From: Greg Kroah-Hartman Date: Sun, 18 Mar 2018 10:47:01 +0000 (+0100) Subject: drop dmaengine patches from 4.14.y and 4.15.y as they are broken... X-Git-Tag: v4.14.28~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a146487ca39e78d3e46059d53bf665dd21bba926;p=thirdparty%2Fkernel%2Fstable-queue.git drop dmaengine patches from 4.14.y and 4.15.y as they are broken... --- diff --git a/queue-4.14/dmaengine-amba-pl08x-use-vchan_terminate_vdesc-instead-of-desc_free.patch b/queue-4.14/dmaengine-amba-pl08x-use-vchan_terminate_vdesc-instead-of-desc_free.patch deleted file mode 100644 index e78c5f5f7bf..00000000000 --- a/queue-4.14/dmaengine-amba-pl08x-use-vchan_terminate_vdesc-instead-of-desc_free.patch +++ /dev/null @@ -1,66 +0,0 @@ -From foo@baz Fri Mar 16 15:43:17 CET 2018 -From: Peter Ujfalusi -Date: Tue, 14 Nov 2017 16:32:09 +0200 -Subject: dmaengine: amba-pl08x: Use vchan_terminate_vdesc() instead of desc_free - -From: Peter Ujfalusi - - -[ Upstream commit 47d71bc75d072ce25c1063aa629e55e1cfb961b2 ] - -To avoid race with vchan_complete, use the race free way to terminate -running transfer. - -Implement the device_synchronize callback to make sure that the terminated -descriptor is freed. - -Signed-off-by: Peter Ujfalusi -Reviewed-by: Linus Walleij -Signed-off-by: Vinod Koul -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman ---- - drivers/dma/amba-pl08x.c | 11 ++++++++++- - 1 file changed, 10 insertions(+), 1 deletion(-) - ---- a/drivers/dma/amba-pl08x.c -+++ b/drivers/dma/amba-pl08x.c -@@ -2182,7 +2182,7 @@ static int pl08x_terminate_all(struct dm - } - /* Dequeue jobs and free LLIs */ - if (plchan->at) { -- pl08x_desc_free(&plchan->at->vd); -+ vchan_terminate_vdesc(&plchan->at->vd); - plchan->at = NULL; - } - /* Dequeue jobs not yet fired as well */ -@@ -2193,6 +2193,13 @@ static int pl08x_terminate_all(struct dm - return 0; - } - -+static void pl08x_synchronize(struct dma_chan *chan) -+{ -+ struct pl08x_dma_chan *plchan = to_pl08x_chan(chan); -+ -+ vchan_synchronize(&plchan->vc); -+} -+ - static int pl08x_pause(struct dma_chan *chan) - { - struct pl08x_dma_chan *plchan = to_pl08x_chan(chan); -@@ -2773,6 +2780,7 @@ static int pl08x_probe(struct amba_devic - pl08x->memcpy.device_pause = pl08x_pause; - pl08x->memcpy.device_resume = pl08x_resume; - pl08x->memcpy.device_terminate_all = pl08x_terminate_all; -+ pl08x->memcpy.device_synchronize = pl08x_synchronize; - pl08x->memcpy.src_addr_widths = PL80X_DMA_BUSWIDTHS; - pl08x->memcpy.dst_addr_widths = PL80X_DMA_BUSWIDTHS; - pl08x->memcpy.directions = BIT(DMA_MEM_TO_MEM); -@@ -2802,6 +2810,7 @@ static int pl08x_probe(struct amba_devic - pl08x->slave.device_pause = pl08x_pause; - pl08x->slave.device_resume = pl08x_resume; - pl08x->slave.device_terminate_all = pl08x_terminate_all; -+ pl08x->slave.device_synchronize = pl08x_synchronize; - pl08x->slave.src_addr_widths = PL80X_DMA_BUSWIDTHS; - pl08x->slave.dst_addr_widths = PL80X_DMA_BUSWIDTHS; - pl08x->slave.directions = diff --git a/queue-4.14/dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch b/queue-4.14/dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch deleted file mode 100644 index a71a5e587d2..00000000000 --- a/queue-4.14/dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch +++ /dev/null @@ -1,58 +0,0 @@ -From foo@baz Fri Mar 16 15:43:17 CET 2018 -From: Peter Ujfalusi -Date: Tue, 14 Nov 2017 16:32:07 +0200 -Subject: dmaengine: bcm2835-dma: Use vchan_terminate_vdesc() instead of desc_free - -From: Peter Ujfalusi - - -[ Upstream commit de92436ac40ffe9933230aa503e24dbb5ede9201 ] - -To avoid race with vchan_complete, use the race free way to terminate -running transfer. - -Implement the device_synchronize callback to make sure that the terminated -descriptor is freed. - -Signed-off-by: Peter Ujfalusi -Acked-by: Eric Anholt -Signed-off-by: Vinod Koul -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman ---- - drivers/dma/bcm2835-dma.c | 10 +++++++++- - 1 file changed, 9 insertions(+), 1 deletion(-) - ---- a/drivers/dma/bcm2835-dma.c -+++ b/drivers/dma/bcm2835-dma.c -@@ -812,7 +812,7 @@ static int bcm2835_dma_terminate_all(str - * c->desc is NULL and exit.) - */ - if (c->desc) { -- bcm2835_dma_desc_free(&c->desc->vd); -+ vchan_terminate_vdesc(&c->desc->vd); - c->desc = NULL; - bcm2835_dma_abort(c->chan_base); - -@@ -836,6 +836,13 @@ static int bcm2835_dma_terminate_all(str - return 0; - } - -+static void bcm2835_dma_synchronize(struct dma_chan *chan) -+{ -+ struct bcm2835_chan *c = to_bcm2835_dma_chan(chan); -+ -+ vchan_synchronize(&c->vc); -+} -+ - static int bcm2835_dma_chan_init(struct bcm2835_dmadev *d, int chan_id, - int irq, unsigned int irq_flags) - { -@@ -942,6 +949,7 @@ static int bcm2835_dma_probe(struct plat - od->ddev.device_prep_dma_memcpy = bcm2835_dma_prep_dma_memcpy; - od->ddev.device_config = bcm2835_dma_slave_config; - od->ddev.device_terminate_all = bcm2835_dma_terminate_all; -+ od->ddev.device_synchronize = bcm2835_dma_synchronize; - od->ddev.src_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES); - od->ddev.dst_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES); - od->ddev.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV) | diff --git a/queue-4.14/dmaengine-virt-dma-support-for-race-free-transfer-termination.patch b/queue-4.14/dmaengine-virt-dma-support-for-race-free-transfer-termination.patch deleted file mode 100644 index 4cc1b0d03fd..00000000000 --- a/queue-4.14/dmaengine-virt-dma-support-for-race-free-transfer-termination.patch +++ /dev/null @@ -1,94 +0,0 @@ -From 1c7f072d94e8b697fd9b70cdb268622a18faf522 Mon Sep 17 00:00:00 2001 -From: Peter Ujfalusi -Date: Tue, 14 Nov 2017 16:32:04 +0200 -Subject: dmaengine: virt-dma: Support for race free transfer termination - -From: Peter Ujfalusi - -commit 1c7f072d94e8b697fd9b70cdb268622a18faf522 upstream. - -Even with the introduced vchan_synchronize() we can face race when -terminating a cyclic transfer. - -If the terminate_all is called after the interrupt handler called -vchan_cyclic_callback(), but before the vchan_complete tasklet is called: -vc->cyclic is set to the cyclic descriptor, but the descriptor itself was -freed up in the driver's terminate_all() callback. -When the vhan_complete() is executed it will try to fetch the vc->cyclic -vdesc, but the pointer is pointing now to uninitialized memory leading to -(hard to reproduce) kernel crash. - -In order to fix this, drivers should: -- call vchan_terminate_vdesc() from their terminate_all callback instead -calling their free_desc function to free up the descriptor. -- implement device_synchronize callback and call vchan_synchronize(). - -This way we can make sure that the descriptor is only going to be freed up -after the vchan_callback was executed in a safe manner. - -Signed-off-by: Peter Ujfalusi -Reviewed-by: Linus Walleij -Signed-off-by: Vinod Koul -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/dma/virt-dma.h | 30 ++++++++++++++++++++++++++++++ - 1 file changed, 30 insertions(+) - ---- a/drivers/dma/virt-dma.h -+++ b/drivers/dma/virt-dma.h -@@ -35,6 +35,7 @@ struct virt_dma_chan { - struct list_head desc_completed; - - struct virt_dma_desc *cyclic; -+ struct virt_dma_desc *vd_terminated; - }; - - static inline struct virt_dma_chan *to_virt_chan(struct dma_chan *chan) -@@ -116,6 +117,25 @@ static inline void vchan_cyclic_callback - } - - /** -+ * vchan_terminate_vdesc - Disable pending cyclic callback -+ * @vd: virtual descriptor to be terminated -+ * -+ * vc.lock must be held by caller -+ */ -+static inline void vchan_terminate_vdesc(struct virt_dma_desc *vd) -+{ -+ struct virt_dma_chan *vc = to_virt_chan(vd->tx.chan); -+ -+ /* free up stuck descriptor */ -+ if (vc->vd_terminated) -+ vchan_vdesc_fini(vc->vd_terminated); -+ -+ vc->vd_terminated = vd; -+ if (vc->cyclic == vd) -+ vc->cyclic = NULL; -+} -+ -+/** - * vchan_next_desc - peek at the next descriptor to be processed - * @vc: virtual channel to obtain descriptor from - * -@@ -168,10 +188,20 @@ static inline void vchan_free_chan_resou - * Makes sure that all scheduled or active callbacks have finished running. For - * proper operation the caller has to ensure that no new callbacks are scheduled - * after the invocation of this function started. -+ * Free up the terminated cyclic descriptor to prevent memory leakage. - */ - static inline void vchan_synchronize(struct virt_dma_chan *vc) - { -+ unsigned long flags; -+ - tasklet_kill(&vc->task); -+ -+ spin_lock_irqsave(&vc->lock, flags); -+ if (vc->vd_terminated) { -+ vchan_vdesc_fini(vc->vd_terminated); -+ vc->vd_terminated = NULL; -+ } -+ spin_unlock_irqrestore(&vc->lock, flags); - } - - #endif diff --git a/queue-4.14/series b/queue-4.14/series index aff43f132cc..ab9be7f0b31 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -61,9 +61,6 @@ iio-adc-ina2xx-shift-bus-voltage-register-to-mask-flag-bits.patch iio-health-max30102-add-power-enable-parameter-to-get_temp-function.patch ath10k-update-tdls-teardown-state-to-target.patch cpufreq-fix-governor-module-removal-race.patch -dmaengine-virt-dma-support-for-race-free-transfer-termination.patch -dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch -dmaengine-amba-pl08x-use-vchan_terminate_vdesc-instead-of-desc_free.patch drm-amdgpu-fix-random-missing-of-flr-notify.patch scsi-ses-don-t-ask-for-diagnostic-pages-repeatedly-during-probe.patch pwm-stmpe-fix-wrong-register-offset-for-hwpwm-2-case.patch diff --git a/queue-4.15/dmaengine-amba-pl08x-use-vchan_terminate_vdesc-instead-of-desc_free.patch b/queue-4.15/dmaengine-amba-pl08x-use-vchan_terminate_vdesc-instead-of-desc_free.patch deleted file mode 100644 index 47964816e12..00000000000 --- a/queue-4.15/dmaengine-amba-pl08x-use-vchan_terminate_vdesc-instead-of-desc_free.patch +++ /dev/null @@ -1,66 +0,0 @@ -From foo@baz Fri Mar 16 15:11:07 CET 2018 -From: Peter Ujfalusi -Date: Tue, 14 Nov 2017 16:32:09 +0200 -Subject: dmaengine: amba-pl08x: Use vchan_terminate_vdesc() instead of desc_free - -From: Peter Ujfalusi - - -[ Upstream commit 47d71bc75d072ce25c1063aa629e55e1cfb961b2 ] - -To avoid race with vchan_complete, use the race free way to terminate -running transfer. - -Implement the device_synchronize callback to make sure that the terminated -descriptor is freed. - -Signed-off-by: Peter Ujfalusi -Reviewed-by: Linus Walleij -Signed-off-by: Vinod Koul -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman ---- - drivers/dma/amba-pl08x.c | 11 ++++++++++- - 1 file changed, 10 insertions(+), 1 deletion(-) - ---- a/drivers/dma/amba-pl08x.c -+++ b/drivers/dma/amba-pl08x.c -@@ -2182,7 +2182,7 @@ static int pl08x_terminate_all(struct dm - } - /* Dequeue jobs and free LLIs */ - if (plchan->at) { -- pl08x_desc_free(&plchan->at->vd); -+ vchan_terminate_vdesc(&plchan->at->vd); - plchan->at = NULL; - } - /* Dequeue jobs not yet fired as well */ -@@ -2193,6 +2193,13 @@ static int pl08x_terminate_all(struct dm - return 0; - } - -+static void pl08x_synchronize(struct dma_chan *chan) -+{ -+ struct pl08x_dma_chan *plchan = to_pl08x_chan(chan); -+ -+ vchan_synchronize(&plchan->vc); -+} -+ - static int pl08x_pause(struct dma_chan *chan) - { - struct pl08x_dma_chan *plchan = to_pl08x_chan(chan); -@@ -2773,6 +2780,7 @@ static int pl08x_probe(struct amba_devic - pl08x->memcpy.device_pause = pl08x_pause; - pl08x->memcpy.device_resume = pl08x_resume; - pl08x->memcpy.device_terminate_all = pl08x_terminate_all; -+ pl08x->memcpy.device_synchronize = pl08x_synchronize; - pl08x->memcpy.src_addr_widths = PL80X_DMA_BUSWIDTHS; - pl08x->memcpy.dst_addr_widths = PL80X_DMA_BUSWIDTHS; - pl08x->memcpy.directions = BIT(DMA_MEM_TO_MEM); -@@ -2802,6 +2810,7 @@ static int pl08x_probe(struct amba_devic - pl08x->slave.device_pause = pl08x_pause; - pl08x->slave.device_resume = pl08x_resume; - pl08x->slave.device_terminate_all = pl08x_terminate_all; -+ pl08x->slave.device_synchronize = pl08x_synchronize; - pl08x->slave.src_addr_widths = PL80X_DMA_BUSWIDTHS; - pl08x->slave.dst_addr_widths = PL80X_DMA_BUSWIDTHS; - pl08x->slave.directions = diff --git a/queue-4.15/dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch b/queue-4.15/dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch deleted file mode 100644 index ddbde391757..00000000000 --- a/queue-4.15/dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch +++ /dev/null @@ -1,58 +0,0 @@ -From foo@baz Fri Mar 16 15:11:07 CET 2018 -From: Peter Ujfalusi -Date: Tue, 14 Nov 2017 16:32:07 +0200 -Subject: dmaengine: bcm2835-dma: Use vchan_terminate_vdesc() instead of desc_free - -From: Peter Ujfalusi - - -[ Upstream commit de92436ac40ffe9933230aa503e24dbb5ede9201 ] - -To avoid race with vchan_complete, use the race free way to terminate -running transfer. - -Implement the device_synchronize callback to make sure that the terminated -descriptor is freed. - -Signed-off-by: Peter Ujfalusi -Acked-by: Eric Anholt -Signed-off-by: Vinod Koul -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman ---- - drivers/dma/bcm2835-dma.c | 10 +++++++++- - 1 file changed, 9 insertions(+), 1 deletion(-) - ---- a/drivers/dma/bcm2835-dma.c -+++ b/drivers/dma/bcm2835-dma.c -@@ -812,7 +812,7 @@ static int bcm2835_dma_terminate_all(str - * c->desc is NULL and exit.) - */ - if (c->desc) { -- bcm2835_dma_desc_free(&c->desc->vd); -+ vchan_terminate_vdesc(&c->desc->vd); - c->desc = NULL; - bcm2835_dma_abort(c->chan_base); - -@@ -836,6 +836,13 @@ static int bcm2835_dma_terminate_all(str - return 0; - } - -+static void bcm2835_dma_synchronize(struct dma_chan *chan) -+{ -+ struct bcm2835_chan *c = to_bcm2835_dma_chan(chan); -+ -+ vchan_synchronize(&c->vc); -+} -+ - static int bcm2835_dma_chan_init(struct bcm2835_dmadev *d, int chan_id, - int irq, unsigned int irq_flags) - { -@@ -942,6 +949,7 @@ static int bcm2835_dma_probe(struct plat - od->ddev.device_prep_dma_memcpy = bcm2835_dma_prep_dma_memcpy; - od->ddev.device_config = bcm2835_dma_slave_config; - od->ddev.device_terminate_all = bcm2835_dma_terminate_all; -+ od->ddev.device_synchronize = bcm2835_dma_synchronize; - od->ddev.src_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES); - od->ddev.dst_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES); - od->ddev.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV) | diff --git a/queue-4.15/dmaengine-virt-dma-support-for-race-free-transfer-termination.patch b/queue-4.15/dmaengine-virt-dma-support-for-race-free-transfer-termination.patch deleted file mode 100644 index 4cc1b0d03fd..00000000000 --- a/queue-4.15/dmaengine-virt-dma-support-for-race-free-transfer-termination.patch +++ /dev/null @@ -1,94 +0,0 @@ -From 1c7f072d94e8b697fd9b70cdb268622a18faf522 Mon Sep 17 00:00:00 2001 -From: Peter Ujfalusi -Date: Tue, 14 Nov 2017 16:32:04 +0200 -Subject: dmaengine: virt-dma: Support for race free transfer termination - -From: Peter Ujfalusi - -commit 1c7f072d94e8b697fd9b70cdb268622a18faf522 upstream. - -Even with the introduced vchan_synchronize() we can face race when -terminating a cyclic transfer. - -If the terminate_all is called after the interrupt handler called -vchan_cyclic_callback(), but before the vchan_complete tasklet is called: -vc->cyclic is set to the cyclic descriptor, but the descriptor itself was -freed up in the driver's terminate_all() callback. -When the vhan_complete() is executed it will try to fetch the vc->cyclic -vdesc, but the pointer is pointing now to uninitialized memory leading to -(hard to reproduce) kernel crash. - -In order to fix this, drivers should: -- call vchan_terminate_vdesc() from their terminate_all callback instead -calling their free_desc function to free up the descriptor. -- implement device_synchronize callback and call vchan_synchronize(). - -This way we can make sure that the descriptor is only going to be freed up -after the vchan_callback was executed in a safe manner. - -Signed-off-by: Peter Ujfalusi -Reviewed-by: Linus Walleij -Signed-off-by: Vinod Koul -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/dma/virt-dma.h | 30 ++++++++++++++++++++++++++++++ - 1 file changed, 30 insertions(+) - ---- a/drivers/dma/virt-dma.h -+++ b/drivers/dma/virt-dma.h -@@ -35,6 +35,7 @@ struct virt_dma_chan { - struct list_head desc_completed; - - struct virt_dma_desc *cyclic; -+ struct virt_dma_desc *vd_terminated; - }; - - static inline struct virt_dma_chan *to_virt_chan(struct dma_chan *chan) -@@ -116,6 +117,25 @@ static inline void vchan_cyclic_callback - } - - /** -+ * vchan_terminate_vdesc - Disable pending cyclic callback -+ * @vd: virtual descriptor to be terminated -+ * -+ * vc.lock must be held by caller -+ */ -+static inline void vchan_terminate_vdesc(struct virt_dma_desc *vd) -+{ -+ struct virt_dma_chan *vc = to_virt_chan(vd->tx.chan); -+ -+ /* free up stuck descriptor */ -+ if (vc->vd_terminated) -+ vchan_vdesc_fini(vc->vd_terminated); -+ -+ vc->vd_terminated = vd; -+ if (vc->cyclic == vd) -+ vc->cyclic = NULL; -+} -+ -+/** - * vchan_next_desc - peek at the next descriptor to be processed - * @vc: virtual channel to obtain descriptor from - * -@@ -168,10 +188,20 @@ static inline void vchan_free_chan_resou - * Makes sure that all scheduled or active callbacks have finished running. For - * proper operation the caller has to ensure that no new callbacks are scheduled - * after the invocation of this function started. -+ * Free up the terminated cyclic descriptor to prevent memory leakage. - */ - static inline void vchan_synchronize(struct virt_dma_chan *vc) - { -+ unsigned long flags; -+ - tasklet_kill(&vc->task); -+ -+ spin_lock_irqsave(&vc->lock, flags); -+ if (vc->vd_terminated) { -+ vchan_vdesc_fini(vc->vd_terminated); -+ vc->vd_terminated = NULL; -+ } -+ spin_unlock_irqrestore(&vc->lock, flags); - } - - #endif diff --git a/queue-4.15/series b/queue-4.15/series index 4dc9c567a0b..01db5f69c21 100644 --- a/queue-4.15/series +++ b/queue-4.15/series @@ -74,9 +74,6 @@ iio-adc-ina2xx-shift-bus-voltage-register-to-mask-flag-bits.patch iio-health-max30102-add-power-enable-parameter-to-get_temp-function.patch ath10k-update-tdls-teardown-state-to-target.patch cpufreq-fix-governor-module-removal-race.patch -dmaengine-virt-dma-support-for-race-free-transfer-termination.patch -dmaengine-bcm2835-dma-use-vchan_terminate_vdesc-instead-of-desc_free.patch -dmaengine-amba-pl08x-use-vchan_terminate_vdesc-instead-of-desc_free.patch kvm-x86-restart-the-guest-when-insn_len-is-zero-and-sev-is-enabled.patch drm-amdgpu-fix-random-missing-of-flr-notify.patch scsi-lpfc-fix-crash-during-driver-unload-with-running-nvme-traffic.patch