September 2024 - Linux-stable-mirror

[PATCH 10/23] drm/amd/display: Clean up dsc blocks in accelerated mode

by Alex Hung

From: Martin Tsai <martin.tsai(a)amd.com> [WHY] DSC on eDP could be enabled during VBIOS post. The enabled DSC may not be disabled when enter to OS, once the system was in second screen only mode before entering to S4. In this case, OS will not send setTimings to reset eDP path again. The enabled DSC HW will make a new stream without DSC cannot output normally if it reused this pipe with enabled DSC. [HOW] In accelerated mode, to clean up DSC blocks if eDP is on link but not active when we are not in fast boot and seamless boot. Cc: Mario Limonciello <mario.limonciello(a)amd.com> Cc: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Reviewed-by: Charlene Liu <charlene.liu(a)amd.com> Signed-off-by: Martin Tsai <martin.tsai(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> --- .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 50 +++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c index d52ce58c6a98..aa7479b31898 100644 --- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c @@ -57,6 +57,7 @@ #include "panel_cntl.h" #include "dc_state_priv.h" #include "dpcd_defs.h" +#include "dsc.h" /* include DCE11 register header files */ #include "dce/dce_11_0_d.h" #include "dce/dce_11_0_sh_mask.h" @@ -1823,6 +1824,48 @@ static void get_edp_links_with_sink( } } +static void clean_up_dsc_blocks(struct dc *dc) +{ + struct display_stream_compressor *dsc = NULL; + struct timing_generator *tg = NULL; + struct stream_encoder *se = NULL; + struct dccg *dccg = dc->res_pool->dccg; + struct pg_cntl *pg_cntl = dc->res_pool->pg_cntl; + int i; + + if (dc->ctx->dce_version != DCN_VERSION_3_5 && + dc->ctx->dce_version != DCN_VERSION_3_51) + return; + + for (i = 0; i < dc->res_pool->res_cap->num_dsc; i++) { + struct dcn_dsc_state s = {0}; + + dsc = dc->res_pool->dscs[i]; + dsc->funcs->dsc_read_state(dsc, &s); + if (s.dsc_fw_en) { + /* disable DSC in OPTC */ + if (i < dc->res_pool->timing_generator_count) { + tg = dc->res_pool->timing_generators[i]; + tg->funcs->set_dsc_config(tg, OPTC_DSC_DISABLED, 0, 0); + } + /* disable DSC in stream encoder */ + if (i < dc->res_pool->stream_enc_count) { + se = dc->res_pool->stream_enc[i]; + se->funcs->dp_set_dsc_config(se, OPTC_DSC_DISABLED, 0, 0); + se->funcs->dp_set_dsc_pps_info_packet(se, false, NULL, true); + } + /* disable DSC block */ + if (dccg->funcs->set_ref_dscclk) + dccg->funcs->set_ref_dscclk(dccg, dsc->inst); + dsc->funcs->dsc_disable(dsc); + + /* power down DSC */ + if (pg_cntl != NULL) + pg_cntl->funcs->dsc_pg_control(pg_cntl, dsc->inst, false); + } + } +} + /* * When ASIC goes from VBIOS/VGA mode to driver/accelerated mode we need: * 1. Power down all DC HW blocks @@ -1927,6 +1970,13 @@ void dce110_enable_accelerated_mode(struct dc *dc, struct dc_state *context) clk_mgr_exit_optimized_pwr_state(dc, dc->clk_mgr); power_down_all_hw_blocks(dc); + + /* DSC could be enabled on eDP during VBIOS post. + * To clean up dsc blocks if eDP is in link but not active. + */ + if (edp_link_with_sink && (edp_stream_num == 0)) + clean_up_dsc_blocks(dc); + disable_vga_and_power_gate_all_controllers(dc); if (edp_link_with_sink && !keep_edp_vdd_on) dc->hwss.edp_power_control(edp_link_with_sink, false); -- 2.34.1

8 months

1
0
0 0

[PATCH 09/23] drm/amd/display: Block dynamic IPS2 on DCN35 for incompatible FW versions

by Alex Hung

From: Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com> [WHY] Hangs with Z8 can occur if running an older unfixed PMFW version. [HOW] Fallback to RCG only for dynamic IPS2 states if it's not newer than 93.12. Limit to DCN35. Cc: Mario Limonciello <mario.limonciello(a)amd.com> Cc: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Reviewed-by: Charlene Liu <charlene.liu(a)amd.com> Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> --- .../gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c index 97164b5585a8..b46a3afe48ca 100644 --- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c +++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c @@ -1222,6 +1222,12 @@ void dcn35_clk_mgr_construct( ctx->dc->debug.disable_dpp_power_gate = false; ctx->dc->debug.disable_hubp_power_gate = false; ctx->dc->debug.disable_dsc_power_gate = false; + + /* Disable dynamic IPS2 in older PMFW (93.12) for Z8 interop. */ + if (ctx->dc->config.disable_ips == DMUB_IPS_ENABLE && + ctx->dce_version == DCN_VERSION_3_5 && + ((clk_mgr->base.smu_ver & 0x00FFFFFF) <= 0x005d0c00)) + ctx->dc->config.disable_ips = DMUB_IPS_RCG_IN_ACTIVE_IPS2_IN_OFF; } else { /*let's reset the config control flag*/ ctx->dc->config.disable_ips = DMUB_IPS_DISABLE_ALL; /*pmfw not support it, disable it all*/ -- 2.34.1

8 months

1
0
0 0

[PATCH 07/23] drm/amd/display: Block timing sync for different output formats in pmo

by Alex Hung

From: Dillon Varone <dillon.varone(a)amd.com> [WHY & HOW] If the output format is different for HDMI TMDS signals, they are not synchronizable. Cc: Mario Limonciello <mario.limonciello(a)amd.com> Cc: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Reviewed-by: Alvin Lee <alvin.lee2(a)amd.com> Signed-off-by: Dillon Varone <dillon.varone(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> --- .../dc/dml2/dml21/src/dml2_pmo/dml2_pmo_dcn4_fams2.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_pmo/dml2_pmo_dcn4_fams2.c b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_pmo/dml2_pmo_dcn4_fams2.c index d63558ee3135..1cf9015e854a 100644 --- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_pmo/dml2_pmo_dcn4_fams2.c +++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_pmo/dml2_pmo_dcn4_fams2.c @@ -940,9 +940,11 @@ static void build_synchronized_timing_groups( /* find synchronizable timing groups */ for (j = i + 1; j < display_config->display_config.num_streams; j++) { if (memcmp(master_timing, - &display_config->display_config.stream_descriptors[j].timing, - sizeof(struct dml2_timing_cfg)) == 0 && - display_config->display_config.stream_descriptors[i].output.output_encoder == display_config->display_config.stream_descriptors[j].output.output_encoder) { + &display_config->display_config.stream_descriptors[j].timing, + sizeof(struct dml2_timing_cfg)) == 0 && + display_config->display_config.stream_descriptors[i].output.output_encoder == display_config->display_config.stream_descriptors[j].output.output_encoder && + (display_config->display_config.stream_descriptors[i].output.output_encoder != dml2_hdmi || //hdmi requires formats match + display_config->display_config.stream_descriptors[i].output.output_format == display_config->display_config.stream_descriptors[j].output.output_format)) { set_bit_in_bitfield(&pmo->scratch.pmo_dcn4.synchronized_timing_group_masks[timing_group_idx], j); set_bit_in_bitfield(&stream_mapped_mask, j); } -- 2.34.1

8 months

1
0
0 0

[PATCH 06/23] drm/amd/display: Enable DML2 override_det_buffer_size_kbytes

by Alex Hung

From: Yihan Zhu <Yihan.Zhu(a)amd.com> [WHY] Corrupted screen will be observed when 4k144 DP/HDMI display and 4k144 eDP are connected, changing eDP refresh rate from 60Hz to 144Hz. [HOW] override_det_buffer_size_kbytes should be true for DCN35/DCN351. Cc: Mario Limonciello <mario.limonciello(a)amd.com> Cc: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Reviewed-by: Roman Li <roman.li(a)amd.com> Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com> Signed-off-by: Yihan Zhu <Yihan.Zhu(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> --- drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c | 1 + drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c | 1 + 2 files changed, 2 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c index 46ad684fe192..893a9d9ee870 100644 --- a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c +++ b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c @@ -2155,6 +2155,7 @@ static bool dcn35_resource_construct( dc->dml2_options.max_segments_per_hubp = 24; dc->dml2_options.det_segment_size = DCN3_2_DET_SEG_SIZE;/*todo*/ + dc->dml2_options.override_det_buffer_size_kbytes = true; if (dc->config.sdpif_request_limit_words_per_umc == 0) dc->config.sdpif_request_limit_words_per_umc = 16;/*todo*/ diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c index 4c5e722baa3a..514c6d56925d 100644 --- a/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c +++ b/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c @@ -2133,6 +2133,7 @@ static bool dcn351_resource_construct( dc->dml2_options.max_segments_per_hubp = 24; dc->dml2_options.det_segment_size = DCN3_2_DET_SEG_SIZE;/*todo*/ + dc->dml2_options.override_det_buffer_size_kbytes = true; if (dc->config.sdpif_request_limit_words_per_umc == 0) dc->config.sdpif_request_limit_words_per_umc = 16;/*todo*/ -- 2.34.1

8 months

1
0
0 0

[PATCH 02/23] drm/amd/display: Use SDR white level to calculate matrix coefficients

by Alex Hung

From: Samson Tam <Samson.Tam(a)amd.com> [WHY] Certain profiles have higher HDR multiplier than SDR white level max which is not currently supported. [HOW] Use SDR white level when calculating matrix coefficients for HDR RGB MPO path instead of HDR multiplier. Cc: Mario Limonciello <mario.limonciello(a)amd.com> Cc: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Reviewed-by: Jun Lei <jun.lei(a)amd.com> Signed-off-by: Samson Tam <Samson.Tam(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 12 ++++++++++++ drivers/gpu/drm/amd/display/dc/dc.h | 3 +++ .../gpu/drm/amd/display/dc/dc_spl_translate.c | 9 +-------- drivers/gpu/drm/amd/display/dc/spl/dc_spl.c | 17 +++++++++++------ .../gpu/drm/amd/display/dc/spl/dc_spl_types.h | 2 +- 5 files changed, 28 insertions(+), 15 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index ae788154896c..243928b0a39f 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -2596,6 +2596,12 @@ static enum surface_update_type det_surface_update(const struct dc *dc, elevate_update_type(&overall_type, UPDATE_TYPE_MED); } + if (u->sdr_white_level_nits) + if (u->sdr_white_level_nits != u->surface->sdr_white_level_nits) { + update_flags->bits.sdr_white_level_nits = 1; + elevate_update_type(&overall_type, UPDATE_TYPE_FULL); + } + if (u->cm2_params) { if ((u->cm2_params->component_settings.shaper_3dlut_setting != u->surface->mcm_shaper_3dlut_setting) @@ -2876,6 +2882,10 @@ static void copy_surface_update_to_plane( surface->hdr_mult = srf_update->hdr_mult; + if (srf_update->sdr_white_level_nits) + surface->sdr_white_level_nits = + srf_update->sdr_white_level_nits; + if (srf_update->blend_tf) memcpy(&surface->blend_tf, srf_update->blend_tf, sizeof(surface->blend_tf)); @@ -4679,6 +4689,8 @@ static bool full_update_required(struct dc *dc, srf_updates[i].scaling_info || (srf_updates[i].hdr_mult.value && srf_updates[i].hdr_mult.value != srf_updates->surface->hdr_mult.value) || + (srf_updates[i].sdr_white_level_nits && + srf_updates[i].sdr_white_level_nits != srf_updates->surface->sdr_white_level_nits) || srf_updates[i].in_transfer_func || srf_updates[i].func_shaper || srf_updates[i].lut3d_func || diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h index 4c94dd38be4b..dcf8a90e961d 100644 --- a/drivers/gpu/drm/amd/display/dc/dc.h +++ b/drivers/gpu/drm/amd/display/dc/dc.h @@ -1269,6 +1269,7 @@ union surface_update_flags { uint32_t tmz_changed:1; uint32_t mcm_transfer_function_enable_change:1; /* disable or enable MCM transfer func */ uint32_t full_update:1; + uint32_t sdr_white_level_nits:1; } bits; uint32_t raw; @@ -1351,6 +1352,7 @@ struct dc_plane_state { bool adaptive_sharpness_en; int sharpness_level; enum linear_light_scaling linear_light_scaling; + unsigned int sdr_white_level_nits; }; struct dc_plane_info { @@ -1508,6 +1510,7 @@ struct dc_surface_update { */ struct dc_cm2_parameters *cm2_params; const struct dc_csc_transform *cursor_csc_color_matrix; + unsigned int sdr_white_level_nits; }; /* diff --git a/drivers/gpu/drm/amd/display/dc/dc_spl_translate.c b/drivers/gpu/drm/amd/display/dc/dc_spl_translate.c index cd6de93eb91c..f711fc2e3e65 100644 --- a/drivers/gpu/drm/amd/display/dc/dc_spl_translate.c +++ b/drivers/gpu/drm/amd/display/dc/dc_spl_translate.c @@ -191,14 +191,7 @@ void translate_SPL_in_params_from_pipe_ctx(struct pipe_ctx *pipe_ctx, struct spl */ spl_in->is_fullscreen = dm_helpers_is_fullscreen(pipe_ctx->stream->ctx, pipe_ctx->stream); spl_in->is_hdr_on = dm_helpers_is_hdr_on(pipe_ctx->stream->ctx, pipe_ctx->stream); - spl_in->hdr_multx100 = 0; - if (spl_in->is_hdr_on) { - spl_in->hdr_multx100 = (uint32_t)dc_fixpt_floor(dc_fixpt_mul(plane_state->hdr_mult, - dc_fixpt_from_int(100))); - /* Disable sharpness for HDR Mult > 6.0 */ - if (spl_in->hdr_multx100 > 600) - spl_in->adaptive_sharpness.enable = false; - } + spl_in->sdr_white_level_nits = plane_state->sdr_white_level_nits; } /// @brief Translate SPL output parameters to pipe context diff --git a/drivers/gpu/drm/amd/display/dc/spl/dc_spl.c b/drivers/gpu/drm/amd/display/dc/spl/dc_spl.c index 15f7eda903e6..a59aa6b59687 100644 --- a/drivers/gpu/drm/amd/display/dc/spl/dc_spl.c +++ b/drivers/gpu/drm/amd/display/dc/spl/dc_spl.c @@ -1155,14 +1155,19 @@ static void spl_set_dscl_prog_data(struct spl_in *spl_in, struct spl_scratch *sp } /* Calculate C0-C3 coefficients based on HDR_mult */ -static void spl_calculate_c0_c3_hdr(struct dscl_prog_data *dscl_prog_data, uint32_t hdr_multx100) +static void spl_calculate_c0_c3_hdr(struct dscl_prog_data *dscl_prog_data, uint32_t sdr_white_level_nits) { struct spl_fixed31_32 hdr_mult, c0_mult, c1_mult, c2_mult; struct spl_fixed31_32 c0_calc, c1_calc, c2_calc; struct spl_custom_float_format fmt; + uint32_t hdr_multx100_int; - SPL_ASSERT(hdr_multx100); - hdr_mult = spl_fixpt_from_fraction((long long)hdr_multx100, 100LL); + if ((sdr_white_level_nits >= 80) && (sdr_white_level_nits <= 480)) + hdr_multx100_int = sdr_white_level_nits * 100 / 80; + else + hdr_multx100_int = 100; /* default for 80 nits otherwise */ + + hdr_mult = spl_fixpt_from_fraction((long long)hdr_multx100_int, 100LL); c0_mult = spl_fixpt_from_fraction(2126LL, 10000LL); c1_mult = spl_fixpt_from_fraction(7152LL, 10000LL); c2_mult = spl_fixpt_from_fraction(722LL, 10000LL); @@ -1191,7 +1196,7 @@ static void spl_calculate_c0_c3_hdr(struct dscl_prog_data *dscl_prog_data, uint3 static void spl_set_easf_data(struct spl_scratch *spl_scratch, struct spl_out *spl_out, bool enable_easf_v, bool enable_easf_h, enum linear_light_scaling lls_pref, enum spl_pixel_format format, enum system_setup setup, - uint32_t hdr_multx100) + uint32_t sdr_white_level_nits) { struct dscl_prog_data *dscl_prog_data = spl_out->dscl_prog_data; if (enable_easf_v) { @@ -1499,7 +1504,7 @@ static void spl_set_easf_data(struct spl_scratch *spl_scratch, struct spl_out *s dscl_prog_data->easf_ltonl_en = 1; // Linear input if ((setup == HDR_L) && (spl_is_rgb8(format))) { /* Calculate C0-C3 coefficients based on HDR multiplier */ - spl_calculate_c0_c3_hdr(dscl_prog_data, hdr_multx100); + spl_calculate_c0_c3_hdr(dscl_prog_data, sdr_white_level_nits); } else { // HDR_L ( DWM ) and SDR_L dscl_prog_data->easf_matrix_c0 = 0x4EF7; // fp1.5.10, C0 coefficient (LN_rec709: 0.2126 * (2^14)/125 = 27.86590720) @@ -1750,7 +1755,7 @@ bool spl_calculate_scaler_params(struct spl_in *spl_in, struct spl_out *spl_out) // Set EASF spl_set_easf_data(&spl_scratch, spl_out, enable_easf_v, enable_easf_h, spl_in->lls_pref, - spl_in->basic_in.format, setup, spl_in->hdr_multx100); + spl_in->basic_in.format, setup, spl_in->sdr_white_level_nits); // Set iSHARP vratio = spl_fixpt_ceil(spl_scratch.scl_data.ratios.vert); diff --git a/drivers/gpu/drm/amd/display/dc/spl/dc_spl_types.h b/drivers/gpu/drm/amd/display/dc/spl/dc_spl_types.h index 85b19ebe2c57..74f2a8c42f4f 100644 --- a/drivers/gpu/drm/amd/display/dc/spl/dc_spl_types.h +++ b/drivers/gpu/drm/amd/display/dc/spl/dc_spl_types.h @@ -518,7 +518,7 @@ struct spl_in { bool is_hdr_on; int h_active; int v_active; - int hdr_multx100; + int sdr_white_level_nits; }; // end of SPL inputs -- 2.34.1

8 months

1
0
0 0

[PATCH 01/23] drm/amd/display: Round calculated vtotal

by Alex Hung

From: Robin Chen <robin.chen(a)amd.com> [WHY] The calculated vtotal may has 1 line deviation. To get precisely vtotal number, round the vtotal result. Cc: Mario Limonciello <mario.limonciello(a)amd.com> Cc: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Reviewed-by: Anthony Koo <anthony.koo(a)amd.com> Signed-off-by: Robin Chen <robin.chen(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> --- drivers/gpu/drm/amd/display/modules/freesync/freesync.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c index a40e6590215a..bbd259cea4f4 100644 --- a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c +++ b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c @@ -134,7 +134,7 @@ unsigned int mod_freesync_calc_v_total_from_refresh( v_total = div64_u64(div64_u64(((unsigned long long)( frame_duration_in_ns) * (stream->timing.pix_clk_100hz / 10)), - stream->timing.h_total), 1000000); + stream->timing.h_total) + 500000, 1000000); /* v_total cannot be less than nominal */ if (v_total < stream->timing.v_total) { -- 2.34.1

8 months

1
0
0 0

[PATCH v3] i2c: aspeed: Update the stop sw state when the bus recovery occurs

by Tommy Huang

When the i2c bus recovery occurs, driver will send i2c stop command in the scl low condition. In this case the sw state will still keep original situation. Under multi-master usage, i2c bus recovery will be called when i2c transfer timeout occurs. Update the stop command calling with aspeed_i2c_do_stop function to update master_state. Fixes: f327c686d3ba ("i2c: aspeed: added driver for Aspeed I2C") Cc: <stable(a)vger.kernel.org> # v4.13+ Signed-off-by: Tommy Huang <tommy_huang(a)aspeedtech.com> --- drivers/i2c/busses/i2c-aspeed.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/i2c/busses/i2c-aspeed.c b/drivers/i2c/busses/i2c-aspeed.c index ce8c4846b7fa..2a03a221e2dd 100644 --- a/drivers/i2c/busses/i2c-aspeed.c +++ b/drivers/i2c/busses/i2c-aspeed.c @@ -170,6 +170,13 @@ struct aspeed_i2c_bus { static int aspeed_i2c_reset(struct aspeed_i2c_bus *bus); +/* precondition: bus.lock has been acquired. */ +static void aspeed_i2c_do_stop(struct aspeed_i2c_bus *bus) +{ + bus->master_state = ASPEED_I2C_MASTER_STOP; + writel(ASPEED_I2CD_M_STOP_CMD, bus->base + ASPEED_I2C_CMD_REG); +} + static int aspeed_i2c_recover_bus(struct aspeed_i2c_bus *bus) { unsigned long time_left, flags; @@ -187,7 +194,7 @@ static int aspeed_i2c_recover_bus(struct aspeed_i2c_bus *bus) command); reinit_completion(&bus->cmd_complete); - writel(ASPEED_I2CD_M_STOP_CMD, bus->base + ASPEED_I2C_CMD_REG); + aspeed_i2c_do_stop(bus); spin_unlock_irqrestore(&bus->lock, flags); time_left = wait_for_completion_timeout( @@ -390,13 +397,6 @@ static void aspeed_i2c_do_start(struct aspeed_i2c_bus *bus) writel(command, bus->base + ASPEED_I2C_CMD_REG); } -/* precondition: bus.lock has been acquired. */ -static void aspeed_i2c_do_stop(struct aspeed_i2c_bus *bus) -{ - bus->master_state = ASPEED_I2C_MASTER_STOP; - writel(ASPEED_I2CD_M_STOP_CMD, bus->base + ASPEED_I2C_CMD_REG); -} - /* precondition: bus.lock has been acquired. */ static void aspeed_i2c_next_msg_or_stop(struct aspeed_i2c_bus *bus) { -- 2.25.1

8 months

2
2
0 0

[PATCH v2 1/4] drm/xe/client: fix deadlock in show_meminfo()

by Matthew Auld

There is a real deadlock as well as sleeping in atomic() bug in here, if the bo put happens to be the last ref, since bo destruction wants to grab the same spinlock and sleeping locks. Fix that by dropping the ref using xe_bo_put_deferred(), and moving the final commit outside of the lock. Dropping the lock around the put is tricky since the bo can go out of scope and delete itself from the list, making it difficult to navigate to the next list entry. Fixes: 0845233388f8 ("drm/xe: Implement fdinfo memory stats printing") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2727 Signed-off-by: Matthew Auld <matthew.auld(a)intel.com> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray(a)intel.com> Cc: Tejas Upadhyay <tejas.upadhyay(a)intel.com> Cc: "Thomas Hellström" <thomas.hellstrom(a)linux.intel.com> Cc: <stable(a)vger.kernel.org> # v6.8+ Reviewed-by: Matthew Brost <matthew.brost(a)intel.com> Reviewed-by: Tejas Upadhyay <tejas.upadhyay(a)intel.com> --- drivers/gpu/drm/xe/xe_drm_client.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/xe/xe_drm_client.c b/drivers/gpu/drm/xe/xe_drm_client.c index e64f4b645e2e..badfa045ead8 100644 --- a/drivers/gpu/drm/xe/xe_drm_client.c +++ b/drivers/gpu/drm/xe/xe_drm_client.c @@ -196,6 +196,7 @@ static void show_meminfo(struct drm_printer *p, struct drm_file *file) struct xe_drm_client *client; struct drm_gem_object *obj; struct xe_bo *bo; + LLIST_HEAD(deferred); unsigned int id; u32 mem_type; @@ -215,11 +216,14 @@ static void show_meminfo(struct drm_printer *p, struct drm_file *file) list_for_each_entry(bo, &client->bos_list, client_link) { if (!kref_get_unless_zero(&bo->ttm.base.refcount)) continue; + bo_meminfo(bo, stats); - xe_bo_put(bo); + xe_bo_put_deferred(bo, &deferred); } spin_unlock(&client->bos_lock); + xe_bo_put_commit(&deferred); + for (mem_type = XE_PL_SYSTEM; mem_type < TTM_NUM_MEM_TYPES; ++mem_type) { if (!xe_mem_type_to_name[mem_type]) continue; -- 2.46.0

8 months

1
1
0 0

[PATCH 5.4 000/121] 5.4.284-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.4.284 release. There are 121 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 12 Sep 2024 09:25:22 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.284-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.4.284-rc1 Zhang Changzhong <zhangchangzhong(a)huawei.com> cx82310_eth: fix error return code in cx82310_bind() Daniel Borkmann <daniel(a)iogearbox.net> net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket Roland Xu <mu001999(a)outlook.com> rtmutex: Drop rt_mutex::wait_lock before scheduling Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> drm/i915/fence: Mark debug_fence_free() with __maybe_unused Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused Maurizio Lombardi <mlombard(a)redhat.com> nvmet-tcp: fix kernel crash if commands allocation fails Jonathan Cameron <Jonathan.Cameron(a)huawei.com> arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry James Morse <james.morse(a)arm.com> arm64: acpi: Move get_cpu_for_acpi_id() to a header Jonathan Cameron <Jonathan.Cameron(a)huawei.com> ACPI: processor: Fix memory leaks in error paths of processor_add() Jonathan Cameron <Jonathan.Cameron(a)huawei.com> ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add() Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: protect references to superblock parameters exposed in sysfs Qing Wang <wangqing(a)vivo.com> nilfs2: replace snprintf in show functions with sysfs_emit Zheng Yejian <zhengyejian(a)huaweicloud.com> tracing: Avoid possible softlockup in tracing_iter_reset() Steven Rostedt (VMware) <rostedt(a)goodmis.org> ring-buffer: Rename ring_buffer_read() to read_buffer_iter_advance() Sven Schnelle <svens(a)linux.ibm.com> uprobes: Use kzalloc to allocate xol area Daniel Lezcano <daniel.lezcano(a)linaro.org> clocksource/drivers/timer-of: Remove percpu irq related code Jacky Bai <ping.bai(a)nxp.com> clocksource/drivers/imx-tpm: Fix next event not taking effect sometime Jacky Bai <ping.bai(a)nxp.com> clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> VMCI: Fix use-after-free when removing resource in vmci_resource_remove() Naman Jain <namjain(a)linux.microsoft.com> Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic Saurabh Sengar <ssengar(a)linux.microsoft.com> uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind Geert Uytterhoeven <geert+renesas(a)glider.be> nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc Carlos Llamas <cmllamas(a)google.com> binder: fix UAF caused by offsets overwrite Guillaume Stols <gstols(a)baylibre.com> iio: adc: ad7606: remove frstdata check for serial mode Matteo Martelli <matteomartelli3(a)gmail.com> iio: fix scale application in iio_convert_raw_to_processed_unlocked David Lechner <dlechner(a)baylibre.com> iio: buffer-dmaengine: fix releasing dma channel on error Aleksandr Mishin <amishin(a)t-argos.ru> staging: iio: frequency: ad9834: Validate frequency parameter value Trond Myklebust <trond.myklebust(a)hammerspace.com> NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations Michael Ellerman <mpe(a)ellerman.id.au> ata: pata_macio: Use WARN instead of BUG Kent Overstreet <kent.overstreet(a)linux.dev> lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() Stefan Wiehler <stefan.wiehler(a)nokia.com> of/irq: Prevent device address out-of-bounds read in interrupt map walk Phillip Lougher <phillip(a)squashfs.org.uk> Squashfs: sanity check symbolic link size Oliver Neukum <oneukum(a)suse.com> usbnet: ipheth: race between ipheth_close and error handling Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Input: uinput - reject requests with unreasonable number of slots Camila Alvarez <cam.alvarez.i(a)gmail.com> HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup David Sterba <dsterba(a)suse.com> btrfs: initialize location to fix -Wmaybe-uninitialized in btrfs_lookup_dentry() Dan Williams <dan.j.williams(a)intel.com> PCI: Add missing bridge lock to pci_bus_lock() Josef Bacik <josef(a)toxicpanda.com> btrfs: clean up our handling of refs == 0 in snapshot delete Josef Bacik <josef(a)toxicpanda.com> btrfs: replace BUG_ON with ASSERT in walk_down_proc() Zqiang <qiang.zhang1211(a)gmail.com> smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu() Sascha Hauer <s.hauer(a)pengutronix.de> wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() Andreas Ziegler <ziegler.andreas(a)siemens.com> libbpf: Add NULL checks to bpf_object__{prev_map,next_map} Guenter Roeck <linux(a)roeck-us.net> hwmon: (w83627ehf) Fix underflows seen when writing limit attributes Guenter Roeck <linux(a)roeck-us.net> hwmon: (nct6775-core) Fix underflows seen when writing limit attributes Guenter Roeck <linux(a)roeck-us.net> hwmon: (lm95234) Fix underflows seen when writing limit attributes Guenter Roeck <linux(a)roeck-us.net> hwmon: (adc128d818) Fix underflows seen when writing limit attributes Krishna Kumar <krishnak(a)linux.ibm.com> pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv Zijun Hu <quic_zijuhu(a)quicinc.com> devres: Initialize an uninitialized struct member Johannes Berg <johannes.berg(a)intel.com> um: line: always fill *error_out in setup_one_line() Waiman Long <longman(a)redhat.com> cgroup: Protect css->cgroup write under css_set_lock Jacob Pan <jacob.jun.pan(a)linux.intel.com> iommu/vt-d: Handle volatile descriptor status read Benjamin Marzinski <bmarzins(a)redhat.com> dm init: Handle minors larger than 255 Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> ASoC: topology: Properly initialize soc_enum values Pawel Dembicki <paweldembicki(a)gmail.com> net: dsa: vsc73xx: fix possible subblocks range of CAPT block Jonas Gorski <jonas.gorski(a)bisdn.de> net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com> net: bridge: fdb: convert added_by_external_learn to use bitops Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com> net: bridge: fdb: convert added_by_user to bitops Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com> net: bridge: fdb: convert is_sticky to bitops Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com> net: bridge: fdb: convert is_static to bitops Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com> net: bridge: fdb: convert is_local to bitops Oliver Neukum <oneukum(a)suse.com> usbnet: modern method to get random MAC Jakub Kicinski <kuba(a)kernel.org> net: usb: don't write directly to netdev->dev_addr Len Baker <len.baker(a)gmx.com> drivers/net/usb: Remove all strcpy() uses Ondrej Zary <linux(a)zary.sk> cx82310_eth: re-enable ethernet mode after router reboot Cong Wang <cong.wang(a)bytedance.com> tcp_bpf: fix return value of tcp_bpf_sendmsg() Aleksandr Mishin <amishin(a)t-argos.ru> platform/x86: dell-smbios: Fix error path in dell_smbios_init() Daiwei Li <daiweili(a)google.com> igb: Fix not clearing TimeSync interrupts for 82580 Kuniyuki Iwashima <kuniyu(a)amazon.com> can: bcm: Remove proc entry when dev is unregistered. Jules Irenge <jbi.octave(a)gmail.com> pcmcia: Use resource_size function on resource object Chen Ni <nichen(a)iscas.ac.cn> media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse Kishon Vijay Abraham I <kishon(a)ti.com> PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0) Shantanu Goel <sgoel01(a)yahoo.com> usb: uas: set host status byte on data completion error Arend van Spriel <arend.vanspriel(a)broadcom.com> wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3 Jan Kara <jack(a)suse.cz> udf: Avoid excessive partition lengths Yunjian Wang <wangyunjian(a)huawei.com> netfilter: nf_conncount: fix wrong variable type Kuniyuki Iwashima <kuniyu(a)amazon.com> af_unix: Remove put_pid()/put_cred() in copy_peercred(). Pali Rohár <pali(a)kernel.org> irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1 Konstantin Andreev <andreev(a)swemel.ru> smack: unix sockets: fix accept()ed socket label Takashi Iwai <tiwai(a)suse.de> ALSA: hda: Add input value sanity checks to HDMI channel map controls Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix state management in error path of log writing function Ryusuke Konishi <konishi.ryusuke(a)gmail.com> nilfs2: fix missing cleanup on rollforward recovery error Toke Høiland-Jørgensen <toke(a)redhat.com> sched: sch_cake: fix bulk flow accounting logic for host fairness Eric Dumazet <edumazet(a)google.com> ila: call nf_unregister_net_hooks() sooner Satya Priya Kakitapalli <quic_skakitap(a)quicinc.com> clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API Satya Priya Kakitapalli <quic_skakitap(a)quicinc.com> clk: qcom: clk-alpha-pll: Fix the pll post div mask Peter Griffin <peter.griffin(a)linaro.org> clk: hi6220: use CLK_OF_DECLARE_DRIVER Peter Griffin <peter.griffin(a)linaro.org> reset: hi6220: Add support for AO reset controller Jann Horn <jannh(a)google.com> fuse: use unsigned type for getxattr/listxattr size truncation Joanne Koong <joannelkoong(a)gmail.com> fuse: update stats for pages in dropped aux writeback list Liao Chen <liaochen4(a)huawei.com> mmc: sdhci-of-aspeed: fix module autoloading Sam Protsenko <semen.protsenko(a)linaro.org> mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K Ma Ke <make24(a)iscas.ac.cn> irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init() Zheng Qixing <zhengqixing(a)huawei.com> ata: libata: Fix memory leak for error path in ata_host_alloc() Christoffer Sandberg <cs(a)tuxedo.de> ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices robelin <robelin(a)nvidia.com> ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object Stephen Hemminger <stephen(a)networkplumber.org> sch/netem: fix use after free in netem_dequeue Richard Fitzgerald <rf(a)opensource.cirrus.com> i2c: Use IS_REACHABLE() for substituting empty ACPI functions Jan Kara <jack(a)suse.cz> udf: Limit file size to 4TB Breno Leitao <leitao(a)debian.org> virtio_net: Fix napi_skb_cache_put warning Stanislav Fomichev <sdf(a)google.com> net: set SOCK_RCU_FREE before inserting socket into hashtable Christoph Hellwig <hch(a)lst.de> block: initialize integrity buffer to zero before writing it to media Ricardo Ribalda <ribalda(a)chromium.org> media: uvcvideo: Enforce alignment of frame and interval Alex Hung <alex.hung(a)amd.com> drm/amd/display: Skip wbscl_set_scaler_filter if filter is null Johannes Berg <johannes.berg(a)intel.com> wifi: cfg80211: make hash table duplicates more survivable Casey Schaufler <casey(a)schaufler-ca.com> smack: tcp: ipv4, fix incorrect labeling Abhishek Pandit-Subedi <abhishekpandit(a)chromium.org> usb: typec: ucsi: Fix null pointer dereference in trace Simon Holesch <simon(a)holesch.de> usbip: Don't submit special requests twice Shannon Nelson <shannon.nelson(a)amd.com> ionic: fix potential irq name truncation Leesoo Ahn <lsahn(a)ooseel.net> apparmor: fix possible NULL pointer dereference Michael Chen <michael.chen(a)amd.com> drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device Tim Huang <Tim.Huang(a)amd.com> drm/amdgpu: fix mc_data out-of-bounds read warning Tim Huang <Tim.Huang(a)amd.com> drm/amdgpu: fix ucode out-of-bounds read warning Hersen Wu <hersenxs.wu(a)amd.com> drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create Alex Hung <alex.hung(a)amd.com> drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] Hersen Wu <hersenxs.wu(a)amd.com> drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 Alex Hung <alex.hung(a)amd.com> drm/amd/display: Check gpio_id before used as array index Tim Huang <Tim.Huang(a)amd.com> drm/amdgpu: fix overflowed array index read warning Ma Jun <Jun.Ma2(a)amd.com> drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr ZHANG Yuntian <yt(a)radxa.com> net: usb: qmi_wwan: add MeiG Smart SRM825L Richard Fitzgerald <rf(a)opensource.cirrus.com> i2c: Fix conditional for substituting empty ACPI functions Philip Mueller <philm(a)manjaro.org> drm: panel-orientation-quirks: Add quirk for OrangePi Neo ------------- Diffstat: Makefile | 4 +- arch/arm64/include/asm/acpi.h | 12 +++ arch/arm64/kernel/acpi_numa.c | 11 -- arch/um/drivers/line.c | 2 + block/bio-integrity.c | 11 +- drivers/acpi/acpi_processor.c | 15 +-- drivers/android/binder.c | 1 + drivers/ata/libata-core.c | 4 +- drivers/ata/pata_macio.c | 7 +- drivers/base/devres.c | 1 + drivers/clk/hisilicon/clk-hi6220.c | 3 +- drivers/clk/qcom/clk-alpha-pll.c | 6 +- drivers/clocksource/timer-imx-tpm.c | 16 ++- drivers/clocksource/timer-of.c | 17 +-- drivers/clocksource/timer-of.h | 1 - drivers/gpu/drm/amd/amdgpu/amdgpu_afmt.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_crat.h | 2 - drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.h | 5 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 +- .../drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 3 +- .../gpu/drm/amd/display/dc/dcn20/dcn20_dwb_scl.c | 3 + drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c | 17 ++- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++ drivers/gpu/drm/i915/i915_sw_fence.c | 8 +- drivers/hid/hid-cougar.c | 2 +- drivers/hv/vmbus_drv.c | 1 + drivers/hwmon/adc128d818.c | 4 +- drivers/hwmon/lm95234.c | 9 +- drivers/hwmon/nct6775.c | 2 +- drivers/hwmon/w83627ehf.c | 4 +- drivers/iio/adc/ad7606.c | 28 +---- drivers/iio/adc/ad7606.h | 2 + drivers/iio/adc/ad7606_par.c | 46 +++++++- drivers/iio/buffer/industrialio-buffer-dmaengine.c | 4 +- drivers/iio/inkern.c | 8 +- drivers/input/misc/uinput.c | 14 +++ drivers/iommu/dmar.c | 2 +- drivers/irqchip/irq-armada-370-xp.c | 4 + drivers/irqchip/irq-gic-v2m.c | 6 +- drivers/md/dm-init.c | 4 +- drivers/media/platform/qcom/camss/camss.c | 5 +- drivers/media/usb/uvc/uvc_driver.c | 18 +++- drivers/misc/vmw_vmci/vmci_resource.c | 3 +- drivers/mmc/host/dw_mmc.c | 4 +- drivers/mmc/host/sdhci-of-aspeed.c | 1 + drivers/net/dsa/vitesse-vsc73xx-core.c | 10 +- drivers/net/ethernet/intel/igb/igb_main.c | 10 ++ drivers/net/ethernet/pensando/ionic/ionic_lif.c | 2 +- drivers/net/usb/ch9200.c | 4 +- drivers/net/usb/cx82310_eth.c | 56 ++++++++-- drivers/net/usb/ipheth.c | 4 +- drivers/net/usb/kaweth.c | 3 +- drivers/net/usb/mcs7830.c | 4 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/usb/sierra_net.c | 6 +- drivers/net/usb/sr9700.c | 4 +- drivers/net/usb/sr9800.c | 5 +- drivers/net/usb/usbnet.c | 23 ++-- drivers/net/virtio_net.c | 8 +- .../broadcom/brcm80211/brcmsmac/mac80211_if.c | 1 + drivers/net/wireless/marvell/mwifiex/main.h | 3 + drivers/nvme/target/tcp.c | 4 +- drivers/nvmem/core.c | 6 +- drivers/of/irq.c | 15 ++- drivers/pci/controller/dwc/pci-keystone.c | 44 +++++++- drivers/pci/hotplug/pnv_php.c | 3 +- drivers/pci/pci.c | 35 +++--- drivers/pcmcia/yenta_socket.c | 6 +- drivers/platform/x86/dell-smbios-base.c | 5 +- drivers/reset/hisilicon/hi6220_reset.c | 69 +++++++++++- drivers/staging/iio/frequency/ad9834.c | 2 +- drivers/uio/uio_hv_generic.c | 11 +- drivers/usb/storage/uas.c | 1 + drivers/usb/typec/ucsi/ucsi.h | 2 +- drivers/usb/usbip/stub_rx.c | 77 +++++++++----- fs/btrfs/extent-tree.c | 32 ++++-- fs/btrfs/inode.c | 2 +- fs/fuse/file.c | 8 +- fs/fuse/xattr.c | 4 +- fs/nfs/super.c | 2 + fs/nilfs2/recovery.c | 35 +++++- fs/nilfs2/segment.c | 10 +- fs/nilfs2/sysfs.c | 117 ++++++++++++--------- fs/squashfs/inode.c | 7 +- fs/udf/super.c | 24 ++++- include/linux/i2c.h | 2 +- include/linux/ring_buffer.h | 3 +- kernel/cgroup/cgroup.c | 2 +- kernel/events/uprobes.c | 3 +- kernel/locking/rtmutex.c | 4 +- kernel/smp.c | 1 + kernel/trace/ring_buffer.c | 23 ++-- kernel/trace/trace.c | 6 +- kernel/trace/trace_functions_graph.c | 2 +- lib/generic-radix-tree.c | 2 + net/bridge/br_fdb.c | 116 ++++++++++---------- net/bridge/br_input.c | 2 +- net/bridge/br_private.h | 17 +-- net/bridge/br_switchdev.c | 6 +- net/can/bcm.c | 4 + net/ipv4/inet_hashtables.c | 2 +- net/ipv4/tcp_bpf.c | 2 +- net/ipv6/ila/ila.h | 1 + net/ipv6/ila/ila_main.c | 6 ++ net/ipv6/ila/ila_xlat.c | 13 ++- net/netfilter/nf_conncount.c | 8 +- net/sched/sch_cake.c | 11 +- net/sched/sch_netem.c | 9 +- net/sunrpc/xprtsock.c | 7 ++ net/unix/af_unix.c | 9 +- net/wireless/scan.c | 46 +++++--- security/apparmor/apparmorfs.c | 4 + security/smack/smack_lsm.c | 14 ++- sound/hda/hdmi_chmap.c | 18 ++++ sound/pci/hda/patch_conexant.c | 11 ++ sound/soc/soc-dapm.c | 1 + sound/soc/soc-topology.c | 2 + tools/lib/bpf/libbpf.c | 4 +- 122 files changed, 946 insertions(+), 423 deletions(-)

8 months

6
127
0 0

[PATCH v6 1/6] x86/tdx: Fix "in-kernel MMIO" check

by Alexey Gladkov

From: "Alexey Gladkov (Intel)" <legion(a)kernel.org> TDX only supports kernel-initiated MMIO operations. The handle_mmio() function checks if the #VE exception occurred in the kernel and rejects the operation if it did not. However, userspace can deceive the kernel into performing MMIO on its behalf. For example, if userspace can point a syscall to an MMIO address, syscall does get_user() or put_user() on it, triggering MMIO #VE. The kernel will treat the #VE as in-kernel MMIO. Ensure that the target MMIO address is within the kernel before decoding instruction. Cc: stable(a)vger.kernel.org Signed-off-by: Alexey Gladkov (Intel) <legion(a)kernel.org> --- arch/x86/coco/tdx/tdx.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c index 078e2bac2553..c90d2fdb5fc4 100644 --- a/arch/x86/coco/tdx/tdx.c +++ b/arch/x86/coco/tdx/tdx.c @@ -405,6 +405,11 @@ static bool mmio_write(int size, unsigned long addr, unsigned long val) EPT_WRITE, addr, val); } +static inline bool is_kernel_addr(unsigned long addr) +{ + return (long)addr < 0; +} + static int handle_mmio(struct pt_regs *regs, struct ve_info *ve) { unsigned long *reg, val, vaddr; @@ -434,6 +439,11 @@ static int handle_mmio(struct pt_regs *regs, struct ve_info *ve) return -EINVAL; } + if (!user_mode(regs) && !is_kernel_addr(ve->gla)) { + WARN_ONCE(1, "Access to userspace address is not supported"); + return -EINVAL; + } + /* * Reject EPT violation #VEs that split pages. * -- 2.46.0

8 months

3
4
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror September 2024