February 2021 - Linux-stable-mirror

[PATCH] KVM: arm64: Avoid corrupting vCPU context register in guest exit

by Will Deacon

Commit 7db21530479f ("KVM: arm64: Restore hyp when panicking in guest context") tracks the currently running vCPU, clearing the pointer to NULL on exit from a guest. Unfortunately, the use of 'set_loaded_vcpu' clobbers x1 to point at the kvm_hyp_ctxt instead of the vCPU context, causing the subsequent RAS code to go off into the weeds when it saves the DISR assuming that the CPU context is embedded in a struct vCPU. Leave x1 alone and use x3 as a temporary register instead when clearing the vCPU on the guest exit path. Cc: Marc Zyngier <maz(a)kernel.org> Cc: Andrew Scull <ascull(a)google.com> Cc: <stable(a)vger.kernel.org> Fixes: 7db21530479f ("KVM: arm64: Restore hyp when panicking in guest context") Suggested-by: Quentin Perret <qperret(a)google.com> Signed-off-by: Will Deacon <will(a)kernel.org> --- This was pretty awful to debug! arch/arm64/kvm/hyp/entry.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/kvm/hyp/entry.S b/arch/arm64/kvm/hyp/entry.S index b0afad7a99c6..0c66a1d408fd 100644 --- a/arch/arm64/kvm/hyp/entry.S +++ b/arch/arm64/kvm/hyp/entry.S @@ -146,7 +146,7 @@ SYM_INNER_LABEL(__guest_exit, SYM_L_GLOBAL) // Now restore the hyp regs restore_callee_saved_regs x2 - set_loaded_vcpu xzr, x1, x2 + set_loaded_vcpu xzr, x2, x3 alternative_if ARM64_HAS_RAS_EXTN // If we have the RAS extensions we can consume a pending error -- 2.30.1.766.gb4fecdf3b7-goog

3 years, 9 months

2
3
0 0

[PATCH 4.19 00/57] 4.19.161-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.161 release. There are 57 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 03 Dec 2020 08:46:29 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.161-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.161-rc1 Alan Stern <stern(a)rowland.harvard.edu> USB: core: Fix regression in Hercules audio card Xiaochen Shen <xiaochen.shen(a)intel.com> x86/resctrl: Add necessary kernfs_put() calls to prevent refcount leak Xiaochen Shen <xiaochen.shen(a)intel.com> x86/resctrl: Remove superfluous kernfs_get() calls to prevent refcount leak Anand K Mistry <amistry(a)google.com> x86/speculation: Fix prctl() when spectre_v2_user={seccomp,prctl},ibpb Zhang Qilong <zhangqilong3(a)huawei.com> usb: gadget: Fix memleak in gadgetfs_fill_super penghao <penghao(a)uniontech.com> USB: quirks: Add USB_QUIRK_DISCONNECT_SUSPEND quirk for Lenovo A630Z TIO built-in usb-audio card Zhang Qilong <zhangqilong3(a)huawei.com> usb: gadget: f_midi: Fix memleak in f_midi_alloc Alan Stern <stern(a)rowland.harvard.edu> USB: core: Change %pK for __user pointers to %px Masami Hiramatsu <mhiramat(a)kernel.org> perf probe: Fix to die_entrypc() returns error correctly Marc Kleine-Budde <mkl(a)pengutronix.de> can: m_can: fix nominal bitiming tseg2 min for version >= 3.1 Kaixu Xia <kaixuxia(a)tencent.com> platform/x86: toshiba_acpi: Fix the wrong variable assignment Benjamin Berg <bberg(a)redhat.com> platform/x86: thinkpad_acpi: Send tablet mode switch at wakeup time Marc Kleine-Budde <mkl(a)pengutronix.de> can: gs_usb: fix endianess problem with candleLight firmware Ard Biesheuvel <ardb(a)kernel.org> efivarfs: revert "fix memory leak in efivarfs_create()" Rui Miguel Silva <rui.silva(a)linaro.org> optee: add writeback to valid memory type Lijun Pan <ljp(a)linux.ibm.com> ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq Lijun Pan <ljp(a)linux.ibm.com> ibmvnic: fix NULL pointer dereference in reset_sub_crq_queues Shay Agroskin <shayagr(a)amazon.com> net: ena: set initial DMA width to avoid intel iommu issue Krzysztof Kozlowski <krzk(a)kernel.org> nfc: s3fwrn5: use signed integer for parsing GPIO numbers Xiongfeng Wang <wangxiongfeng2(a)huawei.com> IB/mthca: fix return value of error branch in mthca_init_cq() Julian Wiedmann <jwi(a)linux.ibm.com> s390/qeth: fix tear down of async TX buffers Raju Rangoju <rajur(a)chelsio.com> cxgb4: fix the panic caused by non smac rewrite Michael Chan <michael.chan(a)broadcom.com> bnxt_en: Release PCI regions when DMA mask setup fails during probe. Dexuan Cui <decui(a)microsoft.com> video: hyperv_fb: Fix the cache type when mapping the VRAM Zhang Changzhong <zhangchangzhong(a)huawei.com> bnxt_en: fix error return code in bnxt_init_board() Zhang Changzhong <zhangchangzhong(a)huawei.com> bnxt_en: fix error return code in bnxt_init_one() Stanley Chu <stanley.chu(a)mediatek.com> scsi: ufs: Fix race between shutdown and runtime resume flow Marc Kleine-Budde <mkl(a)pengutronix.de> ARM: dts: dra76x: m_can: fix order of clocks Taehee Yoo <ap420073(a)gmail.com> batman-adv: set .owner to THIS_MODULE Marc Zyngier <maz(a)kernel.org> phy: tegra: xusb: Fix dangling pointer on probe failure Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> xtensa: uaccess: Add missing __user to strncpy_from_user() prototype Sami Tolvanen <samitolvanen(a)google.com> perf/x86: fix sysfs type mismatches Mike Christie <michael.christie(a)oracle.com> scsi: target: iscsi: Fix cmd abort fabric stop race Lee Duncan <lduncan(a)suse.com> scsi: libiscsi: Fix NOP race condition Sugar Zhang <sugar.zhang(a)rock-chips.com> dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size Minwoo Im <minwoo.im.dev(a)gmail.com> nvme: free sq/cq dbbuf pointers when dbbuf set fails Jens Axboe <axboe(a)kernel.dk> proc: don't allow async path resolution of /proc/self components Hans de Goede <hdegoede(a)redhat.com> HID: Add Logitech Dinovo Edge battery quirk Brian Masney <bmasney(a)redhat.com> x86/xen: don't unbind uninitialized lock_kicker_irq Marc Ferland <ferlandm(a)amotus.ca> dmaengine: xilinx_dma: use readl_poll_timeout_atomic variant Chris Ye <lzye(a)google.com> HID: add HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE for Gamevice devices Pablo Ceballos <pceballos(a)google.com> HID: hid-sensor-hub: Fix issue with devices with no report ID Hans de Goede <hdegoede(a)redhat.com> Input: i8042 - allow insmod to succeed on devices without an i8042 controller Jiri Kosina <jkosina(a)suse.cz> HID: add support for Sega Saturn Frank Yang <puilp0502(a)gmail.com> HID: cypress: Support Varmilo Keyboards' media hotkeys Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close Lyude Paul <lyude(a)redhat.com> drm/atomic_helper: Stop modesets on unregistered connectors harder Will Deacon <will(a)kernel.org> arm64: pgtable: Ensure dirty bit is preserved across pte_wrprotect() Will Deacon <will(a)kernel.org> arm64: pgtable: Fix pte_accessible() Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: Fix split-irqchip vs interrupt injection window request Paolo Bonzini <pbonzini(a)redhat.com> KVM: x86: handle !lapic_in_kernel case in kvm_cpu_*_extint Zenghui Yu <yuzenghui(a)huawei.com> KVM: arm64: vgic-v3: Drop the reporting of GICR_TYPER.Last for userspace Hauke Mehrtens <hauke(a)hauke-m.de> wireless: Use linux/stddef.h instead of stddef.h Filipe Manana <fdmanana(a)suse.com> btrfs: fix lockdep splat when reading qgroup config on mount Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: don't access possibly stale fs_info data for printing duplicate device Cong Wang <cong.wang(a)bytedance.com> netfilter: clear skb->next in NF_HOOK_LIST() Igor Lubashev <ilubashe(a)akamai.com> perf event: Check ref_reloc_sym before using it ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/dra76x.dtsi | 4 +- arch/arm64/include/asm/pgtable.h | 34 +++--- arch/x86/events/intel/cstate.c | 6 +- arch/x86/events/intel/rapl.c | 14 +-- arch/x86/events/intel/uncore.c | 4 +- arch/x86/events/intel/uncore.h | 12 +- arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kernel/cpu/bugs.c | 4 +- arch/x86/kernel/cpu/intel_rdt_rdtgroup.c | 65 +++++------ arch/x86/kvm/irq.c | 85 ++++++-------- arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/x86.c | 18 +-- arch/x86/xen/spinlock.c | 12 +- arch/xtensa/include/asm/uaccess.h | 2 +- drivers/dma/pl330.c | 2 +- drivers/dma/xilinx/xilinx_dma.c | 4 +- drivers/gpu/drm/drm_atomic.c | 21 ---- drivers/gpu/drm/drm_atomic_helper.c | 21 +++- drivers/gpu/drm/drm_connector.c | 11 +- drivers/gpu/drm/i915/intel_dp_mst.c | 8 +- drivers/hid/hid-cypress.c | 44 +++++++- drivers/hid/hid-ids.h | 8 ++ drivers/hid/hid-input.c | 3 + drivers/hid/hid-quirks.c | 5 + drivers/hid/hid-sensor-hub.c | 3 +- drivers/infiniband/hw/mthca/mthca_cq.c | 10 +- drivers/input/serio/i8042.c | 12 +- drivers/net/can/m_can/m_can.c | 2 +- drivers/net/can/usb/gs_usb.c | 131 ++++++++++++---------- drivers/net/ethernet/amazon/ena/ena_netdev.c | 17 ++- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 3 +- drivers/net/ethernet/ibm/ibmvnic.c | 6 + drivers/nfc/s3fwrn5/i2c.c | 4 +- drivers/nvme/host/pci.c | 15 +++ drivers/phy/tegra/xusb.c | 1 + drivers/platform/x86/thinkpad_acpi.c | 1 + drivers/platform/x86/toshiba_acpi.c | 3 +- drivers/s390/net/qeth_core_main.c | 6 - drivers/scsi/libiscsi.c | 23 ++-- drivers/scsi/ufs/ufshcd.c | 6 +- drivers/target/iscsi/iscsi_target.c | 17 ++- drivers/tee/optee/call.c | 3 +- drivers/usb/core/devio.c | 14 +-- drivers/usb/core/quirks.c | 10 ++ drivers/usb/gadget/function/f_midi.c | 10 +- drivers/usb/gadget/legacy/inode.c | 3 + drivers/video/fbdev/hyperv_fb.c | 7 +- fs/btrfs/qgroup.c | 2 +- fs/btrfs/volumes.c | 8 +- fs/efivarfs/inode.c | 2 + fs/efivarfs/super.c | 1 - fs/proc/self.c | 7 ++ include/drm/drm_connector.h | 71 +++++++++++- include/linux/netfilter.h | 2 +- include/scsi/libiscsi.h | 3 + include/uapi/linux/wireless.h | 6 +- net/batman-adv/log.c | 1 + sound/pci/hda/patch_hdmi.c | 20 ++-- tools/perf/util/dwarf-aux.c | 8 ++ tools/perf/util/event.c | 7 +- virt/kvm/arm/vgic/vgic-mmio-v3.c | 22 +++- 63 files changed, 541 insertions(+), 324 deletions(-)

3 years, 9 months

11
77
0 0

[PATCH] perf: fix ccache usage in $(CC) when generating arch errno table

by Antonio Terceiro

This was introduced by commit e4ffd066ff440a57097e9140fa9e16ceef905de8. Assuming the first word of $(CC) is the actual compiler breaks usage like CC="ccache gcc": the script ends up calling ccache directly with gcc arguments, what fails. Instead of getting the first word, just remove from $(CC) any word that starts with a "-". This maintains the spirit of the original patch, while not breaking ccache users. Signed-off-by: Antonio Terceiro <antonio.terceiro(a)linaro.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Arnaldo Carvalho de Melo <acme(a)kernel.org> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com> Cc: Jiri Olsa <jolsa(a)redhat.com> Cc: Namhyung Kim <namhyung(a)kernel.org> Cc: He Zhe <zhe.he(a)windriver.com> CC: stable(a)vger.kernel.org --- tools/perf/Makefile.perf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf index 5345ac70cd83..9bfc725db608 100644 --- a/tools/perf/Makefile.perf +++ b/tools/perf/Makefile.perf @@ -607,7 +607,7 @@ arch_errno_hdr_dir := $(srctree)/tools arch_errno_tbl := $(srctree)/tools/perf/trace/beauty/arch_errno_names.sh $(arch_errno_name_array): $(arch_errno_tbl) - $(Q)$(SHELL) '$(arch_errno_tbl)' $(firstword $(CC)) $(arch_errno_hdr_dir) > $@ + $(Q)$(SHELL) '$(arch_errno_tbl)' '$(patsubst -%,,$(CC))' $(arch_errno_hdr_dir) > $@ sync_file_range_arrays := $(beauty_outdir)/sync_file_range_arrays.c sync_file_range_tbls := $(srctree)/tools/perf/trace/beauty/sync_file_range.sh -- 2.30.1

3 years, 9 months

2
1
0 0

[PATCH v4 04/19] kvm: arm64: nvhe: Save the SPE context early

by Suzuki K Poulose

The nvhe hyp saves the SPE context, flushing any unwritten data before we switch to the guest. But this operation is performed way too late, because : - The ownership of the SPE is transferred to EL2. i.e, using EL2 translations. (MDCR_EL2_E2PB == 0) - The guest Stage1 is loaded. Thus the flush could use the host EL1 virtual address, but use the EL2 translations instead. Fix this by moving the SPE context save early. i.e, Save the context before we load the guest stage1 and before we change the ownership to EL2. The restore path is doing the right thing. Fixes: 014c4c77aad7 ("KVM: arm64: Improve debug register save/restore flow") Cc: stable(a)vger.kernel.org Cc: Christoffer Dall <christoffer.dall(a)arm.com> Cc: Marc Zyngier <maz(a)kernel.org> Cc: Will Deacon <will(a)kernel.org> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Alexandru Elisei <alexandru.elisei(a)arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> --- New patch. --- arch/arm64/include/asm/kvm_hyp.h | 5 +++++ arch/arm64/kvm/hyp/nvhe/debug-sr.c | 12 ++++++++++-- arch/arm64/kvm/hyp/nvhe/switch.c | 12 +++++++++++- 3 files changed, 26 insertions(+), 3 deletions(-) diff --git a/arch/arm64/include/asm/kvm_hyp.h b/arch/arm64/include/asm/kvm_hyp.h index c0450828378b..385bd7dd3d39 100644 --- a/arch/arm64/include/asm/kvm_hyp.h +++ b/arch/arm64/include/asm/kvm_hyp.h @@ -83,6 +83,11 @@ void sysreg_restore_guest_state_vhe(struct kvm_cpu_context *ctxt); void __debug_switch_to_guest(struct kvm_vcpu *vcpu); void __debug_switch_to_host(struct kvm_vcpu *vcpu); +#ifdef __KVM_NVHE_HYPERVISOR__ +void __debug_save_host_buffers_nvhe(struct kvm_vcpu *vcpu); +void __debug_restore_host_buffers_nvhe(struct kvm_vcpu *vcpu); +#endif + void __fpsimd_save_state(struct user_fpsimd_state *fp_regs); void __fpsimd_restore_state(struct user_fpsimd_state *fp_regs); diff --git a/arch/arm64/kvm/hyp/nvhe/debug-sr.c b/arch/arm64/kvm/hyp/nvhe/debug-sr.c index 91a711aa8382..f401724f12ef 100644 --- a/arch/arm64/kvm/hyp/nvhe/debug-sr.c +++ b/arch/arm64/kvm/hyp/nvhe/debug-sr.c @@ -58,16 +58,24 @@ static void __debug_restore_spe(u64 pmscr_el1) write_sysreg_s(pmscr_el1, SYS_PMSCR_EL1); } -void __debug_switch_to_guest(struct kvm_vcpu *vcpu) +void __debug_save_host_buffers_nvhe(struct kvm_vcpu *vcpu) { /* Disable and flush SPE data generation */ __debug_save_spe(&vcpu->arch.host_debug_state.pmscr_el1); +} + +void __debug_switch_to_guest(struct kvm_vcpu *vcpu) +{ __debug_switch_to_guest_common(vcpu); } -void __debug_switch_to_host(struct kvm_vcpu *vcpu) +void __debug_restore_host_buffers_nvhe(struct kvm_vcpu *vcpu) { __debug_restore_spe(vcpu->arch.host_debug_state.pmscr_el1); +} + +void __debug_switch_to_host(struct kvm_vcpu *vcpu) +{ __debug_switch_to_host_common(vcpu); } diff --git a/arch/arm64/kvm/hyp/nvhe/switch.c b/arch/arm64/kvm/hyp/nvhe/switch.c index f3d0e9eca56c..10eed66136a0 100644 --- a/arch/arm64/kvm/hyp/nvhe/switch.c +++ b/arch/arm64/kvm/hyp/nvhe/switch.c @@ -192,6 +192,15 @@ int __kvm_vcpu_run(struct kvm_vcpu *vcpu) pmu_switch_needed = __pmu_switch_to_guest(host_ctxt); __sysreg_save_state_nvhe(host_ctxt); + /* + * For nVHE, we must save and disable any SPE + * buffers, as the translation regime is going + * to be loaded with that of the guest. And we must + * save host context for SPE, before we change the + * ownership to EL2 (via MDCR_EL2_E2PB == 0) and before + * we load guest Stage1. + */ + __debug_save_host_buffers_nvhe(vcpu); __adjust_pc(vcpu); @@ -234,11 +243,12 @@ int __kvm_vcpu_run(struct kvm_vcpu *vcpu) if (vcpu->arch.flags & KVM_ARM64_FP_ENABLED) __fpsimd_save_fpexc32(vcpu); + __debug_switch_to_host(vcpu); /* * This must come after restoring the host sysregs, since a non-VHE * system may enable SPE here and make use of the TTBRs. */ - __debug_switch_to_host(vcpu); + __debug_restore_host_buffers_nvhe(vcpu); if (pmu_switch_needed) __pmu_switch_to_host(host_ctxt); -- 2.24.1

3 years, 9 months

3
4
0 0

[PATCH v4] MIPS: introduce config option to force use FR=0 for FPXX binary

by YunQiang Su

some binary, for example the output of golang, may be mark as FPXX, while in fact they are still FP32. Since FPXX binary can work with both FR=1 and FR=0, we introduce a config option CONFIG_MIPS_O32_FPXX_USE_FR0 to force it to use FR=0 here. https://go-review.googlesource.com/c/go/+/239217 https://go-review.googlesource.com/c/go/+/237058 v3->v4: introduce a config option: CONFIG_MIPS_O32_FPXX_USE_FR0 v2->v3: commit message: add Signed-off-by and Cc to stable. v1->v2: Fix bad commit message: in fact, we are switching to FR=0 Signed-off-by: YunQiang Su <yunqiang.su(a)cipunited.com> Cc: stable(a)vger.kernel.org # 4.19+ --- arch/mips/Kconfig | 11 +++++++++++ arch/mips/kernel/elf.c | 13 ++++++++++--- 2 files changed, 21 insertions(+), 3 deletions(-) diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig index 0a17bedf4f0d..442db620636f 100644 --- a/arch/mips/Kconfig +++ b/arch/mips/Kconfig @@ -3100,6 +3100,17 @@ config MIPS_O32_FP64_SUPPORT If unsure, say N. +config MIPS_O32_FPXX_USE_FR0 + bool "Use FR=0 mode for O32 FPXX binaries" if !CPU_MIPSR6 + depends on MIPS_O32_FP64_SUPPORT + help + O32 FPXX can works on both FR=0 and FR=1 mode, so by default, the + mode preferred by hardware is used. + + While some binaries may be marked as FPXX by mistake, for example + output of golang: they are in fact FP32 mode. To compatiable with + these binaries, we should use FR=0 mode for them. + config USE_OF bool select OF diff --git a/arch/mips/kernel/elf.c b/arch/mips/kernel/elf.c index 7b045d2a0b51..443ced26ee60 100644 --- a/arch/mips/kernel/elf.c +++ b/arch/mips/kernel/elf.c @@ -234,9 +234,10 @@ int arch_check_elf(void *_ehdr, bool has_interpreter, void *_interp_ehdr, * fpxx case. This is because, in any-ABI (or no-ABI) we have no FPU * instructions so we don't care about the mode. We will simply use * the one preferred by the hardware. In fpxx case, that ABI can - * handle both FR=1 and FR=0, so, again, we simply choose the one - * preferred by the hardware. Next, if we only use single-precision - * FPU instructions, and the default ABI FPU mode is not good + * handle both FR=1 and FR=0. Here, we may need to use FR=0, because + * some binaries may be mark as FPXX by mistake (ie, output of golang). + * - If we only use single-precision FPU instructions, + * and the default ABI FPU mode is not good * (ie single + any ABI combination), we set again the FPU mode to the * one is preferred by the hardware. Next, if we know that the code * will only use single-precision instructions, shown by single being @@ -248,8 +249,14 @@ int arch_check_elf(void *_ehdr, bool has_interpreter, void *_interp_ehdr, */ if (prog_req.fre && !prog_req.frdefault && !prog_req.fr1) state->overall_fp_mode = FP_FRE; +#if CONFIG_MIPS_O32_FPXX_USE_FR0 + else if (prog_req.fr1 && prog_req.frdefault) + state->overall_fp_mode = FP_FR0; + else if (prog_req.single && !prog_req.frdefault) +#else else if ((prog_req.fr1 && prog_req.frdefault) || (prog_req.single && !prog_req.frdefault)) +#endif /* Make sure 64-bit MIPS III/IV/64R1 will not pick FR1 */ state->overall_fp_mode = ((raw_current_cpu_data.fpu_id & MIPS_FPIR_F64) && cpu_has_mips_r2_r6) ? -- 2.20.1

3 years, 9 months

4
6
0 0

[PATCH v2] regulator: pca9450: Clear PRESET_EN bit to fix BUCK1/2/3 voltage setting

by Schrempf Frieder

From: Frieder Schrempf <frieder.schrempf(a)kontron.de> The driver uses the DVS registers PCA9450_REG_BUCKxOUT_DVS0 to set the voltage for the buck regulators 1, 2 and 3. This has no effect as the PRESET_EN bit is set by default and therefore the preset values are used instead, which are set to 850 mV. To fix this we clear the PRESET_EN bit at time of initialization. Fixes: 0935ff5f1f0a ("regulator: pca9450: add pca9450 pmic driver") Cc: <stable(a)vger.kernel.org> Signed-off-by: Frieder Schrempf <frieder.schrempf(a)kontron.de> --- Changes in v2: * Improve comment and commit message * Use regmap_clear_bits() instead of regmap_update_bits() * Add error code to log message --- drivers/regulator/pca9450-regulator.c | 8 ++++++++ include/linux/regulator/pca9450.h | 3 +++ 2 files changed, 11 insertions(+) diff --git a/drivers/regulator/pca9450-regulator.c b/drivers/regulator/pca9450-regulator.c index 833d398c6aa2..d38109cc3a01 100644 --- a/drivers/regulator/pca9450-regulator.c +++ b/drivers/regulator/pca9450-regulator.c @@ -797,6 +797,14 @@ static int pca9450_i2c_probe(struct i2c_client *i2c, return ret; } + /* Clear PRESET_EN bit in BUCK123_DVS to use DVS registers */ + ret = regmap_clear_bits(pca9450->regmap, PCA9450_REG_BUCK123_DVS, + BUCK123_PRESET_EN); + if (ret) { + dev_err(&i2c->dev, "Failed to clear PRESET_EN bit: %d\n", ret); + return ret; + } + /* Set reset behavior on assertion of WDOG_B signal */ ret = regmap_update_bits(pca9450->regmap, PCA9450_REG_RESET_CTRL, WDOG_B_CFG_MASK, WDOG_B_CFG_COLD_LDO12); diff --git a/include/linux/regulator/pca9450.h b/include/linux/regulator/pca9450.h index ccdb5320a240..71902f41c919 100644 --- a/include/linux/regulator/pca9450.h +++ b/include/linux/regulator/pca9450.h @@ -147,6 +147,9 @@ enum { #define BUCK6_FPWM 0x04 #define BUCK6_ENMODE_MASK 0x03 +/* PCA9450_REG_BUCK123_PRESET_EN bit */ +#define BUCK123_PRESET_EN 0x80 + /* PCA9450_BUCK1OUT_DVS0 bits */ #define BUCK1OUT_DVS0_MASK 0x7F #define BUCK1OUT_DVS0_DEFAULT 0x14 -- 2.25.1

3 years, 9 months

2
1
0 0

[PATCH v2] misc: fastrpc: restrict user apps from sending kernel RPC messages

by Dmitry Baryshkov

Verify that user applications are not using the kernel RPC message handle to restrict them from directly attaching to guest OS on the remote subsystem. This is a port of CVE-2019-2308 fix. Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method") Cc: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> Cc: Jonathan Marek <jonathan(a)marek.ca> Cc: stable(a)vger.kernel.org Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> --- Changes since v1: - changed to dev_warn_ratelimited to prevent userspace from flooding kernel log drivers/misc/fastrpc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index f12e909034ac..beda610e6b30 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -950,6 +950,11 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl, u32 kernel, if (!fl->cctx->rpdev) return -EPIPE; + if (handle == FASTRPC_INIT_HANDLE && !kernel) { + dev_warn_ratelimited(fl->sctx->dev, "user app trying to send a kernel RPC message (%d)\n", handle); + return -EPERM; + } + ctx = fastrpc_context_alloc(fl, kernel, sc, args); if (IS_ERR(ctx)) return PTR_ERR(ctx); -- 2.30.0

3 years, 9 months

2
5
0 0

[PATCH v2 2/3] x86/entry: Fix entry/exit mismatch on failed fast 32-bit syscalls

by Andy Lutomirski

On a 32-bit fast syscall that fails to read its arguments from user memory, the kernel currently does syscall exit work but not syscall entry work. This confuses audit and ptrace. For example: $ ./tools/testing/selftests/x86/syscall_arg_fault_32 ... strace: pid 264258: entering, ptrace_syscall_info.op == 2 ... This is a minimal fix intended for ease of backporting. A more complete cleanup is coming. Cc: stable(a)vger.kernel.org Fixes: 0b085e68f407 ("x86/entry: Consolidate 32/64 bit syscall entry") Signed-off-by: Andy Lutomirski <luto(a)kernel.org> --- arch/x86/entry/common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c index 0904f5676e4d..cf4dcf346ca8 100644 --- a/arch/x86/entry/common.c +++ b/arch/x86/entry/common.c @@ -128,7 +128,8 @@ static noinstr bool __do_fast_syscall_32(struct pt_regs *regs) regs->ax = -EFAULT; instrumentation_end(); - syscall_exit_to_user_mode(regs); + local_irq_disable(); + exit_to_user_mode(); return false; } -- 2.29.2

3 years, 9 months

2
1
0 0

[PATCH v3] usb: typec: tcpm: Wait for vbus discharge to VSAFE0V before toggling

by Badhri Jagan Sridharan

When vbus auto discharge is enabled, TCPM can sometimes be faster than the TCPC i.e. TCPM can go ahead and move the port to unattached state (involves disabling vbus auto discharge) before TCPC could effectively discharge vbus to VSAFE0V. This leaves vbus with residual charge and increases the decay time which prevents tsafe0v from being met. This change makes TCPM waits for a maximum of tSafe0V(max) for vbus to discharge to VSAFE0V before transitioning to unattached state and re-enable toggling. If vbus discharges to vsafe0v sooner, then, transition to unattached state happens right away. Also, while in SNK_READY, when auto discharge is enabled, drive disconnect based on vbus turning off instead of Rp disappearing on CC pins. Rp disappearing on CC pins is almost instanteous compared to vbus decay. Sink detach: [ 541.703058] CC1: 3 -> 0, CC2: 0 -> 0 [state SNK_READY, polarity 0, disconnected] [ 541.703331] Setting voltage/current limit 5000 mV 0 mA [ 541.727235] VBUS on [ 541.749650] VBUS off [ 541.749653] pending state change SNK_READY -> SNK_UNATTACHED @ 650 ms [rev3 NONE_AMS] [ 541.749944] VBUS VSAFE0V [ 541.749945] state change SNK_READY -> SNK_UNATTACHED [rev3 NONE_AMS] [ 541.750806] Disable vbus discharge ret:0 [ 541.907345] Start toggling [ 541.922799] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected] Source detach: [ 2555.310414] state change SRC_SEND_CAPABILITIES -> SRC_READY [rev3 POWER_NEGOTIATION] [ 2555.310675] AMS POWER_NEGOTIATION finished [ 2555.310679] cc:=3 [ 2593.645886] CC1: 0 -> 0, CC2: 2 -> 0 [state SRC_READY, polarity 1, disconnected] [ 2593.645919] pending state change SRC_READY -> SNK_UNATTACHED @ 650 ms [rev3 NONE_AMS] [ 2593.648419] VBUS off [ 2593.648960] VBUS VSAFE0V [ 2593.648965] state change SRC_READY -> SNK_UNATTACHED [rev3 NONE_AMS] [ 2593.649962] Disable vbus discharge ret:0 [ 2593.890322] Start toggling [ 2593.925663] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, Fixes: f321a02caebd ("usb: typec: tcpm: Implement enabling Auto Discharge disconnect support") Signed-off-by: Badhri Jagan Sridharan <badhri(a)google.com> --- Changes since V1: - Add Fixes tag Changes since V2: - Remove VBUS_DISCHARGE state as preferred by Guenter Roeck --- drivers/usb/typec/tcpm/tcpm.c | 75 ++++++++++++++++++++++++++++++----- 1 file changed, 65 insertions(+), 10 deletions(-) diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c index be0b6469dd3d..8469c37a59e1 100644 --- a/drivers/usb/typec/tcpm/tcpm.c +++ b/drivers/usb/typec/tcpm/tcpm.c @@ -438,6 +438,9 @@ struct tcpm_port { enum tcpm_ams next_ams; bool in_ams; + /* Auto vbus discharge status */ + bool auto_vbus_discharge_enabled; + #ifdef CONFIG_DEBUG_FS struct dentry *dentry; struct mutex logbuffer_lock; /* log buffer access lock */ @@ -507,6 +510,9 @@ static const char * const pd_rev[] = { (tcpm_port_is_sink(port) && \ ((port)->cc1 == TYPEC_CC_RP_3_0 || (port)->cc2 == TYPEC_CC_RP_3_0)) +#define tcpm_wait_for_discharge(port) \ + (((port)->auto_vbus_discharge_enabled && !(port)->vbus_vsafe0v) ? PD_T_SAFE_0V : 0) + static enum tcpm_state tcpm_default_state(struct tcpm_port *port) { if (port->port_type == TYPEC_PORT_DRP) { @@ -3413,6 +3419,8 @@ static int tcpm_src_attach(struct tcpm_port *port) if (port->tcpc->enable_auto_vbus_discharge) { ret = port->tcpc->enable_auto_vbus_discharge(port->tcpc, true); tcpm_log_force(port, "enable vbus discharge ret:%d", ret); + if (!ret) + port->auto_vbus_discharge_enabled = true; } ret = tcpm_set_roles(port, true, TYPEC_SOURCE, tcpm_data_role_for_source(port)); @@ -3495,6 +3503,8 @@ static void tcpm_reset_port(struct tcpm_port *port) if (port->tcpc->enable_auto_vbus_discharge) { ret = port->tcpc->enable_auto_vbus_discharge(port->tcpc, false); tcpm_log_force(port, "Disable vbus discharge ret:%d", ret); + if (!ret) + port->auto_vbus_discharge_enabled = false; } port->in_ams = false; port->ams = NONE_AMS; @@ -3568,6 +3578,8 @@ static int tcpm_snk_attach(struct tcpm_port *port) tcpm_set_auto_vbus_discharge_threshold(port, TYPEC_PWR_MODE_USB, false, VSAFE5V); ret = port->tcpc->enable_auto_vbus_discharge(port->tcpc, true); tcpm_log_force(port, "enable vbus discharge ret:%d", ret); + if (!ret) + port->auto_vbus_discharge_enabled = true; } ret = tcpm_set_roles(port, true, TYPEC_SINK, tcpm_data_role_for_sink(port)); @@ -4670,9 +4682,9 @@ static void _tcpm_cc_change(struct tcpm_port *port, enum typec_cc_status cc1, if (tcpm_port_is_disconnected(port) || !tcpm_port_is_source(port)) { if (port->port_type == TYPEC_PORT_SRC) - tcpm_set_state(port, SRC_UNATTACHED, 0); + tcpm_set_state(port, SRC_UNATTACHED, tcpm_wait_for_discharge(port)); else - tcpm_set_state(port, SNK_UNATTACHED, 0); + tcpm_set_state(port, SNK_UNATTACHED, tcpm_wait_for_discharge(port)); } break; case SNK_UNATTACHED: @@ -4703,7 +4715,23 @@ static void _tcpm_cc_change(struct tcpm_port *port, enum typec_cc_status cc1, tcpm_set_state(port, SNK_DEBOUNCED, 0); break; case SNK_READY: - if (tcpm_port_is_disconnected(port)) + /* + * EXIT condition is based primarily on vbus disconnect and CC is secondary. + * "A port that has entered into USB PD communications with the Source and + * has seen the CC voltage exceed vRd-USB may monitor the CC pin to detect + * cable disconnect in addition to monitoring VBUS. + * + * A port that is monitoring the CC voltage for disconnect (but is not in + * the process of a USB PD PR_Swap or USB PD FR_Swap) shall transition to + * Unattached.SNK within tSinkDisconnect after the CC voltage remains below + * vRd-USB for tPDDebounce." + * + * When set_auto_vbus_discharge_threshold is enabled, CC pins go + * away before vbus decays to disconnect threshold. Allow + * disconnect to be driven by vbus disconnect when auto vbus + * discharge is enabled. + */ + if (!port->auto_vbus_discharge_enabled && tcpm_port_is_disconnected(port)) tcpm_set_state(port, unattached_state(port), 0); else if (!port->pd_capable && (cc1 != old_cc1 || cc2 != old_cc2)) @@ -4802,9 +4830,13 @@ static void _tcpm_cc_change(struct tcpm_port *port, enum typec_cc_status cc1, * Ignore CC changes here. */ break; - default: - if (tcpm_port_is_disconnected(port)) + /* + * While acting as sink and auto vbus discharge is enabled, Allow disconnect + * to be driven by vbus disconnect. + */ + if (tcpm_port_is_disconnected(port) && !(port->pwr_role == TYPEC_SINK && + port->auto_vbus_discharge_enabled)) tcpm_set_state(port, unattached_state(port), 0); break; } @@ -4968,8 +5000,16 @@ static void _tcpm_pd_vbus_off(struct tcpm_port *port) case SRC_TRANSITION_SUPPLY: case SRC_READY: case SRC_WAIT_NEW_CAPABILITIES: - /* Force to unattached state to re-initiate connection */ - tcpm_set_state(port, SRC_UNATTACHED, 0); + /* + * Force to unattached state to re-initiate connection. + * DRP port should move to Unattached.SNK instead of Unattached.SRC if + * sink removed. Although sink removal here is due to source's vbus collapse, + * treat it the same way for consistency. + */ + if (port->port_type == TYPEC_PORT_SRC) + tcpm_set_state(port, SRC_UNATTACHED, tcpm_wait_for_discharge(port)); + else + tcpm_set_state(port, SNK_UNATTACHED, tcpm_wait_for_discharge(port)); break; case PORT_RESET: @@ -4988,9 +5028,8 @@ static void _tcpm_pd_vbus_off(struct tcpm_port *port) break; default: - if (port->pwr_role == TYPEC_SINK && - port->attached) - tcpm_set_state(port, SNK_UNATTACHED, 0); + if (port->pwr_role == TYPEC_SINK && port->attached) + tcpm_set_state(port, SNK_UNATTACHED, tcpm_wait_for_discharge(port)); break; } } @@ -5012,7 +5051,23 @@ static void _tcpm_pd_vbus_vsafe0v(struct tcpm_port *port) tcpm_set_state(port, tcpm_try_snk(port) ? SNK_TRY : SRC_ATTACHED, PD_T_CC_DEBOUNCE); break; + case SRC_STARTUP: + case SRC_SEND_CAPABILITIES: + case SRC_SEND_CAPABILITIES_TIMEOUT: + case SRC_NEGOTIATE_CAPABILITIES: + case SRC_TRANSITION_SUPPLY: + case SRC_READY: + case SRC_WAIT_NEW_CAPABILITIES: + if (port->auto_vbus_discharge_enabled) { + if (port->port_type == TYPEC_PORT_SRC) + tcpm_set_state(port, SRC_UNATTACHED, 0); + else + tcpm_set_state(port, SNK_UNATTACHED, 0); + } + break; default: + if (port->pwr_role == TYPEC_SINK && port->auto_vbus_discharge_enabled) + tcpm_set_state(port, SNK_UNATTACHED, 0); break; } } -- 2.30.0.617.g56c4b15f3c-goog

3 years, 9 months

3
2
0 0

[PATCH 4.9.258] futex: fix dead code in attach_to_pi_owner()

by Xiaoming Ni

The handle_exit_race() function is defined in commit 9c3f39860367 ("futex: Cure exit race"), which never returns -EBUSY. This results in a small piece of dead code in the attach_to_pi_owner() function: int ret = handle_exit_race(uaddr, uval, p); /* Never return -EBUSY */ ... if (ret == -EBUSY) *exiting = p; /* dead code */ The return value -EBUSY is added to handle_exit_race() in upsteam commit ac31c7ff8624409 ("futex: Provide distinct return value when owner is exiting"). This commit was incorporated into v4.9.255, before the function handle_exit_race() was introduced, whitout Modify handle_exit_race(). To fix dead code, extract the change of handle_exit_race() from commit ac31c7ff8624409 ("futex: Provide distinct return value when owner is exiting"), re-incorporated. Fixes: 9c3f39860367 ("futex: Cure exit race") Cc: stable(a)vger.kernel.org # v4.9.258 Signed-off-by: Xiaoming Ni <nixiaoming(a)huawei.com> --- kernel/futex.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/futex.c b/kernel/futex.c index b65dbb5d60bb..0fd785410150 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -1207,11 +1207,11 @@ static int handle_exit_race(u32 __user *uaddr, u32 uval, u32 uval2; /* - * If the futex exit state is not yet FUTEX_STATE_DEAD, wait - * for it to finish. + * If the futex exit state is not yet FUTEX_STATE_DEAD, tell the + * caller that the alleged owner is busy. */ if (tsk && tsk->futex_state != FUTEX_STATE_DEAD) - return -EAGAIN; + return -EBUSY; /* * Reread the user space value to handle the following situation: -- 2.27.0

3 years, 9 months

3
2
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror February 2021