greybus-dev

greybus-dev@lists.linaro.org

25 participants
880 discussions

Re: [PATCH 2/2] mmc: core: Turn mmc_alloc|free_host() into static functions

by Johan Hovold

On Wed, Sep 16, 2026 at 11:36:25AM +0200, Ulf Hansson wrote: > On Wed, Sep 16, 2026 at 9:43 AM Johan Hovold <johan(a)kernel.org> wrote: > > > > On Tue, Sep 15, 2026 at 03:20:46PM +0200, Ulf Hansson wrote: > > > From: Ulf Hansson <ulfh(a)kernel.org> > > > > > > As there are no longer any users of these functions, let's make them > > > internal to the mmc core. > > > > Why would you want to do that? The devres helpers should just be simple > > wrappers around these and sometimes devres just isn't a good fit. > > At the moment there seems to be no need for them. I would rather keep > API/interfaces as simple as possible, so I prefer to remove them at > this point. > > If we see a need for them, we can always add them back. Devres generally only works when all resources are device managed. Therefore you should always provide the underlying non-devres manages interface as well so that you don't force devres on drivers where it could cause trouble. > > Especially with the work cancellations present in mmc_free_host() (which > > I have pointed out elsewhere should not be there), a driver may need to > > free the host before tearing down other non-devres managed resources > > during unbind. > > Can you please point me to such an example so I can try to understand better? We just discussed the renesas driver which can schedule rescan work before registering the host controller. [1] If such a driver also has non-devres managed resources that are freed before the work is cancelled you have a use-after-free. > > This may even be needed for greybus which currently destroys the > > connection before freeing the host. > > I looked closer at gb_sdio_remove() (the greybus sdio driver's > ->remove() callback) and I think the problem isn't about freeing the > host. > > Instead it seems like the call to mmc_remove_host() is done too late. > To me it looks like when the mmc core tries to power off the card > gracefully, through mmc_remove_host() the driver has already moved > into a state where it no longer accepts any requests. Yes, that looks wrong, but that's a separate issue. I only pointed at greybus as an example of a driver which has non-devres managed resources. If there is (rescan) work still scheduled after probe() or remove() returns, there's a potential use-after-free. Johan [1] https://lore.kernel.org/lkml/ap7CaVj82BJZgjf6@hovoldconsulting.com/

5 hours, 2 minutes

[PATCH 0/2] mmc: core: Avoid export of mmc_alloc|free_host()

by Ulf Hansson

From: Ulf Hansson <ulfh(a)kernel.org> The only remaining user of mmc_alloc|free_host() is the greybus sdio driver. Let's convert it into using the resource managed variant so we can drop the export of mmc_alloc|free_host(). Ulf Hansson (2): staging: greybus: sdio: Convert to devm_mmc_alloc_host() mmc: core: Turn mmc_alloc|free_host() into static functions drivers/mmc/core/host.c | 35 +++++++++------------------------- drivers/staging/greybus/sdio.c | 11 +++-------- include/linux/mmc/host.h | 2 -- 3 files changed, 12 insertions(+), 36 deletions(-) -- 2.43.0

7 hours, 19 minutes

[PATCH v2] staging: greybus: remove driver depending on nonexistent config option

by Ethan Nelson-Moore

The Greybus Arche Platform driver depends on the config options USB_HSIC_USB3613 or COMPILE_TEST. USB_HSIC_USB3613 has never existed in mainline Linux, and COMPILE_TEST is intended to enable the compilation of drivers on platforms that can't support them to improve code coverage and ease testing of trivial or tree-wide changes. Therefore, it is impossible for anyone to be using this driver with unmodified mainline kernels. Remove it and move the former maintainer to the CREDITS file. Signed-off-by: Ethan Nelson-Moore <enelsonmoore(a)gmail.com> --- Changes in v2: Clarify commit message - mention COMPILE_TEST CREDITS | 4 + MAINTAINERS | 7 - drivers/staging/greybus/Kconfig | 9 - drivers/staging/greybus/Makefile | 6 - drivers/staging/greybus/arche-apb-ctrl.c | 490 ----------------- drivers/staging/greybus/arche-platform.c | 653 ----------------------- drivers/staging/greybus/arche_platform.h | 28 - 7 files changed, 4 insertions(+), 1193 deletions(-) delete mode 100644 drivers/staging/greybus/arche-apb-ctrl.c delete mode 100644 drivers/staging/greybus/arche-platform.c delete mode 100644 drivers/staging/greybus/arche_platform.h diff --git a/CREDITS b/CREDITS index a0bd941ca5dd..9f74318ac0da 100644 --- a/CREDITS +++ b/CREDITS @@ -1717,6 +1717,10 @@ S: Talstr. 1 S: D - 72072 Tuebingen S: Germany +N: Vaibhav Hiremath +E: hvaibhav.linux(a)gmail.com +D: Greybus Arche Platform driver + N: Richard Hirst E: richard(a)sleepie.demon.co.uk E: rhirst(a)linuxcare.com diff --git a/MAINTAINERS b/MAINTAINERS index c2414447892c..ade7c36f9318 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -11315,13 +11315,6 @@ M: Bryan O'Donoghue <pure.logic(a)nexus-software.ie> S: Maintained F: drivers/staging/greybus/loopback.c -GREYBUS PLATFORM DRIVERS -M: Vaibhav Hiremath <hvaibhav.linux(a)gmail.com> -S: Maintained -F: drivers/staging/greybus/arche-apb-ctrl.c -F: drivers/staging/greybus/arche-platform.c -F: drivers/staging/greybus/arche_platform.h - GREYBUS SDIO/GPIO/SPI PROTOCOLS DRIVERS M: Rui Miguel Silva <rmfrfs(a)gmail.com> S: Maintained diff --git a/drivers/staging/greybus/Kconfig b/drivers/staging/greybus/Kconfig index 7635f3e850fa..c25da61570eb 100644 --- a/drivers/staging/greybus/Kconfig +++ b/drivers/staging/greybus/Kconfig @@ -204,13 +204,4 @@ config GREYBUS_USB endif # GREYBUS_BRIDGED_PHY -config GREYBUS_ARCHE - tristate "Greybus Arche Platform driver" - depends on USB_HSIC_USB3613 || COMPILE_TEST - help - Select this option if you have an Arche device. - - To compile this code as a module, chose M here: the module - will be called gb-arche.ko - endif # GREYBUS diff --git a/drivers/staging/greybus/Makefile b/drivers/staging/greybus/Makefile index 7c5e89622334..7b9807f8a1a3 100644 --- a/drivers/staging/greybus/Makefile +++ b/drivers/staging/greybus/Makefile @@ -65,9 +65,3 @@ obj-$(CONFIG_GREYBUS_SDIO) += gb-sdio.o obj-$(CONFIG_GREYBUS_SPI) += gb-spi.o gb-spilib.o obj-$(CONFIG_GREYBUS_UART) += gb-uart.o obj-$(CONFIG_GREYBUS_USB) += gb-usb.o - - -# Greybus Platform driver -gb-arche-y := arche-platform.o arche-apb-ctrl.o - -obj-$(CONFIG_GREYBUS_ARCHE) += gb-arche.o diff --git a/drivers/staging/greybus/arche-apb-ctrl.c b/drivers/staging/greybus/arche-apb-ctrl.c deleted file mode 100644 index 4302c2226126..000000000000 --- a/drivers/staging/greybus/arche-apb-ctrl.c +++ /dev/null @@ -1,490 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0 -/* - * Arche Platform driver to control APB. - * - * Copyright 2014-2015 Google Inc. - * Copyright 2014-2015 Linaro Ltd. - */ - -#include <linux/clk.h> -#include <linux/delay.h> -#include <linux/gpio/consumer.h> -#include <linux/interrupt.h> -#include <linux/module.h> -#include <linux/pinctrl/consumer.h> -#include <linux/platform_device.h> -#include <linux/pm.h> -#include <linux/property.h> -#include <linux/regulator/consumer.h> -#include <linux/spinlock.h> -#include "arche_platform.h" - -static void apb_bootret_deassert(struct device *dev); - -struct arche_apb_ctrl_drvdata { - /* Control GPIO signals to and from AP <=> AP Bridges */ - struct gpio_desc *resetn; - struct gpio_desc *boot_ret; - struct gpio_desc *pwroff; - struct gpio_desc *wake_in; - struct gpio_desc *wake_out; - struct gpio_desc *pwrdn; - - enum arche_platform_state state; - bool init_disabled; - - struct regulator *vcore; - struct regulator *vio; - - struct gpio_desc *clk_en; - struct clk *clk; - - struct pinctrl *pinctrl; - struct pinctrl_state *pin_default; - - /* V2: SPI Bus control */ - struct gpio_desc *spi_en; - bool spi_en_polarity_high; -}; - -/* - * Note that these low level api's are active high - */ -static inline void deassert_reset(struct gpio_desc *gpio) -{ - gpiod_set_raw_value(gpio, 1); -} - -static inline void assert_reset(struct gpio_desc *gpio) -{ - gpiod_set_raw_value(gpio, 0); -} - -/* - * Note: Please do not modify the below sequence, as it is as per the spec - */ -static int coldboot_seq(struct platform_device *pdev) -{ - struct device *dev = &pdev->dev; - struct arche_apb_ctrl_drvdata *apb = platform_get_drvdata(pdev); - int ret; - - if (apb->init_disabled || - apb->state == ARCHE_PLATFORM_STATE_ACTIVE) - return 0; - - /* Hold APB in reset state */ - assert_reset(apb->resetn); - - if (apb->state == ARCHE_PLATFORM_STATE_FW_FLASHING && apb->spi_en) - devm_gpiod_put(dev, apb->spi_en); - - /* Enable power to APB */ - if (!IS_ERR(apb->vcore)) { - ret = regulator_enable(apb->vcore); - if (ret) { - dev_err(dev, "failed to enable core regulator\n"); - return ret; - } - } - - if (!IS_ERR(apb->vio)) { - ret = regulator_enable(apb->vio); - if (ret) { - dev_err(dev, "failed to enable IO regulator\n"); - return ret; - } - } - - apb_bootret_deassert(dev); - - /* On DB3 clock was not mandatory */ - if (apb->clk_en) - gpiod_set_value(apb->clk_en, 1); - - usleep_range(100, 200); - - /* deassert reset to APB : Active-low signal */ - deassert_reset(apb->resetn); - - apb->state = ARCHE_PLATFORM_STATE_ACTIVE; - - return 0; -} - -static int fw_flashing_seq(struct platform_device *pdev) -{ - struct device *dev = &pdev->dev; - struct arche_apb_ctrl_drvdata *apb = platform_get_drvdata(pdev); - int ret; - - if (apb->init_disabled || - apb->state == ARCHE_PLATFORM_STATE_FW_FLASHING) - return 0; - - ret = regulator_enable(apb->vcore); - if (ret) { - dev_err(dev, "failed to enable core regulator\n"); - return ret; - } - - ret = regulator_enable(apb->vio); - if (ret) { - dev_err(dev, "failed to enable IO regulator\n"); - return ret; - } - - if (apb->spi_en) { - unsigned long flags; - - if (apb->spi_en_polarity_high) - flags = GPIOD_OUT_HIGH; - else - flags = GPIOD_OUT_LOW; - - apb->spi_en = devm_gpiod_get(dev, "spi-en", flags); - if (IS_ERR(apb->spi_en)) { - ret = PTR_ERR(apb->spi_en); - dev_err(dev, "Failed requesting SPI bus en GPIO: %d\n", - ret); - return ret; - } - } - - /* for flashing device should be in reset state */ - assert_reset(apb->resetn); - apb->state = ARCHE_PLATFORM_STATE_FW_FLASHING; - - return 0; -} - -static int standby_boot_seq(struct platform_device *pdev) -{ - struct device *dev = &pdev->dev; - struct arche_apb_ctrl_drvdata *apb = platform_get_drvdata(pdev); - - if (apb->init_disabled) - return 0; - - /* - * Even if it is in OFF state, - * then we do not want to change the state - */ - if (apb->state == ARCHE_PLATFORM_STATE_STANDBY || - apb->state == ARCHE_PLATFORM_STATE_OFF) - return 0; - - if (apb->state == ARCHE_PLATFORM_STATE_FW_FLASHING && apb->spi_en) - devm_gpiod_put(dev, apb->spi_en); - - /* - * As per WDM spec, do nothing - * - * Pasted from WDM spec, - * - A falling edge on POWEROFF_L is detected (a) - * - WDM enters standby mode, but no output signals are changed - */ - - /* TODO: POWEROFF_L is input to WDM module */ - apb->state = ARCHE_PLATFORM_STATE_STANDBY; - return 0; -} - -static void poweroff_seq(struct platform_device *pdev) -{ - struct device *dev = &pdev->dev; - struct arche_apb_ctrl_drvdata *apb = platform_get_drvdata(pdev); - - if (apb->init_disabled || apb->state == ARCHE_PLATFORM_STATE_OFF) - return; - - if (apb->state == ARCHE_PLATFORM_STATE_FW_FLASHING && apb->spi_en) - devm_gpiod_put(dev, apb->spi_en); - - /* disable the clock */ - if (apb->clk_en) - gpiod_set_value(apb->clk_en, 0); - - if (!IS_ERR(apb->vcore) && regulator_is_enabled(apb->vcore) > 0) - regulator_disable(apb->vcore); - - if (!IS_ERR(apb->vio) && regulator_is_enabled(apb->vio) > 0) - regulator_disable(apb->vio); - - /* As part of exit, put APB back in reset state */ - assert_reset(apb->resetn); - apb->state = ARCHE_PLATFORM_STATE_OFF; - - /* TODO: May have to send an event to SVC about this exit */ -} - -static void apb_bootret_deassert(struct device *dev) -{ - struct arche_apb_ctrl_drvdata *apb = dev_get_drvdata(dev); - - gpiod_set_value(apb->boot_ret, 0); -} - -int apb_ctrl_coldboot(struct device *dev) -{ - return coldboot_seq(to_platform_device(dev)); -} - -int apb_ctrl_fw_flashing(struct device *dev) -{ - return fw_flashing_seq(to_platform_device(dev)); -} - -int apb_ctrl_standby_boot(struct device *dev) -{ - return standby_boot_seq(to_platform_device(dev)); -} - -void apb_ctrl_poweroff(struct device *dev) -{ - poweroff_seq(to_platform_device(dev)); -} - -static ssize_t state_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - struct platform_device *pdev = to_platform_device(dev); - struct arche_apb_ctrl_drvdata *apb = platform_get_drvdata(pdev); - int ret = 0; - bool is_disabled; - - if (sysfs_streq(buf, "off")) { - if (apb->state == ARCHE_PLATFORM_STATE_OFF) - return count; - - poweroff_seq(pdev); - } else if (sysfs_streq(buf, "active")) { - if (apb->state == ARCHE_PLATFORM_STATE_ACTIVE) - return count; - - poweroff_seq(pdev); - is_disabled = apb->init_disabled; - apb->init_disabled = false; - ret = coldboot_seq(pdev); - if (ret) - apb->init_disabled = is_disabled; - } else if (sysfs_streq(buf, "standby")) { - if (apb->state == ARCHE_PLATFORM_STATE_STANDBY) - return count; - - ret = standby_boot_seq(pdev); - } else if (sysfs_streq(buf, "fw_flashing")) { - if (apb->state == ARCHE_PLATFORM_STATE_FW_FLASHING) - return count; - - /* - * First we want to make sure we power off everything - * and then enter FW flashing state - */ - poweroff_seq(pdev); - ret = fw_flashing_seq(pdev); - } else { - dev_err(dev, "unknown state\n"); - ret = -EINVAL; - } - - return ret ? ret : count; -} - -static ssize_t state_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct arche_apb_ctrl_drvdata *apb = dev_get_drvdata(dev); - - switch (apb->state) { - case ARCHE_PLATFORM_STATE_OFF: - return sysfs_emit(buf, "off%s\n", - apb->init_disabled ? ",disabled" : ""); - case ARCHE_PLATFORM_STATE_ACTIVE: - return sysfs_emit(buf, "active\n"); - case ARCHE_PLATFORM_STATE_STANDBY: - return sysfs_emit(buf, "standby\n"); - case ARCHE_PLATFORM_STATE_FW_FLASHING: - return sysfs_emit(buf, "fw_flashing\n"); - default: - return sysfs_emit(buf, "unknown state\n"); - } -} - -static DEVICE_ATTR_RW(state); - -static int apb_ctrl_get_fw_data(struct platform_device *pdev, - struct arche_apb_ctrl_drvdata *apb) -{ - struct device *dev = &pdev->dev; - int ret; - - apb->resetn = devm_gpiod_get(dev, "reset", GPIOD_OUT_LOW); - if (IS_ERR(apb->resetn)) { - ret = PTR_ERR(apb->resetn); - dev_err(dev, "Failed requesting reset GPIO: %d\n", ret); - return ret; - } - - apb->boot_ret = devm_gpiod_get(dev, "boot-ret", GPIOD_OUT_LOW); - if (IS_ERR(apb->boot_ret)) { - ret = PTR_ERR(apb->boot_ret); - dev_err(dev, "Failed requesting bootret GPIO: %d\n", ret); - return ret; - } - - /* It's not mandatory to support power management interface */ - apb->pwroff = devm_gpiod_get_optional(dev, "pwr-off", GPIOD_IN); - if (IS_ERR(apb->pwroff)) { - ret = PTR_ERR(apb->pwroff); - dev_err(dev, "Failed requesting pwroff_n GPIO: %d\n", ret); - return ret; - } - - /* Do not make clock mandatory as of now (for DB3) */ - apb->clk_en = devm_gpiod_get_optional(dev, "clock-en", GPIOD_OUT_LOW); - if (IS_ERR(apb->clk_en)) { - ret = PTR_ERR(apb->clk_en); - dev_err(dev, "Failed requesting APB clock en GPIO: %d\n", ret); - return ret; - } - - apb->pwrdn = devm_gpiod_get(dev, "pwr-down", GPIOD_OUT_LOW); - if (IS_ERR(apb->pwrdn)) { - ret = PTR_ERR(apb->pwrdn); - dev_warn(dev, "Failed requesting power down GPIO: %d\n", ret); - return ret; - } - - /* Regulators are optional, as we may have fixed supply coming in */ - apb->vcore = devm_regulator_get(dev, "vcore"); - if (IS_ERR(apb->vcore)) - dev_warn(dev, "no core regulator found\n"); - - apb->vio = devm_regulator_get(dev, "vio"); - if (IS_ERR(apb->vio)) - dev_warn(dev, "no IO regulator found\n"); - - apb->pinctrl = devm_pinctrl_get(&pdev->dev); - if (IS_ERR(apb->pinctrl)) { - dev_err(&pdev->dev, "could not get pinctrl handle\n"); - return PTR_ERR(apb->pinctrl); - } - apb->pin_default = pinctrl_lookup_state(apb->pinctrl, "default"); - if (IS_ERR(apb->pin_default)) { - dev_err(&pdev->dev, "could not get default pin state\n"); - return PTR_ERR(apb->pin_default); - } - - /* Only applicable for platform >= V2 */ - if (device_property_read_bool(&pdev->dev, "gb,spi-en-active-high")) - apb->spi_en_polarity_high = true; - - return 0; -} - -static int arche_apb_ctrl_probe(struct platform_device *pdev) -{ - int ret; - struct arche_apb_ctrl_drvdata *apb; - struct device *dev = &pdev->dev; - - apb = devm_kzalloc(&pdev->dev, sizeof(*apb), GFP_KERNEL); - if (!apb) - return -ENOMEM; - - ret = apb_ctrl_get_fw_data(pdev, apb); - if (ret) { - dev_err(dev, "failed to get apb devicetree data %d\n", ret); - return ret; - } - - /* Initially set APB to OFF state */ - apb->state = ARCHE_PLATFORM_STATE_OFF; - /* Check whether device needs to be enabled on boot */ - if (device_property_read_bool(&pdev->dev, "arche,init-disable")) - apb->init_disabled = true; - - platform_set_drvdata(pdev, apb); - - /* Create sysfs interface to allow user to change state dynamically */ - ret = device_create_file(dev, &dev_attr_state); - if (ret) { - dev_err(dev, "failed to create state file in sysfs\n"); - return ret; - } - - dev_info(&pdev->dev, "Device registered successfully\n"); - return 0; -} - -static void arche_apb_ctrl_remove(struct platform_device *pdev) -{ - device_remove_file(&pdev->dev, &dev_attr_state); - poweroff_seq(pdev); - platform_set_drvdata(pdev, NULL); -} - -static int __maybe_unused arche_apb_ctrl_suspend(struct device *dev) -{ - /* - * If timing profile permits, we may shutdown bridge - * completely - * - * TODO: sequence ?? - * - * Also, need to make sure we meet precondition for unipro suspend - * Precondition: Definition ??? - */ - return 0; -} - -static int __maybe_unused arche_apb_ctrl_resume(struct device *dev) -{ - /* - * At least for ES2 we have to meet the delay requirement between - * unipro switch and AP bridge init, depending on whether bridge is in - * OFF state or standby state. - * - * Based on whether bridge is in standby or OFF state we may have to - * assert multiple signals. Please refer to WDM spec, for more info. - * - */ - return 0; -} - -static void arche_apb_ctrl_shutdown(struct platform_device *pdev) -{ - apb_ctrl_poweroff(&pdev->dev); -} - -static SIMPLE_DEV_PM_OPS(arche_apb_ctrl_pm_ops, arche_apb_ctrl_suspend, - arche_apb_ctrl_resume); - -static const struct of_device_id arche_apb_ctrl_of_match[] = { - { .compatible = "usbffff,2", }, - { }, -}; -MODULE_DEVICE_TABLE(of, arche_apb_ctrl_of_match); - -static struct platform_driver arche_apb_ctrl_device_driver = { - .probe = arche_apb_ctrl_probe, - .remove = arche_apb_ctrl_remove, - .shutdown = arche_apb_ctrl_shutdown, - .driver = { - .name = "arche-apb-ctrl", - .pm = &arche_apb_ctrl_pm_ops, - .of_match_table = arche_apb_ctrl_of_match, - } -}; - -int __init arche_apb_init(void) -{ - return platform_driver_register(&arche_apb_ctrl_device_driver); -} - -void __exit arche_apb_exit(void) -{ - platform_driver_unregister(&arche_apb_ctrl_device_driver); -} diff --git a/drivers/staging/greybus/arche-platform.c b/drivers/staging/greybus/arche-platform.c deleted file mode 100644 index de5de59ea8ab..000000000000 --- a/drivers/staging/greybus/arche-platform.c +++ /dev/null @@ -1,653 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0 -/* - * Arche Platform driver to enable Unipro link. - * - * Copyright 2014-2015 Google Inc. - * Copyright 2014-2015 Linaro Ltd. - */ - -#include <linux/clk.h> -#include <linux/delay.h> -#include <linux/gpio/consumer.h> -#include <linux/init.h> -#include <linux/module.h> -#include <linux/of_platform.h> -#include <linux/pinctrl/consumer.h> -#include <linux/platform_device.h> -#include <linux/pm.h> -#include <linux/interrupt.h> -#include <linux/irq.h> -#include <linux/suspend.h> -#include <linux/time.h> -#include <linux/greybus.h> -#include <linux/of.h> -#include "arche_platform.h" - -#if IS_ENABLED(CONFIG_USB_HSIC_USB3613) -#include <linux/usb/usb3613.h> -#else -static inline int usb3613_hub_mode_ctrl(bool unused) -{ - return 0; -} -#endif - -#define WD_COLDBOOT_PULSE_WIDTH_MS 30 - -enum svc_wakedetect_state { - WD_STATE_IDLE, /* Default state = pulled high/low */ - WD_STATE_BOOT_INIT, /* WD = falling edge (low) */ - WD_STATE_COLDBOOT_TRIG, /* WD = rising edge (high), > 30msec */ - WD_STATE_STANDBYBOOT_TRIG, /* As of now not used ?? */ - WD_STATE_COLDBOOT_START, /* Cold boot process started */ - WD_STATE_STANDBYBOOT_START, /* Not used */ -}; - -struct arche_platform_drvdata { - /* Control GPIO signals to and from AP <=> SVC */ - struct gpio_desc *svc_reset; - bool is_reset_act_hi; - struct gpio_desc *svc_sysboot; - struct gpio_desc *wake_detect; /* bi-dir,maps to WAKE_MOD & WAKE_FRAME signals */ - - enum arche_platform_state state; - - struct gpio_desc *svc_refclk_req; - struct clk *svc_ref_clk; - - struct pinctrl *pinctrl; - struct pinctrl_state *pin_default; - - int num_apbs; - - enum svc_wakedetect_state wake_detect_state; - int wake_detect_irq; - spinlock_t wake_lock; /* Protect wake_detect_state */ - struct mutex platform_state_mutex; /* Protect state */ - unsigned long wake_detect_start; - struct notifier_block pm_notifier; - - struct device *dev; -}; - -/* Requires calling context to hold arche_pdata->platform_state_mutex */ -static void arche_platform_set_state(struct arche_platform_drvdata *arche_pdata, - enum arche_platform_state state) -{ - arche_pdata->state = state; -} - -/* Requires arche_pdata->wake_lock is held by calling context */ -static void arche_platform_set_wake_detect_state(struct arche_platform_drvdata *arche_pdata, - enum svc_wakedetect_state state) -{ - arche_pdata->wake_detect_state = state; -} - -static inline void svc_reset_onoff(struct gpio_desc *gpio, bool onoff) -{ - gpiod_set_raw_value(gpio, onoff); -} - -static int apb_cold_boot(struct device *dev, void *data) -{ - int ret; - - ret = apb_ctrl_coldboot(dev); - if (ret) - dev_warn(dev, "failed to coldboot\n"); - - /*Child nodes are independent, so do not exit coldboot operation */ - return 0; -} - -static int apb_poweroff(struct device *dev, void *data) -{ - apb_ctrl_poweroff(dev); - - /* Enable HUB3613 into HUB mode. */ - if (usb3613_hub_mode_ctrl(false)) - dev_warn(dev, "failed to control hub device\n"); - - return 0; -} - -static void arche_platform_wd_irq_en(struct arche_platform_drvdata *arche_pdata) -{ - /* Enable interrupt here, to read event back from SVC */ - enable_irq(arche_pdata->wake_detect_irq); -} - -static irqreturn_t arche_platform_wd_irq_thread(int irq, void *devid) -{ - struct arche_platform_drvdata *arche_pdata = devid; - unsigned long flags; - - spin_lock_irqsave(&arche_pdata->wake_lock, flags); - if (arche_pdata->wake_detect_state != WD_STATE_COLDBOOT_TRIG) { - /* Something is wrong */ - spin_unlock_irqrestore(&arche_pdata->wake_lock, flags); - return IRQ_HANDLED; - } - - arche_platform_set_wake_detect_state(arche_pdata, - WD_STATE_COLDBOOT_START); - spin_unlock_irqrestore(&arche_pdata->wake_lock, flags); - - /* It should complete power cycle, so first make sure it is poweroff */ - device_for_each_child(arche_pdata->dev, NULL, apb_poweroff); - - /* Bring APB out of reset: cold boot sequence */ - device_for_each_child(arche_pdata->dev, NULL, apb_cold_boot); - - /* Enable HUB3613 into HUB mode. */ - if (usb3613_hub_mode_ctrl(true)) - dev_warn(arche_pdata->dev, "failed to control hub device\n"); - - spin_lock_irqsave(&arche_pdata->wake_lock, flags); - arche_platform_set_wake_detect_state(arche_pdata, WD_STATE_IDLE); - spin_unlock_irqrestore(&arche_pdata->wake_lock, flags); - - return IRQ_HANDLED; -} - -static irqreturn_t arche_platform_wd_irq(int irq, void *devid) -{ - struct arche_platform_drvdata *arche_pdata = devid; - unsigned long flags; - - spin_lock_irqsave(&arche_pdata->wake_lock, flags); - - if (gpiod_get_value(arche_pdata->wake_detect)) { - /* wake/detect rising */ - - /* - * If wake/detect line goes high after low, within less than - * 30msec, then standby boot sequence is initiated, which is not - * supported/implemented as of now. So ignore it. - */ - if (arche_pdata->wake_detect_state == WD_STATE_BOOT_INIT) { - if (time_before(jiffies, - arche_pdata->wake_detect_start + - msecs_to_jiffies(WD_COLDBOOT_PULSE_WIDTH_MS))) { - arche_platform_set_wake_detect_state(arche_pdata, - WD_STATE_IDLE); - } else { - /* - * Check we are not in middle of irq thread - * already - */ - if (arche_pdata->wake_detect_state != - WD_STATE_COLDBOOT_START) { - arche_platform_set_wake_detect_state(arche_pdata, - WD_STATE_COLDBOOT_TRIG); - spin_unlock_irqrestore(&arche_pdata->wake_lock, - flags); - return IRQ_WAKE_THREAD; - } - } - } - } else { - /* wake/detect falling */ - if (arche_pdata->wake_detect_state == WD_STATE_IDLE) { - arche_pdata->wake_detect_start = jiffies; - /* - * In the beginning, when wake/detect goes low - * (first time), we assume it is meant for coldboot - * and set the flag. If wake/detect line stays low - * beyond 30msec, then it is coldboot else fallback - * to standby boot. - */ - arche_platform_set_wake_detect_state(arche_pdata, - WD_STATE_BOOT_INIT); - } - } - - spin_unlock_irqrestore(&arche_pdata->wake_lock, flags); - - return IRQ_HANDLED; -} - -/* - * Requires arche_pdata->platform_state_mutex to be held - */ -static int -arche_platform_coldboot_seq(struct arche_platform_drvdata *arche_pdata) -{ - int ret; - - if (arche_pdata->state == ARCHE_PLATFORM_STATE_ACTIVE) - return 0; - - dev_info(arche_pdata->dev, "Booting from cold boot state\n"); - - svc_reset_onoff(arche_pdata->svc_reset, arche_pdata->is_reset_act_hi); - - gpiod_set_value(arche_pdata->svc_sysboot, 0); - usleep_range(100, 200); - - ret = clk_prepare_enable(arche_pdata->svc_ref_clk); - if (ret) { - dev_err(arche_pdata->dev, "failed to enable svc_ref_clk: %d\n", - ret); - return ret; - } - - /* bring SVC out of reset */ - svc_reset_onoff(arche_pdata->svc_reset, !arche_pdata->is_reset_act_hi); - - arche_platform_set_state(arche_pdata, ARCHE_PLATFORM_STATE_ACTIVE); - - return 0; -} - -/* - * Requires arche_pdata->platform_state_mutex to be held - */ -static int -arche_platform_fw_flashing_seq(struct arche_platform_drvdata *arche_pdata) -{ - int ret; - - if (arche_pdata->state == ARCHE_PLATFORM_STATE_FW_FLASHING) - return 0; - - dev_info(arche_pdata->dev, "Switching to FW flashing state\n"); - - svc_reset_onoff(arche_pdata->svc_reset, arche_pdata->is_reset_act_hi); - - gpiod_set_value(arche_pdata->svc_sysboot, 1); - - usleep_range(100, 200); - - ret = clk_prepare_enable(arche_pdata->svc_ref_clk); - if (ret) { - dev_err(arche_pdata->dev, "failed to enable svc_ref_clk: %d\n", - ret); - return ret; - } - - svc_reset_onoff(arche_pdata->svc_reset, !arche_pdata->is_reset_act_hi); - - arche_platform_set_state(arche_pdata, ARCHE_PLATFORM_STATE_FW_FLASHING); - - return 0; -} - -/* - * Requires arche_pdata->platform_state_mutex to be held - */ -static void -arche_platform_poweroff_seq(struct arche_platform_drvdata *arche_pdata) -{ - unsigned long flags; - - if (arche_pdata->state == ARCHE_PLATFORM_STATE_OFF) - return; - - /* If in fw_flashing mode, then no need to repeate things again */ - if (arche_pdata->state != ARCHE_PLATFORM_STATE_FW_FLASHING) { - disable_irq(arche_pdata->wake_detect_irq); - - spin_lock_irqsave(&arche_pdata->wake_lock, flags); - arche_platform_set_wake_detect_state(arche_pdata, - WD_STATE_IDLE); - spin_unlock_irqrestore(&arche_pdata->wake_lock, flags); - } - - clk_disable_unprepare(arche_pdata->svc_ref_clk); - - /* As part of exit, put APB back in reset state */ - svc_reset_onoff(arche_pdata->svc_reset, arche_pdata->is_reset_act_hi); - - arche_platform_set_state(arche_pdata, ARCHE_PLATFORM_STATE_OFF); -} - -static ssize_t state_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - struct arche_platform_drvdata *arche_pdata = dev_get_drvdata(dev); - int ret = 0; - - mutex_lock(&arche_pdata->platform_state_mutex); - - if (sysfs_streq(buf, "off")) { - if (arche_pdata->state == ARCHE_PLATFORM_STATE_OFF) - goto exit; - - /* If SVC goes down, bring down APB's as well */ - device_for_each_child(arche_pdata->dev, NULL, apb_poweroff); - - arche_platform_poweroff_seq(arche_pdata); - - } else if (sysfs_streq(buf, "active")) { - if (arche_pdata->state == ARCHE_PLATFORM_STATE_ACTIVE) - goto exit; - - /* First we want to make sure we power off everything - * and then activate back again - */ - device_for_each_child(arche_pdata->dev, NULL, apb_poweroff); - arche_platform_poweroff_seq(arche_pdata); - - arche_platform_wd_irq_en(arche_pdata); - ret = arche_platform_coldboot_seq(arche_pdata); - if (ret) - goto exit; - - } else if (sysfs_streq(buf, "standby")) { - if (arche_pdata->state == ARCHE_PLATFORM_STATE_STANDBY) - goto exit; - - dev_warn(arche_pdata->dev, "standby state not supported\n"); - } else if (sysfs_streq(buf, "fw_flashing")) { - if (arche_pdata->state == ARCHE_PLATFORM_STATE_FW_FLASHING) - goto exit; - - /* - * Here we only control SVC. - * - * In case of FW_FLASHING mode we do not want to control - * APBs, as in case of V2, SPI bus is shared between both - * the APBs. So let user chose which APB he wants to flash. - */ - arche_platform_poweroff_seq(arche_pdata); - - ret = arche_platform_fw_flashing_seq(arche_pdata); - if (ret) - goto exit; - } else { - dev_err(arche_pdata->dev, "unknown state\n"); - ret = -EINVAL; - } - -exit: - mutex_unlock(&arche_pdata->platform_state_mutex); - return ret ? ret : count; -} - -static ssize_t state_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct arche_platform_drvdata *arche_pdata = dev_get_drvdata(dev); - - switch (arche_pdata->state) { - case ARCHE_PLATFORM_STATE_OFF: - return sysfs_emit(buf, "off\n"); - case ARCHE_PLATFORM_STATE_ACTIVE: - return sysfs_emit(buf, "active\n"); - case ARCHE_PLATFORM_STATE_STANDBY: - return sysfs_emit(buf, "standby\n"); - case ARCHE_PLATFORM_STATE_FW_FLASHING: - return sysfs_emit(buf, "fw_flashing\n"); - default: - return sysfs_emit(buf, "unknown state\n"); - } -} - -static DEVICE_ATTR_RW(state); - -static int arche_platform_pm_notifier(struct notifier_block *notifier, - unsigned long pm_event, void *unused) -{ - struct arche_platform_drvdata *arche_pdata = - container_of(notifier, struct arche_platform_drvdata, - pm_notifier); - int ret = NOTIFY_DONE; - - mutex_lock(&arche_pdata->platform_state_mutex); - switch (pm_event) { - case PM_SUSPEND_PREPARE: - if (arche_pdata->state != ARCHE_PLATFORM_STATE_ACTIVE) { - ret = NOTIFY_STOP; - break; - } - device_for_each_child(arche_pdata->dev, NULL, apb_poweroff); - arche_platform_poweroff_seq(arche_pdata); - break; - case PM_POST_SUSPEND: - if (arche_pdata->state != ARCHE_PLATFORM_STATE_OFF) - break; - - arche_platform_wd_irq_en(arche_pdata); - arche_platform_coldboot_seq(arche_pdata); - break; - default: - break; - } - mutex_unlock(&arche_pdata->platform_state_mutex); - - return ret; -} - -static int arche_platform_probe(struct platform_device *pdev) -{ - struct arche_platform_drvdata *arche_pdata; - struct device *dev = &pdev->dev; - struct device_node *np = dev->of_node; - int ret; - unsigned int flags; - - arche_pdata = devm_kzalloc(&pdev->dev, sizeof(*arche_pdata), - GFP_KERNEL); - if (!arche_pdata) - return -ENOMEM; - - /* setup svc reset gpio */ - arche_pdata->is_reset_act_hi = of_property_read_bool(np, - "svc,reset-active-high"); - if (arche_pdata->is_reset_act_hi) - flags = GPIOD_OUT_HIGH; - else - flags = GPIOD_OUT_LOW; - - arche_pdata->svc_reset = devm_gpiod_get(dev, "svc,reset", flags); - if (IS_ERR(arche_pdata->svc_reset)) { - ret = PTR_ERR(arche_pdata->svc_reset); - dev_err(dev, "failed to request svc-reset GPIO: %d\n", ret); - return ret; - } - arche_platform_set_state(arche_pdata, ARCHE_PLATFORM_STATE_OFF); - - arche_pdata->svc_sysboot = devm_gpiod_get(dev, "svc,sysboot", - GPIOD_OUT_LOW); - if (IS_ERR(arche_pdata->svc_sysboot)) { - ret = PTR_ERR(arche_pdata->svc_sysboot); - dev_err(dev, "failed to request sysboot0 GPIO: %d\n", ret); - return ret; - } - - /* setup the clock request gpio first */ - arche_pdata->svc_refclk_req = devm_gpiod_get(dev, "svc,refclk-req", - GPIOD_IN); - if (IS_ERR(arche_pdata->svc_refclk_req)) { - ret = PTR_ERR(arche_pdata->svc_refclk_req); - dev_err(dev, "failed to request svc-clk-req GPIO: %d\n", ret); - return ret; - } - - /* setup refclk2 to follow the pin */ - arche_pdata->svc_ref_clk = devm_clk_get(dev, "svc_ref_clk"); - if (IS_ERR(arche_pdata->svc_ref_clk)) { - ret = PTR_ERR(arche_pdata->svc_ref_clk); - dev_err(dev, "failed to get svc_ref_clk: %d\n", ret); - return ret; - } - - platform_set_drvdata(pdev, arche_pdata); - - arche_pdata->num_apbs = of_get_child_count(np); - dev_dbg(dev, "Number of APB's available - %d\n", arche_pdata->num_apbs); - - arche_pdata->wake_detect = devm_gpiod_get(dev, "svc,wake-detect", - GPIOD_IN); - if (IS_ERR(arche_pdata->wake_detect)) { - ret = PTR_ERR(arche_pdata->wake_detect); - dev_err(dev, "Failed requesting wake_detect GPIO: %d\n", ret); - return ret; - } - - arche_platform_set_wake_detect_state(arche_pdata, WD_STATE_IDLE); - - arche_pdata->dev = &pdev->dev; - - spin_lock_init(&arche_pdata->wake_lock); - mutex_init(&arche_pdata->platform_state_mutex); - arche_pdata->wake_detect_irq = - gpiod_to_irq(arche_pdata->wake_detect); - - ret = devm_request_threaded_irq(dev, arche_pdata->wake_detect_irq, - arche_platform_wd_irq, - arche_platform_wd_irq_thread, - IRQF_TRIGGER_FALLING | - IRQF_TRIGGER_RISING | IRQF_ONESHOT, - dev_name(dev), arche_pdata); - if (ret) { - dev_err(dev, "failed to request wake detect IRQ %d\n", ret); - return ret; - } - disable_irq(arche_pdata->wake_detect_irq); - - ret = device_create_file(dev, &dev_attr_state); - if (ret) { - dev_err(dev, "failed to create state file in sysfs\n"); - return ret; - } - - ret = of_platform_populate(np, NULL, NULL, dev); - if (ret) { - dev_err(dev, "failed to populate child nodes %d\n", ret); - goto err_device_remove; - } - - arche_pdata->pm_notifier.notifier_call = arche_platform_pm_notifier; - ret = register_pm_notifier(&arche_pdata->pm_notifier); - if (ret) { - dev_err(dev, "failed to register pm notifier %d\n", ret); - goto err_depopulate; - } - - /* Explicitly power off if requested */ - if (!of_property_read_bool(pdev->dev.of_node, "arche,init-off")) { - mutex_lock(&arche_pdata->platform_state_mutex); - ret = arche_platform_coldboot_seq(arche_pdata); - if (ret) { - mutex_unlock(&arche_pdata->platform_state_mutex); - dev_err(dev, "Failed to cold boot svc %d\n", ret); - goto err_unregister_pm_notifier; - } - arche_platform_wd_irq_en(arche_pdata); - mutex_unlock(&arche_pdata->platform_state_mutex); - } - - dev_info(dev, "Device registered successfully\n"); - return 0; - -err_unregister_pm_notifier: - unregister_pm_notifier(&arche_pdata->pm_notifier); -err_depopulate: - of_platform_depopulate(dev); -err_device_remove: - device_remove_file(&pdev->dev, &dev_attr_state); - return ret; -} - -static void arche_platform_remove(struct platform_device *pdev) -{ - struct arche_platform_drvdata *arche_pdata = platform_get_drvdata(pdev); - - unregister_pm_notifier(&arche_pdata->pm_notifier); - device_remove_file(&pdev->dev, &dev_attr_state); - of_platform_depopulate(&pdev->dev); - arche_platform_poweroff_seq(arche_pdata); - - if (usb3613_hub_mode_ctrl(false)) - dev_warn(arche_pdata->dev, "failed to control hub device\n"); -} - -static __maybe_unused int arche_platform_suspend(struct device *dev) -{ - /* - * If timing profile permits, we may shutdown bridge - * completely - * - * TODO: define shutdown sequence - * - * Also, need to make sure we meet precondition for unipro suspend - * Precondition: Definition ??? - */ - return 0; -} - -static __maybe_unused int arche_platform_resume(struct device *dev) -{ - /* - * At least for ES2 we have to meet the delay requirement between - * unipro switch and AP bridge init, depending on whether bridge is in - * OFF state or standby state. - * - * Based on whether bridge is in standby or OFF state we may have to - * assert multiple signals. Please refer to WDM spec, for more info. - * - */ - return 0; -} - -static void arche_platform_shutdown(struct platform_device *pdev) -{ - struct arche_platform_drvdata *arche_pdata = platform_get_drvdata(pdev); - - arche_platform_poweroff_seq(arche_pdata); - - usb3613_hub_mode_ctrl(false); -} - -static SIMPLE_DEV_PM_OPS(arche_platform_pm_ops, - arche_platform_suspend, - arche_platform_resume); - -static const struct of_device_id arche_platform_of_match[] = { - /* Use PID/VID of SVC device */ - { .compatible = "google,arche-platform", }, - { }, -}; -MODULE_DEVICE_TABLE(of, arche_platform_of_match); - -static struct platform_driver arche_platform_device_driver = { - .probe = arche_platform_probe, - .remove = arche_platform_remove, - .shutdown = arche_platform_shutdown, - .driver = { - .name = "arche-platform-ctrl", - .pm = &arche_platform_pm_ops, - .of_match_table = arche_platform_of_match, - } -}; - -static int __init arche_init(void) -{ - int retval; - - retval = platform_driver_register(&arche_platform_device_driver); - if (retval) - return retval; - - retval = arche_apb_init(); - if (retval) - platform_driver_unregister(&arche_platform_device_driver); - - return retval; -} -module_init(arche_init); - -static void __exit arche_exit(void) -{ - arche_apb_exit(); - platform_driver_unregister(&arche_platform_device_driver); -} -module_exit(arche_exit); - -MODULE_LICENSE("GPL v2"); -MODULE_AUTHOR("Vaibhav Hiremath <vaibhav.hiremath(a)linaro.org>"); -MODULE_DESCRIPTION("Arche Platform Driver"); diff --git a/drivers/staging/greybus/arche_platform.h b/drivers/staging/greybus/arche_platform.h deleted file mode 100644 index 9d997f2d6517..000000000000 --- a/drivers/staging/greybus/arche_platform.h +++ /dev/null @@ -1,28 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/* - * Arche Platform driver to enable Unipro link. - * - * Copyright 2015-2016 Google Inc. - * Copyright 2015-2016 Linaro Ltd. - */ - -#ifndef __ARCHE_PLATFORM_H -#define __ARCHE_PLATFORM_H - -enum arche_platform_state { - ARCHE_PLATFORM_STATE_OFF, - ARCHE_PLATFORM_STATE_ACTIVE, - ARCHE_PLATFORM_STATE_STANDBY, - ARCHE_PLATFORM_STATE_FW_FLASHING, -}; - -int __init arche_apb_init(void); -void __exit arche_apb_exit(void); - -/* Operational states for the APB device */ -int apb_ctrl_coldboot(struct device *dev); -int apb_ctrl_fw_flashing(struct device *dev); -int apb_ctrl_standby_boot(struct device *dev); -void apb_ctrl_poweroff(struct device *dev); - -#endif /* __ARCHE_PLATFORM_H */ -- 2.43.0

1 day, 12 hours

[PATCH] staging: greybus: add missing newlines to sysfs_emit

by Matthew Zvolsky

Add terminating newlines to sysfs_emit format strings to conform with kernel sysfs guidelines. Also clean up envp array declaration to be static const char * const. Signed-off-by: Matthew Zvolsky <matthew-kernel(a)post.cz> --- drivers/staging/greybus/audio_manager_module.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/staging/greybus/audio_manager_module.c b/drivers/staging/greybus/audio_manager_module.c index dc90cc2d2308..16b688cfac75 100644 --- a/drivers/staging/greybus/audio_manager_module.c +++ b/drivers/staging/greybus/audio_manager_module.c @@ -75,7 +75,7 @@ static void gb_audio_module_release(struct kobject *kobj) static ssize_t gb_audio_module_name_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%s", module->desc.name); + return sysfs_emit(buf, "%s\n", module->desc.name); } static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = @@ -84,7 +84,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_name_attribute = static ssize_t gb_audio_module_vid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.vid); + return sysfs_emit(buf, "%d\n", module->desc.vid); } static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = @@ -93,7 +93,7 @@ static struct gb_audio_manager_module_attribute gb_audio_module_vid_attribute = static ssize_t gb_audio_module_pid_show(struct gb_audio_manager_module *module, struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.pid); + return sysfs_emit(buf, "%d\n", module->desc.pid); } static struct gb_audio_manager_module_attribute gb_audio_module_pid_attribute = @@ -103,7 +103,7 @@ static ssize_t gb_audio_module_intf_id_show(struct gb_audio_manager_module *modu struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "%d", module->desc.intf_id); + return sysfs_emit(buf, "%d\n", module->desc.intf_id); } static struct gb_audio_manager_module_attribute @@ -114,7 +114,7 @@ static ssize_t gb_audio_module_ip_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.ip_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.ip_devices); } static struct gb_audio_manager_module_attribute @@ -125,7 +125,7 @@ static ssize_t gb_audio_module_op_devices_show(struct gb_audio_manager_module *m struct gb_audio_manager_module_attribute *attr, char *buf) { - return sysfs_emit(buf, "0x%X", module->desc.op_devices); + return sysfs_emit(buf, "0x%X\n", module->desc.op_devices); } static struct gb_audio_manager_module_attribute @@ -158,7 +158,7 @@ static void send_add_uevent(struct gb_audio_manager_module *module) char ip_devices_string[64]; char op_devices_string[64]; - char *envp[] = { + static const char * const envp[] = { name_string, vid_string, pid_string, -- 2.39.5

4 days, 7 hours

[PATCH v3 0/3] Bring includes in linux/kmod.h up to date

by Petr Pavlu

The usermode helper declarations were previously provided by linux/kmod.h but commit c1f3fa2a4fde ("kmod: split off umh headers into its own file") moved them to linux/umh.h in 2017. Add explicit includes of linux/umh.h to files that use usermode helpers and remove linux/kmod.h where it is no longer needed. Also add a missing include of linux/sysctl.h to kernel/time/jiffies.c. Finally, clean up linux/kmod.h so that it includes only the headers that it actually requires, importantly removing the compat linux/umh.h include. This cleanup is motivated by trying to reduce the preprocessed size of linux/module.h, which includes linux/kmod.h. linux/module.h appears in roughly 15k #include directives across the kernel. This makes it a "hot" header, so it should avoid pulling in unnecessary definitions. Note that this series doesn't immediately improve the situation, since most of the files included by linux/kmod.h are, for now, also included by linux/module.h through other paths. Apologies for the wide distribution. Acked-bys are appreciated. --- Changes in v3: - Rebase on top of v7.3-rc2. - Clean up commit descriptions. - Link to v2: https://patch.msgid.link/20260721131207.803760-1-petr.pavlu@suse.com Changes in v2: - Remove the linux/kmod.h include from kernel/cgroup/cgroup-v1.c. - Add a missing include of linux/sysctl.h to kernel/time/jiffies.c. - Link to v1: https://patch.msgid.link/20260708154510.6794-1-petr.pavlu@suse.com --- Petr Pavlu (3): umh, treewide: Explicitly include linux/umh.h where needed time/jiffies: Include linux/sysctl.h for proc_int_u2k_conv_uop(), ... module: Bring includes in linux/kmod.h up to date arch/x86/kernel/cpu/mce/dev-mcelog.c | 2 +- drivers/block/drbd/drbd_nl.c | 1 + drivers/greybus/svc_watchdog.c | 1 + drivers/macintosh/windfarm_core.c | 1 + drivers/pnp/pnpbios/core.c | 2 +- drivers/video/fbdev/uvesafb.c | 1 + fs/coredump.c | 2 +- fs/nfs/cache_lib.c | 2 +- fs/nfsd/nfs4layouts.c | 2 +- fs/nfsd/nfs4recover.c | 1 + fs/ocfs2/stackglue.c | 1 + include/linux/kmod.h | 12 ++---------- kernel/cgroup/cgroup-v1.c | 2 +- kernel/module/kmod.c | 1 + kernel/power/process.c | 2 +- kernel/reboot.c | 2 +- kernel/time/jiffies.c | 1 + kernel/umh.c | 2 +- lib/kobject_uevent.c | 2 +- net/bridge/br_stp_if.c | 2 +- security/keys/request_key.c | 2 +- security/tomoyo/common.h | 2 +- 22 files changed, 23 insertions(+), 23 deletions(-) --- base-commit: df2908090cda368b01ff43709f51890076c56157 change-id: 20260816-module-include-kmod-14d1a0e19462

5 days

[PATCH] staging: greybus: hid: fix off-by-one in SET_REPORT allocation

by Farhad Alemi

gb_hid_set_report() sizes its request payload as sizeof(*request) + len - 1, but report[] in struct gb_hid_set_report_request is a flexible array member that sizeof() already excludes. The buffer is therefore one byte too small, so memcpy(request->report, buf, len) writes one byte past its end, which KASAN reports as a slab-out-of-bounds write. Drop the stray - 1 so the allocation covers the whole report. Closes: https://lore.kernel.org/all/CA+0ovCgLrz4WhPKP5LGW5HZa8VOodgeo6pWuyQGgHE7UY5… Signed-off-by: Farhad Alemi <farhad.alemi(a)berkeley.edu> --- The device was emulated. --- a/drivers/staging/greybus/hid.c +++ b/drivers/staging/greybus/hid.c @@ -97,7 +97,8 @@ static int gb_hid_set_report(struct gb_hid *ghid, u8 report_type, u8 report_id, { struct gb_hid_set_report_request *request; struct gb_operation *operation; - int ret, size = sizeof(*request) + len - 1; + /* report[] is a flexible array, so sizeof() already excludes it. */ + int ret, size = sizeof(*request) + len; ret = gb_pm_runtime_get_sync(ghid->bundle); if (ret)

5 days, 2 hours

[PATCH] staging: greybus: audio_codec.c: remove unnecessary parentheses

by YiCheng Lu

Remove unnecessary parentheses around simple boolean expressions in the if condition. The kernel coding style prefers not to use parentheses around simple conditions. Signed-off-by: YiCheng Lu <01luyicheng(a)gmail.com> --- drivers/staging/greybus/audio_codec.c | 1100 +++++++++++++++++++++++++ 1 file changed, 1100 insertions(+) create mode 100644 drivers/staging/greybus/audio_codec.c diff --git a/drivers/staging/greybus/audio_codec.c b/drivers/staging/greybus/audio_codec.c new file mode 100644 index 0000000..44aee82 --- /dev/null +++ b/drivers/staging/greybus/audio_codec.c @@ -0,0 +1,1100 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * APBridge ALSA SoC dummy codec driver + * Copyright 2016 Google Inc. + * Copyright 2016 Linaro Ltd. + */ +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/pm_runtime.h> +#include <sound/soc.h> +#include <sound/pcm_params.h> +#include <uapi/linux/input.h> + +#include "audio_codec.h" +#include "audio_apbridgea.h" +#include "audio_manager.h" +#include "audio_helper.h" + +static struct gbaudio_codec_info *gbcodec; + +static struct gbaudio_data_connection * +find_data(struct gbaudio_module_info *module, int id) +{ + struct gbaudio_data_connection *data; + + list_for_each_entry(data, &module->data_list, list) { + if (id == data->id) + return data; + } + return NULL; +} + +static struct gbaudio_stream_params * +find_dai_stream_params(struct gbaudio_codec_info *codec, int id, int stream) +{ + struct gbaudio_codec_dai *dai; + + list_for_each_entry(dai, &codec->dai_list, list) { + if (dai->id == id) + return &dai->params[stream]; + } + return NULL; +} + +static int gbaudio_module_enable_tx(struct gbaudio_codec_info *codec, + struct gbaudio_module_info *module, int id) +{ + int module_state, ret = 0; + u16 data_cport, i2s_port, cportid; + u8 sig_bits, channels; + u32 format, rate; + struct gbaudio_data_connection *data; + struct gbaudio_stream_params *params; + + /* find the dai */ + data = find_data(module, id); + if (!data) { + dev_err(module->dev, "%d:DATA connection missing\n", id); + return -ENODEV; + } + module_state = data->state[SNDRV_PCM_STREAM_PLAYBACK]; + + params = find_dai_stream_params(codec, id, SNDRV_PCM_STREAM_PLAYBACK); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + return -EINVAL; + } + + /* register cport */ + if (module_state < GBAUDIO_CODEC_STARTUP) { + i2s_port = 0; /* fixed for now */ + cportid = data->connection->hd_cport_id; + ret = gb_audio_apbridgea_register_cport(data->connection, + i2s_port, cportid, + AUDIO_APBRIDGEA_DIRECTION_TX); + if (ret) { + dev_err_ratelimited(module->dev, "reg_cport failed:%d\n", ret); + return ret; + } + data->state[SNDRV_PCM_STREAM_PLAYBACK] = GBAUDIO_CODEC_STARTUP; + dev_dbg(module->dev, "Dynamic Register %d DAI\n", cportid); + } + + /* hw_params */ + if (module_state < GBAUDIO_CODEC_HWPARAMS) { + format = params->format; + channels = params->channels; + rate = params->rate; + sig_bits = params->sig_bits; + data_cport = data->connection->intf_cport_id; + ret = gb_audio_gb_set_pcm(module->mgmt_connection, data_cport, + format, rate, channels, sig_bits); + if (ret) { + dev_err_ratelimited(module->dev, "set_pcm failed:%d\n", ret); + return ret; + } + data->state[SNDRV_PCM_STREAM_PLAYBACK] = GBAUDIO_CODEC_HWPARAMS; + dev_dbg(module->dev, "Dynamic hw_params %d DAI\n", data_cport); + } + + /* prepare */ + if (module_state < GBAUDIO_CODEC_PREPARE) { + data_cport = data->connection->intf_cport_id; + ret = gb_audio_gb_set_tx_data_size(module->mgmt_connection, + data_cport, 192); + if (ret) { + dev_err_ratelimited(module->dev, + "set_tx_data_size failed:%d\n", + ret); + return ret; + } + ret = gb_audio_gb_activate_tx(module->mgmt_connection, data_cport); + if (ret) { + dev_err_ratelimited(module->dev, + "activate_tx failed:%d\n", ret); + return ret; + } + data->state[SNDRV_PCM_STREAM_PLAYBACK] = GBAUDIO_CODEC_PREPARE; + dev_dbg(module->dev, "Dynamic prepare %d DAI\n", data_cport); + } + + return 0; +} + +static int gbaudio_module_disable_tx(struct gbaudio_module_info *module, int id) +{ + int ret; + u16 data_cport, cportid, i2s_port; + int module_state; + struct gbaudio_data_connection *data; + + /* find the dai */ + data = find_data(module, id); + if (!data) { + dev_err(module->dev, "%d:DATA connection missing\n", id); + return -ENODEV; + } + module_state = data->state[SNDRV_PCM_STREAM_PLAYBACK]; + + if (module_state > GBAUDIO_CODEC_HWPARAMS) { + data_cport = data->connection->intf_cport_id; + ret = gb_audio_gb_deactivate_tx(module->mgmt_connection, + data_cport); + if (ret) { + dev_err_ratelimited(module->dev, + "deactivate_tx failed:%d\n", ret); + return ret; + } + dev_dbg(module->dev, "Dynamic deactivate %d DAI\n", data_cport); + data->state[SNDRV_PCM_STREAM_PLAYBACK] = GBAUDIO_CODEC_HWPARAMS; + } + + if (module_state > GBAUDIO_CODEC_SHUTDOWN) { + i2s_port = 0; /* fixed for now */ + cportid = data->connection->hd_cport_id; + ret = gb_audio_apbridgea_unregister_cport(data->connection, + i2s_port, cportid, + AUDIO_APBRIDGEA_DIRECTION_TX); + if (ret) { + dev_err_ratelimited(module->dev, + "unregister_cport failed:%d\n", ret); + return ret; + } + dev_dbg(module->dev, "Dynamic Unregister %d DAI\n", cportid); + data->state[SNDRV_PCM_STREAM_PLAYBACK] = GBAUDIO_CODEC_SHUTDOWN; + } + + return 0; +} + +static int gbaudio_module_enable_rx(struct gbaudio_codec_info *codec, + struct gbaudio_module_info *module, int id) +{ + int module_state, ret = 0; + u16 data_cport, i2s_port, cportid; + u8 sig_bits, channels; + u32 format, rate; + struct gbaudio_data_connection *data; + struct gbaudio_stream_params *params; + + /* find the dai */ + data = find_data(module, id); + if (!data) { + dev_err(module->dev, "%d:DATA connection missing\n", id); + return -ENODEV; + } + module_state = data->state[SNDRV_PCM_STREAM_CAPTURE]; + + params = find_dai_stream_params(codec, id, SNDRV_PCM_STREAM_CAPTURE); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + return -EINVAL; + } + + /* register cport */ + if (module_state < GBAUDIO_CODEC_STARTUP) { + i2s_port = 0; /* fixed for now */ + cportid = data->connection->hd_cport_id; + ret = gb_audio_apbridgea_register_cport(data->connection, + i2s_port, cportid, + AUDIO_APBRIDGEA_DIRECTION_RX); + if (ret) { + dev_err_ratelimited(module->dev, "reg_cport failed:%d\n", ret); + return ret; + } + data->state[SNDRV_PCM_STREAM_CAPTURE] = GBAUDIO_CODEC_STARTUP; + dev_dbg(module->dev, "Dynamic Register %d DAI\n", cportid); + } + + /* hw_params */ + if (module_state < GBAUDIO_CODEC_HWPARAMS) { + format = params->format; + channels = params->channels; + rate = params->rate; + sig_bits = params->sig_bits; + data_cport = data->connection->intf_cport_id; + ret = gb_audio_gb_set_pcm(module->mgmt_connection, data_cport, + format, rate, channels, sig_bits); + if (ret) { + dev_err_ratelimited(module->dev, "set_pcm failed:%d\n", ret); + return ret; + } + data->state[SNDRV_PCM_STREAM_CAPTURE] = GBAUDIO_CODEC_HWPARAMS; + dev_dbg(module->dev, "Dynamic hw_params %d DAI\n", data_cport); + } + + /* prepare */ + if (module_state < GBAUDIO_CODEC_PREPARE) { + data_cport = data->connection->intf_cport_id; + ret = gb_audio_gb_set_rx_data_size(module->mgmt_connection, + data_cport, 192); + if (ret) { + dev_err_ratelimited(module->dev, + "set_rx_data_size failed:%d\n", + ret); + return ret; + } + ret = gb_audio_gb_activate_rx(module->mgmt_connection, + data_cport); + if (ret) { + dev_err_ratelimited(module->dev, + "activate_rx failed:%d\n", ret); + return ret; + } + data->state[SNDRV_PCM_STREAM_CAPTURE] = GBAUDIO_CODEC_PREPARE; + dev_dbg(module->dev, "Dynamic prepare %d DAI\n", data_cport); + } + + return 0; +} + +static int gbaudio_module_disable_rx(struct gbaudio_module_info *module, int id) +{ + int ret; + u16 data_cport, cportid, i2s_port; + int module_state; + struct gbaudio_data_connection *data; + + /* find the dai */ + data = find_data(module, id); + if (!data) { + dev_err(module->dev, "%d:DATA connection missing\n", id); + return -ENODEV; + } + module_state = data->state[SNDRV_PCM_STREAM_CAPTURE]; + + if (module_state > GBAUDIO_CODEC_HWPARAMS) { + data_cport = data->connection->intf_cport_id; + ret = gb_audio_gb_deactivate_rx(module->mgmt_connection, + data_cport); + if (ret) { + dev_err_ratelimited(module->dev, + "deactivate_rx failed:%d\n", ret); + return ret; + } + dev_dbg(module->dev, "Dynamic deactivate %d DAI\n", data_cport); + data->state[SNDRV_PCM_STREAM_CAPTURE] = GBAUDIO_CODEC_HWPARAMS; + } + + if (module_state > GBAUDIO_CODEC_SHUTDOWN) { + i2s_port = 0; /* fixed for now */ + cportid = data->connection->hd_cport_id; + ret = gb_audio_apbridgea_unregister_cport(data->connection, + i2s_port, cportid, + AUDIO_APBRIDGEA_DIRECTION_RX); + if (ret) { + dev_err_ratelimited(module->dev, + "unregister_cport failed:%d\n", ret); + return ret; + } + dev_dbg(module->dev, "Dynamic Unregister %d DAI\n", cportid); + data->state[SNDRV_PCM_STREAM_CAPTURE] = GBAUDIO_CODEC_SHUTDOWN; + } + + return 0; +} + +int gbaudio_module_update(struct gbaudio_codec_info *codec, + struct snd_soc_dapm_widget *w, + struct gbaudio_module_info *module, int enable) +{ + int dai_id, ret; + char intf_name[NAME_SIZE], dir[NAME_SIZE]; + + dev_dbg(module->dev, "%s:Module update %s sequence\n", w->name, + enable ? "Enable" : "Disable"); + + if (w->id != snd_soc_dapm_aif_in && w->id != snd_soc_dapm_aif_out) { + dev_dbg(codec->dev, "No action required for %s\n", w->name); + return 0; + } + + /* parse dai_id from AIF widget's stream_name */ + ret = sscanf(w->sname, "%s %d %s", intf_name, &dai_id, dir); + if (ret < 3) { + dev_err(codec->dev, "Error while parsing dai_id for %s\n", w->name); + return -EINVAL; + } + + mutex_lock(&codec->lock); + if (w->id == snd_soc_dapm_aif_in) { + if (enable) + ret = gbaudio_module_enable_tx(codec, module, dai_id); + else + ret = gbaudio_module_disable_tx(module, dai_id); + } else if (w->id == snd_soc_dapm_aif_out) { + if (enable) + ret = gbaudio_module_enable_rx(codec, module, dai_id); + else + ret = gbaudio_module_disable_rx(module, dai_id); + } + + mutex_unlock(&codec->lock); + + return ret; +} +EXPORT_SYMBOL(gbaudio_module_update); + +/* + * codec DAI ops + */ +static int gbcodec_startup(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) +{ + struct gbaudio_codec_info *codec = dev_get_drvdata(dai->dev); + struct gbaudio_stream_params *params; + + mutex_lock(&codec->lock); + + if (list_empty(&codec->module_list)) { + dev_err(codec->dev, "No codec module available\n"); + mutex_unlock(&codec->lock); + return -ENODEV; + } + + params = find_dai_stream_params(codec, dai->id, substream->stream); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + mutex_unlock(&codec->lock); + return -EINVAL; + } + params->state = GBAUDIO_CODEC_STARTUP; + mutex_unlock(&codec->lock); + /* to prevent suspend in case of active audio */ + pm_stay_awake(dai->dev); + + return 0; +} + +static void gbcodec_shutdown(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) +{ + struct gbaudio_codec_info *codec = dev_get_drvdata(dai->dev); + struct gbaudio_stream_params *params; + + mutex_lock(&codec->lock); + + if (list_empty(&codec->module_list)) + dev_info(codec->dev, "No codec module available during shutdown\n"); + + params = find_dai_stream_params(codec, dai->id, substream->stream); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + mutex_unlock(&codec->lock); + return; + } + params->state = GBAUDIO_CODEC_SHUTDOWN; + mutex_unlock(&codec->lock); + pm_relax(dai->dev); +} + +static int gbcodec_hw_params(struct snd_pcm_substream *substream, + struct snd_pcm_hw_params *hwparams, + struct snd_soc_dai *dai) +{ + int ret; + u8 sig_bits, channels; + u32 format, rate; + struct gbaudio_module_info *module; + struct gbaudio_data_connection *data; + struct gb_bundle *bundle; + struct gbaudio_codec_info *codec = dev_get_drvdata(dai->dev); + struct gbaudio_stream_params *params; + + mutex_lock(&codec->lock); + + if (list_empty(&codec->module_list)) { + dev_err(codec->dev, "No codec module available\n"); + mutex_unlock(&codec->lock); + return -ENODEV; + } + + /* + * assuming, currently only 48000 Hz, 16BIT_LE, stereo + * is supported, validate params before configuring codec + */ + if (params_channels(hwparams) != 2) { + dev_err(dai->dev, "Invalid channel count:%d\n", + params_channels(hwparams)); + mutex_unlock(&codec->lock); + return -EINVAL; + } + channels = params_channels(hwparams); + + if (params_rate(hwparams) != 48000) { + dev_err(dai->dev, "Invalid sampling rate:%d\n", + params_rate(hwparams)); + mutex_unlock(&codec->lock); + return -EINVAL; + } + rate = GB_AUDIO_PCM_RATE_48000; + + if (params_format(hwparams) != SNDRV_PCM_FORMAT_S16_LE) { + dev_err(dai->dev, "Invalid format:%d\n", params_format(hwparams)); + mutex_unlock(&codec->lock); + return -EINVAL; + } + format = GB_AUDIO_PCM_FMT_S16_LE; + + /* find the data connection */ + list_for_each_entry(module, &codec->module_list, list) { + data = find_data(module, dai->id); + if (data) + break; + } + + if (!data) { + dev_err(dai->dev, "DATA connection missing\n"); + mutex_unlock(&codec->lock); + return -EINVAL; + } + + params = find_dai_stream_params(codec, dai->id, substream->stream); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + mutex_unlock(&codec->lock); + return -EINVAL; + } + + bundle = to_gb_bundle(module->dev); + ret = gb_pm_runtime_get_sync(bundle); + if (ret) { + mutex_unlock(&codec->lock); + return ret; + } + + ret = gb_audio_apbridgea_set_config(data->connection, 0, + AUDIO_APBRIDGEA_PCM_FMT_16, + AUDIO_APBRIDGEA_PCM_RATE_48000, + 6144000); + if (ret) { + dev_err_ratelimited(dai->dev, "%d: Error during set_config\n", + ret); + gb_pm_runtime_put_noidle(bundle); + mutex_unlock(&codec->lock); + return ret; + } + + gb_pm_runtime_put_noidle(bundle); + + if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) + sig_bits = dai->driver->playback.sig_bits; + else + sig_bits = dai->driver->capture.sig_bits; + + params->state = GBAUDIO_CODEC_HWPARAMS; + params->format = format; + params->rate = rate; + params->channels = channels; + params->sig_bits = sig_bits; + + mutex_unlock(&codec->lock); + return 0; +} + +static int gbcodec_prepare(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) +{ + int ret; + struct gbaudio_module_info *module = NULL, *iter; + struct gbaudio_data_connection *data; + struct gb_bundle *bundle; + struct gbaudio_codec_info *codec = dev_get_drvdata(dai->dev); + struct gbaudio_stream_params *params; + + mutex_lock(&codec->lock); + + if (list_empty(&codec->module_list)) { + dev_err(codec->dev, "No codec module available\n"); + mutex_unlock(&codec->lock); + return -ENODEV; + } + + list_for_each_entry(iter, &codec->module_list, list) { + /* find the dai */ + data = find_data(iter, dai->id); + if (data) { + module = iter; + break; + } + } + if (!data) { + dev_err(dai->dev, "DATA connection missing\n"); + mutex_unlock(&codec->lock); + return -ENODEV; + } + + params = find_dai_stream_params(codec, dai->id, substream->stream); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + mutex_unlock(&codec->lock); + return -EINVAL; + } + + bundle = to_gb_bundle(module->dev); + ret = gb_pm_runtime_get_sync(bundle); + if (ret) { + mutex_unlock(&codec->lock); + return ret; + } + + switch (substream->stream) { + case SNDRV_PCM_STREAM_PLAYBACK: + ret = gb_audio_apbridgea_set_tx_data_size(data->connection, 0, 192); + break; + case SNDRV_PCM_STREAM_CAPTURE: + ret = gb_audio_apbridgea_set_rx_data_size(data->connection, 0, 192); + break; + } + if (ret) { + gb_pm_runtime_put_noidle(bundle); + mutex_unlock(&codec->lock); + dev_err_ratelimited(dai->dev, "set_data_size failed:%d\n", ret); + return ret; + } + + gb_pm_runtime_put_noidle(bundle); + + params->state = GBAUDIO_CODEC_PREPARE; + mutex_unlock(&codec->lock); + return 0; +} + +static int gbcodec_mute_stream(struct snd_soc_dai *dai, int mute, int stream) +{ + int ret; + struct gbaudio_data_connection *data; + struct gbaudio_module_info *module = NULL, *iter; + struct gb_bundle *bundle; + struct gbaudio_codec_info *codec = dev_get_drvdata(dai->dev); + struct gbaudio_stream_params *params; + + dev_dbg(dai->dev, "Mute:%d, Direction:%s\n", mute, + stream ? "CAPTURE" : "PLAYBACK"); + + mutex_lock(&codec->lock); + + params = find_dai_stream_params(codec, dai->id, stream); + if (!params) { + dev_err(codec->dev, "Failed to fetch dai_stream pointer\n"); + mutex_unlock(&codec->lock); + return -EINVAL; + } + + if (list_empty(&codec->module_list)) { + dev_err(codec->dev, "No codec module available\n"); + if (mute) { + params->state = GBAUDIO_CODEC_STOP; + ret = 0; + } else { + ret = -ENODEV; + } + mutex_unlock(&codec->lock); + return ret; + } + + list_for_each_entry(iter, &codec->module_list, list) { + /* find the dai */ + data = find_data(iter, dai->id); + if (data) { + module = iter; + break; + } + } + if (!data) { + dev_err(dai->dev, "%s DATA connection missing\n", + dai->name); + mutex_unlock(&codec->lock); + return -ENODEV; + } + + bundle = to_gb_bundle(module->dev); + ret = gb_pm_runtime_get_sync(bundle); + if (ret) { + mutex_unlock(&codec->lock); + return ret; + } + + if (!mute && !stream) {/* start playback */ + ret = gb_audio_apbridgea_prepare_tx(data->connection, 0); + if (!ret) + ret = gb_audio_apbridgea_start_tx(data->connection, 0, 0); + params->state = GBAUDIO_CODEC_START; + } else if (!mute && stream) {/* start capture */ + ret = gb_audio_apbridgea_prepare_rx(data->connection, 0); + if (!ret) + ret = gb_audio_apbridgea_start_rx(data->connection, 0); + params->state = GBAUDIO_CODEC_START; + } else if (mute && !stream) {/* stop playback */ + ret = gb_audio_apbridgea_stop_tx(data->connection, 0); + if (!ret) + ret = gb_audio_apbridgea_shutdown_tx(data->connection, 0); + params->state = GBAUDIO_CODEC_STOP; + } else if (mute && stream) {/* stop capture */ + ret = gb_audio_apbridgea_stop_rx(data->connection, 0); + if (!ret) + ret = gb_audio_apbridgea_shutdown_rx(data->connection, 0); + params->state = GBAUDIO_CODEC_STOP; + } else { + ret = -EINVAL; + } + + if (ret) + dev_err_ratelimited(dai->dev, + "%s:Error during %s %s stream:%d\n", + module->name, mute ? "Mute" : "Unmute", + stream ? "Capture" : "Playback", ret); + + gb_pm_runtime_put_noidle(bundle); + mutex_unlock(&codec->lock); + return ret; +} + +static const struct snd_soc_dai_ops gbcodec_dai_ops = { + .startup = gbcodec_startup, + .shutdown = gbcodec_shutdown, + .hw_params = gbcodec_hw_params, + .prepare = gbcodec_prepare, + .mute_stream = gbcodec_mute_stream, +}; + +static struct snd_soc_dai_driver gbaudio_dai[] = { + { + .name = "apb-i2s0", + .id = 0, + .playback = { + .stream_name = "I2S 0 Playback", + .rates = SNDRV_PCM_RATE_48000, + .formats = SNDRV_PCM_FMTBIT_S16_LE, + .rate_max = 48000, + .rate_min = 48000, + .channels_min = 1, + .channels_max = 2, + .sig_bits = 16, + }, + .capture = { + .stream_name = "I2S 0 Capture", + .rates = SNDRV_PCM_RATE_48000, + .formats = SNDRV_PCM_FMTBIT_S16_LE, + .rate_max = 48000, + .rate_min = 48000, + .channels_min = 1, + .channels_max = 2, + .sig_bits = 16, + }, + .ops = &gbcodec_dai_ops, + }, +}; + +static int gbaudio_init_jack(struct gbaudio_module_info *module, + struct snd_soc_card *card) +{ + int ret; + struct gbaudio_jack *jack, *n; + struct snd_soc_jack_pin *headset, *button; + + if (!module->jack_mask) + return 0; + + snprintf(module->jack_name, NAME_SIZE, "GB %d Headset Jack", + module->dev_id); + + headset = devm_kzalloc(module->dev, sizeof(*headset), GFP_KERNEL); + if (!headset) + return -ENOMEM; + + headset->pin = module->jack_name; + headset->mask = module->jack_mask; + ret = snd_soc_card_jack_new_pins(card, module->jack_name, + module->jack_mask, + &module->headset.jack, headset, 1); + if (ret) { + dev_err(module->dev, "Failed to create new jack\n"); + return ret; + } + + /* Add to module's jack list */ + list_add(&module->headset.list, &module->jack_list); + + if (!module->button_mask) + return 0; + + snprintf(module->button_name, NAME_SIZE, "GB %d Button Jack", + module->dev_id); + button = devm_kzalloc(module->dev, sizeof(*button), GFP_KERNEL); + if (!button) { + ret = -ENOMEM; + goto free_jacks; + } + + button->pin = module->button_name; + button->mask = module->button_mask; + ret = snd_soc_card_jack_new_pins(card, module->button_name, + module->button_mask, + &module->button.jack, + button, 1); + if (ret) { + dev_err(module->dev, "Failed to create button jack\n"); + goto free_jacks; + } + + /* Add to module's jack list */ + list_add(&module->button.list, &module->jack_list); + + /* + * Currently, max 4 buttons are supported with following key mapping + * BTN_0 = KEY_MEDIA + * BTN_1 = KEY_VOICECOMMAND + * BTN_2 = KEY_VOLUMEUP + * BTN_3 = KEY_VOLUMEDOWN + */ + + if (module->button_mask & SND_JACK_BTN_0) { + ret = snd_jack_set_key(module->button.jack.jack, SND_JACK_BTN_0, + KEY_MEDIA); + if (ret) { + dev_err(module->dev, "Failed to set BTN_0\n"); + goto free_jacks; + } + } + + if (module->button_mask & SND_JACK_BTN_1) { + ret = snd_jack_set_key(module->button.jack.jack, SND_JACK_BTN_1, + KEY_VOICECOMMAND); + if (ret) { + dev_err(module->dev, "Failed to set BTN_1\n"); + goto free_jacks; + } + } + + if (module->button_mask & SND_JACK_BTN_2) { + ret = snd_jack_set_key(module->button.jack.jack, SND_JACK_BTN_2, + KEY_VOLUMEUP); + if (ret) { + dev_err(module->dev, "Failed to set BTN_2\n"); + goto free_jacks; + } + } + + if (module->button_mask & SND_JACK_BTN_3) { + ret = snd_jack_set_key(module->button.jack.jack, SND_JACK_BTN_3, + KEY_VOLUMEDOWN); + if (ret) { + dev_err(module->dev, "Failed to set BTN_0\n"); + goto free_jacks; + } + } + + /* FIXME + * verify if this is really required + set_bit(INPUT_PROP_NO_DUMMY_RELEASE, + module->button.jack.jack->input_dev->propbit); + */ + + return 0; + +free_jacks: + list_for_each_entry_safe(jack, n, &module->jack_list, list) { + snd_device_free(card->snd_card, jack->jack.jack); + list_del(&jack->list); + } + + return ret; +} + +int gbaudio_register_module(struct gbaudio_module_info *module) +{ + int ret; + struct snd_soc_component *comp; + struct snd_soc_dapm_context *dapm; + struct gbaudio_jack *jack = NULL; + + if (!gbcodec) { + dev_err(module->dev, "GB Codec not yet probed\n"); + return -EAGAIN; + } + + comp = gbcodec->component; + dapm = snd_soc_component_to_dapm(comp); + + mutex_lock(&gbcodec->register_mutex); + + if (module->num_dais) { + dev_err(gbcodec->dev, + "%d:DAIs not supported via gbcodec driver\n", + module->num_dais); + mutex_unlock(&gbcodec->register_mutex); + return -EINVAL; + } + + ret = gbaudio_init_jack(module, comp->card); + if (ret) { + mutex_unlock(&gbcodec->register_mutex); + return ret; + } + + if (module->dapm_widgets) + snd_soc_dapm_new_controls(dapm, module->dapm_widgets, + module->num_dapm_widgets); + if (module->controls) + snd_soc_add_component_controls(comp, module->controls, + module->num_controls); + if (module->dapm_routes) + snd_soc_dapm_add_routes(dapm, module->dapm_routes, + module->num_dapm_routes); + + /* card already instantiated, create widgets here only */ + if (comp->card->instantiated) { + gbaudio_dapm_link_component_dai_widgets(comp->card, dapm); +#ifdef CONFIG_SND_JACK + /* + * register jack devices for this module + * from codec->jack_list + */ + list_for_each_entry(jack, &module->jack_list, list) { + snd_device_register(comp->card->snd_card, + jack->jack.jack); + } +#endif + } + + mutex_lock(&gbcodec->lock); + list_add(&module->list, &gbcodec->module_list); + mutex_unlock(&gbcodec->lock); + + if (comp->card->instantiated) + ret = snd_soc_dapm_new_widgets(comp->card); + dev_dbg(comp->dev, "Registered %s module\n", module->name); + + mutex_unlock(&gbcodec->register_mutex); + return ret; +} +EXPORT_SYMBOL(gbaudio_register_module); + +static void gbaudio_codec_clean_data_tx(struct gbaudio_data_connection *data) +{ + u16 i2s_port, cportid; + int ret; + + if (list_is_singular(&gbcodec->module_list)) { + ret = gb_audio_apbridgea_stop_tx(data->connection, 0); + if (ret) + return; + ret = gb_audio_apbridgea_shutdown_tx(data->connection, 0); + if (ret) + return; + } + i2s_port = 0; /* fixed for now */ + cportid = data->connection->hd_cport_id; + ret = gb_audio_apbridgea_unregister_cport(data->connection, + i2s_port, cportid, + AUDIO_APBRIDGEA_DIRECTION_TX); + data->state[0] = GBAUDIO_CODEC_SHUTDOWN; +} + +static void gbaudio_codec_clean_data_rx(struct gbaudio_data_connection *data) +{ + u16 i2s_port, cportid; + int ret; + + if (list_is_singular(&gbcodec->module_list)) { + ret = gb_audio_apbridgea_stop_rx(data->connection, 0); + if (ret) + return; + ret = gb_audio_apbridgea_shutdown_rx(data->connection, 0); + if (ret) + return; + } + i2s_port = 0; /* fixed for now */ + cportid = data->connection->hd_cport_id; + ret = gb_audio_apbridgea_unregister_cport(data->connection, + i2s_port, cportid, + AUDIO_APBRIDGEA_DIRECTION_RX); + data->state[1] = GBAUDIO_CODEC_SHUTDOWN; +} + +static void gbaudio_codec_cleanup(struct gbaudio_module_info *module) +{ + struct gbaudio_data_connection *data; + int pb_state, cap_state; + + dev_dbg(gbcodec->dev, "%s: removed, cleanup APBridge\n", module->name); + list_for_each_entry(data, &module->data_list, list) { + pb_state = data->state[0]; + cap_state = data->state[1]; + + if (pb_state > GBAUDIO_CODEC_SHUTDOWN) + gbaudio_codec_clean_data_tx(data); + + if (cap_state > GBAUDIO_CODEC_SHUTDOWN) + gbaudio_codec_clean_data_rx(data); + } +} + +void gbaudio_unregister_module(struct gbaudio_module_info *module) +{ + struct snd_soc_component *comp = gbcodec->component; + struct gbaudio_jack *jack, *n; + int mask; + + dev_dbg(comp->dev, "Unregister %s module\n", module->name); + + mutex_lock(&gbcodec->register_mutex); + mutex_lock(&gbcodec->lock); + gbaudio_codec_cleanup(module); + list_del(&module->list); + dev_dbg(comp->dev, "Process Unregister %s module\n", module->name); + mutex_unlock(&gbcodec->lock); + +#ifdef CONFIG_SND_JACK + /* free jack devices for this module jack_list */ + list_for_each_entry_safe(jack, n, &module->jack_list, list) { + if (jack == &module->headset) + mask = GBCODEC_JACK_MASK; + else if (jack == &module->button) + mask = GBCODEC_JACK_BUTTON_MASK; + else + mask = 0; + if (mask) { + dev_dbg(module->dev, "Report %s removal\n", + jack->jack.jack->id); + snd_soc_jack_report(&jack->jack, 0, mask); + snd_device_free(comp->card->snd_card, + jack->jack.jack); + list_del(&jack->list); + } + } +#endif + + if (module->dapm_routes) { + struct snd_soc_dapm_context *dapm = snd_soc_component_to_dapm(comp); + + dev_dbg(comp->dev, "Removing %d routes\n", + module->num_dapm_routes); + snd_soc_dapm_del_routes(dapm, module->dapm_routes, + module->num_dapm_routes); + } + if (module->controls) { + dev_dbg(comp->dev, "Removing %d controls\n", + module->num_controls); + /* release control semaphore */ + gbaudio_remove_component_controls(comp, module->controls, + module->num_controls); + } + if (module->dapm_widgets) { + struct snd_soc_dapm_context *dapm = snd_soc_component_to_dapm(comp); + + dev_dbg(comp->dev, "Removing %d widgets\n", + module->num_dapm_widgets); + gbaudio_dapm_free_controls(dapm, module->dapm_widgets, + module->num_dapm_widgets); + } + + dev_dbg(comp->dev, "Unregistered %s module\n", module->name); + + mutex_unlock(&gbcodec->register_mutex); +} +EXPORT_SYMBOL(gbaudio_unregister_module); + +/* + * component driver ops + */ +static int gbcodec_probe(struct snd_soc_component *comp) +{ + int i; + struct gbaudio_codec_info *info; + struct gbaudio_codec_dai *dai; + + info = devm_kzalloc(comp->dev, sizeof(*info), GFP_KERNEL); + if (!info) + return -ENOMEM; + + info->dev = comp->dev; + INIT_LIST_HEAD(&info->module_list); + mutex_init(&info->lock); + mutex_init(&info->register_mutex); + INIT_LIST_HEAD(&info->dai_list); + + /* init dai_list used to maintain runtime stream info */ + for (i = 0; i < ARRAY_SIZE(gbaudio_dai); i++) { + dai = devm_kzalloc(comp->dev, sizeof(*dai), GFP_KERNEL); + if (!dai) + return -ENOMEM; + dai->id = gbaudio_dai[i].id; + list_add(&dai->list, &info->dai_list); + } + + info->component = comp; + snd_soc_component_set_drvdata(comp, info); + gbcodec = info; + + device_init_wakeup(comp->dev, 1); + return 0; +} + +static int gbcodec_write(struct snd_soc_component *comp, unsigned int reg, + unsigned int value) +{ + return 0; +} + +static unsigned int gbcodec_read(struct snd_soc_component *comp, + unsigned int reg) +{ + return 0; +} + +static const struct snd_soc_component_driver soc_codec_dev_gbaudio = { + .probe = gbcodec_probe, + .read = gbcodec_read, + .write = gbcodec_write, +}; + +#ifdef CONFIG_PM +static int gbaudio_codec_suspend(struct device *dev) +{ + dev_dbg(dev, "%s: suspend\n", __func__); + return 0; +} + +static int gbaudio_codec_resume(struct device *dev) +{ + dev_dbg(dev, "%s: resume\n", __func__); + return 0; +} + +static const struct dev_pm_ops gbaudio_codec_pm_ops = { + .suspend = gbaudio_codec_suspend, + .resume = gbaudio_codec_resume, +}; +#endif + +static int gbaudio_codec_probe(struct platform_device *pdev) +{ + return devm_snd_soc_register_component(&pdev->dev, + &soc_codec_dev_gbaudio, + gbaudio_dai, ARRAY_SIZE(gbaudio_dai)); +} + +static const struct of_device_id greybus_asoc_machine_of_match[] = { + { .compatible = "toshiba,apb-dummy-codec", }, + {}, +}; + +static struct platform_driver gbaudio_codec_driver = { + .driver = { + .name = "apb-dummy-codec", +#ifdef CONFIG_PM + .pm = &gbaudio_codec_pm_ops, +#endif + .of_match_table = greybus_asoc_machine_of_match, + }, + .probe = gbaudio_codec_probe, +}; +module_platform_driver(gbaudio_codec_driver); + +MODULE_DESCRIPTION("APBridge ALSA SoC dummy codec driver"); +MODULE_AUTHOR("Vaibhav Agarwal <vaibhav.agarwal(a)linaro.org>"); +MODULE_LICENSE("GPL v2"); +MODULE_ALIAS("platform:apb-dummy-codec"); -- 2.53.0

5 days, 9 hours

[PATCH] staging: greybus: camera: fix potential overflow in debugfs buffers

by contectforbusiness＠proton.me

The debugfs buffers in gb_camera (data[PAGE_SIZE], length) are written with sprintf without any bounds checking. The four places in gb_camera_debugfs_capabilities, gb_camera_debugfs_configure_streams and gb_camera_debugfs_flush do: buffer->length += sprintf(buffer->data + buffer->length, ...); buffer->length = sprintf(buffer->data, ...); If the formatted data ever grows (e.g., more streams, larger hex dump) or if length is already close to PAGE_SIZE, this will overrun the PAGE_SIZE buffer and corrupt memory. The driver is debugfs-only so the impact is limited, but it is still a real bug and the pattern is repeated in multiple places. Fix it by using scnprintf with the remaining size: scnprintf(buffer->data + buffer->length, PAGE_SIZE - buffer->length, ...) scnprintf(buffer->data, PAGE_SIZE, ...) This is the standard way to write to a fixed-size buffer in the kernel. It guarantees we never write past PAGE_SIZE and will truncate instead of overrunning, which is safe for debugfs output. The return value still accumulates in length, which matches the existing use with simple_read_from_buffer (it will just show truncated output rather than corrupting). I checked that this exact conversion has not been proposed before: the recent greybus conversions to sysfs_emit (light.c, gbphy.c) and fbtft/vme_tsi148 scnprintf patches do not touch camera.c at all, and a search of lore for "gb_camera_debugfs" shows no prior patch for these four sprintf sites. No functional change for normal sizes, just makes the code safe if the buffer ever fills up. Signed-off-by: Vaibhav Agarwal <contectforbusiness(a)proton.me> --- drivers/staging/greybus/camera.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/staging/greybus/camera.c b/drivers/staging/greybus/camera.c index 62b55bb28..efc83ceff 100644 --- a/drivers/staging/greybus/camera.c +++ b/drivers/staging/greybus/camera.c @@ -890,7 +890,8 @@ static ssize_t gb_camera_debugfs_capabilities(struct gb_camera *gcam, for (i = 0; i < size; i += 16) { unsigned int nbytes = min_t(unsigned int, size - i, 16); - buffer->length += sprintf(buffer->data + buffer->length, + buffer->length += scnprintf(buffer->data + buffer->length, + PAGE_SIZE - buffer->length, "%*ph\n", nbytes, caps + i); } @@ -973,12 +974,13 @@ static ssize_t gb_camera_debugfs_configure_streams(struct gb_camera *gcam, if (ret < 0) goto done; - buffer->length = sprintf(buffer->data, "%u;%u;", nstreams, flags); + buffer->length = scnprintf(buffer->data, PAGE_SIZE, "%u;%u;", nstreams, flags); for (i = 0; i < nstreams; ++i) { struct gb_camera_stream_config *stream = &streams[i]; - buffer->length += sprintf(buffer->data + buffer->length, + buffer->length += scnprintf(buffer->data + buffer->length, + PAGE_SIZE - buffer->length, "%u;%u;%u;%u;%u;%u;%u;", stream->width, stream->height, stream->format, stream->vc, @@ -1046,7 +1048,7 @@ static ssize_t gb_camera_debugfs_flush(struct gb_camera *gcam, if (ret < 0) return ret; - buffer->length = sprintf(buffer->data, "%u", req_id); + buffer->length = scnprintf(buffer->data, PAGE_SIZE, "%u", req_id); return len; }

5 days, 20 hours

[PATCH] staging: greybus: camera: Fix function declaration alignment

by S Tarun Kumar Lywait

Adhere to Linux kernel coding style. Reported by checkpatch: CHECK: Alignment should match open parenthesis Signed-off-by: S Tarun Kumar Lywait <tarun.k.lywait(a)gmail.com> --- drivers/staging/greybus/camera.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/staging/greybus/camera.c b/drivers/staging/greybus/camera.c index 62b55bb28408..9853bd60ff27 100644 --- a/drivers/staging/greybus/camera.c +++ b/drivers/staging/greybus/camera.c @@ -263,9 +263,10 @@ static int gb_camera_get_max_pkt_size(struct gb_camera *gcam, * Validate the stream configuration response verifying padding is correctly * set and the returned number of streams is supported */ -static const int gb_camera_configure_streams_validate_response(struct gb_camera *gcam, - struct gb_camera_configure_streams_response *resp, - unsigned int nstreams) +static const int gb_camera_configure_streams_validate_response + (struct gb_camera *gcam, + struct gb_camera_configure_streams_response *resp, + unsigned int nstreams) { unsigned int i; -- 2.47.3

5 days, 23 hours

[BUG] KASAN: slab-out-of-bounds Write in gb_hid_raw_request

by Farhad Alemi

Hello, We are reporting the following crash (reproducer and a proposed patch attached): Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713 Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1) [ 44.000772][ T804] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 44.163699][ T804] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 1.00 [ 44.169786][ T804] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.212054][ T12] greybus 1-svc: set power mode = 0 [ 44.212064][ T12] greybus 1-svc: power mode change failed on AP to switch link: -5 [ 44.213758][ C1] greybus greybus1: 0/0:0: short response 0x94 received (8 < 9) [ 44.215179][ T9337] greybus greybus1: 0/0:0: synchronous operation id 0x0003 of type 0x14 failed: -90 [ 44.215216][ T9337] greybus 1-svc: failed to get rail count: -90 [ 44.234071][ T9337] greybus 1-2.2: Interface added (greybus) [ 44.234080][ T9337] greybus 1-2.2: GMP VID=0x00000001, PID=0x00000001 [ 44.234087][ T9337] greybus 1-2.2: DDBL1 Manufacturer=0x00000126, Product=0x00000001 [ 44.256005][ T9337] hid-generic 0000:0001:0002.0001: hidraw0: <UNKNOWN> HID v1.11 Device [1-2.2.1 0001:0002] on [ 44.295710][ T9495] ================================================================== [ 44.295718][ T9495] BUG: KASAN: slab-out-of-bounds in gb_hid_raw_request+0x29c/0x860 [ 44.295741][ T9495] Write of size 2 at addr ffff88810d471a0a by task repro/9495 [ 44.295747][ T9495] [ 44.295758][ T9495] CPU: 1 UID: 0 PID: 9495 Comm: repro Not tainted 7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full) [ 44.295767][ T9495] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014 [ 44.295775][ T9495] Call Trace: [ 44.295779][ T9495] <TASK> [ 44.295784][ T9495] dump_stack_lvl+0xe8/0x150 [ 44.295794][ T9495] print_address_description+0x55/0x1e0 [ 44.295802][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.295809][ T9495] print_report+0x58/0x70 [ 44.295815][ T9495] kasan_report+0x117/0x150 [ 44.295826][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.295834][ T9495] kasan_check_range+0x264/0x2c0 [ 44.295843][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.295849][ T9495] __asan_memcpy+0x40/0x70 [ 44.295858][ T9495] gb_hid_raw_request+0x29c/0x860 [ 44.295865][ T9495] ? __pfx_gb_hid_raw_request+0x10/0x10 [ 44.295873][ T9495] ? __hid_hw_raw_request+0xa7/0x140 [ 44.295883][ T9495] hidraw_send_report+0x2bf/0x540 [ 44.295892][ T9495] ? bpf_lsm_file_permission+0x9/0x20 [ 44.295901][ T9495] hidraw_write+0x91/0xd0 [ 44.295908][ T9495] ? __pfx_hidraw_write+0x10/0x10 [ 44.295916][ T9495] vfs_write+0x29a/0xb90 [ 44.295924][ T9495] ? __pfx_vfs_write+0x10/0x10 [ 44.295931][ T9495] ? __fget_files+0x2a/0x420 [ 44.295939][ T9495] ? __fget_files+0x2a/0x420 [ 44.295944][ T9495] ? __fget_files+0x3a0/0x420 [ 44.295950][ T9495] ? __fget_files+0x2a/0x420 [ 44.295958][ T9495] ksys_write+0x150/0x270 [ 44.295965][ T9495] ? __pfx_ksys_write+0x10/0x10 [ 44.295973][ T9495] do_syscall_64+0x155/0x510 [ 44.295984][ T9495] ? trace_irq_disable+0x3b/0x140 [ 44.295993][ T9495] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.296000][ T9495] ? clear_bhb_loop+0x30/0x80 [ 44.296007][ T9495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.296014][ T9495] RIP: 0033:0x4521d2 [ 44.296024][ T9495] Code: 08 0f 85 e1 df ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 48 89 e5 [ 44.296032][ T9495] RSP: 002b:00007ffcc5937968 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 44.296042][ T9495] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00000000004521d2 [ 44.296046][ T9495] RDX: 0000000000000002 RSI: 00007ffcc5937af6 RDI: 0000000000000004 [ 44.296051][ T9495] RBP: 00007ffcc5937990 R08: 0000000000000000 R09: 0000000000000000 [ 44.296055][ T9495] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcc5937c28 [ 44.296059][ T9495] R13: 00007ffcc5937c38 R14: 0000000000000002 R15: 00000000004cba40 [ 44.296066][ T9495] </TASK> [ 44.296068][ T9495] [ 44.296071][ T9495] Allocated by task 9495: [ 44.296075][ T9495] kasan_save_track+0x3e/0x80 [ 44.296082][ T9495] __kasan_kmalloc+0x93/0xb0 [ 44.296090][ T9495] __kmalloc_noprof+0x36f/0x720 [ 44.296097][ T9495] gb_operation_message_alloc+0x8c/0x280 [ 44.296104][ T9495] gb_operation_create_common+0xa9/0x650 [ 44.296111][ T9495] gb_operation_create_flags+0xa2/0x2d0 [ 44.296117][ T9495] gb_hid_raw_request+0x1e6/0x860 [ 44.296123][ T9495] hidraw_send_report+0x2bf/0x540 [ 44.296130][ T9495] hidraw_write+0x91/0xd0 [ 44.296137][ T9495] vfs_write+0x29a/0xb90 [ 44.296142][ T9495] ksys_write+0x150/0x270 [ 44.296148][ T9495] do_syscall_64+0x155/0x510 [ 44.296156][ T9495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.296162][ T9495] [ 44.296163][ T9495] The buggy address belongs to the object at ffff88810d471a00 [ 44.296163][ T9495] which belongs to the cache kmalloc-16 of size 16 [ 44.296170][ T9495] The buggy address is located 10 bytes inside of [ 44.296170][ T9495] allocated 11-byte region [ffff88810d471a00, ffff88810d471a0b) [ 44.296177][ T9495] [ 44.296179][ T9495] The buggy address belongs to the physical page: [ 44.296186][ T9495] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10d471 [ 44.296193][ T9495] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff) [ 44.296202][ T9495] page_type: f5(slab) [ 44.296212][ T9495] raw: 057ff00000000000 ffff88801b041640 dead000000000100 dead000000000122 [ 44.296217][ T9495] raw: 0000000000000000 0000000000800080 00000000f5000000 0000000000000000 [ 44.296220][ T9495] page dumped because: kasan: bad access detected [ 44.296226][ T9495] page_owner tracks the page as allocated [ 44.296229][ T9495] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 3657058998 [ 44.296240][ T9495] post_alloc_hook+0x1f9/0x250 [ 44.296247][ T9495] get_page_from_freelist+0x235a/0x23e0 [ 44.296255][ T9495] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 44.296262][ T9495] allocate_slab+0x7d/0x610 [ 44.296267][ T9495] refill_objects+0x2d6/0x350 [ 44.296272][ T9495] __pcs_replace_empty_main+0x2c9/0x6c0 [ 44.296281][ T9495] __kmalloc_noprof+0x48b/0x720 [ 44.296288][ T9495] usb_hcd_submit_urb+0x7a3/0x1b40 [ 44.296301][ T9495] usb_start_wait_urb+0x13f/0x5b0 [ 44.296308][ T9495] usb_control_msg+0x234/0x3e0 [ 44.296314][ T9495] hub_power_on+0x1b6/0x460 [ 44.296320][ T9495] hub_activate+0x345/0x1a80 [ 44.296327][ T9495] hub_probe+0x291e/0x3c10 [ 44.296334][ T9495] usb_probe_interface+0x71f/0xe00 [ 44.296342][ T9495] really_probe+0x267/0xaf0 [ 44.296366][ T9495] __driver_probe_device+0x1e2/0x350 [ 44.296372][ T9495] page_owner free stack trace missing [ 44.296375][ T9495] [ 44.296377][ T9495] Memory state around the buggy address: [ 44.296381][ T9495] ffff88810d471900: 00 04 fc fc 00 07 fc fc 00 00 fc fc 00 01 fc fc [ 44.296385][ T9495] ffff88810d471980: 00 01 fc fc 00 01 fc fc fa fb fc fc 00 01 fc fc [ 44.296389][ T9495] >ffff88810d471a00: 00 03 fc fc fa fb fc fc fa fb fc fc 00 01 fc fc [ 44.296393][ T9495] ^ [ 44.296396][ T9495] ffff88810d471a80: fa fb fc fc fa fb fc fc 00 00 fc fc 00 01 fc fc [ 44.296400][ T9495] ffff88810d471b00: 00 01 fc fc 00 01 fc fc 00 05 fc fc 00 05 fc fc [ 44.296404][ T9495] ================================================================== [ 44.297569][ T9495] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 44.352486][ T9495] CPU: 1 UID: 0 PID: 9495 Comm: repro Not tainted 7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full) [ 44.353650][ T9495] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014 [ 44.354609][ T9495] Call Trace: [ 44.354919][ T9495] <TASK> [ 44.355192][ T9495] vpanic+0x56d/0xa60 [ 44.355639][ T9495] ? __pfx_vpanic+0x10/0x10 [ 44.356061][ T9495] panic+0xc5/0xd0 [ 44.356407][ T9495] ? __pfx_panic+0x10/0x10 [ 44.356831][ T9495] ? preempt_schedule_thunk+0x16/0x40 [ 44.357323][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.357800][ T9495] ? preempt_schedule_thunk+0x16/0x40 [ 44.358291][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.358771][ T9495] check_panic_on_warn+0x89/0xb0 [ 44.359225][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.359702][ T9495] end_report+0x73/0x170 [ 44.360095][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.360566][ T9495] kasan_report+0x128/0x150 [ 44.360998][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.361471][ T9495] kasan_check_range+0x264/0x2c0 [ 44.361929][ T9495] ? gb_hid_raw_request+0x29c/0x860 [ 44.362430][ T9495] __asan_memcpy+0x40/0x70 [ 44.362863][ T9495] gb_hid_raw_request+0x29c/0x860 [ 44.363348][ T9495] ? __pfx_gb_hid_raw_request+0x10/0x10 [ 44.363865][ T9495] ? __hid_hw_raw_request+0xa7/0x140 [ 44.364348][ T9495] hidraw_send_report+0x2bf/0x540 [ 44.364825][ T9495] ? bpf_lsm_file_permission+0x9/0x20 [ 44.365314][ T9495] hidraw_write+0x91/0xd0 [ 44.365786][ T9495] ? __pfx_hidraw_write+0x10/0x10 [ 44.366245][ T9495] vfs_write+0x29a/0xb90 [ 44.366636][ T9495] ? __pfx_vfs_write+0x10/0x10 [ 44.367076][ T9495] ? __fget_files+0x2a/0x420 [ 44.367500][ T9495] ? __fget_files+0x2a/0x420 [ 44.367924][ T9495] ? __fget_files+0x3a0/0x420 [ 44.368352][ T9495] ? __fget_files+0x2a/0x420 [ 44.368791][ T9495] ksys_write+0x150/0x270 [ 44.369188][ T9495] ? __pfx_ksys_write+0x10/0x10 [ 44.369633][ T9495] do_syscall_64+0x155/0x510 [ 44.370063][ T9495] ? trace_irq_disable+0x3b/0x140 [ 44.370523][ T9495] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.371077][ T9495] ? clear_bhb_loop+0x30/0x80 [ 44.371509][ T9495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.372046][ T9495] RIP: 0033:0x4521d2 [ 44.372407][ T9495] Code: 08 0f 85 e1 df ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 48 89 e5 [ 44.374131][ T9495] RSP: 002b:00007ffcc5937968 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 44.374887][ T9495] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00000000004521d2 [ 44.375673][ T9495] RDX: 0000000000000002 RSI: 00007ffcc5937af6 RDI: 0000000000000004 [ 44.376381][ T9495] RBP: 00007ffcc5937990 R08: 0000000000000000 R09: 0000000000000000 [ 44.377101][ T9495] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcc5937c28 [ 44.377812][ T9495] R13: 00007ffcc5937c38 R14: 0000000000000002 R15: 00000000004cba40 [ 44.378522][ T9495] </TASK> [ 44.379100][ T9495] Kernel Offset: disabled [ 44.379644][ T9495] Rebooting in 86400 seconds.. Regards, SEFCOM Lab @ ASU

6 days, 8 hours

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

greybus-dev