summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2021-12-21drm/nouveau: wait for the exclusive fence after the shared ones v2Christian König
Always waiting for the exclusive fence resulted on some performance regressions. So try to wait for the shared fences first, then the exclusive fence should always be signaled already. v2: fix incorrectly placed "(", add some comment why we do this. Signed-off-by: Christian König <christian.koenig@amd.com> Tested-by: Stefan Fritsch <sf@sfritsch.de> Tested-by: Dan Moulding <dmoulding@me.com> Acked-by: Ben Skeggs <bskeggs@redhat.com> Signed-off-by: Christian König <christian.koenig@amd.com> Cc: <stable@vger.kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20211209102335.18321-1-christian.koenig@amd.com
2021-12-21usb: mtu3: set interval of FS intr and isoc endpointChunfeng Yun
Add support to set interval also for FS intr and isoc endpoint. Fixes: 4d79e042ed8b ("usb: mtu3: add support for usb3.1 IP") Cc: stable@vger.kernel.org Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com> Link: https://lore.kernel.org/r/20211218095749.6250-4-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-21usb: mtu3: fix list_head check warningChunfeng Yun
This is caused by uninitialization of list_head. BUG: KASAN: use-after-free in __list_del_entry_valid+0x34/0xe4 Call trace: dump_backtrace+0x0/0x298 show_stack+0x24/0x34 dump_stack+0x130/0x1a8 print_address_description+0x88/0x56c __kasan_report+0x1b8/0x2a0 kasan_report+0x14/0x20 __asan_load8+0x9c/0xa0 __list_del_entry_valid+0x34/0xe4 mtu3_req_complete+0x4c/0x300 [mtu3] mtu3_gadget_stop+0x168/0x448 [mtu3] usb_gadget_unregister_driver+0x204/0x3a0 unregister_gadget_item+0x44/0xa4 Fixes: 83374e035b62 ("usb: mtu3: add tracepoints to help debug") Cc: stable@vger.kernel.org Reported-by: Yuwen Ng <yuwen.ng@mediatek.com> Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com> Link: https://lore.kernel.org/r/20211218095749.6250-3-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-21usb: mtu3: add memory barrier before set GPD's HWOChunfeng Yun
There is a seldom issue that the controller access invalid address and trigger devapc or emimpu violation. That is due to memory access is out of order and cause gpd data is not correct. Add mb() to prohibit compiler or cpu from reordering to make sure GPD is fully written before setting its HWO. Fixes: 48e0d3735aa5 ("usb: mtu3: supports new QMU format") Cc: stable@vger.kernel.org Reported-by: Eddie Hung <eddie.hung@mediatek.com> Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com> Link: https://lore.kernel.org/r/20211218095749.6250-2-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-21usb: mtu3: fix interval value for intr and isocChunfeng Yun
Use the Interval value from isoc/intr endpoint descriptor, no need minus one. The original code doesn't cause transfer error for normal cases, but it may have side effect with respond time of ERDY or tPingTimeout. Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com> Link: https://lore.kernel.org/r/20211218095749.6250-1-chunfeng.yun@mediatek.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-21usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.Vincent Pelletier
ffs_data_clear is indirectly called from both ffs_fs_kill_sb and ffs_ep0_release, so it ends up being called twice when userland closes ep0 and then unmounts f_fs. If userland provided an eventfd along with function's USB descriptors, it ends up calling eventfd_ctx_put as many times, causing a refcount underflow. NULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls. Also, set epfiles to NULL right after de-allocating it, for readability. For completeness, ffs_data_clear actually ends up being called thrice, the last call being before the whole ffs structure gets freed, so when this specific sequence happens there is a second underflow happening (but not being reported): /sys/kernel/debug/tracing# modprobe usb_f_fs /sys/kernel/debug/tracing# echo ffs_data_clear > set_ftrace_filter /sys/kernel/debug/tracing# echo function > current_tracer /sys/kernel/debug/tracing# echo 1 > tracing_on (setup gadget, run and kill function userland process, teardown gadget) /sys/kernel/debug/tracing# echo 0 > tracing_on /sys/kernel/debug/tracing# cat trace smartcard-openp-436 [000] ..... 1946.208786: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] ..... 1946.279147: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] .n... 1946.905512: ffs_data_clear <-ffs_data_put Warning output corresponding to above trace: [ 1946.284139] WARNING: CPU: 0 PID: 431 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15c [ 1946.293094] refcount_t: underflow; use-after-free. [ 1946.298164] Modules linked in: usb_f_ncm(E) u_ether(E) usb_f_fs(E) hci_uart(E) btqca(E) btrtl(E) btbcm(E) btintel(E) bluetooth(E) nls_ascii(E) nls_cp437(E) vfat(E) fat(E) bcm2835_v4l2(CE) bcm2835_mmal_vchiq(CE) videobuf2_vmalloc(E) videobuf2_memops(E) sha512_generic(E) videobuf2_v4l2(E) sha512_arm(E) videobuf2_common(E) videodev(E) cpufreq_dt(E) snd_bcm2835(CE) brcmfmac(E) mc(E) vc4(E) ctr(E) brcmutil(E) snd_soc_core(E) snd_pcm_dmaengine(E) drbg(E) snd_pcm(E) snd_timer(E) snd(E) soundcore(E) drm_kms_helper(E) cec(E) ansi_cprng(E) rc_core(E) syscopyarea(E) raspberrypi_cpufreq(E) sysfillrect(E) sysimgblt(E) cfg80211(E) max17040_battery(OE) raspberrypi_hwmon(E) fb_sys_fops(E) regmap_i2c(E) ecdh_generic(E) rfkill(E) ecc(E) bcm2835_rng(E) rng_core(E) vchiq(CE) leds_gpio(E) libcomposite(E) fuse(E) configfs(E) ip_tables(E) x_tables(E) autofs4(E) ext4(E) crc16(E) mbcache(E) jbd2(E) crc32c_generic(E) sdhci_iproc(E) sdhci_pltfm(E) sdhci(E) [ 1946.399633] CPU: 0 PID: 431 Comm: smartcard-openp Tainted: G C OE 5.15.0-1-rpi #1 Debian 5.15.3-1 [ 1946.417950] Hardware name: BCM2835 [ 1946.425442] Backtrace: [ 1946.432048] [<c08d60a0>] (dump_backtrace) from [<c08d62ec>] (show_stack+0x20/0x24) [ 1946.448226] r7:00000009 r6:0000001c r5:c04a948c r4:c0a64e2c [ 1946.458412] [<c08d62cc>] (show_stack) from [<c08d9ae0>] (dump_stack+0x28/0x30) [ 1946.470380] [<c08d9ab8>] (dump_stack) from [<c0123500>] (__warn+0xe8/0x154) [ 1946.482067] r5:c04a948c r4:c0a71dc8 [ 1946.490184] [<c0123418>] (__warn) from [<c08d6948>] (warn_slowpath_fmt+0xa0/0xe4) [ 1946.506758] r7:00000009 r6:0000001c r5:c0a71dc8 r4:c0a71e04 [ 1946.517070] [<c08d68ac>] (warn_slowpath_fmt) from [<c04a948c>] (refcount_warn_saturate+0x110/0x15c) [ 1946.535309] r8:c0100224 r7:c0dfcb84 r6:ffffffff r5:c3b84c00 r4:c24a17c0 [ 1946.546708] [<c04a937c>] (refcount_warn_saturate) from [<c0380134>] (eventfd_ctx_put+0x48/0x74) [ 1946.564476] [<c03800ec>] (eventfd_ctx_put) from [<bf5464e8>] (ffs_data_clear+0xd0/0x118 [usb_f_fs]) [ 1946.582664] r5:c3b84c00 r4:c2695b00 [ 1946.590668] [<bf546418>] (ffs_data_clear [usb_f_fs]) from [<bf547cc0>] (ffs_data_closed+0x9c/0x150 [usb_f_fs]) [ 1946.609608] r5:bf54d014 r4:c2695b00 [ 1946.617522] [<bf547c24>] (ffs_data_closed [usb_f_fs]) from [<bf547da0>] (ffs_fs_kill_sb+0x2c/0x30 [usb_f_fs]) [ 1946.636217] r7:c0dfcb84 r6:c3a12260 r5:bf54d014 r4:c229f000 [ 1946.646273] [<bf547d74>] (ffs_fs_kill_sb [usb_f_fs]) from [<c0326d50>] (deactivate_locked_super+0x54/0x9c) [ 1946.664893] r5:bf54d014 r4:c229f000 [ 1946.672921] [<c0326cfc>] (deactivate_locked_super) from [<c0326df8>] (deactivate_super+0x60/0x64) [ 1946.690722] r5:c2a09000 r4:c229f000 [ 1946.698706] [<c0326d98>] (deactivate_super) from [<c0349a28>] (cleanup_mnt+0xe4/0x14c) [ 1946.715553] r5:c2a09000 r4:00000000 [ 1946.723528] [<c0349944>] (cleanup_mnt) from [<c0349b08>] (__cleanup_mnt+0x1c/0x20) [ 1946.739922] r7:c0dfcb84 r6:c3a12260 r5:c3a126fc r4:00000000 [ 1946.750088] [<c0349aec>] (__cleanup_mnt) from [<c0143d10>] (task_work_run+0x84/0xb8) [ 1946.766602] [<c0143c8c>] (task_work_run) from [<c010bdc8>] (do_work_pending+0x470/0x56c) [ 1946.783540] r7:5ac3c35a r6:c0d0424c r5:c200bfb0 r4:c200a000 [ 1946.793614] [<c010b958>] (do_work_pending) from [<c01000c0>] (slow_work_pending+0xc/0x20) [ 1946.810553] Exception stack(0xc200bfb0 to 0xc200bff8) [ 1946.820129] bfa0: 00000000 00000000 000000aa b5e21430 [ 1946.837104] bfc0: bef867a0 00000001 bef86840 00000034 bef86838 bef86790 bef86794 bef867a0 [ 1946.854125] bfe0: 00000000 bef86798 b67b7a1c b6d626a4 60000010 b5a23760 [ 1946.865335] r10:00000000 r9:c200a000 r8:c0100224 r7:00000034 r6:bef86840 r5:00000001 [ 1946.881914] r4:bef867a0 [ 1946.888793] ---[ end trace 7387f2a9725b28d0 ]--- Fixes: 5e33f6fdf735 ("usb: gadget: ffs: add eventfd notification about ffs events") Cc: stable <stable@vger.kernel.org> Signed-off-by: Vincent Pelletier <plr.vincent@gmail.com> Link: https://lore.kernel.org/r/f79eeea29f3f98de6782a064ec0f7351ad2f598f.1639793920.git.plr.vincent@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-20igb: fix deadlock caused by taking RTNL in RPM resume pathHeiner Kallweit
Recent net core changes caused an issue with few Intel drivers (reportedly igb), where taking RTNL in RPM resume path results in a deadlock. See [0] for a bug report. I don't think the core changes are wrong, but taking RTNL in RPM resume path isn't needed. The Intel drivers are the only ones doing this. See [1] for a discussion on the issue. Following patch changes the RPM resume path to not take RTNL. [0] https://bugzilla.kernel.org/show_bug.cgi?id=215129 [1] https://lore.kernel.org/netdev/20211125074949.5f897431@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com/t/ Fixes: bd869245a3dc ("net: core: try to runtime-resume detached device in __dev_open") Fixes: f32a21376573 ("ethtool: runtime-resume netdev parent before ethtool ioctl ops") Tested-by: Martin Stolpe <martin.stolpe@gmail.com> Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://lore.kernel.org/r/20211220201844.2714498-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-12-20gve: Correct order of processing device optionsJeroen de Borst
The legacy raw addressing device option was processed before the new RDA queue format option. This caused the supported features mask, which is provided only on the RDA queue format option, not to be set. This disabled jumbo-frame support when using raw adressing. Fixes: 255489f5b33c ("gve: Add a jumbo-frame device option") Signed-off-by: Jeroen de Borst <jeroendb@google.com> Link: https://lore.kernel.org/r/20211220192746.2900594-1-jeroendb@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-12-20Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdmaLinus Torvalds
Pull rdma fixes from Jason Gunthorpe: "Last fixes before holidays. Nothing very exciting: - Work around a HW bug in HNS HIP08 - Recent memory leak regression in qib - Incorrect use of kfree() for vmalloc memory in hns" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/hns: Replace kfree() with kvfree() IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() RDMA/hns: Fix RNR retransmission issue for HIP08
2021-12-20soc: qcom: rpmh-rsc: Fix typo in a commentJason Wang
The double `for' in the comment in line 694 is repeated. Remove one of them from the comment. Signed-off-by: Jason Wang <wangborong@cdjrlc.com> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Link: https://lore.kernel.org/r/20211211090626.248801-1-wangborong@cdjrlc.com
2021-12-20soc: qcom: socinfo: Add SM6350 and SM7225Luca Weiss
Both SoCs are known as 'lagoon' downstream. Add their ids to the socinfo driver. Signed-off-by: Luca Weiss <luca.weiss@fairphone.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@somainline.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Link: https://lore.kernel.org/r/20211213081111.20217-1-luca.weiss@fairphone.com
2021-12-20soc: qcom: rpmhpd: Sort power-domain definitions and listsRajendra Nayak
Sort all power-domain defines and the SoC specific lists in alphabetical order for better readability. No functional changes. Signed-off-by: Rajendra Nayak <quic_rjendra@quicinc.com> Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Link: https://lore.kernel.org/r/1639063917-9011-5-git-send-email-quic_rjendra@quicinc.com
2021-12-20soc: qcom: rpmhpd: Remove mx/cx relationship on sc7280Rajendra Nayak
The requirement to specify the active + sleep and active-only MX power-domains as the parents of the corresponding CX power domains is not applicable on sc7280. Fix it by using the cx/cx_ao structs for sc7280 instead of the _w_mx_parent ones. Signed-off-by: Rajendra Nayak <quic_rjendra@quicinc.com> Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Link: https://lore.kernel.org/r/1639063917-9011-4-git-send-email-quic_rjendra@quicinc.com
2021-12-20soc: qcom: rpmhpd: Rename rpmhpd struct namesRajendra Nayak
The rpmhpd structs were named with a SoC-name prefix, but then they got reused across multiple SoC families making things confusing. Rename all the struct names to remove SoC-name prefixes. While we do this we end up with some power-domains without parents, and some with and at times different parents across SoCs. use a _w_<parent-name>_parent suffix for such cases. No functional change as part of this patch. Signed-off-by: Rajendra Nayak <quic_rjendra@quicinc.com> Reviewed-by: Matthias Kaehlcke <mka@chromium.org> Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org> Reviewed-by: Stephen Boyd <swboyd@chromium.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Link: https://lore.kernel.org/r/1639063917-9011-3-git-send-email-quic_rjendra@quicinc.com
2021-12-20soc: qcom: rpmhpd: sm8450: Add the missing .peer for sm8450_cx_aoRajendra Nayak
sm8450_cx and sm8450_cx_ao should be peers of each other, add the missing .peer entry for sm8450_cx_ao Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Cc: Vinod Koul <vkoul@kernel.org> Signed-off-by: Rajendra Nayak <quic_rjendra@quicinc.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Link: https://lore.kernel.org/r/1639063917-9011-2-git-send-email-quic_rjendra@quicinc.com
2021-12-20soc: qcom: socinfo: add SM8450 IDDmitry Baryshkov
Add the ID for the Qualcomm SM8450 SoC. Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Vinod Koul <vkoul@kernel.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Link: https://lore.kernel.org/r/20211201072745.3969077-8-vkoul@kernel.org
2021-12-20soc: qcom: rpmhpd: Add SM8450 power domainsDmitry Baryshkov
Add the power domains exposed by RPMH in the Qualcomm SM8450 platform. Unlike previous generations CX domain is not a child of MX domain. Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Vinod Koul <vkoul@kernel.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Link: https://lore.kernel.org/r/20211201072745.3969077-7-vkoul@kernel.org
2021-12-20soc: qcom: smem: Update max processor countDmitry Baryshkov
Update max processor count to reflect the number of co-processors on SM8450 SoCs. Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Vinod Koul <vkoul@kernel.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Link: https://lore.kernel.org/r/20211201072745.3969077-5-vkoul@kernel.org
2021-12-20soc: qcom: rpmpd: Add support for sm6125Martin Botka
Add RPM power domains located in Qualcomm SM6125 SoC. Signed-off-by: Martin Botka <martin.botka@somainline.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Link: https://lore.kernel.org/r/20211130212332.25401-2-martin.botka@somainline.org
2021-12-20soc: qcom: aoss: constify static struct thermal_cooling_device_opsRikard Falkeborn
The only usage of qmp_cooling_device_ops is to pass its address to devm_thermal_of_cooling_device_register() which takes a pointer to const struct thermal_cooling_device_ops as argument. Make it const to allow the compiler to put it in read-only memory. Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Link: https://lore.kernel.org/r/20211128210317.25504-1-rikard.falkeborn@gmail.com
2021-12-20PM: AVS: qcom-cpr: Use div64_ul instead of do_divChangcheng Deng
do_div() does a 64-by-32 division. Here the divisor is an unsigned long which on some platforms is 64 bit wide. So use div64_ul instead of do_div to avoid a possible truncation. Reported-by: Zeal Robot <zealci@zte.com.cn> Signed-off-by: Changcheng Deng <deng.changcheng@zte.com.cn> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Link: https://lore.kernel.org/r/20211125014311.45942-1-deng.changcheng@zte.com.cn
2021-12-20soc: qcom: llcc: Add configuration data for SM8350Konrad Dybcio
Add LLCC configuration data for SM8350 SoC. Signed-off-by: Konrad Dybcio <konrad.dybcio@somainline.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Link: https://lore.kernel.org/r/20211121002050.36977-2-konrad.dybcio@somainline.org
2021-12-20soc: qcom: stats: Add fixed sleep stats offset for older RPM firmwaresStephan Gerhold
Not all RPM firmware versions have the dynamic sleep stats offset available. Most older versions use a fixed offset of 0xdba0. Add support for this using new SoC-specific compatibles for APQ8084, MSM8226, MSM8916 and MSM8974. Even older SoCs seem to use a different offset and stats format. If needed those could be supported in the future by adding separate compatibles for those with a different stats_config. Cc: Maulik Shah <mkshah@codeaurora.org> Signed-off-by: Stephan Gerhold <stephan@gerhold.net> Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Link: https://lore.kernel.org/r/20211119213953.31970-3-stephan@gerhold.net
2021-12-20drm/i915/guc: Flag an error if an engine reset failsJohn Harrison
If GuC encounters an error during engine reset, the i915 driver promotes to full GT reset. This includes an info message about why the reset is happening. However, that is not treated as a failure by any of the CI systems because resets are an expected occurrance during testing. This kind of failure is a major problem and should never happen. So, complain more loudly and make sure CI notices. Signed-off-by: John Harrison <John.C.Harrison@Intel.com> Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20211211065859.2248188-4-John.C.Harrison@Intel.com
2021-12-20drm/i915/guc: Increase GuC log size for CONFIG_DEBUG_GEMJohn Harrison
Lots of testing is done with the DEBUG_GEM config option enabled but not the DEBUG_GUC option. That means we only get teeny-tiny GuC logs which are not hugely useful. Enabling full DEBUG_GUC also spews lots of other detailed output that is not generally desired. However, bigger GuC logs are extremely useful for almost any regression debug. So enable bigger logs for DEBUG_GEM builds as well. Signed-off-by: John Harrison <John.C.Harrison@Intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20211211065859.2248188-3-John.C.Harrison@Intel.com
2021-12-20drm/i915/guc: Speed up GuC log dumpsJohn Harrison
Add support for telling the debugfs interface the size of the GuC log dump in advance. Without that, the underlying framework keeps calling the 'show' function with larger and larger buffer allocations until it fits. That means reading the log from graphics memory many times - 16 times with the full 18MB log size. v2: Don't return error codes from size query. Report overflow in the error dump as well (review feedback from Daniele). Signed-off-by: John Harrison <John.C.Harrison@Intel.com> Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20211211065859.2248188-2-John.C.Harrison@Intel.com
2021-12-20drm/etnaviv: limit submit sizesLucas Stach
Currently we allow rediculous amounts of kernel memory being allocated via the etnaviv GEM_SUBMIT ioctl, which is a pretty easy DoS vector. Put some reasonable limits in to fix this. The commandstream size is limited to 64KB, which was already a soft limit on older kernels after which the kernel only took submits on a best effort base, so there is no userspace that tries to submit commandstreams larger than this. Even if the whole commandstream is a single incrementing address load, the size limit also limits the number of potential relocs and referenced buffers to slightly under 64K, so use the same limit for those arguments. The performance monitoring infrastructure currently supports less than 50 performance counter signals, so limiting them to 128 on a single submit seems like a reasonably future-proof number for now. This number can be bumped if needed without breaking the interface. Cc: stable@vger.kernel.org Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Lucas Stach <l.stach@pengutronix.de> Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
2021-12-20Merge tag 'spi-fix-v5.16-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fix from Mark Brown: "One small fix for a long standing issue with error handling on probe in the Armada driver" * tag 'spi-fix-v5.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: change clk_disable_unprepare to clk_unprepare
2021-12-20Merge branch 'xsa' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tipLinus Torvalds
Merge xen fixes from Juergen Gross: "Fixes for two issues related to Xen and malicious guests: - Guest can force the netback driver to hog large amounts of memory - Denial of Service in other guests due to event storms" * 'xsa' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/netback: don't queue unlimited number of packages xen/netback: fix rx queue stall detection xen/console: harden hvc_xen against event channel storms xen/netfront: harden netfront against event channel storms xen/blkfront: harden blkfront against event channel storms
2021-12-20drm/i915: Ensure i915_vma tests do not get -ENOSPC with the locking changes.Maarten Lankhorst
Now that we require locking to evict, multiple vmas from the same object might not be evicted. This is expected and required, because execbuf will move to short-term pinning by using the lock only. This will cause these tests to fail, because they create a ton of vma's for the same object. Unbind manually to prevent spurious -ENOSPC in those mock tests. Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20211216142749.1966107-8-maarten.lankhorst@linux.intel.com
2021-12-20drm/i915: Ensure gem_contexts selftests work with unbind changes, v2.Maarten Lankhorst
In the next commits, we may not evict when refcount = 0. igt_vm_isolation() continuously tries to pin/unpin at same address, but also calls put() on the object, which means the object may not be unpinned in time. Instead of this, re-use the same object over and over, so they can be unbound as required. Changes since v1: - Fix cleaning up obj_b on failure. (Matt) Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20211216142749.1966107-7-maarten.lankhorst@linux.intel.com
2021-12-20drm/i915: Force ww lock for i915_gem_object_ggtt_pin_ww, v2.Maarten Lankhorst
We will need the lock to unbind the vma, and wait for bind to complete. Remove the special casing for the !ww path, and force ww locking for all. Changes since v1: - Pass err to for_i915_gem_ww handling for -EDEADLK handling. Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20211216142749.1966107-6-maarten.lankhorst@linux.intel.com
2021-12-20drm/i915: Take object lock in i915_ggtt_pin if ww is not setMaarten Lankhorst
i915_vma_wait_for_bind needs the vma lock held, fix the caller. Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20211216142749.1966107-5-maarten.lankhorst@linux.intel.com
2021-12-20Merge tag 'samsung-soc-5.17' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into arm/soc Samsung mach/soc changes for v5.17 1. Minor fixes for S3C platforms. 2. Remove HAVE_S3C2410_I2C Kconfig symbol - not really useful. * tag 'samsung-soc-5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: ARM: samsung: Remove HAVE_S3C2410_I2C and use direct dependencies ARM: s3c: add one more "fallthrough" statement in Jive ARM: s3c: include header for prototype of s3c2410_modify_misccr Link: https://lore.kernel.org/r/20211220115530.30961-3-krzysztof.kozlowski@canonical.com Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2021-12-20drm/i915: Remove pages_mutex and intel_gtt->vma_ops.set/clear_pages members, v3.Maarten Lankhorst
Big delta, but boils down to moving set_pages to i915_vma.c, and removing the special handling, all callers use the defaults anyway. We only remap in ggtt, so default case will fall through. Because we still don't require locking in i915_vma_unpin(), handle this by using xchg in get_pages(), as it's locked with obj->mutex, and cmpxchg in unpin, which only fails if we race a against a new pin. Changes since v1: - aliasing gtt sets ZERO_SIZE_PTR, not -ENODEV, remove special case from __i915_vma_get_pages(). (Matt) Changes since v2: - Free correct old pages in __i915_vma_get_pages(). (Matt) Remove race of clearing vma->pages accidentally from put, free it but leave it set, as only get has the lock. Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20211216142749.1966107-4-maarten.lankhorst@linux.intel.com Reviewed-by: Matthew Auld <matthew.auld@intel.com>
2021-12-20drm/i915: Change shrink ordering to use locking around unbinding.Maarten Lankhorst
Call drop_pages with the gem object lock held, instead of the other way around. This will allow us to drop the vma bindings with the gem object lock held. We plan to require the object lock for unpinning in the future, and this is an easy target. Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reviewed-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20211216142749.1966107-3-maarten.lankhorst@linux.intel.com
2021-12-20drm/i915: Remove unused bits of i915_vma/active apiMaarten Lankhorst
When reworking the code to move the eviction fence to the object, the best code is removed code. Remove some functions that are unused, and change the function definition if it's only used in 1 place. Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reviewed-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com> [mlankhorst: Remove new use of i915_active_has_exclusive] Link: https://patchwork.freedesktop.org/patch/msgid/20211216142749.1966107-2-maarten.lankhorst@linux.intel.com
2021-12-20Merge tag 'samsung-drivers-5.17' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into arm/drivers Samsung SoC drivers changes for v5.17 1. Exynos ChipID: add Exynos7885 support. 2. Exynos PMU: add Exynos850 support. 3. Minor bindings cleanup. 4. Add Exynos USIv2 (Universal Serial Interface) driver. The USI block is a shared IP block between I2C, UART/serial and SPI. Basically one has to choose which feature the USI block will support and later the regular I2C/serial/SPI driver will bind and work. This merges also one commit with dt-binding headers from my dts64 pull request. Together with a future serial driver change, this will break the ABI. Affected: Serial on ExynosAutov9 SADK and out-of-tree ExynosAutov9 boards Why: To properly and efficiently support the USI with new hierarchy of USI-{serial,SPI,I2C} devicetree nodes. Rationale: Recently added serial and USI support was short-sighted and did not allow to smooth support of other features (SPI and I2C). Adding support for USI-SPI and USI-I2C would effect in code duplication. Adding support for different USI versions (currently supported is USIv2 but support for v1 is planned) would cause even more code duplication and create a solution difficult to maintain. Since USI-serial and ExynosAutov9 have been added recently, are considered fresh development features and there are no supported products using them, the code/solution is being refactored in non-backwards compatible way. The compatibility is not broken yet. It will be when serial driver changes are accepted. The ABI break was discussed with only known users of ExynosAutov9 and received their permission. * tag 'samsung-drivers-5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: dt-bindings: soc: samsung: keep SoC driver bindings together soc: samsung: Add USI driver dt-bindings: soc: samsung: Add Exynos USI bindings soc: samsung: exynos-pmu: Add Exynos850 support dt-bindings: samsung: pmu: Document Exynos850 soc: samsung: exynos-chipid: add Exynos7885 SoC support soc: samsung: exynos-chipid: describe which SoCs go with compatibles Link: https://lore.kernel.org/r/20211220115405.30434-2-krzysztof.kozlowski@canonical.com Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2021-12-20Merge tag 'imx-drivers-5.17' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/drivers i.MX drivers update for 5.17: - A number of patches from Adam Ford to update gpcv2 and blk-ctrl driver to keep i.MX8MM VPU-H1 and i.MX8MN GPUMIX bus clocks active, and add i.MX8MN display related domain support. - Add optional continuous burst clock support for imx-weim bus driver. - Call pm_runtime_put_sync_suspend() instead of pm_runtime_put() in gpcv2 driver to prevent a sequence issue seen with i.MX8MM GPU and MIX domain. * tag 'imx-drivers-5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: soc: imx: imx8m-blk-ctrl: add i.MX8MN DISP blk-ctrl dt-bindings: power: imx8mn: add defines for DISP blk-ctrl domains soc: imx: gpcv2: Add dispmix and mipi domains to imx8mn soc: imx: gpcv2: keep i.MX8MN gpumix bus clock enabled bus: imx-weim: optionally enable continuous burst clock soc: imx: gpcv2: keep i.MX8MM VPU-H1 bus clock active soc: imx: gpcv2: Synchronously suspend MIX domains Link: https://lore.kernel.org/r/20211218071427.26745-1-shawnguo@kernel.org Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2021-12-20Merge tag 'tegra-for-5.17-soc' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/drivers soc/tegra: Changes for v5.17-rc1 This set of changes contains some preparatory work that is shared by several branches and trees to support DVFS via power domains. There's also a bit of cleanup and improvements to reboot on chips that use PSCI. * tag 'tegra-for-5.17-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: soc/tegra: pmc: Rename core power domain soc/tegra: pmc: Rename 3d power domains soc/tegra: regulators: Prepare for suspend soc/tegra: fuse: Use resource-managed helpers soc/tegra: fuse: Reset hardware soc/tegra: pmc: Add reboot notifier soc/tegra: Don't print error message when OPPs not available Link: https://lore.kernel.org/r/20211217162253.1801077-1-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2021-12-20reset: starfive-jh7100: Fix 32bit compilationEmil Renner Berthing
We need to include linux/io-64-nonatomic-lo-hi.h or readq/writeq won't be defined when compiling on 32bit architectures: On i386: ../drivers/reset/reset-starfive-jh7100.c: In function ‘jh7100_reset_update’: ../drivers/reset/reset-starfive-jh7100.c:81:10: error: implicit declaration of function ‘readq’; did you mean ‘readl’? [-Werror=implicit-function-declaration] value = readq(reg_assert); ^~~~~ ../drivers/reset/reset-starfive-jh7100.c:86:2: error: implicit declaration of function ‘writeq’; did you mean ‘writel’? [-Werror=implicit-function-declaration] writeq(value, reg_assert); ^~~~~~ On m68k: drivers/reset/reset-starfive-jh7100.c:81:17: error: implicit declaration of function 'readq'; did you mean 'readb'? [-Werror=implicit-function-declaration] drivers/reset/reset-starfive-jh7100.c:86:9: error: implicit declaration of function 'writeq'; did you mean 'writel'? [-Werror=implicit-function-declaration] cc1: all warnings being treated as errors make[3]: *** [scripts/Makefile.build:289: drivers/reset/reset-starfive-jh7100.o] Error 1 make[2]: *** [scripts/Makefile.build:572: drivers/reset] Error 2 make[1]: *** [Makefile:1969: drivers] Error 2 make: *** [Makefile:226: __sub-make] Error 2 Fixes: 0be3a1595bf8 ("reset: starfive-jh7100: Add StarFive JH7100 reset driver") Reported-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Emil Renner Berthing <kernel@esmil.dk> Link: https://lore.kernel.org/r/20211220121800.760846-1-kernel@esmil.dk' Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2021-12-20drm/i915/guc: Only assign guc_id.id when stealing guc_idMatthew Brost
Previously assigned whole guc_id structure (list, spin lock) which is incorrect, only assign the guc_id.id. Fixes: 0f7976506de61 ("drm/i915/guc: Rework and simplify locking") Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: John Harrison <John.C.Harrison@Intel.com> Signed-off-by: John Harrison <John.C.Harrison@Intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20211214170500.28569-3-matthew.brost@intel.com (cherry picked from commit 939d8e9c87e704fd5437e2c8b80929591fe540eb) Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2021-12-20drm/i915/guc: Use correct context lock when callig clr_context_registeredMatthew Brost
s/ce/cn/ when grabbing guc_state.lock before calling clr_context_registered. Fixes: 0f7976506de61 ("drm/i915/guc: Rework and simplify locking") Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Signed-off-by: John Harrison <John.C.Harrison@Intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20211214170500.28569-2-matthew.brost@intel.com (cherry picked from commit b25db8c782ad7ae80d4cea2a09c222f4f8980bb9) Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2021-12-20Merge tag 'tegra-for-5.17-drivers' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/drivers drivers: Changes for v5.17-rc1 This is an assortment of driver patches that rely on some of the changes in the for-5.17/soc branch. These have all been acked by the respective maintainers and go through the Tegra tree to more easily handle the build dependency. * tag 'tegra-for-5.17-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: media: staging: tegra-vde: Support generic power domain spi: tegra20-slink: Add OPP support mtd: rawnand: tegra: Add runtime PM and OPP support mmc: sdhci-tegra: Add runtime PM and OPP support pwm: tegra: Add runtime PM and OPP support bus: tegra-gmi: Add runtime PM and OPP support usb: chipidea: tegra: Add runtime PM and OPP support soc/tegra: Add devm_tegra_core_dev_init_opp_table_common() soc/tegra: Enable runtime PM during OPP state-syncing Link: https://lore.kernel.org/r/20211217162253.1801077-2-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2021-12-20Merge tag 'ti-driver-soc-fixes-for-v5.17' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into arm/drivers SoC: Keystone driver update for v5.17 * k3-socinfo: Add entry for J721S2 SoC family * Misc fixups for tisci, pruss, knav_dma * tag 'ti-driver-soc-fixes-for-v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: soc: ti: knav_dma: Fix NULL vs IS_ERR() checking in dma_init soc: ti: k3-socinfo: Add entry for J721S2 SoC family firmware: ti_sci: rm: remove unneeded semicolon soc: ti: pruss: fix referenced node in error message Link: https://lore.kernel.org/r/20211217154921.cagzppcensxx6wm4@pension Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2021-12-20Merge tag 'imx-fixes-5.16-3' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 5.16, round 3: - Fix imx6qdl-wandboard Ethernet support by adding 'qca,clk-out-frequency' property. - Fix scl-gpios property typo in LX2160A device tree. * tag 'imx-fixes-5.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: lx2160a: fix scl-gpios property name ARM: dts: imx6qdl-wandboard: Fix Ethernet support soc: imx: Register SoC device only on i.MX boards soc: imx: imx8m-blk-ctrl: Fix imx8mm mipi reset ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name arm64: dts: imx8mq: remove interconnect property from lcdif arm64: dts: ten64: remove redundant interrupt declaration for gpio-keys arm64: dts: lx2160abluebox3: update RGMII delays for sja1105 switch ARM: dts: ls1021a-tsn: update RGMII delays for sja1105 switch ARM: dts: imx6qp-prtwd3: update RGMII delays for sja1105 switch Link: https://lore.kernel.org/r/20211218052003.GA25102@dragon Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2021-12-20HID: potential dereference of null pointerJiasheng Jiang
The return value of devm_kzalloc() needs to be checked. To avoid hdev->dev->driver_data to be null in case of the failure of alloc. Fixes: 14c9c014babe ("HID: add vivaldi HID driver") Cc: stable@vger.kernel.org Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20211215083605.117638-1-jiasheng@iscas.ac.cn
2021-12-20HID: holtek: fix mouse probingBenjamin Tissoires
An overlook from the previous commit: we don't even parse or start the device, meaning that the device is not presented to user space. Fixes: 93020953d0fa ("HID: check for valid USB device for many HID drivers") Cc: stable@vger.kernel.org Link: https://bugs.archlinux.org/task/73048 Link: https://bugzilla.kernel.org/show_bug.cgi?id=215341 Link: https://lore.kernel.org/r/e4efbf13-bd8d-0370-629b-6c80c0044b15@leemhuis.info/ Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
2021-12-20mmc: meson-mx-sdhc: Set MANUAL_STOP for multi-block SDIO commandsMartin Blumenstingl
The vendor driver implements special handling for multi-block SD_IO_RW_EXTENDED (and SD_IO_RW_DIRECT) commands which have data attached to them. It sets the MANUAL_STOP bit in the MESON_SDHC_MISC register for these commands. In all other cases this bit is cleared. Here we omit SD_IO_RW_DIRECT since that command never has any data attached to it. This fixes SDIO wifi using the brcmfmac driver which reported the following error without this change on a Netxeon S82 board using a Meson8 (S802) SoC: brcmf_fw_alloc_request: using brcm/brcmfmac43362-sdio for chip BCM43362/1 brcmf_sdiod_ramrw: membytes transfer failed brcmf_sdio_download_code_file: error -110 on writing 219557 membytes at 0x00000000 brcmf_sdio_download_firmware: dongle image file download failed And with this change: brcmf_fw_alloc_request: using brcm/brcmfmac43362-sdio for chip BCM43362/1 brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available brcmf_c_preinit_dcmds: Firmware: BCM43362/1 wl0: Apr 22 2013 14:50:00 version 5.90.195.89.6 FWID 01-b30a427d Fixes: e4bf1b0970ef96 ("mmc: host: meson-mx-sdhc: new driver for the Amlogic Meson SDHC host") Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20211219153442.463863-2-martin.blumenstingl@googlemail.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2021-12-20mmc: core: Disable card detect during shutdownUlf Hansson
It's seems prone to problems by allowing card detect and its corresponding mmc_rescan() work to run, during platform shutdown. For example, we may end up turning off the power while initializing a card, which potentially could damage it. To avoid this scenario, let's add ->shutdown_pre() callback for the mmc host class device and then turn of the card detect from there. Reported-by: Al Cooper <alcooperx@gmail.com> Suggested-by: Adrian Hunter <adrian.hunter@intel.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20211203141555.105351-1-ulf.hansson@linaro.org