The driver is using endpoint-sized buffers but must not assume that the
tx and rx buffers are of equal size or a malicious device could overflow
the slab-allocated receive buffer when doing bulk transfers.
Fixes: 985cafccbf ("Staging: Comedi: vmk80xx: Add k8061 support")
Cc: stable@vger.kernel.org # 2.6.31
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20211025114532.4599-5-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The driver uses endpoint-sized USB transfer buffers but up until
recently had no sanity checks on the sizes.
Commit e1f13c879a ("staging: comedi: check validity of wMaxPacketSize
of usb endpoints found") inadvertently fixed NULL-pointer dereferences
when accessing the transfer buffers in case a malicious device has a
zero wMaxPacketSize.
Make sure to allocate buffers large enough to handle also the other
accesses that are done without a size check (e.g. byte 18 in
vmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond
the buffers, for example, when doing descriptor fuzzing.
The original driver was for a low-speed device with 8-byte buffers.
Support was later added for a device that uses bulk transfers and is
presumably a full-speed device with a maximum 64-byte wMaxPacketSize.
Fixes: 985cafccbf ("Staging: Comedi: vmk80xx: Add k8061 support")
Cc: stable@vger.kernel.org # 2.6.31
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20211025114532.4599-4-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
In order to better track where in the kernel the dma-buf code is used,
put the symbols in the namespace DMA_BUF and modify all users of the
symbols to properly import the namespace to not break the build at the
same time.
Now the output of modinfo shows the use of these symbols, making it
easier to watch for users over time:
$ modinfo drivers/misc/fastrpc.ko | grep import
import_ns: DMA_BUF
Cc: "Pan, Xinhui" <Xinhui.Pan@amd.com>
Cc: David Airlie <airlied@linux.ie>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: dri-devel@lists.freedesktop.org
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Acked-by: Christian König <christian.koenig@amd.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Sumit Semwal <sumit.semwal@linaro.org>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Link: https://lore.kernel.org/r/20211010124628.17691-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Introduce REPORT_STACK_CANARY to check for differing stack canaries
between two processes (i.e. that an architecture is correctly implementing
per-task stack canaries), using the task_struct canary as the hint to
locate in the stack. Requires that one of the processes being tested
not be pid 1.
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20211022223826.330653-3-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Some LKDTM tests need to be run more than once (usually to setup and
then later trigger). Until now, the only case was the SOFT_LOCKUP test,
which wasn't useful to run in the bulk selftests. The coming stack canary
checking needs to run twice, so support this with a new test output prefix
"repeat".
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20211022223826.330653-2-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
- Update on sysfs wildcard documentation
- debugfs update for core and qcom driver
- invalid slave pointer fix for bus
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmF1Zm8ACgkQfBQHDyUj
g0f2IBAAsmbNL3AUns2/udNxC6QsZ6KjA3CrFYm6bXZQnRfFgZKtXxUFA2brYoXA
/G2qHU0ktZ5XnnSnYCVvapDL7aXraNeTiKpWiXRESm47FXnUPQS9iptmIyv7CzxS
CLA1zF7WRrdNREyQLzwUeAoubb039El5rMG3cIaFaHkqhYs28EZUQfluldrLfjsN
bgtLSWeLQ0yDuECsNYjeWo154DmW8NpbbmzOLDvyT6MJp8BoWVKeBr5ejczBQj0Y
eDXy8f15OY/bbZ5C3BE4swyPTziJNjLRZQtmcQ/zmzUzpbpqmtbq+SzRtFxRUVKi
XTAyFwJm6kghUyKVK/Q1M6F1PcHrsfIQS4IYh+dCfrn/sJVnS0apsmk1duzFsG0h
92A64+c6qfZA6ZNlOCxKs/yngHbIuzGj2f7Q13geE+A8Pn46HfsV/bBGqPDsSRE5
tZXpgsfDWB3eK6wzT5euYvOmInE0qxnUbiDiW2t7s4Hh00Ovsgd3T5Ltdgad7Ln0
6/rG89na9By9pJqeDfoMk/Mf+Tc3uE+9KPhA5vOqputf1u5QuZkikFNdoisuotP8
vFKIZD3kawKK4UjMOxzDVw0eTkX3Mb1yGVzI3JPu7Po0uao+YUUaiOltzou/UXAD
6wpVW2hXqtqAmLKwS0HL1X94cw77ZcwBwtfwNKBNIDX8KOUaN4k=
=fOih
-----END PGP SIGNATURE-----
Merge tag 'soundwire-5.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire into char-misc-next
Vinod writes:
soundwire updates for 5.16-rc1
- Update on sysfs wildcard documentation
- debugfs update for core and qcom driver
- invalid slave pointer fix for bus
* tag 'soundwire-5.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:
soundwire: qcom: add debugfs entry for soundwire register dump
soundwire: bus: stop dereferencing invalid slave pointer
ABI: sysfs-bus-soundwire-slave: use wildcards on What definitions
ABI: sysfs-bus-soundwire-master: use wildcards on What definitions
soundwire: debugfs: use controller id and link_id for debugfs
Clang warns:
drivers/iio/frequency/adrf6780.c:117:1: error: all paths through this
function will call itself [-Werror,-Winfinite-recursion]
{
^
drivers/iio/frequency/adrf6780.c:138:1: error: all paths through this
function will call itself [-Werror,-Winfinite-recursion]
{
^
2 errors generated.
The underscore variants should be used here.
Link: https://github.com/ClangBuiltLinux/linux/issues/1490
Fixes: 63aaf6d06d ("iio: frequency: adrf6780: add support for ADRF6780")
Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Link: https://lore.kernel.org/r/20211022195656.1513147-1-nathan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
New device support
* adrf6780 microwave upconverter.
- New driver for this interesting device including bindings.
Features
* lite-on ltr501
- Add dt-bindings including vendor ID and of_device_id table.
- Add regulator support.
* sensiron,scd4x
- Add reporting of channel scale.
Cleanups including fixes for things in this cycle
* Tree wide: Another set of dev_err_probe() introductions to reduce
noise in logs when deferred probing is needed and provide more debug
info. Devices included this time:
- amlogic,meson_saradc
- capella,cm3605
- fsl,imx7d
- maxim,max1118
- maxim,max1241
- nxp,lpc18xx
- qcom,pm8xxxx-xoadc
- rockchip,saradc
- sharp,gp2ap002
- sterricson,ab8500
- ti,ads7950
* core - iio:buffer
- Fix a path where a ret value is not intialized.
* channel-mux
- Add support to mux core subsystem for a settling delay and use
it in the iio-channel-mux driver.
- Fix a few dt binding warnings.
* nxp,lpc18xx
- Convert to devm_ functions for all of probe and drop remove()
* st,lsm6dsx
- Suppress a warning due to lack of handling of an enum *_MAX entry
that is just there to get the size.
* st,stm32-adc
- Add generic channel binding, deprecating the old approach.
- Add nvmem support to get calibration data for the vrefint channel and
use it to perform such calibration.
- Add a binding for sample-time to the generic channel description as it
can be per channel.
* ti,adc128s052
- Use devm_ managed functions and drop remove()
* vti,sca3000
- Use sign_extend32() rather than opencoding.
* xilinx,xadc
- Drop irq field from state structure as now just used in probe.
-----BEGIN PGP SIGNATURE-----
iQJFBAABCAAvFiEEbilms4eEBlKRJoGxVIU0mcT0FogFAmFxyHIRHGppYzIzQGtl
cm5lbC5vcmcACgkQVIU0mcT0FojRCBAAgIbn0CdCVo5cmYZNV1cIcc1ReGBbfgHq
HopVcs9XDO4aHfzTLSa8bRhAp+bWCLq+ld/3vQ4tWDAJCXM4wh6VW9GOOMhqtDhr
TWYPC9jlH+/z5PWzySozCJ6CsHjU5Z96q+SbQGSfoQZr1xelCO9J51gbT0hZS3Dr
LntwcWQWCCC3LW0WGj4ApKJnW4exqi30ty09Qwfujpa9X5nO2soawSBApfIlInR8
rUrE0WBaE8/rx8ORwngrj+Tfz5F3WNz77KooFR6oGkXOuMOxSLIWS77nUntEQbUc
SRfHUJTTUbL5uI+8ZWZe7IWZzL/OX6uyicsJwcrLxzhw0Z/+i714fIMVLxAEHWqD
D+JgcKiGYO/aPgl23XDOYb8I010TF9tf0bkbNcxzOBa4xdhixBLeg5PyWOMhwUKt
uaslEGKduoJ4S7olcebZJAt3wEHp8YXn71LSkHt6M+fC7rRtzpfSK/L35ZHTb7PI
JxzWGYaD7ZdIHd4y3f7KOU/B2/aEv+ez6NLC+yb8+Bs15nZ/B17zLDAmcd+THvxi
QOBpm/K12rDfqSGV663UCtIq+elScx0J7bIuZG1JwPIfZAiwzBNrOTLZG0o+b3bD
JIYIoZX+45tCR5i3Lukk27QhJ2hJ/7VVOcSQ3aPcgoMTl6QCTV8Fo2oofAZ1JIMo
yHjv28K4ZyA=
=XWvW
-----END PGP SIGNATURE-----
Merge tag 'iio-for-5.16b' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next
Jonathan writes:
2nd set of IIO new driver, cleanups and features for the 5.16 cycle
New device support
* adrf6780 microwave upconverter.
- New driver for this interesting device including bindings.
Features
* lite-on ltr501
- Add dt-bindings including vendor ID and of_device_id table.
- Add regulator support.
* sensiron,scd4x
- Add reporting of channel scale.
Cleanups including fixes for things in this cycle
* Tree wide: Another set of dev_err_probe() introductions to reduce
noise in logs when deferred probing is needed and provide more debug
info. Devices included this time:
- amlogic,meson_saradc
- capella,cm3605
- fsl,imx7d
- maxim,max1118
- maxim,max1241
- nxp,lpc18xx
- qcom,pm8xxxx-xoadc
- rockchip,saradc
- sharp,gp2ap002
- sterricson,ab8500
- ti,ads7950
* core - iio:buffer
- Fix a path where a ret value is not intialized.
* channel-mux
- Add support to mux core subsystem for a settling delay and use
it in the iio-channel-mux driver.
- Fix a few dt binding warnings.
* nxp,lpc18xx
- Convert to devm_ functions for all of probe and drop remove()
* st,lsm6dsx
- Suppress a warning due to lack of handling of an enum *_MAX entry
that is just there to get the size.
* st,stm32-adc
- Add generic channel binding, deprecating the old approach.
- Add nvmem support to get calibration data for the vrefint channel and
use it to perform such calibration.
- Add a binding for sample-time to the generic channel description as it
can be per channel.
* ti,adc128s052
- Use devm_ managed functions and drop remove()
* vti,sca3000
- Use sign_extend32() rather than opencoding.
* xilinx,xadc
- Drop irq field from state structure as now just used in probe.
* tag 'iio-for-5.16b' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (36 commits)
dt-bindings: iio: frequency: add adrf6780 doc
iio: frequency: adrf6780: add support for ADRF6780
iio: chemical: scd4x: Add a scale for the co2 concentration reading
dt-bindings: iio: io-channel-mux: allow duplicate channel, labels
dt-bindings: iio: io-channel-mux: add optional #io-channel-cells
iio: adc: adc128s052: Simplify adc128_probe()
iio: multiplexer: iio-mux: Support settle-time-us property
dt-bindings: iio: io-channel-mux: Add property for settle time
mux: add support for delay after muxing
iio: adc: stm32-adc: use generic binding for sample-time
iio: adc: stm32-adc: add vrefint calibration support
iio: adc: stm32-adc: add support of internal channels
iio: adc: stm32-adc: add support of generic channels binding
iio: adc: stm32-adc: split channel init into several routines
dt-bindings: iio: stm32-adc: add nvmem support for vrefint internal channel
dt-bindings: iio: stm32-adc: add generic channel binding
iio: accel: sca3000: Use sign_extend32() instead of opencoding sign extension.
iio: xilinx-xadc: Remove `irq` field from state struct
iio: imu: st_lsm6dsx: Avoid potential array overflow in st_lsm6dsx_set_odr()
iio: light: gp2ap002: Make use of the helper function dev_err_probe()
...
As these are very late in the 5.15 cycle and non are particularly urgent,
they can wait for the merge window.
Key element in this set is Yang Yingliang has identified a number of
issues in error paths introduced recently when we added multiple
buffer support.
Other fixes:
* adi,ad5662
- Fix handling of i2c_master_send() return value.
* adi,ad5766
- Fix a wrong dt-property name that indicated wrong units and
did not mach the bindings.
- Associated 'fix' of the bindings example to have a possible scale.
* st,pressure-spi
- Add some missing entries to the spi_device_id table to ensure
auto-loading works.
* ti,tsc2046
- Fix a backwards comparison leading to a false dev_warn
-----BEGIN PGP SIGNATURE-----
iQJFBAABCAAvFiEEbilms4eEBlKRJoGxVIU0mcT0FogFAmFxs7kRHGppYzIzQGtl
cm5lbC5vcmcACgkQVIU0mcT0FojEXhAAn8OoUwEaViRbrVuPJmWCLuhZR8/ke1HE
9WFXYjVvr6+FIyxgOxTVhoVd0LmcqzgeMg0si8CvnXvmx0mYqRyGxSgZ0oSWOfNR
/RhfbL3RKyWmbp5ey3JuJxGS9Py1LXSFycsC7igjrgySqGo05kLrMpGkMr2g3d6a
OKBOaoiBQPEvYmkNlFLOhtWGHNA4mICmi7UWwcfeN667SWKT3VFpBllSQwRpRXtz
h/h0XhJg72x7JdJJsiBAWX9IsbBm9bXjaeXWZldDNnrZRS3VKTXzAkMTI0Wu0Rrq
voEXvh74ys280aXoh5eHzN4OLdGBTJLVRjNaEAUaSMry4oWPpnkkda9pYY8dCcaR
b8kPxn68PnrjbBG5et3PBo+/XAh7C0Ny2ETEqI8qlNk9adqUEl0wixuUUEljEqVE
2rB35SEJYJzl0V0Up2uZMzYhPsfw+kbZoLUPyLfL9uNW3r1l9xgQURTM74UZcSdI
cV2kcGWZdIX6IKVrChhPpeXcsS9ZWljWzUGu4IFBw1h9X6jwhbWJvACj889Rf4EI
+ndjCylpE4aJfoZI7JSg5i41KvEGbwE3SkrKZTMNWe6aPajhcylzeG9+jxsAYaPn
+hnKbPTE99oaopu1Od/s2EUtmIontZQy74aDfbQM3HU8fHmauk8/+L9kDNlkV2b3
ZWbSw6Z2g4g=
=jYCH
-----END PGP SIGNATURE-----
Merge tag 'iio-fixes-for-5.16a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next
Jonathan writes:
First set of IIO fixes for the 5.16 cycle
As these are very late in the 5.15 cycle and non are particularly urgent,
they can wait for the merge window.
Key element in this set is Yang Yingliang has identified a number of
issues in error paths introduced recently when we added multiple
buffer support.
Other fixes:
* adi,ad5662
- Fix handling of i2c_master_send() return value.
* adi,ad5766
- Fix a wrong dt-property name that indicated wrong units and
did not mach the bindings.
- Associated 'fix' of the bindings example to have a possible scale.
* st,pressure-spi
- Add some missing entries to the spi_device_id table to ensure
auto-loading works.
* ti,tsc2046
- Fix a backwards comparison leading to a false dev_warn
* tag 'iio-fixes-for-5.16a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio:
iio: buffer: Fix memory leak in iio_buffers_alloc_sysfs_and_mask()
iio: adc: tsc2046: fix scan interval warning
iio: core: fix double free in iio_device_unregister_sysfs()
iio: core: check return value when calling dev_set_name()
iio: buffer: Fix memory leak in iio_buffer_register_legacy_sysfs_groups()
iio: buffer: Fix double-free in iio_buffers_alloc_sysfs_and_mask()
iio: buffer: Fix memory leak in __iio_buffer_alloc_sysfs_and_mask()
iio: buffer: check return value of kstrdup_const()
iio: dac: ad5446: Fix ad5622_write() return value
Documentation:devicetree:bindings:iio:dac: Fix val
drivers: iio: dac: ad5766: Fix dt property name
iio: st_pressure_spi: Add missing entries SPI to device ID table
coccicheck complains about the use of snprintf() in sysfs show
functions:
WARNING use scnprintf or sprintf
Use sysfs_emit instead of scnprintf or sprintf makes more sense.
Reported-by: Zeal Robot <zealci@zte.com.cn>
Signed-off-by: Ye Guojin <ye.guojin@zte.com.cn>
Link: https://lore.kernel.org/r/20211022090604.1065367-1-ye.guojin@zte.com.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Here are the changes for the 5.16-rc1 merge window consisting of just
driver updates. The highlight is the refactoring of some existing drivers
into common code and expanding some macros that will make adding QoS
support much easier.
Driver changes:
- icc-rpm: move bus clocks handling into qnoc_probe
- sdm660: expand DEFINE_QNODE macros
- sdm660: drop default/unused values
- sdm660: merge common code into icc-rpm
- icc-rpm: add support for QoS reg offset
- msm8916: expand DEFINE_QNODE macros
- msm8916: add support for AP-owned nodes
- msm8939: expand DEFINE_QNODE macros
- msm8939: add support for AP-owned nodes
- qcs404: expand DEFINE_QNODE macros
- qcom: drop DEFINE_QNODE macro
- samsung: describe drivers in KConfig
Signed-off-by: Georgi Djakov <djakov@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQIcBAABAgAGBQJhcnY6AAoJEIDQzArG2BZjp+gP/1QzscwyFF/O1bnIIUq61OuZ
kvD+aZ5TlOD62Xn7Lt3mxyyNvqedhjr3oDfAYQ21/W3K15HXGpE00gkCaozY6ffY
9QPdl4epoUnSQmTGu38SnW3B8m7COTEMmpvcyczJY/Qx7Wuy5WRWFPftw/Gb7PQw
+ciU6lIcU8B/fqrT2u3i7k3uOXlra4zWiUqFSS8OegTiKO22CIbtPOEWwkugK6NV
IVd1zdPGaHuLnElFxjSYHn3wYJvkKws3ur8T8DwnPR1oHo4Q2AAPXdkIVsw5IbR7
r7ZqDkTYrYGV4w7fQuYFozhqBr+5xAbaKiQZMqHLrg03OYkerfGG6inm1aqm+Qsk
DB09/A8KNxwrEG45OBepBA5STxvMzDKzLQqYWgnrUtnm3KVUdGtnlgX9a0/crQZz
lB7eoIBopNlKelkOirRN6MDhben8M9Iqj5ZqGLFAi6q97Ehwmr/GCI2msH0OWw/Z
8WEujyAKNthIL1pHMYxyRexemF4OwWXP88/ay3kRnMj7HiLDNNYfVzt9m9Wjz4xc
T6Quas8E8qO/d23LDj81Kr7mKzXj1/oeY7eL5+hdjluAcNRbctSv2vd7SxDIFJ94
+UT1Ajky3s8BSBOyrWxvXEQN0NOCByAJ8+n9WvP71IZEUUfRUpGXKs1Uce1CRMqK
awGu9zZgCFmqq9k8RABr
=CPWP
-----END PGP SIGNATURE-----
Merge tag 'icc-5.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-next
Georgi writes:
interconnect changes for 5.16
Here are the changes for the 5.16-rc1 merge window consisting of just
driver updates. The highlight is the refactoring of some existing drivers
into common code and expanding some macros that will make adding QoS
support much easier.
Driver changes:
- icc-rpm: move bus clocks handling into qnoc_probe
- sdm660: expand DEFINE_QNODE macros
- sdm660: drop default/unused values
- sdm660: merge common code into icc-rpm
- icc-rpm: add support for QoS reg offset
- msm8916: expand DEFINE_QNODE macros
- msm8916: add support for AP-owned nodes
- msm8939: expand DEFINE_QNODE macros
- msm8939: add support for AP-owned nodes
- qcs404: expand DEFINE_QNODE macros
- qcom: drop DEFINE_QNODE macro
- samsung: describe drivers in KConfig
Signed-off-by: Georgi Djakov <djakov@kernel.org>
* tag 'icc-5.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc:
interconnect: samsung: describe drivers in KConfig
interconnect: qcom: drop DEFINE_QNODE macro
interconnect: qcs404: expand DEFINE_QNODE macros
interconnect: msm8939: add support for AP-owned nodes
interconnect: msm8939: expand DEFINE_QNODE macros
interconnect: msm8916: add support for AP-owned nodes
interconnect: msm8916: expand DEFINE_QNODE macros
interconnect: icc-rpm: add support for QoS reg offset
interconnect: sdm660: merge common code into icc-rpm
interconnect: sdm660: drop default/unused values
interconnect: sdm660: expand DEFINE_QNODE macros
interconnect: icc-rpm: move bus clocks handling into qnoc_probe
- SBEFIFO usersapce interfaces to perform FFDC (First Failure
Data Capture) and detect timeouts
- A fix to handle multiple messages in flight
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEE+nHMAt9PCBDH63wBa3ZZB4FHcJ4FAmFx+ZIACgkQa3ZZB4FH
cJ7WHhAAn840J0zZS5mUMq7oJC6oWsSwEtKoBqoEwJq0nGGTDY7KX5r5umH1uEdR
SlIjZ8WoNgZVpZEXXOXZyKWU8yzEckVjEYMWNWZGuabuAXMzTDyB/J376vn9IYQO
ZkGYbu4B9CZssn0sDC671R/FHfPFk7L5jJ0sJgi5I3nDOApw+uvcGqw9r0AWmUfp
7BHNLZvvUNO/Z3yqF+YaeDhOIXHRbN0kq7fwi+lp4s5UUhPZDmNrrbVu+6HqJe9E
ghUST309zWUdtBToyzxkRb2U8rK8QDtkZppRPf+e/64RP8Fz1yNDPHG6HQX7cyYS
1VyMbA5AzzbUE2XORmfbPGrJ9WmQSX8JOJX1bxq/eu15VJAeDVYuMVHm0ekNhi3u
gwBvPXeyCwMCn0rQBGxbqoM9bHHj07vJ1FVaSWpWYjbTWo343itjVi54nYxgQxIA
12TW8xRI1H7IHkgKtaCvrINxHgyXinfZuWrNXVKHsiT02Y+F08eXp0xotaMg0bmj
nhvTw4wRZa0rHIFNFqj/yEKpIaaoDuPo1ZxT81NOAK4kxgzuFB/z2IsUXf+xJI4r
2UAWyryth5wFbfu0BBq95onGOI+MgZwpksVNekcS1P2pByox+pKKvUsqXeSBRHnx
DmiSZVME2zRUb+9jZHVfEVHBZBrMVzDn1pb9Fm1OId8cjeFupdA=
=ug/2
-----END PGP SIGNATURE-----
Merge tag 'fsi-for-v5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/joel/fsi into char-misc-next
Joel writes:
FSI changes for v5.16
- SBEFIFO usersapce interfaces to perform FFDC (First Failure
Data Capture) and detect timeouts
- A fix to handle multiple messages in flight
* tag 'fsi-for-v5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/joel/fsi:
fsi: sbefifo: Use interruptible mutex locking
fsi: sbefifo: Add sysfs file indicating a timeout error
docs: ABI: testing: Document the SBEFIFO timeout interface
hwmon: (occ) Provide the SBEFIFO FFDC in binary sysfs
docs: ABI: testing: Document the OCC hwmon FFDC binary interface
fsi: occ: Store the SBEFIFO FFDC in the user response buffer
fsi: occ: Use a large buffer for responses
hwmon: (occ) Remove sequence numbering and checksum calculation
fsi: occ: Force sequence numbering per OCC
Some SBE operations have extremely large responses and can require
several minutes to process the response. During this time, the device
lock must be held. If another process attempts an operation, it will
wait for the mutex for longer than the kernel hung task watchdog
allows. Therefore, use the interruptible function to lock the mutex.
Signed-off-by: Eddie James <eajames@linux.ibm.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/20210803213016.44739-1-eajames@linux.ibm.com
Signed-off-by: Joel Stanley <joel@jms.id.au>
The SBEFIFO timeout error requires special handling in userspace
to do recovery operations. Add a sysfs file to indicate a timeout
error, and notify pollers when a timeout occurs.
This will be used by the openpower-occ-control application.
Signed-off-by: Eddie James <eajames@linux.ibm.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/20211019211749.38059-3-eajames@linux.ibm.com
Signed-off-by: Joel Stanley <joel@jms.id.au>
Save any FFDC provided by the OCC driver, and provide it to userspace
through a binary sysfs entry. Notify userspace pollers when there is an
error too.
Signed-off-by: Eddie James <eajames@linux.ibm.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20211019205307.36946-5-eajames@linux.ibm.com
Signed-off-by: Joel Stanley <joel@jms.id.au>
If the SBEFIFO response indicates an error, store the response in the
user buffer and return an error. Previously, the user had no way of
obtaining the SBEFIFO FFDC.
The user's buffer now contains data in the event of a failure. No change
in the event of a successful transfer.
Signed-off-by: Eddie James <eajames@linux.ibm.com>
Link: https://lore.kernel.org/r/20211019205307.36946-3-eajames@linux.ibm.com
Signed-off-by: Joel Stanley <joel@jms.id.au>
Allocate a large buffer for each OCC to handle response data. This
removes memory allocation during an operation, and also allows for
the maximum amount of SBE FFDC.
Previously for the putsram and attn commands, only 32 words would have
been available, and for getsram, only up to the size of the transfer.
SBE FFDC might be up to 8Kb.
The SBE interface expects data to be specified in units of words (4
bytes), defined as OCC_MAX_RESP_WORDS.
This change allows the full FFDC capture to be implemented, where before
it was not available.
Signed-off-by: Eddie James <eajames@linux.ibm.com>
Link: https://lore.kernel.org/r/20211019205307.36946-2-eajames@linux.ibm.com
Signed-off-by: Joel Stanley <joel@jms.id.au>
Add device tree bindings for the ADRF6780 Upconverter.
Reviewed-by: Rob Herring <robh@kernel.org>
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Link: https://lore.kernel.org/r/20211021113244.56936-2-antoniu.miclaus@analog.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
This patch adds a scale for the co2 concentration reading. The reading is
expressed in percent after applying the scale to the raw value.
Signed-off-by: Roan van Dijk <roan@protonic.nl>
Link: https://lore.kernel.org/r/20211021140018.3051213-1-roan@protonic.nl
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
This is needed since an empty channel label is used to indicate an
unused channel, and there can be more that one of those.
Fixes the following problem reported by dtbs_check:
envelope-detector-mux: channels: ['', '', 'sync-1', 'in', 'out', 'sync-2', 'sys-reg', 'ana-reg'] has non-unique elements
arch/arm/boot/dts/at91-tse850-3.dt.yaml
Suggested-by: Rob Herring <robh@kernel.org>
Signed-off-by: Peter Rosin <peda@axentia.se>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Needed for in-kernel use of the child channels of the mux.
Fixes problems like this, reported by dtbs_check:
adc0mux: '#io-channel-cells' does not match any of the regexes: 'pinctrl-[0-9]+'
arch/arm/boot/dts/aspeed-bmc-ampere-mtjade.dt.yaml
Suggested-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
Signed-off-by: Peter Rosin <peda@axentia.se>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Turn 'adc128_probe()' into a full resource managed function to simplify the
code.
This way, the .remove function can be removed.
Doing so, the only 'spi_get_drvdata()' call is removed and the
corresponding 'spi_set_drvdata()' can be removed as well.
Suggested-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Link: https://lore.kernel.org/r/4fa7fcc59c40e27af0569138d656c698a53dbd44.1630002770.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
If the devicetree specifies that the hardware requires a settle time,
pass this time on to the mux APIs.
Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
Reviewed-by: Lars-Peter Clausen <lars@metafoo.de>
Tested-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Peter Rosin <peda@axentia.se>
Link: https://lore.kernel.org/r/20211007134641.13417-4-vincent.whitchurch@axis.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Hardware may require some time for the muxed analog signals to settle
after the muxing is changed. Allow this time to be specified in the
devicetree.
Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Reviewed-by: Lars-Peter Clausen <lars@metafoo.de>
Tested-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Peter Rosin <peda@axentia.se>
Link: https://lore.kernel.org/r/20211007134641.13417-3-vincent.whitchurch@axis.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Hardware may require some time for the muxed analog signals to settle
after the muxing is changed. Allow users of the mux subsystem to
specify this delay with the new mux_control_select_delay() function (and
the _try equivalent).
Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
Reviewed-by: Lars-Peter Clausen <lars@metafoo.de>
Tested-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Peter Rosin <peda@axentia.se>
Link: https://lore.kernel.org/r/20211007134641.13417-2-vincent.whitchurch@axis.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
A race condition is possible when writing to events_queue_size where the
events kfifo is freed during the execution of a kfifo_in(), resulting in
a use-after-free. This patch prevents such a scenario by protecting the
events queue in operation with a spinlock and locking before performing
the events queue size adjustment.
The existing events_lock mutex is renamed to events_out_lock to reflect
that it only protects events queue out operations. Because the events
queue in operations can occur in an interrupt context, a new
events_in_lock spinlock is introduced and utilized.
Fixes: feff17a550 ("counter: Implement events_queue_size sysfs attribute")
Cc: David Lechner <david@lechnology.com>
Signed-off-by: William Breathitt Gray <vilhelm.gray@gmail.com>
Link: https://lore.kernel.org/r/20211021103540.955639-1-vilhelm.gray@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
With the removal of the chrdev_lock atomic flag, the counter-sysfs.c and
counter-chrdev.c no longer needs to include the atomic.h header file.
Signed-off-by: William Breathitt Gray <vilhelm.gray@gmail.com>
Link: https://lore.kernel.org/r/20211021103514.955622-1-vilhelm.gray@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
When 'iio_dev_opaque->buffer_ioctl_handler' alloc fails in
iio_buffers_alloc_sysfs_and_mask(), the 'attrs' allocated in
iio_buffer_register_legacy_sysfs_groups() will be leaked:
unreferenced object 0xffff888108568d00 (size 128):
comm "88", pid 2014, jiffies 4294963294 (age 26.920s)
hex dump (first 32 bytes):
80 3e da 02 80 88 ff ff 00 3a da 02 80 88 ff ff .>.......:......
00 35 da 02 80 88 ff ff 00 38 da 02 80 88 ff ff .5.......8......
backtrace:
[<0000000095a9e51e>] __kmalloc+0x1a3/0x2f0
[<00000000faa3735e>] iio_buffers_alloc_sysfs_and_mask+0xfa3/0x1480 [industrialio]
[<00000000a46384dc>] __iio_device_register+0x52e/0x1b40 [industrialio]
[<00000000210af05e>] __devm_iio_device_register+0x22/0x80 [industrialio]
[<00000000730d7b41>] adjd_s311_probe+0x195/0x200 [adjd_s311]
[<00000000c0f70eb9>] i2c_device_probe+0xa07/0xbb0
The iio_buffer_register_legacy_sysfs_groups() is
called in __iio_buffer_alloc_sysfs_and_mask(),
so move the iio_buffer_unregister_legacy_sysfs_groups()
into __iio_buffer_free_sysfs_and_mask(), then the memory
will be freed.
Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: d9a625744e ("iio: core: merge buffer/ & scan_elements/ attributes")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20211018063718.1971240-1-yangyingliang@huawei.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Slave pointer is invalid after end of list iteration, using this
would result in below Memory abort.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004
...
Call trace:
__dev_printk+0x34/0x7c
_dev_warn+0x6c/0x90
sdw_bus_exit_clk_stop+0x194/0x1d0
swrm_runtime_resume+0x13c/0x238
pm_generic_runtime_resume+0x2c/0x48
__rpm_callback+0x44/0x150
rpm_callback+0x6c/0x78
rpm_resume+0x314/0x558
rpm_resume+0x378/0x558
rpm_resume+0x378/0x558
__pm_runtime_resume+0x3c/0x88
Use bus->dev instead to print this error message.
Fixes: b50bb8ba36 ("soundwire: bus: handle -ENODATA errors in clock stop/start sequences")
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20211012101521.32087-1-srinivas.kandagatla@linaro.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Add st,min-sample-time-nsecs to channel generic binding.
Sample time can be defined par channel node. If a channel
is configured as differential, the same sample time applies
for both inputs.
Keep support of legacy st,min-sample-time-nsecs property
for backward compatibility.
Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com>
Reviewed-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
Link: https://lore.kernel.org/r/20211014131228.4692-8-olivier.moysan@foss.st.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Add support of vrefint calibration.
If a channel is labeled as vrefint, get vrefint calibration
from non volatile memory for this channel.
vrefint channel is exposed as a processed channel returning
the actual value of vrefp:
vrefp = 3.3 x vrefint_cal / vrefint_data
A conversion on vrefint channel allows to update scale
factor according to vrefint deviation, compared to vrefint
calibration value.
Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com>
Reviewed-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
Link: https://lore.kernel.org/r/20211014131228.4692-7-olivier.moysan@foss.st.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Add support of ADC2 internal channels VDDCORE, VREFINT and VBAT.
The reserved label name "vddcore", "vrefint" and "vbat" must
be used in Device Tree channel node, to enable the corresponding
internal channel.
Note: This patch does not provide support of internal channels
for F4 and H7.
Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com>
Reviewed-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
Link: https://lore.kernel.org/r/20211014131228.4692-6-olivier.moysan@foss.st.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Add support of generic IIO channel binding:
./devicetree/bindings/iio/adc/adc.yaml
Keep support of st,adc-channels and st,adc-diff-channels
for backward compatibility.
Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com>
Reviewed-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
Link: https://lore.kernel.org/r/20211014131228.4692-5-olivier.moysan@foss.st.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Split stm32_adc_chan_of_init channel initialization function into
several routines to increase readability and prepare channel
generic binding handling.
Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com>
Reviewed-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
Link: https://lore.kernel.org/r/20211014131228.4692-4-olivier.moysan@foss.st.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Add support of nvmem. This allows to retrieve calibration data from OTP
for vrefint internal channel.
Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com>
Reviewed-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
Acked-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/20211014131228.4692-3-olivier.moysan@foss.st.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Add ADC generic channel binding. This binding should
be used as an alternate to legacy channel properties
whenever possible.
ADC generic channel binding allows to identify supported
internal channels through the following reserved label names:
"vddcore", "vrefint" and "vbat".
This binding also allows to set a different sampling time
for each channel.
Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com>
Reviewed-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/20211014131228.4692-2-olivier.moysan@foss.st.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Whilst nice to get rid of this non obvious code, this also clears a
static checker warning:
drivers/iio/accel/sca3000.c:734 sca3000_read_raw()
warn: no-op. '((*val) << 19) >> 19'
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Lars-Peter Clausen <lars@metafoo.de>
Link: https://lore.kernel.org/r/20211017160303.72441-1-jic23@kernel.org
Since commit 2a9685d1a3 ("iio: adc: xilinx: use more devres helpers and
remove remove()") the `irq` field from XADC driver state struct is only
used in the `probe()` function.
Use the local `irq` variable throughout the `probe()` function and remove
the now unused field from the state struct.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Link: https://lore.kernel.org/r/20211017121551.24063-1-lars@metafoo.de
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
The length of hw->settings->odr_table is 2 and ref_sensor->id is an enum
variable whose value is between 0 and 5.
However, the value ST_LSM6DSX_ID_MAX (i.e. 5) is not caught properly in
switch (sensor->id) {
If ref_sensor->id is ST_LSM6DSX_ID_MAX, an array overflow will ocurrs in
function st_lsm6dsx_check_odr():
odr_table = &sensor->hw->settings->odr_table[sensor->id];
and in function st_lsm6dsx_set_odr():
reg = &hw->settings->odr_table[ref_sensor->id].reg;
To avoid this array overflow, handle ST_LSM6DSX_ID_GYRO explicitly and
return -EINVAL for the default case.
The enum value ST_LSM6DSX_ID_MAX is only present as an easy way to check
the limit and as such is never used, however this is not locally obvious.
Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Teng Qi <starmiku1207184332@gmail.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/r/20211011114003.976221-1-starmiku1207184332@gmail.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
When possible use dev_err_probe help to properly deal with the
PROBE_DEFER error, the benefit is that DEFER issue will be logged
in the devices_deferred debugfs file.
Using dev_err_probe() can reduce code size, and the error value
gets printed.
Signed-off-by: Cai Huoqing <caihuoqing@baidu.com>
Link: https://lore.kernel.org/r/20211008092656.421-3-caihuoqing@baidu.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
When possible use dev_err_probe help to properly deal with the
PROBE_DEFER error, the benefit is that DEFER issue will be logged
in the devices_deferred debugfs file.
Using dev_err_probe() can reduce code size, and the error value
gets printed.
Signed-off-by: Cai Huoqing <caihuoqing@baidu.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20211008092656.421-1-caihuoqing@baidu.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
When possible use dev_err_probe help to properly deal with the
PROBE_DEFER error, the benefit is that DEFER issue will be logged
in the devices_deferred debugfs file.
Using dev_err_probe() can reduce code size, and the error value
gets printed.
Signed-off-by: Cai Huoqing <caihuoqing@baidu.com>
Link: https://lore.kernel.org/r/20211008092858.495-9-caihuoqing@baidu.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
When possible use dev_err_probe help to properly deal with the
PROBE_DEFER error, the benefit is that DEFER issue will be logged
in the devices_deferred debugfs file.
Using dev_err_probe() can reduce code size, and the error value
gets printed.
Signed-off-by: Cai Huoqing <caihuoqing@baidu.com>
Link: https://lore.kernel.org/r/20211008092858.495-8-caihuoqing@baidu.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
When possible use dev_err_probe help to properly deal with the
PROBE_DEFER error, the benefit is that DEFER issue will be logged
in the devices_deferred debugfs file.
Using dev_err_probe() can reduce code size, and the error value
gets printed.
BTW, change the return value from 'ENXIO' to 'ENODEV',
perfer ENODEV which means no such device.
Signed-off-by: Cai Huoqing <caihuoqing@baidu.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20211008092858.495-7-caihuoqing@baidu.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
When possible use dev_err_probe help to properly deal with the
PROBE_DEFER error, the benefit is that DEFER issue will be logged
in the devices_deferred debugfs file.
Using dev_err_probe() can reduce code size, and the error value
gets printed.
Signed-off-by: Cai Huoqing <caihuoqing@baidu.com>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Tested-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> #Meson8b Odroid-C1
Link: https://lore.kernel.org/r/20211008092858.495-6-caihuoqing@baidu.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
When possible use dev_err_probe help to properly deal with the
PROBE_DEFER error, the benefit is that DEFER issue will be logged
in the devices_deferred debugfs file.
Using dev_err_probe() can reduce code size, and the error value
gets printed.
Signed-off-by: Cai Huoqing <caihuoqing@baidu.com>
Link: https://lore.kernel.org/r/20211008092858.495-5-caihuoqing@baidu.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
