summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2022-07-11arm64: dts: apalis-imx8: enable CAN on Ixora v1.1Andrejs Cainikovs
Both CAN controllers on Ixora v1.1 were left disabled for some reason, even though these are present on both Ixora v1.1 and v1.2. Lets align this and have enabled all existing CAN controllers on all Ixora variants. Signed-off-by: Andrejs Cainikovs <andrejs.cainikovs@toradex.com>
2022-07-06arm64: dts: apalis-imx8: add sd card sleep stateAndrejs Cainikovs
This adds SD card sleep state and relevant pinmux configuration for Apalis iMX8 boards. Pins for sleep state are configured for pull-disable, except card detect pin which is always pull-up. Signed-off-by: Andrejs Cainikovs <andrejs.cainikovs@toradex.com>
2022-06-29ARM: dts: colibri-imx6ull: fix snvs pinmux groupMax Krummenacher
A pin controlled by the iomuxc-snvs pin controller must be specified under the dtb's iomuxc-snvs node. Move the one and only pin of that category from the iomuxc node and set the pinctrl-0 using it accordingly. Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com>
2022-06-28mxc_lcdif.c: add additonal LCD timingsMax Krummenacher
[ commit 20ab378e5462c4e9b4703264d143d3aeb9882023 on toradex_4.14-2.3.x-imx ] FusionF10A: 1024x600, used with external parallel to LVDS converter FusionF07A: 800x480 EDT-VGA: 640x480 EDT-480x272: 480x272 Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> [ps: forward port from toradex_4.14-2.3.x-imx] Signed-off-by: Philippe Schenker <philippe.schenker@toradex.com>
2022-06-24ASoC: sgtl5000: Fix noise on shutdown/removeFrancesco Dolcini
Put the SGTL5000 in a silent/safe state on shutdown/remove, this is required since the SGTL5000 produces a constant noise on its output after it is configured and its clock is removed. Without this change this is happening every time the module is unbound/removed or from reboot till the clock is enabled again. The issue was experienced on both a Toradex Colibri/Apalis iMX6, but can be easily reproduced everywhere just playing something on the codec and after that removing/unbinding the driver. Fixes: 9b34e6cc3bc2 ("ASoC: Add Freescale SGTL5000 codec support") Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
2022-06-23arm64: dts: apalis-imx8: pin config for ixora ledsAndrejs Cainikovs
Ixora board has external resistors on LED_4_* and LED_5_*. Pins which are driving these LEDs should have no pull. Also, configure LED pins for input/output. Signed-off-by: Andrejs Cainikovs <andrejs.cainikovs@toradex.com>
2022-06-23arm64: dts: apalis-imx8: no pull on ixora card cdAndrejs Cainikovs
Pull configuration should be set as pull-disabled for SD card CD# pin, as it already has an external pull-up. Signed-off-by: Andrejs Cainikovs <andrejs.cainikovs@toradex.com>
2022-06-23arm64: dts: apalis-imx8: remove ixora sdcard sleepAndrejs Cainikovs
Remove sleep state from SD card pinmux configuration. Signed-off-by: Andrejs Cainikovs <andrejs.cainikovs@toradex.com>
2022-06-23arm64: dts: apalis-imx8: ixora sd card is 4-bitAndrejs Cainikovs
Ixora board v1.1 MicroSD card is 4-bit wide, same as v1.2. This change leaves data pins 4-7 not configured, so that these can be used for other purposes. Signed-off-by: Andrejs Cainikovs <andrejs.cainikovs@toradex.com>
2022-06-23arm64: dts: apalis-imx8: fix ixora pinmux configAndrejs Cainikovs
This fixes Ixora pinmux configuration, which should be defined within apalis-imx8qm block. Signed-off-by: Andrejs Cainikovs <andrejs.cainikovs@toradex.com>
2022-06-22arm64: dts: imx8m{m,p}-verdin: use IT temperaturesPhilippe Schenker
Use IT temperature threshold for critical/passive trip point on Verdin iMX8M Plus and Mini. Signed-off-by: Philippe Schenker <philippe.schenker@toradex.com> Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
2022-06-13ARM: dts: imx7d-colibri: Move usdhc1-cd-slp definition to iomuxc_lpsrRafael Beims
The usdhc1-cd-slp-grp node in the device tree is making use of PAD_LPSR definitions and these definitions are not compatible with the iomuxc node. Because of that, instead of setting up GPIO1_IO00 this group is setting up the registers for GPIO1_IO15. Moving the group to the iomuxc_lpsr node makes the setup for the correct pin and also makes GPIO1_IO15 available again as a standard GPIO. Relates-to: ELB-4525 Signed-off-by: Rafael Beims <rafael.beims@toradex.com>
2022-05-24mwifiex: Add SD8997 SDIO-UART firmwareAndrejs Cainikovs
commit 562354ab9f0aa4fcd8f2184506dcb9c18a792182 upstream. With a recent change now it is possible to detect the strapping option on SD8997, which allows to pick up a correct firmware for either SDIO-SDIO or SDIO-UART. This commit enables SDIO-UART firmware on SD8997. Signed-off-by: Andrejs Cainikovs <andrejs.cainikovs@toradex.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220422090313.125857-3-andrejs.cainikovs@toradex.com
2022-05-24mwifiex: Select firmware based on strappingAndrejs Cainikovs
commit 255ca28a659d3cfb069f73c7644853ed93aecdb0 upstream. Some WiFi/Bluetooth modules might have different host connection options, allowing to either use SDIO for both WiFi and Bluetooth, or SDIO for WiFi and UART for Bluetooth. It is possible to detect whether a module has SDIO-SDIO or SDIO-UART connection by reading its host strap register. This change introduces a way to automatically select appropriate firmware depending of the connection method, and removes a need of symlinking or overwriting the original firmware file with a required one. Host strap register used in this commit comes from the NXP driver [1] hosted at Code Aurora. [1] https://source.codeaurora.org/external/imx/linux-imx/tree/drivers/net/wireless/nxp/mxm_wifiex/wlan_src/mlinux/moal_sdio_mmc.c?h=rel_imx_5.4.70_2.3.2&id=688b67b2c7220b01521ffe560da7eee33042c7bd#n1274 Signed-off-by: Andrejs Cainikovs <andrejs.cainikovs@toradex.com> Reviewed-by: Alvin Šipraga <alsi@bang-olufsen.dk> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220422090313.125857-2-andrejs.cainikovs@toradex.com
2022-05-20Revert "clk: imx7d: Remove audio_mclk_root_clk"Philippe Schenker
This reverts commit b576488fa3b5715a1ef3eafc0b1c1d3514345613. As it uses to break audio on i.MX 7 based modules. Signed-off-by: Philippe Schenker <philippe.schenker@toradex.com>
2022-05-19Merge remote-tracking branch 'gh-fslc/5.4-2.3.x-imx' into toradex_5.4-2.3.x-imxPhilippe Schenker
2022-05-19Merge pull request #565 from ↵Otavio Salvador
philschenker/update-to-5.4.193__update-to-2.3.7__5.4-2.3.x-imx Update Patchlevel on Branch 5.4-2.3.x-imx from 5.4.161->5.4.193
2022-05-19Merge pull request #564 from philschenker/update-to-2.3.7__5.4-2.3.x-imxOtavio Salvador
Update Kernel 5.4-2.3.x-imx to NXP Release Linux 5.4.70_2.3.7 Patch
2022-05-19Merge tag 'v5.4.193' into update-to-2.3.7__5.4-2.3.x-imxPhilippe Schenker
This is the 5.4.193 stable release Conflicts: arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts drivers/edac/synopsys_edac.c drivers/mmc/host/sdhci-esdhc-imx.c drivers/mmc/host/sdhci.c drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c sound/soc/codecs/msm8916-wcd-analog.c
2022-05-19LF-3705-1: caam: imx8m: fix the built-in caam driver cannot match soc_idAlice Guo
drivers/soc/imx/soc-imx8m.c is probed later than the caam driver so that return -EPROBE_DEFER is needed after calling soc_device_match() in drivers/crypto/caam/ctrl.c. For i.MX8M, soc_device_match returning NULL can be considered that the SoC device has not been probed yet, so it returns -EPROBE_DEFER directly. Fixes: 6375d33dce9a ("soc: imx8m: change to use platform driver") Signed-off-by: Alice Guo <alice.guo@nxp.com> Reviewed-by: Horia Geantă <horia.geanta@nxp.com> (cherry picked from commit d5df21ff810453741e23aa62de3e3911957c42b1)
2022-05-18MLK-25133: arm: dts: remove power domains for i2c chipsOliver Brown
The power domains are causing the i2c expander to be reset during suspend resume. After resume the expander state is not being restored properly. So since the reset is optional, I am removing the power domains. Signed-off-by: Oliver Brown <oliver.brown@nxp.com> Reviewed-by: Shenwei Wang <shenwei.wang@nxp.com> (cherry picked from commit b928f18fdf653d70871958f561357ad98fa4aa86)
2022-05-18LF-4020: clk: imx8qxp: Fix elcdif_pll clockRobert Chiras
Move the elcdif_pll clock initialization before the lcd_clk, since the elcdif_clk needs to be initialized ahead of lcd_clk, being its parent. This change fixes issues with the LCD clocks during suspend/resume. Signed-off-by: Robert Chiras <robert.chiras@nxp.com> Suggested-by: Ranjani Vaidyanathan <ranjani.vaidyanathan@nxp.com> Acked-by: Laurentiu Palcu <laurentiu.palcu@nxp.com> (cherry picked from commit 0668a88908ccc841081b0509d80e0b4f6b5f9a78)
2022-05-18MLK-25088: drm/mxsfb: Change connector type for panelOliver Brown
The connector type for a panel without a bridge should be DRM_MODE_CONNECTOR_DPI. Signed-off-by: Oliver Brown <oliver.brown@nxp.com> Reviewed-by: Robert Chiras <robert.chiras@nxp.com> (cherry picked from commit cc8cfef78c0ebaa5936af8d1a65f9372680b6634)
2022-05-18LF-3217: media: isi: cap: call streamoff if the process abnormal exitGuoniu.zhou
For normal case, userspace should call streamon/streamoff balance, but for some special case, the process will be killed or terminated and the streamoff ioctl will be ignored. So driver need to handle the case. Signed-off-by: Guoniu.zhou <guoniu.zhou@nxp.com> Reviewed-by: Robby Cai <robby.cai@nxp.com> (cherry picked from commit 057b44588095cb6be35175f42467c1481d0dd54b)
2022-05-18MLK-25649-7 rpmsg: imx: Add support for identifying SCU wakeup source from sysfsRanjani Vaidyanathan
Consolidate SCU wakeup defines in the header file. Signed-off-by: Ranjani Vaidyanathan <ranjani.vaidyanathan@nxp.com> (cherry picked from commit d7b1dd90185df67fe1e713ff439fc898201cb8c8) (cherry picked from commit 5693275abe2a558f7a433bba23eb8ae35bd30749)
2022-05-18MLK-25649-8 rtc: imx-sc: Add support for identifying SCU wakeup source from ↵Ranjani Vaidyanathan
sysfs Consolidate SCU wakeup defines in the header file. Signed-off-by: Ranjani Vaidyanathan <ranjani.vaidyanathan@nxp.com> (cherry picked from commit ae44e6f054423fd6b228a147571cc77bc768138e) (cherry picked from commit 8924966cd6cb48c0c549d07f028ee544fa6dca1a)
2022-05-18MLK-25649-9 watchdog: imx_sc_wdt: Add support for identifying SCU wakeup ↵Ranjani Vaidyanathan
source from sysfs Consolidate SCU wakeup defines in the header file. Signed-off-by: Ranjani Vaidyanathan <ranjani.vaidyanathan@nxp.com> (cherry picked from commit 9d2e7cc3a10f2ce1e36fc40acb494494bed08109) (cherry picked from commit 0096d3876d96b1b400f5bf2cb999078236e28bf0) Ported from codeaurora/imx_5.4.70_2.3.0 Signed-off-by: Philippe Schenker <philippe.schenker@toradex.com>
2022-05-18MLK-25649-4 mailbox: imx: Add support for identifying SCU wakeup source from ↵Ranjani Vaidyanathan
sysfs Record SCU wakeup interrupt in /sys/power/pm_wakeup_irq Signed-off-by: Ranjani Vaidyanathan <ranjani.vaidyanathan@nxp.com> (cherry picked from commit e8d90d8901e42f9ac039086af9f1829030204fa8) (cherry picked from commit 2b5bb07b7c25ae047530a78d5d19466f7b6b330c)
2022-05-18MLK-25649-6 remoteproc: imx_proc: Add support for identifying SCU wakeup sou ↵Ranjani Vaidyanathan
rce from sysfs Consolidate SCU wakeup defines in the header file. Signed-off-by: Ranjani Vaidyanathan <ranjani.vaidyanathan@nxp.com> (cherry picked from commit 012932b938d28eb47d05a505705fad3735b53d5d)
2022-05-18MLK-25649-10 firmware: seco_mu: Add support for identifying SCU wakeup ↵Ranjani Vaidyanathan
source from sysfs Consolidate SCU wakeup defines in the header file. Signed-off-by: Ranjani Vaidyanathan <ranjani.vaidyanathan@nxp.com> (cherry picked from commit 215433a807576abc8cafbbb1b64715650ed98224) (cherry picked from commit 7ca430575e9ae034a2c28798fa8dd7b931f0733c)
2022-05-18MLK-25649-2 gpio: mxc: Add support for identifying SCU wakeup source from sysfsRanjani Vaidyanathan
Consolidate SCU wakeup defines in the header file. Signed-off-by: Ranjani Vaidyanathan <ranjani.vaidyanathan@nxp.com> (cherry picked from commit 7d1a364e453397d3659cb80832e2297d49b62706) (cherry picked from commit 36bde0d134c97cfbbac9ad1078a2fbeb9b2cd9fa)
2022-05-18MLK-25649-1 firmware: imx: imx-scu-irq: Add support for identifying SCU ↵Ranjani Vaidyanathan
wakeup source from sysfs Record SCU wakeup interrupt in /sys/power/pm_wakeup_irq The user can further identify the exact wakeup source by using the following interface: cat /sys/firmware/scu_wakeup_source/wakeup_src The above will print the wake groups and the irqs that could have contributed to waking up the kernel. For example if ON/OFF button was the wakeup source: cat /sys/firmware/scu_wakeup_source/wakeup_src Wakeup source group = 3, irq = 0x1 The user can refer to the SCFW API documentation to identify all the wake groups and irqs. Signed-off-by: Ranjani Vaidyanathan <ranjani.vaidyanathan@nxp.com> (cherry picked from commit d49daabfb43eddf94144560fc2eef58015311454) (cherry picked from commit fed9f95ad512fd4b4cca7c8bfd08a78ddcaebeb9)
2022-05-18LF-4265: mailbox: imx: fix wakeup failure from freeze modeRobin Gong
Since IRQF_NO_SUSPEND used for imx mailbox driver, that means this irq can't be used for wakeup source so that can't wakeup from freeze mode. Add pm_system_wakeup() to wakeup from freeze mode. Signed-off-by: Robin Gong <yibin.gong@nxp.com> Reviewed-by: Jacky Bai <ping.bai@nxp.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> (cherry picked from commit d12a9c6240167bab5a49180cf642cc9e6e518bca) (cherry picked from commit 23857411888f489fbff023d05a38a0cdc035af26)
2022-05-18MLK-25731: drm: imx: hdp: correct ipg clk disableOliver Brown
Change enable calls to disable calls in imx8qm_ipg_clk_disable Signed-off-by: Oliver Brown <oliver.brown@nxp.com> (cherry picked from commit 8d4eef776974fce47db4447226b3834d4eb5afc5)
2022-05-18MLK-25498 gpu: drm: imx: Add missing PHY init to cdns_mhdp_imx_resumeOliver Brown
This fixes an issue where there is no display after resuming from suspend due to missing PHY initialization. Signed-off-by: Oliver Brown <oliver.brown@nxp.com> Reviewed-by: Sandor Yu <Sandor.yu@nxp.com> (cherry picked from commit 23617be31285b84b68e652d3fb39dc73875126c1)
2022-05-13net: phy: Fix race condition on link status changeFrancesco Dolcini
commit 91a7cda1f4b8bdf770000a3b60640576dafe0cec upstream. This fixes the following error caused by a race condition between phydev->adjust_link() and a MDIO transaction in the phy interrupt handler. The issue was reproduced with the ethernet FEC driver and a micrel KSZ9031 phy. [ 146.195696] fec 2188000.ethernet eth0: MDIO read timeout [ 146.201779] ------------[ cut here ]------------ [ 146.206671] WARNING: CPU: 0 PID: 571 at drivers/net/phy/phy.c:942 phy_error+0x24/0x6c [ 146.214744] Modules linked in: bnep imx_vdoa imx_sdma evbug [ 146.220640] CPU: 0 PID: 571 Comm: irq/128-2188000 Not tainted 5.18.0-rc3-00080-gd569e86915b7 #9 [ 146.229563] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) [ 146.236257] unwind_backtrace from show_stack+0x10/0x14 [ 146.241640] show_stack from dump_stack_lvl+0x58/0x70 [ 146.246841] dump_stack_lvl from __warn+0xb4/0x24c [ 146.251772] __warn from warn_slowpath_fmt+0x5c/0xd4 [ 146.256873] warn_slowpath_fmt from phy_error+0x24/0x6c [ 146.262249] phy_error from kszphy_handle_interrupt+0x40/0x48 [ 146.268159] kszphy_handle_interrupt from irq_thread_fn+0x1c/0x78 [ 146.274417] irq_thread_fn from irq_thread+0xf0/0x1dc [ 146.279605] irq_thread from kthread+0xe4/0x104 [ 146.284267] kthread from ret_from_fork+0x14/0x28 [ 146.289164] Exception stack(0xe6fa1fb0 to 0xe6fa1ff8) [ 146.294448] 1fa0: 00000000 00000000 00000000 00000000 [ 146.302842] 1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 146.311281] 1fe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 146.318262] irq event stamp: 12325 [ 146.321780] hardirqs last enabled at (12333): [<c01984c4>] __up_console_sem+0x50/0x60 [ 146.330013] hardirqs last disabled at (12342): [<c01984b0>] __up_console_sem+0x3c/0x60 [ 146.338259] softirqs last enabled at (12324): [<c01017f0>] __do_softirq+0x2c0/0x624 [ 146.346311] softirqs last disabled at (12319): [<c01300ac>] __irq_exit_rcu+0x138/0x178 [ 146.354447] ---[ end trace 0000000000000000 ]--- With the FEC driver phydev->adjust_link() calls fec_enet_adjust_link() calls fec_stop()/fec_restart() and both these function reset and temporary disable the FEC disrupting any MII transaction that could be happening at the same time. fec_enet_adjust_link() and phy_read() can be running at the same time when we have one additional interrupt before the phy_state_machine() is able to terminate. Thread 1 (phylib WQ) | Thread 2 (phy interrupt) | | phy_interrupt() <-- PHY IRQ | handle_interrupt() | phy_read() | phy_trigger_machine() | --> schedule phylib WQ | | phy_state_machine() | phy_check_link_status() | phy_link_change() | phydev->adjust_link() | fec_enet_adjust_link() | --> FEC reset | phy_interrupt() <-- PHY IRQ | phy_read() | Fix this by acquiring the phydev lock in phy_interrupt(). Link: https://lore.kernel.org/all/20220422152612.GA510015@francesco-nb.int.toradex.com/ Fixes: c974bdbc3e77 ("net: phy: Use threaded IRQ, to allow IRQ from sleeping devices") cc: <stable@vger.kernel.org> Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://lore.kernel.org/r/20220506060815.327382-1-francesco.dolcini@toradex.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> [fd: backport: adapt locking before did_interrupt()/ack_interrupt() callbacks removal ] Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
2022-05-12Linux 5.4.193Greg Kroah-Hartman
Link: https://lore.kernel.org/r/20220510130729.852544477@linuxfoundation.org Tested-by: Florian Fainelli <f.fainelli@gmail.com> Tested-by: Shuah Khan <skhan@linuxfoundation.org> Tested-by: Guenter Roeck <linux@roeck-us.net> Tested-by: Hulk Robot <hulkrobot@huawei.com> Tested-by: Linux Kernel Functional Testing <lkft@linaro.org> Tested-by: Jon Hunter <jonathanh@nvidia.com> Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-12mmc: rtsx: add 74 Clocks in power on flowRicky WU
commit 1f311c94aabdb419c28e3147bcc8ab89269f1a7e upstream. SD spec definition: "Host provides at least 74 Clocks before issuing first command" After 1ms for the voltage stable then start issuing the Clock signals if POWER STATE is MMC_POWER_OFF to MMC_POWER_UP to issue Clock signal to card MMC_POWER_UP to MMC_POWER_ON to stop issuing signal to card Signed-off-by: Ricky Wu <ricky_wu@realtek.com> Link: https://lore.kernel.org/r/1badf10aba764191a1a752edcbf90389@realtek.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> Signed-off-by: Christian Loehle <cloehle@hyperstone.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-12PCI: aardvark: Fix reading MSI interrupt numberPali Rohár
commit 805dfc18dd3d4dd97a987d4406593b5a225b1253 upstream. In advk_pcie_handle_msi() it is expected that when bit i in the W1C register PCIE_MSI_STATUS_REG is cleared, the PCIE_MSI_PAYLOAD_REG is updated to contain the MSI number corresponding to index i. Experiments show that this is not so, and instead PCIE_MSI_PAYLOAD_REG always contains the number of the last received MSI, overall. Do not read PCIE_MSI_PAYLOAD_REG register for determining MSI interrupt number. Since Aardvark already forbids more than 32 interrupts and uses own allocated hwirq numbers, the msi_idx already corresponds to the received MSI number. Link: https://lore.kernel.org/r/20220110015018.26359-3-kabel@kernel.org Fixes: 8c39d710363c ("PCI: aardvark: Add Aardvark PCI host controller driver") Signed-off-by: Pali Rohár <pali@kernel.org> Signed-off-by: Marek Behún <kabel@kernel.org> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com> Signed-off-by: Marek Behún <kabel@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-12PCI: aardvark: Clear all MSIs at setupPali Rohár
commit 7d8dc1f7cd007a7ce94c5b4c20d63a8b8d6d7751 upstream. We already clear all the other interrupts (ISR0, ISR1, HOST_CTRL_INT). Define a new macro PCIE_MSI_ALL_MASK and do the same clearing for MSIs, to ensure that we don't start receiving spurious interrupts. Use this new mask in advk_pcie_handle_msi(); Link: https://lore.kernel.org/r/20211130172913.9727-5-kabel@kernel.org Signed-off-by: Pali Rohár <pali@kernel.org> Signed-off-by: Marek Behún <kabel@kernel.org> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-12dm: interlock pending dm_io and dm_wait_for_bios_completionMike Snitzer
commit 9f6dc633761006f974701d4c88da71ab68670749 upstream. Commit d208b89401e0 ("dm: fix mempool NULL pointer race when completing IO") didn't go far enough. When bio_end_io_acct ends the count of in-flight I/Os may reach zero and the DM device may be suspended. There is a possibility that the suspend races with dm_stats_account_io. Fix this by adding percpu "pending_io" counters to track outstanding dm_io. Move kicking of suspend queue to dm_io_dec_pending(). Also, rename md_in_flight_bios() to dm_in_flight_bios() and update it to iterate all pending_io counters. Fixes: d208b89401e0 ("dm: fix mempool NULL pointer race when completing IO") Cc: stable@vger.kernel.org Co-developed-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Reviewed-by: Mike Snitzer <snitzer@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-12dm: fix mempool NULL pointer race when completing IOJiazi Li
commit d208b89401e073de986dc891037c5a668f5d5d95 upstream. dm_io_dec_pending() calls end_io_acct() first and will then dec md in-flight pending count. But if a task is swapping DM table at same time this can result in a crash due to mempool->elements being NULL: task1 task2 do_resume ->do_suspend ->dm_wait_for_completion bio_endio ->clone_endio ->dm_io_dec_pending ->end_io_acct ->wakeup task1 ->dm_swap_table ->__bind ->__bind_mempools ->bioset_exit ->mempool_exit ->free_io [ 67.330330] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 ...... [ 67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO) [ 67.330510] pc : mempool_free+0x70/0xa0 [ 67.330515] lr : mempool_free+0x4c/0xa0 [ 67.330520] sp : ffffff8008013b20 [ 67.330524] x29: ffffff8008013b20 x28: 0000000000000004 [ 67.330530] x27: ffffffa8c2ff40a0 x26: 00000000ffff1cc8 [ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800 [ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800 [ 67.330547] x21: 00000000ffff1cc8 x20: ffffffd9a1304d80 [ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c [ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd [ 67.330563] x15: 000000000093b41e x14: 0000000000000010 [ 67.330569] x13: 0000000000007f7a x12: 0000000034155555 [ 67.330574] x11: 0000000000000001 x10: 0000000000000001 [ 67.330579] x9 : 0000000000000000 x8 : 0000000000000000 [ 67.330585] x7 : 0000000000000000 x6 : ffffff80148b5c1a [ 67.330590] x5 : ffffff8008013ae0 x4 : 0000000000000001 [ 67.330596] x3 : ffffff80080139c8 x2 : ffffff801083bab8 [ 67.330601] x1 : 0000000000000000 x0 : ffffffdada34c970 [ 67.330609] Call trace: [ 67.330616] mempool_free+0x70/0xa0 [ 67.330627] bio_put+0xf8/0x110 [ 67.330638] dec_pending+0x13c/0x230 [ 67.330644] clone_endio+0x90/0x180 [ 67.330649] bio_endio+0x198/0x1b8 [ 67.330655] dec_pending+0x190/0x230 [ 67.330660] clone_endio+0x90/0x180 [ 67.330665] bio_endio+0x198/0x1b8 [ 67.330673] blk_update_request+0x214/0x428 [ 67.330683] scsi_end_request+0x2c/0x300 [ 67.330688] scsi_io_completion+0xa0/0x710 [ 67.330695] scsi_finish_command+0xd8/0x110 [ 67.330700] scsi_softirq_done+0x114/0x148 [ 67.330708] blk_done_softirq+0x74/0xd0 [ 67.330716] __do_softirq+0x18c/0x374 [ 67.330724] irq_exit+0xb4/0xb8 [ 67.330732] __handle_domain_irq+0x84/0xc0 [ 67.330737] gic_handle_irq+0x148/0x1b0 [ 67.330744] el1_irq+0xe8/0x190 [ 67.330753] lpm_cpuidle_enter+0x4f8/0x538 [ 67.330759] cpuidle_enter_state+0x1fc/0x398 [ 67.330764] cpuidle_enter+0x18/0x20 [ 67.330772] do_idle+0x1b4/0x290 [ 67.330778] cpu_startup_entry+0x20/0x28 [ 67.330786] secondary_start_kernel+0x160/0x170 Fix this by: 1) Establishing pointers to 'struct dm_io' members in dm_io_dec_pending() so that they may be passed into end_io_acct() _after_ free_io() is called. 2) Moving end_io_acct() after free_io(). Cc: stable@vger.kernel.org Signed-off-by: Jiazi Li <lijiazi@xiaomi.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Reviewed-by: Mike Snitzer <snitzer@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-12tcp: make sure treq->af_specific is initializedEric Dumazet
commit ba5a4fdd63ae0c575707030db0b634b160baddd7 upstream. syzbot complained about a recent change in TCP stack, hitting a NULL pointer [1] tcp request sockets have an af_specific pointer, which was used before the blamed change only for SYNACK generation in non SYNCOOKIE mode. tcp requests sockets momentarily created when third packet coming from client in SYNCOOKIE mode were not using treq->af_specific. Make sure this field is populated, in the same way normal TCP requests sockets do in tcp_conn_request(). [1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 3695 Comm: syz-executor864 Not tainted 5.18.0-rc3-syzkaller-00224-g5fd1fe4807f9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:tcp_create_openreq_child+0xe16/0x16b0 net/ipv4/tcp_minisocks.c:534 Code: 48 c1 ea 03 80 3c 02 00 0f 85 e5 07 00 00 4c 8b b3 28 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7e 08 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 07 00 00 48 8b 3c 24 48 89 de 41 ff 56 08 48 RSP: 0018:ffffc90000de0588 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff888076490330 RCX: 0000000000000100 RDX: 0000000000000001 RSI: ffffffff87d67ff0 RDI: 0000000000000008 RBP: ffff88806ee1c7f8 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff87d67f00 R11: 0000000000000000 R12: ffff88806ee1bfc0 R13: ffff88801b0e0368 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f517fe58700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffcead76960 CR3: 000000006f97b000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> tcp_v6_syn_recv_sock+0x199/0x23b0 net/ipv6/tcp_ipv6.c:1267 tcp_get_cookie_sock+0xc9/0x850 net/ipv4/syncookies.c:207 cookie_v6_check+0x15c3/0x2340 net/ipv6/syncookies.c:258 tcp_v6_cookie_check net/ipv6/tcp_ipv6.c:1131 [inline] tcp_v6_do_rcv+0x1148/0x13b0 net/ipv6/tcp_ipv6.c:1486 tcp_v6_rcv+0x3305/0x3840 net/ipv6/tcp_ipv6.c:1725 ip6_protocol_deliver_rcu+0x2e9/0x1900 net/ipv6/ip6_input.c:422 ip6_input_finish+0x14c/0x2c0 net/ipv6/ip6_input.c:464 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:473 dst_input include/net/dst.h:461 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ipv6_rcv+0x27f/0x3b0 net/ipv6/ip6_input.c:297 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5405 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5519 process_backlog+0x3a0/0x7c0 net/core/dev.c:5847 __napi_poll+0xb3/0x6e0 net/core/dev.c:6413 napi_poll net/core/dev.c:6480 [inline] net_rx_action+0x8ec/0xc60 net/core/dev.c:6567 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 Fixes: 5b0b9e4c2c89 ("tcp: md5: incorrect tcp_header_len for incoming connections") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Francesco Ruggeri <fruggeri@arista.com> Signed-off-by: David S. Miller <davem@davemloft.net> [fruggeri: Account for backport conflicts from 35b2c3211609 and 6fc8c827dd4f] Signed-off-by: Francesco Ruggeri <fruggeri@arista.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-12ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lockTakashi Iwai
commit bc55cfd5718c7c23e5524582e9fa70b4d10f2433 upstream. syzbot caught a potential deadlock between the PCM runtime->buffer_mutex and the mm->mmap_lock. It was brought by the recent fix to cover the racy read/write and other ioctls, and in that commit, I overlooked a (hopefully only) corner case that may take the revert lock, namely, the OSS mmap. The OSS mmap operation exceptionally allows to re-configure the parameters inside the OSS mmap syscall, where mm->mmap_mutex is already held. Meanwhile, the copy_from/to_user calls at read/write operations also take the mm->mmap_lock internally, hence it may lead to a AB/BA deadlock. A similar problem was already seen in the past and we fixed it with a refcount (in commit b248371628aa). The former fix covered only the call paths with OSS read/write and OSS ioctls, while we need to cover the concurrent access via both ALSA and OSS APIs now. This patch addresses the problem above by replacing the buffer_mutex lock in the read/write operations with a refcount similar as we've used for OSS. The new field, runtime->buffer_accessing, keeps the number of concurrent read/write operations. Unlike the former buffer_mutex protection, this protects only around the copy_from/to_user() calls; the other codes are basically protected by the PCM stream lock. The refcount can be a negative, meaning blocked by the ioctls. If a negative value is seen, the read/write aborts with -EBUSY. In the ioctl side, OTOH, they check this refcount, too, and set to a negative value for blocking unless it's already being accessed. Reported-by: syzbot+6e5c88838328e99c7e1c@syzkaller.appspotmail.com Fixes: dca947d4d26d ("ALSA: pcm: Fix races among concurrent read/write and buffer changes") Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/000000000000381a0d05db622a81@google.com Link: https://lore.kernel.org/r/20220330120903.4738-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> [OP: backport to 5.4: adjusted context] Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-12ALSA: pcm: Fix races among concurrent prealloc proc writesTakashi Iwai
commit 69534c48ba8ce552ce383b3dfdb271ffe51820c3 upstream. We have no protection against concurrent PCM buffer preallocation changes via proc files, and it may potentially lead to UAF or some weird problem. This patch applies the PCM open_mutex to the proc write operation for avoiding the racy proc writes and the PCM stream open (and further operations). Cc: <stable@vger.kernel.org> Reviewed-by: Jaroslav Kysela <perex@perex.cz> Link: https://lore.kernel.org/r/20220322170720.3529-5-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> [OP: backport to 5.4: adjusted context] Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-12ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free callsTakashi Iwai
commit 3c3201f8c7bb77eb53b08a3ca8d9a4ddc500b4c0 upstream. Like the previous fixes to hw_params and hw_free ioctl races, we need to paper over the concurrent prepare ioctl calls against hw_params and hw_free, too. This patch implements the locking with the existing runtime->buffer_mutex for prepare ioctls. Unlike the previous case for snd_pcm_hw_hw_params() and snd_pcm_hw_free(), snd_pcm_prepare() is performed to the linked streams, hence the lock can't be applied simply on the top. For tracking the lock in each linked substream, we modify snd_pcm_action_group() slightly and apply the buffer_mutex for the case stream_lock=false (formerly there was no lock applied) there. Cc: <stable@vger.kernel.org> Reviewed-by: Jaroslav Kysela <perex@perex.cz> Link: https://lore.kernel.org/r/20220322170720.3529-4-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> [OP: backport to 5.4: adjusted context] Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-12ALSA: pcm: Fix races among concurrent read/write and buffer changesTakashi Iwai
commit dca947d4d26dbf925a64a6cfb2ddbc035e831a3d upstream. In the current PCM design, the read/write syscalls (as well as the equivalent ioctls) are allowed before the PCM stream is running, that is, at PCM PREPARED state. Meanwhile, we also allow to re-issue hw_params and hw_free ioctl calls at the PREPARED state that may change or free the buffers, too. The problem is that there is no protection against those mix-ups. This patch applies the previously introduced runtime->buffer_mutex to the read/write operations so that the concurrent hw_params or hw_free call can no longer interfere during the operation. The mutex is unlocked before scheduling, so we don't take it too long. Cc: <stable@vger.kernel.org> Reviewed-by: Jaroslav Kysela <perex@perex.cz> Link: https://lore.kernel.org/r/20220322170720.3529-3-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-12ALSA: pcm: Fix races among concurrent hw_params and hw_free callsTakashi Iwai
commit 92ee3c60ec9fe64404dc035e7c41277d74aa26cb upstream. Currently we have neither proper check nor protection against the concurrent calls of PCM hw_params and hw_free ioctls, which may result in a UAF. Since the existing PCM stream lock can't be used for protecting the whole ioctl operations, we need a new mutex to protect those racy calls. This patch introduced a new mutex, runtime->buffer_mutex, and applies it to both hw_params and hw_free ioctl code paths. Along with it, the both functions are slightly modified (the mmap_count check is moved into the state-check block) for code simplicity. Reported-by: Hu Jiahui <kirin.say@gmail.com> Cc: <stable@vger.kernel.org> Reviewed-by: Jaroslav Kysela <perex@perex.cz> Link: https://lore.kernel.org/r/20220322170720.3529-2-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> [OP: backport to 5.4: adjusted context] Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-12mm: fix unexpected zeroed page mapping with zram swapMinchan Kim
commit e914d8f00391520ecc4495dd0ca0124538ab7119 upstream. Two processes under CLONE_VM cloning, user process can be corrupted by seeing zeroed page unexpectedly. CPU A CPU B do_swap_page do_swap_page SWP_SYNCHRONOUS_IO path SWP_SYNCHRONOUS_IO path swap_readpage valid data swap_slot_free_notify delete zram entry swap_readpage zeroed(invalid) data pte_lock map the *zero data* to userspace pte_unlock pte_lock if (!pte_same) goto out_nomap; pte_unlock return and next refault will read zeroed data The swap_slot_free_notify is bogus for CLONE_VM case since it doesn't increase the refcount of swap slot at copy_mm so it couldn't catch up whether it's safe or not to discard data from backing device. In the case, only the lock it could rely on to synchronize swap slot freeing is page table lock. Thus, this patch gets rid of the swap_slot_free_notify function. With this patch, CPU A will see correct data. CPU A CPU B do_swap_page do_swap_page SWP_SYNCHRONOUS_IO path SWP_SYNCHRONOUS_IO path swap_readpage original data pte_lock map the original data swap_free swap_range_free bd_disk->fops->swap_slot_free_notify swap_readpage read zeroed data pte_unlock pte_lock if (!pte_same) goto out_nomap; pte_unlock return on next refault will see mapped data by CPU B The concern of the patch would increase memory consumption since it could keep wasted memory with compressed form in zram as well as uncompressed form in address space. However, most of cases of zram uses no readahead and do_swap_page is followed by swap_free so it will free the compressed form from in zram quickly. Link: https://lkml.kernel.org/r/YjTVVxIAsnKAXjTd@google.com Fixes: 0bcac06f27d7 ("mm, swap: skip swapcache for swapin of synchronous device") Reported-by: Ivan Babrou <ivan@cloudflare.com> Tested-by: Ivan Babrou <ivan@cloudflare.com> Signed-off-by: Minchan Kim <minchan@kernel.org> Cc: Nitin Gupta <ngupta@vflare.org> Cc: Sergey Senozhatsky <senozhatsky@chromium.org> Cc: Jens Axboe <axboe@kernel.dk> Cc: David Hildenbrand <david@redhat.com> Cc: <stable@vger.kernel.org> [4.14+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-12block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kernHaimin Zhang
commit cc8f7fe1f5eab010191aa4570f27641876fa1267 upstream. Add __GFP_ZERO flag for alloc_page in function bio_copy_kern to initialize the buffer of a bio. Signed-off-by: Haimin Zhang <tcs.kernel@gmail.com> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://lore.kernel.org/r/20220216084038.15635-1-tcs.kernel@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk> [nobelbarakat: Backported to 5.4: Manually added __GFP_ZERO flag] Signed-off-by: Nobel Barakat <nobelbarakat@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
generated by cgit v1.2.3 (git 2.0.4) at 2024-05-22 11:08:45 +0000