From 47a9e454818853d45d49044b289552824292d287 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 23 Dec 2020 12:37:24 +0100 Subject: [PATCH] 5.4-stable patches added patches: arm-dts-exynos-fix-roles-of-usb-3.0-ports-on-odroid-xu.patch arm-dts-exynos-fix-usb-3.0-pins-supply-being-turned-off-on-odroid-xu.patch arm-dts-exynos-fix-usb-3.0-vbus-control-and-over-current-pins-on-exynos5410.patch coresight-etb10-fix-possible-null-ptr-dereference-in-etb_enable_perf.patch coresight-tmc-etf-fix-null-ptr-dereference-in-tmc_enable_etf_sink_perf.patch coresight-tmc-etr-check-if-page-is-valid-before-dma_map_page.patch coresight-tmc-etr-fix-barrier-packet-insertion-for-perf-buffer.patch soc-tegra-fuse-fix-index-bug-in-get_process_id.patch usb-chipidea-ci_hdrc_imx-pass-disable_device_streaming-flag-to-imx6ul.patch usb-gadget-f_acm-add-support-for-superspeed-plus.patch usb-gadget-f_fs-re-use-ss-descriptors-for-superspeedplus.patch usb-gadget-f_midi-setup-superspeed-plus-descriptors.patch usb-gadget-f_rndis-fix-bitrate-for-superspeed-and-above.patch usb-mtu3-fix-memory-corruption-in-mtu3_debugfs_regset.patch usb-serial-option-add-interface-number-sanity-check-to-flag-handling.patch --- ...-roles-of-usb-3.0-ports-on-odroid-xu.patch | 40 ++++++ ...supply-being-turned-off-on-odroid-xu.patch | 38 ++++++ ...-and-over-current-pins-on-exynos5410.patch | 89 +++++++++++++ ...l-ptr-dereference-in-etb_enable_perf.patch | 61 +++++++++ ...eference-in-tmc_enable_etf_sink_perf.patch | 119 ++++++++++++++++++ ...if-page-is-valid-before-dma_map_page.patch | 58 +++++++++ ...ier-packet-insertion-for-perf-buffer.patch | 43 +++++++ queue-5.4/series | 15 +++ ...fuse-fix-index-bug-in-get_process_id.patch | 33 +++++ ...able_device_streaming-flag-to-imx6ul.patch | 38 ++++++ ..._acm-add-support-for-superspeed-plus.patch | 35 ++++++ ...se-ss-descriptors-for-superspeedplus.patch | 68 ++++++++++ ...di-setup-superspeed-plus-descriptors.patch | 38 ++++++ ...fix-bitrate-for-superspeed-and-above.patch | 40 ++++++ ...ry-corruption-in-mtu3_debugfs_regset.patch | 33 +++++ ...number-sanity-check-to-flag-handling.patch | 85 +++++++++++++ 16 files changed, 833 insertions(+) create mode 100644 queue-5.4/arm-dts-exynos-fix-roles-of-usb-3.0-ports-on-odroid-xu.patch create mode 100644 queue-5.4/arm-dts-exynos-fix-usb-3.0-pins-supply-being-turned-off-on-odroid-xu.patch create mode 100644 queue-5.4/arm-dts-exynos-fix-usb-3.0-vbus-control-and-over-current-pins-on-exynos5410.patch create mode 100644 queue-5.4/coresight-etb10-fix-possible-null-ptr-dereference-in-etb_enable_perf.patch create mode 100644 queue-5.4/coresight-tmc-etf-fix-null-ptr-dereference-in-tmc_enable_etf_sink_perf.patch create mode 100644 queue-5.4/coresight-tmc-etr-check-if-page-is-valid-before-dma_map_page.patch create mode 100644 queue-5.4/coresight-tmc-etr-fix-barrier-packet-insertion-for-perf-buffer.patch create mode 100644 queue-5.4/soc-tegra-fuse-fix-index-bug-in-get_process_id.patch create mode 100644 queue-5.4/usb-chipidea-ci_hdrc_imx-pass-disable_device_streaming-flag-to-imx6ul.patch create mode 100644 queue-5.4/usb-gadget-f_acm-add-support-for-superspeed-plus.patch create mode 100644 queue-5.4/usb-gadget-f_fs-re-use-ss-descriptors-for-superspeedplus.patch create mode 100644 queue-5.4/usb-gadget-f_midi-setup-superspeed-plus-descriptors.patch create mode 100644 queue-5.4/usb-gadget-f_rndis-fix-bitrate-for-superspeed-and-above.patch create mode 100644 queue-5.4/usb-mtu3-fix-memory-corruption-in-mtu3_debugfs_regset.patch create mode 100644 queue-5.4/usb-serial-option-add-interface-number-sanity-check-to-flag-handling.patch diff --git a/queue-5.4/arm-dts-exynos-fix-roles-of-usb-3.0-ports-on-odroid-xu.patch b/queue-5.4/arm-dts-exynos-fix-roles-of-usb-3.0-ports-on-odroid-xu.patch new file mode 100644 index 00000000000..21e13559c70 --- /dev/null +++ b/queue-5.4/arm-dts-exynos-fix-roles-of-usb-3.0-ports-on-odroid-xu.patch @@ -0,0 +1,40 @@ +From ecc1ff532b499d20304a4f682247137025814c34 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Thu, 15 Oct 2020 20:20:41 +0200 +Subject: ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU + +From: Krzysztof Kozlowski + +commit ecc1ff532b499d20304a4f682247137025814c34 upstream. + +On Odroid XU board the USB3-0 port is a microUSB and USB3-1 port is USB +type A (host). The roles were copied from Odroid XU3 (Exynos5422) +design which has it reversed. + +Fixes: 8149afe4dbf9 ("ARM: dts: exynos: Add initial support for Odroid XU board") +Signed-off-by: Krzysztof Kozlowski +Cc: +Link: https://lore.kernel.org/r/20201015182044.480562-1-krzk@kernel.org +Tested-by: Gabriel Ribba Esteva +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/exynos5410-odroidxu.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts ++++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts +@@ -637,11 +637,11 @@ + }; + + &usbdrd_dwc3_0 { +- dr_mode = "host"; ++ dr_mode = "peripheral"; + }; + + &usbdrd_dwc3_1 { +- dr_mode = "peripheral"; ++ dr_mode = "host"; + }; + + &usbdrd3_0 { diff --git a/queue-5.4/arm-dts-exynos-fix-usb-3.0-pins-supply-being-turned-off-on-odroid-xu.patch b/queue-5.4/arm-dts-exynos-fix-usb-3.0-pins-supply-being-turned-off-on-odroid-xu.patch new file mode 100644 index 00000000000..4c1ee37587b --- /dev/null +++ b/queue-5.4/arm-dts-exynos-fix-usb-3.0-pins-supply-being-turned-off-on-odroid-xu.patch @@ -0,0 +1,38 @@ +From bd7e7ff56feea7810df900fb09c9741d259861d9 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Thu, 15 Oct 2020 20:20:43 +0200 +Subject: ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU + +From: Krzysztof Kozlowski + +commit bd7e7ff56feea7810df900fb09c9741d259861d9 upstream. + +On Odroid XU LDO12 and LDO15 supplies the power to USB 3.0 blocks but +the GPK GPIO pins are supplied by LDO7 (VDDQ_LCD). LDO7 also supplies +GPJ GPIO pins. + +The Exynos pinctrl driver does not take any supplies, so to have entire +GPIO block always available, make the regulator always on. + +Fixes: 88644b4c750b ("ARM: dts: exynos: Configure PWM, usb3503, PMIC and thermal on Odroid XU board") +Signed-off-by: Krzysztof Kozlowski +Cc: +Link: https://lore.kernel.org/r/20201015182044.480562-3-krzk@kernel.org +Tested-by: Gabriel Ribba Esteva +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/exynos5410-odroidxu.dts | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts ++++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts +@@ -327,6 +327,8 @@ + regulator-name = "vddq_lcd"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; ++ /* Supplies also GPK and GPJ */ ++ regulator-always-on; + }; + + ldo8_reg: LDO8 { diff --git a/queue-5.4/arm-dts-exynos-fix-usb-3.0-vbus-control-and-over-current-pins-on-exynos5410.patch b/queue-5.4/arm-dts-exynos-fix-usb-3.0-vbus-control-and-over-current-pins-on-exynos5410.patch new file mode 100644 index 00000000000..b92866fb04a --- /dev/null +++ b/queue-5.4/arm-dts-exynos-fix-usb-3.0-vbus-control-and-over-current-pins-on-exynos5410.patch @@ -0,0 +1,89 @@ +From 3d992fd8f4e0f09c980726308d2f2725587b32d6 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Thu, 15 Oct 2020 20:20:42 +0200 +Subject: ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410 + +From: Krzysztof Kozlowski + +commit 3d992fd8f4e0f09c980726308d2f2725587b32d6 upstream. + +The VBUS control (PWREN) and over-current pins of USB 3.0 DWC3 +controllers are on Exynos5410 regular GPIOs. This is different than for +example on Exynos5422 where these are special ETC pins with proper reset +values (pulls, functions). + +Therefore these pins should be configured to enable proper USB 3.0 +peripheral and host modes. This also fixes over-current warning: + + [ 6.024658] usb usb4-port1: over-current condition + [ 6.028271] usb usb3-port1: over-current condition + +Fixes: cb0896562228 ("ARM: dts: exynos: Add USB to Exynos5410") +Signed-off-by: Krzysztof Kozlowski +Cc: +Link: https://lore.kernel.org/r/20201015182044.480562-2-krzk@kernel.org +Tested-by: Gabriel Ribba Esteva +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/exynos5410-pinctrl.dtsi | 28 ++++++++++++++++++++++++++++ + arch/arm/boot/dts/exynos5410.dtsi | 4 ++++ + 2 files changed, 32 insertions(+) + +--- a/arch/arm/boot/dts/exynos5410-pinctrl.dtsi ++++ b/arch/arm/boot/dts/exynos5410-pinctrl.dtsi +@@ -560,6 +560,34 @@ + interrupt-controller; + #interrupt-cells = <2>; + }; ++ ++ usb3_1_oc: usb3-1-oc { ++ samsung,pins = "gpk2-4", "gpk2-5"; ++ samsung,pin-function = ; ++ samsung,pin-pud = ; ++ samsung,pin-drv = ; ++ }; ++ ++ usb3_1_vbusctrl: usb3-1-vbusctrl { ++ samsung,pins = "gpk2-6", "gpk2-7"; ++ samsung,pin-function = ; ++ samsung,pin-pud = ; ++ samsung,pin-drv = ; ++ }; ++ ++ usb3_0_oc: usb3-0-oc { ++ samsung,pins = "gpk3-0", "gpk3-1"; ++ samsung,pin-function = ; ++ samsung,pin-pud = ; ++ samsung,pin-drv = ; ++ }; ++ ++ usb3_0_vbusctrl: usb3-0-vbusctrl { ++ samsung,pins = "gpk3-2", "gpk3-3"; ++ samsung,pin-function = ; ++ samsung,pin-pud = ; ++ samsung,pin-drv = ; ++ }; + }; + + &pinctrl_2 { +--- a/arch/arm/boot/dts/exynos5410.dtsi ++++ b/arch/arm/boot/dts/exynos5410.dtsi +@@ -398,6 +398,8 @@ + &usbdrd3_0 { + clocks = <&clock CLK_USBD300>; + clock-names = "usbdrd30"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&usb3_0_oc>, <&usb3_0_vbusctrl>; + }; + + &usbdrd_phy0 { +@@ -409,6 +411,8 @@ + &usbdrd3_1 { + clocks = <&clock CLK_USBD301>; + clock-names = "usbdrd30"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&usb3_1_oc>, <&usb3_1_vbusctrl>; + }; + + &usbdrd_dwc3_1 { diff --git a/queue-5.4/coresight-etb10-fix-possible-null-ptr-dereference-in-etb_enable_perf.patch b/queue-5.4/coresight-etb10-fix-possible-null-ptr-dereference-in-etb_enable_perf.patch new file mode 100644 index 00000000000..869db52fa55 --- /dev/null +++ b/queue-5.4/coresight-etb10-fix-possible-null-ptr-dereference-in-etb_enable_perf.patch @@ -0,0 +1,61 @@ +From 22b2beaa7f166f550424cbb3b988aeaa7ef0425a Mon Sep 17 00:00:00 2001 +From: Sai Prakash Ranjan +Date: Fri, 27 Nov 2020 10:52:51 -0700 +Subject: coresight: etb10: Fix possible NULL ptr dereference in etb_enable_perf() + +From: Sai Prakash Ranjan + +commit 22b2beaa7f166f550424cbb3b988aeaa7ef0425a upstream. + +There was a report of NULL pointer dereference in ETF enable +path for perf CS mode with PID monitoring. It is almost 100% +reproducible when the process to monitor is something very +active such as chrome and with ETF as the sink, not ETR. + +But code path shows that ETB has a similar path as ETF, so +there could be possible NULL pointer dereference crash in +ETB as well. Currently in a bid to find the pid, the owner +is dereferenced via task_pid_nr() call in etb_enable_perf() +and with owner being NULL, we can get a NULL pointer +dereference, so have a similar fix as ETF where we cache PID +in alloc_buffer() callback which is called as the part of +etm_setup_aux(). + +Fixes: 75d7dbd38824 ("coresight: etb10: Add support for CPU-wide trace scenarios") +Cc: stable@vger.kernel.org +Signed-off-by: Sai Prakash Ranjan +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20201127175256.1092685-11-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/coresight/coresight-etb10.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/hwtracing/coresight/coresight-etb10.c ++++ b/drivers/hwtracing/coresight/coresight-etb10.c +@@ -176,6 +176,7 @@ static int etb_enable_perf(struct coresi + unsigned long flags; + struct etb_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent); + struct perf_output_handle *handle = data; ++ struct cs_buffers *buf = etm_perf_sink_config(handle); + + spin_lock_irqsave(&drvdata->spinlock, flags); + +@@ -186,7 +187,7 @@ static int etb_enable_perf(struct coresi + } + + /* Get a handle on the pid of the process to monitor */ +- pid = task_pid_nr(handle->event->owner); ++ pid = buf->pid; + + if (drvdata->pid != -1 && drvdata->pid != pid) { + ret = -EBUSY; +@@ -383,6 +384,7 @@ static void *etb_alloc_buffer(struct cor + if (!buf) + return NULL; + ++ buf->pid = task_pid_nr(event->owner); + buf->snapshot = overwrite; + buf->nr_pages = nr_pages; + buf->data_pages = pages; diff --git a/queue-5.4/coresight-tmc-etf-fix-null-ptr-dereference-in-tmc_enable_etf_sink_perf.patch b/queue-5.4/coresight-tmc-etf-fix-null-ptr-dereference-in-tmc_enable_etf_sink_perf.patch new file mode 100644 index 00000000000..e727be0e72a --- /dev/null +++ b/queue-5.4/coresight-tmc-etf-fix-null-ptr-dereference-in-tmc_enable_etf_sink_perf.patch @@ -0,0 +1,119 @@ +From 868663dd5d69fef05bfb004f91da5c30e9b93461 Mon Sep 17 00:00:00 2001 +From: Sai Prakash Ranjan +Date: Fri, 27 Nov 2020 10:52:50 -0700 +Subject: coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf() + +From: Sai Prakash Ranjan + +commit 868663dd5d69fef05bfb004f91da5c30e9b93461 upstream. + +There was a report of NULL pointer dereference in ETF enable +path for perf CS mode with PID monitoring. It is almost 100% +reproducible when the process to monitor is something very +active such as chrome and with ETF as the sink and not ETR. +Currently in a bid to find the pid, the owner is dereferenced +via task_pid_nr() call in tmc_enable_etf_sink_perf() and with +owner being NULL, we get a NULL pointer dereference. + +Looking at the ETR and other places in the kernel, ETF and the +ETB are the only places trying to dereference the task(owner) +in tmc_enable_etf_sink_perf() which is also called from the +sched_in path as in the call trace. Owner(task) is NULL even +in the case of ETR in tmc_enable_etr_sink_perf(), but since we +cache the PID in alloc_buffer() callback and it is done as part +of etm_setup_aux() when allocating buffer for ETR sink, we never +dereference this NULL pointer and we are safe. So lets do the +same thing with ETF and cache the PID to which the cs_buffer +belongs in tmc_alloc_etf_buffer() as done for ETR. This will +also remove the unnecessary function calls(task_pid_nr()) since +we are caching the PID. + +Easily reproducible running below: + + perf record -e cs_etm/@tmc_etf0/ -N -p + +Unable to handle kernel NULL pointer dereference at virtual address 0000000000000548 +Mem abort info: + ESR = 0x96000006 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 +Data abort info: + ISV = 0, ISS = 0x00000006 + CM = 0, WnR = 0 +... +Call trace: + tmc_enable_etf_sink+0xe4/0x280 + coresight_enable_path+0x168/0x1fc + etm_event_start+0x8c/0xf8 + etm_event_add+0x38/0x54 + event_sched_in+0x194/0x2ac + group_sched_in+0x54/0x12c + flexible_sched_in+0xd8/0x120 + visit_groups_merge+0x100/0x16c + ctx_flexible_sched_in+0x50/0x74 + ctx_sched_in+0xa4/0xa8 + perf_event_sched_in+0x60/0x6c + perf_event_context_sched_in+0x98/0xe0 + __perf_event_task_sched_in+0x5c/0xd8 + finish_task_switch+0x184/0x1cc + schedule_tail+0x20/0xec + ret_from_fork+0x4/0x18 + +Fixes: 880af782c6e8 ("coresight: tmc-etf: Add support for CPU-wide trace scenarios") +Cc: stable@vger.kernel.org +Signed-off-by: Sai Prakash Ranjan +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20201127175256.1092685-10-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/coresight/coresight-priv.h | 2 ++ + drivers/hwtracing/coresight/coresight-tmc-etf.c | 4 +++- + 2 files changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/hwtracing/coresight/coresight-priv.h ++++ b/drivers/hwtracing/coresight/coresight-priv.h +@@ -86,6 +86,7 @@ enum cs_mode { + * struct cs_buffer - keep track of a recording session' specifics + * @cur: index of the current buffer + * @nr_pages: max number of pages granted to us ++ * @pid: PID this cs_buffer belongs to + * @offset: offset within the current buffer + * @data_size: how much we collected in this run + * @snapshot: is this run in snapshot mode +@@ -94,6 +95,7 @@ enum cs_mode { + struct cs_buffers { + unsigned int cur; + unsigned int nr_pages; ++ pid_t pid; + unsigned long offset; + local_t data_size; + bool snapshot; +--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c +@@ -227,6 +227,7 @@ static int tmc_enable_etf_sink_perf(stru + unsigned long flags; + struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent); + struct perf_output_handle *handle = data; ++ struct cs_buffers *buf = etm_perf_sink_config(handle); + + spin_lock_irqsave(&drvdata->spinlock, flags); + do { +@@ -243,7 +244,7 @@ static int tmc_enable_etf_sink_perf(stru + } + + /* Get a handle on the pid of the process to monitor */ +- pid = task_pid_nr(handle->event->owner); ++ pid = buf->pid; + + if (drvdata->pid != -1 && drvdata->pid != pid) { + ret = -EBUSY; +@@ -399,6 +400,7 @@ static void *tmc_alloc_etf_buffer(struct + if (!buf) + return NULL; + ++ buf->pid = task_pid_nr(event->owner); + buf->snapshot = overwrite; + buf->nr_pages = nr_pages; + buf->data_pages = pages; diff --git a/queue-5.4/coresight-tmc-etr-check-if-page-is-valid-before-dma_map_page.patch b/queue-5.4/coresight-tmc-etr-check-if-page-is-valid-before-dma_map_page.patch new file mode 100644 index 00000000000..05605dfb7f5 --- /dev/null +++ b/queue-5.4/coresight-tmc-etr-check-if-page-is-valid-before-dma_map_page.patch @@ -0,0 +1,58 @@ +From 1cc573d5754e92372a7e30e35468644f8811e1a4 Mon Sep 17 00:00:00 2001 +From: Mao Jinlong +Date: Fri, 27 Nov 2020 10:52:53 -0700 +Subject: coresight: tmc-etr: Check if page is valid before dma_map_page() + +From: Mao Jinlong + +commit 1cc573d5754e92372a7e30e35468644f8811e1a4 upstream. + +alloc_pages_node() return should be checked before calling +dma_map_page() to make sure that valid page is mapped or +else it can lead to aborts as below: + + Unable to handle kernel paging request at virtual address ffffffc008000000 + Mem abort info: + ... + pc : __dma_inv_area+0x40/0x58 + lr : dma_direct_map_page+0xd8/0x1c8 + + Call trace: + __dma_inv_area + tmc_pages_alloc + tmc_alloc_data_pages + tmc_alloc_sg_table + tmc_init_etr_sg_table + tmc_alloc_etr_buf + tmc_enable_etr_sink_sysfs + tmc_enable_etr_sink + coresight_enable_path + coresight_enable + enable_source_store + dev_attr_store + sysfs_kf_write + +Fixes: 99443ea19e8b ("coresight: Add generic TMC sg table framework") +Cc: stable@vger.kernel.org +Reviewed-by: Suzuki K Poulose +Signed-off-by: Mao Jinlong +Signed-off-by: Sai Prakash Ranjan +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20201127175256.1092685-13-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c +@@ -217,6 +217,8 @@ static int tmc_pages_alloc(struct tmc_pa + } else { + page = alloc_pages_node(node, + GFP_KERNEL | __GFP_ZERO, 0); ++ if (!page) ++ goto err; + } + paddr = dma_map_page(real_dev, page, 0, PAGE_SIZE, dir); + if (dma_mapping_error(real_dev, paddr)) diff --git a/queue-5.4/coresight-tmc-etr-fix-barrier-packet-insertion-for-perf-buffer.patch b/queue-5.4/coresight-tmc-etr-fix-barrier-packet-insertion-for-perf-buffer.patch new file mode 100644 index 00000000000..6a55d64942f --- /dev/null +++ b/queue-5.4/coresight-tmc-etr-fix-barrier-packet-insertion-for-perf-buffer.patch @@ -0,0 +1,43 @@ +From 83be0b84fe846edf0c722fefe225482d5f0d7395 Mon Sep 17 00:00:00 2001 +From: Suzuki K Poulose +Date: Tue, 8 Dec 2020 11:26:49 -0700 +Subject: coresight: tmc-etr: Fix barrier packet insertion for perf buffer + +From: Suzuki K Poulose + +commit 83be0b84fe846edf0c722fefe225482d5f0d7395 upstream. + +When the ETR is used in perf mode with a larger buffer (configured +via sysfs or the default size of 1M) than the perf aux buffer size, +we end up inserting the barrier packet at the wrong offset, while +moving the offset forward. i.e, instead of the "new moved offset", +we insert it at the current hardware buffer offset. These packets +will not be visible as they are never copied and could lead to +corruption in the trace decoding side, as the decoder is not aware +that it needs to reset the decoding. + +Fixes: ec13c78d7b45 ("coresight: tmc-etr: Add barrier packets when moving offset forward") +Cc: Mathieu Poirier +Cc: stable@vger.kernel.org +Reported-by: Al Grant +Tested-by: Mike Leach +Signed-off-by: Suzuki K Poulose +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20201208182651.1597945-2-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c +@@ -1535,7 +1535,7 @@ tmc_update_etr_buffer(struct coresight_d + + /* Insert barrier packets at the beginning, if there was an overflow */ + if (lost) +- tmc_etr_buf_insert_barrier_packet(etr_buf, etr_buf->offset); ++ tmc_etr_buf_insert_barrier_packet(etr_buf, offset); + tmc_etr_sync_perf_buffer(etr_perf, offset, size); + + /* diff --git a/queue-5.4/series b/queue-5.4/series index f8833d070a4..a16b5e66234 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -46,3 +46,18 @@ iwlwifi-pcie-add-one-missing-entry-for-ax210.patch drm-amd-display-init-clock-value-by-current-vbios-cl.patch perf-x86-intel-check-pebs-status-correctly.patch kbuild-avoid-split-lines-in-.mod-files.patch +soc-tegra-fuse-fix-index-bug-in-get_process_id.patch +usb-mtu3-fix-memory-corruption-in-mtu3_debugfs_regset.patch +usb-serial-option-add-interface-number-sanity-check-to-flag-handling.patch +usb-gadget-f_acm-add-support-for-superspeed-plus.patch +usb-gadget-f_midi-setup-superspeed-plus-descriptors.patch +usb-gadget-f_fs-re-use-ss-descriptors-for-superspeedplus.patch +usb-gadget-f_rndis-fix-bitrate-for-superspeed-and-above.patch +usb-chipidea-ci_hdrc_imx-pass-disable_device_streaming-flag-to-imx6ul.patch +arm-dts-exynos-fix-roles-of-usb-3.0-ports-on-odroid-xu.patch +arm-dts-exynos-fix-usb-3.0-vbus-control-and-over-current-pins-on-exynos5410.patch +arm-dts-exynos-fix-usb-3.0-pins-supply-being-turned-off-on-odroid-xu.patch +coresight-tmc-etf-fix-null-ptr-dereference-in-tmc_enable_etf_sink_perf.patch +coresight-tmc-etr-check-if-page-is-valid-before-dma_map_page.patch +coresight-tmc-etr-fix-barrier-packet-insertion-for-perf-buffer.patch +coresight-etb10-fix-possible-null-ptr-dereference-in-etb_enable_perf.patch diff --git a/queue-5.4/soc-tegra-fuse-fix-index-bug-in-get_process_id.patch b/queue-5.4/soc-tegra-fuse-fix-index-bug-in-get_process_id.patch new file mode 100644 index 00000000000..299c25fadcf --- /dev/null +++ b/queue-5.4/soc-tegra-fuse-fix-index-bug-in-get_process_id.patch @@ -0,0 +1,33 @@ +From b9ce9b0f83b536a4ac7de7567a265d28d13e5bea Mon Sep 17 00:00:00 2001 +From: Nicolin Chen +Date: Wed, 18 Nov 2020 20:44:57 -0800 +Subject: soc/tegra: fuse: Fix index bug in get_process_id + +From: Nicolin Chen + +commit b9ce9b0f83b536a4ac7de7567a265d28d13e5bea upstream. + +This patch simply fixes a bug of referencing speedos[num] in every +for-loop iteration in get_process_id function. + +Fixes: 0dc5a0d83675 ("soc/tegra: fuse: Add Tegra210 support") +Cc: +Signed-off-by: Nicolin Chen +Signed-off-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/soc/tegra/fuse/speedo-tegra210.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/soc/tegra/fuse/speedo-tegra210.c ++++ b/drivers/soc/tegra/fuse/speedo-tegra210.c +@@ -94,7 +94,7 @@ static int get_process_id(int value, con + unsigned int i; + + for (i = 0; i < num; i++) +- if (value < speedos[num]) ++ if (value < speedos[i]) + return i; + + return -EINVAL; diff --git a/queue-5.4/usb-chipidea-ci_hdrc_imx-pass-disable_device_streaming-flag-to-imx6ul.patch b/queue-5.4/usb-chipidea-ci_hdrc_imx-pass-disable_device_streaming-flag-to-imx6ul.patch new file mode 100644 index 00000000000..3b69b38394a --- /dev/null +++ b/queue-5.4/usb-chipidea-ci_hdrc_imx-pass-disable_device_streaming-flag-to-imx6ul.patch @@ -0,0 +1,38 @@ +From c7721e15f434920145c376e8fe77e1c079fc3726 Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Mon, 7 Dec 2020 10:09:09 +0800 +Subject: usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul + +From: Fabio Estevam + +commit c7721e15f434920145c376e8fe77e1c079fc3726 upstream. + +According to the i.MX6UL Errata document: +https://www.nxp.com/docs/en/errata/IMX6ULCE.pdf + +ERR007881 also affects i.MX6UL, so pass the +CI_HDRC_DISABLE_DEVICE_STREAMING flag to workaround the issue. + +Fixes: 52fe568e5d71 ("usb: chipidea: imx: add imx6ul usb support") +Cc: +Signed-off-by: Fabio Estevam +Signed-off-by: Peter Chen +Link: https://lore.kernel.org/r/20201207020909.22483-2-peter.chen@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/chipidea/ci_hdrc_imx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/chipidea/ci_hdrc_imx.c ++++ b/drivers/usb/chipidea/ci_hdrc_imx.c +@@ -57,7 +57,8 @@ static const struct ci_hdrc_imx_platform + + static const struct ci_hdrc_imx_platform_flag imx6ul_usb_data = { + .flags = CI_HDRC_SUPPORTS_RUNTIME_PM | +- CI_HDRC_TURN_VBUS_EARLY_ON, ++ CI_HDRC_TURN_VBUS_EARLY_ON | ++ CI_HDRC_DISABLE_DEVICE_STREAMING, + }; + + static const struct ci_hdrc_imx_platform_flag imx7d_usb_data = { diff --git a/queue-5.4/usb-gadget-f_acm-add-support-for-superspeed-plus.patch b/queue-5.4/usb-gadget-f_acm-add-support-for-superspeed-plus.patch new file mode 100644 index 00000000000..5b7d6c46eb6 --- /dev/null +++ b/queue-5.4/usb-gadget-f_acm-add-support-for-superspeed-plus.patch @@ -0,0 +1,35 @@ +From 3ee05c20656782387aa9eb010fdb9bb16982ac3f Mon Sep 17 00:00:00 2001 +From: "taehyun.cho" +Date: Fri, 27 Nov 2020 15:05:56 +0100 +Subject: USB: gadget: f_acm: add support for SuperSpeed Plus + +From: taehyun.cho + +commit 3ee05c20656782387aa9eb010fdb9bb16982ac3f upstream. + +Setup the SuperSpeed Plus descriptors for f_acm. This allows the gadget +to work properly without crashing at SuperSpeed rates. + +Cc: Felipe Balbi +Cc: stable +Signed-off-by: taehyun.cho +Signed-off-by: Will McVicker +Reviewed-by: Peter Chen +Link: https://lore.kernel.org/r/20201127140559.381351-3-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_acm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/f_acm.c ++++ b/drivers/usb/gadget/function/f_acm.c +@@ -684,7 +684,7 @@ acm_bind(struct usb_configuration *c, st + acm_ss_out_desc.bEndpointAddress = acm_fs_out_desc.bEndpointAddress; + + status = usb_assign_descriptors(f, acm_fs_function, acm_hs_function, +- acm_ss_function, NULL); ++ acm_ss_function, acm_ss_function); + if (status) + goto fail; + diff --git a/queue-5.4/usb-gadget-f_fs-re-use-ss-descriptors-for-superspeedplus.patch b/queue-5.4/usb-gadget-f_fs-re-use-ss-descriptors-for-superspeedplus.patch new file mode 100644 index 00000000000..4edceaac343 --- /dev/null +++ b/queue-5.4/usb-gadget-f_fs-re-use-ss-descriptors-for-superspeedplus.patch @@ -0,0 +1,68 @@ +From a353397b0d5dfa3c99b372505db3378fc919c6c6 Mon Sep 17 00:00:00 2001 +From: Jack Pham +Date: Tue, 27 Oct 2020 16:07:31 -0700 +Subject: usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus + +From: Jack Pham + +commit a353397b0d5dfa3c99b372505db3378fc919c6c6 upstream. + +In many cases a function that supports SuperSpeed can very well +operate in SuperSpeedPlus, if a gadget controller supports it, +as the endpoint descriptors (and companion descriptors) are +generally identical and can be re-used. This is true for two +commonly used functions: Android's ADB and MTP. So we can simply +assign the usb_function's ssp_descriptors array to point to its +ss_descriptors, if available. Similarly, we need to allow an +epfile's ioctl for FUNCTIONFS_ENDPOINT_DESC to correctly +return the corresponding SuperSpeed endpoint descriptor in case +the connected speed is SuperSpeedPlus as well. + +The only exception is if a function wants to implement an +Isochronous endpoint capable of transferring more than 48KB per +service interval when operating at greater than USB 3.1 Gen1 +speed, in which case it would require an additional SuperSpeedPlus +Isochronous Endpoint Companion descriptor to be returned as part +of the Configuration Descriptor. Support for that would need +to be separately added to the userspace-facing FunctionFS API +which may not be a trivial task--likely a new descriptor format +(v3?) may need to be devised to allow for separate SS and SSP +descriptors to be supplied. + +Signed-off-by: Jack Pham +Cc: stable +Link: https://lore.kernel.org/r/20201027230731.9073-1-jackp@codeaurora.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_fs.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1332,6 +1332,7 @@ static long ffs_epfile_ioctl(struct file + + switch (epfile->ffs->gadget->speed) { + case USB_SPEED_SUPER: ++ case USB_SPEED_SUPER_PLUS: + desc_idx = 2; + break; + case USB_SPEED_HIGH: +@@ -3193,7 +3194,8 @@ static int _ffs_func_bind(struct usb_con + } + + if (likely(super)) { +- func->function.ss_descriptors = vla_ptr(vlabuf, d, ss_descs); ++ func->function.ss_descriptors = func->function.ssp_descriptors = ++ vla_ptr(vlabuf, d, ss_descs); + ss_len = ffs_do_descs(ffs->ss_descs_count, + vla_ptr(vlabuf, d, raw_descs) + fs_len + hs_len, + d_raw_descs__sz - fs_len - hs_len, +@@ -3603,6 +3605,7 @@ static void ffs_func_unbind(struct usb_c + func->function.fs_descriptors = NULL; + func->function.hs_descriptors = NULL; + func->function.ss_descriptors = NULL; ++ func->function.ssp_descriptors = NULL; + func->interfaces_nums = NULL; + + ffs_event_add(ffs, FUNCTIONFS_UNBIND); diff --git a/queue-5.4/usb-gadget-f_midi-setup-superspeed-plus-descriptors.patch b/queue-5.4/usb-gadget-f_midi-setup-superspeed-plus-descriptors.patch new file mode 100644 index 00000000000..ad3eb7558bb --- /dev/null +++ b/queue-5.4/usb-gadget-f_midi-setup-superspeed-plus-descriptors.patch @@ -0,0 +1,38 @@ +From 457a902ba1a73b7720666b21ca038cd19764db18 Mon Sep 17 00:00:00 2001 +From: Will McVicker +Date: Fri, 27 Nov 2020 15:05:57 +0100 +Subject: USB: gadget: f_midi: setup SuperSpeed Plus descriptors + +From: Will McVicker + +commit 457a902ba1a73b7720666b21ca038cd19764db18 upstream. + +Needed for SuperSpeed Plus support for f_midi. This allows the +gadget to work properly without crashing at SuperSpeed rates. + +Cc: Felipe Balbi +Cc: stable +Signed-off-by: Will McVicker +Reviewed-by: Peter Chen +Link: https://lore.kernel.org/r/20201127140559.381351-4-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_midi.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/gadget/function/f_midi.c ++++ b/drivers/usb/gadget/function/f_midi.c +@@ -1048,6 +1048,12 @@ static int f_midi_bind(struct usb_config + f->ss_descriptors = usb_copy_descriptors(midi_function); + if (!f->ss_descriptors) + goto fail_f_midi; ++ ++ if (gadget_is_superspeed_plus(c->cdev->gadget)) { ++ f->ssp_descriptors = usb_copy_descriptors(midi_function); ++ if (!f->ssp_descriptors) ++ goto fail_f_midi; ++ } + } + + kfree(midi_function); diff --git a/queue-5.4/usb-gadget-f_rndis-fix-bitrate-for-superspeed-and-above.patch b/queue-5.4/usb-gadget-f_rndis-fix-bitrate-for-superspeed-and-above.patch new file mode 100644 index 00000000000..4ebd806748e --- /dev/null +++ b/queue-5.4/usb-gadget-f_rndis-fix-bitrate-for-superspeed-and-above.patch @@ -0,0 +1,40 @@ +From b00f444f9add39b64d1943fa75538a1ebd54a290 Mon Sep 17 00:00:00 2001 +From: Will McVicker +Date: Fri, 27 Nov 2020 15:05:55 +0100 +Subject: USB: gadget: f_rndis: fix bitrate for SuperSpeed and above + +From: Will McVicker + +commit b00f444f9add39b64d1943fa75538a1ebd54a290 upstream. + +Align the SuperSpeed Plus bitrate for f_rndis to match f_ncm's ncm_bitrate +defined by commit 1650113888fe ("usb: gadget: f_ncm: add SuperSpeed descriptors +for CDC NCM"). + +Cc: Felipe Balbi +Cc: EJ Hsu +Cc: Peter Chen +Cc: stable +Signed-off-by: Will McVicker +Reviewed-by: Peter Chen +Link: https://lore.kernel.org/r/20201127140559.381351-2-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_rndis.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/f_rndis.c ++++ b/drivers/usb/gadget/function/f_rndis.c +@@ -87,8 +87,10 @@ static inline struct f_rndis *func_to_rn + /* peak (theoretical) bulk transfer rate in bits-per-second */ + static unsigned int bitrate(struct usb_gadget *g) + { ++ if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS) ++ return 4250000000U; + if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER) +- return 13 * 1024 * 8 * 1000 * 8; ++ return 3750000000U; + else if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH) + return 13 * 512 * 8 * 1000 * 8; + else diff --git a/queue-5.4/usb-mtu3-fix-memory-corruption-in-mtu3_debugfs_regset.patch b/queue-5.4/usb-mtu3-fix-memory-corruption-in-mtu3_debugfs_regset.patch new file mode 100644 index 00000000000..16b1ddd8f0f --- /dev/null +++ b/queue-5.4/usb-mtu3-fix-memory-corruption-in-mtu3_debugfs_regset.patch @@ -0,0 +1,33 @@ +From 3f6f6343a29d9ea7429306b83b18e66dc1331d5c Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 3 Dec 2020 11:41:13 +0300 +Subject: usb: mtu3: fix memory corruption in mtu3_debugfs_regset() + +From: Dan Carpenter + +commit 3f6f6343a29d9ea7429306b83b18e66dc1331d5c upstream. + +This code is using the wrong sizeof() so it does not allocate enough +memory. It allocates 32 bytes but 72 are required. That will lead to +memory corruption. + +Fixes: ae07809255d3 ("usb: mtu3: add debugfs interface files") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/X8ikqc4Mo2/0G72j@mwanda +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/mtu3/mtu3_debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/mtu3/mtu3_debugfs.c ++++ b/drivers/usb/mtu3/mtu3_debugfs.c +@@ -127,7 +127,7 @@ static void mtu3_debugfs_regset(struct m + struct debugfs_regset32 *regset; + struct mtu3_regset *mregs; + +- mregs = devm_kzalloc(mtu->dev, sizeof(*regset), GFP_KERNEL); ++ mregs = devm_kzalloc(mtu->dev, sizeof(*mregs), GFP_KERNEL); + if (!mregs) + return; + diff --git a/queue-5.4/usb-serial-option-add-interface-number-sanity-check-to-flag-handling.patch b/queue-5.4/usb-serial-option-add-interface-number-sanity-check-to-flag-handling.patch new file mode 100644 index 00000000000..02134361c19 --- /dev/null +++ b/queue-5.4/usb-serial-option-add-interface-number-sanity-check-to-flag-handling.patch @@ -0,0 +1,85 @@ +From a251963f76fa0226d0fdf0c4f989496f18d9ae7f Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 9 Dec 2020 11:42:21 +0100 +Subject: USB: serial: option: add interface-number sanity check to flag handling + +From: Johan Hovold + +commit a251963f76fa0226d0fdf0c4f989496f18d9ae7f upstream. + +Add an interface-number sanity check before testing the device flags to +avoid relying on undefined behaviour when left shifting in case a device +uses an interface number greater than or equal to BITS_PER_LONG (i.e. 64 +or 32). + +Reported-by: syzbot+8881b478dad0a7971f79@syzkaller.appspotmail.com +Fixes: c3a65808f04a ("USB: serial: option: reimplement interface masking") +Cc: stable@vger.kernel.org +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -563,6 +563,9 @@ static void option_instat_callback(struc + + /* Device flags */ + ++/* Highest interface number which can be used with NCTRL() and RSVD() */ ++#define FLAG_IFNUM_MAX 7 ++ + /* Interface does not support modem-control requests */ + #define NCTRL(ifnum) ((BIT(ifnum) & 0xff) << 8) + +@@ -2101,6 +2104,14 @@ static struct usb_serial_driver * const + + module_usb_serial_driver(serial_drivers, option_ids); + ++static bool iface_is_reserved(unsigned long device_flags, u8 ifnum) ++{ ++ if (ifnum > FLAG_IFNUM_MAX) ++ return false; ++ ++ return device_flags & RSVD(ifnum); ++} ++ + static int option_probe(struct usb_serial *serial, + const struct usb_device_id *id) + { +@@ -2117,7 +2128,7 @@ static int option_probe(struct usb_seria + * the same class/subclass/protocol as the serial interfaces. Look at + * the Windows driver .INF files for reserved interface numbers. + */ +- if (device_flags & RSVD(iface_desc->bInterfaceNumber)) ++ if (iface_is_reserved(device_flags, iface_desc->bInterfaceNumber)) + return -ENODEV; + + /* +@@ -2133,6 +2144,14 @@ static int option_probe(struct usb_seria + return 0; + } + ++static bool iface_no_modem_control(unsigned long device_flags, u8 ifnum) ++{ ++ if (ifnum > FLAG_IFNUM_MAX) ++ return false; ++ ++ return device_flags & NCTRL(ifnum); ++} ++ + static int option_attach(struct usb_serial *serial) + { + struct usb_interface_descriptor *iface_desc; +@@ -2148,7 +2167,7 @@ static int option_attach(struct usb_seri + + iface_desc = &serial->interface->cur_altsetting->desc; + +- if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber))) ++ if (!iface_no_modem_control(device_flags, iface_desc->bInterfaceNumber)) + data->use_send_setup = 1; + + if (device_flags & ZLP) -- 2.47.3