsung,pin-function = ; ++ samsung,pin-pud = ; ++ samsung,pin-drv = ; ++ }; + }; + + &pinctrl_2 { +--- a/arch/arm/boot/dts/exynos5410.dtsi ++++ b/arch/arm/boot/dts/exynos5410.dtsi +@@ -390,6 +390,8 @@ + &usbdrd3_0 { + clocks = <&clock CLK_USBD300>; + clock-names = "usbdrd30"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&usb3_0_oc>, <&usb3_0_vbusctrl>; + }; + + &usbdrd_phy0 { +@@ -401,6 +403,8 @@ + &usbdrd3_1 { + clocks = <&clock CLK_USBD301>; + clock-names = "usbdrd30"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&usb3_1_oc>, <&usb3_1_vbusctrl>; + }; + + &usbdrd_dwc3_1 { diff --git a/queue-5.10/coresight-etb10-fix-possible-null-ptr-dereference-in-etb_enable_perf.patch b/queue-5.10/coresight-etb10-fix-possible-null-ptr-dereference-in-etb_enable_perf.patch new file mode 100644 index 00000000000..869db52fa55 --- /dev/null +++ b/queue-5.10/coresight-etb10-fix-possible-null-ptr-dereference-in-etb_enable_perf.patch @@ -0,0 +1,61 @@ +From 22b2beaa7f166f550424cbb3b988aeaa7ef0425a Mon Sep 17 00:00:00 2001 +From: Sai Prakash Ranjan +Date: Fri, 27 Nov 2020 10:52:51 -0700 +Subject: coresight: etb10: Fix possible NULL ptr dereference in etb_enable_perf() + +From: Sai Prakash Ranjan + +commit 22b2beaa7f166f550424cbb3b988aeaa7ef0425a upstream. + +There was a report of NULL pointer dereference in ETF enable +path for perf CS mode with PID monitoring. It is almost 100% +reproducible when the process to monitor is something very +active such as chrome and with ETF as the sink, not ETR. + +But code path shows that ETB has a similar path as ETF, so +there could be possible NULL pointer dereference crash in +ETB as well. Currently in a bid to find the pid, the owner +is dereferenced via task_pid_nr() call in etb_enable_perf() +and with owner being NULL, we can get a NULL pointer +dereference, so have a similar fix as ETF where we cache PID +in alloc_buffer() callback which is called as the part of +etm_setup_aux(). + +Fixes: 75d7dbd38824 ("coresight: etb10: Add support for CPU-wide trace scenarios") +Cc: stable@vger.kernel.org +Signed-off-by: Sai Prakash Ranjan +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20201127175256.1092685-11-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/coresight/coresight-etb10.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/hwtracing/coresight/coresight-etb10.c ++++ b/drivers/hwtracing/coresight/coresight-etb10.c +@@ -176,6 +176,7 @@ static int etb_enable_perf(struct coresi + unsigned long flags; + struct etb_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent); + struct perf_output_handle *handle = data; ++ struct cs_buffers *buf = etm_perf_sink_config(handle); + + spin_lock_irqsave(&drvdata->spinlock, flags); + +@@ -186,7 +187,7 @@ static int etb_enable_perf(struct coresi + } + + /* Get a handle on the pid of the process to monitor */ +- pid = task_pid_nr(handle->event->owner); ++ pid = buf->pid; + + if (drvdata->pid != -1 && drvdata->pid != pid) { + ret = -EBUSY; +@@ -383,6 +384,7 @@ static void *etb_alloc_buffer(struct cor + if (!buf) + return NULL; + ++ buf->pid = task_pid_nr(event->owner); + buf->snapshot = overwrite; + buf->nr_pages = nr_pages; + buf->data_pages = pages; diff --git a/queue-5.10/coresight-etm4x-fix-accesses-to-trccidctlr1.patch b/queue-5.10/coresight-etm4x-fix-accesses-to-trccidctlr1.patch new file mode 100644 index 00000000000..62c8d5ae7bd --- /dev/null +++ b/queue-5.10/coresight-etm4x-fix-accesses-to-trccidctlr1.patch @@ -0,0 +1,56 @@ +From f2603b22e3d2dcffd8b0736e5c68df497af6bc84 Mon Sep 17 00:00:00 2001 +From: Suzuki K Poulose +Date: Fri, 27 Nov 2020 10:52:45 -0700 +Subject: coresight: etm4x: Fix accesses to TRCCIDCTLR1 + +From: Suzuki K Poulose + +commit f2603b22e3d2dcffd8b0736e5c68df497af6bc84 upstream. + +The TRCCIDCTLR1 is only implemented if TRCIDR4.NUMCIDC > 4. +Don't touch the register if it is not implemented. + +Cc: stable@vger.kernel.org +Cc: Mathieu Poirier +Cc: Mike Leach +Signed-off-by: Suzuki K Poulose +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20201127175256.1092685-5-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/coresight/coresight-etm4x-core.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -187,7 +187,8 @@ static int etm4_enable_hw(struct etmv4_d + writeq_relaxed(config->ctxid_pid[i], + drvdata->base + TRCCIDCVRn(i)); + writel_relaxed(config->ctxid_mask0, drvdata->base + TRCCIDCCTLR0); +- writel_relaxed(config->ctxid_mask1, drvdata->base + TRCCIDCCTLR1); ++ if (drvdata->numcidc > 4) ++ writel_relaxed(config->ctxid_mask1, drvdata->base + TRCCIDCCTLR1); + + for (i = 0; i < drvdata->numvmidc; i++) + writeq_relaxed(config->vmid_val[i], +@@ -1241,7 +1242,8 @@ static int etm4_cpu_save(struct etmv4_dr + state->trcvmidcvr[i] = readq(drvdata->base + TRCVMIDCVRn(i)); + + state->trccidcctlr0 = readl(drvdata->base + TRCCIDCCTLR0); +- state->trccidcctlr1 = readl(drvdata->base + TRCCIDCCTLR1); ++ if (drvdata->numcidc > 4) ++ state->trccidcctlr1 = readl(drvdata->base + TRCCIDCCTLR1); + + state->trcvmidcctlr0 = readl(drvdata->base + TRCVMIDCCTLR0); + if (drvdata->numvmidc > 4) +@@ -1352,7 +1354,8 @@ static void etm4_cpu_restore(struct etmv + drvdata->base + TRCVMIDCVRn(i)); + + writel_relaxed(state->trccidcctlr0, drvdata->base + TRCCIDCCTLR0); +- writel_relaxed(state->trccidcctlr1, drvdata->base + TRCCIDCCTLR1); ++ if (drvdata->numcidc > 4) ++ writel_relaxed(state->trccidcctlr1, drvdata->base + TRCCIDCCTLR1); + + writel_relaxed(state->trcvmidcctlr0, drvdata->base + TRCVMIDCCTLR0); + if (drvdata->numvmidc > 4) diff --git a/queue-5.10/coresight-etm4x-fix-accesses-to-trcprocselr.patch b/queue-5.10/coresight-etm4x-fix-accesses-to-trcprocselr.patch new file mode 100644 index 00000000000..70c9bcba167 --- /dev/null +++ b/queue-5.10/coresight-etm4x-fix-accesses-to-trcprocselr.patch @@ -0,0 +1,57 @@ +From 6288b4ceca868eac4bf729532f8d845e3ecbed98 Mon Sep 17 00:00:00 2001 +From: Suzuki K Poulose +Date: Fri, 27 Nov 2020 10:52:47 -0700 +Subject: coresight: etm4x: Fix accesses to TRCPROCSELR + +From: Suzuki K Poulose + +commit 6288b4ceca868eac4bf729532f8d845e3ecbed98 upstream. + +TRCPROCSELR is not implemented if the TRCIDR3.NUMPROC == 0. Skip +accessing the register in such cases. + +Cc: stable@vger.kernel.org +Cc: Mathieu Poirier +Cc: Mike Leach +Signed-off-by: Suzuki K Poulose +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20201127175256.1092685-7-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/coresight/coresight-etm4x-core.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -124,8 +124,8 @@ static int etm4_enable_hw(struct etmv4_d + if (coresight_timeout(drvdata->base, TRCSTATR, TRCSTATR_IDLE_BIT, 1)) + dev_err(etm_dev, + "timeout while waiting for Idle Trace Status\n"); +- +- writel_relaxed(config->pe_sel, drvdata->base + TRCPROCSELR); ++ if (drvdata->nr_pe) ++ writel_relaxed(config->pe_sel, drvdata->base + TRCPROCSELR); + writel_relaxed(config->cfg, drvdata->base + TRCCONFIGR); + /* nothing specific implemented */ + writel_relaxed(0x0, drvdata->base + TRCAUXCTLR); +@@ -1180,7 +1180,8 @@ static int etm4_cpu_save(struct etmv4_dr + state = drvdata->save_state; + + state->trcprgctlr = readl(drvdata->base + TRCPRGCTLR); +- state->trcprocselr = readl(drvdata->base + TRCPROCSELR); ++ if (drvdata->nr_pe) ++ state->trcprocselr = readl(drvdata->base + TRCPROCSELR); + state->trcconfigr = readl(drvdata->base + TRCCONFIGR); + state->trcauxctlr = readl(drvdata->base + TRCAUXCTLR); + state->trceventctl0r = readl(drvdata->base + TRCEVENTCTL0R); +@@ -1287,7 +1288,8 @@ static void etm4_cpu_restore(struct etmv + writel_relaxed(state->trcclaimset, drvdata->base + TRCCLAIMSET); + + writel_relaxed(state->trcprgctlr, drvdata->base + TRCPRGCTLR); +- writel_relaxed(state->trcprocselr, drvdata->base + TRCPROCSELR); ++ if (drvdata->nr_pe) ++ writel_relaxed(state->trcprocselr, drvdata->base + TRCPROCSELR); + writel_relaxed(state->trcconfigr, drvdata->base + TRCCONFIGR); + writel_relaxed(state->trcauxctlr, drvdata->base + TRCAUXCTLR); + writel_relaxed(state->trceventctl0r, drvdata->base + TRCEVENTCTL0R); diff --git a/queue-5.10/coresight-etm4x-fix-accesses-to-trcvmidctlr1.patch b/queue-5.10/coresight-etm4x-fix-accesses-to-trcvmidctlr1.patch new file mode 100644 index 00000000000..21f1a4876bf --- /dev/null +++ b/queue-5.10/coresight-etm4x-fix-accesses-to-trcvmidctlr1.patch @@ -0,0 +1,56 @@ +From 93dd64404cbe63b0afba371acd8db36e84b286c7 Mon Sep 17 00:00:00 2001 +From: Suzuki K Poulose +Date: Fri, 27 Nov 2020 10:52:44 -0700 +Subject: coresight: etm4x: Fix accesses to TRCVMIDCTLR1 + +From: Suzuki K Poulose + +commit 93dd64404cbe63b0afba371acd8db36e84b286c7 upstream. + +TRCVMIDCTRL1 is only implemented only if the TRCIDR4.NUMVMIDC > 4. +We must not touch the register otherwise. + +Cc: stable@vger.kernel.org +Cc: Mathieu Poirier +Cc: Mike Leach +Signed-off-by: Suzuki K Poulose +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20201127175256.1092685-4-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/coresight/coresight-etm4x-core.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -193,7 +193,8 @@ static int etm4_enable_hw(struct etmv4_d + writeq_relaxed(config->vmid_val[i], + drvdata->base + TRCVMIDCVRn(i)); + writel_relaxed(config->vmid_mask0, drvdata->base + TRCVMIDCCTLR0); +- writel_relaxed(config->vmid_mask1, drvdata->base + TRCVMIDCCTLR1); ++ if (drvdata->numvmidc > 4) ++ writel_relaxed(config->vmid_mask1, drvdata->base + TRCVMIDCCTLR1); + + if (!drvdata->skip_power_up) { + /* +@@ -1243,7 +1244,8 @@ static int etm4_cpu_save(struct etmv4_dr + state->trccidcctlr1 = readl(drvdata->base + TRCCIDCCTLR1); + + state->trcvmidcctlr0 = readl(drvdata->base + TRCVMIDCCTLR0); +- state->trcvmidcctlr1 = readl(drvdata->base + TRCVMIDCCTLR1); ++ if (drvdata->numvmidc > 4) ++ state->trcvmidcctlr1 = readl(drvdata->base + TRCVMIDCCTLR1); + + state->trcclaimset = readl(drvdata->base + TRCCLAIMCLR); + +@@ -1353,7 +1355,8 @@ static void etm4_cpu_restore(struct etmv + writel_relaxed(state->trccidcctlr1, drvdata->base + TRCCIDCCTLR1); + + writel_relaxed(state->trcvmidcctlr0, drvdata->base + TRCVMIDCCTLR0); +- writel_relaxed(state->trcvmidcctlr1, drvdata->base + TRCVMIDCCTLR1); ++ if (drvdata->numvmidc > 4) ++ writel_relaxed(state->trcvmidcctlr1, drvdata->base + TRCVMIDCCTLR1); + + writel_relaxed(state->trcclaimset, drvdata->base + TRCCLAIMSET); + diff --git a/queue-5.10/coresight-etm4x-handle-trcvipcssctlr-accesses.patch b/queue-5.10/coresight-etm4x-handle-trcvipcssctlr-accesses.patch new file mode 100644 index 00000000000..da0bc3d9950 --- /dev/null +++ b/queue-5.10/coresight-etm4x-handle-trcvipcssctlr-accesses.patch @@ -0,0 +1,57 @@ +From 60c519c5d3629c21ba356782434d5b612d312de4 Mon Sep 17 00:00:00 2001 +From: Suzuki K Poulose +Date: Fri, 27 Nov 2020 10:52:48 -0700 +Subject: coresight: etm4x: Handle TRCVIPCSSCTLR accesses + +From: Suzuki K Poulose + +commit 60c519c5d3629c21ba356782434d5b612d312de4 upstream. + +TRCVIPCSSCTLR is not present if the TRCIDR4.NUMPC > 0. Thus we +should only access the register if it is present, preventing +any undesired behavior. + +Cc: stable@vger.kernel.org +Signed-off-by: Suzuki K Poulose +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20201127175256.1092685-8-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/coresight/coresight-etm4x-core.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -141,8 +141,9 @@ static int etm4_enable_hw(struct etmv4_d + writel_relaxed(config->viiectlr, drvdata->base + TRCVIIECTLR); + writel_relaxed(config->vissctlr, + drvdata->base + TRCVISSCTLR); +- writel_relaxed(config->vipcssctlr, +- drvdata->base + TRCVIPCSSCTLR); ++ if (drvdata->nr_pe_cmp) ++ writel_relaxed(config->vipcssctlr, ++ drvdata->base + TRCVIPCSSCTLR); + for (i = 0; i < drvdata->nrseqstate - 1; i++) + writel_relaxed(config->seq_ctrl[i], + drvdata->base + TRCSEQEVRn(i)); +@@ -1197,7 +1198,8 @@ static int etm4_cpu_save(struct etmv4_dr + state->trcvictlr = readl(drvdata->base + TRCVICTLR); + state->trcviiectlr = readl(drvdata->base + TRCVIIECTLR); + state->trcvissctlr = readl(drvdata->base + TRCVISSCTLR); +- state->trcvipcssctlr = readl(drvdata->base + TRCVIPCSSCTLR); ++ if (drvdata->nr_pe_cmp) ++ state->trcvipcssctlr = readl(drvdata->base + TRCVIPCSSCTLR); + state->trcvdctlr = readl(drvdata->base + TRCVDCTLR); + state->trcvdsacctlr = readl(drvdata->base + TRCVDSACCTLR); + state->trcvdarcctlr = readl(drvdata->base + TRCVDARCCTLR); +@@ -1305,7 +1307,8 @@ static void etm4_cpu_restore(struct etmv + writel_relaxed(state->trcvictlr, drvdata->base + TRCVICTLR); + writel_relaxed(state->trcviiectlr, drvdata->base + TRCVIIECTLR); + writel_relaxed(state->trcvissctlr, drvdata->base + TRCVISSCTLR); +- writel_relaxed(state->trcvipcssctlr, drvdata->base + TRCVIPCSSCTLR); ++ if (drvdata->nr_pe_cmp) ++ writel_relaxed(state->trcvipcssctlr, drvdata->base + TRCVIPCSSCTLR); + writel_relaxed(state->trcvdctlr, drvdata->base + TRCVDCTLR); + writel_relaxed(state->trcvdsacctlr, drvdata->base + TRCVDSACCTLR); + writel_relaxed(state->trcvdarcctlr, drvdata->base + TRCVDARCCTLR); diff --git a/queue-5.10/coresight-etm4x-skip-setting-lpoverride-bit-for-qcom-skip-power-up.patch b/queue-5.10/coresight-etm4x-skip-setting-lpoverride-bit-for-qcom-skip-power-up.patch new file mode 100644 index 00000000000..4d0f256821e --- /dev/null +++ b/queue-5.10/coresight-etm4x-skip-setting-lpoverride-bit-for-qcom-skip-power-up.patch @@ -0,0 +1,38 @@ +From ac0f82b1b4956e348a6b2de8104308144ffb6ef7 Mon Sep 17 00:00:00 2001 +From: Sai Prakash Ranjan +Date: Fri, 27 Nov 2020 10:52:42 -0700 +Subject: coresight: etm4x: Skip setting LPOVERRIDE bit for qcom, skip-power-up + +From: Sai Prakash Ranjan + +commit ac0f82b1b4956e348a6b2de8104308144ffb6ef7 upstream. + +There is a bug on the systems supporting to skip power up +(qcom,skip-power-up) where setting LPOVERRIDE bit(low-power +state override behaviour) will result in CPU hangs/lockups +even on the implementations which supports it. So skip +setting the LPOVERRIDE bit for such platforms. + +Fixes: 02510a5aa78d ("coresight: etm4x: Add support to skip trace unit power up") +Cc: stable@vger.kernel.org +Reviewed-by: Suzuki K Poulose +Signed-off-by: Sai Prakash Ranjan +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20201127175256.1092685-2-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/coresight/coresight-etm4x-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -779,7 +779,7 @@ static void etm4_init_arch_data(void *in + * LPOVERRIDE, bit[23] implementation supports + * low-power state override + */ +- if (BMVAL(etmidr5, 23, 23)) ++ if (BMVAL(etmidr5, 23, 23) && (!drvdata->skip_power_up)) + drvdata->lpoverride = true; + else + drvdata->lpoverride = false; diff --git a/queue-5.10/coresight-tmc-etf-fix-null-ptr-dereference-in-tmc_enable_etf_sink_perf.patch b/queue-5.10/coresight-tmc-etf-fix-null-ptr-dereference-in-tmc_enable_etf_sink_perf.patch new file mode 100644 index 00000000000..ddbfdb7506c --- /dev/null +++ b/queue-5.10/coresight-tmc-etf-fix-null-ptr-dereference-in-tmc_enable_etf_sink_perf.patch @@ -0,0 +1,119 @@ +From 868663dd5d69fef05bfb004f91da5c30e9b93461 Mon Sep 17 00:00:00 2001 +From: Sai Prakash Ranjan +Date: Fri, 27 Nov 2020 10:52:50 -0700 +Subject: coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf() + +From: Sai Prakash Ranjan + +commit 868663dd5d69fef05bfb004f91da5c30e9b93461 upstream. + +There was a report of NULL pointer dereference in ETF enable +path for perf CS mode with PID monitoring. It is almost 100% +reproducible when the process to monitor is something very +active such as chrome and with ETF as the sink and not ETR. +Currently in a bid to find the pid, the owner is dereferenced +via task_pid_nr() call in tmc_enable_etf_sink_perf() and with +owner being NULL, we get a NULL pointer dereference. + +Looking at the ETR and other places in the kernel, ETF and the +ETB are the only places trying to dereference the task(owner) +in tmc_enable_etf_sink_perf() which is also called from the +sched_in path as in the call trace. Owner(task) is NULL even +in the case of ETR in tmc_enable_etr_sink_perf(), but since we +cache the PID in alloc_buffer() callback and it is done as part +of etm_setup_aux() when allocating buffer for ETR sink, we never +dereference this NULL pointer and we are safe. So lets do the +same thing with ETF and cache the PID to which the cs_buffer +belongs in tmc_alloc_etf_buffer() as done for ETR. This will +also remove the unnecessary function calls(task_pid_nr()) since +we are caching the PID. + +Easily reproducible running below: + + perf record -e cs_etm/@tmc_etf0/ -N -p + +Unable to handle kernel NULL pointer dereference at virtual address 0000000000000548 +Mem abort info: + ESR = 0x96000006 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 +Data abort info: + ISV = 0, ISS = 0x00000006 + CM = 0, WnR = 0 +... +Call trace: + tmc_enable_etf_sink+0xe4/0x280 + coresight_enable_path+0x168/0x1fc + etm_event_start+0x8c/0xf8 + etm_event_add+0x38/0x54 + event_sched_in+0x194/0x2ac + group_sched_in+0x54/0x12c + flexible_sched_in+0xd8/0x120 + visit_groups_merge+0x100/0x16c + ctx_flexible_sched_in+0x50/0x74 + ctx_sched_in+0xa4/0xa8 + perf_event_sched_in+0x60/0x6c + perf_event_context_sched_in+0x98/0xe0 + __perf_event_task_sched_in+0x5c/0xd8 + finish_task_switch+0x184/0x1cc + schedule_tail+0x20/0xec + ret_from_fork+0x4/0x18 + +Fixes: 880af782c6e8 ("coresight: tmc-etf: Add support for CPU-wide trace scenarios") +Cc: stable@vger.kernel.org +Signed-off-by: Sai Prakash Ranjan +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20201127175256.1092685-10-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/coresight/coresight-priv.h | 2 ++ + drivers/hwtracing/coresight/coresight-tmc-etf.c | 4 +++- + 2 files changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/hwtracing/coresight/coresight-priv.h ++++ b/drivers/hwtracing/coresight/coresight-priv.h +@@ -87,6 +87,7 @@ enum cs_mode { + * struct cs_buffer - keep track of a recording session' specifics + * @cur: index of the current buffer + * @nr_pages: max number of pages granted to us ++ * @pid: PID this cs_buffer belongs to + * @offset: offset within the current buffer + * @data_size: how much we collected in this run + * @snapshot: is this run in snapshot mode +@@ -95,6 +96,7 @@ enum cs_mode { + struct cs_buffers { + unsigned int cur; + unsigned int nr_pages; ++ pid_t pid; + unsigned long offset; + local_t data_size; + bool snapshot; +--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c +@@ -227,6 +227,7 @@ static int tmc_enable_etf_sink_perf(stru + unsigned long flags; + struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent); + struct perf_output_handle *handle = data; ++ struct cs_buffers *buf = etm_perf_sink_config(handle); + + spin_lock_irqsave(&drvdata->spinlock, flags); + do { +@@ -243,7 +244,7 @@ static int tmc_enable_etf_sink_perf(stru + } + + /* Get a handle on the pid of the process to monitor */ +- pid = task_pid_nr(handle->event->owner); ++ pid = buf->pid; + + if (drvdata->pid != -1 && drvdata->pid != pid) { + ret = -EBUSY; +@@ -399,6 +400,7 @@ static void *tmc_alloc_etf_buffer(struct + if (!buf) + return NULL; + ++ buf->pid = task_pid_nr(event->owner); + buf->snapshot = overwrite; + buf->nr_pages = nr_pages; + buf->data_pages = pages; diff --git a/queue-5.10/coresight-tmc-etr-check-if-page-is-valid-before-dma_map_page.patch b/queue-5.10/coresight-tmc-etr-check-if-page-is-valid-before-dma_map_page.patch new file mode 100644 index 00000000000..05605dfb7f5 --- /dev/null +++ b/queue-5.10/coresight-tmc-etr-check-if-page-is-valid-before-dma_map_page.patch @@ -0,0 +1,58 @@ +From 1cc573d5754e92372a7e30e35468644f8811e1a4 Mon Sep 17 00:00:00 2001 +From: Mao Jinlong +Date: Fri, 27 Nov 2020 10:52:53 -0700 +Subject: coresight: tmc-etr: Check if page is valid before dma_map_page() + +From: Mao Jinlong + +commit 1cc573d5754e92372a7e30e35468644f8811e1a4 upstream. + +alloc_pages_node() return should be checked before calling +dma_map_page() to make sure that valid page is mapped or +else it can lead to aborts as below: + + Unable to handle kernel paging request at virtual address ffffffc008000000 + Mem abort info: + ... + pc : __dma_inv_area+0x40/0x58 + lr : dma_direct_map_page+0xd8/0x1c8 + + Call trace: + __dma_inv_area + tmc_pages_alloc + tmc_alloc_data_pages + tmc_alloc_sg_table + tmc_init_etr_sg_table + tmc_alloc_etr_buf + tmc_enable_etr_sink_sysfs + tmc_enable_etr_sink + coresight_enable_path + coresight_enable + enable_source_store + dev_attr_store + sysfs_kf_write + +Fixes: 99443ea19e8b ("coresight: Add generic TMC sg table framework") +Cc: stable@vger.kernel.org +Reviewed-by: Suzuki K Poulose +Signed-off-by: Mao Jinlong +Signed-off-by: Sai Prakash Ranjan +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20201127175256.1092685-13-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c +@@ -217,6 +217,8 @@ static int tmc_pages_alloc(struct tmc_pa + } else { + page = alloc_pages_node(node, + GFP_KERNEL | __GFP_ZERO, 0); ++ if (!page) ++ goto err; + } + paddr = dma_map_page(real_dev, page, 0, PAGE_SIZE, dir); + if (dma_mapping_error(real_dev, paddr)) diff --git a/queue-5.10/coresight-tmc-etr-fix-barrier-packet-insertion-for-perf-buffer.patch b/queue-5.10/coresight-tmc-etr-fix-barrier-packet-insertion-for-perf-buffer.patch new file mode 100644 index 00000000000..aba9dcf8c3f --- /dev/null +++ b/queue-5.10/coresight-tmc-etr-fix-barrier-packet-insertion-for-perf-buffer.patch @@ -0,0 +1,43 @@ +From 83be0b84fe846edf0c722fefe225482d5f0d7395 Mon Sep 17 00:00:00 2001 +From: Suzuki K Poulose +Date: Tue, 8 Dec 2020 11:26:49 -0700 +Subject: coresight: tmc-etr: Fix barrier packet insertion for perf buffer + +From: Suzuki K Poulose + +commit 83be0b84fe846edf0c722fefe225482d5f0d7395 upstream. + +When the ETR is used in perf mode with a larger buffer (configured +via sysfs or the default size of 1M) than the perf aux buffer size, +we end up inserting the barrier packet at the wrong offset, while +moving the offset forward. i.e, instead of the "new moved offset", +we insert it at the current hardware buffer offset. These packets +will not be visible as they are never copied and could lead to +corruption in the trace decoding side, as the decoder is not aware +that it needs to reset the decoding. + +Fixes: ec13c78d7b45 ("coresight: tmc-etr: Add barrier packets when moving offset forward") +Cc: Mathieu Poirier +Cc: stable@vger.kernel.org +Reported-by: Al Grant +Tested-by: Mike Leach +Signed-off-by: Suzuki K Poulose +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20201208182651.1597945-2-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c +@@ -1552,7 +1552,7 @@ tmc_update_etr_buffer(struct coresight_d + + /* Insert barrier packets at the beginning, if there was an overflow */ + if (lost) +- tmc_etr_buf_insert_barrier_packet(etr_buf, etr_buf->offset); ++ tmc_etr_buf_insert_barrier_packet(etr_buf, offset); + tmc_etr_sync_perf_buffer(etr_perf, offset, size); + + /* diff --git a/queue-5.10/exfat-avoid-allocating-upcase-table-using-kcalloc.patch b/queue-5.10/exfat-avoid-allocating-upcase-table-using-kcalloc.patch new file mode 100644 index 00000000000..b9bf6d8eba0 --- /dev/null +++ b/queue-5.10/exfat-avoid-allocating-upcase-table-using-kcalloc.patch @@ -0,0 +1,80 @@ +From 9eb78c25327548b905598975aa3ded4ef244b94a Mon Sep 17 00:00:00 2001 +From: Artem Labazov <123321artyom@gmail.com> +Date: Mon, 7 Dec 2020 09:04:36 +0900 +Subject: exfat: Avoid allocating upcase table using kcalloc() + +From: Artem Labazov <123321artyom@gmail.com> + +commit 9eb78c25327548b905598975aa3ded4ef244b94a upstream. + +The table for Unicode upcase conversion requires an order-5 allocation, +which may fail on a highly-fragmented system: + + pool-udisksd: page allocation failure: order:5, + mode:0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), nodemask=(null), + cpuset=/,mems_allowed=0 + CPU: 4 PID: 3756880 Comm: pool-udisksd Tainted: G U + 5.8.10-200.fc32.x86_64 #1 + Hardware name: Dell Inc. XPS 13 9360/0PVG6D, BIOS 2.13.0 11/14/2019 + Call Trace: + dump_stack+0x6b/0x88 + warn_alloc.cold+0x75/0xd9 + ? _cond_resched+0x16/0x40 + ? __alloc_pages_direct_compact+0x144/0x150 + __alloc_pages_slowpath.constprop.0+0xcfa/0xd30 + ? __schedule+0x28a/0x840 + ? __wait_on_bit_lock+0x92/0xa0 + __alloc_pages_nodemask+0x2df/0x320 + kmalloc_order+0x1b/0x80 + kmalloc_order_trace+0x1d/0xa0 + exfat_create_upcase_table+0x115/0x390 [exfat] + exfat_fill_super+0x3ef/0x7f0 [exfat] + ? sget_fc+0x1d0/0x240 + ? exfat_init_fs_context+0x120/0x120 [exfat] + get_tree_bdev+0x15c/0x250 + vfs_get_tree+0x25/0xb0 + do_mount+0x7c3/0xaf0 + ? copy_mount_options+0xab/0x180 + __x64_sys_mount+0x8e/0xd0 + do_syscall_64+0x4d/0x90 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Make the driver use kvcalloc() to eliminate the issue. + +Fixes: 370e812b3ec1 ("exfat: add nls operations") +Cc: stable@vger.kernel.org #v5.7+ +Signed-off-by: Artem Labazov <123321artyom@gmail.com> +Signed-off-by: Namjae Jeon +Signed-off-by: Greg Kroah-Hartman + +--- + fs/exfat/nls.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/exfat/nls.c ++++ b/fs/exfat/nls.c +@@ -659,7 +659,7 @@ static int exfat_load_upcase_table(struc + unsigned char skip = false; + unsigned short *upcase_table; + +- upcase_table = kcalloc(UTBL_COUNT, sizeof(unsigned short), GFP_KERNEL); ++ upcase_table = kvcalloc(UTBL_COUNT, sizeof(unsigned short), GFP_KERNEL); + if (!upcase_table) + return -ENOMEM; + +@@ -715,7 +715,7 @@ static int exfat_load_default_upcase_tab + unsigned short uni = 0, *upcase_table; + unsigned int index = 0; + +- upcase_table = kcalloc(UTBL_COUNT, sizeof(unsigned short), GFP_KERNEL); ++ upcase_table = kvcalloc(UTBL_COUNT, sizeof(unsigned short), GFP_KERNEL); + if (!upcase_table) + return -ENOMEM; + +@@ -803,5 +803,5 @@ load_default: + + void exfat_free_upcase_table(struct exfat_sb_info *sbi) + { +- kfree(sbi->vol_utbl); ++ kvfree(sbi->vol_utbl); + } diff --git a/queue-5.10/series b/queue-5.10/series index 69c5147f61a..5c6a8c3d92c 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -1 +1,23 @@ net-ipconfig-avoid-spurious-blank-lines-in-boot-log.patch +x86-split-lock-avoid-returning-with-interrupts-enabled.patch +exfat-avoid-allocating-upcase-table-using-kcalloc.patch +soc-tegra-fuse-fix-index-bug-in-get_process_id.patch +usb-mtu3-fix-memory-corruption-in-mtu3_debugfs_regset.patch +usb-serial-option-add-interface-number-sanity-check-to-flag-handling.patch +usb-gadget-f_acm-add-support-for-superspeed-plus.patch +usb-gadget-f_midi-setup-superspeed-plus-descriptors.patch +usb-gadget-f_fs-re-use-ss-descriptors-for-superspeedplus.patch +usb-gadget-f_rndis-fix-bitrate-for-superspeed-and-above.patch +usb-chipidea-ci_hdrc_imx-pass-disable_device_streaming-flag-to-imx6ul.patch +arm-dts-exynos-fix-roles-of-usb-3.0-ports-on-odroid-xu.patch +arm-dts-exynos-fix-usb-3.0-vbus-control-and-over-current-pins-on-exynos5410.patch +arm-dts-exynos-fix-usb-3.0-pins-supply-being-turned-off-on-odroid-xu.patch +coresight-tmc-etf-fix-null-ptr-dereference-in-tmc_enable_etf_sink_perf.patch +coresight-tmc-etr-check-if-page-is-valid-before-dma_map_page.patch +coresight-tmc-etr-fix-barrier-packet-insertion-for-perf-buffer.patch +coresight-etb10-fix-possible-null-ptr-dereference-in-etb_enable_perf.patch +coresight-etm4x-skip-setting-lpoverride-bit-for-qcom-skip-power-up.patch +coresight-etm4x-fix-accesses-to-trcvmidctlr1.patch +coresight-etm4x-fix-accesses-to-trccidctlr1.patch +coresight-etm4x-fix-accesses-to-trcprocselr.patch +coresight-etm4x-handle-trcvipcssctlr-accesses.patch diff --git a/queue-5.10/soc-tegra-fuse-fix-index-bug-in-get_process_id.patch b/queue-5.10/soc-tegra-fuse-fix-index-bug-in-get_process_id.patch new file mode 100644 index 00000000000..299c25fadcf --- /dev/null +++ b/queue-5.10/soc-tegra-fuse-fix-index-bug-in-get_process_id.patch @@ -0,0 +1,33 @@ +From b9ce9b0f83b536a4ac7de7567a265d28d13e5bea Mon Sep 17 00:00:00 2001 +From: Nicolin Chen +Date: Wed, 18 Nov 2020 20:44:57 -0800 +Subject: soc/tegra: fuse: Fix index bug in get_process_id + +From: Nicolin Chen + +commit b9ce9b0f83b536a4ac7de7567a265d28d13e5bea upstream. + +This patch simply fixes a bug of referencing speedos[num] in every +for-loop iteration in get_process_id function. + +Fixes: 0dc5a0d83675 ("soc/tegra: fuse: Add Tegra210 support") +Cc: +Signed-off-by: Nicolin Chen +Signed-off-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/soc/tegra/fuse/speedo-tegra210.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/soc/tegra/fuse/speedo-tegra210.c ++++ b/drivers/soc/tegra/fuse/speedo-tegra210.c +@@ -94,7 +94,7 @@ static int get_process_id(int value, con + unsigned int i; + + for (i = 0; i < num; i++) +- if (value < speedos[num]) ++ if (value < speedos[i]) + return i; + + return -EINVAL; diff --git a/queue-5.10/usb-chipidea-ci_hdrc_imx-pass-disable_device_streaming-flag-to-imx6ul.patch b/queue-5.10/usb-chipidea-ci_hdrc_imx-pass-disable_device_streaming-flag-to-imx6ul.patch new file mode 100644 index 00000000000..3b69b38394a --- /dev/null +++ b/queue-5.10/usb-chipidea-ci_hdrc_imx-pass-disable_device_streaming-flag-to-imx6ul.patch @@ -0,0 +1,38 @@ +From c7721e15f434920145c376e8fe77e1c079fc3726 Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Mon, 7 Dec 2020 10:09:09 +0800 +Subject: usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul + +From: Fabio Estevam + +commit c7721e15f434920145c376e8fe77e1c079fc3726 upstream. + +According to the i.MX6UL Errata document: +https://www.nxp.com/docs/en/errata/IMX6ULCE.pdf + +ERR007881 also affects i.MX6UL, so pass the +CI_HDRC_DISABLE_DEVICE_STREAMING flag to workaround the issue. + +Fixes: 52fe568e5d71 ("usb: chipidea: imx: add imx6ul usb support") +Cc: +Signed-off-by: Fabio Estevam +Signed-off-by: Peter Chen +Link: https://lore.kernel.org/r/20201207020909.22483-2-peter.chen@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/chipidea/ci_hdrc_imx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/chipidea/ci_hdrc_imx.c ++++ b/drivers/usb/chipidea/ci_hdrc_imx.c +@@ -57,7 +57,8 @@ static const struct ci_hdrc_imx_platform + + static const struct ci_hdrc_imx_platform_flag imx6ul_usb_data = { + .flags = CI_HDRC_SUPPORTS_RUNTIME_PM | +- CI_HDRC_TURN_VBUS_EARLY_ON, ++ CI_HDRC_TURN_VBUS_EARLY_ON | ++ CI_HDRC_DISABLE_DEVICE_STREAMING, + }; + + static const struct ci_hdrc_imx_platform_flag imx7d_usb_data = { diff --git a/queue-5.10/usb-gadget-f_acm-add-support-for-superspeed-plus.patch b/queue-5.10/usb-gadget-f_acm-add-support-for-superspeed-plus.patch new file mode 100644 index 00000000000..87cadefa55f --- /dev/null +++ b/queue-5.10/usb-gadget-f_acm-add-support-for-superspeed-plus.patch @@ -0,0 +1,35 @@ +From 3ee05c20656782387aa9eb010fdb9bb16982ac3f Mon Sep 17 00:00:00 2001 +From: "taehyun.cho" +Date: Fri, 27 Nov 2020 15:05:56 +0100 +Subject: USB: gadget: f_acm: add support for SuperSpeed Plus + +From: taehyun.cho + +commit 3ee05c20656782387aa9eb010fdb9bb16982ac3f upstream. + +Setup the SuperSpeed Plus descriptors for f_acm. This allows the gadget +to work properly without crashing at SuperSpeed rates. + +Cc: Felipe Balbi +Cc: stable +Signed-off-by: taehyun.cho +Signed-off-by: Will McVicker +Reviewed-by: Peter Chen +Link: https://lore.kernel.org/r/20201127140559.381351-3-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_acm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/f_acm.c ++++ b/drivers/usb/gadget/function/f_acm.c +@@ -686,7 +686,7 @@ acm_bind(struct usb_configuration *c, st + acm_ss_out_desc.bEndpointAddress = acm_fs_out_desc.bEndpointAddress; + + status = usb_assign_descriptors(f, acm_fs_function, acm_hs_function, +- acm_ss_function, NULL); ++ acm_ss_function, acm_ss_function); + if (status) + goto fail; + diff --git a/queue-5.10/usb-gadget-f_fs-re-use-ss-descriptors-for-superspeedplus.patch b/queue-5.10/usb-gadget-f_fs-re-use-ss-descriptors-for-superspeedplus.patch new file mode 100644 index 00000000000..0daba90607e --- /dev/null +++ b/queue-5.10/usb-gadget-f_fs-re-use-ss-descriptors-for-superspeedplus.patch @@ -0,0 +1,68 @@ +From a353397b0d5dfa3c99b372505db3378fc919c6c6 Mon Sep 17 00:00:00 2001 +From: Jack Pham +Date: Tue, 27 Oct 2020 16:07:31 -0700 +Subject: usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus + +From: Jack Pham + +commit a353397b0d5dfa3c99b372505db3378fc919c6c6 upstream. + +In many cases a function that supports SuperSpeed can very well +operate in SuperSpeedPlus, if a gadget controller supports it, +as the endpoint descriptors (and companion descriptors) are +generally identical and can be re-used. This is true for two +commonly used functions: Android's ADB and MTP. So we can simply +assign the usb_function's ssp_descriptors array to point to its +ss_descriptors, if available. Similarly, we need to allow an +epfile's ioctl for FUNCTIONFS_ENDPOINT_DESC to correctly +return the corresponding SuperSpeed endpoint descriptor in case +the connected speed is SuperSpeedPlus as well. + +The only exception is if a function wants to implement an +Isochronous endpoint capable of transferring more than 48KB per +service interval when operating at greater than USB 3.1 Gen1 +speed, in which case it would require an additional SuperSpeedPlus +Isochronous Endpoint Companion descriptor to be returned as part +of the Configuration Descriptor. Support for that would need +to be separately added to the userspace-facing FunctionFS API +which may not be a trivial task--likely a new descriptor format +(v3?) may need to be devised to allow for separate SS and SSP +descriptors to be supplied. + +Signed-off-by: Jack Pham +Cc: stable +Link: https://lore.kernel.org/r/20201027230731.9073-1-jackp@codeaurora.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_fs.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1328,6 +1328,7 @@ static long ffs_epfile_ioctl(struct file + + switch (epfile->ffs->gadget->speed) { + case USB_SPEED_SUPER: ++ case USB_SPEED_SUPER_PLUS: + desc_idx = 2; + break; + case USB_SPEED_HIGH: +@@ -3174,7 +3175,8 @@ static int _ffs_func_bind(struct usb_con + } + + if (likely(super)) { +- func->function.ss_descriptors = vla_ptr(vlabuf, d, ss_descs); ++ func->function.ss_descriptors = func->function.ssp_descriptors = ++ vla_ptr(vlabuf, d, ss_descs); + ss_len = ffs_do_descs(ffs->ss_descs_count, + vla_ptr(vlabuf, d, raw_descs) + fs_len + hs_len, + d_raw_descs__sz - fs_len - hs_len, +@@ -3584,6 +3586,7 @@ static void ffs_func_unbind(struct usb_c + func->function.fs_descriptors = NULL; + func->function.hs_descriptors = NULL; + func->function.ss_descriptors = NULL; ++ func->function.ssp_descriptors = NULL; + func->interfaces_nums = NULL; + + ffs_event_add(ffs, FUNCTIONFS_UNBIND); diff --git a/queue-5.10/usb-gadget-f_midi-setup-superspeed-plus-descriptors.patch b/queue-5.10/usb-gadget-f_midi-setup-superspeed-plus-descriptors.patch new file mode 100644 index 00000000000..ad3eb7558bb --- /dev/null +++ b/queue-5.10/usb-gadget-f_midi-setup-superspeed-plus-descriptors.patch @@ -0,0 +1,38 @@ +From 457a902ba1a73b7720666b21ca038cd19764db18 Mon Sep 17 00:00:00 2001 +From: Will McVicker +Date: Fri, 27 Nov 2020 15:05:57 +0100 +Subject: USB: gadget: f_midi: setup SuperSpeed Plus descriptors + +From: Will McVicker + +commit 457a902ba1a73b7720666b21ca038cd19764db18 upstream. + +Needed for SuperSpeed Plus support for f_midi. This allows the +gadget to work properly without crashing at SuperSpeed rates. + +Cc: Felipe Balbi +Cc: stable +Signed-off-by: Will McVicker +Reviewed-by: Peter Chen +Link: https://lore.kernel.org/r/20201127140559.381351-4-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_midi.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/gadget/function/f_midi.c ++++ b/drivers/usb/gadget/function/f_midi.c +@@ -1048,6 +1048,12 @@ static int f_midi_bind(struct usb_config + f->ss_descriptors = usb_copy_descriptors(midi_function); + if (!f->ss_descriptors) + goto fail_f_midi; ++ ++ if (gadget_is_superspeed_plus(c->cdev->gadget)) { ++ f->ssp_descriptors = usb_copy_descriptors(midi_function); ++ if (!f->ssp_descriptors) ++ goto fail_f_midi; ++ } + } + + kfree(midi_function); diff --git a/queue-5.10/usb-gadget-f_rndis-fix-bitrate-for-superspeed-and-above.patch b/queue-5.10/usb-gadget-f_rndis-fix-bitrate-for-superspeed-and-above.patch new file mode 100644 index 00000000000..4ebd806748e --- /dev/null +++ b/queue-5.10/usb-gadget-f_rndis-fix-bitrate-for-superspeed-and-above.patch @@ -0,0 +1,40 @@ +From b00f444f9add39b64d1943fa75538a1ebd54a290 Mon Sep 17 00:00:00 2001 +From: Will McVicker +Date: Fri, 27 Nov 2020 15:05:55 +0100 +Subject: USB: gadget: f_rndis: fix bitrate for SuperSpeed and above + +From: Will McVicker + +commit b00f444f9add39b64d1943fa75538a1ebd54a290 upstream. + +Align the SuperSpeed Plus bitrate for f_rndis to match f_ncm's ncm_bitrate +defined by commit 1650113888fe ("usb: gadget: f_ncm: add SuperSpeed descriptors +for CDC NCM"). + +Cc: Felipe Balbi +Cc: EJ Hsu +Cc: Peter Chen +Cc: stable +Signed-off-by: Will McVicker +Reviewed-by: Peter Chen +Link: https://lore.kernel.org/r/20201127140559.381351-2-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_rndis.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/f_rndis.c ++++ b/drivers/usb/gadget/function/f_rndis.c +@@ -87,8 +87,10 @@ static inline struct f_rndis *func_to_rn + /* peak (theoretical) bulk transfer rate in bits-per-second */ + static unsigned int bitrate(struct usb_gadget *g) + { ++ if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS) ++ return 4250000000U; + if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER) +- return 13 * 1024 * 8 * 1000 * 8; ++ return 3750000000U; + else if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH) + return 13 * 512 * 8 * 1000 * 8; + else diff --git a/queue-5.10/usb-mtu3-fix-memory-corruption-in-mtu3_debugfs_regset.patch b/queue-5.10/usb-mtu3-fix-memory-corruption-in-mtu3_debugfs_regset.patch new file mode 100644 index 00000000000..16b1ddd8f0f --- /dev/null +++ b/queue-5.10/usb-mtu3-fix-memory-corruption-in-mtu3_debugfs_regset.patch @@ -0,0 +1,33 @@ +From 3f6f6343a29d9ea7429306b83b18e66dc1331d5c Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 3 Dec 2020 11:41:13 +0300 +Subject: usb: mtu3: fix memory corruption in mtu3_debugfs_regset() + +From: Dan Carpenter + +commit 3f6f6343a29d9ea7429306b83b18e66dc1331d5c upstream. + +This code is using the wrong sizeof() so it does not allocate enough +memory. It allocates 32 bytes but 72 are required. That will lead to +memory corruption. + +Fixes: ae07809255d3 ("usb: mtu3: add debugfs interface files") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/X8ikqc4Mo2/0G72j@mwanda +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/mtu3/mtu3_debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/mtu3/mtu3_debugfs.c ++++ b/drivers/usb/mtu3/mtu3_debugfs.c +@@ -127,7 +127,7 @@ static void mtu3_debugfs_regset(struct m + struct debugfs_regset32 *regset; + struct mtu3_regset *mregs; + +- mregs = devm_kzalloc(mtu->dev, sizeof(*regset), GFP_KERNEL); ++ mregs = devm_kzalloc(mtu->dev, sizeof(*mregs), GFP_KERNEL); + if (!mregs) + return; + diff --git a/queue-5.10/usb-serial-option-add-interface-number-sanity-check-to-flag-handling.patch b/queue-5.10/usb-serial-option-add-interface-number-sanity-check-to-flag-handling.patch new file mode 100644 index 00000000000..02134361c19 --- /dev/null +++ b/queue-5.10/usb-serial-option-add-interface-number-sanity-check-to-flag-handling.patch @@ -0,0 +1,85 @@ +From a251963f76fa0226d0fdf0c4f989496f18d9ae7f Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 9 Dec 2020 11:42:21 +0100 +Subject: USB: serial: option: add interface-number sanity check to flag handling + +From: Johan Hovold + +commit a251963f76fa0226d0fdf0c4f989496f18d9ae7f upstream. + +Add an interface-number sanity check before testing the device flags to +avoid relying on undefined behaviour when left shifting in case a device +uses an interface number greater than or equal to BITS_PER_LONG (i.e. 64 +or 32). + +Reported-by: syzbot+8881b478dad0a7971f79@syzkaller.appspotmail.com +Fixes: c3a65808f04a ("USB: serial: option: reimplement interface masking") +Cc: stable@vger.kernel.org +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -563,6 +563,9 @@ static void option_instat_callback(struc + + /* Device flags */ + ++/* Highest interface number which can be used with NCTRL() and RSVD() */ ++#define FLAG_IFNUM_MAX 7 ++ + /* Interface does not support modem-control requests */ + #define NCTRL(ifnum) ((BIT(ifnum) & 0xff) << 8) + +@@ -2101,6 +2104,14 @@ static struct usb_serial_driver * const + + module_usb_serial_driver(serial_drivers, option_ids); + ++static bool iface_is_reserved(unsigned long device_flags, u8 ifnum) ++{ ++ if (ifnum > FLAG_IFNUM_MAX) ++ return false; ++ ++ return device_flags & RSVD(ifnum); ++} ++ + static int option_probe(struct usb_serial *serial, + const struct usb_device_id *id) + { +@@ -2117,7 +2128,7 @@ static int option_probe(struct usb_seria + * the same class/subclass/protocol as the serial interfaces. Look at + * the Windows driver .INF files for reserved interface numbers. + */ +- if (device_flags & RSVD(iface_desc->bInterfaceNumber)) ++ if (iface_is_reserved(device_flags, iface_desc->bInterfaceNumber)) + return -ENODEV; + + /* +@@ -2133,6 +2144,14 @@ static int option_probe(struct usb_seria + return 0; + } + ++static bool iface_no_modem_control(unsigned long device_flags, u8 ifnum) ++{ ++ if (ifnum > FLAG_IFNUM_MAX) ++ return false; ++ ++ return device_flags & NCTRL(ifnum); ++} ++ + static int option_attach(struct usb_serial *serial) + { + struct usb_interface_descriptor *iface_desc; +@@ -2148,7 +2167,7 @@ static int option_attach(struct usb_seri + + iface_desc = &serial->interface->cur_altsetting->desc; + +- if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber))) ++ if (!iface_no_modem_control(device_flags, iface_desc->bInterfaceNumber)) + data->use_send_setup = 1; + + if (device_flags & ZLP) diff --git a/queue-5.10/x86-split-lock-avoid-returning-with-interrupts-enabled.patch b/queue-5.10/x86-split-lock-avoid-returning-with-interrupts-enabled.patch new file mode 100644 index 00000000000..8af695ed8dd --- /dev/null +++ b/queue-5.10/x86-split-lock-avoid-returning-with-interrupts-enabled.patch @@ -0,0 +1,49 @@ +From e14fd4ba8fb47fcf5f244366ec01ae94490cd86a Mon Sep 17 00:00:00 2001 +From: Andi Kleen +Date: Tue, 22 Dec 2020 09:40:10 -0800 +Subject: x86/split-lock: Avoid returning with interrupts enabled + +From: Andi Kleen + +commit e14fd4ba8fb47fcf5f244366ec01ae94490cd86a upstream. + +When a split lock is detected always make sure to disable interrupts +before returning from the trap handler. + +The kernel exit code assumes that all exits run with interrupts +disabled, otherwise the SWAPGS sequence can race against interrupts and +cause recursing page faults and later panics. + +The problem will only happen on CPUs with split lock disable +functionality, so Icelake Server, Tiger Lake, Snow Ridge, Jacobsville. + +Fixes: ca4c6a9858c2 ("x86/traps: Make interrupt enable/disable symmetric in C code") +Fixes: bce9b042ec73 ("x86/traps: Disable interrupts in exc_aligment_check()") # v5.8+ +Signed-off-by: Andi Kleen +Cc: Peter Zijlstra +Cc: Fenghua Yu +Cc: Tony Luck +Reviewed-by: Thomas Gleixner +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/traps.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/traps.c ++++ b/arch/x86/kernel/traps.c +@@ -299,11 +299,12 @@ DEFINE_IDTENTRY_ERRORCODE(exc_alignment_ + local_irq_enable(); + + if (handle_user_split_lock(regs, error_code)) +- return; ++ goto out; + + do_trap(X86_TRAP_AC, SIGBUS, "alignment check", regs, + error_code, BUS_ADRALN, NULL); + ++out: + local_irq_disable(); + } + -- 2.47.3