Commit graph

781,636 commits

Author SHA1 Message Date
Benjamin Tissoires
8f732850df HID: core: allow concurrent registration of drivers
Detected on the Dell XPS 9365.

The laptop has 2 devices that benefit from the hid-generic auto-unbinding.
When those 2 devices are presented to the userspace, udev loads both wacom and
hid-multitouch. When this happens, the code in __hid_bus_reprobe_drivers() is
called concurrently and the second device gets reprobed twice.

An other bug in the power_supply subsystem prevent to remove the wacom driver
if it just finished its initialization, which basically kills the wacom node.

[jkosina@suse.cz: reformat changelog a bit]
Fixes c17a7476e4 ("HID: core: rewrite the hid-generic automatic unbind")
Cc: stable@vger.kernel.org # v4.17
Tested-by: Mario Limonciello <mario.limonciello@dell.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-06-25 15:29:16 +02:00
Nicolas Adenis-Lamarre
d4bdf2d2ba HID: wiimote: add support for Guitar-Hero devices
This adds the drums and guitar extensions for Wiimote devices.

Devices are reported as "Nintendo Wii Remote Guitar/Drums". If I ever
get my hands on "RockBand" guitars, I will try to report them via the
same interface so user-space does not have to bother which device it
deals with.

This is a rebase of the original commits 8e22ecb603 and 73f8645db1.
They were reverted several years ago, since they were dependent on the
ABS_* rework of the input core. Sadly, this never worked out so these
commits were never pushed into a release. This rebase now uses the
ABS_HAT* event codes to report all pressure information.

Signed-off-by: Nicolas.Adenis-Lamarre <nicolas.adenis.lamarre@gmail.com>
(Original commits by Nicolas, adapted to v4.18 by David)
Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-06-25 15:26:06 +02:00
Sebastian Andrzej Siewior
f49255e00c HID: usbhid: use irqsave() in USB's complete callback
The USB completion callback does not disable interrupts while acquiring
the ->lock. We want to remove the local_irq_disable() invocation from
__usb_hcd_giveback_urb() and therefore it is required for the callback
handler to disable the interrupts while acquiring the lock.
The callback may be invoked either in IRQ or BH context depending on the
USB host controller.
Use the _irqsave() variant of the locking primitives.

Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: linux-input@vger.kernel.org
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-06-25 15:24:46 +02:00
Robert Munteanu
dc9b8e85ed HID: redragon: fix num lock and caps lock LEDs
The redragon asura keyboard registers two input devices. The initial commit
85455dd906 ("HID: redragon: Fix modifier keys for Redragon Asura Keyboard")
considered this an error and prevented one of the devices from registering.
However, once this is done the num lock and caps lock leds no longer toggle on
and off, although the key functionality is not affected.

This commit removes the code that prevents the input device
registration and restores the num lock and caps lock LEDs.

Fixes: 85455dd906 ("HID: redragon: Fix modifier keys for Redragon Asura Keyboard")
Signed-off-by: Robert Munteanu <rombert@apache.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-06-25 15:23:40 +02:00
Ajay Gupta
305886ca87 usb: xhci: increase CRS timeout value
Some controllers take almost 55ms to complete controller
restore state (CRS).
There is no timeout limit mentioned in xhci specification so
fixing the issue by increasing the timeout limit to 100ms

[reformat code comment -Mathias]
Signed-off-by: Ajay Gupta <ajaykuee@gmail.com>
Signed-off-by: Nagaraj Annaiah <naga.annaiah@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-25 21:16:27 +08:00
Stefan Agner
3431a150fd usb: xhci: tegra: fix runtime PM error handling
The address-of operator will always evaluate to true. However,
power should be explicitly disabled if no power domain is used.

Remove the address-of operator.

Fixes: 58c38116c6 ("usb: xhci: tegra: Add support for managing powergates")
Signed-off-by: Stefan Agner <stefan@agner.ch>
Acked-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-25 21:16:27 +08:00
Dongjiu Geng
36eb93509c usb: xhci: remove the code build warning
Initialize the 'err' variate to remove the build warning,
the warning is shown as below:

drivers/usb/host/xhci-tegra.c: In function 'tegra_xusb_mbox_thread':
drivers/usb/host/xhci-tegra.c:552:6: warning: 'err' may be used uninitialized in this function [-Wuninitialized]
drivers/usb/host/xhci-tegra.c:482:6: note: 'err' was declared here

Fixes: e84fce0f88 ("usb: xhci: Add NVIDIA Tegra XUSB controller driver")
Signed-off-by: Dongjiu Geng <gengdongjiu@huawei.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Acked-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-25 21:16:27 +08:00
Zhengjun Xing
d850c16583 xhci: Fix kernel oops in trace_xhci_free_virt_device
commit 44a182b9d1 ("xhci: Fix use-after-free in xhci_free_virt_device")
set dev->udev pointer to NULL in xhci_free_dev(), it will cause kernel
panic in trace_xhci_free_virt_device. This patch reimplement the trace
function trace_xhci_free_virt_device, remove dev->udev dereference and
added more useful parameters to show in the trace function,it also makes
sure dev->udev is not NULL before calling trace_xhci_free_virt_device.
This issue happened when xhci-hcd trace is enabled and USB devices hot
plug test. Original use-after-free patch went to stable so this needs so
be applied there as well.

[ 1092.022457] usb 2-4: USB disconnect, device number 6
[ 1092.092772] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
[ 1092.101694] PGD 0 P4D 0
[ 1092.104601] Oops: 0000 [#1] SMP
[ 1092.207734] Workqueue: usb_hub_wq hub_event
[ 1092.212507] RIP: 0010:trace_event_raw_event_xhci_log_virt_dev+0x6c/0xf0
[ 1092.220050] RSP: 0018:ffff8c252e883d28 EFLAGS: 00010086
[ 1092.226024] RAX: ffff8c24af86fa84 RBX: 0000000000000003 RCX: ffff8c25255c2a01
[ 1092.234130] RDX: 0000000000000000 RSI: 00000000aef55009 RDI: ffff8c252e883d28
[ 1092.242242] RBP: ffff8c252550e2c0 R08: ffff8c24af86fa84 R09: 0000000000000a70
[ 1092.250364] R10: 0000000000000a70 R11: 0000000000000000 R12: ffff8c251f21a000
[ 1092.258468] R13: 000000000000000c R14: ffff8c251f21a000 R15: ffff8c251f432f60
[ 1092.266572] FS:  0000000000000000(0000) GS:ffff8c252e880000(0000) knlGS:0000000000000000
[ 1092.275757] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1092.282281] CR2: 0000000000000000 CR3: 0000000154209001 CR4: 00000000003606e0
[ 1092.290384] Call Trace:
[ 1092.293156]  <IRQ>
[ 1092.295439]  xhci_free_virt_device.part.34+0x182/0x1a0
[ 1092.301288]  handle_cmd_completion+0x7ac/0xfa0
[ 1092.306336]  ? trace_event_raw_event_xhci_log_trb+0x6e/0xa0
[ 1092.312661]  xhci_irq+0x3e8/0x1f60
[ 1092.316524]  __handle_irq_event_percpu+0x75/0x180
[ 1092.321876]  handle_irq_event_percpu+0x20/0x50
[ 1092.326922]  handle_irq_event+0x36/0x60
[ 1092.331273]  handle_edge_irq+0x6d/0x180
[ 1092.335644]  handle_irq+0x16/0x20
[ 1092.339417]  do_IRQ+0x41/0xc0
[ 1092.342782]  common_interrupt+0xf/0xf
[ 1092.346955]  </IRQ>

Fixes: 44a182b9d1 ("xhci: Fix use-after-free in xhci_free_virt_device")
Cc: <stable@vger.kernel.org>
Signed-off-by: Zhengjun Xing <zhengjun.xing@linux.intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-25 21:16:27 +08:00
Mathias Nyman
229bc19fd7 xhci: Fix perceived dead host due to runtime suspend race with event handler
Don't rely on event interrupt (EINT) bit alone to detect pending port
change in resume. If no change event is detected the host may be suspended
again, oterwise roothubs are resumed.

There is a lag in xHC setting EINT. If we don't notice the pending change
in resume, and the controller is runtime suspeded again, it causes the
event handler to assume host is dead as it will fail to read xHC registers
once PCI puts the controller to D3 state.

[  268.520969] xhci_hcd: xhci_resume: starting port polling.
[  268.520985] xhci_hcd: xhci_hub_status_data: stopping port polling.
[  268.521030] xhci_hcd: xhci_suspend: stopping port polling.
[  268.521040] xhci_hcd: // Setting command ring address to 0x349bd001
[  268.521139] xhci_hcd: Port Status Change Event for port 3
[  268.521149] xhci_hcd: resume root hub
[  268.521163] xhci_hcd: port resume event for port 3
[  268.521168] xhci_hcd: xHC is not running.
[  268.521174] xhci_hcd: handle_port_status: starting port polling.
[  268.596322] xhci_hcd: xhci_hc_died: xHCI host controller not responding, assume dead

The EINT lag is described in a additional note in xhci specs 4.19.2:

"Due to internal xHC scheduling and system delays, there will be a lag
between a change bit being set and the Port Status Change Event that it
generated being written to the Event Ring. If SW reads the PORTSC and
sees a change bit set, there is no guarantee that the corresponding Port
Status Change Event has already been written into the Event Ring."

Cc: <stable@vger.kernel.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-25 21:16:27 +08:00
Zhouyang Jia
44d4d51de9 HID: hid-ntrig: add error handling for sysfs_create_group
When sysfs_create_group fails, the lack of error-handling code may
cause unexpected results.

This patch adds error-handling code after calling sysfs_create_group.

Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-06-25 15:16:11 +02:00
Stephen Boyd
6136f97cd2 HID: i2c-hid: Add vddl regulator control
Some wacom w9013 devices have a vddl supply for "low valtage"
requirements. Add support in this driver to turn on this low voltage
supply. We can also drop a handful of error messages because the
regulator core is already printing an error when bulk regulators fail to
enable or disable.

Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: Hans de Goede <hdegoede@redhat.com>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Dmitry Torokhov <dtor@chromium.org>
Cc: Doug Anderson <dianders@chromium.org>
Acked-by: Rob Herring <robh@kernel.org>
Cc: <devicetree@vger.kernel.org>
Signed-off-by: Stephen Boyd <swboyd@chromium.org>
Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-06-25 15:12:42 +02:00
Stephen Boyd
d6f8389411 HID: i2c-hid: Use devm to allocate i2c_hid struct
Use devm here to save some lines and prepare for bulk regulator usage in
this driver. Otherwise, when we devm bulk get regulators we'll free the
containing i2c_hid structure and try to put regulator pointers from
freed memory.

Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: Hans de Goede <hdegoede@redhat.com>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Dmitry Torokhov <dtor@chromium.org>
Cc: Doug Anderson <dianders@chromium.org>
Signed-off-by: Stephen Boyd <swboyd@chromium.org>
Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2018-06-25 15:12:42 +02:00
Mark Brown
35fbd905b0
Merge tag 'pxa-for-4.19-dma_slave_map' of
https://github.com/rjarzmik/linux into asoc-4.19 for ac'97 deps
2018-06-25 14:05:18 +01:00
Stafford Horne
560b423dd9 openrisc: Call destructor during __pte_free_tlb
This fixes an issue uncovered when a recent change to add the "page
table" flag was merged.  During bootup we see many errors like the
following:

    BUG: Bad page state in process mkdir  pfn:00bae
    page:c1ff15c0 count:0 mapcount:-1024 mapping:00000000 index:0x0
    flags: 0x0()
    raw: 00000000 00000000 00000000 fffffbff 00000000 00000100 00000200 00000000
    page dumped because: nonzero mapcount
    Modules linked in:
    CPU: 0 PID: 46 Comm: mkdir Tainted: G    B             4.17.0-simple-smp-07461-g1d40a5ea01d5-dirty #993
    Call trace:
    [<(ptrval)>] show_stack+0x44/0x54
    [<(ptrval)>] dump_stack+0xb0/0xe8
    [<(ptrval)>] bad_page+0x138/0x174
    [<(ptrval)>] ? cpumask_next+0x24/0x34
    [<(ptrval)>] free_pages_check_bad+0x6c/0xd0
    [<(ptrval)>] free_pcppages_bulk+0x174/0x42c
    [<(ptrval)>] free_unref_page_commit.isra.17+0xb8/0xc8
    [<(ptrval)>] free_unref_page_list+0x10c/0x190
    [<(ptrval)>] ? set_reset_devices+0x0/0x2c
    [<(ptrval)>] release_pages+0x3a0/0x414
    [<(ptrval)>] tlb_flush_mmu_free+0x5c/0x90
    [<(ptrval)>] tlb_flush_mmu+0x90/0xa4
    [<(ptrval)>] arch_tlb_finish_mmu+0x50/0x94
    [<(ptrval)>] tlb_finish_mmu+0x30/0x64
    [<(ptrval)>] exit_mmap+0x110/0x1e0
    [<(ptrval)>] mmput+0x50/0xf0
    [<(ptrval)>] do_exit+0x274/0xa94
    [<(ptrval)>] do_group_exit+0x50/0x110
    [<(ptrval)>] __wake_up_parent+0x0/0x38
    [<(ptrval)>] _syscall_return+0x0/0x4

During the __pte_free_tlb path openrisc fails to call the page
destructor which would clear the new bits that were introduced.
To fix this we are calling the destructor.

It seem openrisc was the only architecture missing this,  all other
architectures either call the destructor like we are doing here or use
pte_free.

Note: failing to call the destructor was also messing up the zone stats
(and will be cause other problems if you were using SPLIT_PTE_PTLOCKS,
which we are not yet).

Fixes: 1d40a5ea01 ("mm: mark pages in use for page tables")
Acked-by: Matthew Wilcox <willy@infradead.org>
Signed-off-by: Stafford Horne <shorne@gmail.com>
2018-06-25 21:49:10 +09:00
Greg Kroah-Hartman
9d1a68c458 usb: fixes for v4.18-rc1
First set of fixes for the current -rc cycle. The main parts being
 warnings of different kinds being fixed. We're also adding support for
 Intel'l Icelake devices on dwc3-pci.c.
 -----BEGIN PGP SIGNATURE-----
 
 iQJRBAABCgA7FiEElLzh7wn96CXwjh2IzL64meEamQYFAlsqNq8dHGZlbGlwZS5i
 YWxiaUBsaW51eC5pbnRlbC5jb20ACgkQzL64meEamQY5ZA/7BHz9bfj91OYjslUQ
 2CNQaidnzy0ESHxdWEcsOrH3Kqlfv7ByAlG/TP2xwSwWH4jf9WWT7N11jWQpFiNr
 mY51S+VX9zGk65mK2z1lg3F7lZkJBhVSpUApPEEayrb4+tJlGnNDvA7ceocple79
 zSiSD7PNeQmwlU4lJPfcPIsUVoP5s6ZP23t3Fdaa+aB72zmGw7QV+y7fO+NV2SaV
 BXQOUoFGv/Y7LO+Q1w2tcYLzfFMwuoknHYEc4CyYvknoVaqb7doft52i7MJs0/Oy
 tXXRKmprWIwt4xkxkrU6E7WKuECIBZIrOiaaoX6ehB+kwtkNsKvo023YZ7OLTgWo
 W6gciUJ0h19ws+I0GIdnp1aPvFFNte6wuaBpAT8DMFWw7A2Uzvidr6F6kJlHG/9u
 n8tuhS3RHu/AQNT/utiCOh0zucSrir2L4s/fU+7MBlFg2odiOquuZ+HR4D7xwzGL
 +ZUpVdYqAioja2NfzCsG7l0MOzcYXLeVJ0hDNjXzz9QpRceDSrz0Mkl7jh/GM9Ro
 Uml33AmlxnpgLcX7dPqOpUib2jXapyHM5EObhNikAoVamQ8T4qeu/eKT3zBNmEK7
 9QoQczWM/O/oUMPQ1asRjqL8y3qz3zQtlcnngz+zj7J5Oxf1SEyrB+IiDIsITRUd
 k2zdwl6v+v5/uMh2PaKWioZmiYU=
 =g4LL
 -----END PGP SIGNATURE-----

Merge tag 'fixes-for-v4.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus

usb: fixes for v4.18-rc1

First set of fixes for the current -rc cycle. The main parts being
warnings of different kinds being fixed. We're also adding support for
Intel'l Icelake devices on dwc3-pci.c.
2018-06-25 20:42:16 +08:00
Erwan Le Ray
c322d96fcc ARM: dts: stm32: m_can support to stm32mp157c
Add support for the Controller Area Network m_can to STM32MP157C SoC.

Signed-off-by: Bich Hemon <bich.hemon@st.com>
Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
2018-06-25 14:18:59 +02:00
Lionel Debieve
1e726a40e0 ARM: dts: stm32: Add HASH support on stm32mp157c
This patch add HASH instance of the stm32mp157c SoC

Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
2018-06-25 14:11:46 +02:00
Janusz Krzysztofik
50c678772a
ASoC: cx20442: Don't ignore regulator_get() errors.
In its current shape, the driver just ignores errors returned by
regulator_get() at component_probe().  This doesn't hurt on Amstrad
Delta board as long as it registers the codec device at late_initcall,
when the regulator which depends on basic-mmio-gpio device (probed as
late as at dev_initcall) is already available.  Otherwise the driver
may end up trying to control a codec which is not powered up.

Remove that dependency on initialization order by handling the error.
If the regulator is not yet available and -ENODEV is returned, convert
it to -EPROBE_DEFER to get another chance.

Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2018-06-25 12:45:15 +01:00
Petr Mladek
043f891b70 Revert "lib/test_printf.c: call wait_for_random_bytes() before plain %p tests"
This reverts commit ee410f15b1.

It might prevent the machine from boot. It would wait for enough
randomness at the very beginning of kernel_init(). But there is
basically nothing running in parallel that would help to produce
any randomness.

Reported-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Petr Mladek <pmladek@suse.com>
2018-06-25 13:44:20 +02:00
Amelie Delaunay
860f0d21a7 ARM: dts: stm32: update rtc st,syscfg property on stm32f746
To fit with latest rtc driver updates, rtc st,syscfg property must contain
the control register offset of pwrcfg and the mask corresponding to the
DBP (Disable Backup Protection) bit.

Signed-off-by: Amelie Delaunay <amelie.delaunay@st.com>
Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
2018-06-25 12:02:08 +02:00
Amelie Delaunay
3306657119 ARM: dts: stm32: update rtc st,syscfg property on stm32f429
To fit with latest rtc driver updates, rtc st,syscfg property must contain
the control register offset of pwrcfg and the mask corresponding to the
DBP (Disable Backup Protection) bit.

Signed-off-by: Amelie Delaunay <amelie.delaunay@st.com>
Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
2018-06-25 12:02:08 +02:00
Jakub Kicinski
68d676a089 nfp: bpf: don't stop offload if replace failed
Stopping offload completely if replace of program failed dates
back to days of transparent offload.  Back then we wanted to
silently fall back to the in-driver processing.  Today we mark
programs for offload when they are loaded into the kernel, so
the transparent offload is no longer a reality.

Flags check in the driver will only allow replace of a driver
program with another driver program or an offload program with
another offload program.

When driver program is replaced stopping offload is a no-op,
because driver program isn't offloaded.  When replacing
offloaded program if the offload fails the entire operation
will fail all the way back to user space and we should continue
using the old program.  IOW when replacing a driver program
stopping offload is unnecessary and when replacing offloaded
program - it's a bug, old program should continue to run.

In practice this bug would mean that if offload operation was to
fail (either due to FW communication error, kernel OOM or new
program being offloaded but for a different netdev) driver
would continue reporting that previous XDP program is offloaded
but in fact no program will be loaded in hardware.  The failure
is fairly unlikely (found by inspection, when working on the code)
but it's unpleasant.

Backport note: even though the bug was introduced in commit
cafa92ac25 ("nfp: bpf: add support for XDP_FLAGS_HW_MODE"),
this fix depends on commit 441a33031f ("net: xdp: don't allow
device-bound programs in driver mode"), so this fix is sufficient
only in v4.15 or newer.  Kernels v4.13.x and v4.14.x do need to
stop offload if it was transparent/opportunistic, i.e. if
XDP_FLAGS_HW_MODE was not set on running program.

Fixes: cafa92ac25 ("nfp: bpf: add support for XDP_FLAGS_HW_MODE")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-06-25 11:33:55 +02:00
Masahiro Yamada
996302c5e8 module: replace VMLINUX_SYMBOL_STR() with __stringify() or string literal
With the special case handling for Blackfin and Metag was removed by
commit 94e58e0ac3 ("export.h: remove code for prefixing symbols with
underscore"), VMLINUX_SYMBOL_STR() is now equivalent to __stringify().

Replace the remaining usages to prepare for the entire removal of
VMLINUX_SYMBOL_STR().

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Jessica Yu <jeyu@kernel.org>
2018-06-25 11:18:29 +02:00
Takashi Iwai
c9a4c63888 ALSA: seq: Fix UBSAN warning at SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT ioctl
The kernel may spew a WARNING with UBSAN undefined behavior at
handling ALSA sequencer ioctl SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT:

UBSAN: Undefined behaviour in sound/core/seq/seq_clientmgr.c:2007:14
signed integer overflow:
2147483647 + 1 cannot be represented in type 'int'
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x122/0x1c8 lib/dump_stack.c:113
 ubsan_epilogue+0x12/0x86 lib/ubsan.c:159
 handle_overflow+0x1c2/0x21f lib/ubsan.c:190
  __ubsan_handle_add_overflow+0x2a/0x31 lib/ubsan.c:198
 snd_seq_ioctl_query_next_client+0x1ac/0x1d0 sound/core/seq/seq_clientmgr.c:2007
 snd_seq_ioctl+0x264/0x3d0 sound/core/seq/seq_clientmgr.c:2144
 ....

It happens only when INT_MAX is passed there, as we're incrementing it
unconditionally.  So the fix is trivial, check the value with
INT_MAX.  Although the bug itself is fairly harmless, it's better to
fix it so that fuzzers won't hit this again later.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=200211
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-06-25 11:18:04 +02:00
Michel Pollet
4c3d88526e clk: renesas: Renesas R9A06G032 clock driver
This provides a clock driver for the Renesas R09A06G032.
This uses a structure derived from both the R-Car Gen2 driver as well as
the renesas-cpg-mssr driver.

Signed-off-by: Michel Pollet <michel.pollet@bp.renesas.com>
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2018-06-25 11:17:13 +02:00
Takashi Iwai
b41f794f28 ALSA: timer: Fix UBSAN warning at SNDRV_TIMER_IOCTL_NEXT_DEVICE ioctl
The kernel may spew a WARNING about UBSAN undefined behavior at
handling ALSA timer ioctl SNDRV_TIMER_IOCTL_NEXT_DEVICE:

UBSAN: Undefined behaviour in sound/core/timer.c:1524:19
signed integer overflow:
2147483647 + 1 cannot be represented in type 'int'
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x122/0x1c8 lib/dump_stack.c:113
 ubsan_epilogue+0x12/0x86 lib/ubsan.c:159
 handle_overflow+0x1c2/0x21f lib/ubsan.c:190
 __ubsan_handle_add_overflow+0x2a/0x31 lib/ubsan.c:198
 snd_timer_user_next_device sound/core/timer.c:1524 [inline]
 __snd_timer_user_ioctl+0x204d/0x2520 sound/core/timer.c:1939
 snd_timer_user_ioctl+0x67/0x95 sound/core/timer.c:1994
 ....

It happens only when a value with INT_MAX is passed, as we're
incrementing it unconditionally.  So the fix is trivial, check the
value with INT_MAX.  Although the bug itself is fairly harmless, it's
better to fix it so that fuzzers won't hit this again later.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=200213
Reported-and-tested-by: Team OWL337 <icytxw@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-06-25 11:17:01 +02:00
Michel Pollet
e4b08e1f3e dt-bindings: clock: renesas,r9a06g032-sysctrl: documentation
The Renesas R9A06G032 SYSCTRL node description.

Signed-off-by: Michel Pollet <michel.pollet@bp.renesas.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2018-06-25 11:09:19 +02:00
Jason A. Donenfeld
62267e0ecc module: print sensible error code
Printing "err 0" to the user in the warning message is not particularly
useful, especially when this gets transformed into a -ENOENT for the
remainder of the call chain.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Jessica Yu <jeyu@kernel.org>
2018-06-25 10:37:08 +02:00
Chengguang Xu
3391ca1dcd USB: serial: cast sizeof() to int when comparing with error code
Negative error code will be larger than sizeof().

Note that none of these bugs prevent errors from being detected, even if
the ir-usb one would cause a less precise debug message to printed.

Signed-off-by: Chengguang Xu <cgxu519@gmx.com>
[ johan: add comment about implications ]
Signed-off-by: Johan Hovold <johan@kernel.org>
2018-06-25 10:34:31 +02:00
Martin Schwidefsky
c879f71c74 Merge branch 'zcrypt' into features
Add the zcrypt base patches into features using a tip branch for
parallel merging via multiple tress.
2018-06-25 10:25:09 +02:00
Harald Freudenberger
f1b0a4343c s390/zcrypt: Integrate ap_asm.h into include/asm/ap.h.
Move all the inline functions from the ap bus header
file ap_asm.h into the in-kernel api header file
arch/s390/include/asm/ap.h so that KVM can make use
of all the low level AP functions.

Signed-off-by: Harald Freudenberger <freude@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:21:18 +02:00
Harald Freudenberger
4a07750ba8 s390/zcrypt: Show load of cards and queues in sysfs
Show the current load value of cards and queues in sysfs.
The load value for each card and queue is maintained by
the zcrypt device driver for dispatching and load
balancing requests over the available devices.

This patch provides the load value to userspace via a
new read only sysfs attribute 'load' per card and queue.

Signed-off-by: Harald Freudenberger <freude@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:21:17 +02:00
Harald Freudenberger
df80c03831 s390/zcrypt: Review inline assembler constraints.
Reviewed and adapted the register use and asm constraints
of the C inline assembler functions in accordance to the
the AP instructions specifications.

Signed-off-by: Harald Freudenberger <freude@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:21:17 +02:00
Harald Freudenberger
ea3c4185ef s390/zcrypt: Add ZAPQ inline function.
Added new inline function ap_pqap_zapq()
which is a C inline function wrapper for
the AP PQAP(ZAPQ) instruction.

Signed-off-by: Harald Freudenberger <freude@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:21:16 +02:00
Vasily Gorbik
514211f542 s390/setup: do not reserve the decompressor code
Introduce PARMAREA_END, and use it for memblock reserve of low
memory, which is used for lowcore, kdump data mover code and page
buffer, early stack and parmarea. There is no need to reserve an
area between PARMAREA_END and the decompressor _ehead.

Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:14:41 +02:00
Arnd Bergmann
6075e4ae6e s390: hypfs: use ktime_get_seconds() instead of get_seconds()
time_t and get_seconds() are deprecated because they will overflow on
32-bit architectures in the future. This is not a problem on 64-bit s390,
but we should use proper interfaces anyway.

Besides moving to the time64_t based interface, the CLOCK_MONOTONIC
based ktime_get_seconds() is preferred for kernel internal timekeeping
because it does not behave in unexpected ways during leap second changes
or settimeofday() calls.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:14:41 +02:00
Vasily Gorbik
89b5202e81 s390/decompressor: support uncompressed kernel
Implement uncompressed kernel support (when "None" is picked in kernel
compression mode list). In that case an actual decompression code is
skipped and control is passed from boot/head.S to startup_continue in
kernel/head64.S. To achieve that uncompressed kernel payload is
conditionally put at 0x100000 in bzImage.

In reality this is very close to classic uncompressed kernel "image",
but the decompressor has its own build and link process,
kernel/head64.S lives at 0x100000 rather than at 0x11000, and .bss
section is reused for both stages.

Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:14:40 +02:00
Vasily Gorbik
f16466af38 init/Kconfig: add an option for uncompressed kernel
Add "None" as the kernel compression mode.

This option is useful for debugging the kernel in slow simulation
environments, where decompressing and moving the kernel is awfully slow.

Uncompressed kernel implementation might allow early boot code to skip the
decompressor and jump right at uncompressed kernel image entry point.

Platforms implementing that should define HAVE_KERNEL_UNCOMPRESSED.

Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:14:40 +02:00
Vasily Gorbik
c98b6c679a s390/decompressor: allow to pack uncompressed vmlinux.bin into piggy.o
If none of compression methods defined, leave suffix-y empty, so that
plain uncompressed vmlinux.bin could be reused instead.

Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:14:40 +02:00
Vasily Gorbik
b8326bf52e s390/decompressor: allow preprocessor in piggy.o linker script
Rename vmlinux.scr to vmlinux.scr.lds.S and add it to build rules to
enable preprocessor for it.

Also add vmlinux.scr.lds to local .gitignore

Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:14:40 +02:00
Vasily Gorbik
0580bce131 s390/decompressor: extend .bss check for early code
Cover the decompressor code with no .bss usage compile time check.

Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:14:40 +02:00
Vasily Gorbik
78c95647e7 s390: add custom target and make path extension optional for .bss check
"chkbss-target" could be now used to override default target .bss check
is bound to. Objects to be checked are only path extended when needed.

Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:14:39 +02:00
Vasily Gorbik
4560ff1386 s390/decompressor: avoid repeating objects list in Makefile
Optimize the decompressor's Makefile to have a single objects list.

Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:14:39 +02:00
Vasily Gorbik
cad5b35da9 s390/decompressor: reuse lib/mem.S for mem functions
Reusing arch/s390/lib/mem.S file solves a problem that sclp_early_core.c
and its dependencies have to be compiled with -march=z900 (no need to
compile compressed/misc.c with -march=z900). This also allows to avoid
mem functions duplicates, makes code a bit smaller and optimized mem
functions are utilized.

Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:14:39 +02:00
Vasily Gorbik
a1d7d91f10 s390/decompressor: avoid reusing uncompressed image objects
Re-compile ebcdic.c and sclp_early_core.c for the decompressor,
using proper decompressor CFLAGS. This also allows to potentially use
instrumentation for those files when built for the main kernel image.

With kbuild there is no easy way to re-compile a source file from
another directory. Bypass ugly rules and Makefile meta-programming
with relative path includes of original files.

Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:14:39 +02:00
Vasily Gorbik
2dd26659e3 s390/als: avoid .init.* sections usage
Since als.c is the part of the decompressor only, there is no point in
using init sections for code and data. That's just creating extra
sections in the decompressor image.

Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:14:38 +02:00
Vasily Gorbik
a5802353b1 s390/decompressor: rename entry point to startup_decompressor
Rename the decompressor entry point to startup_decompressor to
avoid confusion, leaving startup_continue as the entry point of the
uncompressed image.

Also remove obsolete comment, as the decompressor code is
unconditionally called from boot/head.S now.

Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:14:38 +02:00
Vasily Gorbik
8282cd64d0 s390/boot: make head.S and als.c be part of the decompressor only
Since uncompressed kernel image does not have to be bootable anymore,
move head.S, head_kdump.S and als.c to boot/ folder and compile them
in just in the decompressor.

Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:14:38 +02:00
Vasily Gorbik
bd79d66329 s390/decompressor: trim the kernel image up to 1M
Move head64.S main kernel entry point "startup_continue" to 0x100000 and
trim everything which is below 1M during build. So, that the decompressor
would unpack the main kernel image, move it to 0x100000 and jump to
startup_continue.

Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:14:38 +02:00
Vasily Gorbik
00f2fb573f s390: remove uncompressed kernel image build
Dropping support for uncompressed kernel "image" build. Having
both image and bzImage makes it complicated to add new code to an
early boot phase (which is part of vmlinux for uncompressed kernel and
a separate arch/s390/boot/compressed/vmlinux for bzImage).

e.g. sclp_early_core.o is used for both, the decompressor phase and the
main kernel. The fact of having uncompressed kernel "image" forces us
to have a single object file and sacrifice instrumentation flags on such
files (so that we could use them early). The story gets much more
complicated with the need to utilize some of the string functions.

With bzImage only support, we have 2 separate boot stages each built
and linked separately, which allows to reuse some shared code, but
recompile with appropriate flags.

Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2018-06-25 10:14:38 +02:00