Commit graph

798,688 commits

Author SHA1 Message Date
Andrew F. Davis
99f4855923 ARM: dts: am572x-idk: Add tricolor Industrial LED support
AM572x-IDK rev 1.3A has tricolor RGB LEDs that can be controlled using
GPIO. Expose these to userspace for usage as necessary.

Signed-off-by: Andrew F. Davis <afd@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:29:32 -07:00
Andrew F. Davis
d71fef3c75 ARM: dts: am571x-idk: Add tricolor Industrial LED support
AM571x-IDK rev 1.2A has tricolor RGB LEDs that can be controlled using
GPIO. Expose these to userspace for usage as necessary.

Signed-off-by: Andrew F. Davis <afd@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:29:24 -07:00
Linus Torvalds
5393734014 ACPI fixes for 4.19-rc3
- Fix a power management regression in the ACPI driver for Intel
    SoCs (LPSS) introduced by a system-wide suspend/resume fix during
    the 4.18 cycle (Zhang Rui).
 
  - Prevent dmi_check_system() from being called on non-x86 systems in
    the ACPI core (Jean Delvare).
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJbkjqmAAoJEILEb/54YlRxUn0QAKNCccsWcBnli0OkFKQNvgHN
 cSq8sBLi6PoBULbkOKXgUPxjOajoeJ4I4YyZUIKD8sj4MJyLjGFQY+eDGHqjIetO
 8MmAtSPlmu9xwO3T9OAhnRFI/zMYXHoT1PP7fGfQr8Ok0CpPlfIVZBGzy/9G8PeR
 wgEYSIEcHpD6KphOG0FcUsA2aJdQf9pFe+OPBnNJpj8s7d6nsNhcYqoxQS4R7auz
 2jJkh7khSwuY9EK8+mTLxnx9KUK3E39sTpgFbaixuujUEMnH5hVe1WpH38SC1ufZ
 tGmXA19wZ9xzH02TA5tymx4dViDWMAQBNjoQ7uyqqLWM20oELE0MLbORyIqrUORP
 wf6A+45xNxoVfQieqr8JJMjj0uPeCjKD1kLfPw6xerAI1+xXU7RRGcnaca1UoTVa
 BmKrmReuC+7vpPJ6kZgR0m+LsaIyDF+b4/glgSJH28KoZwv6ZePxvd1tNZsdgYon
 P5lBwLAMXvXvIrEkyx7MAz211EXM0AfJ4Vlt+How9vJt0g6y7cOETsP8hcguYTSb
 KNUiCTL2/+lGMnPYPsWpRFRYYtWMI2gFs97/HO+Ay2MdH3NjQS0CkZ9sNphlixMV
 5dhVidswOwP1lQomps0PZkE2ZW38WedHXuGtQSl3imYhJbWLkoo8PINBt2vwh6cm
 YP+/eFIk4D/hvPFESjvA
 =R0It
 -----END PGP SIGNATURE-----

Merge tag 'acpi-4.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull ACPI fixes from Rafael Wysocki:
 "These fix a regression from the 4.18 cycle in the ACPI driver for
  Intel SoCs (LPSS) and prevent dmi_check_system() from being called on
  non-x86 systems in the ACPI core.

  Specifics:

   - Fix a power management regression in the ACPI driver for Intel SoCs
     (LPSS) introduced by a system-wide suspend/resume fix during the
     4.18 cycle (Zhang Rui).

   - Prevent dmi_check_system() from being called on non-x86 systems in
     the ACPI core (Jean Delvare)"

* tag 'acpi-4.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI / LPSS: Force LPSS quirks on boot
  ACPI / bus: Only call dmi_check_system() on X86
2018-09-07 10:25:26 -07:00
Linus Torvalds
69ddce94e3 sound fixes for 4.19-rc3
Just a few small fixes:
 - a fix for the recursive work cancellation in a specific HD-audio
   operation mode
 - a fix for potentially uninitialized memory access via rawmidi
 - the register bit access fixes for ASoC HD-audio
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAluRUPIOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE+Ocg/+IyPtFzekuBO5zqp9PtDAz0stpvYiUerRYzUL
 PUZzKq4RoIpcZb5wk5wNATAlVGXhQEDzPdjYHQCW639Osj9s6429EufoKXqL9U29
 UrKDMJBCmha3CAe6GJsBTNC/Lt8Zp60nV9HYfT9EU0LPRhQ9kw+gX2I7HyFxE5aw
 7Ik5jOpiC+cR7gSuROL0ZzPQ4mG3YWSe6OWXYpoefuuDRQ7NpG4GIn/KQlJMoUlx
 41GABCvLu2PIApczXzgZUGhTq4C+/0xZuYF4qf4iM5bDFhPxOC1u2eQftiXL5jGI
 +ZWnCjw7005FmH3Yvwrc3S1vpdI26Kzd7Zg5F4xb5vSOybRLmajbnGq1jzqm7bDh
 TcyET4VnX2gkL3DYq5fgwI5gqJPqkd8K8NC1L+YtqzAMb1GN2qDj/0FebGnY1Jpn
 Zufu25bnX+3JKAYB37c/TSzdkKFch6w0Z2TtsmlYjpmTz0m1AyiwdyQ2HcTr+KBx
 a1b1YU5+pvgRFpmgQUpGgXgyoG6+51np4oYf7Memc3gR1Fq8vht18hStgCP0qpuP
 b4uvgOtSKMxJVDxflAbOHE+nhX1O9RciXR7Mep4haDtOTm8bW931L+GlkH1mRRYg
 e4PAo4TmfzcQCyRATWMaA9i4l2hwRyhpndjAP81lyCVba3WBZa7xnLPaDLFFmSuT
 b0h9hi4=
 =nuWw
 -----END PGP SIGNATURE-----

Merge tag 'sound-4.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "Just a few small fixes:

   - a fix for the recursive work cancellation in a specific HD-audio
     operation mode

   - a fix for potentially uninitialized memory access via rawmidi

   - the register bit access fixes for ASoC HD-audio"

* tag 'sound-4.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda: Fix several mismatch for register mask and value
  ALSA: rawmidi: Initialize allocated buffers
  ALSA: hda - Fix cancel_work_sync() stall from jackpoll work
2018-09-07 10:20:31 -07:00
H. Nikolaus Schaller
d2eaf949d2 ARM: dts: omap3-gta04a5one: define GTA04A5 variant with OneNAND
GTA04A5 has been produced with MCP chips either with
 512MB RAM +  512MB NAND
 512MB RAM + 1024MB NAND
1024MB RAM +  512MB OneNAND

RAM setup is done by U-Boot (MLO/SPL) but OneNAND needs
a different setup of the GPMC. So we need to derive a
DTB variant that modifies the gpmc and nand setup.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:11:06 -07:00
H. Nikolaus Schaller
2b5633eb86 ARM: dts: omap3-gta04a5: define pinmux for bluetooth enable of ti,wl1837 module
Properly pinmux the bluetooth enable so that it is not floating.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:11:05 -07:00
H. Nikolaus Schaller
806c99ed78 ARM: dts: omap3-gta04a5: uses different sensors than gta04a4
Sensors for acceleration, rotation, magnetic heading and
barometer have been replaced in the A5 variant.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:11:05 -07:00
H. Nikolaus Schaller
61fedc14b6 ARM: dts: omap3-gta04a5: add support for ti,wl1837 module
GTA04A5 uses a ti,wl1837 WiFi/Bluetooth module. Overwrite
the mmc2 node and child.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:11:04 -07:00
H. Nikolaus Schaller
43541bfa4c ARM: dts: omap3-gta04a5: disable IrDA receiver to save power
The GTA04A5 has an improved IrDA circuit that can enable/disable
the receiver individually. We do not have an IrDA driver/subsystem
and hence the receiver should be actively turned off to save power,
especially in suspend.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:11:03 -07:00
H. Nikolaus Schaller
4440f94d06 ARM: dts: omap3-gta04a5: add support for PPS
GPS receiver provides a 1PPS signal to a gpio.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:11:03 -07:00
H. Nikolaus Schaller
3bace6a401 ARM: dts: omap3-gta04a5: fix whitepsace and tab style
in node sound / property ti,jack-det-gpio.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:11:02 -07:00
H. Nikolaus Schaller
acdf6035a8 ARM: dts: omap3-gta04a5: fix model name
GTA04 is the project name and Letux 2804 the product name.
Report both.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:11:02 -07:00
H. Nikolaus Schaller
b918bba089 ARM: dts: omap3-gta04a5: fix copyright of A5 variant
Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:11:01 -07:00
H. Nikolaus Schaller
18c7bd3204 ARM: dts: omap3-gta04a4: fix model name for A4 variant
GTA04 is the project name and Letux 2804 the product name.
Report both.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:11:00 -07:00
H. Nikolaus Schaller
2719623ea7 ARM: dts: omap3-gta04a3: fix model name for A3 variant
GTA04 is the project name and Letux 2804 the product name.
Report both.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:11:00 -07:00
H. Nikolaus Schaller
2cc86a4705 ARM: dts: omap3-gta04: add mcbsp (audio subsystem) nodes
GTA04 audio system makes use of all four McBSP ports, so enable and
connect them with pinmux.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:59 -07:00
H. Nikolaus Schaller
f5f15be141 ARM: dts: omap3-gta04: add devconf0 setup for mcbsp1 clock pins
McBSP1 needs special "pinctrl" for the clocks.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:58 -07:00
H. Nikolaus Schaller
3c10507a39 ARM: dts: omap3-gta04: add mcbsp (audio subsystem) pinmux
GTA04 audio system makes use of all four McBSP ports, so set
up proper pinmux.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:58 -07:00
H. Nikolaus Schaller
8f69850f04 ARM: dts: omap3-gta04: add camera pinmux
ISP needs camera pinmux (which is referenced by the camera node).

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:57 -07:00
H. Nikolaus Schaller
f2b710826f ARM: dts: omap3-gta04: add camera interface parallel port
The GTA04 has an optional OV9655 camera (for which we do
not yet have a driver upstream), but the ISP hardware
connection description in the device tree is independent
of that.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:57 -07:00
H. Nikolaus Schaller
eaf2dbd0d2 ARM: dts: omap3-gta04: map antenna detect GPIO to SW_LINEIN_INSERT key event
GTA04 can detect presence/absence or plug-in of an external
GPS antenna through a gpio. The best match for an event code
is SW_LINEIN_INSERT.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:56 -07:00
H. Nikolaus Schaller
39b1c4944f ARM: dts: omap3-gta04: make use of input event include file and constants
we can replace magic numbers by symbolic constants now.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:55 -07:00
H. Nikolaus Schaller
f38bb4e9ec ARM: dts: omap3-gta04: explicitly describe that mmc1 has no CD/WP
There are neither CD nor WP switches for mmc1. The µSD slot is
located under the SIM card under the battery and not accessible
during operation.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:55 -07:00
H. Nikolaus Schaller
d2c4c27035 ARM: dts: omap3-gta04: add warning comment to vaux2 regulator
vaux2 should remain always on since a higher potential at vio
could potentially damage the itg3200 sensor.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:54 -07:00
H. Nikolaus Schaller
ebd4fc999e ARM: dts: omap3-gta04: add a comment how to reference the tca6507 gpio
Make clear how to use the wifi_reset since it is not obvious.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:54 -07:00
H. Nikolaus Schaller
1ae00833e3 ARM: dts: omap3-gta04: keep vpll2 always on
This is needed to make the display and venc work properly.
Compare to omap3-beagle.dts.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:53 -07:00
H. Nikolaus Schaller
f22a9e64c3 ARM: dts: omap3-gta04: update gpmc NAND setup
to better match omap3-beagle.dts (which was the basis
of designing the GTA04).

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:52 -07:00
H. Nikolaus Schaller
fa99c21ecb ARM: dts: omap3-gta04: make NAND partitions compatible with recent U-Boot
Vendor defined U-Boot has changed the partition scheme a while ago:

* kernel partition 6MB
* file system partition uses the remainder up to end of the NAND
* increased size of the environment partition (to get an OneNAND compatible base address)
* shrink the U-Boot partition

Let's be compatible (e.g. Debian kernel built from upstream).

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:52 -07:00
H. Nikolaus Schaller
5d282d3f2f ARM: dts: omap3-gta04: add pinmux for bmp085 EOC interrupt
Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:51 -07:00
H. Nikolaus Schaller
7384a24248 ARM: dts: omap3-gta04: fix touchscreen tsc2007
we fix penirq polarity, add penirq pinmux and touchscreen
properties.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:50 -07:00
H. Nikolaus Schaller
8905592b6e ARM: dts: omap3-gta04: tvout: enable as display1 alias
The omap dss susbystem takes the display aliases to find
out which displays exist. To enable tv-out we must define
an alias.

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:50 -07:00
H. Nikolaus Schaller
e08962dff1 ARM: dts: omap3-gta04: add devconf1 setup for correct tvout pins
The VENC with external OPA362 amplifier needs a special
"pinmux" setup in DEVCONF1 (TVOUTBYPASS and TVOUTACEN).

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:49 -07:00
H. Nikolaus Schaller
f659139137 ARM: dts: omap3-gta04: fixes for tvout / venc
* fix connector compatibility (composite)
* add comment for gpio1 23
* add proper #address-cells
* we use only one venc_out channel for composite

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:49 -07:00
H. Nikolaus Schaller
fa0d7dc355 ARM: dts: omap3-gta04: give spi_lcd node a label so that we can overwrite in other DTS files
needed for device variants based on GTA04 board but with
different display panel (driver).

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:48 -07:00
H. Nikolaus Schaller
eef69561c6 ARM: dts: omap3-gta04: fix some whitespace and tab style errors
tab+space -> tab only	 for /* GSM audio */
spaces -> tab for dss_dpi_pins

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:47 -07:00
H. Nikolaus Schaller
85ca3d04c0 ARM: dts: omap3-gta04: fix typo in backlight pins node name
mn -> nm for backlight_pins

Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
2018-09-07 10:10:47 -07:00
Dominique Martinet
b4dc44b3ca 9p locks: fix glock.client_id leak in do_lock
the 9p client code overwrites our glock.client_id pointing to a static
buffer by an allocated string holding the network provided value which
we do not care about; free and reset the value as appropriate.

This is almost identical to the leak in v9fs_file_getlock() fixed by
Al Viro in commit ce85dd58ad ("9p: we are leaking glock.client_id
in v9fs_file_getlock()"), which was returned as an error by a coverity
false positive -- while we are here attempt to make the code slightly
more robust to future change of the net/9p/client code and hopefully
more clear to coverity that there is no problem.

Link: http://lkml.kernel.org/r/1536339057-21974-5-git-send-email-asmadeus@codewreck.org
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
2018-09-08 01:52:35 +09:00
Dominique Martinet
ef5305f1f7 9p: p9dirent_read: check network-provided name length
strcpy to dirent->d_name could overflow the buffer, use strscpy to check
the provided string length and error out if the size was too big.

While we are here, make the function return an error when the pdu
parsing failed, instead of returning the pdu offset as if it had been a
success...

Link: http://lkml.kernel.org/r/1536339057-21974-4-git-send-email-asmadeus@codewreck.org
Addresses-Coverity-ID: 139133 ("Copy into fixed size buffer")
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
2018-09-08 01:52:29 +09:00
Dominique Martinet
473c7dd1d7 9p/rdma: remove useless check in cm_event_handler
the client c is always dereferenced to get the rdma struct, so c has to
be a valid pointer at this point.
Gcc would optimize that away but let's make coverity happy...

Link: http://lkml.kernel.org/r/1536339057-21974-3-git-send-email-asmadeus@codewreck.org
Addresses-Coverity-ID: 102778 ("Dereference before null check")
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
2018-09-08 01:52:22 +09:00
Dominique Martinet
e02a53d92e 9p: acl: fix uninitialized iattr access
iattr is passed to v9fs_vfs_setattr_dotl which does send various
values from iattr over the wire, even if it tells the server to
only look at iattr.ia_valid fields this could leak some stack data.

Link: http://lkml.kernel.org/r/1536339057-21974-2-git-send-email-asmadeus@codewreck.org
Addresses-Coverity-ID: 1195601 ("Uninitalized scalar variable")
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
2018-09-08 01:51:50 +09:00
Dinu-Razvan Chis-Serban
5e172f75e5 9p locks: add mount option for lock retry interval
The default P9_LOCK_TIMEOUT can be too long for some users exporting
a local file system to a guest VM (30s), make this configurable at
mount time.

Link: http://lkml.kernel.org/r/1536295827-3181-1-git-send-email-asmadeus@codewreck.org
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195727
Signed-off-by: Dinu-Razvan Chis-Serban <justcsdr@gmail.com>
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
2018-09-08 01:40:06 +09:00
Gertjan Halkes
2803cf4379 9p: do not trust pdu content for stat item size
v9fs_dir_readdir() could deadloop if a struct was sent with a size set
to -2

Link: http://lkml.kernel.org/r/1536134432-11997-1-git-send-email-asmadeus@codewreck.org
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=88021
Signed-off-by: Gertjan Halkes <gertjan@google.com>
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
2018-09-08 01:40:06 +09:00
Tomas Bortoli
6d35190f39 9p: Rename req to rreq in trans_fd
In struct p9_conn, rename req to rreq as it is used by the read routine.

Link: http://lkml.kernel.org/r/20180903160321.2181-1-tomasbortoli@gmail.com
Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
Suggested-by: Jun Piao <piaojun@huawei.com>
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
2018-09-08 01:40:04 +09:00
Gustavo A. R. Silva
426d5a0f97 9p: fix spelling mistake in fall-through annotation
Replace "fallthough" with a proper "fall through" annotation.

This fix is part of the ongoing efforts to enabling -Wimplicit-fallthrough

Link: http://lkml.kernel.org/r/20180903193806.GA11258@embeddedor.com
Addresses-Coverity-ID: 402012 ("Missing break in switch")
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
2018-09-08 01:39:47 +09:00
Dominique Martinet
8b894adb2b 9p/rdma: do not disconnect on down_interruptible EAGAIN
9p/rdma would sometimes drop the connection and display errors in
recv_done when the user does ^C.
The errors were caused by recv buffers that were posted at the time
of disconnect, and we just do not want to disconnect when
down_interruptible is... interrupted.

Link: http://lkml.kernel.org/r/1535625307-18019-1-git-send-email-asmadeus@codewreck.org
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
2018-09-08 01:39:47 +09:00
Tomas Bortoli
728356dede 9p: Add refcount to p9_req_t
To avoid use-after-free(s), use a refcount to keep track of the
usable references to any instantiated struct p9_req_t.

This commit adds p9_req_put(), p9_req_get() and p9_req_try_get() as
wrappers to kref_put(), kref_get() and kref_get_unless_zero().
These are used by the client and the transports to keep track of
valid requests' references.

p9_free_req() is added back and used as callback by kref_put().

Add SLAB_TYPESAFE_BY_RCU as it ensures that the memory freed by
kmem_cache_free() will not be reused for another type until the rcu
synchronisation period is over, so an address gotten under rcu read
lock is safe to inc_ref() without corrupting random memory while
the lock is held.

Link: http://lkml.kernel.org/r/1535626341-20693-1-git-send-email-asmadeus@codewreck.org
Co-developed-by: Dominique Martinet <dominique.martinet@cea.fr>
Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
Reported-by: syzbot+467050c1ce275af2a5b8@syzkaller.appspotmail.com
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
2018-09-08 01:39:47 +09:00
Tomas Bortoli
43cbcbee99 9p: rename p9_free_req() function
In sight of the next patch to add a refcount in p9_req_t, rename
the p9_free_req() function in p9_release_req().

In the next patch the actual kfree will be moved to another function.

Link: http://lkml.kernel.org/r/20180811144254.23665-1-tomasbortoli@gmail.com
Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
Acked-by: Jun Piao <piaojun@huawei.com>
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
2018-09-08 01:39:47 +09:00
Dominique Martinet
91a76be37f 9p: add a per-client fcall kmem_cache
Having a specific cache for the fcall allocations helps speed up
end-to-end latency.

The caches will automatically be merged if there are multiple caches
of items with the same size so we do not need to try to share a cache
between different clients of the same size.

Since the msize is negotiated with the server, only allocate the cache
after that negotiation has happened - previous allocations or
allocations of different sizes (e.g. zero-copy fcall) are made with
kmalloc directly.

Some figures on two beefy VMs with Connect-IB (sriov) / trans=rdma,
with ior running 32 processes in parallel doing small 32 bytes IOs:
 - no alloc (4.18-rc7 request cache): 65.4k req/s
 - non-power of two alloc, no patch: 61.6k req/s
 - power of two alloc, no patch: 62.2k req/s
 - non-power of two alloc, with patch: 64.7k req/s
 - power of two alloc, with patch: 65.1k req/s

Link: http://lkml.kernel.org/r/1532943263-24378-2-git-send-email-asmadeus@codewreck.org
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
Acked-by: Jun Piao <piaojun@huawei.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Greg Kurz <groug@kaod.org>
2018-09-08 01:39:47 +09:00
Dominique Martinet
523adb6cc1 9p: embed fcall in req to round down buffer allocs
'msize' is often a power of two, or at least page-aligned, so avoiding
an overhead of two dozen bytes for each allocation will help the
allocator do its work and reduce memory fragmentation.

Link: http://lkml.kernel.org/r/1533825236-22896-1-git-send-email-asmadeus@codewreck.org
Suggested-by: Matthew Wilcox <willy@infradead.org>
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
Reviewed-by: Greg Kurz <groug@kaod.org>
Acked-by: Jun Piao <piaojun@huawei.com>
Cc: Matthew Wilcox <willy@infradead.org>
2018-09-08 01:39:45 +09:00
Wanpeng Li
bdf7ffc899 KVM: LAPIC: Fix pv ipis out-of-bounds access
Dan Carpenter reported that the untrusted data returns from kvm_register_read()
results in the following static checker warning:
  arch/x86/kvm/lapic.c:576 kvm_pv_send_ipi()
  error: buffer underflow 'map->phys_map' 's32min-s32max'

KVM guest can easily trigger this by executing the following assembly sequence
in Ring0:

mov $10, %rax
mov $0xFFFFFFFF, %rbx
mov $0xFFFFFFFF, %rdx
mov $0, %rsi
vmcall

As this will cause KVM to execute the following code-path:
vmx_handle_exit() -> handle_vmcall() -> kvm_emulate_hypercall() -> kvm_pv_send_ipi()
which will reach out-of-bounds access.

This patch fixes it by adding a check to kvm_pv_send_ipi() against map->max_apic_id,
ignoring destinations that are not present and delivering the rest. We also check
whether or not map->phys_map[min + i] is NULL since the max_apic_id is set to the
max apic id, some phys_map maybe NULL when apic id is sparse, especially kvm
unconditionally set max_apic_id to 255 to reserve enough space for any xAPIC ID.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Liran Alon <liran.alon@oracle.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: Liran Alon <liran.alon@oracle.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
[Add second "if (min > map->max_apic_id)" to complete the fix. -Radim]
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
2018-09-07 18:38:43 +02:00