Skip to content

R
raspberrypi-kernel

openeuler / raspberrypi-kernel

通知 13
Star 1
Fork 0
R
raspberrypi-kernel
切换分支/标签
  1. 11 2月, 2016 5 次提交
    • A
      libata: fix HDIO_GET_32BIT ioctl · 287e6611
      由 Arnd Bergmann 提交于 
      As reported by Soohoon Lee, the HDIO_GET_32BIT ioctl does not
work correctly in compat mode with libata.

I have investigated the issue further and found multiple problems
that all appeared with the same commit that originally introduced
HDIO_GET_32BIT handling in libata back in linux-2.6.8 and presumably
also linux-2.4, as the code uses "copy_to_user(arg, &val, 1)" to copy
a 'long' variable containing either 0 or 1 to user space.

The problems with this are:

* On big-endian machines, this will always write a zero because it
  stores the wrong byte into user space.

* In compat mode, the upper three bytes of the variable are updated
  by the compat_hdio_ioctl() function, but they now contain
  uninitialized stack data.

* The hdparm tool calling this ioctl uses a 'static long' variable
  to store the result. This means at least the upper bytes are
  initialized to zero, but calling another ioctl like HDIO_GET_MULTCOUNT
  would fill them with data that remains stale when the low byte
  is overwritten. Fortunately libata doesn't implement any of the
  affected ioctl commands, so this would only happen when we query
  both an IDE and an ATA device in the same command such as
  "hdparm -N -c /dev/hda /dev/sda"

* The libata code for unknown reasons started using ATA_IOC_GET_IO32
  and ATA_IOC_SET_IO32 as aliases for HDIO_GET_32BIT and HDIO_SET_32BIT,
  while the ioctl commands that were added later use the normal
  HDIO_* names. This is harmless but rather confusing.

This addresses all four issues by changing the code to use put_user()
on an 'unsigned long' variable in HDIO_GET_32BIT, like the IDE subsystem
does, and by clarifying the names of the ioctl commands.
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Reported-by: NSoohoon Lee <Soohoon.Lee@f5.com>
Tested-by: NSoohoon Lee <Soohoon.Lee@f5.com>
Cc: stable@vger.kernel.org
Signed-off-by: NTejun Heo <tj@kernel.org>
      287e6611
    • S
      ahci_xgene: Implement the workaround to fix the missing of the edge interrupt... · 32aea268
      由 Suman Tripathi 提交于 
      ahci_xgene: Implement the workaround to fix the missing of the edge interrupt for the HOST_IRQ_STAT.

Due to H/W errata, the HOST_IRQ_STAT register misses the edge interrupt
when clearing the HOST_IRQ_STAT register and hardware reporting the
PORT_IRQ_STAT register happens to be at the same clock cycle.
Signed-off-by: NSuman Tripathi <stripathi@apm.com>
Signed-off-by: NTejun Heo <tj@kernel.org>
      32aea268
    • S
      ata: Remove the AHCI_HFLAG_EDGE_IRQ support from libahci. · d867b95f
      由 Suman Tripathi 提交于 
      The flexibility to override the irq handles in the LLD's are already
present, so controllers implementing a edge trigger latch can
implement their own interrupt handler inside the driver.  This patch
removes the AHCI_HFLAG_EDGE_IRQ support from libahci and moves edge
irq handling to ahci_xgene.

tj: Minor update to description.
Signed-off-by: NSuman Tripathi <stripathi@apm.com>
Signed-off-by: NTejun Heo <tj@kenrel.org>
      d867b95f
    • S
      libahci: Implement the capability to override the generic ahci interrupt handler. · f070d671
      由 Suman Tripathi 提交于 
      This patch implements the capability to override the generic AHCI
interrupt handler so that specific ahci drivers can implement their
own custom interrupt handler routines.  It also exports
ahci_handle_port_intr so that custom irq_handler implementations can
use it.

tj: s/ahci_irq_handler/irq_handler/ and updated description.
Signed-off-by: NSuman Tripathi <stripathi@apm.com>
Signed-off-by: NTejun Heo <tj@kernel.org>
      f070d671
    • A
      ahci: Intel DNV device IDs SATA · 342decff
      由 Alexandra Yates 提交于 
      Adding Intel codename DNV platform device IDs for SATA.
Signed-off-by: NAlexandra Yates <alexandra.yates@linux.intel.com>
Signed-off-by: NTejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org
      342decff
  3. 02 2月, 2016 1 次提交
    • T
      libata: fix sff host state machine locking while polling · 8eee1d3e
      由 Tejun Heo 提交于 
      The bulk of ATA host state machine is implemented by
ata_sff_hsm_move().  The function is called from either the interrupt
handler or, if polling, a work item.  Unlike from the interrupt path,
the polling path calls the function without holding the host lock and
ata_sff_hsm_move() selectively grabs the lock.

This is completely broken.  If an IRQ triggers while polling is in
progress, the two can easily race and end up accessing the hardware
and updating state machine state at the same time.  This can put the
state machine in an illegal state and lead to a crash like the
following.

  kernel BUG at drivers/ata/libata-sff.c:1302!
  invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN
  Modules linked in:
  CPU: 1 PID: 10679 Comm: syz-executor Not tainted 4.5.0-rc1+ #300
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
  task: ffff88002bd00000 ti: ffff88002e048000 task.ti: ffff88002e048000
  RIP: 0010:[<ffffffff83a83409>]  [<ffffffff83a83409>] ata_sff_hsm_move+0x619/0x1c60
  ...
  Call Trace:
   <IRQ>
   [<ffffffff83a84c31>] __ata_sff_port_intr+0x1e1/0x3a0 drivers/ata/libata-sff.c:1584
   [<ffffffff83a85611>] ata_bmdma_port_intr+0x71/0x400 drivers/ata/libata-sff.c:2877
   [<     inline     >] __ata_sff_interrupt drivers/ata/libata-sff.c:1629
   [<ffffffff83a85bf3>] ata_bmdma_interrupt+0x253/0x580 drivers/ata/libata-sff.c:2902
   [<ffffffff81479f98>] handle_irq_event_percpu+0x108/0x7e0 kernel/irq/handle.c:157
   [<ffffffff8147a717>] handle_irq_event+0xa7/0x140 kernel/irq/handle.c:205
   [<ffffffff81484573>] handle_edge_irq+0x1e3/0x8d0 kernel/irq/chip.c:623
   [<     inline     >] generic_handle_irq_desc include/linux/irqdesc.h:146
   [<ffffffff811a92bc>] handle_irq+0x10c/0x2a0 arch/x86/kernel/irq_64.c:78
   [<ffffffff811a7e4d>] do_IRQ+0x7d/0x1a0 arch/x86/kernel/irq.c:240
   [<ffffffff86653d4c>] common_interrupt+0x8c/0x8c arch/x86/entry/entry_64.S:520
   <EOI>
   [<     inline     >] rcu_lock_acquire include/linux/rcupdate.h:490
   [<     inline     >] rcu_read_lock include/linux/rcupdate.h:874
   [<ffffffff8164b4a1>] filemap_map_pages+0x131/0xba0 mm/filemap.c:2145
   [<     inline     >] do_fault_around mm/memory.c:2943
   [<     inline     >] do_read_fault mm/memory.c:2962
   [<     inline     >] do_fault mm/memory.c:3133
   [<     inline     >] handle_pte_fault mm/memory.c:3308
   [<     inline     >] __handle_mm_fault mm/memory.c:3418
   [<ffffffff816efb16>] handle_mm_fault+0x2516/0x49a0 mm/memory.c:3447
   [<ffffffff8127dc16>] __do_page_fault+0x376/0x960 arch/x86/mm/fault.c:1238
   [<ffffffff8127e358>] trace_do_page_fault+0xe8/0x420 arch/x86/mm/fault.c:1331
   [<ffffffff8126f514>] do_async_page_fault+0x14/0xd0 arch/x86/kernel/kvm.c:264
   [<ffffffff86655578>] async_page_fault+0x28/0x30 arch/x86/entry/entry_64.S:986

Fix it by ensuring that the polling path is holding the host lock
before entering ata_sff_hsm_move() so that all hardware accesses and
state updates are performed under the host lock.
Signed-off-by: NTejun Heo <tj@kernel.org>
Reported-and-tested-by: NDmitry Vyukov <dvyukov@google.com>
Link: http://lkml.kernel.org/g/CACT4Y+b_JsOxJu2EZyEf+mOXORc_zid5V1-pLZSroJVxyWdSpw@mail.gmail.com
Cc: stable@vger.kernel.org
      8eee1d3e
  5. 29 1月, 2016 1 次提交
    • T
      libata-sff: use WARN instead of BUG on illegal host state machine state · a588afc9
      由 Tejun Heo 提交于 
      ata_sff_hsm_move() triggers BUG if it sees a host state machine state
that it dind't expect.  The risk for data corruption when the
condition occurs is low as it's highly unlikely that it would lead to
spurious completion of commands.  The BUG occasionally triggered for
subtle race conditions in the driver.  Let's downgrade it to WARN so
that it doesn't kill the machine unnecessarily.
Signed-off-by: NTejun Heo <tj@kernel.org>
Cc: Dmitry Vyukov <dvyukov@google.com>
      a588afc9
  7. 26 1月, 2016 3 次提交
  9. 09 1月, 2016 3 次提交
  11. 08 1月, 2016 1 次提交
  13. 01 1月, 2016 2 次提交
  15. 16 12月, 2015 3 次提交
  17. 07 12月, 2015 4 次提交
    • A
      ata/sata_fsl.c: add ATA_FLAG_NO_LOG_PAGE to blacklist the controller for log page reads · 4f2568f5
      由 Andreas Werner 提交于 
      Every attempt to issue a read log page command lockup the controller.
The command is currently sent if the sata device includes the devlsp feature
to read out the timing data.
This attempt to read the data, locks up the controller and the device
is not recognzied correctly (failed to set xfermode) and cannot be accessed.

This was found on Freescale P1013/P1022 and T4240 CPUs
using a ATP IG mSATA 4GB with the devslp feature.

fsl-sata ff718000.sata: Sata FSL Platform/CSB Driver init
[    1.254195] scsi0 : sata_fsl
[    1.256004] ata1: SATA max UDMA/133 irq 74
[    1.370666] fsl-gianfar ethernet.3: enabled errata workarounds, flags: 0x4
[    1.470671] fsl-gianfar ethernet.4: enabled errata workarounds, flags: 0x4
[    1.775584] ata1: Signature Update detected @ 504 msecs
[    1.947594] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[    1.948366] ata1.00: ATA-8: ATP IG mSATA, 20150311, max UDMA/133
[    1.948371] ata1.00: 7732368 sectors, multi 0: LBA
[    1.948843] ata1.00: failed to get Identify Device Data, Emask 0x1
[    1.948857] ata1.00: failed to set xfermode (err_mask=0x40)
[    7.467557] ata1: Signature Update detected @ 504 msecs
[    7.639560] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[    7.651320] ata1.00: failed to get Identify Device Data, Emask 0x1
[    7.651360] ata1.00: failed to set xfermode (err_mask=0x40)
[    7.655628] ata1: limiting SATA link speed to 1.5 Gbps
[    7.659458] ata1.00: limiting speed to UDMA/133:PIO3
[   13.163554] ata1: Signature Update detected @ 504 msecs
[   13.335558] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[   13.347298] ata1.00: failed to get Identify Device Data, Emask 0x1
[   13.347334] ata1.00: failed to set xfermode (err_mask=0x40)
[   13.351601] ata1.00: disabled
[   13.353278] ata1: exception Emask 0x50 SAct 0x0 SErr 0x800 action 0x6 frozen t4
[   13.359281] ata1: SError: { HostInt }
[   13.361644] ata1: hard resetting link
Signed-off-by: NAndreas Werner <andreas.werner@men.de>
Signed-off-by: NTejun Heo <tj@kernel.org>
      4f2568f5
    • A
      libata-eh.c: Introduce new ata port flag for controller which lockup on read log page · ea013a9b
      由 Andreas Werner 提交于 
      Some controller lockup on a ata_read_log_page.
Add new ata port flag ATA_FLAG_NO_LOG_PAGE which can used
to blacklist a controller.

If this flag is set, any attempt to read a log page returns an error
without actually issuing the command.
Signed-off-by: NAndreas Werner <andreas.werner@men.de>
Signed-off-by: NTejun Heo <tj@kernel.org>
      ea013a9b
    • D
      ahci: compile out msi/msix infrastructure · f893180b
      由 Dan Williams 提交于 
      Quoting Arnd:
    The AHCI driver is used for some on-chip devices that do not use PCI
    for probing, and it can be built even when CONFIG_PCI is disabled, but
    that now results in a build failure:

    ata/libahci.c: In function 'ahci_host_activate_multi_irqs':
    ata/libahci.c:2475:4: error: invalid use of undefined type 'struct msix_entry'
    ata/libahci.c:2475:21: error: dereferencing pointer to incomplete type 'struct msix_entry'

Add ifdef CONFIG_PCI_MSI infrastructure to compile out the multi-msi and
multi-msix code.
Reported-by: NArnd Bergmann <arnd@arndb.de>
Tested--by: NArnd Bergmann <arnd@arndb.de>
[arnd: fix up pci enabled case]
Reported-by: NPaul Gortmaker <paul.gortmaker@windriver.com>
Fixes: d684a90d ("ahci: per-port msix support")
Signed-off-by: NDan Williams <dan.j.williams@intel.com>
Signed-off-by: NTejun Heo <tj@kernel.org>
      f893180b
    • H
      ata: core: fix irq description on AHCI single irq systems · 7e22c002
      由 Heiner Kallweit 提交于 
      On my machine with single irq AHCI just the PCI id is printed as
description in /proc/interrupts.
I found a related discussion from beginning of this year:
http://www.gossamer-threads.com/lists/linux/kernel/2117335

Seems like 4f37b504 ("libata: Use dev_name() for request_irq() to
distinguish devices") tried to fix displaying a proper interrupt
description for one scenario but broke it for another one.

The mentioned discussion ended in the current situation being
considered as broken but w/o a patch to fix it.

The following patch is based on a proposal in this mail thread.
Now the interrupt is properly described as:
PCI-MSI 512000-edge      ahci[0000:00:1f.2]

By combining both values also the scenario that commit 4f37b504
("libata: Use dev_name() for request_irq() to distinguish devices")
refers to should still be fine. There it should look like this now:
ahci[20100000.ide]

Using managed memory allocation ensures that the irq description
lives at least as long as the interrupt.
Signed-off-by: NHeiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: NTejun Heo <tj@kernel.org>
Cc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
      7e22c002
  19. 30 11月, 2015 5 次提交
  21. 24 11月, 2015 1 次提交
  23. 21 11月, 2015 2 次提交
  25. 17 11月, 2015 5 次提交
  27. 10 11月, 2015 1 次提交
  29. 04 11月, 2015 1 次提交
  31. 31 10月, 2015 2 次提交