Hi,
unfortunately I missed message that the stable release queue repository
for 4.1.y changed. It looks like I am not copied on release announcements,
so I missed the last couple of releases. As a result, my builders did not
catch any changes for some time.
I just ran a test on v4.1.50 and got the following results.
Build results:
total: 139 pass: 133 fail: 6
Failed builds:
arm:axm55xx_defconfig
arm64:allmodconfig
i386:defconfig
i386:allyesconfig
i386:allmodconfig
i386:allnoconfig
Qemu test results:
total: 125 pass: 111 fail: 14
Failed tests:
arm64:virt:smp:defconfig:initrd
arm64:xlnx-zcu102:smp:defconfig:initrd:zynqmp-ep108
arm64:virt:nosmp:defconfig:initrd
arm64:xlnx-zcu102:nosmp:defconfig:initrd:zynqmp-ep108
x86:Broadwell:q35:x86_pc_defconfig
x86:Skylake-Client:q35:x86_pc_defconfig
x86:SandyBridge:q35:x86_pc_defconfig
x86:Haswell:pc:x86_pc_defconfig
x86:Nehalem:q35:x86_pc_defconfig
x86:phenom:pc:x86_pc_defconfig
x86:core2duo:q35:x86_pc_nosmp_defconfig
x86:Conroe:isapc:x86_pc_nosmp_defconfig
x86:Opteron_G1:pc:x86_pc_nosmp_defconfig
x86:n270:isapc:x86_pc_nosmp_defconfig
From the logs:
Building arm:axm55xx_defconfig ... failed
--------------
Error log:
arch/arm/kvm/handle_exit.c: In function 'handle_hvc':
arch/arm/kvm/handle_exit.c:48:3: error: implicit declaration of function 'vcpu_set_reg'
Building arm64:allmodconfig ... failed
--------------
Error log:
arch/arm64/kvm/handle_exit.c:45:3: error: implicit declaration of function ‘vcpu_set_reg’; did you mean ‘vcpu_sys_reg’?
Building i386:defconfig ... failed
--------------
Error log:
arch/x86/lib/checksum_32.S:32:31: fatal error: asm/nospec-branch.h
All other failures have the same cause.
Guenter
Hi Greg,
Hi Sasha,
commit 9b54d816e0042 ("blkcg: fix double free of new_blkg in blkcg_init_queue")
fixes CVE-2018-7480. See https://nvd.nist.gov/vuln/detail/CVE-2018-7480 for details.
Please apply to v4.1.y .. v4.9.y.
Thanks,
Guenter
Commit 726d061fbd36 ("mm: vmscan: kick flushers when we encounter
dirty pages on the LRU") added flusher invocation to
shrink_inactive_list() when many dirty pages on the LRU are encountered.
However, shrink_inactive_list() doesn't wake up flushers for legacy
cgroup reclaim, so the next commit bbef938429f5 ("mm: vmscan: remove
old flusher wakeup from direct reclaim path") removed the only source
of flusher's wake up in legacy mem cgroup reclaim path.
This leads to premature OOM if there is too many dirty pages in cgroup:
# mkdir /sys/fs/cgroup/memory/test
# echo $$ > /sys/fs/cgroup/memory/test/tasks
# echo 50M > /sys/fs/cgroup/memory/test/memory.limit_in_bytes
# dd if=/dev/zero of=tmp_file bs=1M count=100
Killed
dd invoked oom-killer: gfp_mask=0x14000c0(GFP_KERNEL), nodemask=(null), order=0, oom_score_adj=0
Call Trace:
dump_stack+0x46/0x65
dump_header+0x6b/0x2ac
oom_kill_process+0x21c/0x4a0
out_of_memory+0x2a5/0x4b0
mem_cgroup_out_of_memory+0x3b/0x60
mem_cgroup_oom_synchronize+0x2ed/0x330
pagefault_out_of_memory+0x24/0x54
__do_page_fault+0x521/0x540
page_fault+0x45/0x50
Task in /test killed as a result of limit of /test
memory: usage 51200kB, limit 51200kB, failcnt 73
memory+swap: usage 51200kB, limit 9007199254740988kB, failcnt 0
kmem: usage 296kB, limit 9007199254740988kB, failcnt 0
Memory cgroup stats for /test: cache:49632KB rss:1056KB rss_huge:0KB shmem:0KB
mapped_file:0KB dirty:49500KB writeback:0KB swap:0KB inactive_anon:0KB
active_anon:1168KB inactive_file:24760KB active_file:24960KB unevictable:0KB
Memory cgroup out of memory: Kill process 3861 (bash) score 88 or sacrifice child
Killed process 3876 (dd) total-vm:8484kB, anon-rss:1052kB, file-rss:1720kB, shmem-rss:0kB
oom_reaper: reaped process 3876 (dd), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
Wake up flushers in legacy cgroup reclaim too.
Fixes: bbef938429f5 ("mm: vmscan: remove old flusher wakeup from direct reclaim path")
Signed-off-by: Andrey Ryabinin <aryabinin(a)virtuozzo.com>
Cc: <stable(a)vger.kernel.org>
---
mm/vmscan.c | 31 ++++++++++++++++---------------
1 file changed, 16 insertions(+), 15 deletions(-)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 8fcd9f8d7390..4390a8d5be41 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1771,6 +1771,20 @@ shrink_inactive_list(unsigned long nr_to_scan, struct lruvec *lruvec,
if (stat.nr_writeback && stat.nr_writeback == nr_taken)
set_bit(PGDAT_WRITEBACK, &pgdat->flags);
+ /*
+ * If dirty pages are scanned that are not queued for IO, it
+ * implies that flushers are not doing their job. This can
+ * happen when memory pressure pushes dirty pages to the end of
+ * the LRU before the dirty limits are breached and the dirty
+ * data has expired. It can also happen when the proportion of
+ * dirty pages grows not through writes but through memory
+ * pressure reclaiming all the clean cache. And in some cases,
+ * the flushers simply cannot keep up with the allocation
+ * rate. Nudge the flusher threads in case they are asleep.
+ */
+ if (stat.nr_unqueued_dirty == nr_taken)
+ wakeup_flusher_threads(WB_REASON_VMSCAN);
+
/*
* Legacy memcg will stall in page writeback so avoid forcibly
* stalling here.
@@ -1783,22 +1797,9 @@ shrink_inactive_list(unsigned long nr_to_scan, struct lruvec *lruvec,
if (stat.nr_dirty && stat.nr_dirty == stat.nr_congested)
set_bit(PGDAT_CONGESTED, &pgdat->flags);
- /*
- * If dirty pages are scanned that are not queued for IO, it
- * implies that flushers are not doing their job. This can
- * happen when memory pressure pushes dirty pages to the end of
- * the LRU before the dirty limits are breached and the dirty
- * data has expired. It can also happen when the proportion of
- * dirty pages grows not through writes but through memory
- * pressure reclaiming all the clean cache. And in some cases,
- * the flushers simply cannot keep up with the allocation
- * rate. Nudge the flusher threads in case they are asleep, but
- * also allow kswapd to start writing pages during reclaim.
- */
- if (stat.nr_unqueued_dirty == nr_taken) {
- wakeup_flusher_threads(WB_REASON_VMSCAN);
+ /* Allow kswapd to start writing pages during reclaim. */
+ if (stat.nr_unqueued_dirty == nr_taken)
set_bit(PGDAT_DIRTY, &pgdat->flags);
- }
/*
* If kswapd scans pages marked marked for immediate
--
2.16.1
From: Mikhail Lappo <mikhail.lappo(a)esrlabs.com>
When device boots with T > T_trip_1 and requests interrupt,
the race condition takes place. The interrupt comes before
THERMAL_DEVICE_ENABLED is set. This leads to an attempt to
reading sensor value from irq and disabling the sensor, based on
the data->mode field, which expected to be THERMAL_DEVICE_ENABLED,
but still stays as THERMAL_DEVICE_DISABLED. Afher this issue
sensor is never re-enabled, as the driver state is wrong.
Fix this problem by setting the 'data' members prior to
requesting the interrupts.
Fixes: 37713a1e8e4c ("thermal: imx: implement thermal alarm interrupt handling")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Mikhail Lappo <mikhail.lappo(a)esrlabs.com>
Signed-off-by: Fabio Estevam <fabio.estevam(a)nxp.com>
---
drivers/thermal/imx_thermal.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
index a67781b..ee3a215 100644
--- a/drivers/thermal/imx_thermal.c
+++ b/drivers/thermal/imx_thermal.c
@@ -637,6 +637,9 @@ static int imx_thermal_probe(struct platform_device *pdev)
regmap_write(map, TEMPSENSE0 + REG_CLR, TEMPSENSE0_POWER_DOWN);
regmap_write(map, TEMPSENSE0 + REG_SET, TEMPSENSE0_MEASURE_TEMP);
+ data->irq_enabled = true;
+ data->mode = THERMAL_DEVICE_ENABLED;
+
ret = devm_request_threaded_irq(&pdev->dev, data->irq,
imx_thermal_alarm_irq, imx_thermal_alarm_irq_thread,
0, "imx_thermal", data);
@@ -649,9 +652,6 @@ static int imx_thermal_probe(struct platform_device *pdev)
return ret;
}
- data->irq_enabled = true;
- data->mode = THERMAL_DEVICE_ENABLED;
-
return 0;
}
--
2.7.4
This is a note to let you know that I've just added the patch titled
phy: allwinner: sun4i-usb: poll vbus changes on A23/A33 when driving
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From d7119224bfe6e8efbf821a52db7da9530d790f07 Mon Sep 17 00:00:00 2001
From: Chen-Yu Tsai <wens(a)csie.org>
Date: Fri, 19 Jan 2018 17:25:41 +0800
Subject: phy: allwinner: sun4i-usb: poll vbus changes on A23/A33 when driving
VBUS
The AXP223 PMIC, like the AXP221, does not generate VBUS change
interrupts when N_VBUSEN is used to drive VBUS for the OTG port
on the board.
This was not noticed until recently, as most A23/A33 boards use
a GPIO pin that does not support interrupts for OTG ID detection.
This forces the driver to use polling. However the A33-OlinuXino
uses a pin that does support interrupts, so the driver uses them.
However the VBUS interrupt never fires, and the driver never gets
to update the VBUS status. This results in musb timing out waiting
for VBUS to rise.
This was worked around for the AXP221 by resorting to polling
changes in commit 91d96f06a760 ("phy-sun4i-usb: Add workaround for
missing Vbus det interrupts on A31"). This patch adds the A23 and
A33 to the list of SoCs that need the workaround.
Fixes: fc1f45ed3043 ("phy-sun4i-usb: Add support for the usb-phys on the
sun8i-a33 SoC")
Fixes: 123dfdbcfaf5 ("phy-sun4i-usb: Add support for the usb-phys on the
sun8i-a23 SoC")
Cc: <stable(a)vger.kernel.org> # 4.3.x: 68dbc2ce77bb phy-sun4i-usb:
Use of_match_node to get model specific config data
Cc: <stable(a)vger.kernel.org> # 4.3.x: 5cf700ac9d50 phy: phy-sun4i-usb:
Fix optional gpios failing probe
Cc: <stable(a)vger.kernel.org> # 4.3.x: 04e59a0211ff phy-sun4i-usb:
Fix irq free conditions to match request conditions
Cc: <stable(a)vger.kernel.org> # 4.3.x: 91d96f06a760 phy-sun4i-usb:
Add workaround for missing Vbus det interrupts on A31
Cc: <stable(a)vger.kernel.org> # 4.3.x
Signed-off-by: Chen-Yu Tsai <wens(a)csie.org>
Acked-by: Maxime Ripard <maxime.ripard(a)free-electrons.com>
Signed-off-by: Kishon Vijay Abraham I <kishon(a)ti.com>
Signed-off-by: Kishon Vijay Abraham I <kishon(a)ti.com>
---
drivers/phy/allwinner/phy-sun4i-usb.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c
index bee798892b21..d4dcd39b8d76 100644
--- a/drivers/phy/allwinner/phy-sun4i-usb.c
+++ b/drivers/phy/allwinner/phy-sun4i-usb.c
@@ -411,11 +411,13 @@ static bool sun4i_usb_phy0_poll(struct sun4i_usb_phy_data *data)
return true;
/*
- * The A31 companion pmic (axp221) does not generate vbus change
- * interrupts when the board is driving vbus, so we must poll
+ * The A31/A23/A33 companion pmics (AXP221/AXP223) do not
+ * generate vbus change interrupts when the board is driving
+ * vbus using the N_VBUSEN pin on the pmic, so we must poll
* when using the pmic for vbus-det _and_ we're driving vbus.
*/
- if (data->cfg->type == sun6i_a31_phy &&
+ if ((data->cfg->type == sun6i_a31_phy ||
+ data->cfg->type == sun8i_a33_phy) &&
data->vbus_power_supply && data->phys[0].regulator_on)
return true;
@@ -886,7 +888,7 @@ static const struct sun4i_usb_phy_cfg sun7i_a20_cfg = {
static const struct sun4i_usb_phy_cfg sun8i_a23_cfg = {
.num_phys = 2,
- .type = sun4i_a10_phy,
+ .type = sun6i_a31_phy,
.disc_thresh = 3,
.phyctl_offset = REG_PHYCTL_A10,
.dedicated_clocks = true,
--
2.16.2
As per the IFC hardware manual, Most significant 2 bytes in
nand_fsr register are the outcome of NAND READ STATUS command.
So status value need to be shifted and aligned as per the nand
framework requirement.
Fixes: 82771882d960 ("NAND Machine support for Integrated Flash Controller")
Cc: stable(a)vger.kernel.org # v3.18+
Signed-off-by: Jagdish Gediya <jagdish.gediya(a)nxp.com>
Reviewed-by: Prabhakar Kushwaha <prabhakar.kushwaha(a)nxp.com>
---
Changes for v2: Incorporated comments from Boris Brezillon
- Added fixes tag
drivers/mtd/nand/fsl_ifc_nand.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/nand/fsl_ifc_nand.c b/drivers/mtd/nand/fsl_ifc_nand.c
index 9390cbd..0aa03ba 100644
--- a/drivers/mtd/nand/fsl_ifc_nand.c
+++ b/drivers/mtd/nand/fsl_ifc_nand.c
@@ -643,12 +643,13 @@ static int fsl_ifc_wait(struct mtd_info *mtd, struct nand_chip *chip)
fsl_ifc_run_command(mtd);
nand_fsr = ifc_in32(&ifc->ifc_nand.nand_fsr);
-
+ nand_fsr >>= 16;
+ nand_fsr = (nand_fsr >> 8) | (nand_fsr << 8);
/*
* The chip always seems to report that it is
* write-protected, even when it is not.
*/
- return nand_fsr | NAND_STATUS_WP;
+ return (nand_fsr & 0xff) | NAND_STATUS_WP;
}
/*
--
1.9.1
This is the start of the stable review cycle for the 4.14.25 release.
There are 110 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri Mar 9 19:10:03 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.25-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.25-rc1
Sagi Grimberg <sagi(a)grimberg.me>
nvme-rdma: don't suppress send completions
NeilBrown <neilb(a)suse.com>
md: only allow remove_and_add_spares when no sync_thread running.
Adam Ford <aford173(a)gmail.com>
ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux
Adam Ford <aford173(a)gmail.com>
ARM: dts: LogicPD SOM-LV: Fix I2C1 pinmux
Kai Heng Feng <kai.heng.feng(a)canonical.com>
ACPI / bus: Parse tables as term_list for Dell XPS 9570 and Precision M5530
Eric Biggers <ebiggers(a)google.com>
KVM/x86: remove WARN_ON() for when vm_munmap() fails
Tianyu Lan <lantianyu1986(a)gmail.com>
KVM/x86: Fix wrong macro references of X86_CR0_PG_BIT and X86_CR4_PAE_BIT in kvm_valid_sregs()
Ard Biesheuvel <ard.biesheuvel(a)linaro.org>
PCI/ASPM: Deal with missing root ports in link state handling
Radim Krčmář <rkrcmar(a)redhat.com>
KVM: x86: fix vcpu initialization with userspace lapic
Paolo Bonzini <pbonzini(a)redhat.com>
KVM/VMX: Optimize vmx_vcpu_run() and svm_vcpu_run() by marking the RDMSR path as unlikely()
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: x86: move LAPIC initialization after VMCS creation
Paolo Bonzini <pbonzini(a)redhat.com>
KVM/x86: Remove indirect MSR op calls from SPEC_CTRL
Wanpeng Li <wanpeng.li(a)hotmail.com>
KVM: mmu: Fix overlap between public and private memslots
Wanpeng Li <wanpengli(a)tencent.com>
KVM: X86: Fix SMRAM accessing even if VM is shutdown
Paolo Bonzini <pbonzini(a)redhat.com>
KVM: x86: extend usage of RET_MMIO_PF_* constants
Arnd Bergmann <arnd(a)arndb.de>
ARM: kvm: fix building with gcc-8
Ulf Magnusson <ulfalizer(a)gmail.com>
ARM: mvebu: Fix broken PL310_ERRATA_753970 selects
Daniel Schultz <d.schultz(a)phytec.de>
ARM: dts: rockchip: Remove 1.8 GHz operation point from phycore som
Arnd Bergmann <arnd(a)arndb.de>
ARM: orion: fix orion_ge00_switch_board_info initialization
Jan Beulich <JBeulich(a)suse.com>
x86/mm: Fix {pmd,pud}_{set,clear}_flags()
Rasmus Villemoes <linux(a)rasmusvillemoes.dk>
nospec: Allow index argument to have const-qualified type
David Hildenbrand <david(a)redhat.com>
KVM: s390: consider epoch index on TOD clock syncs
David Hildenbrand <david(a)redhat.com>
KVM: s390: consider epoch index on hotplugged CPUs
David Hildenbrand <david(a)redhat.com>
KVM: s390: provide only a single function for setting the tod (fix SCK)
David Hildenbrand <david(a)redhat.com>
KVM: s390: take care of clock-comparator sign control
Anna Karbownik <anna.karbownik(a)intel.com>
EDAC, sb_edac: Fix out of bound writes during DIMM configuration on KNL
Mauro Carvalho Chehab <mchehab(a)kernel.org>
media: m88ds3103: don't call a non-initalized function
Ming Lei <ming.lei(a)redhat.com>
blk-mq: don't call io sched's .requeue_request when requeueing rq to ->dispatch
Julian Wiedmann <jwi(a)linux.vnet.ibm.com>
s390/qeth: fix IPA command submission race
Julian Wiedmann <jwi(a)linux.vnet.ibm.com>
s390/qeth: fix IP address lookup for L3 devices
Julian Wiedmann <jwi(a)linux.vnet.ibm.com>
Revert "s390/qeth: fix using of ref counter for rxip addresses"
Julian Wiedmann <jwi(a)linux.vnet.ibm.com>
s390/qeth: fix double-free on IP add/remove race
Julian Wiedmann <jwi(a)linux.vnet.ibm.com>
s390/qeth: fix IP removal on offline cards
Julian Wiedmann <jwi(a)linux.vnet.ibm.com>
s390/qeth: fix overestimated count of buffer elements
Julian Wiedmann <jwi(a)linux.vnet.ibm.com>
s390/qeth: fix SETIP command handling
Ursula Braun <ubraun(a)linux.vnet.ibm.com>
s390/qeth: fix underestimated count of buffer elements
Jason Wang <jasowang(a)redhat.com>
virtio-net: disable NAPI only when enabled during XDP set
Jason Wang <jasowang(a)redhat.com>
tuntap: disable preemption during XDP processing
Jason Wang <jasowang(a)redhat.com>
tuntap: correctly add the missing XDP flush
Soheil Hassas Yeganeh <soheil(a)google.com>
tcp: purge write queue upon RST
Jason A. Donenfeld <Jason(a)zx2c4.com>
netlink: put module reference if dump start fails
Ido Schimmel <idosch(a)mellanox.com>
mlxsw: spectrum_router: Do not unconditionally clear route offload indication
Paolo Abeni <pabeni(a)redhat.com>
cls_u32: fix use after free in u32_destroy_key()
Tom Lendacky <thomas.lendacky(a)amd.com>
amd-xgbe: Restore PCI interrupt enablement setting on resume
Eran Ben Elisha <eranbe(a)mellanox.com>
net/mlx5e: Verify inline header size do not exceed SKB linear size
Ido Schimmel <idosch(a)mellanox.com>
bridge: Fix VLAN reference count problem
Alexey Kodanev <alexey.kodanev(a)oracle.com>
sctp: fix dst refcnt leak in sctp_v6_get_dst()
David Ahern <dsahern(a)gmail.com>
net: ipv4: Set addr_type in hash_keys for forwarded case
Jiri Pirko <jiri(a)mellanox.com>
mlxsw: spectrum_router: Fix error path in mlxsw_sp_vr_create
Yuchung Cheng <ycheng(a)google.com>
tcp: revert F-RTO extension to detect more spurious timeouts
Yuchung Cheng <ycheng(a)google.com>
tcp: revert F-RTO middle-box workaround
Xin Long <lucien.xin(a)gmail.com>
sctp: do not pr_err for the duplicated node in transport rhlist
Ivan Vecera <ivecera(a)redhat.com>
net/sched: cls_u32: fix cls_u32 on filter replace
Eric Dumazet <edumazet(a)google.com>
net_sched: gen_estimator: fix broken estimators based on percpu stats
Inbar Karmy <inbark(a)mellanox.com>
net/mlx5e: Fix loopback self test when GRO is off
Tonghao Zhang <xiangxia.m.yue(a)gmail.com>
doc: Change the min default value of tcp_wmem/tcp_rmem.
Eric Dumazet <edumazet(a)google.com>
tcp_bbr: better deal with suboptimal GSO
David Howells <dhowells(a)redhat.com>
rxrpc: Fix send in rxrpc_send_data_packet()
Ilya Lesokhin <ilyal(a)mellanox.com>
tcp: Honor the eor bit in tcp_mtu_probe
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: fix phy_start to consider PHY_IGNORE_INTERRUPT
Gal Pressman <galp(a)mellanox.com>
net/mlx5e: Specify numa node when allocating drop rq
Shalom Toledo <shalomt(a)mellanox.com>
mlxsw: spectrum_switchdev: Check success of FDB add operation
Tommi Rantala <tommi.t.rantala(a)nokia.com>
sctp: fix dst refcnt leak in sctp_v4_get_dst
Gal Pressman <galp(a)mellanox.com>
net/mlx5e: Fix TCP checksum in LRO buffers
Alexey Kodanev <alexey.kodanev(a)oracle.com>
udplite: fix partial checksum initialization
Alexey Kodanev <alexey.kodanev(a)oracle.com>
sctp: verify size of a new chunk in _sctp_make_chunk()
Guillaume Nault <g.nault(a)alphalink.fr>
ppp: prevent unregistered channels from connecting to PPP units
Roman Kapl <code(a)rkapl.cz>
net: sched: report if filter is too large to dump
Nicolas Dichtel <nicolas.dichtel(a)6wind.com>
netlink: ensure to loop over all netns in genlmsg_multicast_allns()
Sabrina Dubroca <sd(a)queasysnail.net>
net: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68
Jakub Kicinski <jakub.kicinski(a)netronome.com>
net: fix race on decreasing number of TX queues
Grygorii Strashko <grygorii.strashko(a)ti.com>
net: ethernet: ti: cpsw: fix net watchdog timeout
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
net: amd-xgbe: fix comparison to bitshift when dealing with a mask
Arnd Bergmann <arnd(a)arndb.de>
ipv6 sit: work around bogus gcc-8 -Wrestrict warning
Denis Du <dudenis2000(a)yahoo.ca>
hdlc_ppp: carrier detect ok, don't turn off negotiation
Stefano Brivio <sbrivio(a)redhat.com>
fib_semantics: Don't match route with mismatching tclassid
Xin Long <lucien.xin(a)gmail.com>
bridge: check brport attr show in brport_show
Thomas Gleixner <tglx(a)linutronix.de>
x86/cpu_entry_area: Sync cpu_entry_area to initial_page_table
Sebastian Panceac <sebastian(a)resin.io>
x86/platform/intel-mid: Handle Intel Edison reboot correctly
Juergen Gross <jgross(a)suse.com>
x86/xen: Zero MSR_IA32_SPEC_CTRL before suspend
Jan Kara <jack(a)suse.cz>
direct-io: Fix sleep in atomic due to sync AIO
Dan Williams <dan.j.williams(a)intel.com>
dax: fix vma_is_fsdax() helper
Viresh Kumar <viresh.kumar(a)linaro.org>
cpufreq: s3c24xx: Fix broken s3c_cpufreq_init()
Dan Williams <dan.j.williams(a)intel.com>
vfio: disable filesystem-dax page pinning
Ming Lei <ming.lei(a)redhat.com>
block: kyber: fix domain token leak during requeue
Jiufei Xue <jiufei.xue(a)linux.alibaba.com>
block: fix the count of PGPGOUT for WRITE_SAME
Anand Jain <anand.jain(a)oracle.com>
btrfs: use proper endianness accessors for super_copy
John David Anglin <dave.anglin(a)bell.net>
parisc: Fix ordering of cache and TLB flushes
Helge Deller <deller(a)gmx.de>
parisc: Reduce irq overhead when run in qemu
Helge Deller <deller(a)gmx.de>
parisc: Use cr16 interval timers unconditionally on qemu
Lingutla Chandrasekhar <clingutla(a)codeaurora.org>
timers: Forward timer base before migrating timers
Shawn Lin <shawn.lin(a)rock-chips.com>
mmc: dw_mmc: Fix out-of-bounds access for slot's caps
Shawn Lin <shawn.lin(a)rock-chips.com>
mmc: dw_mmc: Factor out dw_mci_init_slot_caps
Shawn Lin <shawn.lin(a)rock-chips.com>
mmc: dw_mmc: Avoid accessing registers in runtime suspended state
Geert Uytterhoeven <geert+renesas(a)glider.be>
mmc: dw_mmc-k3: Fix out-of-bounds access through DT alias
Adrian Hunter <adrian.hunter(a)intel.com>
mmc: sdhci-pci: Fix S0i3 for Intel BYT-based controllers
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda - Fix pincfg at resume on Lenovo T470 dock
Hans de Goede <hdegoede(a)redhat.com>
ALSA: hda: Add a power_save blacklist
Takashi Iwai <tiwai(a)suse.de>
ALSA: x86: Fix missing spinlock and mutex initializations
Richard Fitzgerald <rf(a)opensource.cirrus.com>
ALSA: control: Fix memory corruption risk in snd_ctl_elem_read
Erik Veijola <erik.veijola(a)gmail.com>
ALSA: usb-audio: Add a quirck for B&W PX headphones
Alexander Steffen <Alexander.Steffen(a)infineon.com>
tpm_tis_spi: Use DMA-safe memory for SPI transfers
Arnd Bergmann <arnd(a)arndb.de>
tpm: constify transmit data pointers
Jeremy Boone <jeremy.boone(a)nccgroup.trust>
tpm_tis: fix potential buffer overruns caused by bit glitches on the bus
Jeremy Boone <jeremy.boone(a)nccgroup.trust>
tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus
Jeremy Boone <jeremy.boone(a)nccgroup.trust>
tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus
Jeremy Boone <jeremy.boone(a)nccgroup.trust>
tpm: fix potential buffer overruns caused by bit glitches on the bus
Jeremy Boone <jeremy.boone(a)nccgroup.trust>
tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus
Emil Tantilov <emil.s.tantilov(a)intel.com>
ixgbe: fix crash in build_skb Rx code path
Hans de Goede <hdegoede(a)redhat.com>
Bluetooth: btusb: Use DMI matching for QCA reset_resume quirking
-------------
Diffstat:
Documentation/networking/ip-sysctl.txt | 4 +-
Makefile | 4 +-
arch/arm/boot/dts/logicpd-som-lv.dtsi | 9 +-
arch/arm/boot/dts/logicpd-torpedo-som.dtsi | 8 ++
arch/arm/boot/dts/rk3288-phycore-som.dtsi | 20 ----
arch/arm/kvm/hyp/Makefile | 5 +
arch/arm/kvm/hyp/banked-sr.c | 4 +
arch/arm/mach-mvebu/Kconfig | 4 +-
arch/arm/plat-orion/common.c | 23 ++--
arch/parisc/include/asm/cacheflush.h | 1 +
arch/parisc/include/asm/processor.h | 2 +
arch/parisc/kernel/cache.c | 57 +++++-----
arch/parisc/kernel/pacache.S | 22 ++++
arch/parisc/kernel/time.c | 11 +-
arch/s390/kvm/interrupt.c | 25 ++++-
arch/s390/kvm/kvm-s390.c | 79 +++++++------
arch/s390/kvm/kvm-s390.h | 5 +-
arch/s390/kvm/priv.c | 9 +-
arch/x86/include/asm/pgtable.h | 8 +-
arch/x86/include/asm/pgtable_32.h | 1 +
arch/x86/include/asm/pgtable_64.h | 1 +
arch/x86/include/asm/pgtable_types.h | 10 ++
arch/x86/kernel/setup.c | 17 +--
arch/x86/kernel/setup_percpu.c | 17 +--
arch/x86/kvm/lapic.c | 11 +-
arch/x86/kvm/mmu.c | 97 ++++++++--------
arch/x86/kvm/paging_tmpl.h | 18 +--
arch/x86/kvm/svm.c | 9 +-
arch/x86/kvm/vmx.c | 9 +-
arch/x86/kvm/x86.c | 12 +-
arch/x86/mm/cpu_entry_area.c | 6 +
arch/x86/mm/init_32.c | 15 +++
arch/x86/platform/intel-mid/intel-mid.c | 2 +-
arch/x86/xen/suspend.c | 16 +++
block/blk-core.c | 2 +-
block/blk-mq.c | 4 +-
block/kyber-iosched.c | 1 +
drivers/acpi/bus.c | 38 +++++--
drivers/bluetooth/btusb.c | 25 ++++-
drivers/char/tpm/st33zp24/st33zp24.c | 4 +-
drivers/char/tpm/tpm-interface.c | 4 +
drivers/char/tpm/tpm2-cmd.c | 4 +
drivers/char/tpm/tpm_i2c_infineon.c | 5 +-
drivers/char/tpm/tpm_i2c_nuvoton.c | 8 +-
drivers/char/tpm/tpm_tis.c | 2 +-
drivers/char/tpm/tpm_tis_core.c | 9 +-
drivers/char/tpm/tpm_tis_core.h | 4 +-
drivers/char/tpm/tpm_tis_spi.c | 48 ++++----
drivers/cpufreq/s3c24xx-cpufreq.c | 8 +-
drivers/edac/sb_edac.c | 2 +-
drivers/md/md.c | 4 +
drivers/media/dvb-frontends/m88ds3103.c | 7 +-
drivers/mmc/host/dw_mmc-exynos.c | 1 +
drivers/mmc/host/dw_mmc-k3.c | 4 +
drivers/mmc/host/dw_mmc-rockchip.c | 1 +
drivers/mmc/host/dw_mmc-zx.c | 1 +
drivers/mmc/host/dw_mmc.c | 84 +++++++++-----
drivers/mmc/host/dw_mmc.h | 2 +
drivers/mmc/host/sdhci-pci-core.c | 35 +++++-
drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 2 +-
drivers/net/ethernet/amd/xgbe/xgbe-pci.c | 2 +
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 8 ++
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 10 +-
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 49 +++++---
.../net/ethernet/mellanox/mlx5/core/en_selftest.c | 3 +-
drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 2 +-
.../net/ethernet/mellanox/mlxsw/spectrum_router.c | 22 ++--
.../ethernet/mellanox/mlxsw/spectrum_switchdev.c | 29 ++++-
drivers/net/ethernet/ti/cpsw.c | 16 ++-
drivers/net/phy/phy.c | 2 +-
drivers/net/ppp/ppp_generic.c | 9 ++
drivers/net/tun.c | 7 ++
drivers/net/virtio_net.c | 8 +-
drivers/net/wan/hdlc_ppp.c | 5 +-
drivers/nvme/host/rdma.c | 54 +++------
drivers/pci/pcie/aspm.c | 8 +-
drivers/s390/net/qeth_core.h | 7 +-
drivers/s390/net/qeth_core_main.c | 43 +++----
drivers/s390/net/qeth_l3.h | 34 +++++-
drivers/s390/net/qeth_l3_main.c | 123 +++++++++------------
drivers/vfio/vfio_iommu_type1.c | 18 ++-
fs/btrfs/sysfs.c | 8 +-
fs/btrfs/transaction.c | 20 ++--
fs/direct-io.c | 3 +-
include/linux/fs.h | 2 +-
include/linux/nospec.h | 3 +-
include/net/udplite.h | 1 +
kernel/time/timer.c | 6 +
net/bridge/br_sysfs_if.c | 3 +
net/bridge/br_vlan.c | 2 +
net/core/dev.c | 11 +-
net/core/gen_estimator.c | 1 +
net/ipv4/fib_semantics.c | 5 +
net/ipv4/route.c | 10 +-
net/ipv4/tcp_input.c | 24 ++--
net/ipv4/tcp_output.c | 33 +++++-
net/ipv4/udp.c | 5 +
net/ipv6/ip6_checksum.c | 5 +
net/ipv6/sit.c | 2 +-
net/netlink/af_netlink.c | 4 +-
net/netlink/genetlink.c | 12 +-
net/rxrpc/output.c | 2 +-
net/sched/cls_api.c | 7 +-
net/sched/cls_u32.c | 24 ++--
net/sctp/input.c | 5 +-
net/sctp/ipv6.c | 10 +-
net/sctp/protocol.c | 10 +-
net/sctp/sm_make_chunk.c | 7 +-
sound/core/control.c | 2 +-
sound/pci/hda/hda_intel.c | 38 ++++++-
sound/pci/hda/patch_realtek.c | 3 +-
sound/usb/quirks-table.h | 47 ++++++++
sound/x86/intel_hdmi_audio.c | 2 +
virt/kvm/kvm_main.c | 3 +-
114 files changed, 1065 insertions(+), 564 deletions(-)
From: Gabriel Matni <gabriel.matni(a)exfo.com>
Fixes missing characters on kernel console at low baud rates (i.e.9600).
The driver should poll TX_RDY or TX_FIFO_EMP instead of TX_EMP to ensure
that the transmitter holding register (THR) is ready to receive a new byte.
TX_EMP tells us when it is possible to send a break sequence via
SND_BRK_SEQ. While this also indicates that both the THR and the TSR are
empty, it does not guarantee that a new byte can be written just yet.
Fixes: 30530791a7a0 ("serial: mvebu-uart: initial support for Armada-3700 serial port")
Reviewed-by: Miquel Raynal <miquel.raynal(a)bootlin.com>
Acked-by: Gregory CLEMENT <gregory.clement(a)bootlin.com>
Signed-off-by: Gabriel Matni <gabriel.matni(a)exfo.com>
---
drivers/tty/serial/mvebu-uart.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
index a100e98259d7..f0df0640208e 100644
--- a/drivers/tty/serial/mvebu-uart.c
+++ b/drivers/tty/serial/mvebu-uart.c
@@ -618,7 +618,7 @@ static void wait_for_xmitr(struct uart_port *port)
u32 val;
readl_poll_timeout_atomic(port->membase + UART_STAT, val,
- (val & STAT_TX_EMP), 1, 10000);
+ (val & STAT_TX_RDY(port)), 1, 10000);
}
static void mvebu_uart_console_putchar(struct uart_port *port, int ch)
--
2.7.4
> -----Original Message-----
> From: Miquel Raynal [mailto:miquel.raynal@bootlin.com]
> Sent: March 5, 2018 4:47 AM
> To: Gabriel Matni <gabriel.matni(a)exfo.com>
> Cc: linux-arm-kernel(a)lists.infradead.org; gregkh(a)linuxfoundation.org;
> Grégory Clement <gregory.clement(a)bootlin.com>; Thomas Petazzoni
> <thomas.petazzoni(a)bootlin.com>
> Subject: Re: [PATCH] serial: mvebu_uart: fix tx lost characters
>
> Hi Gabriel,
>
> On Tue, 27 Feb 2018 21:56:03 +0000, Gabriel Matni
> <gabriel.matni(a)exfo.com> wrote:
>
> > Hi Miquèl,
> >
> > > -----Original Message-----
> > > From: Miquel Raynal [mailto:miquel.raynal@bootlin.com]
> > > Sent: February 27, 2018 8:13 AM
> > > To: Gabriel Matni <gabriel.matni(a)exfo.com>
> > > Cc: linux-arm-kernel(a)lists.infradead.org; gregkh(a)linuxfoundation.org;
> > > Grégory Clement <gregory.clement(a)bootlin.com>; Thomas Petazzoni
> > > <thomas.petazzoni(a)bootlin.com>
> > > Subject: Re: [PATCH] serial: mvebu_uart: fix tx lost characters
> > >
> > > Hi Gabriel,
> > >
> > > On Thu, 22 Feb 2018 20:30:56 +0000, Gabriel Matni
> > > <gabriel.matni(a)exfo.com> wrote:
> > >
> > > > From: Gabriel Matni <gabriel.matni(a)exfo.com>
> > > >
> > > > Fixes missing characters on kernel console at low baud rates (i.e.9600).
> > > > The driver should poll TX_RDY instead of TX_EMPTY to ensure that the
> > > > transmitter holding is ready to receive a new byte. Polling TX_EMPTY
> > > > isn't enough as the hardware buffer can become empty but not yet
> ready
> > > > for CPU to write the next byte.
> > >
> > > I am kind of sceptic with the explanation. My understanding is that:
> > > - TX_EMPTY means the FIFO is empty
>
> I had a deeper look into the spec : TX_EMPTY != TX_FIFO_EMPTY. I was
> referring to TX_FIFO_EMPTY here so my understanding of your solution was
> wrong.
>
> > > - TX_RDY means the FIFO is not full, neither empty, it is a "half
> > > loaded" state.
> > > Polling TX_RDY instead of TX_EMPTY should work too, but I don't see why
> it
> > > would fix the loss of character by filling the FIFO when there are bytes in
> it
> > > rather than when it is fully empty.
> >
> > TX_READY is set whenever the UART Transmitter Holding register is ready
> to
> > receive a new byte. It gets cleared as soon as a new byte is written to the
> > register. If the FIFO is empty or still has room, the ready will be set.
> >
> > TX_EMPTY tells us when it is possible to send a break sequence via
> > SND_BRK_SEQ. While this also indicates that both the THR and the TSR are
> > empty, it does not guarantee that a new byte can be written just yet.
>
> I do agree with this statement. You are right that polling on TX_EMPTY
> looks wrong and we should definitively poll on TX_READY instead.
>
> > I am
> > unsure about the FIFO status in this case as I can encounter
> TX_FIFO_EMP=0
> > while TX_EMP=1, which suggests that the FIFO isn't necessarily empty
> when
> > TX_EMP is set.
>
> That is weird but maybe the TX_FIFO_EMPTY is asserted only when all
> bits have been shifted, which is a 10-bit period after TSR is
> cleared, while TX_EMPTY would not wait for these bits to be actually
> shifted out and would be asserted a bit earlier, as soon as TSR is
> cleared. That is just and idea.
>
> >
> > Therefore, the driver can either poll TX_FIFO_EMP or TX_READY to know
> > whether it can output a new byte. I personally like TX_READY as it takes
> > advantage of the FIFO.
>
> True.
>
> >
> > > >
> > > > Signed-off-by: Gabriel Matni <gabriel.matni(a)exfo.com>
>
> Reviewed-by: Miquel Raynal <miquel.raynal(a)bootlin.com>
>
> Thanks,
> Miquèl
>
> --
> Miquel Raynal, Bootlin (formerly Free Electrons)
> Embedded Linux and Kernel engineering
> https://bootlin.com
Recent patches broke build on multi_v7_defconfig (ARM), on
stable-rc/linux-4.4.y branch. The build error as follows:
arch/arm/mach-omap2/omap_hwmod_7xx_data.c:2243:12: error:
'HWMOD_CLKDM_NOAUTO' undeclared here (not in a function)
.flags = HWMOD_CLKDM_NOAUTO,
^~~~~~~~~~~~~~~~~~
Pull in missing dependency patches to fix that build error.
1. "Allow modules to disable HW_AUTO": this commit is needed to fix
build error
2. "add usecounting support to autoidle APIs": this commit is a
dependency for 1
3. "provide space for more hwmod flags": this is also a dependency for 1
Tested on TI BeagleBoard X15.
Roger Quadros (1):
ARM: OMAP2+ hwmod: Allow modules to disable HW_AUTO
Sekhar Nori (1):
ARM: OMAP2+: omap_hwmod: provide space for more hwmod flags
Tero Kristo (1):
ARM: OMAP2+: clockdomain: add usecounting support to autoidle APIs
arch/arm/mach-omap2/clockdomain.c | 36 ++++++++++++++++++++++++------------
arch/arm/mach-omap2/clockdomain.h | 2 ++
arch/arm/mach-omap2/cpuidle44xx.c | 2 +-
arch/arm/mach-omap2/omap-smp.c | 2 +-
arch/arm/mach-omap2/omap_hwmod.c | 32 +++++++++++++++++---------------
arch/arm/mach-omap2/omap_hwmod.h | 7 ++++++-
arch/arm/mach-omap2/pm.c | 8 +-------
arch/arm/mach-omap2/powerdomain.c | 20 ++++++--------------
8 files changed, 58 insertions(+), 51 deletions(-)
--
2.16.1
This is a note to let you know that I've just added the patch titled
phy: allwinner: sun4i-usb: poll vbus changes on A23/A33 when driving
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-testing branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will be merged to the usb-next branch sometime soon,
after it passes testing, and the merge window is open.
If you have any questions about this process, please let me know.
>From d7119224bfe6e8efbf821a52db7da9530d790f07 Mon Sep 17 00:00:00 2001
From: Chen-Yu Tsai <wens(a)csie.org>
Date: Fri, 19 Jan 2018 17:25:41 +0800
Subject: phy: allwinner: sun4i-usb: poll vbus changes on A23/A33 when driving
VBUS
The AXP223 PMIC, like the AXP221, does not generate VBUS change
interrupts when N_VBUSEN is used to drive VBUS for the OTG port
on the board.
This was not noticed until recently, as most A23/A33 boards use
a GPIO pin that does not support interrupts for OTG ID detection.
This forces the driver to use polling. However the A33-OlinuXino
uses a pin that does support interrupts, so the driver uses them.
However the VBUS interrupt never fires, and the driver never gets
to update the VBUS status. This results in musb timing out waiting
for VBUS to rise.
This was worked around for the AXP221 by resorting to polling
changes in commit 91d96f06a760 ("phy-sun4i-usb: Add workaround for
missing Vbus det interrupts on A31"). This patch adds the A23 and
A33 to the list of SoCs that need the workaround.
Fixes: fc1f45ed3043 ("phy-sun4i-usb: Add support for the usb-phys on the
sun8i-a33 SoC")
Fixes: 123dfdbcfaf5 ("phy-sun4i-usb: Add support for the usb-phys on the
sun8i-a23 SoC")
Cc: <stable(a)vger.kernel.org> # 4.3.x: 68dbc2ce77bb phy-sun4i-usb:
Use of_match_node to get model specific config data
Cc: <stable(a)vger.kernel.org> # 4.3.x: 5cf700ac9d50 phy: phy-sun4i-usb:
Fix optional gpios failing probe
Cc: <stable(a)vger.kernel.org> # 4.3.x: 04e59a0211ff phy-sun4i-usb:
Fix irq free conditions to match request conditions
Cc: <stable(a)vger.kernel.org> # 4.3.x: 91d96f06a760 phy-sun4i-usb:
Add workaround for missing Vbus det interrupts on A31
Cc: <stable(a)vger.kernel.org> # 4.3.x
Signed-off-by: Chen-Yu Tsai <wens(a)csie.org>
Acked-by: Maxime Ripard <maxime.ripard(a)free-electrons.com>
Signed-off-by: Kishon Vijay Abraham I <kishon(a)ti.com>
Signed-off-by: Kishon Vijay Abraham I <kishon(a)ti.com>
---
drivers/phy/allwinner/phy-sun4i-usb.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c
index bee798892b21..d4dcd39b8d76 100644
--- a/drivers/phy/allwinner/phy-sun4i-usb.c
+++ b/drivers/phy/allwinner/phy-sun4i-usb.c
@@ -411,11 +411,13 @@ static bool sun4i_usb_phy0_poll(struct sun4i_usb_phy_data *data)
return true;
/*
- * The A31 companion pmic (axp221) does not generate vbus change
- * interrupts when the board is driving vbus, so we must poll
+ * The A31/A23/A33 companion pmics (AXP221/AXP223) do not
+ * generate vbus change interrupts when the board is driving
+ * vbus using the N_VBUSEN pin on the pmic, so we must poll
* when using the pmic for vbus-det _and_ we're driving vbus.
*/
- if (data->cfg->type == sun6i_a31_phy &&
+ if ((data->cfg->type == sun6i_a31_phy ||
+ data->cfg->type == sun8i_a33_phy) &&
data->vbus_power_supply && data->phys[0].regulator_on)
return true;
@@ -886,7 +888,7 @@ static const struct sun4i_usb_phy_cfg sun7i_a20_cfg = {
static const struct sun4i_usb_phy_cfg sun8i_a23_cfg = {
.num_phys = 2,
- .type = sun4i_a10_phy,
+ .type = sun6i_a31_phy,
.disc_thresh = 3,
.phyctl_offset = REG_PHYCTL_A10,
.dedicated_clocks = true,
--
2.16.2
Commit 9b61e302210e (spi: Pick spi bus number from Linux idr or spi alias)
ceased to unregister SPI buses with fixed bus numbers. Moreover this is
visible only if CONFIG_SPI_DEBUG=y is set or when trying to re-register
the same SPI controller.
rmmod spi_pxa2xx_platform (with CONFIG_SPI_DEBUG=y):
[ 26.788362] spi_master spi1: attempting to delete unregistered controller [spi1]
modprobe spi_pxa2xx_platform:
[ 37.883137] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:19.0/pxa2xx-spi.12/spi_master/spi1'
[ 37.894984] CPU: 1 PID: 1467 Comm: modprobe Not tainted 4.16.0-rc4+ #21
[ 37.902384] Call Trace:
...
[ 38.122680] kobject_add_internal failed for spi1 with -EEXIST, don't try to register things with the same name in the same directory.
[ 38.136154] WARNING: CPU: 1 PID: 1467 at lib/kobject.c:238 kobject_add_internal+0x2a5/0x2f0
...
[ 38.513817] pxa2xx-spi pxa2xx-spi.12: problem registering spi master
[ 38.521036] pxa2xx-spi: probe of pxa2xx-spi.12 failed with error -17
Fix this by not returning immediately from spi_unregister_controller() if
idr_find() doesn't find controller with given ID/bus number. It finds
only those controllers that were registered with dynamic SPI bus
numbers. Only conditional cleanup between dynamic and fixed bus numbers
is to remove allocated IDR.
Fixes: 9b61e302210e (spi: Pick spi bus number from Linux idr or spi alias)
Cc: stable(a)vger.kernel.org
Signed-off-by: Jarkko Nikula <jarkko.nikula(a)linux.intel.com>
---
This doesn't apply to v4.14 without commit 67f7b2781faf ("spi: fix
use-after-free at controller deregistration").
---
drivers/spi/spi.c | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index b33a727a0158..e90fd442b3f0 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -2254,12 +2254,6 @@ void spi_unregister_controller(struct spi_controller *ctlr)
mutex_lock(&board_lock);
found = idr_find(&spi_master_idr, id);
mutex_unlock(&board_lock);
- if (found != ctlr) {
- dev_dbg(&ctlr->dev,
- "attempting to delete unregistered controller [%s]\n",
- dev_name(&ctlr->dev));
- return;
- }
if (ctlr->queued) {
if (spi_destroy_queue(ctlr))
dev_err(&ctlr->dev, "queue remove failed\n");
@@ -2272,7 +2266,8 @@ void spi_unregister_controller(struct spi_controller *ctlr)
device_unregister(&ctlr->dev);
/* free bus id */
mutex_lock(&board_lock);
- idr_remove(&spi_master_idr, id);
+ if (found == ctlr)
+ idr_remove(&spi_master_idr, id);
mutex_unlock(&board_lock);
}
EXPORT_SYMBOL_GPL(spi_unregister_controller);
--
2.16.1
Commit 9b61e302210e (spi: Pick spi bus number from Linux idr or spi alias)
ceased to unregister SPI buses with fixed bus numbers. Moreover this is
visible only if CONFIG_SPI_DEBUG=y is set or when trying to re-register
the same SPI controller.
rmmod spi_pxa2xx_platform (with CONFIG_SPI_DEBUG=y):
[ 26.788362] spi_master spi1: attempting to delete unregistered controller [spi1]
modprobe spi_pxa2xx_platform:
[ 37.883137] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:19.0/pxa2xx-spi.12/spi_master/spi1'
[ 37.894984] CPU: 1 PID: 1467 Comm: modprobe Not tainted 4.16.0-rc4+ #21
[ 37.902384] Call Trace:
...
[ 38.122680] kobject_add_internal failed for spi1 with -EEXIST, don't try to register things with the same name in the same directory.
[ 38.136154] WARNING: CPU: 1 PID: 1467 at lib/kobject.c:238 kobject_add_internal+0x2a5/0x2f0
...
[ 38.513817] pxa2xx-spi pxa2xx-spi.12: problem registering spi master
[ 38.521036] pxa2xx-spi: probe of pxa2xx-spi.12 failed with error -17
Fix this by not returning immediately from spi_unregister_controller() if
idr_find() doesn't find controller with given ID/bus number. It finds
only those controllers that were registered with dynamic SPI bus
numbers. Only conditional cleanup between dynamic and fixed bus numbers
is to remove allocated IDR.
Fixes: 9b61e302210e (spi: Pick spi bus number from Linux idr or spi alias)
Cc: stable(a)vger.kernel.org
Signed-off-by: Jarkko Nikula <jarkko.nikula(a)linux.intel.com>
---
This doesn't apply to v4.14 without commit 67f7b2781faf ("spi: fix
use-after-free at controller deregistration").
---
drivers/spi/spi.c | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index b33a727a0158..e90fd442b3f0 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -2254,12 +2254,6 @@ void spi_unregister_controller(struct spi_controller *ctlr)
mutex_lock(&board_lock);
found = idr_find(&spi_master_idr, id);
mutex_unlock(&board_lock);
- if (found != ctlr) {
- dev_dbg(&ctlr->dev,
- "attempting to delete unregistered controller [%s]\n",
- dev_name(&ctlr->dev));
- return;
- }
if (ctlr->queued) {
if (spi_destroy_queue(ctlr))
dev_err(&ctlr->dev, "queue remove failed\n");
@@ -2272,7 +2266,8 @@ void spi_unregister_controller(struct spi_controller *ctlr)
device_unregister(&ctlr->dev);
/* free bus id */
mutex_lock(&board_lock);
- idr_remove(&spi_master_idr, id);
+ if (found == ctlr)
+ idr_remove(&spi_master_idr, id);
mutex_unlock(&board_lock);
}
EXPORT_SYMBOL_GPL(spi_unregister_controller);
--
2.16.2
This is a note to let you know that I've just added the patch titled
ARM: dts: r8a7794: Add DU1 clock to device tree
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
arm-dts-r8a7794-add-du1-clock-to-device-tree.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 1764f8081f1524bf629e0744b277db751281ff56 Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas(a)glider.be>
Date: Tue, 28 Mar 2017 12:45:30 +0200
Subject: ARM: dts: r8a7794: Add DU1 clock to device tree
From: Geert Uytterhoeven <geert+renesas(a)glider.be>
commit 1764f8081f1524bf629e0744b277db751281ff56 upstream.
Add the missing module clock for the second channel of the display unit.
Signed-off-by: Geert Uytterhoeven <geert+renesas(a)glider.be>
Acked-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com>
Signed-off-by: Simon Horman <horms+renesas(a)verge.net.au>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
arch/arm/boot/dts/r8a7794.dtsi | 8 +++++---
include/dt-bindings/clock/r8a7794-clock.h | 1 +
2 files changed, 6 insertions(+), 3 deletions(-)
--- a/arch/arm/boot/dts/r8a7794.dtsi
+++ b/arch/arm/boot/dts/r8a7794.dtsi
@@ -1261,19 +1261,21 @@
clocks = <&mp_clk>, <&hp_clk>,
<&zs_clk>, <&p_clk>, <&p_clk>, <&zs_clk>,
<&zs_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>,
- <&zx_clk>;
+ <&zx_clk>, <&zx_clk>;
#clock-cells = <1>;
clock-indices = <
R8A7794_CLK_EHCI R8A7794_CLK_HSUSB
R8A7794_CLK_HSCIF2 R8A7794_CLK_SCIF5
R8A7794_CLK_SCIF4 R8A7794_CLK_HSCIF1 R8A7794_CLK_HSCIF0
R8A7794_CLK_SCIF3 R8A7794_CLK_SCIF2 R8A7794_CLK_SCIF1
- R8A7794_CLK_SCIF0 R8A7794_CLK_DU0
+ R8A7794_CLK_SCIF0
+ R8A7794_CLK_DU1 R8A7794_CLK_DU0
>;
clock-output-names =
"ehci", "hsusb",
"hscif2", "scif5", "scif4", "hscif1", "hscif0",
- "scif3", "scif2", "scif1", "scif0", "du0";
+ "scif3", "scif2", "scif1", "scif0",
+ "du1", "du0";
};
mstp8_clks: mstp8_clks@e6150990 {
compatible = "renesas,r8a7794-mstp-clocks", "renesas,cpg-mstp-clocks";
--- a/include/dt-bindings/clock/r8a7794-clock.h
+++ b/include/dt-bindings/clock/r8a7794-clock.h
@@ -81,6 +81,7 @@
#define R8A7794_CLK_SCIF2 19
#define R8A7794_CLK_SCIF1 20
#define R8A7794_CLK_SCIF0 21
+#define R8A7794_CLK_DU1 23
#define R8A7794_CLK_DU0 24
/* MSTP8 */
Patches currently in stable-queue which might be from geert+renesas(a)glider.be are
queue-4.9/arm64-dts-r8a7796-remove-unit-address-and-reg-from-integrated-cache.patch
queue-4.9/arm-dts-r8a7791-remove-unit-address-and-reg-from-integrated-cache.patch
queue-4.9/arm-dts-r7s72100-fix-ethernet-clock-parent.patch
queue-4.9/arm-dts-r8a7791-correct-parent-of-ssi-clocks.patch
queue-4.9/arm-dts-r8a7794-add-du1-clock-to-device-tree.patch
queue-4.9/arm-dts-silk-correct-clock-of-du1.patch
queue-4.9/arm-dts-r8a7792-remove-unit-address-and-reg-from-integrated-cache.patch
queue-4.9/arm-dts-koelsch-correct-clock-frequency-of-x2-du-clock-input.patch
queue-4.9/arm-dts-r8a7794-correct-clock-of-du1.patch
queue-4.9/arm-dts-r8a7794-remove-unit-address-and-reg-from-integrated-cache.patch
queue-4.9/arm-dts-r8a7793-remove-unit-address-and-reg-from-integrated-cache.patch
queue-4.9/arm-dts-r8a7793-correct-parent-of-ssi-clocks.patch
queue-4.9/arm-dts-r8a7790-correct-parent-of-ssi-clocks.patch
This is a note to let you know that I've just added the patch titled
staging: comedi: ni_mio_common: ack ai fifo error interrupts.
to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-next branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will also be merged in the next major kernel release
during the merge window.
If you have any questions about this process, please let me know.
>From e1d9fc04c41840a4688ef6ce90b6dcca157ea4d7 Mon Sep 17 00:00:00 2001
From: Frank Mori Hess <fmh6jj(a)gmail.com>
Date: Thu, 15 Mar 2018 10:25:44 +0000
Subject: staging: comedi: ni_mio_common: ack ai fifo error interrupts.
Ack ai fifo error interrupts in interrupt handler to clear interrupt
after fifo overflow. It should prevent lock-ups after the ai fifo
overflows.
Cc: <stable(a)vger.kernel.org> # v4.2+
Signed-off-by: Frank Mori Hess <fmh6jj(a)gmail.com>
Signed-off-by: Ian Abbott <abbotti(a)mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/staging/comedi/drivers/ni_mio_common.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
index d6eb55b41814..e40a2c0a9543 100644
--- a/drivers/staging/comedi/drivers/ni_mio_common.c
+++ b/drivers/staging/comedi/drivers/ni_mio_common.c
@@ -1275,6 +1275,8 @@ static void ack_a_interrupt(struct comedi_device *dev, unsigned short a_status)
ack |= NISTC_INTA_ACK_AI_START;
if (a_status & NISTC_AI_STATUS1_STOP)
ack |= NISTC_INTA_ACK_AI_STOP;
+ if (a_status & NISTC_AI_STATUS1_OVER)
+ ack |= NISTC_INTA_ACK_AI_ERR;
if (ack)
ni_stc_writew(dev, ack, NISTC_INTA_ACK_REG);
}
--
2.16.2
The patch
ASoC: ssm2602: Replace reg_default_raw with reg_default
has been applied to the asoc tree at
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git
All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.
You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.
If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.
Please add any relevant lists and maintainers to the CCs when replying
to this mail.
Thanks,
Mark
>From a01df75ce737951ad13a08d101306e88c3f57cb2 Mon Sep 17 00:00:00 2001
From: James Kelly <jamespeterkelly(a)gmail.com>
Date: Mon, 19 Mar 2018 21:29:50 +1100
Subject: [PATCH] ASoC: ssm2602: Replace reg_default_raw with reg_default
SSM2602 driver is broken on recent kernels (at least
since 4.9). User space applications such as amixer or
alsamixer get EIO when attempting to access codec
controls via the relevant IOCTLs.
Root cause of these failures is the regcache_hw_init
function in drivers/base/regmap/regcache.c, which
prevents regmap cache initalization from the
reg_defaults_raw element of the regmap_config structure
when registers are write only. It also disables the
regmap cache entirely when all registers are write only
or volatile as is the case for the SSM2602 driver.
Using the reg_defaults element of the regmap_config
structure rather than the reg_defaults_raw element to
initalize the regmap cache avoids the logic in the
regcache_hw_init function entirely. It also makes this
driver consistent with other ASoC codec drivers, as
this driver was the ONLY codec driver that used the
reg_defaults_raw element to initalize the cache.
Tested on Digilent Zybo Z7 development board which has
a SSM2603 codec chip connected to a Xilinx Zynq SoC.
Signed-off-by: James Kelly <jamespeterkelly(a)gmail.com>
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Cc: stable(a)vger.kernel.org
---
sound/soc/codecs/ssm2602.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
diff --git a/sound/soc/codecs/ssm2602.c b/sound/soc/codecs/ssm2602.c
index 9b341c23f62b..5e80867d09ef 100644
--- a/sound/soc/codecs/ssm2602.c
+++ b/sound/soc/codecs/ssm2602.c
@@ -54,10 +54,17 @@ struct ssm2602_priv {
* using 2 wire for device control, so we cache them instead.
* There is no point in caching the reset register
*/
-static const u16 ssm2602_reg[SSM2602_CACHEREGNUM] = {
- 0x0097, 0x0097, 0x0079, 0x0079,
- 0x000a, 0x0008, 0x009f, 0x000a,
- 0x0000, 0x0000
+static const struct reg_default ssm2602_reg[SSM2602_CACHEREGNUM] = {
+ { .reg = 0x00, .def = 0x0097 },
+ { .reg = 0x01, .def = 0x0097 },
+ { .reg = 0x02, .def = 0x0079 },
+ { .reg = 0x03, .def = 0x0079 },
+ { .reg = 0x04, .def = 0x000a },
+ { .reg = 0x05, .def = 0x0008 },
+ { .reg = 0x06, .def = 0x009f },
+ { .reg = 0x07, .def = 0x000a },
+ { .reg = 0x08, .def = 0x0000 },
+ { .reg = 0x09, .def = 0x0000 }
};
@@ -620,8 +627,8 @@ const struct regmap_config ssm2602_regmap_config = {
.volatile_reg = ssm2602_register_volatile,
.cache_type = REGCACHE_RBTREE,
- .reg_defaults_raw = ssm2602_reg,
- .num_reg_defaults_raw = ARRAY_SIZE(ssm2602_reg),
+ .reg_defaults = ssm2602_reg,
+ .num_reg_defaults = ARRAY_SIZE(ssm2602_reg),
};
EXPORT_SYMBOL_GPL(ssm2602_regmap_config);
--
2.16.2
From: James Bottomley <James.Bottomley(a)HansenPartnership.com>
My Nuvoton 6xx in a Dell XPS-13 has been intermittently failing to work
(necessitating a reboot). The problem seems to be that the TPM gets into a
state where the partial self-test doesn't return TPM_RC_SUCCESS (meaning
all tests have run to completion), but instead returns TPM_RC_TESTING
(meaning some tests are still running in the background). There are
various theories that resending the self-test command actually causes the
tests to restart and thus triggers more TPM_RC_TESTING returns until the
timeout is exceeded.
There are several issues here: firstly being we shouldn't slow down the
boot sequence waiting for the self test to complete once the TPM
backgrounds them. It will actually make available all functions that have
passed and if it gets a failure return TPM_RC_FAILURE to every subsequent
command. So the fix is to kick off self tests once and if they return
TPM_RC_TESTING log that as a backgrounded self test and continue on. In
order to prevent other tpm users from seeing any TPM_RC_TESTING returns
(which it might if they send a command that needs a TPM subsystem which is
still under test), we loop in tpm_transmit_cmd until either a timeout or we
don't get a TPM_RC_TESTING return.
Finally, there have been observations of strange returns from a partial
test. One Nuvoton is occasionally returning TPM_RC_COMMAND_CODE, so treat
any unexpected return from a partial self test as an indication we need to
run a full self test.
[jarkko.sakkinen(a)linux.intel.com: cleaned up James' original commit and
added a proper Fixes line]
Fixes: 2482b1bba5122 ("tpm: Trigger only missing TPM 2.0 self tests")
Cc: stable(a)vger.kernel.org
Signed-off-by: James Bottomley <James.Bottomley(a)HansenPartnership.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkine(a)linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkine(a)linux.intel.com>
---
drivers/char/tpm/tpm-interface.c | 20 ++++++++++++---
drivers/char/tpm/tpm.h | 1 +
drivers/char/tpm/tpm2-cmd.c | 54 ++++++++++++----------------------------
3 files changed, 33 insertions(+), 42 deletions(-)
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index 9e80a953d693..1adb976a2e37 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -537,14 +537,26 @@ ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct tpm_space *space,
const char *desc)
{
const struct tpm_output_header *header = buf;
+ unsigned int delay_msec = TPM2_DURATION_SHORT;
int err;
ssize_t len;
- len = tpm_transmit(chip, space, (u8 *)buf, bufsiz, flags);
- if (len < 0)
- return len;
+ for (;;) {
+ len = tpm_transmit(chip, space, (u8 *)buf, bufsiz, flags);
+ if (len < 0)
+ return len;
+ err = be32_to_cpu(header->return_code);
+ if (err != TPM2_RC_TESTING)
+ break;
+
+ delay_msec *= 2;
+ if (delay_msec > TPM2_DURATION_LONG) {
+ dev_err(&chip->dev, "the self test is still running\n");
+ break;
+ }
+ tpm_msleep(delay_msec);
+ }
- err = be32_to_cpu(header->return_code);
if (err != 0 && desc)
dev_err(&chip->dev, "A TPM error (%d) occurred %s\n", err,
desc);
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index f895fba4e20d..cccd5994a0e1 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -104,6 +104,7 @@ enum tpm2_return_codes {
TPM2_RC_HASH = 0x0083, /* RC_FMT1 */
TPM2_RC_HANDLE = 0x008B,
TPM2_RC_INITIALIZE = 0x0100, /* RC_VER1 */
+ TPM2_RC_FAILURE = 0x0101,
TPM2_RC_DISABLED = 0x0120,
TPM2_RC_COMMAND_CODE = 0x0143,
TPM2_RC_TESTING = 0x090A, /* RC_WARN */
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index a700f8f9ead7..89a5397b18d2 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -31,10 +31,6 @@ struct tpm2_startup_in {
__be16 startup_type;
} __packed;
-struct tpm2_self_test_in {
- u8 full_test;
-} __packed;
-
struct tpm2_get_tpm_pt_in {
__be32 cap_id;
__be32 property_id;
@@ -60,7 +56,6 @@ struct tpm2_get_random_out {
union tpm2_cmd_params {
struct tpm2_startup_in startup_in;
- struct tpm2_self_test_in selftest_in;
struct tpm2_get_tpm_pt_in get_tpm_pt_in;
struct tpm2_get_tpm_pt_out get_tpm_pt_out;
struct tpm2_get_random_in getrandom_in;
@@ -827,16 +822,6 @@ unsigned long tpm2_calc_ordinal_duration(struct tpm_chip *chip, u32 ordinal)
}
EXPORT_SYMBOL_GPL(tpm2_calc_ordinal_duration);
-#define TPM2_SELF_TEST_IN_SIZE \
- (sizeof(struct tpm_input_header) + \
- sizeof(struct tpm2_self_test_in))
-
-static const struct tpm_input_header tpm2_selftest_header = {
- .tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
- .length = cpu_to_be32(TPM2_SELF_TEST_IN_SIZE),
- .ordinal = cpu_to_be32(TPM2_CC_SELF_TEST)
-};
-
/**
* tpm2_do_selftest() - ensure that all self tests have passed
*
@@ -852,27 +837,24 @@ static const struct tpm_input_header tpm2_selftest_header = {
*/
static int tpm2_do_selftest(struct tpm_chip *chip)
{
+ struct tpm_buf buf;
+ int full;
int rc;
- unsigned int delay_msec = 10;
- long duration;
- struct tpm2_cmd cmd;
- duration = jiffies_to_msecs(
- tpm2_calc_ordinal_duration(chip, TPM2_CC_SELF_TEST));
-
- while (1) {
- cmd.header.in = tpm2_selftest_header;
- cmd.params.selftest_in.full_test = 0;
-
- rc = tpm_transmit_cmd(chip, NULL, &cmd, TPM2_SELF_TEST_IN_SIZE,
- 0, 0, "continue selftest");
+ for (full = 0; full < 2; full++) {
+ rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_SELF_TEST);
+ if (rc)
+ return rc;
- if (rc != TPM2_RC_TESTING || delay_msec >= duration)
- break;
+ tpm_buf_append_u8(&buf, full);
+ rc = tpm_transmit_cmd(chip, NULL, buf.data, PAGE_SIZE, 0, 0,
+ "attempting the self test");
+ tpm_buf_destroy(&buf);
- /* wait longer than before */
- delay_msec *= 2;
- tpm_msleep(delay_msec);
+ if (rc == TPM2_RC_TESTING)
+ rc = TPM2_RC_SUCCESS;
+ if (rc == TPM2_RC_INITIALIZE || rc == TPM2_RC_SUCCESS)
+ return rc;
}
return rc;
@@ -1058,10 +1040,8 @@ int tpm2_auto_startup(struct tpm_chip *chip)
goto out;
rc = tpm2_do_selftest(chip);
- if (rc != 0 && rc != TPM2_RC_INITIALIZE) {
- dev_err(&chip->dev, "TPM self test failed\n");
+ if (rc && rc != TPM2_RC_INITIALIZE)
goto out;
- }
if (rc == TPM2_RC_INITIALIZE) {
rc = tpm_startup(chip);
@@ -1069,10 +1049,8 @@ int tpm2_auto_startup(struct tpm_chip *chip)
goto out;
rc = tpm2_do_selftest(chip);
- if (rc) {
- dev_err(&chip->dev, "TPM self test failed\n");
+ if (rc)
goto out;
- }
}
rc = tpm2_get_pcr_allocation(chip);
--
2.15.1
From: Jeremy Boone <jeremy.boone(a)nccgroup.trust>
commit 2c0a646268f2a3536866bf237733a52aec260594 upstream
Discrete TPMs are often connected over slow serial buses which, on
some platforms, can have glitches causing bit flips. In all the
driver _recv() functions, we need to use a u32 to unmarshal the
response size, otherwise a bit flip of the 31st bit would cause the
expected variable to go negative, which would then try to read a huge
amount of data. Also sanity check that the expected amount of data is
large enough for the TPM header.
Signed-off-by: Jeremy Boone <jeremy.boone(a)nccgroup.trust>
Cc: stable(a)vger.kernel.org
Signed-off-by: James Bottomley <James.Bottomley(a)HansenPartnership.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
---
Backported to v4.4 because of merge conflict.
drivers/char/tpm/tpm_tis.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
index 7f13221aeb30..9dd93a209ef2 100644
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -283,7 +283,8 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
{
int size = 0;
- int expected, status;
+ int status;
+ u32 expected;
if (count < TPM_HEADER_SIZE) {
size = -EIO;
@@ -298,7 +299,7 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
}
expected = be32_to_cpu(*(__be32 *) (buf + 2));
- if (expected > count) {
+ if (expected > count || expected < TPM_HEADER_SIZE) {
size = -EIO;
goto out;
}
--
2.15.1
From: Jeremy Boone <jeremy.boone(a)nccgroup.trust>
commit c8e3e06d252155ad0e38a64a65ebb85638893025 upstream
Discrete TPMs are often connected over slow serial buses which, on
some platforms, can have glitches causing bit flips. If a bit does
flip it could cause an overrun if it's in one of the size parameters,
so sanity check that we're not overrunning the provided buffer when
doing a memcpy().
Signed-off-by: Jeremy Boone <jeremy.boone(a)nccgroup.trust>
Cc: stable(a)vger.kernel.org
Signed-off-by: James Bottomley <James.Bottomley(a)HansenPartnership.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
---
Backport for v4.9 because of the merge conflict.
drivers/char/tpm/tpm-interface.c | 5 +++++
drivers/char/tpm/tpm2-cmd.c | 6 ++++++
2 files changed, 11 insertions(+)
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index d0ac2d56520f..830d7e30e508 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -1078,6 +1078,11 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max)
break;
recd = be32_to_cpu(tpm_cmd.params.getrandom_out.rng_data_len);
+ if (recd > num_bytes) {
+ total = -EFAULT;
+ break;
+ }
+
memcpy(dest, tpm_cmd.params.getrandom_out.rng_data, recd);
dest += recd;
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index 17896d654033..a5780ebe15ef 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -668,6 +668,11 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip,
if (!rc) {
data_len = be16_to_cpup(
(__be16 *) &buf.data[TPM_HEADER_SIZE + 4]);
+ if (data_len < MIN_KEY_SIZE || data_len > MAX_KEY_SIZE + 1) {
+ rc = -EFAULT;
+ goto out;
+ }
+
data = &buf.data[TPM_HEADER_SIZE + 6];
memcpy(payload->key, data, data_len - 1);
@@ -675,6 +680,7 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip,
payload->migratable = data[data_len - 1];
}
+out:
tpm_buf_destroy(&buf);
return rc;
}
--
2.15.1