Commit Graph

935302 Commits

Author SHA1 Message Date
Pawel Laszczak
03cce68a82 usb: cdns3: drd: return IRQ_NONE explicitly.
IRQ_NONE can be returned indirect.

Reviewed-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Pawel Laszczak <pawell@cadence.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-07-24 16:45:12 +03:00
Pawel Laszczak
ecf4f823fb usb: cnds3: drd: deleted !=
Patch deletes unnecessary != from condition statement in cdns3_drd_init
function.

Reviewed-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Pawel Laszczak <pawell@cadence.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-07-24 16:45:12 +03:00
Pawel Laszczak
27afe16612 usb: cdns3: drd: removed not needed variables initialization
Patch remove some variables initialization from core.c and drd.c
file.

Reviewed-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Pawel Laszczak <pawell@cadence.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-07-24 16:45:12 +03:00
Pawel Laszczak
b20aecff99 usb: cdns3: core: removed cdns3_get_current_role_driver function
Function is not used in driver so it can be removed.

Signed-off-by: Pawel Laszczak <pawell@cadence.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-07-24 16:45:12 +03:00
Peter Chen
95f5acfc4f usb: cdns3: gadget: always zeroed TRB buffer when enable endpoint
During the endpoint dequeue operation, it changes dequeued TRB as link
TRB, when the endpoint is disabled and re-enabled, the DMA fetches the
TRB before the link TRB, after it handles current TRB, the DMA pointer
will advance to the TRB after link TRB, but enqueue and dequene
variables don't know it due to no hardware interrupt at the time, when
the next TRB is added to link TRB position, the DMA will not handle
this TRB due to its pointer is already at the next TRB. See the trace
log like below:

file-storage-675   [001] d..1    86.585657: usb_ep_queue: ep0: req 00000000df9b3a4f length 0/0 sgs 0/0 stream 0 zsI status 0 --> 0
file-storage-675   [001] d..1    86.585663: cdns3_ep_queue: ep1out: req: 000000002ebce364, req buff 00000000f5bc96b4, length: 0/1024 zsi, status: -115, trb: [start:0, end:0: virt addr (null)], flags:0 SID: 0
file-storage-675   [001] d..1    86.585671: cdns3_prepare_trb: ep1out: trb 000000007f770303, dma buf: 0xbd195800, size: 1024, burst: 128 ctrl: 0x00000425 (C=1, T=0, ISP, IOC, Normal) SID:0 LAST_SID:0
file-storage-675   [001] d..1    86.585676: cdns3_ring:
            Ring contents for ep1out:
            Ring deq index: 0, trb: 000000007f770303 (virt), 0xc4003000 (dma)
            Ring enq index: 1, trb: 0000000049c1ba21 (virt), 0xc400300c (dma)
            free trbs: 38, CCS=1, PCS=1
            @0x00000000c4003000 bd195800 80020400 00000425
            @0x00000000c400300c c4003018 80020400 00001811
            @0x00000000c4003018 bcfcc000 0000001f 00000426
            @0x00000000c4003024 bcfce800 0000001f 00000426

	    ...

 irq/144-5b13000-698   [000] d...    87.619286: usb_gadget_giveback_request: ep1in: req 0000000031b832eb length 13/13 sgs 0/0 stream 0 zsI status 0 --> 0
    file-storage-675   [001] d..1    87.619287: cdns3_ep_queue: ep1out: req: 000000002ebce364, req buff 00000000f5bc96b4, length: 0/1024 zsi, status: -115, trb: [start:0, end:0: virt addr 0x80020400c400300c], flags:0 SID: 0
    file-storage-675   [001] d..1    87.619294: cdns3_prepare_trb: ep1out: trb 0000000049c1ba21, dma buf: 0xbd198000, size: 1024, burst: 128 ctrl: 0x00000425 (C=1, T=0, ISP, IOC, Normal) SID:0 LAST_SID:0
    file-storage-675   [001] d..1    87.619297: cdns3_ring:
                Ring contents for ep1out:
                Ring deq index: 1, trb: 0000000049c1ba21 (virt), 0xc400300c (dma)
                Ring enq index: 2, trb: 0000000059b34b67 (virt), 0xc4003018 (dma)
                free trbs: 38, CCS=1, PCS=1
                @0x00000000c4003000 bd195800 0000001f 00000427
                @0x00000000c400300c bd198000 80020400 00000425
                @0x00000000c4003018 bcfcc000 0000001f 00000426
                @0x00000000c4003024 bcfce800 0000001f 00000426
		...

    file-storage-675   [001] d..1    87.619305: cdns3_doorbell_epx: ep1out, ep_trbaddr c4003018
    file-storage-675   [001] ....    87.619308: usb_ep_queue: ep1out: req 000000002ebce364 length 0/1024 sgs 0/0 stream 0 zsI status -115 --> 0
 irq/144-5b13000-698   [000] d..1    87.619315: cdns3_epx_irq: IRQ for ep1out: 01000c80 TRBERR , ep_traddr: c4003018 ep_last_sid: 00000000 use_streams: 0
 irq/144-5b13000-698   [000] d..1    87.619395: cdns3_usb_irq: IRQ 00000008 = Hot Reset

Fixes: f616c3bda4 ("usb: cdns3: Fix dequeue implementation")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-07-24 16:45:12 +03:00
Peter Chen
33c4b00b85 usb: cdns3: ep0: delete the unnecessary operation
It doesn't need to enable/disable L1 on the fly for EP0 transfer,
we only need to enable L1 after SET_CONFIGURATION.

This code may be introduced by careless.

Cc: Pawel Laszczak <pawell@cadence.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-07-24 16:45:12 +03:00
Evgeny Novikov
ae90cc8237 usb: gadget: net2272: skip BAR1 on error handling paths in probe
net2272_rdk1_probe() skips "i == 1" (BAR1) during allocation of
resources. The patch does this on error hanling paths as well.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-07-24 16:45:12 +03:00
Chunfeng Yun
75ae051efc usb: gadget: bdc: use readl_poll_timeout() to simplify code
Use readl_poll_timeout() to poll register status

Cc: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-07-24 16:45:12 +03:00
Marek Szyprowski
33a06f1300 usb: dwc2: Fix error path in gadget registration
When gadget registration fails, one should not call usb_del_gadget_udc().
Ensure this by setting gadget->udc to NULL. Also in case of a failure
there is no need to disable low-level hardware, so return immiedetly
instead of jumping to error_init label.

This fixes the following kernel NULL ptr dereference on gadget failure
(can be easily triggered with g_mass_storage without any module
parameters):

dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter besl=1
dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter g_np_tx_fifo_size=1024
dwc2 12480000.hsotg: EPs: 16, dedicated fifos, 7808 entries in SPRAM
Mass Storage Function, version: 2009/09/11
LUN: removable file: (no medium)
no file given for LUN0
g_mass_storage 12480000.hsotg: failed to start g_mass_storage: -22
8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000104
pgd = (ptrval)
[00000104] *pgd=00000000
Internal error: Oops: 805 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.8.0-rc5 #3133
Hardware name: Samsung Exynos (Flattened Device Tree)
Workqueue: events deferred_probe_work_func
PC is at usb_del_gadget_udc+0x38/0xc4
LR is at __mutex_lock+0x31c/0xb18
...
Process kworker/0:1 (pid: 12, stack limit = 0x(ptrval))
Stack: (0xef121db0 to 0xef122000)
...
[<c076bf3c>] (usb_del_gadget_udc) from [<c0726bec>] (dwc2_hsotg_remove+0x10/0x20)
[<c0726bec>] (dwc2_hsotg_remove) from [<c0711208>] (dwc2_driver_probe+0x57c/0x69c)
[<c0711208>] (dwc2_driver_probe) from [<c06247c0>] (platform_drv_probe+0x6c/0xa4)
[<c06247c0>] (platform_drv_probe) from [<c0621df4>] (really_probe+0x200/0x48c)
[<c0621df4>] (really_probe) from [<c06221e8>] (driver_probe_device+0x78/0x1fc)
[<c06221e8>] (driver_probe_device) from [<c061fcd4>] (bus_for_each_drv+0x74/0xb8)
[<c061fcd4>] (bus_for_each_drv) from [<c0621b54>] (__device_attach+0xd4/0x16c)
[<c0621b54>] (__device_attach) from [<c0620c98>] (bus_probe_device+0x88/0x90)
[<c0620c98>] (bus_probe_device) from [<c06211b0>] (deferred_probe_work_func+0x3c/0xd0)
[<c06211b0>] (deferred_probe_work_func) from [<c0149280>] (process_one_work+0x234/0x7dc)
[<c0149280>] (process_one_work) from [<c014986c>] (worker_thread+0x44/0x51c)
[<c014986c>] (worker_thread) from [<c0150b1c>] (kthread+0x158/0x1a0)
[<c0150b1c>] (kthread) from [<c0100114>] (ret_from_fork+0x14/0x20)
Exception stack(0xef121fb0 to 0xef121ff8)
...
---[ end trace 9724c2fc7cc9c982 ]---

While fixing this also fix the double call to dwc2_lowlevel_hw_disable()
if dr_mode is set to USB_DR_MODE_PERIPHERAL. In such case low-level
hardware is already disabled before calling usb_add_gadget_udc(). That
function correctly preserves low-level hardware state, there is no need
for the second unconditional dwc2_lowlevel_hw_disable() call.

Fixes: 207324a321 ("usb: dwc2: Postponed gadget registration to the udc class driver")
Acked-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-07-24 16:45:12 +03:00
Michał Mirosław
abac8a85c8 usb: gadget: udc: atmel: implement .pullup callback
Implement udc->pullup callback, so that udc_connect/disconnect work.
This is needed for composite gadget, as it assumes udc_disconnect()
actually works and calls its ->disconnect callback.

Acked-by: Cristian Birsan <cristian.birsan@microchip.com>
Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-07-24 16:45:12 +03:00
Marek Szyprowski
37d9453b05 usb: gadget: udc: Flush pending work also in error path
When binding an UDC driver to the pending gadget fails in
check_pending_gadget_drivers(), the usb_add_gadget_udc_release() function
ends without waiting for the usb_gadget_state_work to finish, what in
turn might cause the whole struct usb_gadget being freed by the caller
before the usb_gadget_state_work being executed.

This can be observed on some boards with USB Mass Storage gadget
compiled-in and kernel booted without the needed module parameters:

dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter besl=1
dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter g_np_tx_fifo_size=1024
dwc2 12480000.hsotg: EPs: 16, dedicated fifos, 7808 entries in SPRAM
Mass Storage Function, version: 2009/09/11
LUN: removable file: (no medium)
no file given for LUN0
g_mass_storage 12480000.hsotg: failed to start g_mass_storage: -22
dwc2: probe of 12480000.hsotg failed with error -22
8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000004
pgd = (ptrval)
[00000004] *pgd=00000000
Internal error: Oops: 5 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 1 PID: 88 Comm: kworker/1:2 Not tainted 5.8.0-rc5-next-20200715-00062-gc5bb489ae825-dirty #8792
Hardware name: Samsung Exynos (Flattened Device Tree)
Workqueue:  0x0 (rcu_gp)
PC is at process_one_work+0x44/0x7dc
...
Process kworker/1:2 (pid: 88, stack limit = 0x(ptrval))
Stack: (0xed9f1f00 to 0xed9f2000)
...
[<c0148590>] (process_one_work) from [<c0148d6c>] (worker_thread+0x44/0x51c)
[<c0148d6c>] (worker_thread) from [<c01500c0>] (kthread+0x158/0x1a0)
[<c01500c0>] (kthread) from [<c0100114>] (ret_from_fork+0x14/0x20)
Exception stack(0xed9f1fb0 to 0xed9f1ff8)
...
---[ end trace 5033c1326a62e5f3 ]---
note: kworker/1:2[88] exited with preempt_count 1

Fix this by flushing pending work in error path.

Reviewed-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-07-24 16:45:12 +03:00
Peter Chen
f4cfe5ce60 usb: cdns3: gadget: improve the set_configuration handling
- Delete the duplicated EP_CMD_ERDY and EP_CMD_REQ_CMPL setting
- Prepare the next setup before setting EP_CMD_ERDY and EP_CMD_REQ_CMPL,
it could avoid a bug that DMA hang at EP0 OUT for DEV_VER_NXP_V1
- Delete the duplicated cdns3_set_hw_configuration calling at
cdns3_req_ep0_set_configuration, the composite.c will handle
this request, and call .ep0_queue back, and at .ep_queue it will
call cdns3_set_hw_configuration.
- Move cdns3_allow_enable_l1 into cdns3_set_hw_configuration since
it is part of this function.

Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-07-24 16:45:11 +03:00
Dan Robertson
7a410953d1 usb: dwc3: meson-g12a: fix shared reset control use
The reset is a shared reset line, but reset_control_reset is still used
and reset_control_deassert is not guaranteed to have been called before
the first reset_control_assert call. When suspending the following
warning may be seen:

WARNING: CPU: 1 PID: 5530 at drivers/reset/core.c:355 reset_control_assert+0x184/0x19c
Hardware name: Hardkernel ODROID-N2 (DT)
[..]
pc : reset_control_assert+0x184/0x19c
lr : dwc3_meson_g12a_suspend+0x68/0x7c
[..]
Call trace:
 reset_control_assert+0x184/0x19c
 dwc3_meson_g12a_suspend+0x68/0x7c
 platform_pm_suspend+0x28/0x54
 __device_suspend+0x590/0xabc
 dpm_suspend+0x104/0x404
 dpm_suspend_start+0x84/0x1bc
 suspend_devices_and_enter+0xc4/0x4fc
 pm_suspend+0x198/0x2d4

Fixes: 6d9fa35a34 ("usb: dwc3: meson-g12a: get the reset as shared")
Signed-off-by: Dan Robertson <dan@dlrobertson.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-07-24 16:45:11 +03:00
Oleg Nesterov
fe5ed7ab99 uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression
If a tracee is uprobed and it hits int3 inserted by debugger, handle_swbp()
does send_sig(SIGTRAP, current, 0) which means si_code == SI_USER. This used
to work when this code was written, but then GDB started to validate si_code
and now it simply can't use breakpoints if the tracee has an active uprobe:

	# cat test.c
	void unused_func(void)
	{
	}
	int main(void)
	{
		return 0;
	}

	# gcc -g test.c -o test
	# perf probe -x ./test -a unused_func
	# perf record -e probe_test:unused_func gdb ./test -ex run
	GNU gdb (GDB) 10.0.50.20200714-git
	...
	Program received signal SIGTRAP, Trace/breakpoint trap.
	0x00007ffff7ddf909 in dl_main () from /lib64/ld-linux-x86-64.so.2
	(gdb)

The tracee hits the internal breakpoint inserted by GDB to monitor shared
library events but GDB misinterprets this SIGTRAP and reports a signal.

Change handle_swbp() to use force_sig(SIGTRAP), this matches do_int3_user()
and fixes the problem.

This is the minimal fix for -stable, arch/x86/kernel/uprobes.c is equally
wrong; it should use send_sigtrap(TRAP_TRACE) instead of send_sig(SIGTRAP),
but this doesn't confuse GDB and needs another x86-specific patch.

Reported-by: Aaron Merey <amerey@redhat.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200723154420.GA32043@redhat.com
2020-07-24 15:38:37 +02:00
Chris Wilson
062d3f95b6 sched: Warn if garbage is passed to default_wake_function()
Since the default_wake_function() passes its flags onto
try_to_wake_up(), warn if those flags collide with internal values.

Given that the supplied flags are garbage, no repair can be done but at
least alert the user to the damage they are causing.

In the belief that these errors should be picked up during testing, the
warning is only compiled in under CONFIG_SCHED_DEBUG.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Link: https://lore.kernel.org/r/20200723201042.18861-1-chris@chris-wilson.co.uk
2020-07-24 14:40:25 +02:00
Matthew Howell
5fdbe136ae serial: exar: Fix GPIO configuration for Sealevel cards based on XR17V35X
Sealevel XR17V35X based devices are inoperable on kernel versions
4.11 and above due to a change in the GPIO preconfiguration introduced in
commit
7dea8165f1. This patch fixes this by preconfiguring the GPIO on Sealevel
cards to the value (0x00) used prior to commit 7dea8165f1

With GPIOs preconfigured as per commit 7dea8165f1 all ports on
Sealevel XR17V35X based devices become stuck in high impedance
mode, regardless of dip-switch or software configuration. This
causes the device to become effectively unusable. This patch (in
various forms) has been distributed to our customers and no issues
related to it have been reported.

Fixes: 7dea8165f1 ("serial: exar: Preconfigure xr17v35x MPIOs as output")
Signed-off-by: Matthew Howell <matthew.howell@sealevel.com>
Link: https://lore.kernel.org/r/alpine.DEB.2.21.2007221605270.13247@tstest-VirtualBox
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-24 10:58:14 +02:00
David S. Miller
8e8135862c Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
Pablo Neira Ayuso says:

====================
Netfilter/IPVS fixes for net

The following patchset contains Netfilter/IPVS fixes for net:

1) Fix NAT hook deletion when table is dormant, from Florian Westphal.

2) Fix IPVS sync stalls, from guodeqing.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-23 17:22:09 -07:00
Cong Wang
32818c075c geneve: fix an uninitialized value in geneve_changelink()
geneve_nl2info() sets 'df' conditionally, so we have to
initialize it by copying the value from existing geneve
device in geneve_changelink().

Fixes: 56c09de347 ("geneve: allow changing DF behavior after creation")
Reported-by: syzbot+7ebc2e088af5e4c0c9fa@syzkaller.appspotmail.com
Cc: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-23 15:19:58 -07:00
Cong Wang
c75d1d5248 bonding: check return value of register_netdevice() in bond_newlink()
Very similar to commit 544f287b84
("bonding: check error value of register_netdevice() immediately"),
we should immediately check the return value of register_netdevice()
before doing anything else.

Fixes: 005db31d5f ("bonding: set carrier off for devices created through netlink")
Reported-and-tested-by: syzbot+bbc3a11c4da63c1b74d6@syzkaller.appspotmail.com
Cc: Beniamino Galvani <bgalvani@redhat.com>
Cc: Taehee Yoo <ap420073@gmail.com>
Cc: Jay Vosburgh <j.vosburgh@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-23 15:17:04 -07:00
Steve French
0e6705182d Revert "cifs: Fix the target file was deleted when rename failed."
This reverts commit 9ffad9263b.

Upon additional testing with older servers, it was found that
the original commit introduced a regression when using the old SMB1
dialect and rsyncing over an existing file.

The patch will need to be respun to address this, likely including
a larger refactoring of the SMB1 and SMB3 rename code paths to make
it less confusing and also to address some additional rename error
cases that SMB3 may be able to workaround.

Signed-off-by: Steve French <stfrench@microsoft.com>
Reported-by: Patrick Fernie <patrick.fernie@gmail.com>
CC: Stable <stable@vger.kernel.org>
Acked-by: Ronnie Sahlberg <lsahlber@redhat.com>
Acked-by: Pavel Shilovsky <pshilov@microsoft.com>
Acked-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
2020-07-23 15:44:11 -05:00
Linus Torvalds
f37e99aca0 - Change cpum_cf/perf counter name from DFLT_CCERROR to DFLT_CCFINISH
to reflect reality and avoid further confusion. This is a user space
   visible change therefore the commit has also a stable tag for 5.7,
   where this counter was introduced.
 
 - Add Matthew Rosato as s390 IOMMU maintainer.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEECMNfWEw3SLnmiLkZIg7DeRspbsIFAl8Z37QACgkQIg7DeRsp
 bsJh9RAAwKu9/8WoFICzUqVwMnsJNkuMo4VAVHO5hA3CHVJ+0C4mPZt0dgHd9vuo
 RSnegi9PZHMTwUP4lFDos7gpa8OLcJOelVbJ94weVN51+ISJpb83gwLoxSBJk29I
 Wi0vyrS1copQmdkhU4urrBicF58iV7VafdhGhrqVFbPEVfIEndt4Qt/tKcgUOrkx
 Tz1n0GJdMob+60u4+9NEwBGeEHVVHmYvQjTzD+b5T1kRo6PfN2CXpGbv8ab0gYjX
 SHBElpMn16OIUALE4Xmz/QOa2nn2Ji0C39RUmZHaRK7uJgeIZcijYXDdhxvUY2Fu
 AkX/96W9dgfDp9+OolVGV6rV/b1S7Cy0VKDu03t5vUuPWNP6fx3NxAg2q5p50GE8
 OUTRgqO3+slFC0MAJ82fmGmDfJMjP6ulgy6nIOlL9UfUxAzz5JLC8L39G0qXDqI+
 RL7AKpK+DjhWG+Kc565TyE7OiEFamzIve8Gl4mY4v76cEthGDi7eXVe7mUgOTCF1
 /ZcIq/komgvhqhnURFFk71lrLwOLXRQKO88QjNERozlA1+psKMGMO0L1jMsV+Goc
 +xUW+uoixfVWQoUplNJGUrYJl7x+MSe6s3SFBs+nhsjn+mF1RsWU+SXAiHxSe/QP
 F0nS/ZVM02ixal2JS17/DFi8XE/BDIG+YabWryLjM5QDvwNU2vw=
 =9JBZ
 -----END PGP SIGNATURE-----

Merge tag 's390-5.8-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux into master

Pull s390 fixes from Heiko Carstens:

 - Change cpum_cf/perf counter name from DFLT_CCERROR to DFLT_CCFINISH
   to reflect reality and avoid further confusion. This is a user space
   visible change therefore the commit has also a stable tag for 5.7,
   where this counter was introduced.

 - Add Matthew Rosato as s390 IOMMU maintainer.

* tag 's390-5.8-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  MAINTAINERS: add Matthew for s390 IOMMU
  s390/cpum_cf,perf: change DFLT_CCERROR counter name
2020-07-23 13:42:46 -07:00
Douglas Anderson
02b9aec592 i2c: i2c-qcom-geni: Fix DMA transfer race
When I have KASAN enabled on my kernel and I start stressing the
touchscreen my system tends to hang.  The touchscreen is one of the
only things that does a lot of big i2c transfers and ends up hitting
the DMA paths in the geni i2c driver.  It appears that KASAN adds
enough delay in my system to tickle a race condition in the DMA setup
code.

When the system hangs, I found that it was running the geni_i2c_irq()
over and over again.  It had these:

m_stat   = 0x04000080
rx_st    = 0x30000011
dm_tx_st = 0x00000000
dm_rx_st = 0x00000000
dma      = 0x00000001

Notably we're in DMA mode but are getting M_RX_IRQ_EN and
M_RX_FIFO_WATERMARK_EN over and over again.

Putting some traces in geni_i2c_rx_one_msg() showed that when we
failed we were getting to the start of geni_i2c_rx_one_msg() but were
never executing geni_se_rx_dma_prep().

I believe that the problem here is that we are starting the geni
command before we run geni_se_rx_dma_prep().  If a transfer makes it
far enough before we do that then we get into the state I have
observed.  Let's change the order, which seems to work fine.

Although problems were seen on the RX path, code inspection suggests
that the TX should be changed too.  Change it as well.

Fixes: 37692de5d5 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Tested-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Reviewed-by: Akash Asthana <akashast@codeaurora.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Mukesh Kumar Savaliya <msavaliy@codeaurora.org>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
2020-07-23 22:26:44 +02:00
Wolfram Sang
eb01597158 i2c: rcar: always clear ICSAR to avoid side effects
On R-Car Gen2, we get a timeout when reading from the address set in
ICSAR, even though the slave interface is disabled. Clearing it fixes
this situation. Note that Gen3 is not affected.

To reproduce: bind and undbind an I2C slave on some bus, run
'i2cdetect' on that bus.

Fixes: de20d1857d ("i2c: rcar: add slave support")
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
2020-07-23 22:25:18 +02:00
Yuchung Cheng
76be93fc07 tcp: allow at most one TLP probe per flight
Previously TLP may send multiple probes of new data in one
flight. This happens when the sender is cwnd limited. After the
initial TLP containing new data is sent, the sender receives another
ACK that acks partial inflight.  It may re-arm another TLP timer
to send more, if no further ACK returns before the next TLP timeout
(PTO) expires. The sender may send in theory a large amount of TLP
until send queue is depleted. This only happens if the sender sees
such irregular uncommon ACK pattern. But it is generally undesirable
behavior during congestion especially.

The original TLP design restrict only one TLP probe per inflight as
published in "Reducing Web Latency: the Virtue of Gentle Aggression",
SIGCOMM 2013. This patch changes TLP to send at most one probe
per inflight.

Note that if the sender is app-limited, TLP retransmits old data
and did not have this issue.

Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-23 12:23:32 -07:00
Dan Carpenter
17ad73e941 AX.25: Prevent integer overflows in connect and sendmsg
We recently added some bounds checking in ax25_connect() and
ax25_sendmsg() and we so we removed the AX25_MAX_DIGIS checks because
they were no longer required.

Unfortunately, I believe they are required to prevent integer overflows
so I have added them back.

Fixes: 8885bb0621 ("AX.25: Prevent out-of-bounds read in ax25_sendmsg()")
Fixes: 2f2a7ffad5 ("AX.25: Fix out-of-bounds read in ax25_connect()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-23 12:09:57 -07:00
Mikulas Patocka
5df96f2b9f dm integrity: fix integrity recalculation that is improperly skipped
Commit adc0daad36 ("dm: report suspended
device during destroy") broke integrity recalculation.

The problem is dm_suspended() returns true not only during suspend,
but also during resume. So this race condition could occur:
1. dm_integrity_resume calls queue_work(ic->recalc_wq, &ic->recalc_work)
2. integrity_recalc (&ic->recalc_work) preempts the current thread
3. integrity_recalc calls if (unlikely(dm_suspended(ic->ti))) goto unlock_ret;
4. integrity_recalc exits and no recalculating is done.

To fix this race condition, add a function dm_post_suspending that is
only true during the postsuspend phase and use it instead of
dm_suspended().

Signed-off-by: Mikulas Patocka <mpatocka redhat com>
Fixes: adc0daad36 ("dm: report suspended device during destroy")
Cc: stable vger kernel org # v4.18+
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
2020-07-23 14:39:37 -04:00
Pavel Begunkov
3e863ea3bb io_uring: missed req_init_async() for IOSQE_ASYNC
IOSQE_ASYNC branch of io_queue_sqe() is another place where an
unitialised req->work can be accessed (i.e. prior io_req_init_async()).
Nothing really bad though, it just looses IO_WQ_WORK_CONCURRENT flag.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2020-07-23 11:20:55 -06:00
Mathias Nyman
9a360a7cae xhci: dbc: remove tty specific port structure from struct xhci_dbc
Use a void pointer that any function driver can use instead.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-28-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:29 +02:00
Mathias Nyman
688915b11a xhci: dbgcap: remove dbc dependency on dbctty specific flag
dbc should not be aware of, or use any dbctty specific variables.
currenly dbc driver reads the port->registered flag to see if the
callbacks should be called.

Only makes these decisions based on dbc internal state instead.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-27-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:29 +02:00
Mathias Nyman
6ae6470bfa xhci: dbc: Add a operations structure to access driver functions
Don't call dbctty driver functions directly from dbc core code.
Introduce a new dbc_driver structure that contains function pointers
for disconnect and configure operations.

The driver (ttydbc) must provide these opeations when creating a dbc.

Name the structure dbc_driver instead of dbc_ops as we plan to
add more driver configureable values here, such as vid and pid.

Decouples dbc and dbctty.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-26-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:29 +02:00
Mathias Nyman
4521f16139 xhci: dbctty: split dbc tty driver registration and unregistration functions.
Split the dbc tty driver registrations function into separate
init and probe parts.

The init part will register the tty driver, and should in the future be
called from module_init().
The probe part will become the normal probe function, but for now it is
called from the init part.

The unregister function is s likewise split into remove and exit parts.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-25-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:29 +02:00
Mathias Nyman
4ee0e36643 xhci: dbc: remove endpoint pointers from dbc_port structure
dbctty no longer needs references directly to dbc endpoints,
so remove them

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-24-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:28 +02:00
Mathias Nyman
e0aa56dc7b xhci: dbc: simplify dbc requests allocation and queueing
Don't pass endpoint pointer, dbctty should not be aware of
struct dbc_ep, knowing the direction is enough.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-23-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:28 +02:00
Mathias Nyman
11e229a758 xhci: dbc: Pass dbc pointer to dbc start and stop functions.
xhci_dbc_start() and xhci_dbc_stop() functions only used xhci_hcd pointer
to get the dbc pointer.
Pass the dbc pointer instead of the xhci_hcd pointer as a parameter

No functional changes
This change helps decoupling xhci and DbC

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-22-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:28 +02:00
Mathias Nyman
dd98570be1 xhci: dbc: Pass dbc pointer to dbc memory init and cleanup functions
Dbc mem_init and mem_cleanup functions used xhci_hcd to get to the device
pointer. The device pointer can be accessed directly from dbc structure,
so pass a pointer to dbc as a parameter instead.

No functional changes
This change helps decoupling xhci and DbC

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-21-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:28 +02:00
Mathias Nyman
ac286428c6 xhci: dbc: don't use generic xhci ring allocation functions for dbc.
The generic xhci ring allocations code needs struct xhci_hcd pointer, and
it allocates memory for the rings from dma pools created for the xhci
device.

In order to decouple xhci and DbC we have to create our own ring allocation
and free routines for DbC

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-20-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:28 +02:00
Mathias Nyman
cb66434e67 xhci: dbc: Don't use generic xhci context allocation for dbc
The DbC context is different from the xhci device context.
It's a lot smaller as it only contains three 64 bytes sub-contexts;
the info, endpoint-out, and endpoint-in contexts. In total 192 bytes.
The context size (CSZ) field in HCCPARAMS1 xhci register does not alter
DbC context size like it does for xhci device contexts.

So don't use the geneic xhci context memory allocation, or the
dma pool that is intended for xhci device contexts.

In addition to saving memory this also helps decoupleing xhci and dbc code.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-19-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:28 +02:00
Mathias Nyman
f39f3afdf9 xhci: dbc: Use dbc structure in the request completion instead of xhci_hcd
The dbc request completion callback doesn't need a xhci_hcd pointer.
The only user of the xhci_hcd pointer in dbgtty request callback was
the xhci_warn() function. Change it to dev_warn() instead.

While changing the callback function parameter to dbc in struct
xhci_requeset, move the struct xhci_request declaraion down a bit in the
header file to avoid compiler warinings

No functional changes
This change helps decoupling xhci and DbC

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-18-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:28 +02:00
Mathias Nyman
91aaf97471 xhci: dbc: Pass dbc pointer to get_in/out_ep() helper functions to get endpoints
Pass dbc pointer instead of struct xhci_hcd pointer to the get_in_ep() and
get_out_ep() helper functions.

No functional changes
This change helps decoupling xhci and DbC

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-17-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:28 +02:00
Mathias Nyman
b396fa39de xhci: dbgtty: Pass dbc pointer when registering a dbctty device
Pass dbc pointer to the xhci_dbc_tty_register_device() and
xhci_dbc_tty_unregister_device() functions instead of xhci_hcd pointer

These functions don't need a xhci_hcd pointer anymore, only use case was
the xhci_err() function, which is now changed to a dev_err() instead.

No functional changes
This change helps decoupling xhci and DbC

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-16-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:27 +02:00
Mathias Nyman
a1f6376df4 xhci: dbc: Pass dbc pointer to dbc_handle_xfer_event() instead of xhci_hcd pointer
The event handling function only used xhci pointer to get the dbc pointer.
Pass the dbc pointer instead as a parameter

No functional changes
This change helps decoupling xhci and DbC

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-15-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:27 +02:00
Mathias Nyman
903089b7b9 xhci: dbc: Change to pass dbc pointer to xhci_do_dbc_stop()
Pass the dbc pointer instead of xhci_hcd pointer in order to
decouple xhci and dbc.

xhci_do_dbc_stop() only used xhci to get the dbc pointer.
Pass the dbc pointer instead as a parameter

No functional changes
This change helps decoupling xhci and DbC

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-14-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:27 +02:00
Mathias Nyman
d3249fa917 xhci: dbc: Pass dbc pointer to endpoint init and exit functions.
struct xhci_hcd pointer is not needed for dbc endpoint init and exit,
it was only used to get to the dbc structure.
Pass the dbc pointer as a parameter to these functions instead.

No functional changes
This change helps decoupling xhci and DbC

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-13-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:27 +02:00
Mathias Nyman
ed7bffee02 xhci: dbc: Get the device pointer from dbc structure in dbc_ep_do_queue()
dbc_ep_do_queue() can now get the device pointer directly from dbc
structure instead of going through the xhci_hcd structure.

No functional changes
This change helps decoupling xhci and DbC

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-12-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:27 +02:00
Mathias Nyman
1da49a26af xhci: dbc: Don't pass the xhci pointer as a parameter to xhci_dbc_init_context()
xhci_dbc_init_context() no longer needs the struct xhci_hcd pointer.
Pass the dbc pointer directly instead.

No functional changes
This change helps decoupling xhci and DbC

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-11-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:27 +02:00
Mathias Nyman
7cd6312e09 xhci: dbc: Don't use xhci_write_64() as it takes xhci as a parameter
xhci_write_64() is essentially a wrapper for lo_hi_writeq(), but it
requires struct xhci_hcd * as a parameter.
Use lo_hi_writeq() directly instead

No functional changes
This change helps decoupling xhci and DbC

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-10-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:27 +02:00
Mathias Nyman
985247fe4c xhci: dbc: Use dev_info() and similar instead of xhci_info()
To make this change possible we also need to change
dbc_handle_port_status() to take dbc pointer as parameter instead of
xhci_hcd pointer.

Note that xhci_info() used xhci_to_hcd(xhci)->self.controller as the
device while for dev_info we use xhci_to_hcd(xhci)->self.sysdev.

In many cases those are the same, but not for some device where
a dwc3 controller creates a xhci platform device. In th this case
self.controller may be the platform device while self.sysdev is
the actual device known to firmware (dwc3).

This change helps decoupling xhci and DbC

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-9-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:26 +02:00
Mathias Nyman
be33f48093 xhci: dbc: Add device pointer to dbc structure
Currently the dbc structure contains a pointer to struct xhci_hcd,
and dbc functions use that to dig up the underlying device pointer.

We are trying to decouple xhci and dbc code, and prepare for
code that use dbc such as dbctty into into real device drivers.
This is one step along the way.

Keep functionality the same and keep the xhci pointer, and
let the new device pointer point to the xhci device for now.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-8-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:26 +02:00
Mathias Nyman
bcf87ea6e2 xhci: dbc: Remove dbc_dma_free_coherent() wrapper
dbc_dma_free_coherent() takes struct xhci_hcd pointer as a parameter, but
does nothing more than calls dma_free_coherent().
Remove it and call dma_free_coherent() directly instead.

No functional changes
This change helps decoupling xhci and DbC

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-7-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:26 +02:00
Mathias Nyman
c9dd94385d xhci: dbc: Remove dbc_dma_alloc_coherent() wrapper
dbc_dma_alloc_coherent() takes struct xhci_hcd pointer as an parameter, but
does nothing more than calls dma_alloc_coherent().
Remove it and call dma_alloc_coherent() directly instead.

No functional changes
This change helps decoupling xhci and DbC

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200723144530.9992-6-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-23 17:05:26 +02:00