summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-03-15usb: dwc3: Rework clock initialization to be more flexibleJohn Stultz
The dwc3 core binding specifies three clocks: ref, bus_early, and suspend which are all controlled in the driver together. However some variants of the hardware my not have all three clks, or some may have more. Usually this was handled by using the dwc3-of-simple glue driver, but that resulted in a proliferation of bindings for for every variant, when the only difference was the clocks and resets lists. So this patch reworks the reading of the clks from the dts to use devm_clk_bulk_get_all() will will fetch all the clocks specified in the dts together. This patch was recommended by Rob Herring <robh@kernel.org> as an alternative to creating multiple bindings for each variant of hardware. Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Rob Herring <robh+dt@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> CC: ShuFan Lee <shufan_lee@richtek.com> Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com> Cc: Suzuki K Poulose <suzuki.poulose@arm.com> Cc: Chunfeng Yun <chunfeng.yun@mediatek.com> Cc: Yu Chen <chenyu56@huawei.com> Cc: Felipe Balbi <balbi@kernel.org> Cc: Hans de Goede <hdegoede@redhat.com> Cc: Andy Shevchenko <andy.shevchenko@gmail.com> Cc: Jun Li <lijun.kernel@gmail.com> Cc: Valentin Schneider <valentin.schneider@arm.com> Cc: Guillaume Gardet <Guillaume.Gardet@arm.com> Cc: Jack Pham <jackp@codeaurora.org> Cc: linux-usb@vger.kernel.org Cc: devicetree@vger.kernel.org Suggested-by: Rob Herring <robh@kernel.org> Signed-off-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15dt-bindings: usb: dwc3: Allow clock list & resets to be more flexibleJohn Stultz
Rather then adding another device specific binding to support hikey960, Rob Herring suggested we expand the current dwc3 binding to allow for variable numbers of clocks and resets. Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Rob Herring <robh+dt@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> CC: ShuFan Lee <shufan_lee@richtek.com> Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com> Cc: Suzuki K Poulose <suzuki.poulose@arm.com> Cc: Chunfeng Yun <chunfeng.yun@mediatek.com> Cc: Yu Chen <chenyu56@huawei.com> Cc: Felipe Balbi <balbi@kernel.org> Cc: Hans de Goede <hdegoede@redhat.com> Cc: Andy Shevchenko <andy.shevchenko@gmail.com> Cc: Jun Li <lijun.kernel@gmail.com> Cc: Valentin Schneider <valentin.schneider@arm.com> Cc: Guillaume Gardet <Guillaume.Gardet@arm.com> Cc: Jack Pham <jackp@codeaurora.org> Cc: linux-usb@vger.kernel.org Cc: devicetree@vger.kernel.org Suggested-by: Rob Herring <robh@kernel.org> Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15usb: dwc3: Add support for role-switch-default-mode bindingJohn Stultz
Support the new role-switch-default-mode binding for configuring the default role the controller assumes as when the usb role is USB_ROLE_NONE This patch was split out from a larger patch originally by Yu Chen <chenyu56@huawei.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Rob Herring <robh+dt@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> CC: ShuFan Lee <shufan_lee@richtek.com> Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com> Cc: Suzuki K Poulose <suzuki.poulose@arm.com> Cc: Chunfeng Yun <chunfeng.yun@mediatek.com> Cc: Yu Chen <chenyu56@huawei.com> Cc: Felipe Balbi <balbi@kernel.org> Cc: Hans de Goede <hdegoede@redhat.com> Cc: Andy Shevchenko <andy.shevchenko@gmail.com> Cc: Jun Li <lijun.kernel@gmail.com> Cc: Valentin Schneider <valentin.schneider@arm.com> Cc: Guillaume Gardet <Guillaume.Gardet@arm.com> Cc: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Cc: Jack Pham <jackp@codeaurora.org> Cc: linux-usb@vger.kernel.org Cc: devicetree@vger.kernel.org Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15dt-bindings: usb: generic: Add role-switch-default-mode bindingJohn Stultz
Add binding to configure the default role the controller assumes is host mode when the usb role is USB_ROLE_NONE. Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Rob Herring <robh+dt@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> CC: ShuFan Lee <shufan_lee@richtek.com> Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com> Cc: Suzuki K Poulose <suzuki.poulose@arm.com> Cc: Chunfeng Yun <chunfeng.yun@mediatek.com> Cc: Yu Chen <chenyu56@huawei.com> Cc: Felipe Balbi <balbi@kernel.org> Cc: Hans de Goede <hdegoede@redhat.com> Cc: Andy Shevchenko <andy.shevchenko@gmail.com> Cc: Jun Li <lijun.kernel@gmail.com> Cc: Valentin Schneider <valentin.schneider@arm.com> Cc: Guillaume Gardet <Guillaume.Gardet@arm.com> Cc: Jack Pham <jackp@codeaurora.org> Cc: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Cc: linux-usb@vger.kernel.org Cc: devicetree@vger.kernel.org Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15usb: dwc3: Registering a role switch in the DRD code.Yu Chen
The Type-C drivers use USB role switch API to inform the system about the negotiated data role, so registering a role switch in the DRD code in order to support platforms with USB Type-C connectors. Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Rob Herring <robh+dt@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> CC: ShuFan Lee <shufan_lee@richtek.com> Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com> Cc: Suzuki K Poulose <suzuki.poulose@arm.com> Cc: Chunfeng Yun <chunfeng.yun@mediatek.com> Cc: Yu Chen <chenyu56@huawei.com> Cc: Felipe Balbi <balbi@kernel.org> Cc: Hans de Goede <hdegoede@redhat.com> Cc: Andy Shevchenko <andy.shevchenko@gmail.com> Cc: Jun Li <lijun.kernel@gmail.com> Cc: Valentin Schneider <valentin.schneider@arm.com> Cc: Guillaume Gardet <Guillaume.Gardet@arm.com> Cc: Jack Pham <jackp@codeaurora.org> Cc: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Cc: linux-usb@vger.kernel.org Cc: devicetree@vger.kernel.org Suggested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by: Yu Chen <chenyu56@huawei.com> Signed-off-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15usb: dwc3: core: add support for disabling SS instances in park modeNeil Armstrong
In certain circumstances, the XHCI SuperSpeed instance in park mode can fail to recover, thus on Amlogic G12A/G12B/SM1 SoCs when there is high load on the single XHCI SuperSpeed instance, the controller can crash like: xhci-hcd xhci-hcd.0.auto: xHCI host not responding to stop endpoint command. xhci-hcd xhci-hcd.0.auto: Host halt failed, -110 xhci-hcd xhci-hcd.0.auto: xHCI host controller not responding, assume dead xhci-hcd xhci-hcd.0.auto: xHCI host not responding to stop endpoint command. hub 2-1.1:1.0: hub_ext_port_status failed (err = -22) xhci-hcd xhci-hcd.0.auto: HC died; cleaning up usb 2-1.1-port1: cannot reset (err = -22) Setting the PARKMODE_DISABLE_SS bit in the DWC3_USB3_GUCTL1 mitigates the issue. The bit is described as : "When this bit is set to '1' all SS bus instances in park mode are disabled" Synopsys explains: The GUCTL1.PARKMODE_DISABLE_SS is only available in dwc_usb3 controller running in host mode. This should not be set for other IPs. This can be disabled by default based on IP, but I recommend to have a property to enable this feature for devices that need this. CC: Dongjin Kim <tobetter@gmail.com> Cc: Jianxin Pan <jianxin.pan@amlogic.com> Cc: Thinh Nguyen <thinhn@synopsys.com> Cc: Jun Li <lijun.kernel@gmail.com> Reported-by: Tim <elatllat@gmail.com> Signed-off-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15doc: dt: bindings: usb: dwc3: Update entries for disabling SS instances in ↵Neil Armstrong
park mode This patch updates the documentation with the information related to the quirks that needs to be added for disabling all SuperSpeed XHCI instances in park mode. Cc: Dongjin Kim <tobetter@gmail.com> Cc: Jianxin Pan <jianxin.pan@amlogic.com> Cc: Thinh Nguyen <thinhn@synopsys.com> Cc: Jun Li <lijun.kernel@gmail.com> Reported-by: Tim <elatllat@gmail.com> Signed-off-by: Neil Armstrong <narmstrong@baylibre.com> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15usb: dwc3: gadget: Wrap around when skip TRBsThinh Nguyen
When skipping TRBs, we need to account for wrapping around the ring buffer and not modifying some invalid TRBs. Without this fix, dwc3 won't be able to check for available TRBs. Cc: stable <stable@vger.kernel.org> Fixes: 7746a8dfb3f9 ("usb: dwc3: gadget: extract dwc3_gadget_ep_skip_trbs()") Signed-off-by: Thinh Nguyen <thinhn@synopsys.com> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15usb: dwc3: gadget: Don't clear flags before transfer endedThinh Nguyen
We track END_TRANSFER command completion. Don't clear transfer started/ended flag prematurely. Otherwise, we'd run into the problem with restarting transfer before END_TRANSFER command finishes. Fixes: 6d8a019614f3 ("usb: dwc3: gadget: check for Missed Isoc from event status") Signed-off-by: Thinh Nguyen <thinhn@synopsys.com> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15usb: dwc3: Remove kernel doc annotation where it's not neededAndy Shevchenko
The main comment in the file mistakenly marked with kernel doc annotation which makes the parser unhappy: .../dwc3/host.c:16: warning: Function parameter or member 'dwc' not described in 'dwc3_host_get_irq' Drop kernel doc annotation from host.c module. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15usb: dwc3: Add ACPI support for xHCI portsAndy Shevchenko
The ACPI companion of the adapter has to be set for xHCI controller code to read and attach the ports described in the ACPI table. Use ACPI_COMPANION_SET macro to set this. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15usb: dwc3: exynos: Add support for Exynos5422 suspend clkAnand Moon
Exynos5422 DWC3 module support two clk USBD300 and SCLK_USBD300 so add missing code to enable/disable code and suspend clk, for this add a new compatible samsung,exynos5420-dwusb3 to help configure dwc3 code and dwc3 suspend clock. Suspend clock controls the PHY power change from P0 to P1/P2/P3 during U0 to U1/U2/U3 transition. Signed-off-by: Anand Moon <linux.amoon@gmail.com> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15usb: dwc3: meson-g12a: Don't use ret uninitialized in dwc3_meson_g12a_otg_initNathan Chancellor
Clang warns: ../drivers/usb/dwc3/dwc3-meson-g12a.c:421:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] if (priv->otg_mode == USB_DR_MODE_OTG) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../drivers/usb/dwc3/dwc3-meson-g12a.c:455:9: note: uninitialized use occurs here return ret; ^~~ ../drivers/usb/dwc3/dwc3-meson-g12a.c:421:2: note: remove the 'if' if its condition is always true if (priv->otg_mode == USB_DR_MODE_OTG) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../drivers/usb/dwc3/dwc3-meson-g12a.c:415:9: note: initialize the variable 'ret' to silence this warning int ret, irq; ^ = 0 1 warning generated. It is not wrong, ret is only used when that if statement is true. Just directly return 0 at the end to avoid this. Fixes: 729149c53f04 ("usb: dwc3: Add Amlogic A1 DWC3 glue") Reported-by: kbuild test robot <lkp@intel.com> Link: https://groups.google.com/d/msg/clang-built-linux/w5iBENco_m4/PPuXreAxBQAJ Link: https://github.com/ClangBuiltLinux/linux/issues/869 Signed-off-by: Nathan Chancellor <natechancellor@gmail.com> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15usb: cdns3: remove redundant assignment to pointer trbColin Ian King
Pointer trb being assigned with a value that is never read, it is assigned a new value later on. The assignment is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15usb: gadget: remove redundant assignment to variable statusColin Ian King
Variable status is being assigned with a value that is never read, it is assigned a new value immediately afterwards. The assignment is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15usb: gadget: xudc: Remove redundant platform_get_irq error messageYueHaibing
platform_get_irq() will call dev_err() itself on failure, so there is no need for the driver to also do this. This is detected by coccinelle. Acked-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Nagarjuna Kristam <nkristam@nvidia.com> Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15usb: dwc2: add support for STM32MP15 SoCs USB OTG HS and FSAmelie Delaunay
This patch introduces a new parameter to activate external ID pin and valid vbus level detection, required on STM32MP15 SoC to support dual role, either in HS or FS. The STM32MP15 SoC uses the GGPIO register to enable the level detection. The level detector requires to be powered. Also adds the params structures for STM32MP15 OTG HS and STM32MP1 OTG FS. Acked-by: Minas Harutyunyan <hminas@synopsys.com> Signed-off-by: Amelie Delaunay <amelie.delaunay@st.com> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15usb: dwc3: Add Amlogic A1 DWC3 glueHanjie Lin
Adds support for Amlogic A1 USB Control Glue HW. The Amlogic A1 SoC Family embeds 1 USB Controllers: - a DWC3 IP configured as Host for USB2 and USB3 A glue connects the controllers to the USB2 PHY of A1 SoC. Signed-off-by: Yue Wang <yue.wang@amlogic.com> Signed-off-by: Hanjie Lin <hanjie.lin@amlogic.com> Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15dt-bindings: usb: dwc3: Add the Amlogic A1 Family DWC3 Glue BindingsHanjie Lin
The Amlogic A1 SoC Family embeds 1 USB Controllers: - a DWC3 IP configured as Host for USB2 and USB3 A glue connects the controllers to the USB2 PHY of A1 SoC. Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: Yue Wang <yue.wang@amlogic.com> Signed-off-by: Hanjie Lin <hanjie.lin@amlogic.com> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15usb: gadget: add udc driver for max3420Jassi Brar
The MAX3420 is USB2.0 only, UDC-over-SPI controller. This driver also supports the peripheral mode of MAX3421. Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15dt-bindings: max3421-udc: add dt bindings for MAX3420 UDCJassi Brar
Add YAML dt bindings for Maxim MAX3420 UDC controller. Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15usb: dwc3: trace: print enqueue/dequeue pointers tooFelipe Balbi
By printing enqueue/dequeue pointers, we can make sure that our TRB handling is correct. We've had a recent situation where we were not always dequeueing all TRBs in an SG list and this helped figure out what the problem was. Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-03-15geneve: move debug check after netdev unregisterFlorian Westphal
The debug check must be done after unregister_netdevice_many() call -- the list_del() for this is done inside .ndo_stop. Fixes: 2843a25348f8 ("geneve: speedup geneve tunnels dismantle") Reported-and-tested-by: <syzbot+68a8ed58e3d17c700de5@syzkaller.appspotmail.com> Cc: Haishuang Yan <yanhaishuang@cmss.chinamobile.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-03-15net/packet: tpacket_rcv: avoid a producer race conditionWillem de Bruijn
PACKET_RX_RING can cause multiple writers to access the same slot if a fast writer wraps the ring while a slow writer is still copying. This is particularly likely with few, large, slots (e.g., GSO packets). Synchronize kernel thread ownership of rx ring slots with a bitmap. Writers acquire a slot race-free by testing tp_status TP_STATUS_KERNEL while holding the sk receive queue lock. They release this lock before copying and set tp_status to TP_STATUS_USER to release to userspace when done. During copying, another writer may take the lock, also see TP_STATUS_KERNEL, and start writing to the same slot. Introduce a new rx_owner_map bitmap with a bit per slot. To acquire a slot, test and set with the lock held. To release race-free, update tp_status and owner bit as a transaction, so take the lock again. This is the one of a variety of discussed options (see Link below): * instead of a shadow ring, embed the data in the slot itself, such as in tp_padding. But any test for this field may match a value left by userspace, causing deadlock. * avoid the lock on release. This leaves a small race if releasing the shadow slot before setting TP_STATUS_USER. The below reproducer showed that this race is not academic. If releasing the slot after tp_status, the race is more subtle. See the first link for details. * add a new tp_status TP_KERNEL_OWNED to avoid the transactional store of two fields. But, legacy applications may interpret all non-zero tp_status as owned by the user. As libpcap does. So this is possible only opt-in by newer processes. It can be added as an optional mode. * embed the struct at the tail of pg_vec to avoid extra allocation. The implementation proved no less complex than a separate field. The additional locking cost on release adds contention, no different than scaling on multicore or multiqueue h/w. In practice, below reproducer nor small packet tcpdump showed a noticeable change in perf report in cycles spent in spinlock. Where contention is problematic, packet sockets support mitigation through PACKET_FANOUT. And we can consider adding opt-in state TP_KERNEL_OWNED. Easy to reproduce by running multiple netperf or similar TCP_STREAM flows concurrently with `tcpdump -B 129 -n greater 60000`. Based on an earlier patchset by Jon Rosen. See links below. I believe this issue goes back to the introduction of tpacket_rcv, which predates git history. Link: https://www.mail-archive.com/netdev@vger.kernel.org/msg237222.html Suggested-by: Jon Rosen <jrosen@cisco.com> Signed-off-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Jon Rosen <jrosen@cisco.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-03-15net: ip_gre: Separate ERSPAN newlink / changelink callbacksPetr Machata
ERSPAN shares most of the code path with GRE and gretap code. While that helps keep the code compact, it is also error prone. Currently a broken userspace can turn a gretap tunnel into a de facto ERSPAN one by passing IFLA_GRE_ERSPAN_VER. There has been a similar issue in ip6gretap in the past. To prevent these problems in future, split the newlink and changelink code paths. Split the ERSPAN code out of ipgre_netlink_parms() into a new function erspan_netlink_parms(). Extract a piece of common logic from ipgre_newlink() and ipgre_changelink() into ipgre_newlink_encap_setup(). Add erspan_newlink() and erspan_changelink(). Fixes: 84e54fe0a5ea ("gre: introduce native tunnel support for ERSPAN") Signed-off-by: Petr Machata <petrm@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-03-15cxgb4: fix delete filter entry fail in unload pathShahjada Abul Husain
Currently, the hardware TID index is assumed to start from index 0. However, with the following changeset, commit c21939998802 ("cxgb4: add support for high priority filters") hardware TID index can start after the high priority region, which has introduced a regression resulting in remove filters entry failure for cxgb4 unload path. This patch fix that. Fixes: c21939998802 ("cxgb4: add support for high priority filters") Signed-off-by: Shahjada Abul Husain <shahjada@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-03-14net: stmmac: platform: Fix misleading interrupt error msgMarkus Fuchs
Not every stmmac based platform makes use of the eth_wake_irq or eth_lpi interrupts. Use the platform_get_irq_byname_optional variant for these interrupts, so no error message is displayed, if they can't be found. Rather print an information to hint something might be wrong to assist debugging on platforms which use these interrupts. Signed-off-by: Markus Fuchs <mklntf@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-03-14net/bpfilter: fix dprintf usage for /dev/kmsgBruno Meneguele
The bpfilter UMH code was recently changed to log its informative messages to /dev/kmsg, however this interface doesn't support SEEK_CUR yet, used by dprintf(). As result dprintf() returns -EINVAL and doesn't log anything. However there already had some discussions about supporting SEEK_CUR into /dev/kmsg interface in the past it wasn't concluded. Since the only user of that from userspace perspective inside the kernel is the bpfilter UMH (userspace) module it's better to correct it here instead waiting a conclusion on the interface. Fixes: 36c4357c63f3 ("net: bpfilter: print umh messages to /dev/kmsg") Signed-off-by: Bruno Meneguele <bmeneg@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-03-14net_sched: keep alloc_hash updated after hash allocationCong Wang
In commit 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex") I moved cp->hash calculation before the first tcindex_alloc_perfect_hash(), but cp->alloc_hash is left untouched. This difference could lead to another out of bound access. cp->alloc_hash should always be the size allocated, we should update it after this tcindex_alloc_perfect_hash(). Reported-and-tested-by: syzbot+dcc34d54d68ef7d2d53d@syzkaller.appspotmail.com Reported-and-tested-by: syzbot+c72da7b9ed57cde6fca2@syzkaller.appspotmail.com Fixes: 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex") Cc: Jamal Hadi Salim <jhs@mojatatu.com> Cc: Jiri Pirko <jiri@resnulli.us> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-03-14net_sched: hold rtnl lock in tcindex_partial_destroy_work()Cong Wang
syzbot reported a use-after-free in tcindex_dump(). This is due to the lack of RTNL in the deferred rcu work. We queue this work with RTNL in tcindex_change(), later, tcindex_dump() is called: fh = tp->ops->get(tp, t->tcm_handle); ... err = tp->ops->change(..., &fh, ...); tfilter_notify(..., fh, ...); but there is nothing to serialize the pending tcindex_partial_destroy_work() with tcindex_dump(). Fix this by simply holding RTNL in tcindex_partial_destroy_work(), so that it won't be called until RTNL is released after tc_new_tfilter() is completed. Reported-and-tested-by: syzbot+653090db2562495901dc@syzkaller.appspotmail.com Fixes: 3d210534cc93 ("net_sched: fix a race condition in tcindex_destroy()") Cc: Jamal Hadi Salim <jhs@mojatatu.com> Cc: Jiri Pirko <jiri@resnulli.us> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-03-14io-wq: hash dependent workPavel Begunkov
Enable io-wq hashing stuff for dependent works simply by re-enqueueing such requests. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2020-03-14io-wq: split hashing and enqueueingPavel Begunkov
It's a preparation patch removing io_wq_enqueue_hashed(), which now should be done by io_wq_hash_work() + io_wq_enqueue(). Also, set hash value for dependant works, and do it as late as possible, because req->file can be unavailable before. This hash will be ignored by io-wq. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2020-03-14io-wq: don't resched if there is no workPavel Begunkov
This little tweak restores the behaviour that was before the recent io_worker_handle_work() optimisation patches. It makes the function do cond_resched() and flush_signals() only if there is an actual work to execute. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2020-03-14io_uring: NULL-deref for IOSQE_{ASYNC,DRAIN}Pavel Begunkov
Processing links, io_submit_sqe() prepares requests, drops sqes, and passes them with sqe=NULL to io_queue_sqe(). There IOSQE_DRAIN and/or IOSQE_ASYNC requests will go through the same prep, which doesn't expect sqe=NULL and fail with NULL pointer deference. Always do full prepare including io_alloc_async_ctx() for linked requests, and then it can skip the second preparation. Cc: stable@vger.kernel.org # 5.5 Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2020-03-14Merge branch 'i2c/for-current' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "I2C has quite some regression fixes this time. One is also related to watchdogs, we have proper acks from Guenter for them" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: acpi: put device when verifying client fails misc: eeprom: at24: fix regulator underflow i2c: gpio: suppress error on probe defer macintosh: windfarm: fix MODINFO regression i2c: designware-pci: Fix BUG_ON during device removal i2c: i801: Do not add ICH_RES_IO_SMI for the iTCO_wdt device watchdog: iTCO_wdt: Make ICH_RES_IO_SMI optional watchdog: iTCO_wdt: Export vendorsupport
2020-03-14Merge tag 'arc-5.6-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC fixes from Vineet Gupta: - Fix __ALIGN_STR and __ALIGN to not use default junk padding - Misc Kconfig cleanups, header updates * tag 'arc-5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARC: define __ALIGN_STR and __ALIGN symbols for ARC ARC: show_regs: reduce lines of output ARC: Replace <linux/clk-provider.h> by <linux/of_clk.h> ARC: fpu: fix randconfig build error reported by 0-day test service ARC: fix some Kconfig typos ARC: Cleanup old Kconfig IO scheduler options
2020-03-14Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds
Pull kvm fixes from Paolo Bonzini: "Bugfixes for x86 and s390" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: nVMX: avoid NULL pointer dereference with incorrect EVMCS GPAs KVM: x86: Initializing all kvm_lapic_irq fields in ioapic_write_indirect KVM: VMX: Condition ENCLS-exiting enabling on CPU support for SGX1 KVM: s390: Also reset registers in sync regs for initial cpu reset KVM: fix Kconfig menu text for -Werror KVM: x86: remove stale comment from struct x86_emulate_ctxt KVM: x86: clear stale x86_emulate_ctxt->intercept value KVM: SVM: Fix the svm vmexit code for WRMSR KVM: X86: Fix dereference null cpufreq policy
2020-03-14iommu/vt-d: Populate debugfs if IOMMUs are detectedMegha Dey
Currently, the intel iommu debugfs directory(/sys/kernel/debug/iommu/intel) gets populated only when DMA remapping is enabled (dmar_disabled = 0) irrespective of whether interrupt remapping is enabled or not. Instead, populate the intel iommu debugfs directory if any IOMMUs are detected. Cc: Dan Carpenter <dan.carpenter@oracle.com> Fixes: ee2636b8670b1 ("iommu/vt-d: Enable base Intel IOMMU debugfs support") Signed-off-by: Megha Dey <megha.dey@linux.intel.com> Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> Signed-off-by: Joerg Roedel <jroedel@suse.de>
2020-03-14Merge tag 'clk-fixes-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "A small collection of fixes. I'll make another sweep soon to look for more fixes for this -rc series. - Mark device node const in of_clk_get_parent APIs to ease landing changes in users later - Fix flag for Qualcomm SC7180 video clocks where we thought it would never turn off but actually hardware takes care of it - Remove disp_cc_mdss_rscc_ahb_clk on Qualcomm SC7180 SoCs because this clk is always on anyway - Correct some bad dt-binding numbers for i.MX8MN SoCs" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: imx8mn: Fix incorrect clock defines clk: qcom: dispcc: Remove support of disp_cc_mdss_rscc_ahb_clk clk: qcom: videocc: Update the clock flag for video_cc_vcodec0_core_clk of: clk: Make of_clk_get_parent_{count,name}() parameter const
2020-03-14Merge branch 'kvm-null-pointer-fix' into kvm-masterPaolo Bonzini
2020-03-14KVM: nVMX: avoid NULL pointer dereference with incorrect EVMCS GPAsVitaly Kuznetsov
When an EVMCS enabled L1 guest on KVM will tries doing enlightened VMEnter with EVMCS GPA = 0 the host crashes because the evmcs_gpa != vmx->nested.hv_evmcs_vmptr condition in nested_vmx_handle_enlightened_vmptrld() will evaluate to false (as nested.hv_evmcs_vmptr is zeroed after init). The crash will happen on vmx->nested.hv_evmcs pointer dereference. Another problematic EVMCS ptr value is '-1' but it only causes host crash after nested_release_evmcs() invocation. The problem is exactly the same as with '0', we mistakenly think that the EVMCS pointer hasn't changed and thus nested.hv_evmcs_vmptr is valid. Resolve the issue by adding an additional !vmx->nested.hv_evmcs check to nested_vmx_handle_enlightened_vmptrld(), this way we will always be trying kvm_vcpu_map() when nested.hv_evmcs is NULL and this is supposed to catch all invalid EVMCS GPAs. Also, initialize hv_evmcs_vmptr to '0' in nested_release_evmcs() to be consistent with initialization where we don't currently set hv_evmcs_vmptr to '-1'. Cc: stable@vger.kernel.org Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-03-14cpufreq: Use scnprintf() for avoiding potential buffer overflowTakashi Iwai
Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Signed-off-by: Takashi Iwai <tiwai@suse.de> Acked-by: Viresh Kumar <viresh.kumar@linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2020-03-14cpuidle: psci: Split psci_dt_cpu_init_idle()Ulf Hansson
To make the code a bit more readable, let's move the OSI specific initialization out of the psci_dt_cpu_init_idle() and into a separate function. Reviewed-by: Sudeep Holla <sudeep.holla@arm.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2020-03-14PM / Domains: Allow no domain-idle-states DT property in genpd when parsingUlf Hansson
Commit 2c361684803e ("PM / Domains: Don't treat zero found compatible idle states as an error"), moved of_genpd_parse_idle_states() towards allowing none compatible idle state to be found for the device node, rather than returning an error code. However, it didn't consider that the "domain-idle-states" DT property may be missing as it's optional, which makes of_count_phandle_with_args() to return -ENOENT. Let's fix this to make the behaviour consistent. Fixes: 2c361684803e ("PM / Domains: Don't treat zero found compatible idle states as an error") Reported-by: Benjamin Gaignard <benjamin.gaignard@st.com> Cc: 4.20+ <stable@vger.kernel.org> # 4.20+ Reviewed-by: Sudeep Holla <sudeep.holla@arm.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2020-03-14Merge tag 'kvm-s390-master-5.6-1' of ↵Paolo Bonzini
git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into kvm-master KVM: s390: Fully do the CPU resets as intended With 7de3f1423ff9 ("KVM: s390: Add new reset vcpu API") we clarified the meaning of the reset ioctl to fully reset the CPU and not only the parts that can not be handled by userspace. Turns out that we missed some parts.
2020-03-14PM / hibernate: Remove unnecessary compat ioctl overridesEric Biggers
Since the SNAPSHOT_GET_IMAGE_SIZE, SNAPSHOT_AVAIL_SWAP_SIZE, and SNAPSHOT_ALLOC_SWAP_PAGE ioctls produce an loff_t result, and loff_t is always 64-bit even in the compat case, there's no reason to have the special compat handling for these ioctls. Just remove this unneeded code so that these ioctls call into snapshot_ioctl() directly, doing just the compat_ptr() conversion on the argument. (This unnecessary code was also causing a KMSAN false positive.) Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2020-03-14PM: hibernate: fix docs for ioctls that return loff_t via pointerEric Biggers
Correctly document how the SNAPSHOT_GET_IMAGE_SIZE and SNAPSHOT_AVAIL_SWAP_SIZE ioctls return their result. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2020-03-14Documentation: intel_pstate: update links for referencesAlex Hung
URLs for presentation and Intel Software Developer’s Manual are updated as they were using "http" which are gradually replaced by "https". Signed-off-by: Alex Hung <alex.hung@canonical.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2020-03-14cpufreq: intel_pstate: Consolidate policy verificationRafael J. Wysocki
There is still some code duplication between intel_pstate_verify_policy() and intel_cpufreq_verify_policy(), so avoid it by moving the common code into a separate function and calling it from both these places. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2020-03-14cpuidle: haltpoll: allow force loading on hosts without the REALTIME hintMaciej S. Szmigiero
Before commit 1328edca4a14 ("cpuidle-haltpoll: Enable kvm guest polling when dedicated physical CPUs are available") the cpuidle-haltpoll driver could also be used in scenarios when the host does not advertise the KVM_HINTS_REALTIME hint. While the behavior introduced by the aforementioned commit makes sense as the default there are cases where the old behavior is desired, for example, when other kernel changes triggered by presence by this hint are unwanted, for some workloads where the latency benefit from polling overweights the loss from idle CPU capacity that otherwise would be available, or just when running under older Qemu versions that lack this hint. Let's provide a typical "force" module parameter that allows restoring the old behavior. Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com> Reviewed-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>