mvebu dt64 for 5.4 (part 1)
- Add mailbox support on Armada 37xx
- Add cpu clock node needed for CPU freq on Armada 7K/8K
- Enhance CP110 COMPHY support used by PCIe, USB3 and SATA
* tag 'mvebu-dt64-5.4-1' of git://git.infradead.org/linux-mvebu:
arm64: dts: marvell: Add cpu clock node on Armada 7K/8K
arm64: dts: marvell: Convert 7k/8k usb-phy properties to phy-supply
arm64: dts: marvell: Add 7k/8k PHYs in PCIe nodes
arm64: dts: marvell: Add 7k/8k PHYs in USB3 nodes
arm64: dts: marvell: Add 7k/8k per-port PHYs in SATA nodes
arm64: dts: marvell: Add CP110 COMPHY clocks
arm64: dts: marvell: armada-37xx: add mailbox node
Link: https://lore.kernel.org/r/875zmhzjml.fsf@FE-laptop
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
mvebu dt for 5.4 (part 1)
- Disable the kirkwood RTC that doesn't work on the ts219 board
* tag 'mvebu-dt-5.4-1' of git://git.infradead.org/linux-mvebu:
ARM: dts: kirkwood: ts219: disable the SoC's RTC
Link: https://lore.kernel.org/r/878srdzjpj.fsf@FE-laptop
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
i.MX arm32 device tree changes for 5.4:
- New board support: ZII i.MX7 RMU2, Kontron i.MX6UL N6310, and
PHYTEC phyBOARD-Segin based on i.MX6ULL.
- A series from Andrey Smirnov to update vf610-zii boards on I2C
pinmux, switch watchdog, GPIO expander IRQ.
- Move GIC node into soc node for i.MX6 SoCs.
- Add OV5645 camera support for imx6qdl-wandboard board.
- Drop unneeded snvs_pwrkey node for imx7d-zii-rpu2 and imx7-colibri.
- Use simple-mfd instead of simple-bus for i.MX6 ANATOP.
- Move the native-mode property inside the display-timings node for
various i.MX25 and i.MX27 boards.
- Add EDMA devices for i.MX7ULP SoC.
- A series from Stefan Riedmueller to update imx6ul-phytec-segin board
on various devices.
- Use OF graph to describe the display for opos6uldev board.
- Misc random updates on i.MX7/6 boards.
* tag 'imx-dt-5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: (53 commits)
ARM: dts: vf610-zii-scu4-aib: Configure IRQ line for GPIO expander
ARM: dts: imx6ul-kontron-n6310: Add Kontron i.MX6UL N6310 SoM and boards
ARM: dts: vf610-zii-cfu1: Slow I2C0 down to 100 kHz
ARM: dts: pbab01: correct rtc vendor
ARM: vf610-zii-cfu1: Add node for switch watchdog
ARM: dts: imx6: drop gpmi-nand address and size cells
ARM: dts: imx6: replace simple-bus by simple-mfd for anatop
ARM: dts: imx6qdl-colibri: add phy to fec
ARM: dts: imx7-colibri: add recovery for I2C for iMX7
ARM: dts: imx7-colibri: Add sleep pinctrl to ethernet
ARM: dts: imx7-colibri: prepare module device tree for FlexCAN
ARM: dts: imx7-colibri: disable HS400
ARM: dts: imx7-colibri: make sure module supplies are always on
ARM: dts: imx7d: cl-som-imx7: add compatible for phy
ARM: dts: imx7d: cl-som-imx7: make ethernet work again
ARM: dts: imx6ul: Add csi node
ARM: dts: imx25: mbimxsd25: native-mode is part of display-timings
ARM: dts: apf27dev: native-mode is part of display-timings
ARM: dts: edb7211: native-mode is part of display-timings
ARM: dts: imx27-phytec-phycore-rdk: native-mode is part of display-timings
...
Link: https://lore.kernel.org/r/20190825153237.28829-5-shawnguo@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
The race was when a thread using closure_sync() notices cl->s->done == 1
before the thread calling closure_put() calls wake_up_process(). Then,
it's possible for that thread to return and exit just before
wake_up_process() is called - so we're trying to wake up a process that
no longer exists.
rcu_read_lock() is sufficient to protect against this, as there's an rcu
barrier somewhere in the process teardown path.
Signed-off-by: Kent Overstreet <kent.overstreet@gmail.com>
Acked-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
The copy_to_user() function returns the number of bytes remaining to be
copied, but the intention here was to return -EFAULT if the copy fails.
Fixes: cafe563591 ("bcache: A block layer cache")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Coly Li <colyli@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
i.MX device tree update with new clocks:
- A series from Anson Huang to add i.MX8MN SoC and DDR4 EVK board
device tree support.
- Add DSP device tree support for i.MX8QXP SoC.
* tag 'imx-dt-clkdep-5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
arm64: dts: imx8qxp: Add DSP DT node
arm64: dts: imx8mn: Add cpu-freq support
arm64: dts: imx8mn-ddr4-evk: Add rohm,bd71847 PMIC support
arm64: dts: imx8mn-ddr4-evk: Add i2c1 support
arm64: dts: freescale: Add i.MX8MN DDR4 EVK board support
arm64: dts: imx8mn: Add gpio-ranges property
arm64: dts: freescale: Add i.MX8MN dtsi support
clk: imx8: Add DSP related clocks
clk: imx: Add support for i.MX8MN clock driver
clk: imx: Add API for clk unregister when driver probe fail
clk: imx8mm: Make 1416X/1443X PLL macro definitions common for usage
dt-bindings: imx: Add clock binding doc for i.MX8MN
Link: https://lore.kernel.org/r/20190825153237.28829-4-shawnguo@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
This argument was not being considered since blk-mq was set by default,
so removed this documentation to avoid confusion.
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>
.txt file is now .rst
Signed-off-by: Jens Axboe <axboe@kernel.dk>
gpio: updates for v5.4
- use a helper variable for &pdev->dev in gpio-em
- tweak the ifdefs in GPIO headers
- fix function links in HTML docs
- remove an unneeded error message from ixp4xx
- use the optional clk_get in gpio-mxc instead of checking the return value
- a couple improvements in pca953x
- allow to build gpio-lpc32xx on non-lpc32xx targets
This argument was ignored since blk-mq was set as default, so remove it
from documentation.
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>
.txt file is now .rst
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Since the inclusion of blk-mq, elevator argument was not being
considered anymore, and it's utility died long with the legacy IO path,
now removed too.
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Bob Liu <bob.liu@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>
Fold with doc removal patch.
Signed-off-by: Jens Axboe <axboe@kernel.dk>
dts changes for omap variants for v5.4
Remove regulator-boot-off properties that we never had in the mainline
kernel so they won't do anything. We add stdout-path for gta04, and
make am335x-boneblue use am335x-osd335x-common.dtsi file.
* tag 'omap-for-v5.4/dt-take2-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
ARM: dts: am335x-boneblue: Use of am335x-osd335x-common.dtsi
ARM: dts: gta04: define chosen/stdout-path
ARM: dts: omap3-n950-n9: Remove regulator-boot-off property
ARM: dts: am335x-cm-t335: Remove regulator-boot-off property
Link: https://lore.kernel.org/r/pull-1566599057-142651@atomide.com-2
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
There are bugs on vhci with usb 3.0 storage device. In USB, each SG
list entry buffer should be divisible by the bulk max packet size.
But with native SG support, this problem doesn't matter because the
SG buffer is treated as contiguous buffer. But without native SG
support, USB storage driver breaks SG list into several URBs and the
error occurs because of a buffer size of URB that cannot be divided
by the bulk max packet size. The error situation is as follows.
When USB Storage driver requests 31.5 KB data and has SG list which
has 3584 bytes buffer followed by 7 4096 bytes buffer for some
reason. USB Storage driver splits this SG list into several URBs
because VHCI doesn't support SG and sends them separately. So the
first URB buffer size is 3584 bytes. When receiving data from device,
USB 3.0 device sends data packet of 1024 bytes size because the max
packet size of BULK pipe is 1024 bytes. So device sends 4096 bytes.
But the first URB buffer has only 3584 bytes buffer size. So host
controller terminates the transfer even though there is more data to
receive. So, vhci needs to support SG transfer to prevent this error.
In this patch, vhci supports SG regardless of whether the server's
host controller supports SG or not, because stub driver splits SG
list into several URBs if the server's host controller doesn't
support SG.
To support SG, vhci sets URB_DMA_MAP_SG flag in urb->transfer_flags
if URB has SG list and this flag will tell stub driver to use SG
list. After receiving urb from stub driver, vhci clear URB_DMA_MAP_SG
flag to avoid unnecessary DMA unmapping in HCD.
vhci sends each SG list entry to stub driver. Then, stub driver sees
the total length of the buffer and allocates SG table and pages
according to the total buffer length calling sgl_alloc(). After stub
driver receives completed URB, it again sends each SG list entry to
vhci.
If the server's host controller doesn't support SG, stub driver
breaks a single SG request into several URBs and submits them to
the server's host controller. When all the split URBs are completed,
stub driver reassembles the URBs into a single return command and
sends it to vhci.
Moreover, in the situation where vhci supports SG, but stub driver
does not, or vice versa, usbip works normally. Because there is no
protocol modification, there is no problem in communication between
server and client even if the one has a kernel without SG support.
In the case of vhci supports SG and stub driver doesn't, because
vhci sends only the total length of the buffer to stub driver as
it did before the patch applied, stub driver only needs to allocate
the required length of buffers using only kmalloc() regardless of
whether vhci supports SG or not. But stub driver has to allocate
buffer with kmalloc() as much as the total length of SG buffer which
is quite huge when vhci sends SG request, so it has overhead in
buffer allocation in this situation.
If stub driver needs to send data buffer to vhci because of IN pipe,
stub driver also sends only total length of buffer as metadata and
then sends real data as vhci does. Then vhci receive data from stub
driver and store it to the corresponding buffer of SG list entry.
And for the case of stub driver supports SG and vhci doesn't, since
the USB storage driver checks that vhci doesn't support SG and sends
the request to stub driver by splitting the SG list into multiple
URBs, stub driver allocates a buffer for each URB with kmalloc() as
it did before this patch.
* Test environment
Test uses two difference machines and two different kernel version
to make mismatch situation between the client and the server where
vhci supports SG, but stub driver does not, or vice versa. All tests
are conducted in both full SG support that both vhci and stub support
SG and half SG support that is the mismatch situation. Test kernel
version is 5.3-rc6 with commit "usb: add a HCD_DMA flag instead of
guestimating DMA capabilities" to avoid unnecessary DMA mapping and
unmapping.
- Test kernel version
- 5.3-rc6 with SG support
- 5.1.20-200.fc29.x86_64 without SG support
* SG support test
- Test devices
- Super-speed storage device - SanDisk Ultra USB 3.0
- High-speed storage device - SMI corporation USB 2.0 flash drive
- Test description
Test read and write operation of mass storage device that uses the
BULK transfer. In test, the client reads and writes files whose size
is over 1G and it works normally.
* Regression test
- Test devices
- Super-speed device - Logitech Brio webcam
- High-speed device - Logitech C920 HD Pro webcam
- Full-speed device - Logitech bluetooth mouse
- Britz BR-Orion speaker
- Low-speed device - Logitech wired mouse
- Test description
Moving and click test for mouse. To test the webcam, use gnome-cheese.
To test the speaker, play music and video on the client. All works
normally.
* VUDC compatibility test
VUDC also works well with this patch. Tests are done with two USB
gadget created by CONFIGFS USB gadget. Both use the BULK pipe.
1. Serial gadget
2. Mass storage gadget
- Serial gadget test
Serial gadget on the host sends and receives data using cat command
on the /dev/ttyGS<N>. The client uses minicom to communicate with
the serial gadget.
- Mass storage gadget test
After connecting the gadget with vhci, use "dd" to test read and
write operation on the client side.
Read - dd if=/dev/sd<N> iflag=direct of=/dev/null bs=1G count=1
Write - dd if=<my file path> iflag=direct of=/dev/sd<N> bs=1G count=1
Signed-off-by: Suwan Kim <suwan.kim027@gmail.com>
Acked-by: Shuah khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/20190828032741.12234-1-suwan.kim027@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit 7211aef86f ("block: mq-deadline: Fix write completion
handling") added a call to blk_mq_sched_mark_restart_hctx() in
dd_dispatch_request() to make sure that write request dispatching does
not stall when all target zones are locked. This fix left a subtle race
when a write completion happens during a dispatch execution on another
CPU:
CPU 0: Dispatch CPU1: write completion
dd_dispatch_request()
lock(&dd->lock);
...
lock(&dd->zone_lock); dd_finish_request()
rq = find request lock(&dd->zone_lock);
unlock(&dd->zone_lock);
zone write unlock
unlock(&dd->zone_lock);
...
__blk_mq_free_request
check restart flag (not set)
-> queue not run
...
if (!rq && have writes)
blk_mq_sched_mark_restart_hctx()
unlock(&dd->lock)
Since the dispatch context finishes after the write request completion
handling, marking the queue as needing a restart is not seen from
__blk_mq_free_request() and blk_mq_sched_restart() not executed leading
to the dispatch stall under 100% write workloads.
Fix this by moving the call to blk_mq_sched_mark_restart_hctx() from
dd_dispatch_request() into dd_finish_request() under the zone lock to
ensure full mutual exclusion between write request dispatch selection
and zone unlock on write request completion.
Fixes: 7211aef86f ("block: mq-deadline: Fix write completion handling")
Cc: stable@vger.kernel.org
Reported-by: Hans Holmberg <Hans.Holmberg@wdc.com>
Reviewed-by: Hans Holmberg <hans.holmberg@wdc.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Allwinner DT changes for 5.4
Our usual pile of patches for the next release, which include mostly:
- More fixes thanks to the DT validation using the YAML bindings
- IR receiver support on the H6
- SPDIF support on the H6
- I2C Support on the H6
- CSI support on the A20
- RTC support on the H6
- New Boards: Lichee Zero Plus, Tanix TX6, A64-Olinuxino-eMMC
* tag 'sunxi-dt-for-5.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: (40 commits)
arm64: dts: allwinner: orange-pi-3: Enable WiFi
ARM: dts: sunxi: Add missing watchdog clocks
ARM: dts: sunxi: Add missing watchdog interrupts
arm64: dts: allwinner: h6: Add support for RTC and fix the clock tree
ARM: dts: sun7i: Add CSI0 controller
arm64: dts: allwinner: a64: Add A64 OlinuXino board (with eMMC)
dt-bindings: arm: sunxi: Add compatible for A64 OlinuXino with eMMC
ARM: dts: v3s: Change the timers compatible
ARM: dts: h3: Change the timers compatible
ARM: dts: a83t: Change the timers compatible
ARM: dts: a23/a33: Change the timers compatible
ARM: dts: sun6i: Add missing timers interrupts
ARM: dts: sun5i: Add missing timers interrupts
ARM: dts: sun4i: Add missing timers interrupts
dt-bindings: mfd: Convert Allwinner GPADC bindings to a schema
arm64: dts: allwinner: h6: Introduce Tanix TX6 board
dt-bindings: arm: sunxi: Add compatible for Tanix TX6 board
arm64: allwinner: h6: add I2C nodes
dt-bindings: i2c: mv64xxx: Add compatible for the H6 i2c node.
ARM: dts: sunxi: Add mdio bus sub-node to GMAC
...
Link: https://lore.kernel.org/r/d97e6252-9dd7-4cf5-a3cf-56f78b0ca455.lettre@localhost
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
`dev` (struct rsi_91x_usbdev *) field of adapter
(struct rsi_91x_usbdev *) is allocated and initialized in
`rsi_init_usb_interface`. If any error is detected in information
read from the device side, `rsi_init_usb_interface` will be
freed. However, in the higher level error handling code in
`rsi_probe`, if error is detected, `rsi_91x_deinit` is called
again, in which `dev` will be freed again, resulting double free.
This patch fixes the double free by removing the free operation on
`dev` in `rsi_init_usb_interface`, because `rsi_91x_deinit` is also
used in `rsi_disconnect`, in that code path, the `dev` field is not
(and thus needs to be) freed.
This bug was found in v4.19, but is also present in the latest version
of kernel. Fixes CVE-2019-15504.
Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Hui Peng <benquike@gmail.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
This reverts commit 9ad3b55654.
As reported by Sergey:
"I got some problem after upgrade kernel to 5.2 version (debian testing
linux-image-5.2.0-2-amd64). 5Ghz client stopped to see AP.
Some tests with 1metre distance between client-AP: 2.4Ghz -22dBm, for
5Ghz - 53dBm !, for longer distance (8m + walls) 2.4 - 61dBm, 5Ghz not
visible."
It was identified that rx signal level degradation was caused by
9ad3b55654 ("rt2800: enable TX_PIN_CFG_LNA_PE_ bits per band").
So revert this commit.
Cc: <stable@vger.kernel.org> # v5.1+
Reported-and-tested-by: Sergey Maranchuk <slav0nic0@gmail.com>
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
After looking at code I realized that my previous fix
9584412438 ("rt2x00: clear IV's on start to fix AP mode regression")
was incomplete. We can still have wrong IV's after re-keyring.
To fix that, clear up IV's also on key removal.
Fixes: 710e6cc159 ("rt2800: do not nullify initialization vector data")
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
tested-by: Emil Karlson <jekarl@iki.fi>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
We were erroneously assigning the new configuration to a local
variable cfg, but that was not being assigned to anything, so the
change was getting lost. Assign directly to iwl_trans->cfg instead.
Fixes: 5a8c31aa63 ("iwlwifi: pcie: fix recognition of QuZ devices")
Cc: stable@vger.kernel.org # 5.2
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
mwifiex_update_vs_ie(),mwifiex_set_uap_rates() and
mwifiex_set_wmm_params() call memcpy() without checking
the destination size.Since the source is given from
user-space, this may trigger a heap buffer overflow.
Fix them by putting the length check before performing memcpy().
This fix addresses CVE-2019-14814,CVE-2019-14815,CVE-2019-14816.
Signed-off-by: Wen Huang <huangwenabc@gmail.com>
Acked-by: Ganapathi Bhat <gbhat@marvell.comg>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
MT7630E hardware does support 5GHz, but we do not properly configure phy
for 5GHz channels. Scanning at this band not only do not show any APs
but also can hang the firmware.
Since vendor reference driver do not support 5GHz we don't know how
properly configure 5GHz channels. So disable this band for MT7630E .
Cc: stable@vger.kernel.org
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Xhci re-enables a slot on transaction error in set_address using
xhci_disable_slot() + xhci_alloc_dev().
But in this case, xhci_alloc_dev() creates debugfs entries upon an
existing device without cleaning up old entries, thus memory leaks.
So this patch simply moves calling xhci_debugfs_free_dev() from
xhci_free_dev() to xhci_disable_slot().
[added "possible" to header as this is about failure codepath -Mathias]
Signed-off-by: Ikjoon Jang <ikjn@chromium.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/1567172356-12915-5-git-send-email-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
If the 'kmalloc()' fails, we need to undo the previous
'dbc_alloc_request()' call.
Because of the more similar function name, it is more logical to use
'dbc_free_request()' instead of 'xhci_dbc_free_req()'.
Both are equivalent here because:
static void xhci_dbc_free_req(struct dbc_ep *dep, struct dbc_request *req)
{
kfree(req->buf);
dbc_free_request(dep, req);
}
and 'req->buf' is known to be NULL at this point
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/1567172356-12915-2-git-send-email-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Since 41634aa8d6 ("mt76: only schedule txqs from the tx tasklet")
I can observe firmware hangs on MT7630E on station mode: tx stop
functioning after minor activity (rx keep working) and on module
unload device fail to stop with messages:
[ 5446.141413] mt76x0e 0000:06:00.0: TX DMA did not stop
[ 5449.176764] mt76x0e 0000:06:00.0: TX DMA did not stop
Loading module again results in failure to associate with AP.
Only machine power off / power on cycle can make device work again.
It's unclear why commit 41634aa8d6 causes the problem, but it is
related to HW encryption. Since issue is a firmware hang, that is super
hard to debug, just disable HW encryption as fix for the issue.
Fixes: 41634aa8d6 ("mt76: only schedule txqs from the tx tasklet")
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Currently the check on a non-zero return code in ret is false because
ret has been initialized to zero. I believe that ret should be assigned
to the return from the call to readl_poll_timeout_atomic before the
check on ret. Since ret is being re-assinged the original initialization
of ret to zero can be removed.
Addresses-Coverity: ("'Constant' variable guards dead code")
Fixes: 7733f6c32e ("usb: cdns3: Add Cadence USB3 DRD Driver")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20190902145035.18200-1-colin.king@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Arnd Bergmann