02 Nov, 2021

2 commits

  • This adds a UIO driver the ivshmem device, found in QEMU and the
    Jailhouse hypervisor. It exposes the MMIO register region and all shared
    memory section to userspace. Interrupts are configured in one-shot mode
    so that userspace needs to re-enable them after each event via the
    Interrupt Control register. The driver registers all possible MSI-X
    vectors, coalescing them into the single notifier UIO provides.

    Note: Specification work for the interface is ongoing, so details may
    still change.

    Signed-off-by: Jan Kiszka

    Jan Kiszka
     
  • This allows to tag memory regions read-only, denying userspace to map
    them writable. Default remains read/write.

    Signed-off-by: Jan Kiszka

    Jan Kiszka
     

21 May, 2021

2 commits


14 May, 2021

5 commits

  • import memory resources from underlying pci device, thus allowing
    userspace applications to memory map those resources.

    without this change, current implementation, does not populate the
    memory maps and are not shown under the corresponding sysfs uio entry:

    root@apalis-imx8:~# echo "ad00 0122" > \
    /sys/bus/pci/drivers/uio_pci_generic/new_id
    [ 55.736433] uio_pci_generic 0000:01:00.0: enabling device (0000 -> 0002)
    root@apalis-imx8:~# ls -lsrt /sys/class/uio/uio0/
    0 -rw-r--r-- 1 root root 4096 Apr 27 18:52 uevent
    0 -r--r--r-- 1 root root 4096 Apr 27 18:52 version
    0 -r--r--r-- 1 root root 4096 Apr 27 18:52 suppliers
    0 lrwxrwxrwx 1 root root 0 Apr 27 18:52 subsystem
    -> ../../../../../../../../../class/uio
    0 drwxr-xr-x 2 root root 0 Apr 27 18:52 power
    0 -r--r--r-- 1 root root 4096 Apr 27 18:52 name
    0 -r--r--r-- 1 root root 4096 Apr 27 18:52 event
    0 lrwxrwxrwx 1 root root 0 Apr 27 18:52 device
    -> ../../../0000:01:00.0
    0 -r--r--r-- 1 root root 4096 Apr 27 18:52 dev
    0 -r--r--r-- 1 root root 4096 Apr 27 18:52 consumers
    root@apalis-imx8:~#

    with the proposed changed, have following instead:
    root@apalis-imx8:~# ls -lsrt /sys/class/uio/uio0/
    0 -rw-r--r-- 1 root root 4096 Apr 27 19:06 uevent
    0 -r--r--r-- 1 root root 4096 Apr 27 19:06 version
    0 -r--r--r-- 1 root root 4096 Apr 27 19:06 suppliers
    0 lrwxrwxrwx 1 root root 0 Apr 27 19:06 subsystem
    -> ../../../../../../../../../class/uio
    0 drwxr-xr-x 2 root root 0 Apr 27 19:06 power
    0 -r--r--r-- 1 root root 4096 Apr 27 19:06 name
    0 drwxr-xr-x 4 root root 0 Apr 27 19:06 maps
    0 -r--r--r-- 1 root root 4096 Apr 27 19:06 event
    0 lrwxrwxrwx 1 root root 0 Apr 27 19:06 device
    -> ../../../0000:01:00.0
    0 -r--r--r-- 1 root root 4096 Apr 27 19:06 dev
    0 -r--r--r-- 1 root root 4096 Apr 27 19:06 consumers
    root@apalis-imx8:~#

    root@apalis-imx8:~# ls -lsrt /sys/class/uio/uio0/maps/
    0 drwxr-xr-x 2 root root 0 Apr 27 19:07 map1
    0 drwxr-xr-x 2 root root 0 Apr 27 19:07 map0
    root@apalis-imx8:~#

    root@apalis-imx8:~# cat /sys/class/uio/uio0/maps/map1/addr
    0x0000000062000000
    root@apalis-imx8:~#

    root@apalis-imx8:~# cat /sys/class/uio/uio0/maps/map1/size
    0x0000000000200000
    root@apalis-imx8:~#

    tested on AltaData ARINC 429 MiniPCIE module on imx8qm-apalis-ixora-v1.2

    Signed-off-by: Firas Ashkar
    Link: https://lore.kernel.org/r/20210427201046.4005820-1-firas.ashkar@savoirfairelinux.com
    Signed-off-by: Greg Kroah-Hartman

    Firas Ashkar
     
  • 'pci_iomap()' is used in the probe and 'pci_iounmap()' in the error
    handling path of the probe.
    So keep things consistent and use 'pci_iounmap()' also in the remove
    function.

    Fixes: 1bafeb378e91 ("uio: add the uio_aec driver")
    Signed-off-by: Christophe JAILLET
    Link: https://lore.kernel.org/r/f6b2a09a45658e8ef552aa34f0b8615dc1c35838.1620546705.git.christophe.jaillet@wanadoo.fr
    Signed-off-by: Greg Kroah-Hartman

    Christophe JAILLET
     
  • Memory allocated by 'vmbus_alloc_ring()' at the beginning of the probe
    function is never freed in the error handling path.

    Add the missing 'vmbus_free_ring()' call.

    Note that it is already freed in the .remove function.

    Fixes: cdfa835c6e5e ("uio_hv_generic: defer opening vmbus until first use")
    Cc: stable
    Signed-off-by: Christophe JAILLET
    Link: https://lore.kernel.org/r/0d86027b8eeed8e6360bc3d52bcdb328ff9bdca1.1620544055.git.christophe.jaillet@wanadoo.fr
    Signed-off-by: Greg Kroah-Hartman

    Christophe JAILLET
     
  • If 'vmbus_establish_gpadl()' fails, the (recv|send)_gpadl will not be
    updated and 'hv_uio_cleanup()' in the error handling path will not be
    able to free the corresponding buffer.

    In such a case, we need to free the buffer explicitly.

    Fixes: cdfa835c6e5e ("uio_hv_generic: defer opening vmbus until first use")
    Cc: stable
    Signed-off-by: Christophe JAILLET
    Link: https://lore.kernel.org/r/4fdaff557deef6f0475d02ba7922ddbaa1ab08a6.1620544055.git.christophe.jaillet@wanadoo.fr
    Signed-off-by: Greg Kroah-Hartman

    Christophe JAILLET
     
  • Commit ef84928cff58 ("uio/uio_pci_generic: use device-managed function
    equivalents") was able to simplify various error paths thanks to no
    longer having to clean up on the way out. Some error paths were dropped,
    others were simplified. In one of those simplifications, the return
    value was accidentally changed from -ENODEV to -ENOMEM. Restore the old
    return value.

    Fixes: ef84928cff58 ("uio/uio_pci_generic: use device-managed function equivalents")
    Cc: stable
    Acked-by: Michael S. Tsirkin
    Signed-off-by: Martin Ågren
    Link: https://lore.kernel.org/r/20210422192240.1136373-1-martin.agren@gmail.com
    Signed-off-by: Greg Kroah-Hartman

    Martin Ågren
     

28 Mar, 2021

1 commit

  • This patch supports the DFL drivers be written in userspace. This is
    realized by exposing the userspace I/O device interfaces.

    The driver now only binds the ether group feature, which has no irq. So
    the irq support is not implemented yet.

    Reviewed-by: Tom Rix
    Signed-off-by: Xu Yilun
    Link: https://lore.kernel.org/r/1615168776-8553-2-git-send-email-yilun.xu@intel.com
    Signed-off-by: Greg Kroah-Hartman

    Xu Yilun
     

09 Feb, 2021

1 commit

  • Some devices use 255 as default value of Interrupt Line register, and this
    maybe causes pdev->irq is set as IRQ_NOTCONNECTED in some scenarios. For
    example, NVMe controller connects to Intel Volume Management Device (VMD).
    In this situation, IRQ_NOTCONNECTED means INTx line is not connected, not
    fault. If bind uio_pci_generic to these devices, uio frame will return
    -ENOTCONN through request_irq.

    This patch allows binding uio_pci_generic to device with dev->irq of
    IRQ_NOTCONNECTED.

    Acked-by: Kyungsan Kim
    Signed-off-by: Jie Li
    Link: https://lore.kernel.org/r/1612153559-17028-1-git-send-email-jie6.li@samsung.com
    Signed-off-by: Greg Kroah-Hartman

    Jie Li
     

10 Dec, 2020

11 commits

  • This is a minor cleanup for the management of the private object of this
    driver. The allocation can be tied to the life-time of the hv_device
    object.
    This cleans up a bit the exit & error paths, since the object doesn't need
    to be explicitly free'd anymore.

    Signed-off-by: Alexandru Ardelean
    Link: https://lore.kernel.org/r/20201119154903.82099-4-alexandru.ardelean@analog.com
    Signed-off-by: Greg Kroah-Hartman

    Alexandru Ardelean
     
  • This change moves all the simple allocations to use device-managed
    allocator functions. This way their life-time is tied to the
    platform_device object, so when this gets free'd these allocations also get
    cleaned up.
    The final effect is that error & exit paths get cleaned up a bit.

    Signed-off-by: Alexandru Ardelean
    Link: https://lore.kernel.org/r/20201119154903.82099-3-alexandru.ardelean@analog.com
    Signed-off-by: Greg Kroah-Hartman

    Alexandru Ardelean
     
  • The uio_info object is free'd last, so it's life-time is tied PCI device
    object. Using devm_kzalloc() cleans up the error path a bit and the exit
    path.

    Signed-off-by: Alexandru Ardelean
    Link: https://lore.kernel.org/r/20201119154903.82099-2-alexandru.ardelean@analog.com
    Signed-off-by: Greg Kroah-Hartman

    Alexandru Ardelean
     
  • The uio_info object is free'd last, so it's life-time is tied PCI device
    object. Using devm_kzalloc() cleans up the error path a bit and the exit
    path.

    Signed-off-by: Alexandru Ardelean
    Link: https://lore.kernel.org/r/20201119154903.82099-1-alexandru.ardelean@analog.com
    Signed-off-by: Greg Kroah-Hartman

    Alexandru Ardelean
     
  • This change uses the devm_kzalloc() function to tie the life-time of the
    uio_info object to PCI device. This cleans up the exit & error path a bit.

    Signed-off-by: Alexandru Ardelean
    Link: https://lore.kernel.org/r/20201120084207.50736-3-alexandru.ardelean@analog.com
    Signed-off-by: Greg Kroah-Hartman

    Alexandru Ardelean
     
  • This change uses the devm_kzalloc() function to tie the life-time of the
    uio_info object to PCI device. This cleans up the exit & error path a bit.

    Signed-off-by: Alexandru Ardelean
    Link: https://lore.kernel.org/r/20201120084207.50736-2-alexandru.ardelean@analog.com
    Signed-off-by: Greg Kroah-Hartman

    Alexandru Ardelean
     
  • This change converts the simple allocations [kzalloc()] to devm_kzalloc()
    tying the life-time of these objects to the PCI device object.
    It cleans up the error and exit path and bit, and does a minor correction
    that -ENOMEM is returned (vs -ENODEV) in case the 'priv' object cannot be
    allocated.

    Signed-off-by: Alexandru Ardelean
    Link: https://lore.kernel.org/r/20201120084207.50736-1-alexandru.ardelean@analog.com
    Signed-off-by: Greg Kroah-Hartman

    Alexandru Ardelean
     
  • This moves move pm_runtime_disable on a devm_add_action_or_reset() handler.
    And with the use of the devm_uio_register_device() function, the remove
    hook is no longer required.

    Signed-off-by: Alexandru Ardelean
    Link: https://lore.kernel.org/r/20201120075625.12272-2-alexandru.ardelean@analog.com
    Signed-off-by: Greg Kroah-Hartman

    Alexandru Ardelean
     
  • This change converts the simple allocations in the driver to used
    device-managed allocation functions.
    This removes the error path entirely in the probe function, and reduces
    some code in the remove function.

    Signed-off-by: Alexandru Ardelean
    Link: https://lore.kernel.org/r/20201120075625.12272-1-alexandru.ardelean@analog.com
    Signed-off-by: Greg Kroah-Hartman

    Alexandru Ardelean
     
  • The pci_get_drvdata() was moved during commit ef84928cff58
    ("uio/uio_pci_generic: use device-managed function equivalents").

    Storing a private object with pci_set_drvdata() doesn't make sense
    since that change, since there is no more pci_get_drvdata() call in the
    driver to retrieve the information.

    This change removes it.

    Fixes: ef84928cff58 ("uio/uio_pci_generic: use device-managed function equivalents")
    Signed-off-by: Alexandru Ardelean
    Link: https://lore.kernel.org/r/20201123143447.16829-1-alexandru.ardelean@analog.com
    Signed-off-by: Greg Kroah-Hartman

    Alexandru Ardelean
     
  • This change uses devm_clk_get() to obtain a reference to the clock. It has
    the benefit that clk_put() is no longer required, and cleans up the exit &
    error path.

    Signed-off-by: Alexandru Ardelean
    Link: https://lore.kernel.org/r/20201119145059.48326-1-alexandru.ardelean@analog.com
    Signed-off-by: Greg Kroah-Hartman

    Alexandru Ardelean
     

16 Nov, 2020

1 commit


14 Nov, 2020

1 commit

  • This driver can be easily converted to use the device-managed allocator
    function and the PCI managed enable function.

    With these conversions the probe error paths are no longer needed and
    neither is the remove function.

    Signed-off-by: Alexandru Ardelean
    Link: https://lore.kernel.org/r/20201111113828.64992-1-alexandru.ardelean@analog.com
    Signed-off-by: Greg Kroah-Hartman

    Alexandru Ardelean
     

13 Nov, 2020

1 commit


10 Nov, 2020

2 commits

  • Commit 8fd0e2a6df26 ("uio: free uio id after uio file node is freed")
    triggered KASAN use-after-free failure at deletion of TCM-user
    backstores [1].

    In uio_unregister_device(), struct uio_device *idev is passed to
    uio_free_minor() to refer idev->minor. However, before uio_free_minor()
    call, idev is already freed by uio_device_release() during call to
    device_unregister().

    To avoid reference to idev->minor after idev free, keep idev->minor
    value in a local variable. Also modify uio_free_minor() argument to
    receive the value.

    [1]
    BUG: KASAN: use-after-free in uio_unregister_device+0x166/0x190
    Read of size 4 at addr ffff888105196508 by task targetcli/49158

    CPU: 3 PID: 49158 Comm: targetcli Not tainted 5.10.0-rc1 #1
    Hardware name: Supermicro Super Server/X10SRL-F, BIOS 2.0 12/17/2015
    Call Trace:
    dump_stack+0xae/0xe5
    ? uio_unregister_device+0x166/0x190
    print_address_description.constprop.0+0x1c/0x210
    ? uio_unregister_device+0x166/0x190
    ? uio_unregister_device+0x166/0x190
    kasan_report.cold+0x37/0x7c
    ? kobject_put+0x80/0x410
    ? uio_unregister_device+0x166/0x190
    uio_unregister_device+0x166/0x190
    tcmu_destroy_device+0x1c4/0x280 [target_core_user]
    ? tcmu_release+0x90/0x90 [target_core_user]
    ? __mutex_unlock_slowpath+0xd6/0x5d0
    target_free_device+0xf3/0x2e0 [target_core_mod]
    config_item_cleanup+0xea/0x210
    configfs_rmdir+0x651/0x860
    ? detach_groups.isra.0+0x380/0x380
    vfs_rmdir.part.0+0xec/0x3a0
    ? __lookup_hash+0x20/0x150
    do_rmdir+0x252/0x320
    ? do_file_open_root+0x420/0x420
    ? strncpy_from_user+0xbc/0x2f0
    ? getname_flags.part.0+0x8e/0x450
    do_syscall_64+0x33/0x40
    entry_SYSCALL_64_after_hwframe+0x44/0xa9
    RIP: 0033:0x7f9e2bfc91fb
    Code: 73 01 c3 48 8b 0d 9d ec 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 54 00 00 00 0f 05 3d 01 f0 ff ff 73 01 c3 48 8b 0d 6d ec 0c 00 f7 d8 64 89 01 48
    RSP: 002b:00007ffdd2baafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
    RAX: ffffffffffffffda RBX: 00007f9e2beb44a0 RCX: 00007f9e2bfc91fb
    RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007f9e1c20be90
    RBP: 00007ffdd2bab000 R08: 0000000000000000 R09: 00007f9e2bdf2440
    R10: 00007ffdd2baaf37 R11: 0000000000000246 R12: 00000000ffffff9c
    R13: 000055f9abb7e390 R14: 000055f9abcf9558 R15: 00007f9e2be7a780

    Allocated by task 34735:
    kasan_save_stack+0x1b/0x40
    __kasan_kmalloc.constprop.0+0xc2/0xd0
    __uio_register_device+0xeb/0xd40
    tcmu_configure_device+0x5a0/0xbc0 [target_core_user]
    target_configure_device+0x12f/0x760 [target_core_mod]
    target_dev_enable_store+0x32/0x50 [target_core_mod]
    configfs_write_file+0x2bb/0x450
    vfs_write+0x1ce/0x610
    ksys_write+0xe9/0x1b0
    do_syscall_64+0x33/0x40
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

    Freed by task 49158:
    kasan_save_stack+0x1b/0x40
    kasan_set_track+0x1c/0x30
    kasan_set_free_info+0x1b/0x30
    __kasan_slab_free+0x110/0x150
    slab_free_freelist_hook+0x5a/0x170
    kfree+0xc6/0x560
    device_release+0x9b/0x210
    kobject_put+0x13e/0x410
    uio_unregister_device+0xf9/0x190
    tcmu_destroy_device+0x1c4/0x280 [target_core_user]
    target_free_device+0xf3/0x2e0 [target_core_mod]
    config_item_cleanup+0xea/0x210
    configfs_rmdir+0x651/0x860
    vfs_rmdir.part.0+0xec/0x3a0
    do_rmdir+0x252/0x320
    do_syscall_64+0x33/0x40
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

    The buggy address belongs to the object at ffff888105196000
    which belongs to the cache kmalloc-2k of size 2048
    The buggy address is located 1288 bytes inside of
    2048-byte region [ffff888105196000, ffff888105196800)
    The buggy address belongs to the page:
    page:0000000098e6ca81 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x105190
    head:0000000098e6ca81 order:3 compound_mapcount:0 compound_pincount:0
    flags: 0x17ffffc0010200(slab|head)
    raw: 0017ffffc0010200 dead000000000100 dead000000000122 ffff888100043040
    raw: 0000000000000000 0000000000080008 00000001ffffffff ffff88810eb55c01
    page dumped because: kasan: bad access detected
    page->mem_cgroup:ffff88810eb55c01

    Memory state around the buggy address:
    ffff888105196400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    ffff888105196480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    >ffff888105196500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    ^
    ffff888105196580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    ffff888105196600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

    Fixes: 8fd0e2a6df26 ("uio: free uio id after uio file node is freed")
    Cc: stable
    Signed-off-by: Shin'ichiro Kawasaki
    Link: https://lore.kernel.org/r/20201102122819.2346270-1-shinichiro.kawasaki@wdc.com
    Signed-off-by: Greg Kroah-Hartman

    Shin'ichiro Kawasaki
     
  • The definitions for (devm_)uio_register_device should be
    at the header file, as the macros are there. The ones
    inside uio.c refer, instead, to __(devm_)uio_register_device.

    Update them and add new kernel-doc markups for the macros.

    Signed-off-by: Mauro Carvalho Chehab
    Link: https://lore.kernel.org/r/82ab7b68d271aeda7396e369ff8a629491b9d628.1603469755.git.mchehab+huawei@kernel.org
    Signed-off-by: Greg Kroah-Hartman

    Mauro Carvalho Chehab
     

18 Sep, 2020

1 commit


10 Jul, 2020

1 commit


03 Jul, 2020

4 commits

  • uio_pdrv_genirq and uio_dmem_genirq interrupts are handled in
    userspace. So the condition for the interrupt hasn't normally not been
    cleared when top half returns. disable_irq_nosync is called in top half,
    but since that normally is lazy the irq isn't actually disabled.

    For level triggered interrupts this will always result in a spurious
    additional fire since the level in to the interrupt controller still is
    active. The actual interrupt handler isn't run though since this
    spurious irq is just recorded, and later on discared (for level).

    This commit disables lazy masking for level triggered interrupts. It
    leaves edge triggered interrupts as before, because they work with the
    lazy scheme.

    All other UIO drivers already seem to clear the interrupt cause at
    driver levels.

    Example of double fire. First goes all the way up to
    uio_pdrv_genirq_handler, second is terminated in handle_fasteoi_irq and
    marked as pending.

    -0 [000] d... 8.245870: gic_handle_irq: irq 29
    -0 [000] d.h. 8.245873: uio_pdrv_genirq_handler: disable irq 29
    -0 [000] d... 8.245878: gic_handle_irq: irq 29
    -0 [000] d.h. 8.245880: handle_fasteoi_irq: irq 29 PENDING
    HInt-34 [001] d... 8.245897: uio_pdrv_genirq_irqcontrol: enable irq 29

    Tested on 5.7rc2 using uio_pdrv_genirq and a custom Xilinx MPSoC board.

    Signed-off-by: Thommy Jakobsson
    Link: https://lore.kernel.org/r/20200628141229.16121-1-thommyj@gmail.com
    Signed-off-by: Greg Kroah-Hartman

    Thommy Jakobsson
     
  • Similar to the changes made in 270579d95f82 ("uio_mf624: Align memory
    regions to page size and set correct offsets"), this will allow
    uio_pdrv_genirq devices to expose memory regions that is not page-aligned,
    requiring the users to respect the offset sysfs attribute (as implemented
    in libuio).

    Signed-off-by: Esben Haabendal
    Link: https://lore.kernel.org/r/20200701145659.3978-4-esben@geanix.com
    Signed-off-by: Greg Kroah-Hartman

    Esben Haabendal
     
  • While e3a3c3a20555 ("UIO: fix uio_pdrv_genirq with device tree but no
    interrupt") added support for using uio_pdrv_genirq for devices without
    interrupt for device tree platforms, the removal of uio_pdrv in
    26dac3c49d56 ("uio: Remove uio_pdrv and use uio_pdrv_genirq instead")
    broke the support for non device tree platforms.

    This change fixes this, so that uio_pdrv_genirq can be used without
    interrupt on all platforms.

    This still leaves the support that uio_pdrv had for custom interrupt
    handler lacking, as uio_pdrv_genirq does not handle it (yet).

    Fixes: 26dac3c49d56 ("uio: Remove uio_pdrv and use uio_pdrv_genirq instead")
    Signed-off-by: Esben Haabendal
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/r/20200701145659.3978-3-esben@geanix.com
    Signed-off-by: Greg Kroah-Hartman

    Esben Haabendal
     
  • Since e3a3c3a20555 ("UIO: fix uio_pdrv_genirq with device tree but no
    interrupt"), the uio_pdrv_genirq has supported use without interrupt,
    so the change in 7723f4c5ecdb ("driver core: platform: Add an error
    message to") added false warnings for those cases.

    Fixes: 7723f4c5ecdb ("driver core: platform: Add an error message to platform_get_irq*()")
    Signed-off-by: Esben Haabendal
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/r/20200701145659.3978-2-esben@geanix.com
    Signed-off-by: Greg Kroah-Hartman

    Esben Haabendal
     

15 May, 2020

1 commit

  • This driver calls sysfs_create_bin_file() in probe, but forgets to
    call sysfs_remove_bin_file() in remove.
    Add the missed call to fix it.

    Signed-off-by: Chuhong Yuan
    Link: https://lore.kernel.org/r/20200507151343.792816-1-hslester96@gmail.com
    Signed-off-by: Greg Kroah-Hartman

    Chuhong Yuan
     

28 Apr, 2020

2 commits


18 Mar, 2020

2 commits

  • This change makes use of the new devm_uio_register_device() initializer.
    This cleans up the exit path quite nicely, and removes the remove function
    of the driver.

    Signed-off-by: Alexandru Ardelean
    Link: https://lore.kernel.org/r/20200306161853.25368-2-alexandru.ardelean@analog.com
    Signed-off-by: Greg Kroah-Hartman

    Alexandru Ardelean
     
  • This change adds a resource managed equivalent of uio_register_device().
    Not adding devm_uio_unregister_device(), since the intent is to discourage
    it's usage. Having such a function may allow some bad driver designs. Most
    users of devm_*register*() functions rarely use the unregister equivalents.

    Signed-off-by: Alexandru Ardelean
    Link: https://lore.kernel.org/r/20200306161853.25368-1-alexandru.ardelean@analog.com
    Signed-off-by: Greg Kroah-Hartman

    Alexandru Ardelean
     

14 Jan, 2020

2 commits

  • When deferring the probe routine just return without displaying an
    error.

    Signed-off-by: Oscar Ravadilla
    Link: https://lore.kernel.org/r/20200108001648.2949-1-oscar.ravadilla@alliedtelesis.co.nz
    Signed-off-by: Greg Kroah-Hartman

    Oscar Ravadilla
     
  • The driver may sleep while holding a spinlock.
    The function call path (from bottom to top) in Linux 4.19 is:

    kernel/irq/manage.c, 523:
    synchronize_irq in disable_irq
    drivers/uio/uio_dmem_genirq.c, 140:
    disable_irq in uio_dmem_genirq_irqcontrol
    drivers/uio/uio_dmem_genirq.c, 134:
    _raw_spin_lock_irqsave in uio_dmem_genirq_irqcontrol

    synchronize_irq() can sleep at runtime.

    To fix this bug, disable_irq() is called without holding the spinlock.

    This bug is found by a static analysis tool STCheck written by myself.

    Signed-off-by: Jia-Ju Bai
    Link: https://lore.kernel.org/r/20191218094405.6009-1-baijiaju1990@gmail.com
    Signed-off-by: Greg Kroah-Hartman

    Jia-Ju Bai