26 May, 2020

1 commit

  • In commit 184ecc9eb260d5a3bcdddc5bebd18f285ac004e9 ("ptp: Add adjphase
    function to support phase offset control.") the PTP Hardware Clock
    interface expanded to support the ADJ_OFFSET offset mode. However,
    the implementation did not respect the traditional yet pedantic
    distinction between units of microseconds and nanoseconds signaled by
    the ADJ_NANO flag. This patch fixes the issue by adding logic to
    handle that flag.

    Signed-off-by: Richard Cochran
    Reviewed-by: Vincent Cheng
    Signed-off-by: David S. Miller

    Richard Cochran
     

03 May, 2020

1 commit


31 Mar, 2020

1 commit

  • The PTP Hardware Clock (PHC) subsystem offers an API for configuring
    programmable pins. User space sets or gets the settings using ioctls,
    and drivers verify dialed settings via a callback. Drivers may also
    query pin settings by calling the ptp_find_pin() method.

    Although the core subsystem protects concurrent access to the pin
    settings, the implementation places illogical restrictions on how
    drivers may call ptp_find_pin(). When enabling an auxiliary function
    via the .enable(on=1) callback, drivers may invoke the pin finding
    method, but when disabling with .enable(on=0) drivers are not
    permitted to do so. With the exception of the mv88e6xxx, all of the
    PHC drivers do respect this restriction, but still the locking pattern
    is both confusing and unnecessary.

    This patch changes the locking implementation to allow PHC drivers to
    freely call ptp_find_pin() from their .enable() and .verify()
    callbacks.

    V2 ChangeLog:
    - fixed spelling in the kernel doc
    - add Vladimir's tested by tag

    Signed-off-by: Richard Cochran
    Reported-by: Yangbo Lu
    Tested-by: Vladimir Oltean
    Signed-off-by: David S. Miller

    Richard Cochran
     

20 Jan, 2020

1 commit


15 Jan, 2020

1 commit

  • There is a bug in ptp_clock_unregister(), where ptp_cleanup_pin_groups()
    first frees ptp->pin_{,dev_}attr, but then posix_clock_unregister() needs
    them to destroy a related sysfs device.

    These functions can not be just swapped, as posix_clock_unregister() frees
    ptp which is needed in the ptp_cleanup_pin_groups(). Fix this by calling
    ptp_cleanup_pin_groups() in ptp_clock_release(), right before ptp is freed.

    This makes this patch fix an UAF bug in a patch which fixes an UAF bug.

    Reported-by: Antti Laakso
    Fixes: a33121e5487b ("ptp: fix the race between the release of ptp_clock and cdev")
    Link: https://lore.kernel.org/netdev/3d2bd09735dbdaf003585ca376b7c1e5b69a19bd.camel@intel.com/
    Signed-off-by: Vladis Dronov
    Acked-by: Richard Cochran
    Signed-off-by: David S. Miller

    Vladis Dronov
     

01 Jan, 2020

1 commit


31 Dec, 2019

2 commits

  • In order to effectively use the PTP kernel thread for tasks such as
    timestamping packets, allow the user control over stopping it, which is
    needed e.g. when the timestamping queues must be drained.

    Signed-off-by: Vladimir Oltean
    Signed-off-by: David S. Miller

    Vladimir Oltean
     
  • In a case when a ptp chardev (like /dev/ptp0) is open but an underlying
    device is removed, closing this file leads to a race. This reproduces
    easily in a kvm virtual machine:

    ts# cat openptp0.c
    int main() { ... fp = fopen("/dev/ptp0", "r"); ... sleep(10); }
    ts# uname -r
    5.5.0-rc3-46cf053e
    ts# cat /proc/cmdline
    ... slub_debug=FZP
    ts# modprobe ptp_kvm
    ts# ./openptp0 &
    [1] 670
    opened /dev/ptp0, sleeping 10s...
    ts# rmmod ptp_kvm
    ts# ls /dev/ptp*
    ls: cannot access '/dev/ptp*': No such file or directory
    ts# ...woken up
    [ 48.010809] general protection fault: 0000 [#1] SMP
    [ 48.012502] CPU: 6 PID: 658 Comm: openptp0 Not tainted 5.5.0-rc3-46cf053e #25
    [ 48.014624] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ...
    [ 48.016270] RIP: 0010:module_put.part.0+0x7/0x80
    [ 48.017939] RSP: 0018:ffffb3850073be00 EFLAGS: 00010202
    [ 48.018339] RAX: 000000006b6b6b6b RBX: 6b6b6b6b6b6b6b6b RCX: ffff89a476c00ad0
    [ 48.018936] RDX: fffff65a08d3ea08 RSI: 0000000000000247 RDI: 6b6b6b6b6b6b6b6b
    [ 48.019470] ... ^^^ a slub poison
    [ 48.023854] Call Trace:
    [ 48.024050] __fput+0x21f/0x240
    [ 48.024288] task_work_run+0x79/0x90
    [ 48.024555] do_exit+0x2af/0xab0
    [ 48.024799] ? vfs_write+0x16a/0x190
    [ 48.025082] do_group_exit+0x35/0x90
    [ 48.025387] __x64_sys_exit_group+0xf/0x10
    [ 48.025737] do_syscall_64+0x3d/0x130
    [ 48.026056] entry_SYSCALL_64_after_hwframe+0x44/0xa9
    [ 48.026479] RIP: 0033:0x7f53b12082f6
    [ 48.026792] ...
    [ 48.030945] Modules linked in: ptp i6300esb watchdog [last unloaded: ptp_kvm]
    [ 48.045001] Fixing recursive fault but reboot is needed!

    This happens in:

    static void __fput(struct file *file)
    { ...
    if (file->f_op->release)
    file->f_op->release(inode, file); <<< cdev is kfree'd here
    if (unlikely(S_ISCHR(inode->i_mode) && inode->i_cdev != NULL &&
    !(mode & FMODE_PATH))) {
    cdev_put(inode->i_cdev); <<< cdev fields are accessed here

    Namely:

    __fput()
    posix_clock_release()
    kref_put(&clk->kref, delete_clock) <<< the last reference
    delete_clock()
    delete_ptp_clock()
    kfree(ptp) <<< cdev is embedded in ptp
    cdev_put
    module_put(p->owner) <<< *p is kfree'd, bang!

    Here cdev is embedded in posix_clock which is embedded in ptp_clock.
    The race happens because ptp_clock's lifetime is controlled by two
    refcounts: kref and cdev.kobj in posix_clock. This is wrong.

    Make ptp_clock's sysfs device a parent of cdev with cdev_device_add()
    created especially for such cases. This way the parent device with its
    ptp_clock is not released until all references to the cdev are released.
    This adds a requirement that an initialized but not exposed struct
    device should be provided to posix_clock_register() by a caller instead
    of a simple dev_t.

    This approach was adopted from the commit 72139dfa2464 ("watchdog: Fix
    the race between the release of watchdog_core_data and cdev"). See
    details of the implementation in the commit 233ed09d7fda ("chardev: add
    helper function to register char devs with a struct device").

    Link: https://lore.kernel.org/linux-fsdevel/20191125125342.6189-1-vdronov@redhat.com/T/#u
    Analyzed-by: Stephen Johnston
    Analyzed-by: Vern Lovejoy
    Signed-off-by: Vladis Dronov
    Acked-by: Richard Cochran
    Signed-off-by: David S. Miller

    Vladis Dronov
     

14 Jun, 2019

1 commit


24 May, 2019

1 commit

  • Based on 1 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license as published by
    the free software foundation either version 2 of the license or at
    your option any later version this program is distributed in the
    hope that it will be useful but without any warranty without even
    the implied warranty of merchantability or fitness for a particular
    purpose see the gnu general public license for more details you
    should have received a copy of the gnu general public license along
    with this program if not write to the free software foundation inc
    675 mass ave cambridge ma 02139 usa

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-or-later

    has been chosen to replace the boilerplate/reference in 441 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Michael Ellerman (powerpc)
    Reviewed-by: Richard Fontana
    Reviewed-by: Allison Randal
    Reviewed-by: Kate Stewart
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190520071858.739733335@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

07 Feb, 2019

1 commit

  • struct timex is not y2038 safe.
    Replace all uses of timex with y2038 safe __kernel_timex.

    Note that struct __kernel_timex is an ABI interface definition.
    We could define a new structure based on __kernel_timex that
    is only available internally instead. Right now, there isn't
    a strong motivation for this as the structure is isolated to
    a few defined struct timex interfaces and such a structure would
    be exactly the same as struct timex.

    The patch was generated by the following coccinelle script:

    virtual patch

    @depends on patch forall@
    identifier ts;
    expression e;
    @@
    (
    - struct timex ts;
    + struct __kernel_timex ts;
    |
    - struct timex ts = {};
    + struct __kernel_timex ts = {};
    |
    - struct timex ts = e;
    + struct __kernel_timex ts = e;
    |
    - struct timex *ts;
    + struct __kernel_timex *ts;
    |
    (memset \| copy_from_user \| copy_to_user \)(...,
    - sizeof(struct timex))
    + sizeof(struct __kernel_timex))
    )

    @depends on patch forall@
    identifier ts;
    identifier fn;
    @@
    fn(...,
    - struct timex *ts,
    + struct __kernel_timex *ts,
    ...) {
    ...
    }

    @depends on patch forall@
    identifier ts;
    identifier fn;
    @@
    fn(...,
    - struct timex *ts) {
    + struct __kernel_timex *ts) {
    ...
    }

    Signed-off-by: Deepa Dinamani
    Cc: linux-alpha@vger.kernel.org
    Cc: netdev@vger.kernel.org
    Signed-off-by: Arnd Bergmann

    Deepa Dinamani
     

29 Dec, 2018

1 commit

  • Pull char/misc driver updates from Greg KH:
    "Here is the big set of char and misc driver patches for 4.21-rc1.

    Lots of different types of driver things in here, as this tree seems
    to be the "collection of various driver subsystems not big enough to
    have their own git tree" lately.

    Anyway, some highlights of the changes in here:

    - binderfs: is it a rule that all driver subsystems will eventually
    grow to have their own filesystem? Binder now has one to handle the
    use of it in containerized systems.

    This was discussed at the Plumbers conference a few months ago and
    knocked into mergable shape very fast by Christian Brauner. Who
    also has signed up to be another binder maintainer, showing a
    distinct lack of good judgement :)

    - binder updates and fixes

    - mei driver updates

    - fpga driver updates and additions

    - thunderbolt driver updates

    - soundwire driver updates

    - extcon driver updates

    - nvmem driver updates

    - hyper-v driver updates

    - coresight driver updates

    - pvpanic driver additions and reworking for more device support

    - lp driver updates. Yes really, it's _finally_ moved to the proper
    parallal port driver model, something I never thought I would see
    happen. Good stuff.

    - other tiny driver updates and fixes.

    All of these have been in linux-next for a while with no reported
    issues"

    * tag 'char-misc-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (116 commits)
    MAINTAINERS: add another Android binder maintainer
    intel_th: msu: Fix an off-by-one in attribute store
    stm class: Add a reference to the SyS-T document
    stm class: Fix a module refcount leak in policy creation error path
    char: lp: use new parport device model
    char: lp: properly count the lp devices
    char: lp: use first unused lp number while registering
    char: lp: detach the device when parallel port is removed
    char: lp: introduce list to save port number
    bus: qcom: remove duplicated include from qcom-ebi2.c
    VMCI: Use memdup_user() rather than duplicating its implementation
    char/rtc: Use of_node_name_eq for node name comparisons
    misc: mic: fix a DMA pool free failure
    ptp: fix an IS_ERR() vs NULL check
    genwqe: Fix size check
    binder: implement binderfs
    binder: fix use-after-free due to ksys_close() during fdget()
    bus: fsl-mc: remove duplicated include files
    bus: fsl-mc: explicitly define the fsl_mc_command endianness
    misc: ti-st: make array read_ver_cmd static, shrinks object size
    ...

    Linus Torvalds
     

19 Dec, 2018

1 commit

  • We recently modified pps_register_source() to return error pointers
    instead of NULL but it seems like there was a merge issue and part of
    the commit was lost. Anyway, the ptp_clock_register() function needs to
    be updated to check for IS_ERR() as well.

    Fixes: 3b1ad360acad ("pps: using ERR_PTR instead of NULL while pps_register_source fails")
    Signed-off-by: Dan Carpenter
    Acked-by: Richard Cochran
    Signed-off-by: Greg Kroah-Hartman

    Dan Carpenter
     

24 Nov, 2018

1 commit

  • Fix smatch warning:

    drivers/ptp/ptp_clock.c:298 ptp_clock_register() warn:
    passing zero to 'ERR_PTR'

    'err' should be set while device_create_with_groups and
    pps_register_source fails

    Fixes: 85a66e550195 ("ptp: create "pins" together with the rest of attributes")
    Signed-off-by: YueHaibing
    Acked-by: Richard Cochran
    Signed-off-by: David S. Miller

    YueHaibing
     

10 Nov, 2018

1 commit


29 Oct, 2018

1 commit

  • Building with -Wformat-nonliteral, gcc complains

    drivers/ptp/ptp_clock.c: In function ‘ptp_clock_register’:
    drivers/ptp/ptp_clock.c:239:26: warning: format not a string literal and no format arguments [-Wformat-nonliteral]
    worker_name : info->name);

    kthread_create_worker takes fmt+varargs to set the name of the
    worker, and that happens with a vsnprintf() to a stack buffer (that is
    then copied into task_comm). So there's no reason not to just pass
    "ptp%d", ptp->index to kthread_create_worker() and avoid the
    intermediate worker_name variable.

    Signed-off-by: Rasmus Villemoes
    Acked-by: Richard Cochran
    Reviewed-by: Kees Cook
    Signed-off-by: David S. Miller

    Rasmus Villemoes
     

02 Aug, 2017

1 commit

  • Many PTP drivers required to perform some asynchronous or periodic work,
    like periodically handling PHC counter overflow or handle delayed timestamp
    for RX/TX network packets. In most of the cases, such work is implemented
    using workqueues. Unfortunately, Kernel workqueues might introduce
    significant delay in work scheduling under high system load and on -RT,
    which could cause misbehavior of PTP drivers due to internal counter
    overflow, for example, and there is no way to tune its execution policy and
    priority manuallly.

    Hence, The kthread_worker can be used insted of workqueues, as it create
    separte named kthread for each worker and its its execution policy and
    priority can be configured using chrt tool.

    This prblem was reported for two drivers TI CPSW CPTS and dp83640, so
    instead of modifying each of these driver it was proposed to add PTP
    auxiliary worker to the PHC subsystem.

    The patch adds PTP auxiliary worker in PHC subsystem using kthread_worker
    and kthread_delayed_work and introduces two new PHC subsystem APIs:

    - long (*do_aux_work)(struct ptp_clock_info *ptp) callback in
    ptp_clock_info structure, which driver should assign if it require to
    perform asynchronous or periodic work. Driver should return the delay of
    the PTP next auxiliary work scheduling time (>=0) or negative value in case
    further scheduling is not required.

    - int ptp_schedule_worker(struct ptp_clock *ptp, unsigned long delay) which
    allows schedule PTP auxiliary work.

    The name of kthread_worker thread corresponds PTP PHC device name "ptp%d".

    Signed-off-by: Grygorii Strashko
    Signed-off-by: David S. Miller

    Grygorii Strashko
     

15 Apr, 2017

1 commit

  • struct timespec is not y2038 safe on 32 bit machines.

    The posix clocks apis use struct timespec directly and through struct
    itimerspec.

    Replace the posix clock interfaces to use struct timespec64 and struct
    itimerspec64 instead. Also fix up their implementations accordingly.

    Note that the clock_getres() interface has also been changed to use
    timespec64 even though this particular interface is not affected by the
    y2038 problem. This helps verification for internal kernel code for y2038
    readiness by getting rid of time_t/ timeval/ timespec.

    Signed-off-by: Deepa Dinamani
    Cc: arnd@arndb.de
    Cc: y2038@lists.linaro.org
    Cc: netdev@vger.kernel.org
    Cc: Richard Cochran
    Cc: john.stultz@linaro.org
    Link: http://lkml.kernel.org/r/1490555058-4603-3-git-send-email-deepa.kernel@gmail.com
    Signed-off-by: Thomas Gleixner

    Deepa Dinamani
     

18 Feb, 2017

2 commits


10 Nov, 2016

1 commit

  • The internal PTP Hardware Clock (PHC) interface limits the resolution for
    frequency adjustments to one part per billion. However, some hardware
    devices allow finer adjustment, and making use of the increased resolution
    improves synchronization measurably on such devices.

    This patch adds an alternative method that allows finer frequency tuning
    by passing the scaled ppm value to PHC drivers. This value comes from
    user space, and it has a resolution of about 0.015 ppb. We also deprecate
    the older method, anticipating its removal once existing drivers have been
    converted over.

    Signed-off-by: Richard Cochran
    Suggested-by: Ulrik De Bie
    Signed-off-by: David S. Miller

    Richard Cochran
     

04 Oct, 2016

1 commit

  • A call to 'ida_simple_remove()' is missing in the error handling path.

    This as been spotted with the following coccinelle script which tries to
    detect missing 'ida_simple_remove()' call in error handling paths.

    ///////////////
    @@
    expression x;
    identifier l;
    @@

    * x = ida_simple_get(...);
    ...
    if (...) {
    ...
    }
    ...
    if (...) {
    ...
    goto l;
    }
    ...
    * l: ... when != ida_simple_remove(...);

    Signed-off-by: Christophe JAILLET
    Acked-by: Richard Cochran
    Signed-off-by: David S. Miller

    Christophe Jaillet
     

01 Apr, 2015

2 commits


29 Apr, 2014

1 commit

  • PTP Hardware Clock drivers specify a maximum frequency adjustment that
    their clocks can accommodate. Normally, user space programs will want to
    respect the advertised limits. However, no kernel or driver code checks
    that the dialed frequency offset is within the bounds, and out of range
    values can lead to surprising results.

    This patch fixes the issue by rejecting bad values.

    Signed-off-by: Richard Cochran
    Signed-off-by: David S. Miller

    Richard Cochran
     

22 Mar, 2014

1 commit

  • This patch adds a pair of new ioctls to the PTP Hardware Clock device
    interface. Using the ioctls, user space programs can query each pin to
    find out its current function and also reprogram a different function
    if desired.

    Signed-off-by: Richard Cochran
    Signed-off-by: David S. Miller

    Richard Cochran
     

27 Jul, 2013

1 commit


13 Apr, 2013

1 commit

  • As network adapters supporting PTP are becoming more common, machines with
    many NICs suddenly have many PHCs, too. The current limit of eight /dev/ptp*
    char devices (and thus, 8 network interfaces with PHC) is insufficient. Let
    the ptp driver allocate the char devices dynamically.

    Tested with 28 PHCs, removing and re-adding some of them.

    Thanks to Ben Hutchings for advice leading to simpler and cleaner patch.

    Signed-off-by: Jiri Benc
    Acked-by: Richard Cochran
    Signed-off-by: David S. Miller

    Jiri Benc
     

23 Sep, 2012

3 commits

  • PTP Hardware Clock devices appear as class devices in sysfs. This patch
    changes the registration API to use the parent device, clarifying the
    clock's relationship to the underlying device.

    Signed-off-by: Richard Cochran
    Acked-by: Ben Hutchings
    Acked-by: Jeff Kirsher
    Signed-off-by: David S. Miller

    Richard Cochran
     
  • If the timex.mode field indicates a query, then we provide the value of
    the current frequency adjustment.

    [ Get rid of extraneous empty lines -DaveM ]

    Signed-off-by: Richard Cochran
    Signed-off-by: David S. Miller

    Richard Cochran
     
  • This patch adds a field to the representation of a PTP hardware clock in
    order to remember the frequency adjustment value dialed by the user.

    Adding this field will let us answer queries in the manner of adjtimex
    in a follow on patch.

    Signed-off-by: Richard Cochran
    Signed-off-by: David S. Miller

    Richard Cochran
     

08 Sep, 2012

1 commit

  • Initial version by Stuart Hodgson

    Some PHC device drivers may deliver PPS events with a significant
    and variable delay, but still be able to measure precisely what
    that delay is.

    Add a pps_sub_ts() function for subtracting a delay from the
    timestamp(s) in a PPS event, and a PTP event type (PTP_CLOCK_PPSUSR)
    for which the caller provides a complete PPS event.

    Signed-off-by: Ben Hutchings

    Ben Hutchings
     

04 Apr, 2012

1 commit


17 Mar, 2012

1 commit


06 Dec, 2011

1 commit


24 May, 2011

1 commit

  • This patch adds an infrastructure for hardware clocks that implement
    IEEE 1588, the Precision Time Protocol (PTP). A class driver offers a
    registration method to particular hardware clock drivers. Each clock is
    presented as a standard POSIX clock.

    The ancillary clock features are exposed in two different ways, via
    the sysfs and by a character device.

    Signed-off-by: Richard Cochran
    Acked-by: Arnd Bergmann
    Acked-by: David S. Miller
    Signed-off-by: John Stultz

    Richard Cochran