/*
 * GPIO definitions for Amlogic Meson GXBB SoCs
 *
 * Copyright (C) 2016 Endless Mobile, Inc.
 * Author: Carlo Caione <carlo@endlessm.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * version 2 as published by the Free Software Foundation.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program. If not, see <http://www.gnu.org/licenses/>.
 */

#ifndef _DT_BINDINGS_MESON_GXBB_GPIO_H
#define _DT_BINDINGS_MESON_GXBB_GPIO_H

#define	GPIOAO_0	0
#define	GPIOAO_1	1
#define	GPIOAO_2	2
#define	GPIOAO_3	3
#define	GPIOAO_4	4
#define	GPIOAO_5	5
#define	GPIOAO_6	6
#define	GPIOAO_7	7
#define	GPIOAO_8	8
#define	GPIOAO_9	9
#define	GPIOAO_10	10
#define	GPIOAO_11	11
#define	GPIOAO_12	12
#define	GPIOAO_13	13

#define	GPIOZ_0		0
#define	GPIOZ_1		1
#define	GPIOZ_2		2
#define	GPIOZ_3		3
#define	GPIOZ_4		4
#define	GPIOZ_5		5
#define	GPIOZ_6		6
#define	GPIOZ_7		7
#define	GPIOZ_8		8
#define	GPIOZ_9		9
#define	GPIOZ_10	10
#define	GPIOZ_11	11
#define	GPIOZ_12	12
#define	GPIOZ_13	13
#define	GPIOZ_14	14
#define	GPIOZ_15	15
#define	GPIOH_0		16
#define	GPIOH_1		17
#define	GPIOH_2		18
#define	GPIOH_3		19
#define	BOOT_0		20
#define	BOOT_1		21
#define	BOOT_2		22
#define	BOOT_3		23
#define	BOOT_4		24
#define	BOOT_5		25
#define	BOOT_6		26
#define	BOOT_7		27
#define	BOOT_8		28
#define	BOOT_9		29
#define	BOOT_10		30
#define	BOOT_11		31
#define	BOOT_12		32
#define	BOOT_13		33
#define	BOOT_14		34
#define	BOOT_15		35
#define	BOOT_16		36
#define	BOOT_17		37
#define	CARD_0		38
#define	CARD_1		39
#define	CARD_2		40
#define	CARD_3		41
#define	CARD_4		42
#define	CARD_5		43
#define	CARD_6		44
#define	GPIODV_0	45
#define	GPIODV_1	46
#define	GPIODV_2	47
#define	GPIODV_3	48
#define	GPIODV_4	49
#define	GPIODV_5	50
#define	GPIODV_6	51
#define	GPIODV_7	52
#define	GPIODV_8	53
#define	GPIODV_9	54
#define	GPIODV_10	55
#define	GPIODV_11	56
#define	GPIODV_12	57
#define	GPIODV_13	58
#define	GPIODV_14	59
#define	GPIODV_15	60
#define	GPIODV_16	61
#define	GPIODV_17	62
#define	GPIODV_18	63
#define	GPIODV_19	64
#define	GPIODV_20	65
#define	GPIODV_21	66
#define	GPIODV_22	67
#define	GPIODV_23	68
#define	GPIODV_24	69
#define	GPIODV_25	70
#define	GPIODV_26	71
#define	GPIODV_27	72
#define	GPIODV_28	73
#define	GPIODV_29	74
#define	GPIOY_0		75
#define	GPIOY_1		76
#define	GPIOY_2		77
#define	GPIOY_3		78
#define	GPIOY_4		79
#define	GPIOY_5		80
#define	GPIOY_6		81
#define	GPIOY_7		82
#define	GPIOY_8		83
#define	GPIOY_9		84
#define	GPIOY_10	85
#define	GPIOY_11	86
#define	GPIOY_12	87
#define	GPIOY_13	88
#define	GPIOY_14	89
#define	GPIOY_15	90
#define	GPIOY_16	91
#define	GPIOX_0		92
#define	GPIOX_1		93
#define	GPIOX_2		94
#define	GPIOX_3		95
#define	GPIOX_4		96
#define	GPIOX_5		97
#define	GPIOX_6		98
#define	GPIOX_7		99
#define	GPIOX_8		100
#define	GPIOX_9		101
#define	GPIOX_10	102
#define	GPIOX_11	103
#define	GPIOX_12	104
#define	GPIOX_13	105
#define	GPIOX_14	106
#define	GPIOX_15	107
#define	GPIOX_16	108
#define	GPIOX_17	109
#define	GPIOX_18	110
#define	GPIOX_19	111
#define	GPIOX_20	112
#define	GPIOX_21	113
#define	GPIOX_22	114
#define	GPIOCLK_0	115
#define	GPIOCLK_1	116
#define	GPIOCLK_2	117
#define	GPIOCLK_3	118
#define	GPIO_TEST_N	119

#endif
net-next.git/log/net/vmw_vsock/vmci_transport.h?id=5b2ec6f2be512485cb9fde7eb1119279af524c28&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th><th class='left'>Files</th><th class='left'>Lines</th></tr>
ct name='context' onchange='this.form.submit();'><option value='1'>1</option><option value='2'>2</option><option value='3' selected='selected'>3</option><option value='4'>4</option><option value='5'>5</option><option value='6'>6</option><option value='7'>7</option><option value='8'>8</option><option value='9'>9</option><option value='10'>10</option><option value='15'>15</option><option value='20'>20</option><option value='25'>25</option><option value='30'>30</option><option value='35'>35</option><option value='40'>40</option></select></td></tr><tr><td class='label'>space:</td><td class='ctrl'><select name='ignorews' onchange='this.form.submit();'><option value='0' selected='selected'>include</option><option value='1'>ignore</option></select></td></tr><tr><td class='label'>mode:</td><td class='ctrl'><select name='dt' onchange='this.form.submit();'><option value='0' selected='selected'>unified</option><option value='1'>ssdiff</option><option value='2'>stat only</option></select></td></tr><tr><td/><td class='ctrl'><noscript><input type='submit' value='reload'/></noscript></td></tr></table></form></div><table summary='commit info' class='commit-info'>
<tr><th>author</th><td>Luis R. Rodriguez &lt;mcgrof@kernel.org&gt;</td><td class='right'>2017-01-25 10:31:52 -0800</td></tr>
<tr><th>committer</th><td>Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;</td><td class='right'>2017-01-27 09:19:48 +0100</td></tr>
<tr><th>commit</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/include/soc/nps/mtm.h?id=191e885a2e130e639bb0c8ee350d7047294f2ce6'>191e885a2e130e639bb0c8ee350d7047294f2ce6</a> (<a href='/cgit.cgi/linux/net-next.git/patch/include/soc/nps/mtm.h?id=191e885a2e130e639bb0c8ee350d7047294f2ce6'>patch</a>)</td></tr>
<tr><th>tree</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/tree/?id=191e885a2e130e639bb0c8ee350d7047294f2ce6'>9bf9f9b4971df55a46e0a6750d3f6cd37bf1d9f0</a> /<a href='/cgit.cgi/linux/net-next.git/tree/include/soc/nps/mtm.h?id=191e885a2e130e639bb0c8ee350d7047294f2ce6'>include/soc/nps/mtm.h</a></td></tr>
<tr><th>parent</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/include/soc/nps/mtm.h?id=49def1853334396f948dcb4cedb9347abb318df5'>49def1853334396f948dcb4cedb9347abb318df5</a> (<a href='/cgit.cgi/linux/net-next.git/diff/include/soc/nps/mtm.h?id=191e885a2e130e639bb0c8ee350d7047294f2ce6&amp;id2=49def1853334396f948dcb4cedb9347abb318df5'>diff</a>)</td></tr></table>
<div class='commit-subject'>firmware: fix NULL pointer dereference in __fw_load_abort()</div><div class='commit-msg'>Since commit 5d47ec02c37ea6 ("firmware: Correct handling of
fw_state_wait() return value") fw_load_abort() could be called twice and
lead us to a kernel crash. This happens only when the firmware fallback
mechanism (regular or custom) is used. The fallback mechanism exposes a
sysfs interface for userspace to upload a file and notify the kernel
when the file is loaded and ready, or to cancel an upload by echo'ing -1
into on the loading file:

echo -n "-1" &gt; /sys/$DEVPATH/loading

This will call fw_load_abort(). Some distributions actually have a udev
rule in place to *always* immediately cancel all firmware fallback
mechanism requests (Debian), they have:

  $ cat /lib/udev/rules.d/50-firmware.rules
  # stub for immediately telling the kernel that userspace firmware loading
  # failed; necessary to avoid long timeouts with CONFIG_FW_LOADER_USER_HELPER=y
  SUBSYSTEM=="firmware", ACTION=="add", ATTR{loading}="-1

Distributions with this udev rule would run into this crash only if the
fallback mechanism is used. Since most distributions disable by default
using the fallback mechanism (CONFIG_FW_LOADER_USER_HELPER_FALLBACK),
this would typicaly mean only 2 drivers which *require* the fallback
mechanism could typically incur a crash: drivers/firmware/dell_rbu.c and
the drivers/leds/leds-lp55xx-common.c driver. Distributions enabling
CONFIG_FW_LOADER_USER_HELPER_FALLBACK by default are obviously more
exposed to this crash.

The crash happens because after commit 5b029624948d ("firmware: do not
use fw_lock for fw_state protection") and subsequent fix commit
5d47ec02c37ea6 ("firmware: Correct handling of fw_state_wait() return
value") a race can happen between this cancelation and the firmware
fw_state_wait_timeout() being woken up after a state change with which
fw_load_abort() as that calls swake_up(). Upon error
fw_state_wait_timeout() will also again call fw_load_abort() and trigger
a null reference.

At first glance we could just fix this with a !buf check on
fw_load_abort() before accessing buf-&gt;fw_st, however there is a logical
issue in having a state machine used for the fallback mechanism and
preventing access from it once we abort as its inside the buf
(buf-&gt;fw_st).

The firmware_class.c code is setting the buf to NULL to annotate an
abort has occurred. Replace this mechanism by simply using the state
check instead. All the other code in place already uses similar checks
for aborting as well so no further changes are needed.

An oops can be reproduced with the new fw_fallback.sh fallback mechanism
cancellation test. Either cancelling the fallback mechanism or the
custom fallback mechanism triggers a crash.

mcgrof@piggy ~/linux-next/tools/testing/selftests/firmware
(git::20170111-fw-fixes)$ sudo ./fw_fallback.sh

./fw_fallback.sh: timeout works
./fw_fallback.sh: firmware comparison works
./fw_fallback.sh: fallback mechanism works

[ this then sits here when it is trying the cancellation test ]

Kernel log:

test_firmware: loading 'nope-test-firmware.bin'
misc test_firmware: Direct firmware load for nope-test-firmware.bin failed with error -2
misc test_firmware: Falling back to user helper
BUG: unable to handle kernel NULL pointer dereference at 0000000000000038
IP: _request_firmware+0xa27/0xad0
PGD 0

Oops: 0000 [#1] SMP
Modules linked in: test_firmware(E) ... etc ...
CPU: 1 PID: 1396 Comm: fw_fallback.sh Tainted: G        W E   4.10.0-rc3-next-20170111+ #30
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.1-0-g8891697-prebuilt.qemu-project.org 04/01/2014
task: ffff9740b27f4340 task.stack: ffffbb15c0bc8000
RIP: 0010:_request_firmware+0xa27/0xad0
RSP: 0018:ffffbb15c0bcbd10 EFLAGS: 00010246
RAX: 00000000fffffffe RBX: ffff9740afe5aa80 RCX: 0000000000000000
RDX: ffff9740b27f4340 RSI: 0000000000000283 RDI: 0000000000000000
RBP: ffffbb15c0bcbd90 R08: ffffbb15c0bcbcd8 R09: 0000000000000000
R10: 0000000894a0d4b1 R11: 000000000000008c R12: ffffffffc0312480
R13: 0000000000000005 R14: ffff9740b1c32400 R15: 00000000000003e8
FS:  00007f8604422700(0000) GS:ffff9740bfc80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000038 CR3: 000000012164c000 CR4: 00000000000006e0
Call Trace:
 request_firmware+0x37/0x50
 trigger_request_store+0x79/0xd0 [test_firmware]
 dev_attr_store+0x18/0x30
 sysfs_kf_write+0x37/0x40
 kernfs_fop_write+0x110/0x1a0
 __vfs_write+0x37/0x160
 ? _cond_resched+0x1a/0x50
 vfs_write+0xb5/0x1a0
 SyS_write+0x55/0xc0
 ? trace_do_page_fault+0x37/0xd0
 entry_SYSCALL_64_fastpath+0x1e/0xad
RIP: 0033:0x7f8603f49620
RSP: 002b:00007fff6287b788 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 000055c307b110a0 RCX: 00007f8603f49620
RDX: 0000000000000016 RSI: 000055c3084d8a90 RDI: 0000000000000001
RBP: 0000000000000016 R08: 000000000000c0ff R09: 000055c3084d6336
R10: 000055c307b108b0 R11: 0000000000000246 R12: 000055c307b13c80
R13: 000055c3084d6320 R14: 0000000000000000 R15: 00007fff6287b950
Code: 9f 64 84 e8 9c 61 fe ff b8 f4 ff ff ff e9 6b f9 ff
ff 48 c7 c7 40 6b 8d 84 89 45 a8 e8 43 84 18 00 49 8b be 00 03 00 00 8b
45 a8 &lt;83&gt; 7f 38 02 74 08 e8 6e ec ff ff 8b 45 a8 49 c7 86 00 03 00 00
RIP: _request_firmware+0xa27/0xad0 RSP: ffffbb15c0bcbd10
CR2: 0000000000000038
---[ end trace 6d94ac339c133e6f ]---

Fixes: 5d47ec02c37e ("firmware: Correct handling of fw_state_wait() return value")
Reported-and-Tested-by: Jakub Kicinski &lt;jakub.kicinski@netronome.com&gt;
Reported-and-Tested-by: Patrick Bruenn &lt;p.bruenn@beckhoff.com&gt;
Reported-by: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
CC: &lt;stable@vger.kernel.org&gt;    [3.10+]
Signed-off-by: Luis R. Rodriguez &lt;mcgrof@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</div><div class='diffstat-header'><a href='/cgit.cgi/linux/net-next.git/diff/?id=191e885a2e130e639bb0c8ee350d7047294f2ce6'>Diffstat</a> (limited to 'include/soc/nps/mtm.h')</div><table summary='diffstat' class='diffstat'>