August 2019 - Linux-stable-mirror

[PATCH v2] drm/nouveau: Only recalculate PBN/VCPI on mode/connector changes

by Lyude Paul

I -thought- I had fixed this entirely, but it looks like that I didn't test this thoroughly enough as we apparently still make one big mistake with nv50_msto_atomic_check() - we don't handle the following scenario: * CRTC #1 has n VCPI allocated to it, is attached to connector DP-4 which is attached to encoder #1. enabled=y active=n * CRTC #1 is changed from DP-4 to DP-5, causing: * DP-4 crtc=#1→NULL (VCPI n→0) * DP-5 crtc=NULL→#1 * CRTC #1 steals encoder #1 back from DP-4 and gives it to DP-5 * CRTC #1 maintains the same mode as before, just with a different connector * mode_changed=n connectors_changed=y (we _SHOULD_ do VCPI 0→n here, but don't) Once the above scenario is repeated once, we'll attempt freeing VCPI from the connector that we didn't allocate due to the connectors changing, but the mode staying the same. Sigh. Since nv50_msto_atomic_check() has broken a few times now, let's rethink things a bit to be more careful: limit both VCPI/PBN allocations to mode_changed || connectors_changed, since neither VCPI or PBN should ever need to change outside of routing and mode changes. Changes since v1: * Fix accidental reversal of clock and bpp arguments in drm_dp_calc_pbn_mode() - William Lewis Signed-off-by: Lyude Paul <lyude(a)redhat.com> Reported-by: Bohdan Milar <bmilar(a)redhat.com> Tested-by: Bohdan Milar <bmilar(a)redhat.com> Fixes: 232c9eec417a ("drm/nouveau: Use atomic VCPI helpers for MST") References: 412e85b60531 ("drm/nouveau: Only release VCPI slots on mode changes") Cc: Lyude Paul <lyude(a)redhat.com> Cc: Ben Skeggs <bskeggs(a)redhat.com> Cc: Daniel Vetter <daniel.vetter(a)ffwll.ch> Cc: David Airlie <airlied(a)redhat.com> Cc: Jerry Zuo <Jerry.Zuo(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Juston Li <juston.li(a)intel.com> Cc: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Cc: Karol Herbst <karolherbst(a)gmail.com> Cc: Ilia Mirkin <imirkin(a)alum.mit.edu> Cc: <stable(a)vger.kernel.org> # v5.1+ --- drivers/gpu/drm/nouveau/dispnv50/disp.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c index 126703816794..5c36c75232e6 100644 --- a/drivers/gpu/drm/nouveau/dispnv50/disp.c +++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c @@ -771,16 +771,20 @@ nv50_msto_atomic_check(struct drm_encoder *encoder, struct nv50_head_atom *asyh = nv50_head_atom(crtc_state); int slots; - /* When restoring duplicated states, we need to make sure that the - * bw remains the same and avoid recalculating it, as the connector's - * bpc may have changed after the state was duplicated - */ - if (!state->duplicated) - asyh->dp.pbn = - drm_dp_calc_pbn_mode(crtc_state->adjusted_mode.clock, - connector->display_info.bpc * 3); + if (crtc_state->mode_changed || crtc_state->connectors_changed) { + /* + * When restoring duplicated states, we need to make sure that + * the bw remains the same and avoid recalculating it, as the + * connector's bpc may have changed after the state was + * duplicated + */ + if (!state->duplicated) { + const int bpp = connector->display_info.bpc * 3; + const int clock = crtc_state->adjusted_mode.clock; + + asyh->dp.pbn = drm_dp_calc_pbn_mode(clock, bpp); + } - if (crtc_state->mode_changed) { slots = drm_dp_atomic_find_vcpi_slots(state, &mstm->mgr, mstc->port, asyh->dp.pbn); -- 2.21.0

5 years, 4 months

2
1
0 0

Re: [PATCH v9 2/7] powerpc/mce: Fix MCE handling for huge pages

by Santosh Sivaraj

Sasha Levin <sashal(a)kernel.org> writes: > Hi, > > [This is an automated email] > > This commit has been processed because it contains a "Fixes:" tag, > fixing commit: ba41e1e1ccb9 powerpc/mce: Hookup derror (load/store) UE errors. > > The bot has tested the following trees: v5.2.8, v4.19.66. > > v5.2.8: Build OK! > v4.19.66: Failed to apply! Possible dependencies: > 360cae313702 ("KVM: PPC: Book3S HV: Nested guest entry via hypercall") > 41f4e631daf8 ("KVM: PPC: Book3S HV: Extract PMU save/restore operations as C-callable functions") > 884dfb722db8 ("KVM: PPC: Book3S HV: Simplify machine check handling") > 89329c0be8bd ("KVM: PPC: Book3S HV: Clear partition table entry on vm teardown") > 8e3f5fc1045d ("KVM: PPC: Book3S HV: Framework and hcall stubs for nested virtualization") > 95a6432ce903 ("KVM: PPC: Book3S HV: Streamlined guest entry/exit path on P9 for radix guests") > a43c1590426c ("powerpc/pseries: Flush SLB contents on SLB MCE errors.") > c05772018491 ("powerpc/64s: Better printing of machine check info for guest MCEs") > d24ea8a7336a ("KVM: PPC: Book3S: Simplify external interrupt handling") > df709a296ef7 ("KVM: PPC: Book3S HV: Simplify real-mode interrupt handling") > f7035ce9f1df ("KVM: PPC: Book3S HV: Move interrupt delivery on guest entry to C code") > > > NOTE: The patch will not be queued to stable trees until it is upstream. > > How should we proceed with this patch? I will send a backport once this has been merged upstream. Thanks, Santosh > > -- > Thanks, > Sasha

5 years, 4 months

1
0
0 0

[PATCH 4.19 00/74] 4.19.65-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.65 release. There are 74 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed 07 Aug 2019 12:47:58 PM UTC. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.65-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.65-rc1 Suganath Prabu <suganath-prabu.subramani(a)broadcom.com> scsi: mpt3sas: Use 63-bit DMA addressing on SAS35 HBA Andy Lutomirski <luto(a)kernel.org> x86/vdso: Prevent segfaults due to hoisted vclock reads Linus Torvalds <torvalds(a)linux-foundation.org> gcc-9: properly declare the {pv,hv}clock_page storage Josh Poimboeuf <jpoimboe(a)redhat.com> objtool: Support GCC 9 cold subfunction naming scheme Eugeniy Paltsev <Eugeniy.Paltsev(a)synopsys.com> ARC: enable uboot support unconditionally Jean Delvare <jdelvare(a)suse.de> eeprom: at24: make spd world-readable again Xiaolin Zhang <xiaolin.zhang(a)intel.com> drm/i915/gvt: fix incorrect cache entry for guest page mapping John Fleck <john.fleck(a)intel.com> IB/hfi1: Check for error on call to alloc_rsm_map_table Yishai Hadas <yishaih(a)mellanox.com> IB/mlx5: Fix RSS Toeplitz setup to be aligned with the HW specification Yishai Hadas <yishaih(a)mellanox.com> IB/mlx5: Fix clean_mr() to work in the expected order Yishai Hadas <yishaih(a)mellanox.com> IB/mlx5: Move MRs to a kernel PD when freeing them to the MR cache Yishai Hadas <yishaih(a)mellanox.com> IB/mlx5: Use direct mkey destroy command upon UMR unreg failure Yishai Hadas <yishaih(a)mellanox.com> IB/mlx5: Fix unreg_umr to ignore the mkey state Juergen Gross <jgross(a)suse.com> xen/swiotlb: fix condition for calling xen_destroy_contiguous_region() Munehisa Kamata <kamatam(a)amazon.com> nbd: replace kill_bdev() with __invalidate_device() again Will Deacon <will(a)kernel.org> arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG} Will Deacon <will(a)kernel.org> arm64: compat: Allow single-byte watchpoints on all addresses Will Deacon <will(a)kernel.org> drivers/perf: arm_pmu: Fix failure path in PM notifier Helge Deller <deller(a)gmx.de> parisc: Fix build of compressed kernel even with debug enabled Chris Down <chris(a)chrisdown.name> cgroup: kselftest: relax fs_spec checks Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: fix endless loop after read unit address configuration Yang Shi <yang.shi(a)linux.alibaba.com> mm: vmscan: check if mem cgroup is disabled or not before calling memcg slab shrinker Samuel Thibault <samuel.thibault(a)ens-lyon.org> ALSA: hda: Fix 1-minute detection delay when i915 module is not available Ondrej Mosnacek <omosnace(a)redhat.com> selinux: fix memory leak in policydb_init() Marco Felsch <m.felsch(a)pengutronix.de> mtd: rawnand: micron: handle on-die "ECC-off" devices correctly Gustavo A. R. Silva <gustavo(a)embeddedor.com> IB/hfi1: Fix Spectre v1 vulnerability Michael Wu <michael.wu(a)vatics.com> gpiolib: fix incorrect IRQ requesting of an active-low lineevent Joe Perches <joe(a)perches.com> mmc: meson-mx-sdio: Fix misuse of GENMASK macro Douglas Anderson <dianders(a)chromium.org> mmc: dw_mmc: Fix occasional hang after tuning on eMMC Filipe Manana <fdmanana(a)suse.com> Btrfs: fix race leading to fs corruption after transaction abort Filipe Manana <fdmanana(a)suse.com> Btrfs: fix incremental send failure after deduplication Masahiro Yamada <yamada.masahiro(a)socionext.com> kbuild: initialize CLANG_FLAGS correctly in the top Makefile M. Vefa Bicakci <m.v.b(a)runbox.com> kconfig: Clear "written" flag to avoid data loss Yongxin Liu <yongxin.liu(a)windriver.com> drm/nouveau: fix memory leak in nouveau_conn_reset() Zhenzhong Duan <zhenzhong.duan(a)oracle.com> x86, boot: Remove multiple copy of static function sanitize_boot_params() Josh Poimboeuf <jpoimboe(a)redhat.com> x86/paravirt: Fix callee-saved function ELF sizes Josh Poimboeuf <jpoimboe(a)redhat.com> x86/kvm: Don't call kvm_spurious_fault() from .fixup Zhenzhong Duan <zhenzhong.duan(a)oracle.com> xen/pv: Fix a boot up hang revealed by int3 self test Petr Machata <petrm(a)mellanox.com> mlxsw: spectrum_dcb: Configure DSCP map as the last rule is removed Kees Cook <keescook(a)chromium.org> ipc/mqueue.c: only perform resource calculation if user valid Dan Carpenter <dan.carpenter(a)oracle.com> drivers/rapidio/devices/rio_mport_cdev.c: NUL terminate some strings Mikko Rapeli <mikko.rapeli(a)iki.fi> uapi linux/coda_psdev.h: move upc_req definition from uapi to kernel side headers Sam Protsenko <semen.protsenko(a)linaro.org> coda: fix build using bare-metal toolchain Zhouyang Jia <jiazhouyang09(a)gmail.com> coda: add error handling for fget Peter Rosin <peda(a)axentia.se> lib/test_string.c: avoid masking memset16/32/64 failures Kees Cook <keescook(a)chromium.org> lib/test_overflow.c: avoid tainting the kernel and fix wrap size Doug Berger <opendmb(a)gmail.com> mm/cma.c: fail if fixed declaration can't be honored Arnd Bergmann <arnd(a)arndb.de> x86: math-emu: Hide clang warnings for 16-bit overflow Qian Cai <cai(a)lca.pw> x86/apic: Silence -Wtype-limits compiler warnings Benjamin Poirier <bpoirier(a)suse.com> be2net: Signal that the device cannot transmit during reconfiguration Arnd Bergmann <arnd(a)arndb.de> ACPI: fix false-positive -Wuninitialized warning Arnd Bergmann <arnd(a)arndb.de> x86: kvm: avoid constant-conversion warning Ravi Bangoria <ravi.bangoria(a)linux.ibm.com> perf version: Fix segfault due to missing OPT_END() Benjamin Block <bblock(a)linux.ibm.com> scsi: zfcp: fix GCC compiler warning emitted with -Wmaybe-uninitialized Arnd Bergmann <arnd(a)arndb.de> ACPI: blacklist: fix clang warning for unused DMI table Jeff Layton <jlayton(a)kernel.org> ceph: return -ERANGE if virtual xattr value didn't fit in buffer Andrea Parri <andrea.parri(a)amarulasolutions.com> ceph: fix improper use of smp_mb__before_atomic() Ronnie Sahlberg <lsahlber(a)redhat.com> cifs: Fix a race condition with cifs_echo_request Qu Wenruo <wqu(a)suse.com> btrfs: qgroup: Don't hold qgroup_ioctl_lock in btrfs_qgroup_inherit() David Sterba <dsterba(a)suse.com> btrfs: fix minimum number of chunk errors for DUP Chunyan Zhang <zhang.chunyan(a)linaro.org> clk: sprd: Add check for return value of sprd_clk_regmap_init() Russell King <rmk+kernel(a)armlinux.org.uk> fs/adfs: super: fix use-after-free bug JC Kuo <jckuo(a)nvidia.com> clk: tegra210: fix PLLU and PLLU_OUT1 Geert Uytterhoeven <geert+renesas(a)glider.be> dmaengine: rcar-dmac: Reject zero-length slave DMA requests Petr Cvek <petrcvekcz(a)gmail.com> MIPS: lantiq: Fix bitfield masking Jean-Philippe Brucker <jean-philippe.brucker(a)arm.com> firmware/psci: psci_checker: Park kthreads before stopping them Prarit Bhargava <prarit(a)redhat.com> kernel/module.c: Only return -EEXIST for modules that have finished loading Helen Koike <helen.koike(a)collabora.com> arm64: dts: rockchip: fix isp iommu clocks and power domain Dmitry Osipenko <digetx(a)gmail.com> dmaengine: tegra-apb: Error out if DMA_PREP_INTERRUPT flag is unset Cheng Jian <cj.chengjian(a)huawei.com> ftrace: Enable trampoline when rec count returns back to one Douglas Anderson <dianders(a)chromium.org> ARM: dts: rockchip: Mark that the rk3288 timer might stop in suspend Douglas Anderson <dianders(a)chromium.org> ARM: dts: rockchip: Make rk3288-veyron-mickey's emmc work again Douglas Anderson <dianders(a)chromium.org> ARM: dts: rockchip: Make rk3288-veyron-minnie run at hs200 Russell King <rmk+kernel(a)armlinux.org.uk> ARM: riscpc: fix DMA ------------- Diffstat: Makefile | 7 +- arch/arc/Kconfig | 13 ---- arch/arc/configs/nps_defconfig | 1 - arch/arc/configs/vdk_hs38_defconfig | 1 - arch/arc/configs/vdk_hs38_smp_defconfig | 2 - arch/arc/kernel/head.S | 2 - arch/arc/kernel/setup.c | 2 - arch/arm/boot/dts/rk3288-veyron-mickey.dts | 4 -- arch/arm/boot/dts/rk3288-veyron-minnie.dts | 4 -- arch/arm/boot/dts/rk3288.dtsi | 1 + arch/arm/mach-rpc/dma.c | 5 +- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 8 +-- arch/arm64/include/asm/cpufeature.h | 7 +- arch/arm64/kernel/cpufeature.c | 8 ++- arch/arm64/kernel/hw_breakpoint.c | 7 +- arch/mips/lantiq/irq.c | 5 +- arch/parisc/boot/compressed/vmlinux.lds.S | 4 +- arch/x86/boot/compressed/misc.c | 1 + arch/x86/boot/compressed/misc.h | 1 - arch/x86/entry/entry_64.S | 1 - arch/x86/entry/vdso/vclock_gettime.c | 19 ++++-- arch/x86/include/asm/apic.h | 2 +- arch/x86/include/asm/kvm_host.h | 34 +++++----- arch/x86/include/asm/paravirt.h | 1 + arch/x86/include/asm/traps.h | 2 +- arch/x86/kernel/apic/apic.c | 2 +- arch/x86/kernel/kvm.c | 1 + arch/x86/kvm/mmu.c | 6 +- arch/x86/math-emu/fpu_emu.h | 2 +- arch/x86/math-emu/reg_constant.c | 2 +- arch/x86/xen/enlighten_pv.c | 2 +- arch/x86/xen/xen-asm_64.S | 1 - drivers/acpi/blacklist.c | 4 ++ drivers/block/nbd.c | 2 +- drivers/clk/sprd/sc9860-clk.c | 5 +- drivers/clk/tegra/clk-tegra210.c | 8 +-- drivers/dma/sh/rcar-dmac.c | 2 +- drivers/dma/tegra20-apb-dma.c | 12 +++- drivers/firmware/psci_checker.c | 10 +-- drivers/gpio/gpiolib.c | 6 +- drivers/gpu/drm/i915/gvt/kvmgt.c | 12 ++++ drivers/gpu/drm/nouveau/nouveau_connector.c | 2 +- drivers/infiniband/hw/hfi1/chip.c | 11 +++- drivers/infiniband/hw/hfi1/verbs.c | 2 + drivers/infiniband/hw/mlx5/mlx5_ib.h | 1 + drivers/infiniband/hw/mlx5/mr.c | 23 ++++--- drivers/infiniband/hw/mlx5/qp.c | 13 ++-- drivers/misc/eeprom/at24.c | 2 +- drivers/mmc/host/dw_mmc.c | 3 +- drivers/mmc/host/meson-mx-sdio.c | 2 +- drivers/mtd/nand/raw/nand_micron.c | 14 +++- drivers/net/ethernet/emulex/benet/be_main.c | 6 +- drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c | 16 ++--- drivers/perf/arm_pmu.c | 2 +- drivers/rapidio/devices/rio_mport_cdev.c | 2 + drivers/s390/block/dasd_alias.c | 22 +++++-- drivers/s390/scsi/zfcp_erp.c | 7 ++ drivers/scsi/mpt3sas/mpt3sas_base.c | 12 ++-- drivers/xen/swiotlb-xen.c | 4 +- fs/adfs/super.c | 5 +- fs/btrfs/qgroup.c | 24 ++++++- fs/btrfs/send.c | 77 +++++----------------- fs/btrfs/transaction.c | 10 +++ fs/btrfs/volumes.c | 3 +- fs/ceph/super.h | 7 +- fs/ceph/xattr.c | 14 ++-- fs/cifs/connect.c | 8 +-- fs/coda/psdev.c | 5 +- include/linux/acpi.h | 5 +- include/linux/coda.h | 3 +- include/linux/coda_psdev.h | 11 ++++ include/uapi/linux/coda_psdev.h | 13 ---- ipc/mqueue.c | 19 +++--- kernel/module.c | 6 +- kernel/trace/ftrace.c | 28 ++++---- lib/test_overflow.c | 11 ++-- lib/test_string.c | 6 +- mm/cma.c | 13 ++++ mm/vmscan.c | 9 ++- scripts/kconfig/confdata.c | 4 ++ security/selinux/ss/policydb.c | 6 +- sound/hda/hdac_i915.c | 10 +-- tools/objtool/elf.c | 2 +- tools/perf/builtin-version.c | 1 + tools/testing/selftests/cgroup/cgroup_util.c | 3 +- 85 files changed, 385 insertions(+), 281 deletions(-)

5 years, 4 months

9
87
0 0

[PATCH] xtensa: add missing isync to the cpu_reset TLB code

by Max Filippov

ITLB entry modifications must be followed by the isync instruction before the new entries are possibly used. cpu_reset lacks one isync between ITLB way 6 initialization and jump to the identity mapping. Add missing isync to xtensa cpu_reset. Cc: stable(a)vger.kernel.org Signed-off-by: Max Filippov <jcmvbkbc(a)gmail.com> --- arch/xtensa/kernel/setup.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c index 5cb8a62e091c..7c3106093c75 100644 --- a/arch/xtensa/kernel/setup.c +++ b/arch/xtensa/kernel/setup.c @@ -511,6 +511,7 @@ void cpu_reset(void) "add %2, %2, %7\n\t" "addi %0, %0, -1\n\t" "bnez %0, 1b\n\t" + "isync\n\t" /* Jump to identity mapping */ "jx %3\n" "2:\n\t" -- 2.11.0

5 years, 4 months

1
0
0 0

patch "iio: adc: max9611: Fix temperature reading in probe" added to staging-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: adc: max9611: Fix temperature reading in probe to my staging git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git in the staging-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. >From b9ddd5091160793ee9fac10da765cf3f53d2aaf0 Mon Sep 17 00:00:00 2001 From: Jacopo Mondi <jacopo+renesas(a)jmondi.org> Date: Mon, 5 Aug 2019 17:55:15 +0200 Subject: iio: adc: max9611: Fix temperature reading in probe The max9611 driver reads the die temperature at probe time to validate the communication channel. Use the actual read value to perform the test instead of the read function return value, which was mistakenly used so far. The temperature reading test was only successful because the 0 return value is in the range of supported temperatures. Fixes: 69780a3bbc0b ("iio: adc: Add Maxim max9611 ADC driver") Signed-off-by: Jacopo Mondi <jacopo+renesas(a)jmondi.org> Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> --- drivers/iio/adc/max9611.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c index 0e3c6529fc4c..da073d72f649 100644 --- a/drivers/iio/adc/max9611.c +++ b/drivers/iio/adc/max9611.c @@ -480,7 +480,7 @@ static int max9611_init(struct max9611_dev *max9611) if (ret) return ret; - regval = ret & MAX9611_TEMP_MASK; + regval &= MAX9611_TEMP_MASK; if ((regval > MAX9611_TEMP_MAX_POS && regval < MAX9611_TEMP_MIN_NEG) || -- 2.22.0

5 years, 4 months

1
0
0 0

patch "iio: frequency: adf4371: Fix output frequency setting" added to staging-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled iio: frequency: adf4371: Fix output frequency setting to my staging git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git in the staging-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. >From 82a5008a341d301da3ab529ca888c64f529bd075 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nuno=20S=C3=A1?= <nuno.sa(a)analog.com> Date: Mon, 5 Aug 2019 15:37:16 +0200 Subject: iio: frequency: adf4371: Fix output frequency setting MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The fract1 word was not being properly programmed on the device leading to wrong output frequencies. Fixes: 7f699bd14913 (iio: frequency: adf4371: Add support for ADF4371 PLL) Signed-off-by: Nuno Sá <nuno.sa(a)analog.com> Reviewed-by: Stefan Popa <stefan.popa(a)analog.com> Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> --- drivers/iio/frequency/adf4371.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/iio/frequency/adf4371.c b/drivers/iio/frequency/adf4371.c index e48f15cc9ab5..ff82863cbf42 100644 --- a/drivers/iio/frequency/adf4371.c +++ b/drivers/iio/frequency/adf4371.c @@ -276,11 +276,11 @@ static int adf4371_set_freq(struct adf4371_state *st, unsigned long long freq, st->buf[0] = st->integer >> 8; st->buf[1] = 0x40; /* REG12 default */ st->buf[2] = 0x00; - st->buf[3] = st->fract2 & 0xFF; - st->buf[4] = st->fract2 >> 7; - st->buf[5] = st->fract2 >> 15; + st->buf[3] = st->fract1 & 0xFF; + st->buf[4] = st->fract1 >> 8; + st->buf[5] = st->fract1 >> 16; st->buf[6] = ADF4371_FRAC2WORD_L(st->fract2 & 0x7F) | - ADF4371_FRAC1WORD(st->fract1 >> 23); + ADF4371_FRAC1WORD(st->fract1 >> 24); st->buf[7] = ADF4371_FRAC2WORD_H(st->fract2 >> 7); st->buf[8] = st->mod2 & 0xFF; st->buf[9] = ADF4371_MOD2WORD(st->mod2 >> 8); -- 2.22.0

5 years, 4 months

1
0
0 0

patch "USB: core: Fix races in character device registration and" added to usb-linus

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled USB: core: Fix races in character device registration and to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-linus branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will hopefully also be merged in Linus's tree for the next -rc kernel release. If you have any questions about this process, please let me know. >From 303911cfc5b95d33687d9046133ff184cf5043ff Mon Sep 17 00:00:00 2001 From: Alan Stern <stern(a)rowland.harvard.edu> Date: Mon, 12 Aug 2019 16:11:07 -0400 Subject: USB: core: Fix races in character device registration and deregistraion The syzbot fuzzer has found two (!) races in the USB character device registration and deregistration routines. This patch fixes the races. The first race results from the fact that usb_deregister_dev() sets usb_minors[intf->minor] to NULL before calling device_destroy() on the class device. This leaves a window during which another thread can allocate the same minor number but will encounter a duplicate name error when it tries to register its own class device. A typical error message in the system log would look like: sysfs: cannot create duplicate filename '/class/usbmisc/ldusb0' The patch fixes this race by destroying the class device first. The second race is in usb_register_dev(). When that routine runs, it first allocates a minor number, then drops minor_rwsem, and then creates the class device. If the device creation fails, the minor number is deallocated and the whole routine returns an error. But during the time while minor_rwsem was dropped, there is a window in which the minor number is allocated and so another thread can successfully open the device file. Typically this results in use-after-free errors or invalid accesses when the other thread closes its open file reference, because the kernel then tries to release resources that were already deallocated when usb_register_dev() failed. The patch fixes this race by keeping minor_rwsem locked throughout the entire routine. Reported-and-tested-by: syzbot+30cf45ebfe0b0c4847a1(a)syzkaller.appspotmail.com Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> CC: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.1908121607590.1659-100000@iolanth… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/core/file.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c index 65de6f73b672..558890ada0e5 100644 --- a/drivers/usb/core/file.c +++ b/drivers/usb/core/file.c @@ -193,9 +193,10 @@ int usb_register_dev(struct usb_interface *intf, intf->minor = minor; break; } - up_write(&minor_rwsem); - if (intf->minor < 0) + if (intf->minor < 0) { + up_write(&minor_rwsem); return -EXFULL; + } /* create a usb class device for this usb interface */ snprintf(name, sizeof(name), class_driver->name, minor - minor_base); @@ -203,12 +204,11 @@ int usb_register_dev(struct usb_interface *intf, MKDEV(USB_MAJOR, minor), class_driver, "%s", kbasename(name)); if (IS_ERR(intf->usb_dev)) { - down_write(&minor_rwsem); usb_minors[minor] = NULL; intf->minor = -1; - up_write(&minor_rwsem); retval = PTR_ERR(intf->usb_dev); } + up_write(&minor_rwsem); return retval; } EXPORT_SYMBOL_GPL(usb_register_dev); @@ -234,12 +234,12 @@ void usb_deregister_dev(struct usb_interface *intf, return; dev_dbg(&intf->dev, "removing %d minor\n", intf->minor); + device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor)); down_write(&minor_rwsem); usb_minors[intf->minor] = NULL; up_write(&minor_rwsem); - device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor)); intf->usb_dev = NULL; intf->minor = -1; destroy_usb_class(); -- 2.22.0

5 years, 4 months

1
0
0 0

[PATCH] dma-mapping: Use unsigned types for size checks

by Isaac J. Manjarres

Both the size parameter in the dma_alloc_from_[dev/global]_coherent() functions and the size field in the dma_coherent_mem structure are represented by a signed quantity, which makes it so that any comparisons between these two quantities is a signed comparison. When a reserved memory region is larger than or equal to 2GB in size, this will cause the most significant bit to be set to 1, thus, treating the size as a negative number in signed comparisons. This can result in allocation failures when an amount of memory that is strictly less than 2 GB is requested from this region. The allocation fails because the signed comparison to prevent from allocating more memory than what is in the region in __dma_alloc_from_coherent() evaluates to true since the size of the region is treated as a negative number, but the size of the request is treated as a positive number. Thus, change the type of the size parameter in the allocation functions to an unsigned type, and change the type of the size field in the dma_coherent_mem structure to an unsigned type as well, as it does not make sense for sizes to be represented by signed quantities. Fixes: ee7e5516be4f ("generic: per-device coherent dma allocator") Signed-off-by: Isaac J. Manjarres <isaacm(a)codeaurora.org> Cc: stable(a)vger.kernel.org --- include/linux/dma-mapping.h | 6 +++--- kernel/dma/coherent.c | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h index f7d1eea..06d446d 100644 --- a/include/linux/dma-mapping.h +++ b/include/linux/dma-mapping.h @@ -159,14 +159,14 @@ static inline int is_device_dma_capable(struct device *dev) * These three functions are only for dma allocator. * Don't use them in device drivers. */ -int dma_alloc_from_dev_coherent(struct device *dev, ssize_t size, +int dma_alloc_from_dev_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle, void **ret); int dma_release_from_dev_coherent(struct device *dev, int order, void *vaddr); int dma_mmap_from_dev_coherent(struct device *dev, struct vm_area_struct *vma, void *cpu_addr, size_t size, int *ret); -void *dma_alloc_from_global_coherent(ssize_t size, dma_addr_t *dma_handle); +void *dma_alloc_from_global_coherent(size_t size, dma_addr_t *dma_handle); int dma_release_from_global_coherent(int order, void *vaddr); int dma_mmap_from_global_coherent(struct vm_area_struct *vma, void *cpu_addr, size_t size, int *ret); @@ -176,7 +176,7 @@ int dma_mmap_from_global_coherent(struct vm_area_struct *vma, void *cpu_addr, #define dma_release_from_dev_coherent(dev, order, vaddr) (0) #define dma_mmap_from_dev_coherent(dev, vma, vaddr, order, ret) (0) -static inline void *dma_alloc_from_global_coherent(ssize_t size, +static inline void *dma_alloc_from_global_coherent(size_t size, dma_addr_t *dma_handle) { return NULL; diff --git a/kernel/dma/coherent.c b/kernel/dma/coherent.c index 29fd659..c671d5c 100644 --- a/kernel/dma/coherent.c +++ b/kernel/dma/coherent.c @@ -13,7 +13,7 @@ struct dma_coherent_mem { void *virt_base; dma_addr_t device_base; unsigned long pfn_base; - int size; + unsigned long size; unsigned long *bitmap; spinlock_t spinlock; bool use_dev_dma_pfn_offset; @@ -136,7 +136,7 @@ void dma_release_declared_memory(struct device *dev) EXPORT_SYMBOL(dma_release_declared_memory); static void *__dma_alloc_from_coherent(struct dma_coherent_mem *mem, - ssize_t size, dma_addr_t *dma_handle) + size_t size, dma_addr_t *dma_handle) { int order = get_order(size); unsigned long flags; @@ -179,7 +179,7 @@ static void *__dma_alloc_from_coherent(struct dma_coherent_mem *mem, * Returns 0 if dma_alloc_coherent should continue with allocating from * generic memory areas, or !0 if dma_alloc_coherent should return @ret. */ -int dma_alloc_from_dev_coherent(struct device *dev, ssize_t size, +int dma_alloc_from_dev_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle, void **ret) { struct dma_coherent_mem *mem = dev_get_coherent_memory(dev); @@ -191,7 +191,7 @@ int dma_alloc_from_dev_coherent(struct device *dev, ssize_t size, return 1; } -void *dma_alloc_from_global_coherent(ssize_t size, dma_addr_t *dma_handle) +void *dma_alloc_from_global_coherent(size_t size, dma_addr_t *dma_handle) { if (!dma_coherent_default_memory) return NULL; -- The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project

5 years, 4 months

1
0
0 0

[PATCH] mmc: core: Prevent processing SDIO IRQs when the card is suspended

by Ulf Hansson

Processing of SDIO IRQs must obviously be prevented while the card is system suspended, otherwise we may end up trying to communicate with an uninitialized SDIO card. Reports throughout the years shows that this is not only a theoretical problem, but a real issue. So, let's finally fix this problem, by keeping track of the state for the card and bail out before processing the SDIO IRQ, in case the card is suspended. Cc: stable(a)vger.kernel.org Reported-by: Douglas Anderson <dianders(a)chromium.org> Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> --- This has only been compile tested so far, any help for real test on HW is greatly appreciated. Note that, this is only the initial part of what is needed to make power management of SDIO card more robust, but let's start somewhere and continue to improve things. The next step I am looking at right now, is to make sure the SDIO IRQ is turned off during system suspend, unless it's supported as a system wakeup (and enabled to be used). --- drivers/mmc/core/sdio.c | 7 +++++++ drivers/mmc/core/sdio_irq.c | 4 ++++ 2 files changed, 11 insertions(+) diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c index d1aa1c7577bb..9951295d3220 100644 --- a/drivers/mmc/core/sdio.c +++ b/drivers/mmc/core/sdio.c @@ -937,6 +937,10 @@ static int mmc_sdio_pre_suspend(struct mmc_host *host) */ static int mmc_sdio_suspend(struct mmc_host *host) { + /* Prevent processing of SDIO IRQs in suspended state. */ + mmc_card_set_suspended(host->card); + cancel_delayed_work_sync(&host->sdio_irq_work); + mmc_claim_host(host); if (mmc_card_keep_power(host) && mmc_card_wake_sdio_irq(host)) @@ -985,6 +989,9 @@ static int mmc_sdio_resume(struct mmc_host *host) err = sdio_enable_4bit_bus(host->card); } + /* Allow SDIO IRQs to be processed again. */ + mmc_card_clr_suspended(host->card); + if (!err && host->sdio_irqs) { if (!(host->caps2 & MMC_CAP2_SDIO_IRQ_NOTHREAD)) wake_up_process(host->sdio_irq_thread); diff --git a/drivers/mmc/core/sdio_irq.c b/drivers/mmc/core/sdio_irq.c index 931e6226c0b3..9f54a259a1b3 100644 --- a/drivers/mmc/core/sdio_irq.c +++ b/drivers/mmc/core/sdio_irq.c @@ -34,6 +34,10 @@ static int process_sdio_pending_irqs(struct mmc_host *host) unsigned char pending; struct sdio_func *func; + /* Don't process SDIO IRQs if the card is suspended. */ + if (mmc_card_suspended(card)) + return 0; + /* * Optimization, if there is only 1 function interrupt registered * and we know an IRQ was signaled then call irq handler directly. -- 2.17.1

5 years, 4 months

3
7
0 0

[PATCH] dma-buf/sw_sync: Synchronize signal vs syncpt free

by Chris Wilson

During release of the syncpt, we remove it from the list of syncpt and the tree, but only if it is not already been removed. However, during signaling, we first remove the syncpt from the list. So, if we concurrently free and signal the syncpt, the free may decide that it is not part of the tree and immediately free itself -- meanwhile the signaler goes onto to use the now freed datastructure. In particular, we get struct by commit 0e2f733addbf ("dma-buf: make dma_fence structure a bit smaller v2") as the cb_list is immediately clobbered by the kfree_rcu. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111381 Fixes: d3862e44daa7 ("dma-buf/sw-sync: Fix locking around sync_timeline lists") References: 0e2f733addbf ("dma-buf: make dma_fence structure a bit smaller v2") Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk> Cc: Sumit Semwal <sumit.semwal(a)linaro.org> Cc: Sean Paul <seanpaul(a)chromium.org> Cc: Gustavo Padovan <gustavo(a)padovan.org> Cc: Christian König <christian.koenig(a)amd.com> Cc: <stable(a)vger.kernel.org> # v4.14+ --- drivers/dma-buf/sw_sync.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c index 051f6c2873c7..27b1d549ed38 100644 --- a/drivers/dma-buf/sw_sync.c +++ b/drivers/dma-buf/sw_sync.c @@ -132,17 +132,14 @@ static void timeline_fence_release(struct dma_fence *fence) { struct sync_pt *pt = dma_fence_to_sync_pt(fence); struct sync_timeline *parent = dma_fence_parent(fence); + unsigned long flags; + spin_lock_irqsave(fence->lock, flags); if (!list_empty(&pt->link)) { - unsigned long flags; - - spin_lock_irqsave(fence->lock, flags); - if (!list_empty(&pt->link)) { - list_del(&pt->link); - rb_erase(&pt->node, &parent->pt_tree); - } - spin_unlock_irqrestore(fence->lock, flags); + list_del(&pt->link); + rb_erase(&pt->node, &parent->pt_tree); } + spin_unlock_irqrestore(fence->lock, flags); sync_timeline_put(parent); dma_fence_free(fence); -- 2.23.0.rc1

5 years, 4 months

2
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror August 2019