February 2020 - Linux-stable-mirror

[PATCH] mtd: spi-nor: Fixup page size and map selection for S25FS-S

by Alexander A Sverdlin

From: Alexander Sverdlin <alexander.sverdlin(a)nokia.com> Spansion S25FS-S family has an issue in Basic Flash Parameter Table: DWORD-11 bits 7-4 specify write page size 512 bytes. In reality this is configurable in the non-volatile CR3NV register and even factory default configuration is "wrap at 256 bytes". So blind relying on BFPT breaks write operation on these Flashes. All this story is vendor-specific, so add the corresponding fixup hook which first restores the safe page size of 256 bytes from struct flash_info but checks is more performant 512 bytes configuration is active and adjusts the page_size accordingly. To read CR3V RDAR command is required which in turn requires addr width and read latency to be configured, which was not the case before. Setting these parameters is also later required for sector map selection, because: JESD216 allows "variable address length" and "variable latency" in Configuration Detection Command Descriptors, in other words "as-is". And they are still unset during Sector Map Parameter Table parsing, which led to "map_id" determined erroneously as 0 for, e.g. S25FS128S. New warning is added to catch the potential misconfiguration with other chips. Link: http://lists.infradead.org/pipermail/linux-mtd/2020-February/093950.html Link: http://lists.infradead.org/pipermail/linux-mtd/2018-December/085956.html Fixes: f384b352cbf0 ("mtd: spi-nor: parse Serial Flash Discoverable Parameters (SFDP) tables") Cc: stable(a)vger.kernel.org Signed-off-by: Alexander Sverdlin <alexander.sverdlin(a)nokia.com> --- Yes, this is a combination of two previously sent patches as it turned out, width/dummy quirk is necessary even earlier, during post_bfpt fixup. drivers/mtd/spi-nor/spi-nor.c | 132 +++++++++++++++++++++++++++++++++++++++++- include/linux/mtd/spi-nor.h | 11 ++++ 2 files changed, 141 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c index 1224247..1d0e2ef 100644 --- a/drivers/mtd/spi-nor/spi-nor.c +++ b/drivers/mtd/spi-nor/spi-nor.c @@ -2326,6 +2326,122 @@ static struct spi_nor_fixups gd25q256_fixups = { .default_init = gd25q256_default_init, }; +/* + * Return true if it was possible to read something known and non-zero with + * the probed parameters. struct spi_nor is updated in this case as well. + */ +static bool spi_nor_probe_width_and_dummy(struct spi_nor *nor, u8 width, + u8 dummy) +{ + u8 read_opcode = nor->read_opcode; + u8 savedw = nor->addr_width; + u8 savedd = nor->read_dummy; + int ret; + u8 buf; + + nor->addr_width = width; + nor->read_dummy = dummy; + nor->read_opcode = SPINOR_OP_RDAR; + ret = spi_nor_read_data(nor, SPINOR_REG_CR2V, 1, &buf); + nor->read_opcode = read_opcode; + + if (ret == 1 && (CR2V_RL(buf) == dummy) && + (!!(buf & CR2V_AL) == (width == 4))) + return true; + + nor->addr_width = savedw; + nor->read_dummy = savedd; + + return false; +} + +/* + * JESD216 allows to omit particular address length or latency specification in + * the header and at this point they are still unset, so we need some + * heuristics. One example is S25FS128S. + * + * It was observed that RDAR with incorrect parameters result in all-zeroes or + * all-ones reads. That's why probed dummy is limited to 14 and loops are built + * in a way to probe width 3 and 0 dummy bits last to avoid false-positive + * (refer to CR2 mapping). 8 dummy bits are probed on the first iteration. + */ +static void spi_nor_fixup_width_and_dummy(struct spi_nor *nor) +{ + u8 width_min = 3; + u8 width_max = 4; + u8 dummy_min = 0; + u8 dummy_max = 14; + u8 w, d; + + if (nor->addr_width && nor->read_dummy) + return; + + if (nor->addr_width) { + width_min = nor->addr_width; + width_max = nor->addr_width; + } + if (nor->read_dummy) { + dummy_min = nor->read_dummy; + dummy_max = nor->read_dummy; + } + + for (w = width_min; w <= width_max; ++w) + for (d = 8; d <= dummy_max; ++d) + if (d >= dummy_min && + spi_nor_probe_width_and_dummy(nor, w, d)) + return; + for (w = width_max; w >= width_min; --w) + for (d = 7; d >= dummy_min; --d) + if (d <= dummy_max && + spi_nor_probe_width_and_dummy(nor, w, d)) + return; +} + +/* Spansion S25FS-S SFDP workarounds */ +static int s25fs_s_post_bfpt_fixups(struct spi_nor *nor, + const struct sfdp_parameter_header *bfpt_header, + const struct sfdp_bfpt *bfpt, + struct spi_nor_flash_parameter *params) +{ + const struct flash_info *info = nor->info; + u8 read_opcode, buf; + int ret; + + /* + * RDAR command below requires nor->addr_width and nor->dummy correctly + * set. spi_nor_get_map_in_use() later requires them as well. + */ + spi_nor_fixup_width_and_dummy(nor); + + /* Default is safe */ + params->page_size = info->page_size; + + /* + * But is the chip configured for more performant 512 bytes write page + * size? + */ + read_opcode = nor->read_opcode; + + nor->read_opcode = SPINOR_OP_RDAR; + ret = spi_nor_read_data(nor, SPINOR_REG_CR3V, 1, &buf); + nor->read_opcode = read_opcode; + + switch (ret) { + case 0: + return -EIO; + case 1: + if (buf & CR3V_02H_V) + params->page_size = 512; + return 0; + } + + return ret; +} + +static const struct spi_nor_fixups s25fs_s_fixups = { + .post_bfpt = s25fs_s_post_bfpt_fixups, +}; + /* NOTE: double check command sets and memory organization when you add * more nor chips. This current list focusses on newer chips, which * have been converging on command sets which including JEDEC ID. @@ -2560,7 +2676,8 @@ static const struct flash_info spi_nor_ids[] = { SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ | USE_CLSR) }, { "s25fl128s1", INFO6(0x012018, 0x4d0180, 64 * 1024, 256, SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ | USE_CLSR) }, - { "s25fl256s0", INFO(0x010219, 0x4d00, 256 * 1024, 128, USE_CLSR) }, + { "s25fl256s0", INFO(0x010219, 0x4d00, 256 * 1024, 128, USE_CLSR) + .fixups = &s25fs_s_fixups, }, { "s25fl256s1", INFO(0x010219, 0x4d01, 64 * 1024, 512, SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ | USE_CLSR) }, { "s25fl512s", INFO6(0x010220, 0x4d0080, 256 * 1024, 256, SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ | @@ -2570,7 +2687,8 @@ static const struct flash_info spi_nor_ids[] = { { "s25sl12800", INFO(0x012018, 0x0300, 256 * 1024, 64, 0) }, { "s25sl12801", INFO(0x012018, 0x0301, 64 * 1024, 256, 0) }, { "s25fl129p0", INFO(0x012018, 0x4d00, 256 * 1024, 64, SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ | USE_CLSR) }, - { "s25fl129p1", INFO(0x012018, 0x4d01, 64 * 1024, 256, SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ | USE_CLSR) }, + { "s25fl129p1", INFO(0x012018, 0x4d01, 64 * 1024, 256, SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ | USE_CLSR) + .fixups = &s25fs_s_fixups, }, { "s25sl004a", INFO(0x010212, 0, 64 * 1024, 8, 0) }, { "s25sl008a", INFO(0x010213, 0, 64 * 1024, 16, 0) }, { "s25sl016a", INFO(0x010214, 0, 64 * 1024, 32, 0) }, @@ -3897,6 +4015,16 @@ static const u32 *spi_nor_get_map_in_use(struct spi_nor *nor, const u32 *smpt, nor->read_opcode = SMPT_CMD_OPCODE(smpt[i]); addr = smpt[i + 1]; + switch (nor->read_opcode) { + case SPINOR_OP_RDAR: + if (nor->read_dummy && nor->addr_width) + break; + dev_warn(nor->dev, "OP 0x%02x width %u dummy %u\n", + nor->read_opcode, nor->addr_width, + nor->read_dummy); + break; + } + err = spi_nor_read_raw(nor, addr, 1, buf); if (err) { ret = ERR_PTR(err); diff --git a/include/linux/mtd/spi-nor.h b/include/linux/mtd/spi-nor.h index de90724..1e21592 100644 --- a/include/linux/mtd/spi-nor.h +++ b/include/linux/mtd/spi-nor.h @@ -116,6 +116,7 @@ /* Used for Spansion flashes only. */ #define SPINOR_OP_BRWR 0x17 /* Bank register write */ #define SPINOR_OP_CLSR 0x30 /* Clear status register 1 */ +#define SPINOR_OP_RDAR 0x65 /* Read Any Register */ /* Used for Micron flashes only. */ #define SPINOR_OP_RD_EVCR 0x65 /* Read EVCR register */ @@ -152,6 +153,16 @@ #define SR2_QUAD_EN_BIT1 BIT(1) #define SR2_QUAD_EN_BIT7 BIT(7) +/* Used for Spansion flashes RDAR command only. */ +#define SPINOR_REG_CR2V 0x800003 +#define CR2V_AL BIT(7) /* Address Length */ +/* Read Latency */ +#define CR2V_RL_MASK GENMASK(3, 0) +#define CR2V_RL(_nbits) ((_nbits) & CR2V_RL_MASK) + +#define SPINOR_REG_CR3V 0x800004 +#define CR3V_02H_V BIT(4) /* Page Buffer Wrap */ + /* Supported SPI protocols */ #define SNOR_PROTO_INST_MASK GENMASK(23, 16) #define SNOR_PROTO_INST_SHIFT 16 -- 2.4.6

3 years, 12 months

7
14
0 0

[PATCH 4.14 00/65] 4.14.167-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.167 release. There are 65 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Fri, 24 Jan 2020 09:25:24 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.167-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.14.167-rc1 Stephan Gerhold <stephan(a)gerhold.net> regulator: ab8500: Remove SYSCLKREQ from enum ab8505_regulator_id Masami Hiramatsu <mhiramat(a)kernel.org> perf probe: Fix wrong address verification Bart Van Assche <bvanassche(a)acm.org> scsi: core: scsi_trace: Use get_unaligned_be*() Martin Wilck <mwilck(a)suse.com> scsi: qla2xxx: fix rports not being mark as lost in sync fabric scan Huacai Chen <chenhc(a)lemote.com> scsi: qla2xxx: Fix qla2x00_request_irqs() for MSI Bart Van Assche <bvanassche(a)acm.org> scsi: target: core: Fix a pr_debug() argument Pan Bian <bianpan2016(a)163.com> scsi: bnx2i: fix potential use after free Pan Bian <bianpan2016(a)163.com> scsi: qla4xxx: fix double free bug Dan Carpenter <dan.carpenter(a)oracle.com> scsi: esas2r: unlock on error in esas2r_nvram_read_direct() Jeff Mahoney <jeffm(a)suse.com> reiserfs: fix handling of -EOPNOTSUPP in reiserfs_for_each_xattr Sudeep Holla <sudeep.holla(a)arm.com> Revert "arm64: dts: juno: add dma-ranges property" Eric Dumazet <edumazet(a)google.com> tick/sched: Annotate lockless access to last_jiffies_update Johannes Berg <johannes.berg(a)intel.com> cfg80211: check for set_wiphy_params Christian Hewitt <christianshewitt(a)gmail.com> arm64: dts: meson-gxl-s905x-khadas-vim: fix gpio-keys-polled node Dan Carpenter <dan.carpenter(a)oracle.com> cw1200: Fix a signedness bug in cw1200_load_firmware() Nathan Chancellor <natechancellor(a)gmail.com> xen/blkfront: Adjust indentation in xlvbd_alloc_gendisk Pengcheng Yang <yangpc(a)wangsu.com> tcp: fix marked lost packets not being retransmitted Johan Hovold <johan(a)kernel.org> r8152: add missing endpoint sanity check Vladis Dronov <vdronov(a)redhat.com> ptp: free ptp device pin descriptors properly Colin Ian King <colin.king(a)canonical.com> net/wan/fsl_ucc_hdlc: fix out of bounds write on array utdm_info Eric Dumazet <edumazet(a)google.com> net: usb: lan78xx: limit size of local TSO packets Yonglong Liu <liuyonglong(a)huawei.com> net: hns: fix soft lockup when there is not enough memory Alexander Lobakin <alobakin(a)dlink.ru> net: dsa: tag_qca: fix doubled Tx statistics Mohammed Gamal <mgamal(a)redhat.com> hv_netvsc: Fix memory leak when removing rndis device Eric Dumazet <edumazet(a)google.com> macvlan: use skb_reset_mac_header() in macvlan_queue_xmit() Sven Eckelmann <sven(a)narfation.org> batman-adv: Fix DAT candidate selection on little endian systems Johan Hovold <johan(a)kernel.org> NFC: pn533: fix bulk-message timeout Florian Westphal <fw(a)strlen.de> netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct Cong Wang <xiyou.wangcong(a)gmail.com> netfilter: fix a use-after-free in mtype_destroy() Felix Fietkau <nbd(a)nbd.name> cfg80211: fix page refcount issue in A-MSDU decap Dinh Nguyen <dinguyen(a)kernel.org> arm64: dts: agilex/stratix10: fix pmu interrupt numbers Kirill A. Shutemov <kirill(a)shutemov.name> mm/huge_memory.c: thp: fix conflict of above-47bit hint address and PMD alignment Bharath Vedartham <linux.bhar(a)gmail.com> mm/huge_memory.c: make __thp_get_unmapped_area static Johan Hovold <johan(a)kernel.org> USB: serial: io_edgeport: handle unbound ports on URB completion John Ogness <john.ogness(a)linutronix.de> USB: serial: io_edgeport: use irqsave() in USB's complete callback Jose Abreu <Jose.Abreu(a)synopsys.com> net: stmmac: Enable 16KB buffer size Jose Abreu <Jose.Abreu(a)synopsys.com> net: stmmac: 16KB buffer must be 16 byte aligned Wen Yang <wenyang(a)linux.alibaba.com> mm/page-writeback.c: avoid potential division by zero in wb_min_max_ratio() Johannes Thumshirn <johannes.thumshirn(a)wdc.com> btrfs: fix memory leak in qgroup accounting Kirill A. Shutemov <kirill(a)shutemov.name> mm/shmem.c: thp, shmem: fix conflict of above-47bit hint address and PMD alignment Jin Yao <yao.jin(a)linux.intel.com> perf report: Fix incorrectly added dimensions as switch perf data file Yuya Fujita <fujita.yuya(a)fujitsu.com> perf hists: Fix variable name's inconsistency in hists__for_each() macro Ard Biesheuvel <ardb(a)kernel.org> x86/efistub: Disable paging at mixed mode entry Qian Cai <cai(a)lca.pw> x86/resctrl: Fix an imbalance in domain_remove_cpu() Keiya Nobuta <nobuta.keiya(a)fujitsu.com> usb: core: hub: Improved device recognition on remote wakeup Christian Brauner <christian.brauner(a)ubuntu.com> ptrace: reintroduce usage of subjective credentials in ptrace_has_cap() Dan Carpenter <dan.carpenter(a)oracle.com> scsi: mptfusion: Fix double fetch bug in ioctl Arnd Bergmann <arnd(a)arndb.de> scsi: fnic: fix invalid stack access Johan Hovold <johan(a)kernel.org> USB: serial: quatech2: handle unbound ports Johan Hovold <johan(a)kernel.org> USB: serial: keyspan: handle unbound ports Johan Hovold <johan(a)kernel.org> USB: serial: io_edgeport: add missing active-port sanity check Johan Hovold <johan(a)kernel.org> USB: serial: ch341: handle unbound port at reset_resume Johan Hovold <johan(a)kernel.org> USB: serial: suppress driver bind attributes Reinhard Speyerer <rspmn(a)arcor.de> USB: serial: option: add support for Quectel RM500Q in QDL mode Johan Hovold <johan(a)kernel.org> USB: serial: opticon: fix control-message timeouts Kristian Evensen <kristian.evensen(a)gmail.com> USB: serial: option: Add support for Quectel RM500Q Jerónimo Borque <jeronimo(a)borque.com.ar> USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx Lars Möllendorf <lars.moellendorf(a)plating.de> iio: buffer: align the size of scan bytes to size of the largest element Kishon Vijay Abraham I <kishon(a)ti.com> ARM: dts: am571x-idk: Fix gpios property to have the correct gpio number Mikulas Patocka <mpatocka(a)redhat.com> block: fix an integer overflow in logical block size Jari Ruusu <jari.ruusu(a)gmail.com> Fix built-in early-load Intel microcode alignment Takashi Iwai <tiwai(a)suse.de> ALSA: seq: Fix racy access for queue timer in proc read Stephan Gerhold <stephan(a)gerhold.net> ASoC: msm8916-wcd-analog: Fix selected events for MIC BIAS External1 Guenter Roeck <linux(a)roeck-us.net> clk: Don't try to enable critical clocks if prepare failed Martin Blumenstingl <martin.blumenstingl(a)googlemail.com> dt-bindings: reset: meson8b: fix duplicate reset IDs ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/am571x-idk.dts | 2 +- arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi | 8 +- .../dts/amlogic/meson-gxl-s905x-khadas-vim.dts | 4 +- arch/arm64/boot/dts/arm/juno-base.dtsi | 1 - arch/x86/boot/compressed/head_64.S | 5 + arch/x86/kernel/cpu/intel_rdt.c | 2 +- block/blk-settings.c | 2 +- drivers/block/xen-blkfront.c | 4 +- drivers/clk/clk.c | 10 +- drivers/iio/industrialio-buffer.c | 6 +- drivers/md/dm-snap-persistent.c | 2 +- drivers/md/raid0.c | 2 +- drivers/message/fusion/mptctl.c | 213 +++++---------------- drivers/net/ethernet/hisilicon/hns/hns_enet.c | 4 +- drivers/net/ethernet/stmicro/stmmac/common.h | 5 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 +- drivers/net/hyperv/rndis_filter.c | 2 - drivers/net/macvlan.c | 5 +- drivers/net/usb/lan78xx.c | 1 + drivers/net/usb/r8152.c | 3 + drivers/net/wan/fsl_ucc_hdlc.c | 2 +- drivers/net/wireless/st/cw1200/fwio.c | 6 +- drivers/nfc/pn533/usb.c | 2 +- drivers/ptp/ptp_clock.c | 4 +- drivers/scsi/bnx2i/bnx2i_iscsi.c | 2 +- drivers/scsi/esas2r/esas2r_flash.c | 1 + drivers/scsi/fnic/vnic_dev.c | 20 +- drivers/scsi/qla2xxx/qla_init.c | 6 +- drivers/scsi/qla2xxx/qla_isr.c | 6 +- drivers/scsi/qla4xxx/ql4_mbx.c | 3 - drivers/scsi/scsi_trace.c | 113 ++++------- drivers/target/target_core_fabric_lib.c | 2 +- drivers/usb/core/hub.c | 1 + drivers/usb/serial/ch341.c | 6 +- drivers/usb/serial/io_edgeport.c | 33 ++-- drivers/usb/serial/keyspan.c | 4 + drivers/usb/serial/opticon.c | 2 +- drivers/usb/serial/option.c | 6 + drivers/usb/serial/quatech2.c | 6 + drivers/usb/serial/usb-serial-simple.c | 2 + drivers/usb/serial/usb-serial.c | 3 + firmware/Makefile | 2 +- fs/btrfs/qgroup.c | 6 +- fs/reiserfs/xattr.c | 8 +- include/dt-bindings/reset/amlogic,meson8b-reset.h | 6 +- include/linux/blkdev.h | 8 +- include/linux/regulator/ab8500.h | 2 - kernel/ptrace.c | 15 +- kernel/time/tick-sched.c | 14 +- mm/huge_memory.c | 38 ++-- mm/page-writeback.c | 4 +- mm/shmem.c | 7 +- net/batman-adv/distributed-arp-table.c | 4 +- net/dsa/tag_qca.c | 3 - net/ipv4/netfilter/arp_tables.c | 19 +- net/ipv4/tcp_input.c | 7 +- net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +- net/wireless/rdev-ops.h | 4 + net/wireless/util.c | 2 +- sound/core/seq/seq_timer.c | 14 +- sound/soc/codecs/msm8916-wcd-analog.c | 4 +- tools/perf/builtin-report.c | 5 +- tools/perf/util/hist.h | 4 +- tools/perf/util/probe-finder.c | 32 +--- 65 files changed, 320 insertions(+), 409 deletions(-)

4 years

6
72
0 0

[PATCH v2] drm/etnaviv: rework perfmon query infrastructure

by Christian Gmeiner

Report the correct perfmon domains and signals depending on the supported feature flags. Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com> Fixes: 9e2c2e273012 ("drm/etnaviv: add infrastructure to query perf counter") Cc: stable(a)vger.kernel.org Signed-off-by: Christian Gmeiner <christian.gmeiner(a)gmail.com> --- Changes V1 -> V2: - Handle domain == NULL case better to get rid of BUG_ON(..) usage. --- drivers/gpu/drm/etnaviv/etnaviv_perfmon.c | 59 ++++++++++++++++++++--- 1 file changed, 52 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c b/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c index 8adbf2861bff..e6795bafcbb9 100644 --- a/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c +++ b/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c @@ -32,6 +32,7 @@ struct etnaviv_pm_domain { }; struct etnaviv_pm_domain_meta { + unsigned int feature; const struct etnaviv_pm_domain *domains; u32 nr_domains; }; @@ -410,36 +411,78 @@ static const struct etnaviv_pm_domain doms_vg[] = { static const struct etnaviv_pm_domain_meta doms_meta[] = { { + .feature = chipFeatures_PIPE_3D, .nr_domains = ARRAY_SIZE(doms_3d), .domains = &doms_3d[0] }, { + .feature = chipFeatures_PIPE_2D, .nr_domains = ARRAY_SIZE(doms_2d), .domains = &doms_2d[0] }, { + .feature = chipFeatures_PIPE_VG, .nr_domains = ARRAY_SIZE(doms_vg), .domains = &doms_vg[0] } }; +static unsigned int num_pm_domains(const struct etnaviv_gpu *gpu) +{ + unsigned int num = 0, i; + + for (i = 0; i < ARRAY_SIZE(doms_meta); i++) { + const struct etnaviv_pm_domain_meta *meta = &doms_meta[i]; + + if (gpu->identity.features & meta->feature) + num += meta->nr_domains; + } + + return num; +} + +static const struct etnaviv_pm_domain *pm_domain(const struct etnaviv_gpu *gpu, + unsigned int index) +{ + const struct etnaviv_pm_domain *domain = NULL; + unsigned int offset = 0, i; + + for (i = 0; i < ARRAY_SIZE(doms_meta); i++) { + const struct etnaviv_pm_domain_meta *meta = &doms_meta[i]; + + if (!(gpu->identity.features & meta->feature)) + continue; + + if (meta->nr_domains < (index - offset)) { + offset += meta->nr_domains; + continue; + } + + domain = meta->domains + (index - offset); + } + + return domain; +} + int etnaviv_pm_query_dom(struct etnaviv_gpu *gpu, struct drm_etnaviv_pm_domain *domain) { - const struct etnaviv_pm_domain_meta *meta = &doms_meta[domain->pipe]; + const unsigned int nr_domains = num_pm_domains(gpu); const struct etnaviv_pm_domain *dom; - if (domain->iter >= meta->nr_domains) + if (domain->iter >= nr_domains) return -EINVAL; - dom = meta->domains + domain->iter; + dom = pm_domain(gpu, domain->iter); + if (!dom) + return -EINVAL; domain->id = domain->iter; domain->nr_signals = dom->nr_signals; strncpy(domain->name, dom->name, sizeof(domain->name)); domain->iter++; - if (domain->iter == meta->nr_domains) + if (domain->iter == nr_domains) domain->iter = 0xff; return 0; @@ -448,14 +491,16 @@ int etnaviv_pm_query_dom(struct etnaviv_gpu *gpu, int etnaviv_pm_query_sig(struct etnaviv_gpu *gpu, struct drm_etnaviv_pm_signal *signal) { - const struct etnaviv_pm_domain_meta *meta = &doms_meta[signal->pipe]; + const unsigned int nr_domains = num_pm_domains(gpu); const struct etnaviv_pm_domain *dom; const struct etnaviv_pm_signal *sig; - if (signal->domain >= meta->nr_domains) + if (signal->domain >= nr_domains) return -EINVAL; - dom = meta->domains + signal->domain; + dom = pm_domain(gpu, signal->domain); + if (!dom) + return -EINVAL; if (signal->iter >= dom->nr_signals) return -EINVAL; -- 2.24.1

4 years

4
3
0 0

[PATCH] drm: avoid spurious EBUSY due to nonblocking atomic modesets

by Daniel Vetter

When doing an atomic modeset with ALLOW_MODESET drivers are allowed to pull in arbitrary other resources, including CRTCs (e.g. when reconfiguring global resources). But in nonblocking mode userspace has then no idea this happened, which can lead to spurious EBUSY calls, both: - when that other CRTC is currently busy doing a page_flip the ALLOW_MODESET commit can fail with an EBUSY - on the other CRTC a normal atomic flip can fail with EBUSY because of the additional commit inserted by the kernel without userspace's knowledge For blocking commits this isn't a problem, because everyone else will just block until all the CRTC are reconfigured. Only thing userspace can notice is the dropped frames without any reason for why frames got dropped. Consensus is that we need new uapi to handle this properly, but no one has any idea what exactly the new uapi should look like. As a stop-gap plug this problem by demoting nonblocking commits which might cause issues by including CRTCs not in the original request to blocking commits. v2: Add comments and a WARN_ON to enforce this only when allowed - we don't want to silently convert page flips into blocking plane updates just because the driver is buggy. v3: Fix inverted WARN_ON (Pekka). References: https://lists.freedesktop.org/archives/dri-devel/2018-July/182281.html Bugzilla: https://gitlab.freedesktop.org/wayland/weston/issues/24#note_9568 Cc: Daniel Stone <daniel(a)fooishbar.org> Cc: Pekka Paalanen <pekka.paalanen(a)collabora.co.uk> Cc: stable(a)vger.kernel.org Reviewed-by: Daniel Stone <daniels(a)collabora.com> Signed-off-by: Daniel Vetter <daniel.vetter(a)intel.com> --- drivers/gpu/drm/drm_atomic.c | 34 +++++++++++++++++++++++++++++++--- 1 file changed, 31 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c index 9ccfbf213d72..4c035abf98b8 100644 --- a/drivers/gpu/drm/drm_atomic.c +++ b/drivers/gpu/drm/drm_atomic.c @@ -1362,15 +1362,43 @@ EXPORT_SYMBOL(drm_atomic_commit); int drm_atomic_nonblocking_commit(struct drm_atomic_state *state) { struct drm_mode_config *config = &state->dev->mode_config; - int ret; + unsigned requested_crtc = 0; + unsigned affected_crtc = 0; + struct drm_crtc *crtc; + struct drm_crtc_state *crtc_state; + bool nonblocking = true; + int ret, i; + + /* + * For commits that allow modesets drivers can add other CRTCs to the + * atomic commit, e.g. when they need to reallocate global resources. + * + * But when userspace also requests a nonblocking commit then userspace + * cannot know that the commit affects other CRTCs, which can result in + * spurious EBUSY failures. Until we have better uapi plug this by + * demoting such commits to blocking mode. + */ + for_each_new_crtc_in_state(state, crtc, crtc_state, i) + requested_crtc |= drm_crtc_mask(crtc); ret = drm_atomic_check_only(state); if (ret) return ret; - DRM_DEBUG_ATOMIC("committing %p nonblocking\n", state); + for_each_new_crtc_in_state(state, crtc, crtc_state, i) + affected_crtc |= drm_crtc_mask(crtc); + + if (affected_crtc != requested_crtc) { + /* adding other CRTC is only allowed for modeset commits */ + WARN_ON(!state->allow_modeset); + + DRM_DEBUG_ATOMIC("demoting %p to blocking mode to avoid EBUSY\n", state); + nonblocking = false; + } else { + DRM_DEBUG_ATOMIC("committing %p nonblocking\n", state); + } - return config->funcs->atomic_commit(state->dev, state, true); + return config->funcs->atomic_commit(state->dev, state, nonblocking); } EXPORT_SYMBOL(drm_atomic_nonblocking_commit); -- 2.24.1

4 years

2
5
0 0

[PATCH] libata: Return correct rc status in sata_pmp_eh_recover_pm() pwhen ATA_DFLAG_DETACH is set

by Kai-Heng Feng

During system resume from suspend, this can be observed on ASM1062 PMP controller: <6>[12007.593358] ata10.01: SATA link down (SStatus 0 SControl 330) <6>[12007.593469] ata10.02: hard resetting link <6>[12007.908353] ata10.02: SATA link down (SStatus 0 SControl 330) <6>[12007.911149] ata10.00: configured for UDMA/133 <0>[12007.972508] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: sata_pmp_eh_recover+0xa2b/0xa40 <0>[12007.972508] <4>[12007.972515] CPU: 2 PID: 230 Comm: scsi_eh_9 Tainted: P OE 4.15.0-46-generic #49-Ubuntu <4>[12007.972517] Hardware name: System manufacturer System Product Name/A320M-C, BIOS 1001 12/10/2017 <4>[12007.972518] Call Trace: <4>[12007.972525] dump_stack+0x63/0x8b <4>[12007.972530] panic+0xe4/0x244 <4>[12007.972533] ? sata_pmp_eh_recover+0xa2b/0xa40 <4>[12007.972536] __stack_chk_fail+0x19/0x20 <4>[12007.972538] sata_pmp_eh_recover+0xa2b/0xa40 <4>[12007.972543] ? ahci_do_softreset+0x260/0x260 [libahci] <4>[12007.972545] ? ahci_do_hardreset+0x140/0x140 [libahci] <4>[12007.972547] ? ata_phys_link_offline+0x60/0x60 <4>[12007.972549] ? ahci_stop_engine+0xc0/0xc0 [libahci] <4>[12007.972552] sata_pmp_error_handler+0x22/0x30 <4>[12007.972554] ahci_error_handler+0x45/0x80 [libahci] <4>[12007.972556] ata_scsi_port_error_handler+0x29b/0x770 <4>[12007.972558] ? ata_scsi_cmd_error_handler+0x101/0x140 <4>[12007.972559] ata_scsi_error+0x95/0xd0 <4>[12007.972562] ? scsi_try_target_reset+0x90/0x90 <4>[12007.972563] scsi_error_handler+0xd0/0x5b0 <4>[12007.972566] kthread+0x121/0x140 <4>[12007.972567] ? scsi_eh_get_sense+0x200/0x200 <4>[12007.972569] ? kthread_create_worker_on_cpu+0x70/0x70 <4>[12007.972572] ret_from_fork+0x22/0x40 <0>[12007.972591] Kernel Offset: 0xcc00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) Since sata_pmp_eh_recover_pmp() doens't set rc when ATA_DFLAG_DETACH is set, sata_pmp_eh_recover() continues to run. During retry it triggers the stack protector. Set correct rc in sata_pmp_eh_recover_pmp() to let sata_pmp_eh_recover() jump to pmp_fail directly. BugLink: https://bugs.launchpad.net/bugs/1821434 Cc: stable(a)vger.kernel.org Signed-off-by: Kai-Heng Feng <kai.heng.feng(a)canonical.com> --- drivers/ata/libata-pmp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c index 2ae1799f4992..51eeaea65833 100644 --- a/drivers/ata/libata-pmp.c +++ b/drivers/ata/libata-pmp.c @@ -764,6 +764,7 @@ static int sata_pmp_eh_recover_pmp(struct ata_port *ap, if (dev->flags & ATA_DFLAG_DETACH) { detach = 1; + rc = -ENODEV; goto fail; } -- 2.17.1

4 years

3
3
0 0

[PATCH] RISC-V: Move all address space definition macros to one place

by Atish Patra

If both CONFIG_KASAN and CONFIG_SPARSEMEM_VMEMMAP are set, we get the following compilation error. --------------------------------------------------------------- ./arch/riscv/include/asm/pgtable-64.h: In function ‘pud_page’: ./include/asm-generic/memory_model.h:54:29: error: ‘vmemmap’ undeclared (first use in this function); did you mean ‘mem_map’? #define __pfn_to_page(pfn) (vmemmap + (pfn)) ^~~~~~~ ./include/asm-generic/memory_model.h:82:21: note: in expansion of macro ‘__pfn_to_page’ #define pfn_to_page __pfn_to_page ^~~~~~~~~~~~~ ./arch/riscv/include/asm/pgtable-64.h:70:9: note: in expansion of macro ‘pfn_to_page’ return pfn_to_page(pud_val(pud) >> _PAGE_PFN_SHIFT); --------------------------------------------------------------- Fix the compliation errors by moving all the address space definition macros before including pgtable-64.h. Cc: stable(a)vger.kernel.org Fixes: 8ad8b72721d0 (riscv: Add KASAN support) Signed-off-by: Atish Patra <atish.patra(a)wdc.com> --- arch/riscv/include/asm/pgtable.h | 78 +++++++++++++++++--------------- 1 file changed, 41 insertions(+), 37 deletions(-) diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h index 453afb0a570a..4f6ee48a42e8 100644 --- a/arch/riscv/include/asm/pgtable.h +++ b/arch/riscv/include/asm/pgtable.h @@ -19,6 +19,47 @@ #include <asm/tlbflush.h> #include <linux/mm_types.h> +#ifdef CONFIG_MMU + +#define VMALLOC_SIZE (KERN_VIRT_SIZE >> 1) +#define VMALLOC_END (PAGE_OFFSET - 1) +#define VMALLOC_START (PAGE_OFFSET - VMALLOC_SIZE) + +#define BPF_JIT_REGION_SIZE (SZ_128M) +#define BPF_JIT_REGION_START (PAGE_OFFSET - BPF_JIT_REGION_SIZE) +#define BPF_JIT_REGION_END (VMALLOC_END) + +/* + * Roughly size the vmemmap space to be large enough to fit enough + * struct pages to map half the virtual address space. Then + * position vmemmap directly below the VMALLOC region. + */ +#define VMEMMAP_SHIFT \ + (CONFIG_VA_BITS - PAGE_SHIFT - 1 + STRUCT_PAGE_MAX_SHIFT) +#define VMEMMAP_SIZE BIT(VMEMMAP_SHIFT) +#define VMEMMAP_END (VMALLOC_START - 1) +#define VMEMMAP_START (VMALLOC_START - VMEMMAP_SIZE) + +/* + * Define vmemmap for pfn_to_page & page_to_pfn calls. Needed if kernel + * is configured with CONFIG_SPARSEMEM_VMEMMAP enabled. + */ +#define vmemmap ((struct page *)VMEMMAP_START) + +#define PCI_IO_SIZE SZ_16M +#define PCI_IO_END VMEMMAP_START +#define PCI_IO_START (PCI_IO_END - PCI_IO_SIZE) + +#define FIXADDR_TOP PCI_IO_START +#ifdef CONFIG_64BIT +#define FIXADDR_SIZE PMD_SIZE +#else +#define FIXADDR_SIZE PGDIR_SIZE +#endif +#define FIXADDR_START (FIXADDR_TOP - FIXADDR_SIZE) + +#endif + #ifdef CONFIG_64BIT #include <asm/pgtable-64.h> #else @@ -90,31 +131,6 @@ extern pgd_t swapper_pg_dir[]; #define __S110 PAGE_SHARED_EXEC #define __S111 PAGE_SHARED_EXEC -#define VMALLOC_SIZE (KERN_VIRT_SIZE >> 1) -#define VMALLOC_END (PAGE_OFFSET - 1) -#define VMALLOC_START (PAGE_OFFSET - VMALLOC_SIZE) - -#define BPF_JIT_REGION_SIZE (SZ_128M) -#define BPF_JIT_REGION_START (PAGE_OFFSET - BPF_JIT_REGION_SIZE) -#define BPF_JIT_REGION_END (VMALLOC_END) - -/* - * Roughly size the vmemmap space to be large enough to fit enough - * struct pages to map half the virtual address space. Then - * position vmemmap directly below the VMALLOC region. - */ -#define VMEMMAP_SHIFT \ - (CONFIG_VA_BITS - PAGE_SHIFT - 1 + STRUCT_PAGE_MAX_SHIFT) -#define VMEMMAP_SIZE BIT(VMEMMAP_SHIFT) -#define VMEMMAP_END (VMALLOC_START - 1) -#define VMEMMAP_START (VMALLOC_START - VMEMMAP_SIZE) - -/* - * Define vmemmap for pfn_to_page & page_to_pfn calls. Needed if kernel - * is configured with CONFIG_SPARSEMEM_VMEMMAP enabled. - */ -#define vmemmap ((struct page *)VMEMMAP_START) - static inline int pmd_present(pmd_t pmd) { return (pmd_val(pmd) & (_PAGE_PRESENT | _PAGE_PROT_NONE)); @@ -452,18 +468,6 @@ static inline int ptep_clear_flush_young(struct vm_area_struct *vma, #define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val(pte) }) #define __swp_entry_to_pte(x) ((pte_t) { (x).val }) -#define PCI_IO_SIZE SZ_16M -#define PCI_IO_END VMEMMAP_START -#define PCI_IO_START (PCI_IO_END - PCI_IO_SIZE) - -#define FIXADDR_TOP PCI_IO_START -#ifdef CONFIG_64BIT -#define FIXADDR_SIZE PMD_SIZE -#else -#define FIXADDR_SIZE PGDIR_SIZE -#endif -#define FIXADDR_START (FIXADDR_TOP - FIXADDR_SIZE) - /* * Task size is 0x4000000000 for RV64 or 0x9fc00000 for RV32. * Note that PGDIR_SIZE must evenly divide TASK_SIZE. -- 2.25.0

4 years, 1 month

6
6
0 0

[PATCH v2] mm/hugetlb: fix a addressing exception caused by huge_pte_offset()

by Longpeng(Mike)

From: Longpeng <longpeng2(a)huawei.com> Our machine encountered a panic(addressing exception) after run for a long time and the calltrace is: RIP: 0010:[<ffffffff9dff0587>] [<ffffffff9dff0587>] hugetlb_fault+0x307/0xbe0 RSP: 0018:ffff9567fc27f808 EFLAGS: 00010286 RAX: e800c03ff1258d48 RBX: ffffd3bb003b69c0 RCX: e800c03ff1258d48 RDX: 17ff3fc00eda72b7 RSI: 00003ffffffff000 RDI: e800c03ff1258d48 RBP: ffff9567fc27f8c8 R08: e800c03ff1258d48 R09: 0000000000000080 R10: ffffaba0704c22a8 R11: 0000000000000001 R12: ffff95c87b4b60d8 R13: 00005fff00000000 R14: 0000000000000000 R15: ffff9567face8074 FS: 00007fe2d9ffb700(0000) GS:ffff956900e40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffd3bb003b69c0 CR3: 000000be67374000 CR4: 00000000003627e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: [<ffffffff9df9b71b>] ? unlock_page+0x2b/0x30 [<ffffffff9dff04a2>] ? hugetlb_fault+0x222/0xbe0 [<ffffffff9dff1405>] follow_hugetlb_page+0x175/0x540 [<ffffffff9e15b825>] ? cpumask_next_and+0x35/0x50 [<ffffffff9dfc7230>] __get_user_pages+0x2a0/0x7e0 [<ffffffff9dfc648d>] __get_user_pages_unlocked+0x15d/0x210 [<ffffffffc068cfc5>] __gfn_to_pfn_memslot+0x3c5/0x460 [kvm] [<ffffffffc06b28be>] try_async_pf+0x6e/0x2a0 [kvm] [<ffffffffc06b4b41>] tdp_page_fault+0x151/0x2d0 [kvm] [<ffffffffc075731c>] ? vmx_vcpu_run+0x2ec/0xc80 [kvm_intel] [<ffffffffc0757328>] ? vmx_vcpu_run+0x2f8/0xc80 [kvm_intel] [<ffffffffc06abc11>] kvm_mmu_page_fault+0x31/0x140 [kvm] [<ffffffffc074d1ae>] handle_ept_violation+0x9e/0x170 [kvm_intel] [<ffffffffc075579c>] vmx_handle_exit+0x2bc/0xc70 [kvm_intel] [<ffffffffc074f1a0>] ? __vmx_complete_interrupts.part.73+0x80/0xd0 [kvm_intel] [<ffffffffc07574c0>] ? vmx_vcpu_run+0x490/0xc80 [kvm_intel] [<ffffffffc069f3be>] vcpu_enter_guest+0x7be/0x13a0 [kvm] [<ffffffffc06cf53e>] ? kvm_check_async_pf_completion+0x8e/0xb0 [kvm] [<ffffffffc06a6f90>] kvm_arch_vcpu_ioctl_run+0x330/0x490 [kvm] [<ffffffffc068d919>] kvm_vcpu_ioctl+0x309/0x6d0 [kvm] [<ffffffff9deaa8c2>] ? dequeue_signal+0x32/0x180 [<ffffffff9deae34d>] ? do_sigtimedwait+0xcd/0x230 [<ffffffff9e03aed0>] do_vfs_ioctl+0x3f0/0x540 [<ffffffff9e03b0c1>] SyS_ioctl+0xa1/0xc0 [<ffffffff9e53879b>] system_call_fastpath+0x22/0x27 ( The kernel we used is older, but we think the latest kernel also has this bug after dig into this problem. ) For 1G hugepages, huge_pte_offset() wants to return NULL or pudp, but it may return a wrong 'pmdp' if there is a race. Please look at the following code snippet: ... pud = pud_offset(p4d, addr); if (sz != PUD_SIZE && pud_none(*pud)) return NULL; /* hugepage or swap? */ if (pud_huge(*pud) || !pud_present(*pud)) return (pte_t *)pud; pmd = pmd_offset(pud, addr); if (sz != PMD_SIZE && pmd_none(*pmd)) return NULL; /* hugepage or swap? */ if (pmd_huge(*pmd) || !pmd_present(*pmd)) return (pte_t *)pmd; ... The following sequence would trigger this bug: 1. CPU0: sz = PUD_SIZE and *pud = 0 , continue 1. CPU0: "pud_huge(*pud)" is false 2. CPU1: calling hugetlb_no_page and set *pud to xxxx8e7(PRESENT) 3. CPU0: "!pud_present(*pud)" is false, continue 4. CPU0: pmd = pmd_offset(pud, addr) and maybe return a wrong pmdp However, we want CPU0 to return NULL or pudp. We can avoid this race by read the pud only once. What's more, we also use READ_ONCE to access the entries for safe(e.g. avoid the compilier mischief) Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Sean Christopherson <sean.j.christopherson(a)intel.com> Cc: Mike Kravetz <mike.kravetz(a)oracle.com> Cc: stable(a)vger.kernel.org Signed-off-by: Longpeng <longpeng2(a)huawei.com> --- v1 -> v2: - avoid renaming [Matthew, Mike] --- mm/hugetlb.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index dd8737a..90daf37 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -4910,28 +4910,30 @@ pte_t *huge_pte_offset(struct mm_struct *mm, { pgd_t *pgd; p4d_t *p4d; - pud_t *pud; - pmd_t *pmd; + pud_t *pud, pud_entry; + pmd_t *pmd, pmd_entry; pgd = pgd_offset(mm, addr); - if (!pgd_present(*pgd)) + if (!pgd_present(READ_ONCE(*pgd))) return NULL; p4d = p4d_offset(pgd, addr); - if (!p4d_present(*p4d)) + if (!p4d_present(READ_ONCE(*p4d))) return NULL; pud = pud_offset(p4d, addr); - if (sz != PUD_SIZE && pud_none(*pud)) + pud_entry = READ_ONCE(*pud); + if (sz != PUD_SIZE && pud_none(pud_entry)) return NULL; /* hugepage or swap? */ - if (pud_huge(*pud) || !pud_present(*pud)) + if (pud_huge(pud_entry) || !pud_present(pud_entry)) return (pte_t *)pud; pmd = pmd_offset(pud, addr); - if (sz != PMD_SIZE && pmd_none(*pmd)) + pmd_entry = READ_ONCE(*pmd); + if (sz != PMD_SIZE && pmd_none(pmd_entry)) return NULL; /* hugepage or swap? */ - if (pmd_huge(*pmd) || !pmd_present(*pmd)) + if (pmd_huge(pmd_entry) || !pmd_present(pmd_entry)) return (pte_t *)pmd; return NULL; -- 1.8.3.1

4 years, 1 month

5
18
0 0

Re: [PATCH v2] mm/hugetlb: fix a addressing exception caused by huge_pte_offset()

by Qian Cai

> On Feb 21, 2020, at 10:34 PM, Longpeng(Mike) <longpeng2(a)huawei.com> wrote: > > diff --git a/mm/hugetlb.c b/mm/hugetlb.c > index dd8737a..90daf37 100644 > --- a/mm/hugetlb.c > +++ b/mm/hugetlb.c > @@ -4910,28 +4910,30 @@ pte_t *huge_pte_offset(struct mm_struct *mm, > { > pgd_t *pgd; > p4d_t *p4d; > - pud_t *pud; > - pmd_t *pmd; > + pud_t *pud, pud_entry; > + pmd_t *pmd, pmd_entry; > > pgd = pgd_offset(mm, addr); > - if (!pgd_present(*pgd)) > + if (!pgd_present(READ_ONCE(*pgd))) > return NULL; > p4d = p4d_offset(pgd, addr); > - if (!p4d_present(*p4d)) > + if (!p4d_present(READ_ONCE(*p4d))) > return NULL; What’s the point of READ_ONCE() on those two places?

4 years, 1 month

5
6
0 0

[PATCH] bonding: do not enslave CAN devices

by Oliver Hartkopp

Since commit 8df9ffb888c ("can: make use of preallocated can_ml_priv for per device struct can_dev_rcv_lists") the device specific CAN receive filter lists are stored in netdev_priv() and dev->ml_priv points to these filters. In the bug report Syzkaller enslaved a vxcan1 CAN device and accessed the bonding device with a PF_CAN socket which lead to a crash due to an access of an unhandled bond_dev->ml_priv pointer. Deny to enslave CAN devices by the bonding driver as the resulting bond_dev pretends to be a CAN device by copying dev->type without really being one. Reported-by: syzbot+c3ea30e1e2485573f953(a)syzkaller.appspotmail.com Fixes: 8df9ffb888c ("can: make use of preallocated can_ml_priv for per device struct can_dev_rcv_lists") Cc: linux-stable <stable(a)vger.kernel.org> # >= v5.4 Signed-off-by: Oliver Hartkopp <socketcan(a)hartkopp.net> --- drivers/net/bonding/bond_main.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index 48d5ec770b94..4b781a7dfd96 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -1475,6 +1475,18 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev, return -EPERM; } + /* CAN network devices hold device specific filter lists in + * netdev_priv() where dev->ml_priv sets a reference to. + * As bonding assumes to have some ethernet-like device it doesn't + * take care about these CAN specific filter lists today. + * So we deny the enslaving of CAN interfaces here. + */ + if (slave_dev->type == ARPHRD_CAN) { + NL_SET_ERR_MSG(extack, "CAN devices can not be enslaved"); + slave_err(bond_dev, slave_dev, "no bonding on CAN devices\n"); + return -EINVAL; + } + /* set bonding device ether type by slave - bonding netdevices are * created with ether_setup, so when the slave type is not ARPHRD_ETHER * there is a need to override some of the type dependent attribs/funcs. -- 2.20.1

4 years, 1 month

6
13
0 0

[PATCH v2 1/2] clk: ingenic/jz4770: Exit with error if CGU init failed

by Paul Cercueil

Exit jz4770_cgu_init() if the 'cgu' pointer we get is NULL, since the pointer is passed as argument to functions later on. Fixes: 7a01c19007ad ("clk: Add Ingenic jz4770 CGU driver") Cc: stable(a)vger.kernel.org Signed-off-by: Paul Cercueil <paul(a)crapouillou.net> Reported-by: kbuild test robot <lkp(a)intel.com> Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com> --- Notes: v2: Added Fixes: tag drivers/clk/ingenic/jz4770-cgu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/clk/ingenic/jz4770-cgu.c b/drivers/clk/ingenic/jz4770-cgu.c index 956dd653a43d..c051ecba5cf8 100644 --- a/drivers/clk/ingenic/jz4770-cgu.c +++ b/drivers/clk/ingenic/jz4770-cgu.c @@ -432,8 +432,10 @@ static void __init jz4770_cgu_init(struct device_node *np) cgu = ingenic_cgu_new(jz4770_cgu_clocks, ARRAY_SIZE(jz4770_cgu_clocks), np); - if (!cgu) + if (!cgu) { pr_err("%s: failed to initialise CGU\n", __func__); + return; + } retval = ingenic_cgu_register_clocks(cgu); if (retval) -- 2.25.0

4 years, 1 month

2
3
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror February 2020