Commit Graph

1149361 Commits

Author SHA1 Message Date
heshuai1
a9a44851ec ANDROID: freezer: Add vendor hook to freezer for GKI purpose.
Add the vendor hook to freezer.c so that OEM's logic can be executed
when the process is about to be frozen. We need to clear the flag for
some tasks and rebind task dependencies for optimization purposes.

Bug: 187458531
Bug: 281920779

Signed-off-by: heshuai1 <heshuai1@xiaomi.com>
Change-Id: Iea42fd9604d6b33ccd6502425416f0dd28eecebb
(cherry picked from commit a1580311c3)
2023-05-17 00:25:38 +00:00
Zhuguangqing
632ec01905 ANDROID: freezer: export the freezer_cgrp_subsys for GKI purpose.
Exporting the symbol freezer_cgrp_subsys, in that vendor module can
add can_attach & cancel_attach member function. It is vendor-specific
tuning.

Bug: 182496370
Bug: 281920779

Signed-off-by: Zhuguangqing <zhuguangqing@xiaomi.com>
Change-Id: I153682b9d1015eed3f048b45ea6495ebb8f3c261
(cherry picked from commit ee3f4d2821)
(cherry picked from commit 8a90e4d4e555dd5484213c6fec5061958016a194)
2023-05-17 00:25:38 +00:00
wang qiankun
fdd7d6fbac ANDROID: GKI: update the ABI symbol list
INFO: ABI DIFFERENCES HAVE BEEN DETECTED!
INFO: 4 function symbol(s) added
  'int __traceiter_android_vh_binder_alloc_new_buf_locked(void*, size_t, size_t*, int)'
  'int __traceiter_android_vh_binder_reply(void*, struct binder_proc*, struct binder_proc*, struct binder_thread*, struct binder_transaction_data*)'
  'int __traceiter_android_vh_binder_trans(void*, struct binder_proc*, struct binder_proc*, struct binder_thread*, struct binder_transaction_data*)'
  'int __traceiter_android_vh_do_send_sig_info(void*, int, struct task_struct*, struct task_struct*)'

4 variable symbol(s) added
  'struct tracepoint __tracepoint_android_vh_binder_alloc_new_buf_locked'
  'struct tracepoint __tracepoint_android_vh_binder_reply'
  'struct tracepoint __tracepoint_android_vh_binder_trans'
  'struct tracepoint __tracepoint_android_vh_do_send_sig_info'

function symbol 'int snd_usb_power_domain_set(struct snd_usb_audio*, struct snd_usb_power_domain*, unsigned char)' changed
  CRC changed from 0xf4ff4ee5 to 0xb29e40d5

Bug: 281920779

Change-Id: I3e6cd71847ee2eeee26fc8aef985055c00504d14
Signed-off-by: wang qiankun <wangqiankun3@xiaomi.corp-partner.google.com>
2023-05-16 21:47:18 +00:00
Zhuguangqing
17fff41db8 ANDROID: Add vendor hooks for binder perf tuning
Add some hooks in the binder module so that we can do task dependency analysis and statistical work in OEM's module for further optimization.

Bug: 235925535
Bug: 281920779

Signed-off-by: Zhuguangqing <zhuguangqing@xiaomi.com>
Change-Id: Id47e59c4e3ccd07b26eef758ada147b98cd1964e
Signed-off-by: heshuai1 <heshuai1@xiaomi.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
[ cmllamas: don't export complete private definition struct binder_alloc
  in vendor hooks, instead just pass member alloc->free_async_space as
  implemented by heshuai1 and squashed here ]
(cherry picked from commit 254fb1f4034fde523378ee58a501d212a59047b7)
2023-05-16 21:44:18 +00:00
Zhuguangqing
bf4922727c ANDROID: Add vendor hooks to signal.
This hook will allow us to get signal messages so that we can set
limitations for certain tasks and restore them when receiving important signals.

Bug: 184898838
Bug: 281920779

Signed-off-by: Zhuguangqing <zhuguangqing@xiaomi.com>
Change-Id: I83a28b0a6eb413976f4c57f2314d008ad792fa0d
(cherry picked from commit 58e3f869fc)
2023-05-16 21:44:18 +00:00
Minchan Kim
27dfd1c13e ANDROID: Update the ABI symbol list
1 function symbol(s) added
  'void __page_pinner_put_page(struct page*)'

1 variable symbol(s) added
  'struct static_key_false page_pinner_inited'
Bug: 274967172
Change-Id: I458edf7089b44696fa270be0ed538441c99ab5e6
Signed-off-by: Minchan Kim <minchan@google.com>
2023-05-16 21:34:27 +00:00
Minchan Kim
2488e2e472 ANDROID: page_pinner: add missing page_pinner_put_page
aosp/2369528 missed page_pinner_put_page in put_page_testzero
path. Fix it.

Bug: 274967172
Change-Id: Ia2af2ffb752f8405b4289ca88cde09f201548e1f
Signed-off-by: Minchan Kim <minchan@google.com>
2023-05-16 21:34:27 +00:00
Charan Teja Kalla
d47c9481da ANDROID: page_pinner: prevent pp_buffer uninitialized access
There is a race window between page_pinner_inited set and the pp_buffer
initialization which cause accessing the pp_buffer->lock. Avoid this by
moving the pp_buffer initialization to page_ext_ops->init() which sets
the page_pinner_inited only after the pp_buffer is initialized.

Race scenario:
1) init_page_pinner is called --> page_pinner_inited is set.

2) __alloc_contig_migrate_range --> __page_pinner_failure_detect()
accesses the pp_buffer->lock(yet to be initialized).

3) Then the pp_buffer is allocated and initialized.

Below is the issue call stack:
 spin_bug+0x0
 _raw_spin_lock_irqsave+0x3c
 __page_pinner_failure_detect+0x110
 __alloc_contig_migrate_range+0x1c4
 alloc_contig_range+0x130
 cma_alloc+0x170
 dma_alloc_contiguous+0xa0
 __dma_direct_alloc_pages+0x16c
 dma_direct_alloc+0x88

Bug: 259024332
Change-Id: I6849ac4d944498b9a431b47cad7adc7903c9bbaa
Signed-off-by: Charan Teja Kalla <quic_charante@quicinc.com>
2023-05-16 21:34:27 +00:00
Suren Baghdasaryan
83b784c3d7 ANDROID: page_pinner: prevent pp_buffer access before initialization
If page_pinner is configured with page_pinner_enabled=false and
failure_tracking=true, pp_buffer will be accessed without being
initialized. Prevent this by adding page_pinner_inited checks in
functions that access it.

Fixes: 898cfbf094a2 ("ANDROID: mm: introduce page_pinner")
Bug: 259024332
Bug: 260179017
Change-Id: I8f612cae3e74d36e8a4eee5edec25281246cbe5e
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Richard Chang <richardycc@google.com>
(cherry picked from commit 23fb3111f63e5fe239a769668275c20493a5849c)
2023-05-16 21:34:27 +00:00
Charan Teja Kalla
231a4cccec ANDROID: mm: fix use-after free of page_ext in page_pinner
Apply new page_ext refcounting scheme to page_pinner.

Bug: 236222283
Bug: 240196534
[surenb: extracted from aosp/2369529]
Change-Id: I3b64caf5a7e8ff316507cc3933f5b3696142268d
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2023-05-16 21:34:27 +00:00
Minchan Kim
e6e6e1273d ANDROID: mm: introduce page_pinner
For CMA allocation, it's really critical to migrate a page but
sometimes it fails. One of the reasons is some driver holds a
page refcount for a long time so VM couldn't migrate the page
at that time.

The concern here is there is no way to find the who hold the
refcount of the page effectively. This patch introduces feature
to keep tracking page's pinner. All get_page sites are vulnerable
to pin a page for a long time but the cost to keep track it would
be significat since get_page is the most frequent kernel operation.
Furthermore, the page could be not user page but kernel page which
is not related to the page migration failure.

Thus, this patch keeps tracks of only migration failed pages to
reduce runtime cost. Once page migration fails in CMA allocation
path, those pages are marked as "migration failure" and every
put_page operation against those pages, callstack of the put
are recorded into page_pinner buffer. Later, admin can see
what pages were failed and who released the refcount since the
failure. It really helps effectively to find out longtime refcount
holder to prevent the page migration.

note: page_pinner doesn't guarantee attributing/unattributing are
atomic if they happen at the same time. It's just best effort so
false-positive could happen.

Bug: 183414571
BUg: 240196534
Signed-off-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Minchan Kim <minchan@google.com>
Change-Id: I603d0c0122734c377db6b1eb95848a6f734173a0
(cherry picked from commit 898cfbf094a2fc13c67fab5b5d3c916f0139833a)
2023-05-16 21:34:27 +00:00
Elliot Berman
4c868837fa ANDROID: abi_gki_aarch64_qcom: Add gh_rm_register_platform_ops
From commit 80dfafb2b9b6 ("ANDROID: gunyah: Sync with latest "firmware:
qcom_scm: Register Gunyah platform ops""), the QCOM platform extensions
now use gh_rm_(un)register_platform_ops instead of the devm_ equivalent
because the platform extensions are no longer directly backed by a
device.

 2 function symbol(s) added
  'int gh_rm_register_platform_ops(struct gh_rm_platform_ops*)'
  'void gh_rm_unregister_platform_ops(struct gh_rm_platform_ops*)'

Bug: 279506910
Change-Id: I7ad36387a9d254691ecf9b769e058d972bd41c42
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-05-16 20:35:28 +00:00
Elliot Berman
9a9fc8d1b2 ANDROID: gunyah: Sync remaining gunyah drivers with latest
Apply remaining minor fixups from Gunyah v13 patches:

https://lore.kernel.org/all/20230509204801.2824351-1-quic_eberman@quicinc.com/

Bug: 279506910
Change-Id: I1a596b9df29d210c51b612845e4a1aafbea00441
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-05-16 20:35:28 +00:00
Elliot Berman
afaf163329 ANDROID: gunyah: Sync with latest "mailbox: Add Gunyah message queue mailbox"
Align msgq mailbox implementation to version 13 of Gunyah patches:

https://lore.kernel.org/all/20230509204801.2824351-6-quic_eberman@quicinc.com/

Bug: 279506910
Change-Id: I017873310e6c8650afa3e6dae379c7e7048b7197
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-05-16 20:35:28 +00:00
Elliot Berman
016d92266e ANDROID: gunyah: Sync with latest "gunyah: Common types and error codes for Gunyah hypercalls"
Rename gh_remap_error to gh_error_remap to align with Gunyah v13
patches:

https://lore.kernel.org/all/20230509204801.2824351-3-quic_eberman@quicinc.com/

Bug: 279506910
Change-Id: Id3e033108a6a42868dc12a9c20c1a06775418979
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-05-16 20:35:28 +00:00
Elliot Berman
58a642ea08 ANDROID: gunyah: Sync with latest hypercalls
Align hypercalls to Gunyah v13 patches:

https://lore.kernel.org/all/20230509204801.2824351-1-quic_eberman@quicinc.com/

Bug: 279506910
Change-Id: Ie99913e7d9213e4805a98aa04a06c751ece32488
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-05-16 20:35:28 +00:00
Elliot Berman
a30bae5a9a ANDROID: gunyah: Sync with latest documentation and UAPI
Align docs and UAPI to Gunyah v13 patches:

https://lore.kernel.org/all/20230509204801.2824351-1-quic_eberman@quicinc.com/

Bug: 279506910
Change-Id: I2719f07f69877374ffa88020fe2a23a70d79bb8b
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-05-16 20:35:28 +00:00
Elliot Berman
b3f59a9b33 ANDROID: gunyah: Sync with latest "firmware: qcom_scm: Register Gunyah platform ops"
The QCOM platform hooks are not enabled in gki_defconfig, but backport
to align to Gunyah v13 patches posted to kernel.org:

https://lore.kernel.org/all/20230509204801.2824351-15-quic_eberman@quicinc.com/

Bug: 279506910
Change-Id: Idce927cfa89cfea137b96024dd3c5a2bf297da82
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-05-16 20:35:28 +00:00
Elliot Berman
15a4929f8e BACKPORT: firmware: qcom_scm: Use fixed width src vm bitmap
The maximum VMID for assign_mem is 63. Use a u64 to represent this
bitmap instead of architecture-dependent "unsigned int" which varies in
size on 32-bit and 64-bit platforms.

Acked-by: Kalle Valo <kvalo@kernel.org> (ath10k)
Tested-by: Gokul krishna Krishnakumar <quic_gokukris@quicinc.com>
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230213181832.3489174-1-quic_eberman@quicinc.com

Bug: 279506910
(cherry picked from commit 968a26a07f)
Change-Id: Ie7125d1299e4edda47f3e6e9031dc515cfdd8f0f
[eberman: Drop modifications to drivers/remoteproc/qcom_q6v5_pas.c which
don't exist in 14-6.1]
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-05-16 20:35:28 +00:00
Elliot Berman
b0426ab62e BACKPORT: misc: fastrpc: Pass bitfield into qcom_scm_assign_mem
The srcvm parameter of qcom_scm_assign_mem is a pointer to a bitfield of
VMIDs. The  bitfield is updated with which VMIDs have permissions
after the qcom_scm_assign_mem call. This makes it simpler for clients to
make qcom_scm_assign_mem calls later, they always pass in same srcvm
bitfield and do not need to closely track whether memory was originally
shared.

When restoring permissions to HLOS, fastrpc is incorrectly using the
first VMID directly -- neither the BIT nor the other possible VMIDs the
memory was already assigned to.  We already have a field intended for
this purpose: "perms" in the struct fastrpc_channel_ctx, but it was
never used. Start using the perms field.

Cc: Abel Vesa <abel.vesa@linaro.org>
Cc: Vamsi Krishna Gattupalli <quic_vgattupa@quicinc.com>
Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Fixes: e90d911906 ("misc: fastrpc: Add support to secure memory map")
Fixes: 0871561055 ("misc: fastrpc: Add support for audiopd")
Fixes: 532ad70c6d ("misc: fastrpc: Add mmap request assigning for static PD pool")
Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>

drivers/misc/fastrpc.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

Link: https://lore.kernel.org/r/20230112182313.521467-1-quic_eberman@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 279506910
(cherry picked from commit aaca766c77)
[eberman: Drop modifications to qcom_scm_assign_mem not in 14-6.1]
Change-Id: I9eff564504fa277519245a446eb6fcad41a0ee42
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-05-16 20:35:28 +00:00
Elliot Berman
2220f8190a ANDROID: gunyah: Sync with latest "virt: gunyah: Add ioeventfd"
Align ioeventfd handling to Gunyah v13 patches:

https://lore.kernel.org/all/20230509204801.2824351-24-quic_eberman@quicinc.com/

Bug: 279506910
Change-Id: I8d66d83bee284eacb4bc9d76d3cbfd52785d9661
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-05-16 20:35:28 +00:00
Elliot Berman
1b9d0e44a7 ANDROID: gunyah: Sync with latest "gunyah: vm_mgr: Add ioctls to support basic non-proxy VM boot"
Align VM lifecycle to Gunyah v13 patches posted to kernel.org.

- Move gh_vm_free and kref functions down.
- Simplify/clean up gh_vm_free
- Defer vmid allocation to when the VM is being started

https://lore.kernel.org/all/20230509204801.2824351-12-quic_eberman@quicinc.com/

Bug: 279506910
Change-Id: I413865c16a730365edc83385bc37394b99517ab1
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-05-16 20:35:28 +00:00
Elliot Berman
28ecb1162a ANDROID: gunyah: Sync with latest "gunyah: vm_mgr: Add/remove user memory regions"
Align Gunyah memory parcel to Gunyah v12 patches posted to kernel.org.

We deviate from a perfect copy from kernel.org because:
 - in pages_are_mergeable, zone_device_pages_have_same_pgmap is not
   present in 6.1. Drop this check.

https://lore.kernel.org/all/20230509204801.2824351-11-quic_eberman@quicinc.com/

Bug: 279506910
Change-Id: I90ec2ac416b24bcc65635f27cae7665ce879783f
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-05-16 20:35:28 +00:00
Elliot Berman
084d70e264 ANDROID: gunyah: Sync with latest "virt: gunyah: Add resource tickets"
Align resource tickets with the Gunyah v13 pathces posted to kernel.org:

https://lore.kernel.org/all/20230509204801.2824351-19-quic_eberman@quicinc.com/

Bug: 279506910
Change-Id: Ie08544786045b338c332b3a35c125fcb9a77b697
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-05-16 20:35:28 +00:00
Elliot Berman
5e0785329a ANDROID: gunyah: Sync with latest "gunyah: vm_mgr: Add framework for VM Functions"
Align Gunyah VM Functions with Gunyah v13 patches:

https://lore.kernel.org/all/20230509204801.2824351-18-quic_eberman@quicinc.com/

Bug: 279506910
Change-Id: Id8e043191539d41e4b54cb579ba2a84db76e0f70
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-05-16 20:35:28 +00:00
Elliot Berman
fea63fe1f1 ANDROID: gunyah: Sync with latest "gunyah: rsc_mgr: Add resource manager RPC core"
Align resource manager and rpc to v12 of Gunyah patches posted to
kernel.org.

 - Rename "buff" to "buf"
 - printk adjustments
 - Comments
 - Stylistic tweaks

https://lore.kernel.org/all/20230509204801.2824351-7-quic_eberman@quicinc.com/

Bug: 279506910
Change-Id: Iff216a9cb3afeb9de75f0b42bf58f139da2ca4bd
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-05-16 20:35:28 +00:00
Elliot Berman
6889a3fbe4 ANDROID: gunyah: Sync with latest "virt: gunyah: Translate gh_rm_hyp_resource into gunyah_resource"
Align the Gunyah IRQ domain to the v13 series:

https://lore.kernel.org/all/20230509204801.2824351-17-quic_eberman@quicinc.com/

Bug: 279506910
Change-Id: I6807139aa917d89b44cb3d77aa3c790433746f3d
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-05-16 20:35:28 +00:00
Elliot Berman
96ddb92d5c ANDROID: gunyah: Sync with latest "virt: gunyah: Add hypercalls to identify Gunyah"
Align arch_is_gh_guest to version 13 of Gunyah patches:

https://lore.kernel.org/all/20230509204801.2824351-4-quic_eberman@quicinc.com/

Bug: 279506910
Change-Id: I7b4ff1974a1175efb94dfdb1f414771d887ecb1f
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-05-16 20:35:28 +00:00
Kees Cook
467d3baa5d BACKPORT: overflow: Introduce overflows_type() and castable_to_type()
Implement a robust overflows_type() macro to test if a variable or
constant value would overflow another variable or type. This can be
used as a constant expression for static_assert() (which requires a
constant expression[1][2]) when used on constant values. This must be
constructed manually, since __builtin_add_overflow() does not produce
a constant expression[3].

Additionally adds castable_to_type(), similar to __same_type(), but for
checking if a constant value would overflow if cast to a given type.

Add unit tests for overflows_type(), __same_type(), and castable_to_type()
to the existing KUnit "overflow" test:

[16:03:33] ================== overflow (21 subtests) ==================
...
[16:03:33] [PASSED] overflows_type_test
[16:03:33] [PASSED] same_type_test
[16:03:33] [PASSED] castable_to_type_test
[16:03:33] ==================== [PASSED] overflow =====================
[16:03:33] ============================================================
[16:03:33] Testing complete. Ran 21 tests: passed: 21
[16:03:33] Elapsed time: 24.022s total, 0.002s configuring, 22.598s building, 0.767s running

[1] https://en.cppreference.com/w/c/language/_Static_assert
[2] C11 standard (ISO/IEC 9899:2011): 6.7.10 Static assertions
[3] https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow-Builtins.html
    6.56 Built-in Functions to Perform Arithmetic with Overflow Checking
    Built-in Function: bool __builtin_add_overflow (type1 a, type2 b,

Cc: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Tom Rix <trix@redhat.com>
Cc: Daniel Latypov <dlatypov@google.com>
Cc: Vitor Massaru Iha <vitor@massaru.org>
Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Cc: Jani Nikula <jani.nikula@intel.com>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: linux-hardening@vger.kernel.org
Cc: llvm@lists.linux.dev
Co-developed-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20221024201125.1416422-1-gwan-gyeong.mun@intel.com

Bug: 279506910
(cherry picked from commit 4b21d25bf5)
Change-Id: I20aff9de6b82a2f5203367d30555f904681a5b7b
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
2023-05-16 20:35:28 +00:00
Treehugger Robot
25a4fdf787 Merge "Merge b1644a0031 ("drm/rockchip: vop2: Use regcache_sync() to fix suspend/resume") into android14-6.1" into android14-6.1 2023-05-16 18:34:57 +00:00
Dmytro Laktyushkin
26283282a1 UPSTREAM: drm/amd/display: set dcn315 lb bpp to 48
commit 6d9240c46f upstream.

[Why & How]
Fix a typo for dcn315 line buffer bpp.

Reviewed-by: Jun Lei <Jun.Lei@amd.com>
Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
Change-Id: I6f5408cd982d1ff478e6fb2982bd90c97184e692
Signed-off-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 4ac57c3fe2)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-05-16 18:11:31 +00:00
Alan Liu
5d61392e80 UPSTREAM: drm/amdgpu: Fix desktop freezed after gpu-reset
commit c8b5a95b57 upstream.

[Why]
After gpu-reset, sometimes the driver fails to enable vblank irq,
causing flip_done timed out and the desktop freezed.

During gpu-reset, we disable and enable vblank irq in dm_suspend() and
dm_resume(). Later on in amdgpu_irq_gpu_reset_resume_helper(), we check
irqs' refcount and decide to enable or disable the irqs again.

However, we have 2 sets of API for controling vblank irq, one is
dm_vblank_get/put() and another is amdgpu_irq_get/put(). Each API has
its own refcount and flag to store the state of vblank irq, and they
are not synchronized.

In drm we use the first API to control vblank irq but in
amdgpu_irq_gpu_reset_resume_helper() we use the second set of API.

The failure happens when vblank irq was enabled by dm_vblank_get()
before gpu-reset, we have vblank->enabled true. However, during
gpu-reset, in amdgpu_irq_gpu_reset_resume_helper() vblank irq's state
checked from amdgpu_irq_update() is DISABLED. So finally it disables
vblank irq again. After gpu-reset, if there is a cursor plane commit,
the driver will try to enable vblank irq by calling drm_vblank_enable(),
but the vblank->enabled is still true, so it fails to turn on vblank
irq and causes flip_done can't be completed in vblank irq handler and
desktop become freezed.

[How]
Combining the 2 vblank control APIs by letting drm's API finally calls
amdgpu_irq's API, so the irq's refcount and state of both APIs can be
synchronized. Also add a check to prevent refcount from being less then
0 in amdgpu_irq_put().

v2:
- Add warning in amdgpu_irq_enable() if the irq is already disabled.
- Call dc_interrupt_set() in dm_set_vblank() to avoid refcount change
  if it is in gpu-reset.

v3:
- Improve commit message and code comments.

Change-Id: I44a9569645ce40ea1cf98fce4741c9e683160220
Signed-off-by: Alan Liu <HaoPing.Liu@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit bef774effb)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-05-16 18:11:31 +00:00
Ville Syrjälä
fea91b573a UPSTREAM: drm/i915: Fix fast wake AUX sync len
commit e1c71f8f91 upstream.

Fast wake should use 8 SYNC pulses for the preamble
and 10-16 SYNC pulses for the precharge. Reduce our
fast wake SYNC count to match the maximum value.
We also use the maximum precharge length for normal
AUX transactions.

Cc: stable@vger.kernel.org
Cc: Jouni Högander <jouni.hogander@intel.com>
Change-Id: Iaa1ca424e1758a938aa960891141715c3ec46e14
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230329172434.18744-1-ville.syrjala@linux.intel.com
Reviewed-by: Jouni Högander <jouni.hogander@intel.com>
(cherry picked from commit 605f7c7313)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 66eb772be2)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-05-16 18:11:31 +00:00
Ekaterina Orlova
b0b7c6147e UPSTREAM: ASN.1: Fix check for strdup() success
commit 5a43001c01 upstream.

It seems there is a misprint in the check of strdup() return code that
can lead to NULL pointer dereference.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 4520c6a49a ("X.509: Add simple ASN.1 grammar compiler")
Change-Id: I625ab151cdb5da606d1b3ae364c90e4b0f6f9dc5
Signed-off-by: Ekaterina Orlova <vorobushek.ok@gmail.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Jarkko Sakkinen <jarkko@kernel.org>
Cc: keyrings@vger.kernel.org
Cc: linux-kbuild@vger.kernel.org
Link: https://lore.kernel.org/r/20230315172130.140-1-vorobushek.ok@gmail.com/
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit ab91b09f39)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-05-16 17:26:47 +00:00
Chancel Liu
c45eb7457f UPSTREAM: ASoC: fsl_sai: Fix pins setting for i.MX8QM platform
commit 238787157d upstream.

SAI on i.MX8QM platform supports the data lines up to 4. So the pins
setting should be corrected to 4.

Fixes: eba0f00775 ("ASoC: fsl_sai: Enable combine mode soft")
Change-Id: Iab8b402f688a8289606e979b7ea6c0a07006a235
Signed-off-by: Chancel Liu <chancel.liu@nxp.com>
Acked-by: Shengjiu Wang <shengjiu.wang@gmail.com>
Reviewed-by: Iuliana Prodan <iuliana.prodan@nxp.com>
Link: https://lore.kernel.org/r/20230418094259.4150771-1-chancel.liu@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 1831d8cbae)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-05-16 17:26:38 +00:00
Nikita Zhandarovich
9a9b52eec7 UPSTREAM: ASoC: fsl_asrc_dma: fix potential null-ptr-deref
commit 86a24e99c9 upstream.

dma_request_slave_channel() may return NULL which will lead to
NULL pointer dereference error in 'tmp_chan->private'.

Correct this behaviour by, first, switching from deprecated function
dma_request_slave_channel() to dma_request_chan(). Secondly, enable
sanity check for the resuling value of dma_request_chan().
Also, fix description that follows the enacted changes and that
concerns the use of dma_request_slave_channel().

Fixes: 706e2c8811 ("ASoC: fsl_asrc_dma: Reuse the dma channel if available in Back-End")
Co-developed-by: Natalia Petrova <n.petrova@fintech.ru>
Change-Id: I2ae5ca9cbb40afd7c5f066e8ed984cf4f35c832e
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Acked-by: Shengjiu Wang <shengjiu.wang@gmail.com>
Link: https://lore.kernel.org/r/20230417133242.53339-1-n.zhandarovich@fintech.ru
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 6cb818ed5f)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-05-16 17:26:38 +00:00
Daniel Baluta
7caae9e684 UPSTREAM: ASoC: SOF: pm: Tear down pipelines only if DSP was active
commit 0b186bb061 upstream.

With PCI if the device was suspended it is brought back to full
power and then suspended again.

This doesn't happen when device is described via DT.

We need to make sure that we tear down pipelines only if the device
was previously active (thus the pipelines were setup).

Otherwise, we can break the use_count:

[  219.009743] sof-audio-of-imx8m 3b6e8000.dsp:
sof_ipc3_tear_down_all_pipelines: widget PIPELINE.2.SAI3.IN is still in use: count -1

and after this everything stops working.

Fixes: d185e0689a ("ASoC: SOF: pm: Always tear down pipelines before DSP suspend")
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Change-Id: Ic7f724954ede17a021a486dba6c9eed9e3354438
Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>
Link: https://lore.kernel.org/r/20230405092655.19587-1-daniel.baluta@oss.nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 7a6593b5d7)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-05-16 17:26:38 +00:00
Alexis Lothoré
fe43fe9cce UPSTREAM: fpga: bridge: properly initialize bridge device before populating children
commit dc70eb868b upstream.

The current code path can lead to warnings because of uninitialized device,
which contains, as a consequence, uninitialized kobject. The uninitialized
device is passed to of_platform_populate, which will at some point, while
creating child device, try to get a reference on uninitialized parent,
resulting in the following warning:

kobject: '(null)' ((ptrval)): is not initialized, yet kobject_get() is
being called.

The warning is observed after migrating a kernel 5.10.x to 6.1.x.
Reverting commit 0d70af3c25 ("fpga: bridge: Use standard dev_release for
class driver") seems to remove the warning.
This commit aggregates device_initialize() and device_add() into
device_register() but this new call is done AFTER of_platform_populate

Fixes: 0d70af3c25 ("fpga: bridge: Use standard dev_release for class driver")
Change-Id: I4726f74122c2755c1b14b66f40250306b1a796b2
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Acked-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/20230404133102.2837535-2-alexis.lothore@bootlin.com
Signed-off-by: Xu Yilun <yilun.xu@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 71b6df69f1)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-05-16 17:26:38 +00:00
Dan Carpenter
0c69b18d8e UPSTREAM: iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger()
commit 73a428b37b upstream.

The at91_adc_allocate_trigger() function is supposed to return error
pointers.  Returning a NULL will cause an Oops.

Fixes: 5e1a1da0f8 ("iio: adc: at91-sama5d2_adc: add hw trigger and buffer support")
Change-Id: I31db683d8467f130b1795093287e0eacee2a776a
Signed-off-by: Dan Carpenter <error27@gmail.com>
Link: https://lore.kernel.org/r/5d728f9d-31d1-410d-a0b3-df6a63a2c8ba@kili.mountain
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit f8c3eb751a)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-05-16 17:26:38 +00:00
Soumya Negi
690f3e949d UPSTREAM: Input: pegasus-notetaker - check pipe type when probing
commit b3d80fd27a upstream.

Fix WARNING in pegasus_open/usb_submit_urb
Syzbot bug: https://syzkaller.appspot.com/bug?id=bbc107584dcf3262253ce93183e51f3612aaeb13

Warning raised because pegasus_driver submits transfer request for
bogus URB (pipe type does not match endpoint type). Add sanity check at
probe time for pipe value extracted from endpoint descriptor. Probe
will fail if sanity check fails.

Reported-and-tested-by: syzbot+04ee0cb4caccaed12d78@syzkaller.appspotmail.com
Change-Id: Iedb606676db9329b44bc530edf017c80f4fa4263
Signed-off-by: Soumya Negi <soumya.negi97@gmail.com>
Link: https://lore.kernel.org/r/20230404074145.11523-1-soumya.negi97@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 342c1db4fa)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-05-16 17:26:14 +00:00
Linus Torvalds
6bf110bb7a UPSTREAM: gcc: disable '-Warray-bounds' for gcc-13 too
commit 0da6e5fd6c upstream.

We started disabling '-Warray-bounds' for gcc-12 originally on s390,
because it resulted in some warnings that weren't realistically fixable
(commit 8b202ee218: "s390: disable -Warray-bounds").

That s390-specific issue was then found to be less common elsewhere, but
generic (see f0be87c42c: "gcc-12: disable '-Warray-bounds' universally
for now"), and then later expanded the version check was expanded to
gcc-11 (5a41237ad1: "gcc: disable -Warray-bounds for gcc-11 too").

And it turns out that I was much too optimistic in thinking that it's
all going to go away, and here we are with gcc-13 showing all the same
issues.  So instead of expanding this one version at a time, let's just
disable it for gcc-11+, and put an end limit to it only when we actually
find a solution.

Yes, I'm sure some of this is because the kernel just does odd things
(like our "container_of()" use, but also knowingly playing games with
things like linker tables and array layouts).

And yes, some of the warnings are likely signs of real bugs, but when
there are hundreds of false positives, that doesn't really help.

Oh well.

Change-Id: Ie09553dec193c593f34169f835a876ea81b7cb6d
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit a93c20f583)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-05-16 17:26:14 +00:00
Kuniyuki Iwashima
90f84684ab UPSTREAM: sctp: Call inet6_destroy_sock() via sk->sk_destruct().
commit 6431b0f6ff upstream.

After commit d38afeec26 ("tcp/udp: Call inet6_destroy_sock()
in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in
sk->sk_destruct() by setting inet6_sock_destruct() to it to make
sure we do not leak inet6-specific resources.

SCTP sets its own sk->sk_destruct() in the sctp_init_sock(), and
SCTPv6 socket reuses it as the init function.

To call inet6_sock_destruct() from SCTPv6 sk->sk_destruct(), we
set sctp_v6_destruct_sock() in a new init function.

Change-Id: Ie3beb7e182e26def3fb7b50fef029fd5a8c94fc7
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit a09b9383b7)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-05-16 17:26:14 +00:00
Kuniyuki Iwashima
e1dc9c79c2 UPSTREAM: dccp: Call inet6_destroy_sock() via sk->sk_destruct().
commit 1651951ebe upstream.

After commit d38afeec26 ("tcp/udp: Call inet6_destroy_sock()
in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in
sk->sk_destruct() by setting inet6_sock_destruct() to it to make
sure we do not leak inet6-specific resources.

DCCP sets its own sk->sk_destruct() in the dccp_init_sock(), and
DCCPv6 socket shares it by calling the same init function via
dccp_v6_init_sock().

To call inet6_sock_destruct() from DCCPv6 sk->sk_destruct(), we
export it and set dccp_v6_sk_destruct() in the init function.

Change-Id: I1aa8f30c780796bb5d446874bb44113783d6460a
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit a530b33fe9)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-05-16 17:26:14 +00:00
Pablo Neira Ayuso
8cc757d50b UPSTREAM: netfilter: nf_tables: deactivate anonymous set from preparation phase
commit c1592a8994 upstream.

Toggle deleted anonymous sets as inactive in the next generation, so
users cannot perform any update on it. Clear the generation bitmask
in case the transaction is aborted.

The following KASAN splat shows a set element deletion for a bound
anonymous set that has been already removed in the same transaction.

[   64.921510] ==================================================================
[   64.923123] BUG: KASAN: wild-memory-access in nf_tables_commit+0xa24/0x1490 [nf_tables]
[   64.924745] Write of size 8 at addr dead000000000122 by task test/890
[   64.927903] CPU: 3 PID: 890 Comm: test Not tainted 6.3.0+ #253
[   64.931120] Call Trace:
[   64.932699]  <TASK>
[   64.934292]  dump_stack_lvl+0x33/0x50
[   64.935908]  ? nf_tables_commit+0xa24/0x1490 [nf_tables]
[   64.937551]  kasan_report+0xda/0x120
[   64.939186]  ? nf_tables_commit+0xa24/0x1490 [nf_tables]
[   64.940814]  nf_tables_commit+0xa24/0x1490 [nf_tables]
[   64.942452]  ? __kasan_slab_alloc+0x2d/0x60
[   64.944070]  ? nf_tables_setelem_notify+0x190/0x190 [nf_tables]
[   64.945710]  ? kasan_set_track+0x21/0x30
[   64.947323]  nfnetlink_rcv_batch+0x709/0xd90 [nfnetlink]
[   64.948898]  ? nfnetlink_rcv_msg+0x480/0x480 [nfnetlink]

Bug: 282877000
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I536b7fbec55a5b37a57546023891a3dcfeb2c24b
2023-05-16 15:47:00 +00:00
Greg Kroah-Hartman
dec77ff4b5 Merge b1644a0031 ("drm/rockchip: vop2: Use regcache_sync() to fix suspend/resume") into android14-6.1
Steps on the way to 6.1.26

Change-Id: I76647cf6aaf4db218b2013de08a01cd9d11b0bb3
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-05-16 14:19:59 +00:00
Cixi Geng
10e4c804f2 ANDROID: GKI: add symbol list file for unisoc
Add abi_gki_aarch64_unisoc

4 function symbol(s) added
  'struct hwspinlock* devm_hwspin_lock_request_specific(struct device*, unsigned int)'
  'void sdhci_enable_v4_mode(struct sdhci_host*)'
  'void sdhci_request(struct mmc_host*, struct mmc_request*)'
  'int sdhci_request_atomic(struct mmc_host*, struct mmc_request*)'

Bug: 282902304
Change-Id: I70eaba8be31407d3486b6e845241681c9995f27e
Signed-off-by: Cixi Geng <cixi.geng1@unisoc.com>
2023-05-16 14:10:58 +00:00
Kuniyuki Iwashima
8b5229c547 UPSTREAM: inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().
commit b5fc29233d upstream.

After commit d38afeec26 ("tcp/udp: Call inet6_destroy_sock()
in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in
sk->sk_destruct() by setting inet6_sock_destruct() to it to make
sure we do not leak inet6-specific resources.

Now we can remove unnecessary inet6_destroy_sock() calls in
sk->sk_prot->destroy().

DCCP and SCTP have their own sk->sk_destruct() function, so we
change them separately in the following patches.

Change-Id: Iae566ce3b7a73584548fc88c950518b53194c5df
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit a8cf114105)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-05-16 14:09:57 +00:00
Alyssa Ross
e0c86087dc UPSTREAM: purgatory: fix disabling debug info
commit d83806c4c0 upstream.

Since 32ef9e5054, -Wa,-gdwarf-2 is no longer used in KBUILD_AFLAGS.
Instead, it includes -g, the appropriate -gdwarf-* flag, and also the
-Wa versions of both of those if building with Clang and GNU as.  As a
result, debug info was being generated for the purgatory objects, even
though the intention was that it not be.

Fixes: 32ef9e5054 ("Makefile.debug: re-enable debug info for .S files")
Change-Id: I68ab786b0a713958e145908bbd26b7f842de5575
Signed-off-by: Alyssa Ross <hi@alyssa.is>
Cc: stable@vger.kernel.org
Acked-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 588d682251)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-05-16 14:03:44 +00:00
Jiaxun Yang
2200f18847 UPSTREAM: MIPS: Define RUNTIME_DISCARD_EXIT in LD script
commit 6dcbd0a69c upstream.

MIPS's exit sections are discarded at runtime as well.

Fixes link error:
`.exit.text' referenced in section `__jump_table' of fs/fuse/inode.o:
defined in discarded section `.exit.text' of fs/fuse/inode.o

Fixes: 99cb0d917f ("arch: fix broken BuildID for arm64 and riscv")
Reported-by: "kernelci.org bot" <bot@kernelci.org>
Change-Id: I2acdca2a4b35005d411c57978f4765bcc936e093
Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit f9a20ef5e8)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-05-16 14:03:40 +00:00
Greg Kroah-Hartman
c4cafbd0d4 Merge a3a93b4683 ("memstick: fix memory leak if card device is never registered") into android14-6.1
Steps on the way to 6.1.26

Change-Id: I068fdd73b1a29b954bef6931c144aa707d446482
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-05-16 12:06:36 +00:00