15 May, 2020

1 commit

  • After the atomic plane update, the shadow load should be
    enabled to make sure its update can take effect on next
    frame in any cases. And this enable is better to be done
    in CRTC's atomic_flush() which is called after plane's
    atomic_update() is called.

    Besides, the shadow load enable in controller enable is
    unnecessary, so remove it.

    Signed-off-by: Fancy Fang
    Reviewed-by: Liu Ying
    (cherry picked from commit bfa7236c8477e8993f074a3068ddc64c1614db06)

    Fancy Fang
     

12 May, 2020

1 commit

  • The threaded interrupt handler may still be called after the
    usb_gadget_disconnect is called, it causes the structures used
    at interrupt handler was freed before it uses, eg the
    usb_request. This issue usually occurs we remove the udc function
    during the transfer. Below is the example when doing stress
    test for android switch function, the EP0's request is freed
    by .unbind (configfs_composite_unbind -> composite_dev_cleanup),
    but the threaded handler accesses this request during handling
    setup packet request.

    In fact, there is no protection between unbind the udc
    and udc interrupt handling, so we have to avoid the interrupt
    handler is occurred or scheduled during the .unbind flow.

    init: Sending signal 9 to service 'adbd' (pid 18077) process group...
    android_work: did not send uevent (0 0 000000007bec2039)
    libprocessgroup: Successfully killed process cgroup uid 0 pid 18077 in 6ms
    init: Service 'adbd' (pid 18077) received signal 9
    init: Sending signal 9 to service 'adbd' (pid 18077) process group...
    libprocessgroup: Successfully killed process cgroup uid 0 pid 18077 in 0ms
    init: processing action (init.svc.adbd=stopped) from (/init.usb.configfs.rc:14)
    init: Received control message 'start' for 'adbd' from pid: 399 (/vendor/bin/hw/android.hardware.usb@1.

    init: starting service 'adbd'...
    read descriptors
    read strings
    Unable to handle kernel read from unreadable memory at virtual address 000000000000002a
    android_work: sent uevent USB_STATE=CONNECTED
    Mem abort info:
    ESR = 0x96000004
    EC = 0x25: DABT (current EL), IL = 32 bits
    SET = 0, FnV = 0
    EA = 0, S1PTW = 0
    Data abort info:
    ISV = 0, ISS = 0x00000004
    CM = 0, WnR = 0
    user pgtable: 4k pages, 48-bit VAs, pgdp=00000000e97f1000
    using random self ethernet address
    [000000000000002a] pgd=0000000000000000
    Internal error: Oops: 96000004 [#1] PREEMPT SMP
    Modules linked in:
    CPU: 0 PID: 232 Comm: irq/68-5b110000 Not tainted 5.4.24-06075-g94a6b52b5815 #92
    Hardware name: Freescale i.MX8QXP MEK (DT)
    pstate: 00400085 (nzcv daIf +PAN -UAO)
    using random host ethernet address
    pc : composite_setup+0x5c/0x1730
    lr : android_setup+0xc0/0x148
    sp : ffff80001349bba0
    x29: ffff80001349bba0 x28: ffff00083a50da00
    x27: ffff8000124e6000 x26: ffff800010177950
    x25: 0000000000000040 x24: ffff000834e18010
    x23: 0000000000000000 x22: 0000000000000000
    x21: ffff00083a50da00 x20: ffff00082e75ec40
    x19: 0000000000000000 x18: 0000000000000000
    x17: 0000000000000000 x16: 0000000000000000
    x15: 0000000000000000 x14: 0000000000000000
    x13: 0000000000000000 x12: 0000000000000001
    x11: ffff80001180fb58 x10: 0000000000000040
    x9 : ffff8000120fc980 x8 : 0000000000000000
    x7 : ffff00083f98df50 x6 : 0000000000000100
    x5 : 00000307e8978431 x4 : ffff800011386788
    x3 : 0000000000000000 x2 : ffff800012342000
    x1 : 0000000000000000 x0 : ffff800010c6d3a0
    Call trace:
    composite_setup+0x5c/0x1730
    android_setup+0xc0/0x148
    cdns3_ep0_delegate_req+0x64/0x90
    cdns3_check_ep0_interrupt_proceed+0x384/0x738
    cdns3_device_thread_irq_handler+0x124/0x6e0
    cdns3_thread_irq+0x94/0xa0
    irq_thread_fn+0x30/0xa0
    irq_thread+0x150/0x248
    kthread+0xfc/0x128
    ret_from_fork+0x10/0x18
    Code: 910e8000 f9400693 12001ed7 79400f79 (3940aa61)
    ---[ end trace c685db37f8773fba ]---
    Kernel panic - not syncing: Fatal exception
    SMP: stopping secondary CPUs
    Kernel Offset: disabled
    CPU features: 0x0002,20002008
    Memory Limit: none
    Rebooting in 5 seconds..

    Reviewed-by: Jun Li
    Signed-off-by: Peter Chen

    Peter Chen
     

07 May, 2020

1 commit


29 Apr, 2020

4 commits


22 Apr, 2020

1 commit


10 Apr, 2020

1 commit


09 Apr, 2020

4 commits


03 Apr, 2020

1 commit

  • Add macro for the SNVS clock of the i.MX8MN.

    Signed-off-by: Horia Geantă
    Acked-by: Rob Herring
    Signed-off-by: Shawn Guo
    (cherry picked from commit d2d46dfaa72b41b4d6adf6ef1068ee00a51ba0fc)
    [changed clock id]
    Signed-off-by: Horia Geantă
    Reviewed-by: Iuliana Prodan

    Horia Geantă
     

27 Mar, 2020

1 commit

  • There is hardware issue: TKT0535653
    SDMA3 can't work without setting AUDIOMIX_CLKEN0[SDMA2] (bit-26) to 1

    The workaround is:
    As the reset state of AUDIOMIX_CLKEN0[SDMA2] is enabled,
    we just need to keep it on as reset state, don't touch it
    in kernel, then every thing is same as before, if we register
    the clock in clk-audiomix, then kernel will try to disable
    it in idle.

    Signed-off-by: Shengjiu Wang
    Reviewed-by: Daniel Baluta
    Reviewed-by: Jacky Bai
    Reviewed-by: Robin Gong

    Shengjiu Wang
     

14 Mar, 2020

3 commits


08 Mar, 2020

1 commit

  • Merge Linux stable release v5.4.24 into imx_5.4.y

    * tag 'v5.4.24': (3306 commits)
    Linux 5.4.24
    blktrace: Protect q->blk_trace with RCU
    kvm: nVMX: VMWRITE checks unsupported field before read-only field
    ...

    Signed-off-by: Jason Liu

    Conflicts:
    arch/arm/boot/dts/imx6sll-evk.dts
    arch/arm/boot/dts/imx7ulp.dtsi
    arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
    drivers/clk/imx/clk-composite-8m.c
    drivers/gpio/gpio-mxc.c
    drivers/irqchip/Kconfig
    drivers/mmc/host/sdhci-of-esdhc.c
    drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
    drivers/net/can/flexcan.c
    drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
    drivers/net/ethernet/mscc/ocelot.c
    drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
    drivers/net/phy/realtek.c
    drivers/pci/controller/mobiveil/pcie-mobiveil-host.c
    drivers/perf/fsl_imx8_ddr_perf.c
    drivers/tee/optee/shm_pool.c
    drivers/usb/cdns3/gadget.c
    kernel/sched/cpufreq.c
    net/core/xdp.c
    sound/soc/fsl/fsl_esai.c
    sound/soc/fsl/fsl_sai.c
    sound/soc/sof/core.c
    sound/soc/sof/imx/Kconfig
    sound/soc/sof/loader.c

    Jason Liu
     

05 Mar, 2020

10 commits

  • [ Upstream commit c780e86dd48ef6467a1146cf7d0fe1e05a635039 ]

    KASAN is reporting that __blk_add_trace() has a use-after-free issue
    when accessing q->blk_trace. Indeed the switching of block tracing (and
    thus eventual freeing of q->blk_trace) is completely unsynchronized with
    the currently running tracing and thus it can happen that the blk_trace
    structure is being freed just while __blk_add_trace() works on it.
    Protect accesses to q->blk_trace by RCU during tracing and make sure we
    wait for the end of RCU grace period when shutting down tracing. Luckily
    that is rare enough event that we can afford that. Note that postponing
    the freeing of blk_trace to an RCU callback should better be avoided as
    it could have unexpected user visible side-effects as debugfs files
    would be still existing for a short while block tracing has been shut
    down.

    Link: https://bugzilla.kernel.org/show_bug.cgi?id=205711
    CC: stable@vger.kernel.org
    Reviewed-by: Chaitanya Kulkarni
    Reviewed-by: Ming Lei
    Tested-by: Ming Lei
    Reviewed-by: Bart Van Assche
    Reported-by: Tristan Madani
    Signed-off-by: Jan Kara
    Signed-off-by: Jens Axboe
    Signed-off-by: Sasha Levin

    Jan Kara
     
  • commit 9a6b55ac4a44060bcb782baf002859b2a2c63267 upstream.

    The function name suggests that this is a boolean checking whether the
    architecture asks for an update of the VDSO data, but it works the other
    way round. To spare further confusion invert the logic.

    Fixes: 44f57d788e7d ("timekeeping: Provide a generic update_vsyscall() implementation")
    Signed-off-by: Thomas Gleixner
    Link: https://lore.kernel.org/r/20200114185946.656652824@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     
  • commit fcbb8461fd2376ba3782b5b8bd440c929b8e4980 upstream.

    There are both positive and negative options about this feature.
    At first, I thought it was a good idea, but actually Linus stated a
    negative opinion (https://lkml.org/lkml/2019/9/29/227). I admit it
    is ugly and annoying.

    The baseline I'd like to keep is the compile-test of uapi headers.
    (Otherwise, kernel developers have no way to ensure the correctness
    of the exported headers.)

    I will maintain a small build rule in usr/include/Makefile.
    Remove the other header test functionality.

    Signed-off-by: Masahiro Yamada
    [ added to 5.4.y due to start of build warnings from backported patches
    because of this feature - gregkh]
    Signed-off-by: Greg Kroah-Hartman

    Masahiro Yamada
     
  • commit ca4b43c14cd88d28cfc6467d2fa075aad6818f1d upstream.

    To work properly on every architectures and compilers, the enum value
    needs to be specific numbers.

    Suggested-by: Greg KH
    Signed-off-by: Peter Chen
    Link: https://lore.kernel.org/r/1580537624-10179-1-git-send-email-peter.chen@nxp.com
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Peter Chen
     
  • commit f66ee0410b1c3481ee75e5db9b34547b4d582465 upstream.

    In the case of huge hash:* types of sets, due to the single spinlock of
    a set the processing of the whole set under spinlock protection could take
    too long.

    There were four places where the whole hash table of the set was processed
    from bucket to bucket under holding the spinlock:

    - During resizing a set, the original set was locked to exclude kernel side
    add/del element operations (userspace add/del is excluded by the
    nfnetlink mutex). The original set is actually just read during the
    resize, so the spinlocking is replaced with rcu locking of regions.
    However, thus there can be parallel kernel side add/del of entries.
    In order not to loose those operations a backlog is added and replayed
    after the successful resize.
    - Garbage collection of timed out entries was also protected by the spinlock.
    In order not to lock too long, region locking is introduced and a single
    region is processed in one gc go. Also, the simple timer based gc running
    is replaced with a workqueue based solution. The internal book-keeping
    (number of elements, size of extensions) is moved to region level due to
    the region locking.
    - Adding elements: when the max number of the elements is reached, the gc
    was called to evict the timed out entries. The new approach is that the gc
    is called just for the matching region, assuming that if the region
    (proportionally) seems to be full, then the whole set does. We could scan
    the other regions to check every entry under rcu locking, but for huge
    sets it'd mean a slowdown at adding elements.
    - Listing the set header data: when the set was defined with timeout
    support, the garbage collector was called to clean up timed out entries
    to get the correct element numbers and set size values. Now the set is
    scanned to check non-timed out entries, without actually calling the gc
    for the whole set.

    Thanks to Florian Westphal for helping me to solve the SOFTIRQ-safe ->
    SOFTIRQ-unsafe lock order issues during working on the patch.

    Reported-by: syzbot+4b0e9d4ff3cf117837e5@syzkaller.appspotmail.com
    Reported-by: syzbot+c27b8d5010f45c666ed1@syzkaller.appspotmail.com
    Reported-by: syzbot+68a806795ac89df3aa1c@syzkaller.appspotmail.com
    Fixes: 23c42a403a9c ("netfilter: ipset: Introduction of new commands and protocol version 7")
    Signed-off-by: Jozsef Kadlecsik
    Signed-off-by: Greg Kroah-Hartman

    Jozsef Kadlecsik
     
  • commit 84a4062632462c4320704fcdf8e99e89e94c0aba upstream.

    We have a HID touch device that reports its opens and shorts test
    results in HID buffers of size 8184 bytes. The maximum size of the HID
    buffer is currently set to 4096 bytes, causing probe of this device to
    fail. With this patch we increase the maximum size of the HID buffer to
    8192 bytes, making device probe and acquisition of said buffers succeed.

    Signed-off-by: Johan Korsnes
    Cc: Alan Stern
    Cc: Armando Visconti
    Cc: Jiri Kosina
    Signed-off-by: Jiri Kosina
    Signed-off-by: Greg Kroah-Hartman

    Johan Korsnes
     
  • commit 1dade3a7048ccfc675650cd2cf13d578b095e5fb upstream.

    Sometimes it is useful to find the access_width field value in bytes and
    not in bits so add a helper that can be used for this purpose.

    Suggested-by: Jean Delvare
    Signed-off-by: Mika Westerberg
    Reviewed-by: Jean Delvare
    Cc: 4.16+ # 4.16+
    Signed-off-by: Rafael J. Wysocki
    Signed-off-by: Greg Kroah-Hartman

    Mika Westerberg
     
  • [ Upstream commit ebc0f83c78a2d26384401ecf2d2fa48063c0ee27 ]

    The way loadavg is tracked during nohz only pays attention to the load
    upon entering nohz. This can be particularly noticeable if full nohz is
    entered while non-idle, and then the cpu goes idle and stays that way for
    a long time.

    Use the remote tick to ensure that full nohz cpus report their deltas
    within a reasonable time.

    [ swood: Added changelog and removed recheck of stopped tick. ]

    Signed-off-by: Peter Zijlstra (Intel)
    Signed-off-by: Scott Wood
    Signed-off-by: Peter Zijlstra (Intel)
    Signed-off-by: Ingo Molnar
    Link: https://lkml.kernel.org/r/1578736419-14628-3-git-send-email-swood@redhat.com
    Signed-off-by: Sasha Levin

    Peter Zijlstra (Intel)
     
  • [ Upstream commit 7151affeef8d527f50b4b68a871fd28bd660023f ]

    netdev_next_lower_dev_rcu() will be used to implement a function,
    which is to walk all lower interfaces.
    There are already functions that they walk their lower interface.
    (netdev_walk_all_lower_dev_rcu, netdev_walk_all_lower_dev()).
    But, there would be cases that couldn't be covered by given
    netdev_walk_all_lower_dev_{rcu}() function.
    So, some modules would want to implement own function,
    which is to walk all lower interfaces.

    In the next patch, netdev_next_lower_dev_rcu() will be used.
    In addition, this patch removes two unused prototypes in netdevice.h.

    Signed-off-by: Taehee Yoo
    Signed-off-by: David S. Miller
    Signed-off-by: Greg Kroah-Hartman

    Taehee Yoo
     
  • [ Upstream commit 8a9093c79863b58cc2f9874d7ae788f0d622a596 ]

    tc flower rules that are based on src or dst port blocking are sometimes
    ineffective due to uninitialized stack data. __skb_flow_dissect() extracts
    ports from the skb for tc flower to match against. However, the port
    dissection is not done when when the FLOW_DIS_IS_FRAGMENT bit is set in
    key_control->flags. All callers of __skb_flow_dissect(), zero-out the
    key_control field except for fl_classify() as used by the flower
    classifier. Thus, the FLOW_DIS_IS_FRAGMENT may be set on entry to
    __skb_flow_dissect(), since key_control is allocated on the stack
    and may not be initialized.

    Since key_basic and key_control are present for all flow keys, let's
    make sure they are initialized.

    Fixes: 62230715fd24 ("flow_dissector: do not dissect l4 ports for fragments")
    Co-developed-by: Eric Dumazet
    Signed-off-by: Eric Dumazet
    Acked-by: Cong Wang
    Signed-off-by: Jason Baron
    Signed-off-by: David S. Miller
    Signed-off-by: Greg Kroah-Hartman

    Jason Baron
     

29 Feb, 2020

8 commits

  • commit 10a663a1b15134a5a714aa515e11425a44d4fdf7 upstream.

    device_shutdown() called from reboot or power_shutdown expect
    all devices to be shutdown. Same is true for even ahci pci driver.
    As no ahci shutdown function is implemented, the ata subsystem
    always remains alive with DMA & interrupt support. File system
    related calls should not be honored after device_shutdown().

    So defining ahci pci driver shutdown to freeze hardware (mask
    interrupt, stop DMA engine and free DMA resources).

    Signed-off-by: Prabhakar Kushwaha
    Signed-off-by: Jens Axboe
    Signed-off-by: Greg Kroah-Hartman

    Prabhakar Kushwaha
     
  • commit dfa9a5efe8b932a84b3b319250aa3ac60c20f876 upstream.

    The rawmidi state flags (opened, append, active_sensing) are stored in
    bit fields that can be potentially racy when concurrently accessed
    without any locks. Although the current code should be fine, there is
    also no any real benefit by keeping the bitfields for this kind of
    short number of members.

    This patch changes those bit fields flags to the simple bool fields.
    There should be no size increase of the snd_rawmidi_substream by this
    change.

    Reported-by: syzbot+576cc007eb9f2c968200@syzkaller.appspotmail.com
    Link: https://lore.kernel.org/r/20200214111316.26939-4-tiwai@suse.de
    Signed-off-by: Takashi Iwai
    Signed-off-by: Greg Kroah-Hartman

    Takashi Iwai
     
  • commit e7598fac323aad0e502415edeffd567315994dd6 upstream.

    The intel_svm_is_pasid_valid() needs to be marked inline, otherwise it
    causes the compile warning below:

    CC [M] drivers/dma/idxd/cdev.o
    In file included from drivers/dma/idxd/cdev.c:9:0:
    ./include/linux/intel-svm.h:125:12: warning: ‘intel_svm_is_pasid_valid’ defined but not used [-Wunused-function]
    static int intel_svm_is_pasid_valid(struct device *dev, int pasid)
    ^~~~~~~~~~~~~~~~~~~~~~~~

    Reported-by: Borislav Petkov
    Fixes: 15060aba71711 ('iommu/vt-d: Helper function to query if a pasid has any active users')
    Signed-off-by: Joerg Roedel
    Signed-off-by: Greg Kroah-Hartman

    Joerg Roedel
     
  • commit 807b9515b7d044cf77df31f1af9d842a76ecd5cb upstream.

    Since commit e9d3009cb936 introduced a regression and since the fix for
    that regression was not perfect, revert this commit.

    Link: https://marc.info/?l=target-devel&m=158157054906195
    Cc: Rahul Kundu
    Cc: Mike Marciniszyn
    Cc: Sagi Grimberg
    Reported-by: Dakshaja Uppalapati
    Fixes: e9d3009cb936 ("scsi: target: iscsi: Wait for all commands to finish before freeing a session")
    Signed-off-by: Bart Van Assche
    Signed-off-by: Martin K. Petersen
    Signed-off-by: Greg Kroah-Hartman

    Bart Van Assche
     
  • commit 2546287c5fb363a0165933ae2181c92f03e701d0 upstream.

    This was noticed when printing debugfs for MSIs on my ARM64 server. The
    new dstate IRQD_MSI_NOMASK_QUIRK came out surprisingly while it should only
    be the x86 stuff for the time being...

    The new MSI quirk flag uses the same bit as IRQ_DOMAIN_NAME_ALLOCATED which
    is oddly defined as bit 6 for no good reason.

    Switch it to the non used bit 1.

    Fixes: 6f1a4891a592 ("x86/apic/msi: Plug non-maskable MSI affinity race")
    Signed-off-by: Zenghui Yu
    Signed-off-by: Thomas Gleixner
    Cc: stable@vger.kernel.org
    Link: https://lkml.kernel.org/r/20200221020725.2038-1-yuzenghui@huawei.com
    Signed-off-by: Greg Kroah-Hartman

    Zenghui Yu
     
  • commit 63fb9623427fbb44e3782233b6e4714057b76ff2 upstream.

    Commit fdde0ff8590b ("ACPI: PM: s2idle: Prevent spurious SCIs from
    waking up the system") overlooked the fact that fixed events can wake
    up the system too and broke RTC wakeup from suspend-to-idle as a
    result.

    Fix this issue by checking the fixed events in acpi_s2idle_wake() in
    addition to checking wakeup GPEs and break out of the suspend-to-idle
    loop if the status bits of any enabled fixed events are set then.

    Fixes: fdde0ff8590b ("ACPI: PM: s2idle: Prevent spurious SCIs from waking up the system")
    Reported-and-tested-by: Chris Wilson
    Cc: 5.4+ # 5.4+
    Signed-off-by: Rafael J. Wysocki
    Signed-off-by: Linus Torvalds
    Signed-off-by: Greg Kroah-Hartman

    Rafael J. Wysocki
     
  • commit 0c5aae59270fb1f827acce182786094c9ccf598e upstream.

    The serdev tty-port controller driver should reset the tty-port client
    operations also on deregistration to avoid a NULL-pointer dereference in
    case the port is later re-registered as a normal tty device.

    Note that this can only happen with tty drivers such as 8250 which have
    statically allocated port structures that can end up being reused and
    where a later registration would not register a serdev controller (e.g.
    due to registration errors or if the devicetree has been changed in
    between).

    Specifically, this can be an issue for any statically defined ports that
    would be registered by 8250 core when an 8250 driver is being unbound.

    Fixes: bed35c6dfa6a ("serdev: add a tty port controller driver")
    Cc: stable # 4.11
    Reported-by: Loic Poulain
    Signed-off-by: Johan Hovold
    Link: https://lore.kernel.org/r/20200210145730.22762-1-johan@kernel.org
    Signed-off-by: Greg Kroah-Hartman

    Johan Hovold
     
  • commit 73f8bda9b5dc1c69df2bc55c0cbb24461a6391a9 upstream.

    Add a new device quirk that can be used to blacklist endpoints.

    Since commit 3e4f8e21c4f2 ("USB: core: fix check for duplicate
    endpoints") USB core ignores any duplicate endpoints found during
    descriptor parsing.

    In order to handle devices where the first interfaces with duplicate
    endpoints are the ones that should have their endpoints ignored, we need
    to add a blacklist.

    Tested-by: edes
    Cc: stable
    Signed-off-by: Johan Hovold
    Link: https://lore.kernel.org/r/20200203153830.26394-2-johan@kernel.org
    Signed-off-by: Greg Kroah-Hartman

    Johan Hovold
     

26 Feb, 2020

3 commits