kernel: bump 4.19 to 4.19.90

Refreshed all patches.

Remove upstreamed:
- 010-dmaengine-dw-dmac-implement-dma-prot.patch
- 950-0148-Increase-firmware-call-buffer-size-to-48-bytes.patch
- 950-0206-Mailbox-firmware-calls-now-use-kmalloc-2749.patch
- 402-leds-trigger-netdev-fix-handling-on-interface-rename.patch

Fixes:
- CVE-2019-19332

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
[Add 010-dt-bindings-dmaengine-dw-dmac-add-protection-control.patch]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit is contained in:
Koen Vandeputte
2019-12-18 16:38:57 +01:00
committed by Hauke Mehrtens
parent 7604e53d5f
commit e115fa478f
35 changed files with 155 additions and 388 deletions

View File

@@ -14,7 +14,7 @@ use the same logic.
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -2578,7 +2578,12 @@ static int pl011_setup_port(struct devic
@@ -2576,7 +2576,12 @@ static int pl011_setup_port(struct devic
if (IS_ERR(base))
return PTR_ERR(base);

View File

@@ -26,7 +26,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -1652,6 +1652,23 @@ static void pl011_put_poll_char(struct u
@@ -1650,6 +1650,23 @@ static void pl011_put_poll_char(struct u
#endif /* CONFIG_CONSOLE_POLL */
@@ -50,7 +50,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
static int pl011_hwinit(struct uart_port *port)
{
struct uart_amba_port *uap =
@@ -1668,7 +1685,7 @@ static int pl011_hwinit(struct uart_port
@@ -1666,7 +1683,7 @@ static int pl011_hwinit(struct uart_port
if (retval)
return retval;
@@ -59,7 +59,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
/* Clear pending error and receive interrupts */
pl011_write(UART011_OEIS | UART011_BEIS | UART011_PEIS |
@@ -2324,7 +2341,7 @@ static int __init pl011_console_setup(st
@@ -2322,7 +2339,7 @@ static int __init pl011_console_setup(st
plat->init();
}
@@ -68,7 +68,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
if (uap->vendor->fixed_options) {
baud = uap->fixed_baud;
@@ -2509,6 +2526,7 @@ static struct uart_driver amba_reg = {
@@ -2507,6 +2524,7 @@ static struct uart_driver amba_reg = {
.cons = AMBA_CONSOLE,
};
@@ -76,7 +76,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
static int pl011_probe_dt_alias(int index, struct device *dev)
{
struct device_node *np;
@@ -2540,6 +2558,7 @@ static int pl011_probe_dt_alias(int inde
@@ -2538,6 +2556,7 @@ static int pl011_probe_dt_alias(int inde
return ret;
}

View File

@@ -17,7 +17,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -1385,6 +1385,7 @@ static bool pl011_tx_char(struct uart_am
@@ -1383,6 +1383,7 @@ static bool pl011_tx_char(struct uart_am
return false; /* unable to transmit character */
pl011_write(c, uap, REG_DR);

View File

@@ -33,7 +33,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -2661,6 +2661,11 @@ static int pl011_probe(struct amba_devic
@@ -2659,6 +2659,11 @@ static int pl011_probe(struct amba_devic
if (IS_ERR(uap->clk))
return PTR_ERR(uap->clk);

View File

@@ -27,7 +27,7 @@ Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c
@@ -32,6 +32,8 @@ struct rpi_firmware {
@@ -31,6 +31,8 @@ struct rpi_firmware {
u32 enabled;
};
@@ -36,7 +36,7 @@ Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
static DEFINE_MUTEX(transaction_lock);
static void response_callback(struct mbox_client *cl, void *msg)
@@ -229,6 +231,7 @@ static int rpi_firmware_probe(struct pla
@@ -230,6 +232,7 @@ static int rpi_firmware_probe(struct pla
init_completion(&fw->c);
platform_set_drvdata(pdev, fw);
@@ -44,7 +44,7 @@ Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
rpi_firmware_print_firmware_revision(fw);
rpi_register_hwmon_driver(dev, fw);
@@ -243,6 +246,7 @@ static int rpi_firmware_remove(struct pl
@@ -244,6 +247,7 @@ static int rpi_firmware_remove(struct pl
platform_device_unregister(rpi_hwmon);
rpi_hwmon = NULL;
mbox_free_channel(fw->chan);
@@ -52,7 +52,7 @@ Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
return 0;
}
@@ -255,7 +259,7 @@ static int rpi_firmware_remove(struct pl
@@ -256,7 +260,7 @@ static int rpi_firmware_remove(struct pl
*/
struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)
{
@@ -61,7 +61,7 @@ Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
if (!pdev)
return NULL;
@@ -278,7 +282,18 @@ static struct platform_driver rpi_firmwa
@@ -279,7 +283,18 @@ static struct platform_driver rpi_firmwa
.probe = rpi_firmware_probe,
.remove = rpi_firmware_remove,
};

View File

@@ -15890,7 +15890,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
-Wno-avoid_unnecessary_addr_size \
-Wno-alias_paths \
-Wno-graph_child_address \
@@ -292,6 +293,18 @@ cmd_dtc = mkdir -p $(dir ${dtc-tmp}) ; \
@@ -293,6 +294,18 @@ cmd_dtc = mkdir -p $(dir ${dtc-tmp}) ; \
$(obj)/%.dtb: $(src)/%.dts $(DTC) FORCE
$(call if_changed_dep,dtc)

View File

@@ -56,7 +56,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
#endif
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -496,6 +496,9 @@ do { \
@@ -514,6 +514,9 @@ do { \
extern unsigned long __must_check
arm_copy_from_user(void *to, const void __user *from, unsigned long n);

View File

@@ -13,7 +13,7 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c
@@ -46,7 +46,7 @@ static void response_callback(struct mbo
@@ -45,7 +45,7 @@ static void response_callback(struct mbo
* Sends a request to the firmware through the BCM2835 mailbox driver,
* and synchronously waits for the reply.
*/
@@ -22,7 +22,7 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
rpi_firmware_transaction(struct rpi_firmware *fw, u32 chan, u32 data)
{
u32 message = MBOX_MSG(chan, data);
@@ -67,6 +67,7 @@ rpi_firmware_transaction(struct rpi_firm
@@ -66,6 +66,7 @@ rpi_firmware_transaction(struct rpi_firm
return ret;
}

View File

@@ -18,10 +18,10 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
#include <linux/of_platform.h>
#include <linux/platform_device.h>
+#include <linux/reboot.h>
#include <linux/slab.h>
#include <soc/bcm2835/raspberrypi-firmware.h>
#define MBOX_MSG(chan, data28) (((data28) & ~0xf) | ((chan) & 0xf))
@@ -174,6 +175,26 @@ int rpi_firmware_property(struct rpi_fir
@@ -175,6 +176,26 @@ int rpi_firmware_property(struct rpi_fir
}
EXPORT_SYMBOL_GPL(rpi_firmware_property);
@@ -48,7 +48,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
static void
rpi_firmware_print_firmware_revision(struct rpi_firmware *fw)
{
@@ -284,15 +305,32 @@ static struct platform_driver rpi_firmwa
@@ -285,15 +306,32 @@ static struct platform_driver rpi_firmwa
.remove = rpi_firmware_remove,
};

View File

@@ -16,7 +16,7 @@ Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c
@@ -31,6 +31,7 @@ struct rpi_firmware {
@@ -30,6 +30,7 @@ struct rpi_firmware {
struct mbox_chan *chan; /* The property channel. */
struct completion c;
u32 enabled;
@@ -24,9 +24,9 @@ Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
};
static struct platform_device *g_pdev;
@@ -171,6 +172,12 @@ int rpi_firmware_property(struct rpi_fir
data + sizeof(struct rpi_firmware_property_tag_header),
buf_size);
@@ -172,6 +173,12 @@ int rpi_firmware_property(struct rpi_fir
kfree(data);
+ if ((tag == RPI_FIRMWARE_GET_THROTTLED) &&
+ memcmp(&fw->get_throttled, tag_data, sizeof(fw->get_throttled))) {
@@ -37,7 +37,7 @@ Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
return ret;
}
EXPORT_SYMBOL_GPL(rpi_firmware_property);
@@ -195,6 +202,27 @@ static int rpi_firmware_notify_reboot(st
@@ -196,6 +203,27 @@ static int rpi_firmware_notify_reboot(st
return 0;
}
@@ -65,7 +65,7 @@ Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
static void
rpi_firmware_print_firmware_revision(struct rpi_firmware *fw)
{
@@ -227,6 +255,11 @@ rpi_register_hwmon_driver(struct device
@@ -228,6 +256,11 @@ rpi_register_hwmon_driver(struct device
rpi_hwmon = platform_device_register_data(dev, "raspberrypi-hwmon",
-1, NULL, 0);

View File

@@ -1,28 +0,0 @@
From 3118f1a2f29ae802a334963c2aded87d60bddd56 Mon Sep 17 00:00:00 2001
From: James Hughes <james.hughes@raspberrypi.org>
Date: Wed, 31 Oct 2018 13:00:46 +0000
Subject: [PATCH 148/806] Increase firmware call buffer size to 48 bytes
An assumption was made in commit a1547e0bc that 32 bytes
would be enough data buffer size for all firmware calls. However,
the axi performance monitor driver uses a call with 44 bytes
(RPI_FIRMWARE_GET_PERIPH_REG) to get the VC registers values.
Increase value to 48 to take this in to account.
Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
---
drivers/firmware/raspberrypi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c
@@ -22,7 +22,7 @@
#define MBOX_DATA28(msg) ((msg) & ~0xf)
#define MBOX_CHAN_PROPERTY 8
-#define MAX_RPI_FW_PROP_BUF_SIZE 32
+#define MAX_RPI_FW_PROP_BUF_SIZE 48
static struct platform_device *rpi_hwmon;

View File

@@ -1,89 +0,0 @@
From 01995961823e4185f687c02cf326d78ba1b6b7bf Mon Sep 17 00:00:00 2001
From: James Hughes <JamesH65@users.noreply.github.com>
Date: Tue, 13 Nov 2018 17:27:00 +0000
Subject: [PATCH 206/806] Mailbox firmware calls now use kmalloc (#2749)
A previous change moved away from variable stack
allocation of a data buffer to a fixed maximum size.
However, some mailbox calls use larger data buffers
than the maximum allowed. This change moves from
stack storage to kmalloc to ensure all sizes are
catered for.
Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
---
drivers/firmware/raspberrypi.c | 35 +++++++++++++++++-----------------
1 file changed, 18 insertions(+), 17 deletions(-)
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c
@@ -15,6 +15,7 @@
#include <linux/of_platform.h>
#include <linux/platform_device.h>
#include <linux/reboot.h>
+#include <linux/slab.h>
#include <soc/bcm2835/raspberrypi-firmware.h>
#define MBOX_MSG(chan, data28) (((data28) & ~0xf) | ((chan) & 0xf))
@@ -22,8 +23,6 @@
#define MBOX_DATA28(msg) ((msg) & ~0xf)
#define MBOX_CHAN_PROPERTY 8
-#define MAX_RPI_FW_PROP_BUF_SIZE 48
-
static struct platform_device *rpi_hwmon;
struct rpi_firmware {
@@ -149,28 +148,28 @@ EXPORT_SYMBOL_GPL(rpi_firmware_property_
int rpi_firmware_property(struct rpi_firmware *fw,
u32 tag, void *tag_data, size_t buf_size)
{
- /* Single tags are very small (generally 8 bytes), so the
- * stack should be safe.
- */
- u8 data[sizeof(struct rpi_firmware_property_tag_header) +
- MAX_RPI_FW_PROP_BUF_SIZE];
- struct rpi_firmware_property_tag_header *header =
- (struct rpi_firmware_property_tag_header *)data;
int ret;
+ struct rpi_firmware_property_tag_header *header;
- if (WARN_ON(buf_size > sizeof(data) - sizeof(*header)))
- return -EINVAL;
+ /* Some mailboxes can use over 1k bytes. Rather than checking
+ * size and using stack or kmalloc depending on requirements,
+ * just use kmalloc. Mailboxes don't get called enough to worry
+ * too much about the time taken in the allocation.
+ */
+ void *data = kmalloc(sizeof(*header) + buf_size, GFP_KERNEL);
+ if (!data)
+ return -ENOMEM;
+
+ header = data;
header->tag = tag;
header->buf_size = buf_size;
header->req_resp_size = 0;
- memcpy(data + sizeof(struct rpi_firmware_property_tag_header),
- tag_data, buf_size);
+ memcpy(data + sizeof(*header), tag_data, buf_size);
- ret = rpi_firmware_property_list(fw, &data, buf_size + sizeof(*header));
- memcpy(tag_data,
- data + sizeof(struct rpi_firmware_property_tag_header),
- buf_size);
+ ret = rpi_firmware_property_list(fw, data, buf_size + sizeof(*header));
+
+ memcpy(tag_data, data + sizeof(*header), buf_size);
if ((tag == RPI_FIRMWARE_GET_THROTTLED) &&
memcmp(&fw->get_throttled, tag_data, sizeof(fw->get_throttled))) {
@@ -178,6 +177,8 @@ int rpi_firmware_property(struct rpi_fir
sysfs_notify(&fw->cl.dev->kobj, NULL, "get_throttled");
}
+ kfree(data);
+
return ret;
}
EXPORT_SYMBOL_GPL(rpi_firmware_property);

View File

@@ -16,7 +16,7 @@ Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -1735,7 +1735,8 @@ static int pl011_allocate_irq(struct uar
@@ -1733,7 +1733,8 @@ static int pl011_allocate_irq(struct uar
{
pl011_write(uap->im, uap, REG_IMSC);

View File

@@ -20,7 +20,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1428,6 +1428,87 @@ command_cleanup:
@@ -1425,6 +1425,87 @@ command_cleanup:
}
/*
@@ -108,7 +108,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
* non-error returns are a promise to giveback() the urb later
* we drop ownership so next owner (or urb unlink) can get it
*/
@@ -1495,6 +1576,11 @@ static int xhci_urb_enqueue(struct usb_h
@@ -1492,6 +1573,11 @@ static int xhci_urb_enqueue(struct usb_h
}
}

View File

@@ -11,7 +11,7 @@ This reverts commit 1cf1071a79f320bc4497a3ade77431f04442eb17.
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1428,87 +1428,6 @@ command_cleanup:
@@ -1425,87 +1425,6 @@ command_cleanup:
}
/*
@@ -99,7 +99,7 @@ This reverts commit 1cf1071a79f320bc4497a3ade77431f04442eb17.
* non-error returns are a promise to giveback() the urb later
* we drop ownership so next owner (or urb unlink) can get it
*/
@@ -1576,11 +1495,6 @@ static int xhci_urb_enqueue(struct usb_h
@@ -1573,11 +1492,6 @@ static int xhci_urb_enqueue(struct usb_h
}
}

View File

@@ -15,7 +15,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1428,6 +1428,103 @@ command_cleanup:
@@ -1425,6 +1425,103 @@ command_cleanup:
}
/*
@@ -119,7 +119,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
* non-error returns are a promise to giveback() the urb later
* we drop ownership so next owner (or urb unlink) can get it
*/
@@ -5220,6 +5317,7 @@ static const struct hc_driver xhci_hc_dr
@@ -5217,6 +5314,7 @@ static const struct hc_driver xhci_hc_dr
.endpoint_reset = xhci_endpoint_reset,
.check_bandwidth = xhci_check_bandwidth,
.reset_bandwidth = xhci_reset_bandwidth,

View File

@@ -42,15 +42,15 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
#ifdef CONFIG_DMA_ENGINE
/* DMA stuff */
bool using_tx_dma;
@@ -814,6 +815,7 @@ __acquires(&uap->port.lock)
@@ -813,6 +814,7 @@ __acquires(&uap->port.lock)
if (!uap->using_tx_dma)
return;
/* Avoid deadlock with the DMA engine callback */
+ uap->irq_locked = 0;
spin_unlock(&uap->port.lock);
dmaengine_terminate_all(uap->dmatx.chan);
spin_lock(&uap->port.lock);
@@ -941,6 +943,7 @@ static void pl011_dma_rx_chars(struct ua
dmaengine_terminate_async(uap->dmatx.chan);
if (uap->dmatx.queued) {
@@ -939,6 +941,7 @@ static void pl011_dma_rx_chars(struct ua
fifotaken = pl011_fifo_to_tty(uap);
}
@@ -58,7 +58,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
spin_unlock(&uap->port.lock);
dev_vdbg(uap->port.dev,
"Took %d chars from DMA buffer and %d chars from the FIFO\n",
@@ -1349,6 +1352,7 @@ __acquires(&uap->port.lock)
@@ -1347,6 +1350,7 @@ __acquires(&uap->port.lock)
{
pl011_fifo_to_tty(uap);
@@ -66,7 +66,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
spin_unlock(&uap->port.lock);
tty_flip_buffer_push(&uap->port.state->port);
/*
@@ -1484,6 +1488,7 @@ static irqreturn_t pl011_int(int irq, vo
@@ -1482,6 +1486,7 @@ static irqreturn_t pl011_int(int irq, vo
int handled = 0;
spin_lock_irqsave(&uap->port.lock, flags);
@@ -74,7 +74,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
status = pl011_read(uap, REG_RIS) & uap->im;
if (status) {
do {
@@ -1503,7 +1508,7 @@ static irqreturn_t pl011_int(int irq, vo
@@ -1501,7 +1506,7 @@ static irqreturn_t pl011_int(int irq, vo
UART011_CTSMIS|UART011_RIMIS))
pl011_modem_status(uap);
if (status & UART011_TXIS)

View File

@@ -22,7 +22,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -2491,9 +2491,11 @@ int xhci_mem_init(struct xhci_hcd *xhci,
@@ -2495,9 +2495,11 @@ int xhci_mem_init(struct xhci_hcd *xhci,
* Event ring setup: Allocate a normal ring, but also setup
* the event ring segment table (ERST). Section 4.9.3.
*/
@@ -36,7 +36,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
if (!xhci->event_ring)
goto fail;
if (xhci_check_trb_in_td_math(xhci) < 0)
@@ -2506,7 +2508,7 @@ int xhci_mem_init(struct xhci_hcd *xhci,
@@ -2510,7 +2512,7 @@ int xhci_mem_init(struct xhci_hcd *xhci,
/* set ERST count with the number of entries in the segment table */
val = readl(&xhci->ir_set->erst_size);
val &= ERST_SIZE_MASK;