v2 -> v3:
- Rephrase "Write to VIDC_CTRL_INIT after unmasking interrupts" commit msg
- Drop "Remap bufreq fields on HFI6XX"
- Rephrase "Introduce VPU version distinction" commit msg
- Better explain "Leave a clue for homegrown porters"
- Drop incorrect fixes tags/rephrase version check alternations
- Drop AR50L/IRIS1 from if-conditions, they'll be introduced separately
- pick up tags
- rebase on next-20230517 (no effective changes)
v2: https://lore.kernel.org/r/20230228-topic-venus-v2-0-d95d14949c79@linaro.org
v1 -> v2:
- Move "Write to VIDC_CTRL_INIT after unmasking interrupts" up and add
a Fixes tag & Cc stable
- Reword the comment in "Correct IS_V6() checks"
- Move up "media: venus: Remap bufreq fields on HFI6XX", add Fixes and
Cc stable
- Use better English in "Use newly-introduced hfi_buffer_requirements
accessors" commit message
- Mention "Restrict writing SCIACMDARG3 to Venus V1/V2" doesn't seem to
regress SM8250 in the commit message
- Pick up tags (note: I capitalized the R in Dikshita's 'reviewed-by'
and removed one occurrence of random '**' to make sure review tools
like b4 don't go crazy)
- Handle AR50_LITE in "Assign registers based on VPU version"
- Drop /* VPUn */ comments, they're invalid as explained by Vikash
- Take a different approach to the sys_idle problem in patch 1
v1: https://lore.kernel.org/r/20230228-topic-venus-v1-0-58c2c88384e9@linaro.org
Currently upstream assumes all (well, almost all - see 7280 or CrOS
specific checks) Venus implementations using the same version of the
Hardware Firmware Interface can be treated the same way. This is
however not the case.
This series tries to introduce the groundwork to start differentiating
them based on the VPU (Video Processing Unit) hardware type, fixes a
couple of issues that were an effect of that generalized assumption
and lays the foundation for supporting 8150 (IRIS1) and SM6115/QCM2290
(AR50 Lite), which will hopefully come soon.
Tested on 8250, but pretty please test it on your boards too!
Signed-off-by: Konrad Dybcio <konrad.dybcio(a)linaro.org>
---
Konrad Dybcio (17):
media: venus: hfi_venus: Only consider sys_idle_indicator on V1
media: venus: hfi_venus: Write to VIDC_CTRL_INIT after unmasking interrupts
media: venus: Introduce VPU version distinction
media: venus: Add vpu_version to most SoCs
media: venus: firmware: Leave a clue about obtaining CP VARs
media: venus: hfi_venus: Sanitize venus_boot_core() per-VPU-version
media: venus: core: Assign registers based on VPU version
media: venus: hfi_venus: Sanitize venus_halt_axi() per-VPU-version
media: venus: hfi_venus: Sanitize venus_isr() per-VPU-version
media: venus: hfi_venus: Sanitize venus_cpu_and_video_core_idle() per-VPU-version
media: venus: hfi_venus: Sanitize venus_cpu_idle_and_pc_ready() per-VPU-version
media: venus: firmware: Correct IS_V6() checks
media: venus: hfi_platform: Check vpu_version instead of device compatible
media: venus: vdec: Sanitize vdec_set_work_route() per-VPU-version
media: venus: Introduce accessors for remapped hfi_buffer_reqs members
media: venus: Use newly-introduced hfi_buffer_requirements accessors
media: venus: hfi_venus: Restrict writing SCIACMDARG3 to Venus V1/V2
drivers/media/platform/qcom/venus/core.c | 7 ++-
drivers/media/platform/qcom/venus/core.h | 15 ++++++
drivers/media/platform/qcom/venus/firmware.c | 22 ++++++--
drivers/media/platform/qcom/venus/helpers.c | 7 +--
drivers/media/platform/qcom/venus/hfi_helper.h | 61 +++++++++++++++++++---
drivers/media/platform/qcom/venus/hfi_msgs.c | 2 +-
.../media/platform/qcom/venus/hfi_plat_bufs_v6.c | 22 ++++----
drivers/media/platform/qcom/venus/hfi_platform.c | 2 +-
drivers/media/platform/qcom/venus/hfi_venus.c | 45 ++++++++--------
drivers/media/platform/qcom/venus/vdec.c | 10 ++--
drivers/media/platform/qcom/venus/vdec_ctrls.c | 2 +-
drivers/media/platform/qcom/venus/venc.c | 4 +-
drivers/media/platform/qcom/venus/venc_ctrls.c | 2 +-
13 files changed, 139 insertions(+), 62 deletions(-)
---
base-commit: 065efa589871e93b6610c70c1e9de274ef1f1ba2
change-id: 20230228-topic-venus-70ea3bc76688
Best regards,
--
Konrad Dybcio <konrad.dybcio(a)linaro.org>
The patch titled
Subject: nilfs2: fix possible out-of-bounds segment allocation in resize ioctl
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
nilfs2-fix-possible-out-of-bounds-segment-allocation-in-resize-ioctl.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Subject: nilfs2: fix possible out-of-bounds segment allocation in resize ioctl
Date: Wed, 24 May 2023 18:43:48 +0900
Syzbot reports that in its stress test for resize ioctl, the log writing
function nilfs_segctor_do_construct hits a WARN_ON in
nilfs_segctor_truncate_segments().
It turned out that there is a problem with the current implementation of
the resize ioctl, which changes the writable range on the device (the
range of allocatable segments) at the end of the resize process.
This order is necessary for file system expansion to avoid corrupting the
superblock at trailing edge. However, in the case of a file system
shrink, if log writes occur after truncating out-of-bounds trailing
segments and before the resize is complete, segments may be allocated from
the truncated space.
The userspace resize tool was fine as it limits the range of allocatable
segments before performing the resize, but it can run into this issue if
the resize ioctl is called alone.
Fix this issue by changing nilfs_sufile_resize() to update the range of
allocatable segments immediately after successful truncation of segment
space in case of file system shrink.
Link: https://lkml.kernel.org/r/20230524094348.3784-1-konishi.ryusuke@gmail.com
Fixes: 4e33f9eab07e ("nilfs2: implement resize ioctl")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Reported-by: syzbot+33494cd0df2ec2931851(a)syzkaller.appspotmail.com
Closes: https://lkml.kernel.org/r/0000000000005434c405fbbafdc5@google.com
Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/nilfs2/sufile.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/fs/nilfs2/sufile.c~nilfs2-fix-possible-out-of-bounds-segment-allocation-in-resize-ioctl
+++ a/fs/nilfs2/sufile.c
@@ -779,6 +779,15 @@ int nilfs_sufile_resize(struct inode *su
goto out_header;
sui->ncleansegs -= nsegs - newnsegs;
+
+ /*
+ * If the sufile is successfully truncated, immediately adjust
+ * the segment allocation space while locking the semaphore
+ * "mi_sem" so that nilfs_sufile_alloc() never allocates
+ * segments in the truncated space.
+ */
+ sui->allocmax = newnsegs - 1;
+ sui->allocmin = 0;
}
kaddr = kmap_atomic(header_bh->b_page);
_
Patches currently in -mm which might be from konishi.ryusuke(a)gmail.com are
nilfs2-fix-incomplete-buffer-cleanup-in-nilfs_btnode_abort_change_key.patch
nilfs2-fix-possible-out-of-bounds-segment-allocation-in-resize-ioctl.patch