summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Merge tag 'cfi-v5.13-rc1' of ↵Linus Torvalds2021-04-2775-113/+760
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull CFI on arm64 support from Kees Cook: "This builds on last cycle's LTO work, and allows the arm64 kernels to be built with Clang's Control Flow Integrity feature. This feature has happily lived in Android kernels for almost 3 years[1], so I'm excited to have it ready for upstream. The wide diffstat is mainly due to the treewide fixing of mismatched list_sort prototypes. Other things in core kernel are to address various CFI corner cases. The largest code portion is the CFI runtime implementation itself (which will be shared by all architectures implementing support for CFI). The arm64 pieces are Acked by arm64 maintainers rather than coming through the arm64 tree since carrying this tree over there was going to be awkward. CFI support for x86 is still under development, but is pretty close. There are a handful of corner cases on x86 that need some improvements to Clang and objtool, but otherwise works well. Summary: - Clean up list_sort prototypes (Sami Tolvanen) - Introduce CONFIG_CFI_CLANG for arm64 (Sami Tolvanen)" * tag 'cfi-v5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: arm64: allow CONFIG_CFI_CLANG to be selected KVM: arm64: Disable CFI for nVHE arm64: ftrace: use function_nocfi for ftrace_call arm64: add __nocfi to __apply_alternatives arm64: add __nocfi to functions that jump to a physical address arm64: use function_nocfi with __pa_symbol arm64: implement function_nocfi psci: use function_nocfi for cpu_resume lkdtm: use function_nocfi treewide: Change list_sort to use const pointers bpf: disable CFI in dispatcher functions kallsyms: strip ThinLTO hashes from static functions kthread: use WARN_ON_FUNCTION_MISMATCH workqueue: use WARN_ON_FUNCTION_MISMATCH module: ensure __cfi_check alignment mm: add generic function_nocfi macro cfi: add __cficanonical add support for Clang CFI
| * arm64: allow CONFIG_CFI_CLANG to be selectedSami Tolvanen2021-04-091-0/+1
| | | | | | | | | | | | | | | | | | | | Select ARCH_SUPPORTS_CFI_CLANG to allow CFI to be enabled. Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210408182843.1754385-19-samitolvanen@google.com
| * KVM: arm64: Disable CFI for nVHESami Tolvanen2021-04-091-3/+3
| | | | | | | | | | | | | | | | | | | | Disable CFI for the nVHE code to avoid address space confusion. Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210408182843.1754385-18-samitolvanen@google.com
| * arm64: ftrace: use function_nocfi for ftrace_callSami Tolvanen2021-04-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | With CONFIG_CFI_CLANG, the compiler replaces function pointers with jump table addresses, which breaks dynamic ftrace as the address of ftrace_call is replaced with the address of ftrace_call.cfi_jt. Use function_nocfi() to get the address of the actual function instead. Suggested-by: Ben Dai <ben.dai@unisoc.com> Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Acked-by: Mark Rutland <mark.rutland@arm.com> Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210408182843.1754385-17-samitolvanen@google.com
| * arm64: add __nocfi to __apply_alternativesSami Tolvanen2021-04-091-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | __apply_alternatives makes indirect calls to functions whose address is taken in assembly code using the alternative_cb macro. With non-canonical CFI, the compiler won't replace these function references with the jump table addresses, which trips CFI. Disable CFI checking in the function to work around the issue. Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210408182843.1754385-16-samitolvanen@google.com
| * arm64: add __nocfi to functions that jump to a physical addressSami Tolvanen2021-04-093-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | Disable CFI checking for functions that switch to linear mapping and make an indirect call to a physical address, since the compiler only understands virtual addresses and the CFI check for such indirect calls would always fail. Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210408182843.1754385-15-samitolvanen@google.com
| * arm64: use function_nocfi with __pa_symbolSami Tolvanen2021-04-096-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With CONFIG_CFI_CLANG, the compiler replaces function address references with the address of the function's CFI jump table entry. This means that __pa_symbol(function) returns the physical address of the jump table entry, which can lead to address space confusion as the jump table points to the function's virtual address. Therefore, use the function_nocfi() macro to ensure we are always taking the address of the actual function instead. Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> Acked-by: Mark Rutland <mark.rutland@arm.com> Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210408182843.1754385-14-samitolvanen@google.com
| * arm64: implement function_nocfiSami Tolvanen2021-04-091-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | With CONFIG_CFI_CLANG, the compiler replaces function addresses in instrumented C code with jump table addresses. This change implements the function_nocfi() macro, which returns the actual function address instead. Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> Acked-by: Mark Rutland <mark.rutland@arm.com> Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210408182843.1754385-13-samitolvanen@google.com
| * psci: use function_nocfi for cpu_resumeSami Tolvanen2021-04-091-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With CONFIG_CFI_CLANG, the compiler replaces function pointers with jump table addresses, which results in __pa_symbol returning the physical address of the jump table entry. As the jump table contains an immediate jump to an EL1 virtual address, this typically won't work as intended. Use function_nocfi to get the actual address of cpu_resume. Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> Acked-by: Mark Rutland <mark.rutland@arm.com> Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210408182843.1754385-12-samitolvanen@google.com
| * lkdtm: use function_nocfiSami Tolvanen2021-04-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | To ensure we take the actual address of a function in kernel text, use function_nocfi. Otherwise, with CONFIG_CFI_CLANG, the compiler replaces the address with a pointer to the CFI jump table, which is actually in the module when compiled with CONFIG_LKDTM=m. Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Acked-by: Kees Cook <keescook@chromium.org> Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210408182843.1754385-11-samitolvanen@google.com
| * treewide: Change list_sort to use const pointersSami Tolvanen2021-04-0941-72/+90
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | list_sort() internally casts the comparison function passed to it to a different type with constant struct list_head pointers, and uses this pointer to call the functions, which trips indirect call Control-Flow Integrity (CFI) checking. Instead of removing the consts, this change defines the list_cmp_func_t type and changes the comparison function types of all list_sort() callers to use const pointers, thus avoiding type mismatches. Suggested-by: Nick Desaulniers <ndesaulniers@google.com> Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Kees Cook <keescook@chromium.org> Tested-by: Nick Desaulniers <ndesaulniers@google.com> Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210408182843.1754385-10-samitolvanen@google.com
| * bpf: disable CFI in dispatcher functionsSami Tolvanen2021-04-091-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | BPF dispatcher functions are patched at runtime to perform direct instead of indirect calls. Disable CFI for the dispatcher functions to avoid conflicts. Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210408182843.1754385-9-samitolvanen@google.com
| * kallsyms: strip ThinLTO hashes from static functionsSami Tolvanen2021-04-091-5/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | | | With CONFIG_CFI_CLANG and ThinLTO, Clang appends a hash to the names of all static functions not marked __used. This can break userspace tools that don't expect the function name to change, so strip out the hash from the output. Suggested-by: Jack Pham <jackp@codeaurora.org> Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210408182843.1754385-8-samitolvanen@google.com
| * kthread: use WARN_ON_FUNCTION_MISMATCHSami Tolvanen2021-04-091-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With CONFIG_CFI_CLANG, a callback function passed to __kthread_queue_delayed_work from a module points to a jump table entry defined in the module instead of the one used in the core kernel, which breaks function address equality in this check: WARN_ON_ONCE(timer->function != ktead_delayed_work_timer_fn); Use WARN_ON_FUNCTION_MISMATCH() instead to disable the warning when CFI and modules are both enabled. Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210408182843.1754385-7-samitolvanen@google.com
| * workqueue: use WARN_ON_FUNCTION_MISMATCHSami Tolvanen2021-04-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With CONFIG_CFI_CLANG, a callback function passed to __queue_delayed_work from a module points to a jump table entry defined in the module instead of the one used in the core kernel, which breaks function address equality in this check: WARN_ON_ONCE(timer->function != delayed_work_timer_fn); Use WARN_ON_FUNCTION_MISMATCH() instead to disable the warning when CFI and modules are both enabled. Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210408182843.1754385-6-samitolvanen@google.com
| * module: ensure __cfi_check alignmentSami Tolvanen2021-04-091-1/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CONFIG_CFI_CLANG_SHADOW assumes the __cfi_check() function is page aligned and at the beginning of the .text section. While Clang would normally align the function correctly, it fails to do so for modules with no executable code. This change ensures the correct __cfi_check() location and alignment. It also discards the .eh_frame section, which Clang can generate with certain sanitizers, such as CFI. Link: https://bugs.llvm.org/show_bug.cgi?id=46293 Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> Acked-by: Jessica Yu <jeyu@kernel.org> Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210408182843.1754385-5-samitolvanen@google.com
| * mm: add generic function_nocfi macroSami Tolvanen2021-04-091-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With CONFIG_CFI_CLANG, the compiler replaces function addresses in instrumented C code with jump table addresses. This means that __pa_symbol(function) returns the physical address of the jump table entry instead of the actual function, which may not work as the jump table code will immediately jump to a virtual address that may not be mapped. To avoid this address space confusion, this change adds a generic definition for function_nocfi(), which architectures that support CFI can override. The typical implementation of would use inline assembly to take the function address, which avoids compiler instrumentation. Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> Acked-by: Mark Rutland <mark.rutland@arm.com> Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210408182843.1754385-4-samitolvanen@google.com
| * cfi: add __cficanonicalSami Tolvanen2021-04-094-4/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With CONFIG_CFI_CLANG, the compiler replaces a function address taken in C code with the address of a local jump table entry, which passes runtime indirect call checks. However, the compiler won't replace addresses taken in assembly code, which will result in a CFI failure if we later jump to such an address in instrumented C code. The code generated for the non-canonical jump table looks this: <noncanonical.cfi_jt>: /* In C, &noncanonical points here */ jmp noncanonical ... <noncanonical>: /* function body */ ... This change adds the __cficanonical attribute, which tells the compiler to use a canonical jump table for the function instead. This means the compiler will rename the actual function to <function>.cfi and points the original symbol to the jump table entry instead: <canonical>: /* jump table entry */ jmp canonical.cfi ... <canonical.cfi>: /* function body */ ... As a result, the address taken in assembly, or other non-instrumented code always points to the jump table and therefore, can be used for indirect calls in instrumented code without tripping CFI checks. Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> Acked-by: Bjorn Helgaas <bhelgaas@google.com> # pci.h Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210408182843.1754385-3-samitolvanen@google.com
| * add support for Clang CFISami Tolvanen2021-04-0914-6/+534
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change adds support for Clang’s forward-edge Control Flow Integrity (CFI) checking. With CONFIG_CFI_CLANG, the compiler injects a runtime check before each indirect function call to ensure the target is a valid function with the correct static type. This restricts possible call targets and makes it more difficult for an attacker to exploit bugs that allow the modification of stored function pointers. For more details, see: https://clang.llvm.org/docs/ControlFlowIntegrity.html Clang requires CONFIG_LTO_CLANG to be enabled with CFI to gain visibility to possible call targets. Kernel modules are supported with Clang’s cross-DSO CFI mode, which allows checking between independently compiled components. With CFI enabled, the compiler injects a __cfi_check() function into the kernel and each module for validating local call targets. For cross-module calls that cannot be validated locally, the compiler calls the global __cfi_slowpath_diag() function, which determines the target module and calls the correct __cfi_check() function. This patch includes a slowpath implementation that uses __module_address() to resolve call targets, and with CONFIG_CFI_CLANG_SHADOW enabled, a shadow map that speeds up module look-ups by ~3x. Clang implements indirect call checking using jump tables and offers two methods of generating them. With canonical jump tables, the compiler renames each address-taken function to <function>.cfi and points the original symbol to a jump table entry, which passes __cfi_check() validation. This isn’t compatible with stand-alone assembly code, which the compiler doesn’t instrument, and would result in indirect calls to assembly code to fail. Therefore, we default to using non-canonical jump tables instead, where the compiler generates a local jump table entry <function>.cfi_jt for each address-taken function, and replaces all references to the function with the address of the jump table entry. Note that because non-canonical jump table addresses are local to each component, they break cross-module function address equality. Specifically, the address of a global function will be different in each module, as it's replaced with the address of a local jump table entry. If this address is passed to a different module, it won’t match the address of the same function taken there. This may break code that relies on comparing addresses passed from other components. CFI checking can be disabled in a function with the __nocfi attribute. Additionally, CFI can be disabled for an entire compilation unit by filtering out CC_FLAGS_CFI. By default, CFI failures result in a kernel panic to stop a potential exploit. CONFIG_CFI_PERMISSIVE enables a permissive mode, where the kernel prints out a rate-limited warning instead, and allows execution to continue. This option is helpful for locating type mismatches, but should only be enabled during development. Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210408182843.1754385-2-samitolvanen@google.com
* | Merge tag 'overflow-v5.13-rc1' of ↵Linus Torvalds2021-04-271-1/+1
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull overflow update from Kees Cook: "I was expecting more in this tree for this cycle, but the other work has not yet landed for -next. As a result, only this single typo fix exists. Yay tiny pulls. :) - Fix typo in check_shl_overflow() kern-dec (Keith Busch)" * tag 'overflow-v5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: overflow: Correct check_shl_overflow() comment
| * | overflow: Correct check_shl_overflow() commentKeith Busch2021-04-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A 'false' return means the value was safely set, so the comment should say 'true' for when it is not considered safe. Cc: Jason Gunthorpe <jgg@ziepe.ca> Signed-off-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Kees Cook <keescook@chromium.org> Fixes: 0c66847793d1 ("overflow.h: Add arithmetic shift helper") Link: https://lore.kernel.org/r/20210401160629.1941787-1-kbusch@kernel.org
* | | Merge tag 'pstore-v5.13-rc1' of ↵Linus Torvalds2021-04-274-6/+33
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore update from Kees Cook: - Add mem_type property to expand support for >2 memory types (Mukesh Ojha) * tag 'pstore-v5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore: Add mem_type property DT parsing support
| * | | pstore: Add mem_type property DT parsing supportMukesh Ojha2021-03-314-6/+33
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There could be a scenario where we define some region in normal memory and use them store to logs which is later retrieved by bootloader during warm reset. In this scenario, we wanted to treat this memory as normal cacheable memory instead of default behaviour which is an overhead. Making it cacheable could improve performance. This commit gives control to change mem_type from Device tree, and also documents the value for normal memory. Signed-off-by: Mukesh Ojha <mojha@codeaurora.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/1616438537-13719-1-git-send-email-mojha@codeaurora.org
* | | Merge tag 'seccomp-v5.13-rc1' of ↵Linus Torvalds2021-04-273-2/+4
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull seccomp updates from Kees Cook: - Fix "cacheable" typo in comments (Cui GaoSheng) - Fix CONFIG for /proc/$pid/status Seccomp_filters (Kenta.Tada@sony.com) * tag 'seccomp-v5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: seccomp: Fix "cacheable" typo in comments seccomp: Fix CONFIG tests for Seccomp_filters
| * | | seccomp: Fix "cacheable" typo in commentsCui GaoSheng2021-03-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do a trivial typo fix: s/cachable/cacheable/ Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Cui GaoSheng <cuigaosheng1@huawei.com> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210331030724.84419-1-cuigaosheng1@huawei.com
| * | | seccomp: Fix CONFIG tests for Seccomp_filtersKenta.Tada@sony.com2021-03-312-1/+3
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Strictly speaking, seccomp filters are only used when CONFIG_SECCOMP_FILTER. This patch fixes the condition to enable "Seccomp_filters" in /proc/$pid/status. Signed-off-by: Kenta Tada <Kenta.Tada@sony.com> Fixes: c818c03b661c ("seccomp: Report number of loaded filters in /proc/$pid/status") Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/OSBPR01MB26772D245E2CF4F26B76A989F5669@OSBPR01MB2677.jpnprd01.prod.outlook.com
* | | cfg80211: fix locking in netlink owner interface destructionJohannes Berg2021-04-272-9/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Harald Arnesen reported [1] a deadlock at reboot time, and after he captured a stack trace a picture developed of what's going on: The distribution he's using is using iwd (not wpa_supplicant) to manage wireless. iwd will usually use the "socket owner" option when it creates new interfaces, so that they're automatically destroyed when it quits (unexpectedly or otherwise). This is also done by wpa_supplicant, but it doesn't do it for the normal one, only for additional ones, which is different with iwd. Anyway, during shutdown, iwd quits while the netdev is still UP, i.e. IFF_UP is set. This causes the stack trace that Linus so nicely transcribed from the pictures: cfg80211_destroy_iface_wk() takes wiphy_lock -> cfg80211_destroy_ifaces() ->ieee80211_del_iface ->ieeee80211_if_remove ->cfg80211_unregister_wdev ->unregister_netdevice_queue ->dev_close_many ->__dev_close_many ->raw_notifier_call_chain ->cfg80211_netdev_notifier_call and that last call tries to take wiphy_lock again. In commit a05829a7222e ("cfg80211: avoid holding the RTNL when calling the driver") I had taken into account the possibility of recursing from cfg80211 into cfg80211_netdev_notifier_call() via the network stack, but only for NETDEV_UNREGISTER, not for what happens here, NETDEV_GOING_DOWN and NETDEV_DOWN notifications. Additionally, while this worked still back in commit 78f22b6a3a92 ("cfg80211: allow userspace to take ownership of interfaces"), it missed another corner case: unregistering a netdev will cause dev_close() to be called, and thus stop wireless operations (e.g. disconnecting), but there are some types of virtual interfaces in wifi that don't have a netdev - for that we need an additional call to cfg80211_leave(). So, to fix this mess, change cfg80211_destroy_ifaces() to not require the wiphy_lock(), but instead make it acquire it, but only after it has actually closed all the netdevs on the list, and then call cfg80211_leave() as well before removing them from the driver, to fix the second issue. The locking change in this requires modifying the nl80211 call to not get the wiphy lock passed in, but acquire it by itself after flushing any potentially pending destruction requests. [1] https://lore.kernel.org/r/09464e67-f3de-ac09-28a3-e27b7914ee7d@skogtun.org Cc: stable@vger.kernel.org # 5.12 Reported-by: Harald Arnesen <harald@skogtun.org> Fixes: 776a39b8196d ("cfg80211: call cfg80211_destroy_ifaces() with wiphy lock held") Fixes: 78f22b6a3a92 ("cfg80211: allow userspace to take ownership of interfaces") Signed-off-by: Johannes Berg <johannes.berg@intel.com> Tested-by: Harald Arnesen <harald@skogtun.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | | Merge tag 'spi-v5.13' of ↵Linus Torvalds2021-04-2772-1064/+2011
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "The only core work for SPI this time around is the completion of the conversion to the new style method for specifying transfer delays, meaning we can cope with what most controllers support more directly using conversions in the core rather than open coding in drivers. Otherwise it's a good stack of cleanups and fixes plus a few new drivers. Summary: - Completion of the conversion to new style transfer delay configuration - Introduction and use of module_parport_driver() helper, merged here as there's no parport tree - Support for Altera SoCs on DFL buses, NXP i.MX8DL, HiSilicon Kunpeng, MediaTek MT8195" * tag 'spi-v5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (113 commits) spi: Rename enable1 to activate in spi_set_cs() spi: Convert Freescale QSPI binding to json schema spi: stm32-qspi: fix debug format string spi: tools: make a symbolic link to the header file spi.h spi: fsi: add a missing of_node_put spi: Make error handling of gpiod_count() call cleaner spidev: Add Micron SPI NOR Authenta device compatible spi: brcm,spi-bcm-qspi: convert to the json-schema spi: altera: Add DFL bus driver for Altera API Controller spi: altera: separate core code from platform code spi: stm32-qspi: Fix compilation warning in ARM64 spi: Handle SPI device setup callback failure. spi: sync up initial chipselect state spi: stm32-qspi: Add dirmap support spi: stm32-qspi: Trigger DMA only if more than 4 bytes to transfer spi: stm32-qspi: fix pm_runtime usage_count counter spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op spi: spi-zynqmp-gqspi: Resolved slab-out-of-bounds bug spi: spi-zynqmp-gqspi: fix hang issue when suspend/resume ...
| * | | spi: Rename enable1 to activate in spi_set_cs()Andy Shevchenko2021-04-231-5/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The enable1 is confusing name. Change it to clearly show what is the intention behind it. No functional changes. Fixes: 25093bdeb6bc ("spi: implement SW control for CS times") Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20210420131846.75983-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
| * | | spi: Convert Freescale QSPI binding to json schemaKuldeep Singh2021-04-233-66/+97
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Convert the Freescale QSPI binding to DT schema format using json-schema. Signed-off-by: Kuldeep Singh <kuldeep.singh@nxp.com> Reviewed-by: Rob Herring <robh@kernel.org> Link: https://lore.kernel.org/r/20210312054038.3586706-1-kuldeep.singh@nxp.com Signed-off-by: Mark Brown <broonie@kernel.org>
| * | | spi: stm32-qspi: fix debug format stringArnd Bergmann2021-04-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Printing size_t needs a special %zx format modifier to avoid a warning like: drivers/spi/spi-stm32-qspi.c:481:41: note: format string is defined here 481 | dev_dbg(qspi->dev, "%s len = 0x%x offs = 0x%llx buf = 0x%p\n", __func__, len, offs, buf); Patrice already tried to fix this, but picked %lx instead of %zx, which fixed some architectures but broke others in the same way. Using %zx works everywhere. Fixes: 18674dee3cd6 ("spi: stm32-qspi: Add dirmap support") Fixes: 1b8a7d4282c0 ("spi: stm32-qspi: Fix compilation warning in ARM64") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://lore.kernel.org/r/20210422134955.1988316-1-arnd@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
| * | | spi: tools: make a symbolic link to the header file spi.hQuanyang Wang2021-04-221-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The header file spi.h in include/uapi/linux/spi is needed for spidev.h, so we also need make a symbolic link to it to eliminate the error message as below: In file included from spidev_test.c:24: include/linux/spi/spidev.h:28:10: fatal error: linux/spi/spi.h: No such file or directory 28 | #include <linux/spi/spi.h> | ^~~~~~~~~~~~~~~~~ compilation terminated. Fixes: f7005142dace ("spi: uapi: unify SPI modes into a single spi.h") Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com> Link: https://lore.kernel.org/r/20210422102604.3034217-1-quanyang.wang@windriver.com Signed-off-by: Mark Brown <broonie@kernel.org>
| * | | spi: fsi: add a missing of_node_putChristophe JAILLET2021-04-211-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'for_each_available_child_of_node' performs an of_node_get on each iteration, so a return from the middle of the loop requires an of_node_put. Fixes: bbb6b2f9865b ("spi: Add FSI-attached SPI controller driver") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Link: https://lore.kernel.org/r/504e431b900341249d331b868d90312cf41f415a.1618947919.git.christophe.jaillet@wanadoo.fr Signed-off-by: Mark Brown <broonie@kernel.org>
| * | | spi: Make error handling of gpiod_count() call cleanerAndy Shevchenko2021-04-211-6/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Each time we call spi_get_gpio_descs() the num_chipselect is overwritten either by new value or by the old one. This is an extra operation in case gpiod_count() returns an error. Besides that it slashes the error handling of gpiod_count(). Refactor the code to make error handling of gpiod_count() call cleaner. Note, that gpiod_count() never returns 0, take this into account as well. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20210420164040.40055-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
| * | | Merge series "spi: altera: Add DFL bus support for Altera SPI" from ↵Mark Brown2021-04-206-163/+422
| |\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | matthew.gerlach@linux.intel.com Matthew Gerlach <matthew.gerlach@linux.intel.com>: From: Matthew Gerlach <matthew.gerlach@linux.intel.com> This patch set adds Device Feature List (DFL) bus support for the Altera SPI Master controller. Patch 1 separates spi-altera.c into spi-altera-core.c and spi-altera-platform.c. Patch 2 adds spi-altera-dfl.c. Matthew Gerlach (2): spi: altera: separate core code from platform code spi: altera: Add DFL bus driver for Altera API Controller drivers/spi/Kconfig | 18 +- drivers/spi/Makefile | 4 +- drivers/spi/spi-altera-core.c | 222 ++++++++++++++++++++++ drivers/spi/spi-altera-dfl.c | 204 ++++++++++++++++++++ drivers/spi/spi-altera-platform.c | 172 +++++++++++++++++ drivers/spi/spi-altera.c | 378 -------------------------------------- include/linux/spi/altera.h | 21 +++ 7 files changed, 639 insertions(+), 380 deletions(-) create mode 100644 drivers/spi/spi-altera-core.c create mode 100644 drivers/spi/spi-altera-dfl.c create mode 100644 drivers/spi/spi-altera-platform.c delete mode 100644 drivers/spi/spi-altera.c -- 1.8.3.1
| | * | | spi: altera: Add DFL bus driver for Altera API ControllerMatthew Gerlach2021-04-203-0/+214
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a Device Feature List (DFL) bus driver for the Altera SPI Master controller. The SPI master is connected to an Intel SPI Slave to Avalon Bridge inside an Intel MAX10 BMC Chip. Signed-off-by: Matthew Gerlach <matthew.gerlach@linux.intel.com> Link: https://lore.kernel.org/r/20210416165720.554144-3-matthew.gerlach@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
| | * | | spi: altera: separate core code from platform codeMatthew Gerlach2021-04-205-163/+208
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In preparation of adding support for a new bus type, separate the core spi-altera code from the platform driver code. Signed-off-by: Matthew Gerlach <matthew.gerlach@linux.intel.com> Link: https://lore.kernel.org/r/20210416165720.554144-2-matthew.gerlach@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
| * | | | spidev: Add Micron SPI NOR Authenta device compatibleShivamurthy Shastri2021-04-201-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add compatible string for Micron SPI NOR Authenta device. Signed-off-by: Shivamurthy Shastri <sshivamurthy@micron.com> Link: https://lore.kernel.org/r/20210419204015.1769-1-sshivamurthy@micron.com Signed-off-by: Mark Brown <broonie@kernel.org>
| * | | | spi: brcm,spi-bcm-qspi: convert to the json-schemaRafał Miłecki2021-04-203-246/+199
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This helps validating DTS files. Changes that require mentioning: 1. reg-names "mspi_regs" and "bspi_regs" were renamed to "mspi" and "bspi" as that is what's used in DTS files and in Linux driver 2. interrupt-names Names were reordered. "mspi_done" has to go first as it's always required. 3. spi-rx-bus-width Property description was dropped as it's part of the spi-controller.yaml 4. Examples: * drop partitions as they are well documented elsewhere * regs and interrupts were formatted and reordered to match yaml * <0x1c> was replaced with <&gic> * "m25p80" node name became "flash" * dropped invalid "m25p,fast-read" property * dropped undocumented and Linux-unused "clock-names" This rewritten binding validates cleanly using the "dt_binding_check". Some Linux stored DTS files will require reordering regs and interrupts to make dtbs_check happy. Signed-off-by: Rafał Miłecki <rafal@milecki.pl> Reviewed-by: Rob Herring <robh@kernel.org> Link: https://lore.kernel.org/r/20210416194723.23855-1-zajec5@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
| * | | spi: stm32-qspi: Fix compilation warning in ARM64Patrice Chotard2021-04-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes warnings detected when compiling in ARM64. Introduced by 'commit 18674dee3cd6 ("spi: stm32-qspi: Add dirmap support")' Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com> Link: https://lore.kernel.org/r/20210420082103.1693-1-patrice.chotard@foss.st.com Signed-off-by: Mark Brown <broonie@kernel.org>
| * | | Merge series "spi: stm32-qspi: Fix and update" from ↵Mark Brown2021-04-191-22/+84
| |\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | <patrice.chotard@foss.st.com> Patrice Chotard <patrice.chotard@foss.st.com>: From: Patrice Chotard <patrice.chotard@foss.st.com> Christophe Kerello (1): spi: stm32-qspi: fix pm_runtime usage_count counter Patrice Chotard (2): spi: stm32-qspi: Trigger DMA only if more than 4 bytes to transfer spi: stm32-qspi: Add dirmap support drivers/spi/spi-stm32-qspi.c | 106 +++++++++++++++++++++++++++-------- 1 file changed, 84 insertions(+), 22 deletions(-) -- 2.17.1 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
| | * | | spi: stm32-qspi: Add dirmap supportPatrice Chotard2021-04-191-16/+67
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add stm32_qspi_dirmap_read() and stm32_qspi_dirmap_create() to get dirmap support. Update the exec_op callback which doens't allow anymore memory map access. Memory map access are only available through the dirmap_read callback. Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com> Link: https://lore.kernel.org/r/20210419121541.11617-4-patrice.chotard@foss.st.com Signed-off-by: Mark Brown <broonie@kernel.org>
| | * | | spi: stm32-qspi: Trigger DMA only if more than 4 bytes to transferPatrice Chotard2021-04-191-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In order to optimize accesses to spi flashes, trigger a DMA only if more than 4 bytes has to be transferred. DMA transfer preparation's cost becomes negligible above 4 bytes to transfer. Below this threshold, indirect transfer give more throughput. mtd_speedtest shows that page write throughtput increases : - from 779 to 853 KiB/s (~9.5%) with s25fl512s SPI-NOR. - from 5283 to 5666 KiB/s (~7.25%) with Micron SPI-NAND. Signed-off-by: Christophe Kerello <christophe.kerello@foss.st.com> Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com> Link: https://lore.kernel.org/r/20210419121541.11617-3-patrice.chotard@foss.st.com Signed-off-by: Mark Brown <broonie@kernel.org>
| | * | | spi: stm32-qspi: fix pm_runtime usage_count counterChristophe Kerello2021-04-191-4/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pm_runtime usage_count counter is not well managed. pm_runtime_put_autosuspend callback drops the usage_counter but this one has never been increased. Add pm_runtime_get_sync callback to bump up the usage counter. It is also needed to use pm_runtime_force_suspend and pm_runtime_force_resume APIs to handle properly the clock. Fixes: 9d282c17b023 ("spi: stm32-qspi: Add pm_runtime support") Signed-off-by: Christophe Kerello <christophe.kerello@foss.st.com> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20210419121541.11617-2-patrice.chotard@foss.st.com Signed-off-by: Mark Brown <broonie@kernel.org>
| * | | | spi: Handle SPI device setup callback failure.Joe Burmeister2021-04-191-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the setup callback failed, but the controller has auto_runtime_pm and set_cs, the setup failure could be missed. Signed-off-by: Joe Burmeister <joe.burmeister@devtank.co.uk> Link: https://lore.kernel.org/r/20210419130631.4586-1-joe.burmeister@devtank.co.uk Signed-off-by: Mark Brown <broonie@kernel.org>
| * | | | spi: sync up initial chipselect stateDavid Bauer2021-04-191-8/+8
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When initially probing the SPI slave device, the call for disabling an SPI device without the SPI_CS_HIGH flag is not applied, as the condition for checking whether or not the state to be applied equals the one currently set evaluates to true. This however might not necessarily be the case, as the chipselect might be active. Add a force flag to spi_set_cs which allows to override this early exit condition. Set it to false everywhere except when called from spi_setup to sync up the initial CS state. Fixes commit d40f0b6f2e21 ("spi: Avoid setting the chip select if we don't need to") Signed-off-by: David Bauer <mail@david-bauer.net> Link: https://lore.kernel.org/r/20210416195956.121811-1-mail@david-bauer.net Signed-off-by: Mark Brown <broonie@kernel.org>
| * | | spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single failsQuanyang Wang2021-04-161-6/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The spi controller supports 44-bit address space on AXI in DMA mode, so set dma_addr_t width to 44-bit to avoid using a swiotlb mapping. In addition, if dma_map_single fails, it should return immediately instead of continuing doing the DMA operation which bases on invalid address. This fixes the following crash which occurs in reading a big block from flash: [ 123.633577] zynqmp-qspi ff0f0000.spi: swiotlb buffer is full (sz: 4194304 bytes), total 32768 (slots), used 0 (slots) [ 123.644230] zynqmp-qspi ff0f0000.spi: ERR:rxdma:memory not mapped [ 123.784625] Unable to handle kernel paging request at virtual address 00000000003fffc0 [ 123.792536] Mem abort info: [ 123.795313] ESR = 0x96000145 [ 123.798351] EC = 0x25: DABT (current EL), IL = 32 bits [ 123.803655] SET = 0, FnV = 0 [ 123.806693] EA = 0, S1PTW = 0 [ 123.809818] Data abort info: [ 123.812683] ISV = 0, ISS = 0x00000145 [ 123.816503] CM = 1, WnR = 1 [ 123.819455] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000805047000 [ 123.825887] [00000000003fffc0] pgd=0000000803b45003, p4d=0000000803b45003, pud=0000000000000000 [ 123.834586] Internal error: Oops: 96000145 [#1] PREEMPT SMP Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework") Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com> Link: https://lore.kernel.org/r/20210416004652.2975446-6-quanyang.wang@windriver.com Signed-off-by: Mark Brown <broonie@kernel.org>
| * | | spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_opQuanyang Wang2021-04-161-10/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When handling op->addr, it is using the buffer "tmpbuf" which has been freed. This will trigger a use-after-free KASAN warning. Let's use temporary variables to store op->addr.val and op->cmd.opcode to fix this issue. Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework") Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com> Link: https://lore.kernel.org/r/20210416004652.2975446-5-quanyang.wang@windriver.com Signed-off-by: Mark Brown <broonie@kernel.org>
| * | | spi: spi-zynqmp-gqspi: Resolved slab-out-of-bounds bugAmit Kumar Mahapatra2021-04-161-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | During a transfer the driver filled the fifo with 4bytes, even if the data that needs to be transfer is less that 4bytes. This resulted in slab-out-of-bounds bug in KernelAddressSanitizer. This patch resolves slab-out-of-bounds bug by filling the fifo with the number of bytes that needs to transferred. Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@xilinx.com> Link: https://lore.kernel.org/r/20210416004652.2975446-4-quanyang.wang@windriver.com Signed-off-by: Mark Brown <broonie@kernel.org>
| * | | spi: spi-zynqmp-gqspi: fix hang issue when suspend/resumeQuanyang Wang2021-04-161-6/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After calling platform_set_drvdata(pdev, xqspi) in probe, the return value of dev_get_drvdata(dev) is a pointer to struct zynqmp_qspi but not struct spi_controller. A wrong structure type passing to the functions spi_controller_suspend/resume will hang the system. And we should check the return value of spi_controller_suspend, if an error is returned, return it to PM subsystem to stop suspend. Also, GQSPI_EN_MASK should be written to GQSPI_EN_OFST to enable the spi controller in zynqmp_qspi_resume since it was disabled in zynqmp_qspi_suspend before. Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework") Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com> Link: https://lore.kernel.org/r/20210416004652.2975446-3-quanyang.wang@windriver.com Signed-off-by: Mark Brown <broonie@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-02 17:39:11 +0100