summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2023-10-09drm/msm: drop pm ops from the headless msm driverDmitry Baryshkov
The msm_pm_prepare()/msm_pm_complete() only make sense for the KMS-enabled devices, they have priv->kms guards inside. Drop global msm_pm_ops, which were used only by the headless msm device. Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/561643/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm: remove msm_drm_private::bridges fieldDmitry Baryshkov
As all output devices have switched to devm_drm_bridge_add(), we can drop the bridges array from struct msm_drm_private. Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/561641/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm/dp: switch to devm_drm_bridge_add()Dmitry Baryshkov
Make MSM DP driver use devm_drm_bridge_add() instead of plain drm_bridge_add(). As the driver doesn't require any additional cleanup, stop adding created bridge to the priv->bridges array. Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/561639/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm/dp: move pdev from struct dp_display_private to struct msm_dpDmitry Baryshkov
The dp_drm needs accessing the DP's platform device. Move pdev to the public structure. Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/561642/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm/hdmi: switch to devm_drm_bridge_add()Dmitry Baryshkov
Make MSM HDMI driver use devm_drm_bridge_add() instead of plain drm_bridge_add(). As the driver doesn't require any additional cleanup, stop adding created bridge to the priv->bridges array. Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/561635/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm/dsi: switch to devm_drm_bridge_add()Dmitry Baryshkov
Make MSM DSI driver use devm_drm_bridge_add() instead of plain drm_bridge_add(). As the driver doesn't require any additional cleanup, stop adding created bridge to the priv->bridges array. Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/561636/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm/mdp5: move resource allocation to the _probe functionDmitry Baryshkov
To let the probe function bail early if any of the resources is unavailable, move resource allocattion from kms_init directly to the probe callback. Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com> Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/561630/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm/mdp4: move resource allocation to the _probe functionDmitry Baryshkov
To let the probe function bail early if any of the resources is unavailable, move resource allocattion from kms_init directly to the probe callback. While we are at it, replace irq_of_parse_and_map() with platform_get_irq(). Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com> Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/561628/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm/dpu: move resource allocation to the _probe functionDmitry Baryshkov
To let the probe function bail early if any of the resources is unavailable, move resource allocattion from kms_init directly to the probe callback. While we are at it, replace irq_of_parse_and_map() with platform_get_irq(). This also drops devm_iounmap() calls. It is too early to have them _dpu_kms_hw_destroy() (or it will break if for some reason DPU device is rebound into the composite device) and it doesn't make sense to have them in dpu_dev_remove (as everything will be torn down by the devres anyway after the device is unbound from the driver). Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/561629/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm: allow passing struct msm_kms to msm_drv_probe()Dmitry Baryshkov
In preparation of moving resource allocation to the probe time, allow MSM KMS drivers to pass struct msm_kms pointer via msm_drv_probe(). Reviewed-by: Rob Clark <robdclark@gmail.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/561627/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm/adreno: Add A635 speedbin 0xac (A643)Konrad Dybcio
Downstream calls this the "speedbin 1", but that number is already occupied. Use index two. Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/559607/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm/adreno: Add ZAP firmware name to A635Konrad Dybcio
Some (many?) devices with A635 expect a ZAP shader to be loaded. Set the file name to allow for that. Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/559605/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm/a6xx: Fix unknown speedbin caseKonrad Dybcio
When opp-supported-hw is present under an OPP node, but no form of opp_set_supported_hw() has been called, that OPP is ignored by the API and marked as unsupported. Before Commit c928a05e4415 ("drm/msm/adreno: Move speedbin mapping to device table"), an unknown speedbin would result in marking all OPPs as available, but it's better to avoid potentially overclocking the silicon - the GMU will simply refuse to power up the chip. Currently, the Adreno speedbin code does just that (AND returns an invalid error, (int)UINT_MAX). Fix that by defaulting to speedbin 0 (which is conveniently always bound to fuseval == 0). Fixes: c928a05e4415 ("drm/msm/adreno: Move speedbin mapping to device table") Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/559604/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm/adreno: Fix SM6375 GPU IDKonrad Dybcio
SM6375 comes with a patchlevel=1. Fix the chipid up to reflect that. Fixes: 90b593ce1c9e ("drm/msm/adreno: Switch to chip-id for identifying GPU") Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/554527/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm/a6xx: Poll for GBIF unhalt status in hw_initKonrad Dybcio
Some GPUs - particularly A7xx ones - are really really stubborn and sometimes take a longer-than-expected time to finish unhalting GBIF. Note that this is not caused by the request a few lines above. Poll for the unhalt ack to make sure we're not trying to write bits to an essentially dead GPU that can't receive data on its end of the bus. Failing to do this will result in inexplicable GMU timeouts or worse. This is a rather ugly hack which introduces a whole lot of latency. Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> # sm8450 Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/559292/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm/a6xx: Add A740 supportKonrad Dybcio
A740 builds upon the A730 IP, shuffling some values and registers around. More differences will appear when things like BCL are implemented. adreno_is_a740_family is added in preparation for more A7xx GPUs, the logic checks will be valid resulting in smaller diffs. Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> # sm8450 Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/559291/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm/a6xx: Add A730 supportKonrad Dybcio
Add support for Adreno 730, also known as GEN7_0_x, found on SM8450. Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> # sm8450 Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/559290/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm/a6xx: Mostly implement A7xx gpu_stateKonrad Dybcio
Provide the necessary alternations to mostly support state dumping on A7xx. Newer GPUs will probably require more changes here. Crashdumper and debugbus remain untested. Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> # sm8450 Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/559289/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm/a6xx: Send ACD state to QMP at GMU resumeKonrad Dybcio
The QMP mailbox expects to be notified of the ACD (Adaptive Clock Distribution) state. Get a handle to the mailbox at probe time and poke it at GMU resume. Since we don't fully support ACD yet, hardcode the message to "val: 0" (state = disabled). Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> # sm8450 Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/559287/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm/a6xx: Add skeleton A7xx supportKonrad Dybcio
A7xx GPUs are - from kernel's POV anyway - basically another generation of A6xx. They build upon the A650/A660_family advancements, skipping some writes (presumably more values are preset correctly on reset), adding some new ones and changing others. One notable difference is the introduction of a second shadow, called BV. To handle this with the current code, allocate it right after the current RPTR shadow. BV handling and .submit are mostly based on Jonathan Marek's work. All A7xx GPUs are assumed to have a GMU. A702 is not an A7xx-class GPU, it's a weird forked A610. Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> # sm8450 Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/559285/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09drm/msm/a6xx: Add missing regs for A7XXKonrad Dybcio
Add some missing definitions required for A7 support. This may be substituted with a mesa header sync. Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> # sm8450 Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/559282/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09dt-bindings: display/msm/gpu: Allow A7xx SKUsKonrad Dybcio
Allow A7xx SKUs, such as the A730 GPU found on SM8450 and friends. They use GMU for all things DVFS, just like most A6xx GPUs. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> # sm8450 Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/559281/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09dt-bindings: display/msm/gmu: Allow passing QMP handleKonrad Dybcio
When booting the GMU, the QMP mailbox should be pinged about some tunables (e.g. adaptive clock distribution state). To achieve that, a reference to it is necessary. Allow it and require it with A730. Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> # sm8450 Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/559279/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09dt-bindings: display/msm/gmu: Add Adreno 7[34]0 GMUKonrad Dybcio
The GMU on the A7xx series is pretty much the same as on the A6xx parts. It's now "smarter", needs a bit less register writes and controls more things (like inter-frame power collapse) mostly internally (instead of us having to write to G[PM]U_[CG]X registers from APPS) The only difference worth mentioning is the now-required DEMET clock, which is strictly required for things like asserting reset lines, not turning it on results in GMU not being fully functional (all OOB requests would fail and HFI would hang after the first submitted OOB). Describe the A730 and A740 GMU. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> # sm8450 Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/559278/ Signed-off-by: Rob Clark <robdclark@chromium.org>
2023-10-09ASoC: cs35l56: ASP1 DOUT must default to Hi-Z when not transmittingRichard Fitzgerald
The ASP1 DOUT line must be defaulted to be high-impedance when it is not actually transmitting data for an active channel. In non-SoundWire modes ASP1 will usually be shared by multiple amps so each amp must only drive the line during the slot for an enabled TX channel. In SoundWire mode a custom firmware can use ASP1 as a secondary chip-to-chip audio link or as GPIO. It should be defaulted to high-impedance since by default the purpose of this pin is not known. Backport note: On kernel versions before 6.6 the cs35l56->base.regmap argument to regmap_set_bits() must be changed to cs35l56->regmap. Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com> Fixes: e49611252900 ("ASoC: cs35l56: Add driver for Cirrus Logic CS35L56") Link: https://lore.kernel.org/r/20231009153412.30380-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2023-10-09ASoC: codecs: fix widget name comparisonsMark Brown
Merge series from Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>: Some codec drivers compare widget names with strcmp, ignoring the component name prefix. If prefix is used, the comparisons start failing. Add a helper to fix the issue.
2023-10-09ASoC: codecs: wcd938x: fix probe and bind errorMark Brown
Merge series from Johan Hovold <johan+linaro@kernel.org>: The wcd938x codec driver happily ignores error handling, something which has bitten us in the past when we hit a probe deferral: https://lore.kernel.org/lkml/20230705123018.30903-1-johan+linaro@kernel.org/ Fix up the remaining probe and component bind paths that left resources allocated and registered after errors to avoid similar future issues.
2023-10-09cgroup: Remove duplicates in cgroup v1 tasks fileMichal Koutný
One PID may appear multiple times in a preloaded pidlist. (Possibly due to PID recycling but we have reports of the same task_struct appearing with different PIDs, thus possibly involving transfer of PID via de_thread().) Because v1 seq_file iterator uses PIDs as position, it leads to a message: > seq_file: buggy .next function kernfs_seq_next did not update position index Conservative and quick fix consists of removing duplicates from `tasks` file (as opposed to removing pidlists altogether). It doesn't affect correctness (it's sufficient to show a PID once), performance impact would be hidden by unconditional sorting of the pidlist already in place (asymptotically). Link: https://lore.kernel.org/r/20230823174804.23632-1-mkoutny@suse.com/ Suggested-by: Firo Yang <firo.yang@suse.com> Signed-off-by: Michal Koutný <mkoutny@suse.com> Signed-off-by: Tejun Heo <tj@kernel.org> Cc: stable@vger.kernel.org
2023-10-09drm/i915/uapi: fix doc typosRandy Dunlap
Correct typo of "its". Add commas for clarity. Capitalize L3. Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Cc: Jani Nikula <jani.nikula@linux.intel.com> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com> Cc: intel-gfx@lists.freedesktop.org Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Maxime Ripard <mripard@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: dri-devel@lists.freedesktop.org Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20231008214942.28439-1-rdunlap@infradead.org
2023-10-09Documentation/gpu: fix Panfrost documentation build warningsAdrián Larumbe
Fix issues revealed by `make htmldocs` after adding Panfrost DRM documentation file. Signed-off-by: Adrián Larumbe <adrian.larumbe@collabora.com> Fixes: f11b0417eec2 ("drm/panfrost: Add fdinfo support GPU load metrics") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202310030917.Txzlpoeq-lkp@intel.com Reviewed-by: Steven Price <steven.price@arm.com> Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> Link: https://patchwork.freedesktop.org/patch/msgid/20231005141239.132783-1-adrian.larumbe@collabora.com
2023-10-09xdp: Fix zero-size allocation warning in xskq_create()Andrew Kanner
Syzkaller reported the following issue: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 2807 at mm/vmalloc.c:3247 __vmalloc_node_range (mm/vmalloc.c:3361) Modules linked in: CPU: 0 PID: 2807 Comm: repro Not tainted 6.6.0-rc2+ #12 Hardware name: Generic DT based system unwind_backtrace from show_stack (arch/arm/kernel/traps.c:258) show_stack from dump_stack_lvl (lib/dump_stack.c:107 (discriminator 1)) dump_stack_lvl from __warn (kernel/panic.c:633 kernel/panic.c:680) __warn from warn_slowpath_fmt (./include/linux/context_tracking.h:153 kernel/panic.c:700) warn_slowpath_fmt from __vmalloc_node_range (mm/vmalloc.c:3361 (discriminator 3)) __vmalloc_node_range from vmalloc_user (mm/vmalloc.c:3478) vmalloc_user from xskq_create (net/xdp/xsk_queue.c:40) xskq_create from xsk_setsockopt (net/xdp/xsk.c:953 net/xdp/xsk.c:1286) xsk_setsockopt from __sys_setsockopt (net/socket.c:2308) __sys_setsockopt from ret_fast_syscall (arch/arm/kernel/entry-common.S:68) xskq_get_ring_size() uses struct_size() macro to safely calculate the size of struct xsk_queue and q->nentries of desc members. But the syzkaller repro was able to set q->nentries with the value initially taken from copy_from_sockptr() high enough to return SIZE_MAX by struct_size(). The next PAGE_ALIGN(size) is such case will overflow the size_t value and set it to 0. This will trigger WARN_ON_ONCE in vmalloc_user() -> __vmalloc_node_range(). The issue is reproducible on 32-bit arm kernel. Fixes: 9f78bf330a66 ("xsk: support use vaddr as ring") Reported-by: syzbot+fae676d3cf469331fc89@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000c84b4705fb31741e@google.com/T/ Reported-by: syzbot+b132693e925cbbd89e26@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000e20df20606ebab4f@google.com/T/ Signed-off-by: Andrew Kanner <andrew.kanner@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Tested-by: syzbot+fae676d3cf469331fc89@syzkaller.appspotmail.com Acked-by: Magnus Karlsson <magnus.karlsson@intel.com> Link: https://syzkaller.appspot.com/bug?extid=fae676d3cf469331fc89 Link: https://lore.kernel.org/bpf/20231007075148.1759-1-andrew.kanner@gmail.com
2023-10-09Merge tag 'irqchip-fixes-6.6-2' of ↵Thomas Gleixner
git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent Pull irqchip fixes from Marc Zyngier: - DT binding updates for Renesas r8a779f0 and rzg2l - Let GICv3 honor the "dma-non-coherent" attribute for systems that rely on SW guessing what the HW supports - Fix the RISC-V INTC probing by marking all devices as initialised at once - Properly translate interrupt numbers from DT on stm32-exti - Use irq_data_get_irq_chip_data() in the rzg2l driver instead of blindly dereferencing the irq_data structure - Add a MAINTAINERS entry for the various ARM GIC irqchip drivers - Remove myself as the top-level irqchip/irqdomain maintainer Link: https://lore.kernel.org/all/20231007121933.3840357-1-maz@kernel.org
2023-10-09x86/sev: Check IOBM for IOIO exceptions from user-spaceJoerg Roedel
Check the IO permission bitmap (if present) before emulating IOIO #VC exceptions for user-space. These permissions are checked by hardware already before the #VC is raised, but due to the VC-handler decoding race it needs to be checked again in software. Fixes: 25189d08e516 ("x86/sev-es: Add support for handling IOIO exceptions") Reported-by: Tom Dohrmann <erbse.13@gmx.de> Signed-off-by: Joerg Roedel <jroedel@suse.de> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Tested-by: Tom Dohrmann <erbse.13@gmx.de> Cc: <stable@kernel.org>
2023-10-09x86/sev: Disable MMIO emulation from user modeBorislav Petkov (AMD)
A virt scenario can be constructed where MMIO memory can be user memory. When that happens, a race condition opens between when the hardware raises the #VC and when the #VC handler gets to emulate the instruction. If the MOVS is replaced with a MOVS accessing kernel memory in that small race window, then write to kernel memory happens as the access checks are not done at emulation time. Disable MMIO emulation in user mode temporarily until a sensible use case appears and justifies properly handling the race window. Fixes: 0118b604c2c9 ("x86/sev-es: Handle MMIO String Instructions") Reported-by: Tom Dohrmann <erbse.13@gmx.de> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Tested-by: Tom Dohrmann <erbse.13@gmx.de> Cc: <stable@kernel.org>
2023-10-09riscv, bpf: Track both a0 (RISC-V ABI) and a5 (BPF) return valuesBjörn Töpel
The RISC-V BPF uses a5 for BPF return values, which are zero-extended, whereas the RISC-V ABI uses a0 which is sign-extended. In other words, a5 and a0 can differ, and are used in different context. The BPF trampoline are used for both BPF programs, and regular kernel functions. Make sure that the RISC-V BPF trampoline saves, and restores both a0 and a5. Fixes: 49b5e77ae3e2 ("riscv, bpf: Add bpf trampoline support for RV64") Signed-off-by: Björn Töpel <bjorn@rivosinc.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20231004120706.52848-3-bjorn@kernel.org
2023-10-09riscv, bpf: Sign-extend return valuesBjörn Töpel
The RISC-V architecture does not expose sub-registers, and hold all 32-bit values in a sign-extended format [1] [2]: | The compiler and calling convention maintain an invariant that all | 32-bit values are held in a sign-extended format in 64-bit | registers. Even 32-bit unsigned integers extend bit 31 into bits | 63 through 32. Consequently, conversion between unsigned and | signed 32-bit integers is a no-op, as is conversion from a signed | 32-bit integer to a signed 64-bit integer. While BPF, on the other hand, exposes sub-registers, and use zero-extension (similar to arm64/x86). This has led to some subtle bugs, where a BPF JITted program has not sign-extended the a0 register (return value in RISC-V land), passed the return value up the kernel, e.g.: | int from_bpf(void); | | long foo(void) | { | return from_bpf(); | } Here, a0 would be 0xffff_ffff, instead of the expected 0xffff_ffff_ffff_ffff. Internally, the RISC-V JIT uses a5 as a dedicated register for BPF return values. Keep a5 zero-extended, but explicitly sign-extend a0 (which is used outside BPF land). Now that a0 (RISC-V ABI) and a5 (BPF ABI) differs, a0 is only moved to a5 for non-BPF native calls (BPF_PSEUDO_CALL). Fixes: 2353ecc6f91f ("bpf, riscv: add BPF JIT for RV64G") Signed-off-by: Björn Töpel <bjorn@rivosinc.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://github.com/riscv/riscv-isa-manual/releases/download/riscv-isa-release-056b6ff-2023-10-02/unpriv-isa-asciidoc.pdf # [2] Link: https://github.com/riscv-non-isa/riscv-elf-psabi-doc/releases/download/draft-20230929-e5c800e661a53efe3c2678d71a306323b60eb13b/riscv-abi.pdf # [2] Link: https://lore.kernel.org/bpf/20231004120706.52848-2-bjorn@kernel.org
2023-10-09ACPI: resource: Add TongFang GM6BGEQ, GM6BG5Q and GM6BG0Q to ↵Hans de Goede
irq1_edge_low_force_override[] The TongFang GM6BGEQ, GM6BG5Q and GM6BG0Q are 3 GPU variants of a TongFang barebone design which is sold under various brand names. The ACPI IRQ override for the keyboard IRQ must be used on these AMD Zen laptops in order for the IRQ to work. Adjust the pcspecialist_laptop[] DMI match table for this: 1. Drop the sys-vendor match from the existing PCSpecialist Elimina Pro 16 entry for the GM6BGEQ (RTX3050 GPU) model so that it will also match the laptop when sold by other vendors such as hyperbook.pl. 2. Add board-name matches for the GM6BG5Q (RTX4050) and GM6B0Q (RTX4060) models. Note the .ident values of the dmi_system_id structs are left unset since these are not used. Suggested-by: August Wikerfors <git@augustwikerfors.se> Reported-by: Francesco <f.littarru@outlook.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217394 Link: https://laptopparts4less.frl/index.php?route=product/search&filter_name=GM6BG Link: https://hyperbook.pl/en/content/14-hyperbook-drivers Link: https://linux-hardware.org/?probe=bfa70344e3 Link: https://bbs.archlinuxcn.org/viewtopic.php?id=13313 Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2023-10-09regmap: fix NULL deref on lookupJohan Hovold
Not all regmaps have a name so make sure to check for that to avoid dereferencing a NULL pointer when dev_get_regmap() is used to lookup a named regmap. Fixes: e84861fec32d ("regmap: dev_get_regmap_match(): fix string comparison") Cc: stable@vger.kernel.org # 5.8 Cc: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20231006082104.16707-1-johan+linaro@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2023-10-09ASoC: pxa: fix a memory leak in probe()Dan Carpenter
Free the "priv" pointer before returning the error code. Fixes: 90eb6b59d311 ("ASoC: pxa-ssp: add support for an external clock in devicetree") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/84ac2313-1420-471a-b2cb-3269a2e12a7c@moroto.mountain Signed-off-by: Mark Brown <broonie@kernel.org>
2023-10-09ASoC: cs35l56: Fix illegal use of init_completion()Richard Fitzgerald
Fix cs35l56_patch() to call reinit_completion() to reinitialize the completion object. It was incorrectly using init_completion(). Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com> Fixes: e49611252900 ("ASoC: cs35l56: Add driver for Cirrus Logic CS35L56") Link: https://lore.kernel.org/r/20231006164405.253796-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2023-10-09ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errorsJohan Hovold
Make sure to balance the runtime PM operations, including the disable count, on probe errors and on driver unbind. Fixes: 16572522aece ("ASoC: codecs: wcd938x-sdw: add SoundWire driver") Cc: stable@vger.kernel.org # 5.14 Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20231003155558.27079-8-johan+linaro@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2023-10-09ASoC: codecs: wcd938x-sdw: fix use after free on driver unbindJohan Hovold
Make sure to deregister the component when the driver is being unbound and before the underlying device-managed resources are freed. Fixes: 16572522aece ("ASoC: codecs: wcd938x-sdw: add SoundWire driver") Cc: stable@vger.kernel.org # 5.14 Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20231003155558.27079-7-johan+linaro@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2023-10-09ASoC: codecs: wcd938x: fix runtime PM imbalance on removeJohan Hovold
Make sure to balance the runtime PM operations, including the disable count, on driver unbind. Fixes: 16572522aece ("ASoC: codecs: wcd938x-sdw: add SoundWire driver") Cc: stable@vger.kernel.org # 5.14 Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20231003155558.27079-6-johan+linaro@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2023-10-09ASoC: codecs: wcd938x: fix regulator leaks on probe errorsJohan Hovold
Make sure to disable and free the regulators on probe errors and on driver unbind. Fixes: 16572522aece ("ASoC: codecs: wcd938x-sdw: add SoundWire driver") Cc: stable@vger.kernel.org # 5.14 Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20231003155558.27079-5-johan+linaro@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2023-10-09ASoC: codecs: wcd938x: fix resource leaks on bind errorsJohan Hovold
Add the missing code to release resources on bind errors, including the references taken by wcd938x_sdw_device_get() which also need to be dropped on unbind(). Fixes: 16572522aece ("ASoC: codecs: wcd938x-sdw: add SoundWire driver") Cc: stable@vger.kernel.org # 5.14 Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20231003155558.27079-4-johan+linaro@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2023-10-09ASoC: codecs: wcd938x: fix unbind tear down orderJohan Hovold
Make sure to deregister the component before tearing down the resources it depends on during unbind(). Fixes: 16572522aece ("ASoC: codecs: wcd938x-sdw: add SoundWire driver") Cc: stable@vger.kernel.org # 5.14 Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20231003155558.27079-3-johan+linaro@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2023-10-09ASoC: codecs: wcd938x: drop bogus bind error handlingJohan Hovold
Drop the bogus error handling for a soundwire device backcast during bind() that cannot fail. Fixes: 16572522aece ("ASoC: codecs: wcd938x-sdw: add SoundWire driver") Cc: stable@vger.kernel.org # 5.14 Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20231003155558.27079-2-johan+linaro@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2023-10-09ASoC: codecs: wsa-macro: handle component name prefixKrzysztof Kozlowski
When comparing widget names in wsa_macro_spk_boost_event(), consider also the component's name prefix. Otherwise the WSA codec won't have proper mixer setup resulting in no sound playback through speakers. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://lore.kernel.org/r/20231003155710.821315-3-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown <broonie@kernel.org>
2023-10-09ASoC: soc-dapm: Add helper for comparing widget nameKrzysztof Kozlowski
Some drivers use one event callback for multiple widgets but still need to perform a bit different actions based on actual widget. This is done by comparing widget name, however drivers tend to miss possible name prefix. Add a helper to solve common mistakes. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://lore.kernel.org/r/20231003155710.821315-2-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown <broonie@kernel.org>
2023-10-09drm/i915/guc: Annotate struct ct_incoming_msg with __counted_byKees Cook
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct ct_incoming_msg. Cc: Jani Nikula <jani.nikula@linux.intel.com> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com> Cc: David Airlie <airlied@gmail.com> Cc: Daniel Vetter <daniel@ffwll.ch> Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org> Cc: John Harrison <John.C.Harrison@Intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Michal Wajdeczko <michal.wajdeczko@intel.com> Cc: Matt Roper <matthew.d.roper@intel.com> Cc: intel-gfx@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org Cc: linux-hardening@vger.kernel.org Link: https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci [1] Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com> Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20231006201744.work.135-kees@kernel.org
generated by cgit (git 2.34.1) at 2025-09-24 13:03:27 +0000