+++ /dev/null
-From foo@baz Fri Mar 16 15:43:17 CET 2018
-From: Peter Ujfalusi <peter.ujfalusi@ti.com>
-Date: Tue, 14 Nov 2017 16:32:09 +0200
-Subject: dmaengine: amba-pl08x: Use vchan_terminate_vdesc() instead of desc_free
-
-From: Peter Ujfalusi <peter.ujfalusi@ti.com>
-
-
-[ Upstream commit 47d71bc75d072ce25c1063aa629e55e1cfb961b2 ]
-
-To avoid race with vchan_complete, use the race free way to terminate
-running transfer.
-
-Implement the device_synchronize callback to make sure that the terminated
-descriptor is freed.
-
-Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
-Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
-Signed-off-by: Vinod Koul <vinod.koul@intel.com>
-Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/dma/amba-pl08x.c | 11 ++++++++++-
- 1 file changed, 10 insertions(+), 1 deletion(-)
-
---- a/drivers/dma/amba-pl08x.c
-+++ b/drivers/dma/amba-pl08x.c
-@@ -2182,7 +2182,7 @@ static int pl08x_terminate_all(struct dm
- }
- /* Dequeue jobs and free LLIs */
- if (plchan->at) {
-- pl08x_desc_free(&plchan->at->vd);
-+ vchan_terminate_vdesc(&plchan->at->vd);
- plchan->at = NULL;
- }
- /* Dequeue jobs not yet fired as well */
-@@ -2193,6 +2193,13 @@ static int pl08x_terminate_all(struct dm
- return 0;
- }
-
-+static void pl08x_synchronize(struct dma_chan *chan)
-+{
-+ struct pl08x_dma_chan *plchan = to_pl08x_chan(chan);
-+
-+ vchan_synchronize(&plchan->vc);
-+}
-+
- static int pl08x_pause(struct dma_chan *chan)
- {
- struct pl08x_dma_chan *plchan = to_pl08x_chan(chan);
-@@ -2773,6 +2780,7 @@ static int pl08x_probe(struct amba_devic
- pl08x->memcpy.device_pause = pl08x_pause;
- pl08x->memcpy.device_resume = pl08x_resume;
- pl08x->memcpy.device_terminate_all = pl08x_terminate_all;
-+ pl08x->memcpy.device_synchronize = pl08x_synchronize;
- pl08x->memcpy.src_addr_widths = PL80X_DMA_BUSWIDTHS;
- pl08x->memcpy.dst_addr_widths = PL80X_DMA_BUSWIDTHS;
- pl08x->memcpy.directions = BIT(DMA_MEM_TO_MEM);
-@@ -2802,6 +2810,7 @@ static int pl08x_probe(struct amba_devic
- pl08x->slave.device_pause = pl08x_pause;
- pl08x->slave.device_resume = pl08x_resume;
- pl08x->slave.device_terminate_all = pl08x_terminate_all;
-+ pl08x->slave.device_synchronize = pl08x_synchronize;
- pl08x->slave.src_addr_widths = PL80X_DMA_BUSWIDTHS;
- pl08x->slave.dst_addr_widths = PL80X_DMA_BUSWIDTHS;
- pl08x->slave.directions =
+++ /dev/null
-From foo@baz Fri Mar 16 15:43:17 CET 2018
-From: Peter Ujfalusi <peter.ujfalusi@ti.com>
-Date: Tue, 14 Nov 2017 16:32:07 +0200
-Subject: dmaengine: bcm2835-dma: Use vchan_terminate_vdesc() instead of desc_free
-
-From: Peter Ujfalusi <peter.ujfalusi@ti.com>
-
-
-[ Upstream commit de92436ac40ffe9933230aa503e24dbb5ede9201 ]
-
-To avoid race with vchan_complete, use the race free way to terminate
-running transfer.
-
-Implement the device_synchronize callback to make sure that the terminated
-descriptor is freed.
-
-Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
-Acked-by: Eric Anholt <eric@anholt.net>
-Signed-off-by: Vinod Koul <vinod.koul@intel.com>
-Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/dma/bcm2835-dma.c | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
---- a/drivers/dma/bcm2835-dma.c
-+++ b/drivers/dma/bcm2835-dma.c
-@@ -812,7 +812,7 @@ static int bcm2835_dma_terminate_all(str
- * c->desc is NULL and exit.)
- */
- if (c->desc) {
-- bcm2835_dma_desc_free(&c->desc->vd);
-+ vchan_terminate_vdesc(&c->desc->vd);
- c->desc = NULL;
- bcm2835_dma_abort(c->chan_base);
-
-@@ -836,6 +836,13 @@ static int bcm2835_dma_terminate_all(str
- return 0;
- }
-
-+static void bcm2835_dma_synchronize(struct dma_chan *chan)
-+{
-+ struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
-+
-+ vchan_synchronize(&c->vc);
-+}
-+
- static int bcm2835_dma_chan_init(struct bcm2835_dmadev *d, int chan_id,
- int irq, unsigned int irq_flags)
- {
-@@ -942,6 +949,7 @@ static int bcm2835_dma_probe(struct plat
- od->ddev.device_prep_dma_memcpy = bcm2835_dma_prep_dma_memcpy;
- od->ddev.device_config = bcm2835_dma_slave_config;
- od->ddev.device_terminate_all = bcm2835_dma_terminate_all;
-+ od->ddev.device_synchronize = bcm2835_dma_synchronize;
- od->ddev.src_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES);
- od->ddev.dst_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES);
- od->ddev.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV) |
+++ /dev/null
-From 1c7f072d94e8b697fd9b70cdb268622a18faf522 Mon Sep 17 00:00:00 2001
-From: Peter Ujfalusi <peter.ujfalusi@ti.com>
-Date: Tue, 14 Nov 2017 16:32:04 +0200
-Subject: dmaengine: virt-dma: Support for race free transfer termination
-
-From: Peter Ujfalusi <peter.ujfalusi@ti.com>
-
-commit 1c7f072d94e8b697fd9b70cdb268622a18faf522 upstream.
-
-Even with the introduced vchan_synchronize() we can face race when
-terminating a cyclic transfer.
-
-If the terminate_all is called after the interrupt handler called
-vchan_cyclic_callback(), but before the vchan_complete tasklet is called:
-vc->cyclic is set to the cyclic descriptor, but the descriptor itself was
-freed up in the driver's terminate_all() callback.
-When the vhan_complete() is executed it will try to fetch the vc->cyclic
-vdesc, but the pointer is pointing now to uninitialized memory leading to
-(hard to reproduce) kernel crash.
-
-In order to fix this, drivers should:
-- call vchan_terminate_vdesc() from their terminate_all callback instead
-calling their free_desc function to free up the descriptor.
-- implement device_synchronize callback and call vchan_synchronize().
-
-This way we can make sure that the descriptor is only going to be freed up
-after the vchan_callback was executed in a safe manner.
-
-Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
-Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
-Signed-off-by: Vinod Koul <vinod.koul@intel.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/dma/virt-dma.h | 30 ++++++++++++++++++++++++++++++
- 1 file changed, 30 insertions(+)
-
---- a/drivers/dma/virt-dma.h
-+++ b/drivers/dma/virt-dma.h
-@@ -35,6 +35,7 @@ struct virt_dma_chan {
- struct list_head desc_completed;
-
- struct virt_dma_desc *cyclic;
-+ struct virt_dma_desc *vd_terminated;
- };
-
- static inline struct virt_dma_chan *to_virt_chan(struct dma_chan *chan)
-@@ -116,6 +117,25 @@ static inline void vchan_cyclic_callback
- }
-
- /**
-+ * vchan_terminate_vdesc - Disable pending cyclic callback
-+ * @vd: virtual descriptor to be terminated
-+ *
-+ * vc.lock must be held by caller
-+ */
-+static inline void vchan_terminate_vdesc(struct virt_dma_desc *vd)
-+{
-+ struct virt_dma_chan *vc = to_virt_chan(vd->tx.chan);
-+
-+ /* free up stuck descriptor */
-+ if (vc->vd_terminated)
-+ vchan_vdesc_fini(vc->vd_terminated);
-+
-+ vc->vd_terminated = vd;
-+ if (vc->cyclic == vd)
-+ vc->cyclic = NULL;
-+}
-+
-+/**
- * vchan_next_desc - peek at the next descriptor to be processed
- * @vc: virtual channel to obtain descriptor from
- *
-@@ -168,10 +188,20 @@ static inline void vchan_free_chan_resou
- * Makes sure that all scheduled or active callbacks have finished running. For
- * proper operation the caller has to ensure that no new callbacks are scheduled
- * after the invocation of this function started.
-+ * Free up the terminated cyclic descriptor to prevent memory leakage.
- */
- static inline void vchan_synchronize(struct virt_dma_chan *vc)
- {
-+ unsigned long flags;
-+
- tasklet_kill(&vc->task);
-+
-+ spin_lock_irqsave(&vc->lock, flags);
-+ if (vc->vd_terminated) {
-+ vchan_vdesc_fini(vc->vd_terminated);
-+ vc->vd_terminated = NULL;
-+ }
-+ spin_unlock_irqrestore(&vc->lock, flags);
- }
-
- #endif
iio-health-max30102-add-power-enable-parameter-to-get_temp-function.patch
ath10k-update-tdls-teardown-state-to-target.patch
cpufreq-fix-governor-module-removal-race.patch
-dmaengine-virt-dma-support-for-race-free-transfer-termination.patch
-dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch
-dmaengine-amba-pl08x-use-vchan_terminate_vdesc-instead-of-desc_free.patch
drm-amdgpu-fix-random-missing-of-flr-notify.patch
scsi-ses-don-t-ask-for-diagnostic-pages-repeatedly-during-probe.patch
pwm-stmpe-fix-wrong-register-offset-for-hwpwm-2-case.patch
+++ /dev/null
-From foo@baz Fri Mar 16 15:11:07 CET 2018
-From: Peter Ujfalusi <peter.ujfalusi@ti.com>
-Date: Tue, 14 Nov 2017 16:32:09 +0200
-Subject: dmaengine: amba-pl08x: Use vchan_terminate_vdesc() instead of desc_free
-
-From: Peter Ujfalusi <peter.ujfalusi@ti.com>
-
-
-[ Upstream commit 47d71bc75d072ce25c1063aa629e55e1cfb961b2 ]
-
-To avoid race with vchan_complete, use the race free way to terminate
-running transfer.
-
-Implement the device_synchronize callback to make sure that the terminated
-descriptor is freed.
-
-Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
-Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
-Signed-off-by: Vinod Koul <vinod.koul@intel.com>
-Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/dma/amba-pl08x.c | 11 ++++++++++-
- 1 file changed, 10 insertions(+), 1 deletion(-)
-
---- a/drivers/dma/amba-pl08x.c
-+++ b/drivers/dma/amba-pl08x.c
-@@ -2182,7 +2182,7 @@ static int pl08x_terminate_all(struct dm
- }
- /* Dequeue jobs and free LLIs */
- if (plchan->at) {
-- pl08x_desc_free(&plchan->at->vd);
-+ vchan_terminate_vdesc(&plchan->at->vd);
- plchan->at = NULL;
- }
- /* Dequeue jobs not yet fired as well */
-@@ -2193,6 +2193,13 @@ static int pl08x_terminate_all(struct dm
- return 0;
- }
-
-+static void pl08x_synchronize(struct dma_chan *chan)
-+{
-+ struct pl08x_dma_chan *plchan = to_pl08x_chan(chan);
-+
-+ vchan_synchronize(&plchan->vc);
-+}
-+
- static int pl08x_pause(struct dma_chan *chan)
- {
- struct pl08x_dma_chan *plchan = to_pl08x_chan(chan);
-@@ -2773,6 +2780,7 @@ static int pl08x_probe(struct amba_devic
- pl08x->memcpy.device_pause = pl08x_pause;
- pl08x->memcpy.device_resume = pl08x_resume;
- pl08x->memcpy.device_terminate_all = pl08x_terminate_all;
-+ pl08x->memcpy.device_synchronize = pl08x_synchronize;
- pl08x->memcpy.src_addr_widths = PL80X_DMA_BUSWIDTHS;
- pl08x->memcpy.dst_addr_widths = PL80X_DMA_BUSWIDTHS;
- pl08x->memcpy.directions = BIT(DMA_MEM_TO_MEM);
-@@ -2802,6 +2810,7 @@ static int pl08x_probe(struct amba_devic
- pl08x->slave.device_pause = pl08x_pause;
- pl08x->slave.device_resume = pl08x_resume;
- pl08x->slave.device_terminate_all = pl08x_terminate_all;
-+ pl08x->slave.device_synchronize = pl08x_synchronize;
- pl08x->slave.src_addr_widths = PL80X_DMA_BUSWIDTHS;
- pl08x->slave.dst_addr_widths = PL80X_DMA_BUSWIDTHS;
- pl08x->slave.directions =
+++ /dev/null
-From foo@baz Fri Mar 16 15:11:07 CET 2018
-From: Peter Ujfalusi <peter.ujfalusi@ti.com>
-Date: Tue, 14 Nov 2017 16:32:07 +0200
-Subject: dmaengine: bcm2835-dma: Use vchan_terminate_vdesc() instead of desc_free
-
-From: Peter Ujfalusi <peter.ujfalusi@ti.com>
-
-
-[ Upstream commit de92436ac40ffe9933230aa503e24dbb5ede9201 ]
-
-To avoid race with vchan_complete, use the race free way to terminate
-running transfer.
-
-Implement the device_synchronize callback to make sure that the terminated
-descriptor is freed.
-
-Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
-Acked-by: Eric Anholt <eric@anholt.net>
-Signed-off-by: Vinod Koul <vinod.koul@intel.com>
-Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/dma/bcm2835-dma.c | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
---- a/drivers/dma/bcm2835-dma.c
-+++ b/drivers/dma/bcm2835-dma.c
-@@ -812,7 +812,7 @@ static int bcm2835_dma_terminate_all(str
- * c->desc is NULL and exit.)
- */
- if (c->desc) {
-- bcm2835_dma_desc_free(&c->desc->vd);
-+ vchan_terminate_vdesc(&c->desc->vd);
- c->desc = NULL;
- bcm2835_dma_abort(c->chan_base);
-
-@@ -836,6 +836,13 @@ static int bcm2835_dma_terminate_all(str
- return 0;
- }
-
-+static void bcm2835_dma_synchronize(struct dma_chan *chan)
-+{
-+ struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
-+
-+ vchan_synchronize(&c->vc);
-+}
-+
- static int bcm2835_dma_chan_init(struct bcm2835_dmadev *d, int chan_id,
- int irq, unsigned int irq_flags)
- {
-@@ -942,6 +949,7 @@ static int bcm2835_dma_probe(struct plat
- od->ddev.device_prep_dma_memcpy = bcm2835_dma_prep_dma_memcpy;
- od->ddev.device_config = bcm2835_dma_slave_config;
- od->ddev.device_terminate_all = bcm2835_dma_terminate_all;
-+ od->ddev.device_synchronize = bcm2835_dma_synchronize;
- od->ddev.src_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES);
- od->ddev.dst_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES);
- od->ddev.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV) |
+++ /dev/null
-From 1c7f072d94e8b697fd9b70cdb268622a18faf522 Mon Sep 17 00:00:00 2001
-From: Peter Ujfalusi <peter.ujfalusi@ti.com>
-Date: Tue, 14 Nov 2017 16:32:04 +0200
-Subject: dmaengine: virt-dma: Support for race free transfer termination
-
-From: Peter Ujfalusi <peter.ujfalusi@ti.com>
-
-commit 1c7f072d94e8b697fd9b70cdb268622a18faf522 upstream.
-
-Even with the introduced vchan_synchronize() we can face race when
-terminating a cyclic transfer.
-
-If the terminate_all is called after the interrupt handler called
-vchan_cyclic_callback(), but before the vchan_complete tasklet is called:
-vc->cyclic is set to the cyclic descriptor, but the descriptor itself was
-freed up in the driver's terminate_all() callback.
-When the vhan_complete() is executed it will try to fetch the vc->cyclic
-vdesc, but the pointer is pointing now to uninitialized memory leading to
-(hard to reproduce) kernel crash.
-
-In order to fix this, drivers should:
-- call vchan_terminate_vdesc() from their terminate_all callback instead
-calling their free_desc function to free up the descriptor.
-- implement device_synchronize callback and call vchan_synchronize().
-
-This way we can make sure that the descriptor is only going to be freed up
-after the vchan_callback was executed in a safe manner.
-
-Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
-Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
-Signed-off-by: Vinod Koul <vinod.koul@intel.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/dma/virt-dma.h | 30 ++++++++++++++++++++++++++++++
- 1 file changed, 30 insertions(+)
-
---- a/drivers/dma/virt-dma.h
-+++ b/drivers/dma/virt-dma.h
-@@ -35,6 +35,7 @@ struct virt_dma_chan {
- struct list_head desc_completed;
-
- struct virt_dma_desc *cyclic;
-+ struct virt_dma_desc *vd_terminated;
- };
-
- static inline struct virt_dma_chan *to_virt_chan(struct dma_chan *chan)
-@@ -116,6 +117,25 @@ static inline void vchan_cyclic_callback
- }
-
- /**
-+ * vchan_terminate_vdesc - Disable pending cyclic callback
-+ * @vd: virtual descriptor to be terminated
-+ *
-+ * vc.lock must be held by caller
-+ */
-+static inline void vchan_terminate_vdesc(struct virt_dma_desc *vd)
-+{
-+ struct virt_dma_chan *vc = to_virt_chan(vd->tx.chan);
-+
-+ /* free up stuck descriptor */
-+ if (vc->vd_terminated)
-+ vchan_vdesc_fini(vc->vd_terminated);
-+
-+ vc->vd_terminated = vd;
-+ if (vc->cyclic == vd)
-+ vc->cyclic = NULL;
-+}
-+
-+/**
- * vchan_next_desc - peek at the next descriptor to be processed
- * @vc: virtual channel to obtain descriptor from
- *
-@@ -168,10 +188,20 @@ static inline void vchan_free_chan_resou
- * Makes sure that all scheduled or active callbacks have finished running. For
- * proper operation the caller has to ensure that no new callbacks are scheduled
- * after the invocation of this function started.
-+ * Free up the terminated cyclic descriptor to prevent memory leakage.
- */
- static inline void vchan_synchronize(struct virt_dma_chan *vc)
- {
-+ unsigned long flags;
-+
- tasklet_kill(&vc->task);
-+
-+ spin_lock_irqsave(&vc->lock, flags);
-+ if (vc->vd_terminated) {
-+ vchan_vdesc_fini(vc->vd_terminated);
-+ vc->vd_terminated = NULL;
-+ }
-+ spin_unlock_irqrestore(&vc->lock, flags);
- }
-
- #endif
iio-health-max30102-add-power-enable-parameter-to-get_temp-function.patch
ath10k-update-tdls-teardown-state-to-target.patch
cpufreq-fix-governor-module-removal-race.patch
-dmaengine-virt-dma-support-for-race-free-transfer-termination.patch
-dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch
-dmaengine-amba-pl08x-use-vchan_terminate_vdesc-instead-of-desc_free.patch
kvm-x86-restart-the-guest-when-insn_len-is-zero-and-sev-is-enabled.patch
drm-amdgpu-fix-random-missing-of-flr-notify.patch
scsi-lpfc-fix-crash-during-driver-unload-with-running-nvme-traffic.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
