summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2020-09-28mmc: sdhci-of-esdhc: fix reference clock source selectionYangbo Lu
The bit ESDHC_PERIPHERAL_CLK_SEL to select using peripheral clock or platform clock is not able to be reset by SDHCI_RESET_ALL. So driver needs to initialize it as 1 or 0 once, to override the different value which may be configured in bootloader. Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com> Link: https://lore.kernel.org/r/20200927082304.9232-1-yangbo.lu@nxp.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2020-09-28gpio: amd-fch: correct logic of GPIO_LINE_DIRECTIONEd Wildgoose
The original commit appears to have the logic reversed in amd_fch_gpio_get_direction. Also confirmed by observing the value of "direction" in the sys tree. Signed-off-by: Ed Wildgoose <lists@wildgooses.com> Fixes: e09d168f13f0 ("gpio: AMD G-Series PCH gpio driver") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
2020-09-28mmc: host: fix depends for MMC_MESON_GX w/ COMPILE_TESTRandy Dunlap
Fix build errors for meson-gx-mmc.c when CONFIG_COMMON_CLK is not set/enabled. This can happen when COMPILE_TEST is set/enabled. ERROR: modpost: "clk_divider_ops" [drivers/mmc/host/meson-gx-mmc.ko] undefined! ERROR: modpost: "devm_clk_register" [drivers/mmc/host/meson-gx-mmc.ko] undefined! ERROR: modpost: "clk_mux_ops" [drivers/mmc/host/meson-gx-mmc.ko] undefined! ERROR: modpost: "__clk_get_name" [drivers/mmc/host/meson-gx-mmc.ko] undefined! Fixes: 54d8454436a2 ("mmc: host: Enable compile testing of multiple drivers") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org> Reported-by: kernel test robot <lkp@intel.com> Link: https://lore.kernel.org/r/20200925164323.29843-1-rdunlap@infradead.org Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2020-09-28Merge branch 'fixes' into nextUlf Hansson
2020-09-28mmc: sdhci: Workaround broken command queuing on Intel GLK based IRBIS modelsHans de Goede
Commit bedf9fc01ff1 ("mmc: sdhci: Workaround broken command queuing on Intel GLK"), disabled command-queuing on Intel GLK based LENOVO models because of it being broken due to what is believed to be a bug in the BIOS. It seems that the BIOS of some IRBIS models, including the IRBIS NB111 model has the same issue, so disable command queuing there too. Fixes: bedf9fc01ff1 ("mmc: sdhci: Workaround broken command queuing on Intel GLK") BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=209397 Reported-and-tested-by: RussianNeuroMancer <russianneuromancer@ya.ru> Signed-off-by: Hans de Goede <hdegoede@redhat.com> Acked-by: Adrian Hunter <adrian.hunter@intel.com> Link: https://lore.kernel.org/r/20200927104821.5676-1-hdegoede@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2020-09-28memstick: Skip allocating card when removing hostKai-Heng Feng
After commit 6827ca573c03 ("memstick: rtsx_usb_ms: Support runtime power management"), removing module rtsx_usb_ms will be stuck. The deadlock is caused by powering on and powering off at the same time, the former one is when memstick_check() is flushed, and the later is called by memstick_remove_host(). Soe let's skip allocating card to prevent this issue. Fixes: 6827ca573c03 ("memstick: rtsx_usb_ms: Support runtime power management") Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com> Link: https://lore.kernel.org/r/20200925084952.13220-1-kai.heng.feng@canonical.com Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2020-09-28hv: clocksource: Add notrace attribute to read_hv_sched_clock_*() functionsMohammed Gamal
When selecting function_graph tracer with the command: # echo function_graph > /sys/kernel/debug/tracing/current_tracer The kernel crashes with the following stack trace: [69703.122389] BUG: stack guard page was hit at 000000001056545c (stack is 00000000fa3f8fed..0000000005d39503) [69703.122403] kernel stack overflow (double-fault): 0000 [#1] SMP PTI [69703.122413] CPU: 0 PID: 16982 Comm: bash Kdump: loaded Not tainted 4.18.0-236.el8.x86_64 #1 [69703.122420] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.0 12/17/2019 [69703.122433] RIP: 0010repare_ftrace_return+0xa/0x110 [69703.122458] Code: 05 00 0f 0b 48 c7 c7 10 ca 69 ae 0f b6 f0 e8 4b 52 0c 00 31 c0 eb ca 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 56 41 55 41 54 <53> 48 83 ec 18 65 48 8b 04 25 28 00 00 00 48 89 45 d8 31 c0 48 85 [69703.122467] RSP: 0018:ffffbd6d01118000 EFLAGS: 00010086 [69703.122476] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000003 [69703.122484] RDX: 0000000000000000 RSI: ffffbd6d011180d8 RDI: ffffffffadce7550 [69703.122491] RBP: ffffbd6d01118018 R08: 0000000000000000 R09: ffff9d4b09266000 [69703.122498] R10: ffff9d4b0fc04540 R11: ffff9d4b0fc20a00 R12: ffff9d4b6e42aa90 [69703.122506] R13: ffff9d4b0fc20ab8 R14: 00000000000003e8 R15: ffffbd6d0111837c [69703.122514] FS: 00007fd5f2588740(0000) GS:ffff9d4b6e400000(0000) knlGS:0000000000000000 [69703.122521] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [69703.122528] CR2: ffffbd6d01117ff8 CR3: 00000000565d8001 CR4: 00000000003606f0 [69703.122538] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [69703.122545] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [69703.122552] Call Trace: [69703.122568] ftrace_graph_caller+0x6b/0xa0 [69703.122589] ? read_hv_sched_clock_tsc+0x5/0x20 [69703.122599] read_hv_sched_clock_tsc+0x5/0x20 [69703.122611] sched_clock+0x5/0x10 [69703.122621] sched_clock_local+0x12/0x80 [69703.122631] sched_clock_cpu+0x8c/0xb0 [69703.122644] trace_clock_global+0x21/0x90 [69703.122655] ring_buffer_lock_reserve+0x100/0x3c0 [69703.122671] trace_buffer_lock_reserve+0x16/0x50 [69703.122683] __trace_graph_entry+0x28/0x90 [69703.122695] trace_graph_entry+0xfd/0x1a0 [69703.122705] ? read_hv_clock_tsc_cs+0x10/0x10 [69703.122714] ? sched_clock+0x5/0x10 [69703.122723] prepare_ftrace_return+0x99/0x110 [69703.122734] ? read_hv_clock_tsc_cs+0x10/0x10 [69703.122743] ? sched_clock+0x5/0x10 [69703.122752] ftrace_graph_caller+0x6b/0xa0 [69703.122768] ? read_hv_clock_tsc_cs+0x10/0x10 [69703.122777] ? sched_clock+0x5/0x10 [69703.122786] ? read_hv_sched_clock_tsc+0x5/0x20 [69703.122796] ? ring_buffer_unlock_commit+0x1d/0xa0 [69703.122805] read_hv_sched_clock_tsc+0x5/0x20 [69703.122814] ftrace_graph_caller+0xa0/0xa0 [ ... recursion snipped ... ] Setting the notrace attribute for read_hv_sched_clock_msr() and read_hv_sched_clock_tsc() fixes it. Fixes: bd00cd52d5be ("clocksource/drivers/hyperv: Add Hyper-V specific sched clock function") Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Signed-off-by: Mohammed Gamal <mgamal@redhat.com> Link: https://lore.kernel.org/r/20200924151117.767442-1-mgamal@redhat.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
2020-09-28PCI: hv: Document missing hv_pci_protocol_negotiation() parameterKrzysztof Wilczyński
Add missing documentation for the parameter "version" and "num_version" of the hv_pci_protocol_negotiation() function and resolve build time kernel-doc warnings: drivers/pci/controller/pci-hyperv.c:2535: warning: Function parameter or member 'version' not described in 'hv_pci_protocol_negotiation' drivers/pci/controller/pci-hyperv.c:2535: warning: Function parameter or member 'num_version' not described in 'hv_pci_protocol_negotiation' No change to functionality intended. Signed-off-by: Krzysztof Wilczyński <kw@linux.com> Link: https://lore.kernel.org/r/20200925234753.1767227-1-kw@linux.com Reviewed-by: Michael Kelley <mikelley@microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2020-09-28scsi: storvsc: Support PAGE_SIZE larger than 4KBoqun Feng
Hyper-V always use 4k page size (HV_HYP_PAGE_SIZE), so when communicating with Hyper-V, a guest should always use HV_HYP_PAGE_SIZE as the unit for page related data. For storvsc, the data is vmbus_packet_mpb_array. And since in scsi_cmnd, sglist of pages (in unit of PAGE_SIZE) is used, we need convert pages in the sglist of scsi_cmnd into Hyper-V pages in vmbus_packet_mpb_array. This patch does the conversion by dividing pages in sglist into Hyper-V pages, offset and indexes in vmbus_packet_mpb_array are recalculated accordingly. Signed-off-by: Boqun Feng <boqun.feng@gmail.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Link: https://lore.kernel.org/r/20200916034817.30282-12-boqun.feng@gmail.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
2020-09-28Driver: hv: util: Use VMBUS_RING_SIZE() for ringbuffer sizesBoqun Feng
For a Hyper-V vmbus, the size of the ringbuffer has two requirements: 1) it has to take one PAGE_SIZE for the header 2) it has to be PAGE_SIZE aligned so that double-mapping can work VMBUS_RING_SIZE() could calculate a correct ringbuffer size which fulfills both requirements, therefore use it to make sure vmbus work when PAGE_SIZE != HV_HYP_PAGE_SIZE (4K). Note that since the argument for VMBUS_RING_SIZE() is the size of payload (data part), so it will be minus 4k (the size of header when PAGE_SIZE = 4k) than the original value to keep the ringbuffer total size unchanged when PAGE_SIZE = 4k. Signed-off-by: Boqun Feng <boqun.feng@gmail.com> Cc: Michael Kelley <mikelley@microsoft.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Link: https://lore.kernel.org/r/20200916034817.30282-11-boqun.feng@gmail.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
2020-09-28HID: hyperv: Use VMBUS_RING_SIZE() for ringbuffer sizesBoqun Feng
For a Hyper-V vmbus, the size of the ringbuffer has two requirements: 1) it has to take one PAGE_SIZE for the header 2) it has to be PAGE_SIZE aligned so that double-mapping can work VMBUS_RING_SIZE() could calculate a correct ringbuffer size which fulfills both requirements, therefore use it to make sure vmbus work when PAGE_SIZE != HV_HYP_PAGE_SIZE (4K). Note that since the argument for VMBUS_RING_SIZE() is the size of payload (data part), so it will be minus 4k (the size of header when PAGE_SIZE = 4k) than the original value to keep the ringbuffer total size unchanged when PAGE_SIZE = 4k. Signed-off-by: Boqun Feng <boqun.feng@gmail.com> Cc: Jiri Kosina <jkosina@suse.cz> Cc: Michael Kelley <mikelley@microsoft.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Link: https://lore.kernel.org/r/20200916034817.30282-10-boqun.feng@gmail.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
2020-09-28Input: hyperv-keyboard: Use VMBUS_RING_SIZE() for ringbuffer sizesBoqun Feng
For a Hyper-V vmbus, the size of the ringbuffer has two requirements: 1) it has to take one PAGE_SIZE for the header 2) it has to be PAGE_SIZE aligned so that double-mapping can work VMBUS_RING_SIZE() could calculate a correct ringbuffer size which fulfills both requirements, therefore use it to make sure vmbus work when PAGE_SIZE != HV_HYP_PAGE_SIZE (4K). Note that since the argument for VMBUS_RING_SIZE() is the size of payload (data part), so it will be minus 4k (the size of header when PAGE_SIZE = 4k) than the original value to keep the ringbuffer total size unchanged when PAGE_SIZE = 4k. Signed-off-by: Boqun Feng <boqun.feng@gmail.com> Cc: Michael Kelley <mikelley@microsoft.com> Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com> Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Link: https://lore.kernel.org/r/20200916034817.30282-9-boqun.feng@gmail.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
2020-09-28hv_netvsc: Use HV_HYP_PAGE_SIZE for Hyper-V communicationBoqun Feng
When communicating with Hyper-V, HV_HYP_PAGE_SIZE should be used since that's the page size used by Hyper-V and Hyper-V expects all page-related data using the unit of HY_HYP_PAGE_SIZE, for example, the "pfn" in hv_page_buffer is actually the HV_HYP_PAGE (i.e. the Hyper-V page) number. In order to support guest whose page size is not 4k, we need to make hv_netvsc always use HV_HYP_PAGE_SIZE for Hyper-V communication. Signed-off-by: Boqun Feng <boqun.feng@gmail.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Link: https://lore.kernel.org/r/20200916034817.30282-8-boqun.feng@gmail.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
2020-09-28Drivers: hv: vmbus: Move virt_to_hvpfn() to hyperv headerBoqun Feng
There will be more places other than vmbus where we need to calculate the Hyper-V page PFN from a virtual address, so move virt_to_hvpfn() to hyperv generic header. Signed-off-by: Boqun Feng <boqun.feng@gmail.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Link: https://lore.kernel.org/r/20200916034817.30282-6-boqun.feng@gmail.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
2020-09-28Drivers: hv: Use HV_HYP_PAGE in hv_synic_enable_regs()Boqun Feng
Both the base_*_gpa should use the guest page number in Hyper-V page, so use HV_HYP_PAGE instead of PAGE. Signed-off-by: Boqun Feng <boqun.feng@gmail.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Link: https://lore.kernel.org/r/20200916034817.30282-5-boqun.feng@gmail.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
2020-09-28Drivers: hv: vmbus: Introduce types of GPADLBoqun Feng
This patch introduces two types of GPADL: HV_GPADL_{BUFFER, RING}. The types of GPADL are purely the concept in the guest, IOW the hypervisor treat them as the same. The reason of introducing the types for GPADL is to support guests whose page size is not 4k (the page size of Hyper-V hypervisor). In these guests, both the headers and the data parts of the ringbuffers need to be aligned to the PAGE_SIZE, because 1) some of the ringbuffers will be mapped into userspace and 2) we use "double mapping" mechanism to support fast wrap-around, and "double mapping" relies on ringbuffers being page-aligned. However, the Hyper-V hypervisor only uses 4k (HV_HYP_PAGE_SIZE) headers. Our solution to this is that we always make the headers of ringbuffers take one guest page and when GPADL is established between the guest and hypervisor, the only first 4k of header is used. To handle this special case, we need the types of GPADL to differ different guest memory usage for GPADL. Type enum is introduced along with several general interfaces to describe the differences between normal buffer GPADL and ringbuffer GPADL. Signed-off-by: Boqun Feng <boqun.feng@gmail.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Link: https://lore.kernel.org/r/20200916034817.30282-4-boqun.feng@gmail.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
2020-09-28Drivers: hv: vmbus: Move __vmbus_open()Boqun Feng
Pure function movement, no functional changes. The move is made, because in a later change, __vmbus_open() will rely on some static functions afterwards, so we separate the move and the modification of __vmbus_open() in two patches to make it easy to review. Signed-off-by: Boqun Feng <boqun.feng@gmail.com> Reviewed-by: Wei Liu <wei.liu@kernel.org> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Link: https://lore.kernel.org/r/20200916034817.30282-3-boqun.feng@gmail.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
2020-09-28Drivers: hv: vmbus: Always use HV_HYP_PAGE_SIZE for gpadlBoqun Feng
Since the hypervisor always uses 4K as its page size, the size of PFNs used for gpadl should be HV_HYP_PAGE_SIZE rather than PAGE_SIZE, so adjust this accordingly as the preparation for supporting 16K/64K page size guests. No functional changes on x86, since PAGE_SIZE is always 4k (equals to HV_HYP_PAGE_SIZE). Signed-off-by: Boqun Feng <boqun.feng@gmail.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Link: https://lore.kernel.org/r/20200916034817.30282-2-boqun.feng@gmail.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
2020-09-28ide/macide: Convert Mac IDE driver to platform driverFinn Thain
Add platform devices for the Mac IDE controller variants. Convert the macide module into a platform driver to support two of those variants. For the third, use a generic "pata_platform" driver instead. This enables automatic loading of the appropriate module and begins the process of replacing the driver with libata alternatives. Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Tested-by: Stan Johnson <userm57@yahoo.com> Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Cc: Joshua Thompson <funaho@jurai.org> References: commit 5ed0794cde593 ("m68k/atari: Convert Falcon IDE drivers to platform drivers") References: commit 7ad19a99ad431 ("ide: officially deprecated the legacy IDE driver") Link: https://lore.kernel.org/r/edd106dad1bbea32500601c6071f37a9f02a8004.1600901284.git.fthain@telegraphics.com.au Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2020-09-27r8169: fix RTL8168f/RTL8411 EPHY configHeiner Kallweit
Mistakenly bit 2 was set instead of bit 3 as in the vendor driver. Fixes: a7a92cf81589 ("r8169: sync PCIe PHY init with vendor driver 8.047.01") Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-09-27mlxsw: spectrum_acl: Fix mlxsw_sp_acl_tcam_group_add()'s error pathIdo Schimmel
If mlxsw_sp_acl_tcam_group_id_get() fails, the mutex initialized earlier is not destroyed. Fix this by initializing the mutex after calling the function. This is symmetric to mlxsw_sp_acl_tcam_group_del(). Fixes: 5ec2ee28d27b ("mlxsw: spectrum_acl: Introduce a mutex to guard region list updates") Signed-off-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: Jiri Pirko <jiri@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-09-27mdio: fix mdio-thunder.c dependency & build errorRandy Dunlap
Fix build error by selecting MDIO_DEVRES for MDIO_THUNDER. Fixes this build error: ld: drivers/net/phy/mdio-thunder.o: in function `thunder_mdiobus_pci_probe': drivers/net/phy/mdio-thunder.c:78: undefined reference to `devm_mdiobus_alloc_size' Fixes: 379d7ac7ca31 ("phy: mdio-thunder: Add driver for Cavium Thunder SoC MDIO buses.") Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Cc: Bartosz Golaszewski <bgolaszewski@baylibre.com> Cc: Andrew Lunn <andrew@lunn.ch> Cc: Heiner Kallweit <hkallweit1@gmail.com> Cc: netdev@vger.kernel.org Cc: David Daney <david.daney@cavium.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-09-27Merge tag 'timers-urgent-2020-09-27' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer updates from Thomas Gleixner: "A set of clocksource/clockevents updates: - Reset the TI/DM timer before enabling it instead of doing it the other way round. - Initialize the reload value for the GX6605s timer correctly so the hardware counter starts at 0 again after overrun. - Make error return value negative in the h8300 timer init function" * tag 'timers-urgent-2020-09-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clocksource/drivers/timer-gx6605s: Fixup counter reload clocksource/drivers/timer-ti-dm: Do reset before enable clocksource/drivers/h8300_timer8: Fix wrong return value in h8300_8timer_init()
2020-09-27i2c: npcm7xx: Clear LAST bit after a failed transaction.Tali Perry
Due to a HW issue, in some scenarios the LAST bit might remain set. This will cause an unexpected NACK after reading 16 bytes on the next read. Example: if user tries to read from a missing device, get a NACK, then if the next command is a long read ( > 16 bytes), the master will stop reading after 16 bytes. To solve this, if a command fails, check if LAST bit is still set. If it does, reset the module. Fixes: 56a1485b102e (i2c: npcm7xx: Add Nuvoton NPCM I2C controller driver) Signed-off-by: Tali Perry <tali.perry1@gmail.com> Signed-off-by: Wolfram Sang <wsa@kernel.org>
2020-09-27i2c: cpm: Fix i2c_ram structureNicolas VINCENT
the i2c_ram structure is missing the sdmatmp field mentionned in datasheet for MPC8272 at paragraph 36.5. With this field missing, the hardware would write past the allocated memory done through cpm_muram_alloc for the i2c_ram structure and land in memory allocated for the buffers descriptors corrupting the cbd_bufaddr field. Since this field is only set during setup(), the first i2c transaction would work and the following would send data read from an arbitrary memory location. Fixes: 61045dbe9d8d ("i2c: Add support for I2C bus on Freescale CPM1/CPM2 controllers") Signed-off-by: Nicolas VINCENT <nicolas.vincent@vossloh.com> Acked-by: Jochen Friedrich <jochen@scram.de> Acked-by: Christophe Leroy <christophe.leroy@csgroup.eu> Signed-off-by: Wolfram Sang <wsa@kernel.org>
2020-09-27vt_ioctl: make VT_RESIZEX behave like VT_RESIZETetsuo Handa
syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2], for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height larger than actual font height calculated by con_font_set() from ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates minimal amount of memory based on actual font height calculated by con_font_set(), use of vt_resizex() can cause UAF/OOB read for font data. VT_RESIZEX was introduced in Linux 1.3.3, but it is unclear that what comes to the "+ more" part, and I couldn't find a user of VT_RESIZEX. #define VT_RESIZE 0x5609 /* set kernel's idea of screensize */ #define VT_RESIZEX 0x560A /* set kernel's idea of screensize + more */ So far we are not aware of syzbot reports caused by setting non-zero value to v_vlin parameter. But given that it is possible that nobody is using VT_RESIZEX, we can try removing support for v_clin and v_vlin parameters. Therefore, this patch effectively makes VT_RESIZEX behave like VT_RESIZE, with emitting a message if somebody is still using v_clin and/or v_vlin parameters. [1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837 [2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3 Reported-by: syzbot <syzbot+b308f5fd049fbbc6e74f@syzkaller.appspotmail.com> Reported-by: syzbot <syzbot+16469b5e8e5a72e9131e@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/4933b81b-9b1a-355b-df0e-9b31e8280ab9@i-love.sakura.ne.jp Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-27serial: mvebu-uart: simplify the return expression of mvebu_uart_probe()Qinglang Miao
Simplify the return expression. Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com> Link: https://lore.kernel.org/r/20200921131105.93177-1-miaoqinglang@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-27tty: serial: imx: fix link error with CONFIG_SERIAL_CORE_CONSOLE=nYang Yingliang
aarch64-linux-gnu-ld: drivers/tty/serial/imx_earlycon.o: in function `imx_uart_console_early_write': imx_earlycon.c:(.text+0x84): undefined reference to `uart_console_write' The driver uses the uart_console_write(), but SERIAL_CORE_CONSOLE is not selected, so uart_console_write is not defined, then we get the error. Fix this by selecting SERIAL_CORE_CONSOLE. Fixes: 699cc4dfd140 ("tty: serial: imx: add imx earlycon driver") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Link: https://lore.kernel.org/r/20200919063240.2754965-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-27tty: hvc: fix link error with CONFIG_SERIAL_CORE_CONSOLE=nYang Yingliang
aarch64-linux-gnu-ld: drivers/tty/hvc/hvc_dcc.o: in function `dcc_early_write': hvc_dcc.c:(.text+0x164): undefined reference to `uart_console_write' The driver uses the uart_console_write(), but SERIAL_CORE_CONSOLE is not selected, so uart_console_write is not defined, then we get the error. Fix this by selecting SERIAL_CORE_CONSOLE. Fixes: d1a1af2cdf19 ("hvc: dcc: Add earlycon support") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Link: https://lore.kernel.org/r/20200919063535.2809707-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-27pch_uart: drop double zeroingJulia Lawall
sg_init_table zeroes its first argument, so the allocation of that argument doesn't have to. the semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression x,n,flags; @@ x = - kcalloc + kmalloc_array (n,sizeof(struct scatterlist),flags) ... sg_init_table(x,n) // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr> Link: https://lore.kernel.org/r/1600601186-7420-2-git-send-email-Julia.Lawall@inria.fr Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-27media: staging: rkisp1: cap: protect access to buf with the spin lockDafna Hirschfeld
The function 'rkisp1_stream_start' calls 'rkisp1_set_next_buf' which access the buffers, so the call should be protected by taking the cap->buf.lock. After this patch, all locks are reviewed and commented so remove the TODO item "review and comment every lock" Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-09-27media: staging: rkisp1: use the right variants of spin_lockDafna Hirschfeld
When locking, use either 'spin_lock' or 'spin_lock_irq' according to the context. There is nowhere need to use 'spin_lock_irqsave'. Outside of irq context, always use 'spin_lock_irq' to be on the safe side. Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-09-27media: staging: rkisp1: params: no need to lock default configDafna Hirschfeld
In the function 'rkisp1_params_config_parameter' the lock is taken while applying the default config. But the lock only needs to protect the buffers list and the 'is_streaming' field, so move the locking to lock only what is needed. Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Acked-by: Helen Koike <helen.koike@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-09-27media: staging: rkisp1: stats: protect write to 'is_streaming' in ↵Dafna Hirschfeld
start_streaming cb The field stats->is_streaming is written in 'start_streaming' callback without the stats->lock protection. The isr might run together with the callback so 'spin_lock_irq' should be used. Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Acked-by: Helen Koike <helen.koike@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-09-27media: staging: rkisp1: isp: don't enable signal RKISP1_CIF_ISP_FRAME_INDafna Hirschfeld
The signal RKISP1_CIF_ISP_FRAME_IN is not used in the isr so there is no need to enable it. Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Acked-by: Helen Koike <helen.koike@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-09-27media: staging: rkisp1: isp: add a warning and debugfs var for irq delayDafna Hirschfeld
The signal RKISP1_CIF_ISP_FRAME is set when the ISP completes outputting the frame to the next block in the pipeline. In order to keep buffer synchronization we assume that the RKISP1_CIF_ISP_V_START signal never arrives together with the RKISP1_CIF_ISP_FRAME signal. In case those signals arrive together then the code is not able to tell if the RKISP1_CIF_ISP_FRAME signal relates to the frame of the current v-start or the previous. This patch adds a WARN_ONCE and a debugfs var to catch it. Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-09-27media: staging: rkisp1: remove atomic operations for frame sequenceDafna Hirschfeld
The isp.frame_sequence is now read only from the irq handlers that are all fired from the same interrupt, so there is not need for atomic operation. In addition, the frame seq incrementation is moved from rkisp1_isp_queue_event_sof to rkisp1_isp_isr to make the code clearer and the incorrect inline comment is removed. Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Acked-by: Helen Koike <helen.koike@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-09-27media: staging: rkisp1: params: set vb.sequence to be the isp's ↵Dafna Hirschfeld
frame_sequence + 1 The params isr is called when the ISP finishes processing a frame (RKISP1_CIF_ISP_FRAME). Configurations performed in the params isr will be applied on the next frame. Since frame_sequence is updated on the vertical sync signal, we should use frame_sequence + 1 as the vb.sequence of the params buffer to indicate to userspace on which frame these parameters are being applied. Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Acked-by: Helen Koike <helen.koike@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-09-27media: staging: rkisp1: params: avoid using buffer if params is not streamingDafna Hirschfeld
Currently, the first buffer queued in the params node is returned immediately to userspace and a copy of it is saved in the field 'cur_params'. The copy is later used for the first configuration when the stream is initiated by one of selfpath/mainpath capture nodes. There are 3 problems with this implementation: - The first params buffer is applied and returned to userspace even if userspace never calls to streamon on the params node. - If the first params buffer is queued after the stream started on the params node then it will return to userspace but will never be used. - The frame_sequence of the first buffer is set to -1 if the main/selfpath did not start streaming. A correct implementation is to apply the first params buffer when stream is started from mainpath/selfpath and only if params is also streaming. The patch adds a new function 'rkisp1_params_apply_params_cfg' which takes a buffer from the buffers queue, apply it and returns it to userspace. The function is called from the irq handler and when main/selfpath stream starts - in the function 'rkisp1_params_config_parameter' Also remove the fields 'cur_params', 'is_first_params' which are no more needed. Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Reported-by: kernel test robot <lkp@intel.com> Acked-by: Helen Koike <helen.koike@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-09-27media: staging: rkisp1: params: use the new effect value in cproc configDafna Hirschfeld
The cproc (color processing) configuration needs to know if an image effect is configured. The code uses the image effect in 'cur_params' which is the first params buffer queued in the stream. This is the wrong place to read the value. The value should be taken from the current params buffer. Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Acked-by: Helen Koike <helen.koike@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-09-27media: staging: rkisp1: params: in the isr, return if buffer list is emptyDafna Hirschfeld
Currently the code in the isr checks if the buffer list is not empty before referencing a buffer and then check again if the buffer is not NULL. Instead we can save one 'if' statement by returning if the buffers list is empty. Also remove non-helpful inline doc 'get one empty buffer' Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Acked-by: Helen Koike <helen.koike@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-09-27media: staging: rkisp1: params: upon stream stop, iterate a local list to ↵Dafna Hirschfeld
return the buffers The code in '.stop_streaming' callback releases and acquire the lock at each iteration when returning the buffers. Holding the lock disables interrupts so it should be minimized. To make the code cleaner and still minimize holding the lock, the buffer list is first moved to a local list and then can be iterated without the lock. Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Acked-by: Helen Koike <helen.koike@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-09-27media: saa7146: drop double zeroingJulia Lawall
sg_init_table zeroes its first argument, so the allocation of that argument doesn't have to. the semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression x,n,flags; @@ x = - kcalloc + kmalloc_array (n,sizeof(struct scatterlist),flags) ... sg_init_table(x,n) // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-09-27media: firewire: fix memory leakPavel Machek
Fix memory leak in node_probe. Signed-off-by: Pavel Machek (CIP) <pavel@denx.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-09-27media: rcar-vin: Extend RAW8 support to all RGB layoutsNiklas Söderlund
Extend the list of supported formats to include all RGB layouts of RAW8. Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Reviewed-by: Ulrich Hecht <uli+renesas@fpond.eu> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-09-27media: rcar-csi2: Extend RAW8 support to all RGB layoutsNiklas Söderlund
Extend the list of supported formats to include all RGB layouts of RAW8. Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se> Reviewed-by: Ulrich Hecht <uli+renesas@fpond.eu> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-09-27media: rc: gpio-ir-recv: add QoS support for cpuidle systemJoakim Zhang
GPIO IR receive is much rely on interrupt response, uneven interrupt latency will lead to incorrect timing, so the decoder fails to decode it. The issue is particularly acute on some systems which support cpuidle, not all, dynamically disable and enable cpuidle can solve this problem to a great extent. However, there is a downside to this approach, the measurement of header on the first frame may incorrect. Test on i.MX8M serials, when enable cpuidle, interrupt latency could be about 500us. With this patch: 1. has no side effect on non-cpuidle system, even runtime pm api won't be invoked to avoid a bunch of pm busy work for devices that do not need it, including spinlocks, ktime, etc. 2. latency is still much longer for the first gpio interrupt on cpuidle system, so the first frame may not be decoded. Generally, RC would transmit multiple frames at once press, we can sacrifice the first frame. 3. add "linux,autosuspend-period" property in device tree if you also suffer this cpuidle issue. Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-09-27media: dvb-frontends: tda18271c2dd: Constify static structsRikard Falkeborn
Constify a number of static structs that were not modified. In order to be able to do that, const input arguments to a couple of functions that not modify their argument. This allows the compiler to put them in read-only memory, resulting in about 6k memory being read-only, and the resulting module is 400 bytes smaller. Before: text data bss dec hex filename 15492 6873 0 22365 575d drivers/media/dvb-frontends/tda18271c2dd.ko After: text data bss dec hex filename 21021 897 0 21918 559e drivers/media/dvb-frontends/tda18271c2dd.ko Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-09-27media: flexcop-usb: remove needless check before usb_free_coherent()Qinglang Miao
usb_free_coherent() is safe with NULL addr and this check is not required. Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-09-27media: flexcop-usb: sanity checking of endpoint typeOliver Neukum
Make sure the endpoint is ISOC in and do not hard code USB_DIR_IN. Signed-off-by: Oliver Neukum <oneukum@suse.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>