summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2022-10-06drm/amdgpu: Enable VCN PG on GC11_0_1Sonny Jiang
Enable VCN PG on GC11_0_1 Signed-off-by: Sonny Jiang <sonny.jiang@amd.com> Reviewed-by: James Zhu <James.Zhu@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org # 6.0.x
2022-10-06drm/amd/display: Add missing mask sh for SYM32_TP_SQ_PULSE registerWenjing Liu
There is a missing register mask in dcn32 causing the hardware programming is not executed when programming SQ_num test pattern for DP2. Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> Signed-off-by: Wenjing Liu <wenjing.liu@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Add missing SDP registers to DCN32 reglistGeorge Shen
[Why] Certain features require the additional DP SDP configuration registers DP_SEC_CNTL1 and DP_SEC_CNTL5 in order to function correctly. The DCN32 DIO stream encoder reglist is currently missing these two registers. [How] Add the missing registers to the DCN32 DIO stream encoder reglist. Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> Signed-off-by: George Shen <George.Shen@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Fix disable DSC logic in the DIO codeEric Bernstein
[Why] In DIO stream encoder, definition of DP_DSC_MODE is changed (only enable/disable) In OPTC, OTG_SET_V_TOTAL_MIN_MASK_EN is removed (same as DCN3.1) [How] In DIO stream encoder, update enc32_dp_set_dsc_config(). In OPTC, use DCN3.1 version for function interfaces .set_vrr_m_const and .set_drr Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> Signed-off-by: Eric Bernstein <eric.bernstein@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Fix merging dynamic ODM+MPO configs on DCN32Dillon Varone
[WHY&HOW?] When merging ODM pipes that are using MPO, we must copy the stream_res from the new top pipe to the bottom pipe so that the overlayed plane is not pointing to the wrong stream assets. Reviewed-by: Martin Leung <Martin.Leung@amd.com> Reviewed-by: Jun Lei <Jun.Lei@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Dillon Varone <Dillon.Varone@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Adding missing HDMI ACP SEND registerRodrigo Siqueira
Add HDMI ACP bit field definition for DCN32. Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Remove OPTC lock checkRodrigo Siqueira
At some point, we decided to blank HUBP during pixel data blank, and to handle that, we added some OPTC lock checks. Later, we realized that this change caused multiple regression, and we removed it. Nevertheless, we still have some leftovers that might affect some ASIC behavior, and this commit drops those changes to keep the code consistent. Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Fix SubVP control flow in the MPO contextRodrigo Siqueira
SubVP has some issues related to how we allocate and enable it. This commit fixes this behavior by adding the proper check and configuration to the SubVP code path. Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Update DCN321 hook that deals with pipe aquireRodrigo Siqueira
DCN provides a hook to check if we can have a new pipe allocation based on some DC constraints. If the current configuration supports the new pipe request, DC updates its context; otherwise, it will keep the same configuration. This behavior is similar across multiple ASICs, and for this reason, we reused DCN20 on DCN321. However, this DCN32x has some peculiarities which require its function to avoid weird pipe split issues. This commit update this issue by using dcn32_acquire_idle_pipe_for_head_pipe_in_layer instead of dcn20_acquire_idle_pipe_for_layer. Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Drop unused code for DCN32/321Rodrigo Siqueira
Under DCN32/321 we identified some code paths that DC never executes. This commit removes those unused codes to avoid distractions when debugging issues. Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: block odd h_total timings from halving pixel rateMartin Leung
why: when dynamic odm was turned on, there is also logic to halve the pixelclk this still turned on when we avoided odm in the case of odd h_total timings how: block the pixel clk mechanism also in the case of odd h_total timings Reviewed-by: Jun Lei <Jun.Lei@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Martin Leung <Martin.Leung@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Fix vupdate and vline position calculationAric Cyr
[how] Large deltas for periodic interrupts could result in the interrupt not being programmed properly and thus not firing. [why] Add proper wrap-around support for calculating VUPDATE and VLINE positions. Reviewed-by: Jun Lei <Jun.Lei@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Aric Cyr <aric.cyr@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: write all 4 bytes of FFE_PRESET dpcd valueWenjing Liu
[why] According to specs, it expects us to write all 4 bytes even if current lane count is less than 4. Reviewed-by: George Shen <George.Shen@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Wenjing Liu <wenjing.liu@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Increase compbuf size prior to updating clocksDillon Varone
[WHY?] Clocks are updating based on the incoming context's support, however the new compbuf size is not programmed prior to udpating clocks, which can result in P-State hangs. [HOW?] Increase compbuf size prior to updating clocks. Reviewed-by: Alvin Lee <Alvin.Lee2@amd.com> Reviewed-by: Martin Leung <Martin.Leung@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Dillon Varone <Dillon.Varone@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Keep OTG on when Z10 is disableLewis Huang
[Why] Disable OTG when PSRSU with z10 even if z10 is disable [How] Reverse condition to keep OTG on when Z10 is disable Reviewed-by: Robin Chen <po-tchen@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Lewis Huang <Lewis.Huang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: add dummy pstate workaround to dcn315Dmytro Laktyushkin
DCN315 has to always allow pstate change or SMU will hang. This workaround achieves this by applying a low pstate change latency to be used when pstate is calculated to be unsupported. This lower latency only accounts for memory retraining; a previous change handles locking in the highest available pstate allowing us to minimize required latency hiding to only account for memory retraining. Reviewed-by: Charlene Liu <Charlene.Liu@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: skip commit minimal transition stateZhikai Zhai
[WHY] Now dynamic ODM will now be disabled when MPO is required safe transitions to avoid underflow, but we are triggering the way of minimal transition too often. Commit state of dc with no check will do pipeline setup which may re-initialize the component with no need such as audio. [HOW] Just do the minimal transition when all of pipes are in use, otherwise return true to skip. Reviewed-by: Dillon Varone <Dillon.Varone@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Zhikai Zhai <zhikai.zhai@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Add log for LTTPRLeo Chen
[Why & How] Adding log for LTTPR to facilitate debugging. Reviewed-by: Charlene Liu <Charlene.Liu@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Leo Chen <sancchen@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: For SubVP pipe split case use min transition into MPOAlvin Lee
[Description] - For SubVP pipe split case we need to use a minimial transition when opening MPO video since we are transitioning from 4 pipes to 3 pipes where an OPP for a previous MPCC will change - Also save and restore mall config when doing fast_validate in case there was a shallow copy of the dc->current_state Reviewed-by: Jun Lei <Jun.Lei@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Alvin Lee <Alvin.Lee2@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Refactor edp ILR caps codesIan Chen
We split out ILR config from "global" to "per-panel" config settings. Reviewed-by: Anthony Koo <Anthony.Koo@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Ian Chen <ian.chen@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Allow PSR exit when panel is disconnectedIswara Nagulendran
[HOW&WHY] Fixed check to only avoid PSR entry when panel is disconnected. PSR exit can be permitted to restore the HW to it's non-PSR state. Reviewed-by: Jayendran Ramani <Jayendran.Ramani@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Iswara Nagulendran <Iswara.Nagulendran@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: AUX tracing cleanupLeo (Hanghong) Ma
[Why && How] Remove the unnecessary AUX trace and use one trace for AUX failure. Reviewed-by: Martin Leung <Martin.Leung@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Leo (Hanghong) Ma <hanghong.ma@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: fix integer overflow during MSA V_Freq calculationWenjing Liu
[why] Analyzer shows incorrect V freq in MSA for some large timing. [how] Cast an 32 bit integer to uint64_t before multiplication to avoid integer overflow for a very large timing. Reviewed-by: Ariel Bernstein <Eric.Bernstein@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Wenjing Liu <wenjing.liu@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Disable GSL when enabling phantom pipeAlvin Lee
[Description] When enabling phantom pipe on a pipe that was previously using immediate flip, we have to disable GSL or this will prevent the update from taking place right away on the phantom pipe when we enable it in FW Reviewed-by: Jun Lei <Jun.Lei@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Alvin Lee <Alvin.Lee2@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: prevent S4 test from failingCharlene Liu
[why] limit the vm prefetch check for now, until the feature is fully verified. Reviewed-by: Hansen Dsouza <Hansen.Dsouza@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Charlene Liu <Charlene.Liu@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06Revert "drm/amd/display: correct hostvm flag"Aric Cyr
This reverts commit 796d6a37ff5ffaf9f2dc0f3f4bf9f4a1034c00de. 4K144 resolution isn't available on DCN31. Reviewed-by: Sherry Wang <Yao.Wang1@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Aric Cyr <aric.cyr@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Block SubVP if rotation being usedAlvin Lee
[Description] - SubVP rotation support is not explicitly implemented, so block SubVP in rotation cases to avoid unexpected behaviors Reviewed-by: Nevenko Stupar <Nevenko.Stupar@amd.com> Reviewed-by: Jun Lei <Jun.Lei@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Alvin Lee <Alvin.Lee2@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: fix dcn315 dml detile overestimationDmytro Laktyushkin
DML does not take the fact that dcn315 does not have enough detile buffer to max all pipes. This change adds a workaround to apply the same logic DC does when calculating detile buffer size in DML. Reviewed-by: Charlene Liu <Charlene.Liu@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Reorder FCLK P-state switch sequence for DCN32Dillon Varone
[WHY?] In some cases, DCFCLK hardmin requests are not acknowledged by SMU as the requested clock does not have a compatible ratio with current FCLK, and it cannot be changed as FCLK P-state is not allowed. [HOW?] Allow FCLK p-state change prior to changing DCFCLK hardmin. Reviewed-by: Alvin Lee <Alvin.Lee2@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Dillon Varone <Dillon.Varone@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Program SubVP in dc_commit_state_no_checkDillon Varone
[Why?] Currently SubVP programming is only done in commit_planes_for_stream, as it was expected only this call would add/remove planes from a display. [How?] Add SubVP programming to dc_commit_state_no_check. Reviewed-by: Alvin Lee <Alvin.Lee2@amd.com> Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Signed-off-by: Dillon Varone <Dillon.Varone@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drivers/amd/pm: check the return value of amdgpu_bo_kmapLi Zhong
amdgpu_bo_kmap() returns error when fails to map buffer object. Add the error check and propagate the error. Signed-off-by: Li Zhong <floridsleeves@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: change to enc314_stream_encoder_dp_blank staticYang Yingliang
enc314_stream_encoder_dp_blank is only used in dcn314_dio_stream_encoder.c now, change it to static. Fixes: c55bf690fe79 ("drm/amd/display: Add explicit FIFO disable for DP blank") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Only commit SubVP state after pipe programmingAlvin Lee
[Description] We only want to commit the SubVP config to DMCUB after the main and phantom pipe programming has completed. Commiting the state early can cause issues such as P-State being allowed by the HW early which causes the SubVP state machine to go into a bad state Reviewed-by: Jun Lei <Jun.Lei@amd.com> Acked-by: Brian Chang <Brian.Chang@amd.com> Signed-off-by: Alvin Lee <Alvin.Lee2@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06drm/amd/display: Fix mutex lock in dcn10Daniel Gomez
Removal of DC_FP_* wrappers from dml (9696679bf7ac) provokes a mutex lock [2] on the amdgpu driver. Re-arrange the dcn10 code to avoid locking the mutex by placing the DC_FP_* wrappers around the proper functions. This fixes the following WARN/stacktrace: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 227, name: systemd-udevd preempt_count: 1, expected: 0 CPU: 4 PID: 227 Comm: systemd-udevd Not tainted 6.0.0-rc6-qtec-standard #2 Hardware name: Qtechnology A/S QT5222/QT5221, BIOS v1.0.1 06/07/2021 Call Trace: <TASK> dump_stack_lvl+0x33/0x42 __might_resched.cold.172+0xa5/0xb3 mutex_lock+0x1a/0x40 amdgpu_dpm_get_clock_by_type_with_voltage+0x38/0x70 [amdgpu] dm_pp_get_clock_levels_by_type_with_voltage+0x64/0xa0 [amdgpu] dcn_bw_update_from_pplib+0x70/0x340 [amdgpu] dcn10_create_resource_pool+0x8c8/0xd20 [amdgpu] ? __kmalloc+0x1c7/0x4a0 dc_create_resource_pool+0xe7/0x190 [amdgpu] dc_create+0x212/0x5d0 [amdgpu] amdgpu_dm_init+0x246/0x370 [amdgpu] ? schedule_hrtimeout_range_clock+0x93/0x120 ? phm_wait_for_register_unequal.part.1+0x4a/0x80 [amdgpu] dm_hw_init+0xe/0x20 [amdgpu] amdgpu_device_init.cold.56+0x1324/0x1653 [amdgpu] ? pci_bus_read_config_word+0x43/0x80 amdgpu_driver_load_kms+0x15/0x120 [amdgpu] amdgpu_pci_probe+0x116/0x320 [amdgpu] pci_device_probe+0x97/0x110 really_probe+0xdd/0x340 __driver_probe_device+0x80/0x170 driver_probe_device+0x1f/0x90 __driver_attach+0xdc/0x180 ? __device_attach_driver+0x100/0x100 ? __device_attach_driver+0x100/0x100 bus_for_each_dev+0x74/0xc0 bus_add_driver+0x19e/0x210 ? kset_find_obj+0x30/0xa0 ? 0xffffffffa0a5b000 driver_register+0x6b/0xc0 ? 0xffffffffa0a5b000 do_one_initcall+0x4a/0x1f0 ? __vunmap+0x28e/0x2f0 ? __cond_resched+0x15/0x30 ? kmem_cache_alloc_trace+0x3d/0x440 do_init_module+0x4a/0x1e0 load_module+0x1cba/0x1e10 ? __do_sys_finit_module+0xb7/0x120 __do_sys_finit_module+0xb7/0x120 do_syscall_64+0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7ff2b5f5422d Code: 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c3 ab 0e 00 f7 d8 64 89 01 48 RSP: 002b:00007ffc44ab28e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000555c566a9240 RCX: 00007ff2b5f5422d RDX: 0000000000000000 RSI: 00007ff2b60bb353 RDI: 0000000000000019 RBP: 00007ff2b60bb353 R08: 0000000000000000 R09: 0000555c566a9240 R10: 0000000000000019 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000020000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Fixes: 9696679bf7ac ("drm/amd/display: remove DC_FP_* wrapper from dml folder") Reviewed-by: Hamza Mahfooz <hamza.mahfooz@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Daniel Gomez <daniel@qtec.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2022-10-06random: clear new batches when bringing new CPUs onlineJason A. Donenfeld
The commit that added the new get_random_{u8,u16}() functions neglected to update the code that clears the batches when bringing up a new CPU. It also forgot a few comments and helper defines, so add those in too. Fixes: 585cd5fe9f73 ("random: add 8-bit and 16-bit batches") Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2022-10-06mmc: core: Add SD card quirk for broken discardAvri Altman
Some SD-cards from Sandisk that are SDA-6.0 compliant reports they supports discard, while they actually don't. This might cause mk2fs to fail while trying to format the card and revert it to a read-only mode. To fix this problem, let's add a card quirk (MMC_QUIRK_BROKEN_SD_DISCARD) to indicate that we shall fall-back to use the legacy erase command instead. Signed-off-by: Avri Altman <avri.altman@wdc.com> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220928095744.16455-1-avri.altman@wdc.com [Ulf: Updated the commit message] Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2022-10-06xen/gntdev: Accommodate VMA splittingM. Vefa Bicakci
Prior to this commit, the gntdev driver code did not handle the following scenario correctly with paravirtualized (PV) Xen domains: * User process sets up a gntdev mapping composed of two grant mappings (i.e., two pages shared by another Xen domain). * User process munmap()s one of the pages. * User process munmap()s the remaining page. * User process exits. In the scenario above, the user process would cause the kernel to log the following messages in dmesg for the first munmap(), and the second munmap() call would result in similar log messages: BUG: Bad page map in process doublemap.test pte:... pmd:... page:0000000057c97bff refcount:1 mapcount:-1 \ mapping:0000000000000000 index:0x0 pfn:... ... page dumped because: bad pte ... file:gntdev fault:0x0 mmap:gntdev_mmap [xen_gntdev] readpage:0x0 ... Call Trace: <TASK> dump_stack_lvl+0x46/0x5e print_bad_pte.cold+0x66/0xb6 unmap_page_range+0x7e5/0xdc0 unmap_vmas+0x78/0xf0 unmap_region+0xa8/0x110 __do_munmap+0x1ea/0x4e0 __vm_munmap+0x75/0x120 __x64_sys_munmap+0x28/0x40 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x61/0xcb ... For each munmap() call, the Xen hypervisor (if built with CONFIG_DEBUG) would print out the following and trigger a general protection fault in the affected Xen PV domain: (XEN) d0v... Attempt to implicitly unmap d0's grant PTE ... (XEN) d0v... Attempt to implicitly unmap d0's grant PTE ... As of this writing, gntdev_grant_map structure's vma field (referred to as map->vma below) is mainly used for checking the start and end addresses of mappings. However, with split VMAs, these may change, and there could be more than one VMA associated with a gntdev mapping. Hence, remove the use of map->vma and rely on map->pages_vm_start for the original start address and on (map->count << PAGE_SHIFT) for the original mapping size. Let the invalidate() and find_special_page() hooks use these. Also, given that there can be multiple VMAs associated with a gntdev mapping, move the "mmu_interval_notifier_remove(&map->notifier)" call to the end of gntdev_put_map, so that the MMU notifier is only removed after the closing of the last remaining VMA. Finally, use an atomic to prevent inadvertent gntdev mapping re-use, instead of using the map->live_grants atomic counter and/or the map->vma pointer (the latter of which is now removed). This prevents the userspace from mmap()'ing (with MAP_FIXED) a gntdev mapping over the same address range as a previously set up gntdev mapping. This scenario can be summarized with the following call-trace, which was valid prior to this commit: mmap gntdev_mmap mmap (repeat mmap with MAP_FIXED over the same address range) gntdev_invalidate unmap_grant_pages (sets 'being_removed' entries to true) gnttab_unmap_refs_async unmap_single_vma gntdev_mmap (maps the shared pages again) munmap gntdev_invalidate unmap_grant_pages (no-op because 'being_removed' entries are true) unmap_single_vma (For PV domains, Xen reports that a granted page is being unmapped and triggers a general protection fault in the affected domain, if Xen was built with CONFIG_DEBUG) The fix for this last scenario could be worth its own commit, but we opted for a single commit, because removing the gntdev_grant_map structure's vma field requires guarding the entry to gntdev_mmap(), and the live_grants atomic counter is not sufficient on its own to prevent the mmap() over a pre-existing mapping. Link: https://github.com/QubesOS/qubes-issues/issues/7631 Fixes: ab31523c2fca ("xen/gntdev: allow usermode to map granted pages") Cc: stable@vger.kernel.org Signed-off-by: M. Vefa Bicakci <m.v.b@runbox.com> Reviewed-by: Juergen Gross <jgross@suse.com> Link: https://lore.kernel.org/r/20221002222006.2077-3-m.v.b@runbox.com Signed-off-by: Juergen Gross <jgross@suse.com>
2022-10-06xen/gntdev: Prevent leaking grantsM. Vefa Bicakci
Prior to this commit, if a grant mapping operation failed partially, some of the entries in the map_ops array would be invalid, whereas all of the entries in the kmap_ops array would be valid. This in turn would cause the following logic in gntdev_map_grant_pages to become invalid: for (i = 0; i < map->count; i++) { if (map->map_ops[i].status == GNTST_okay) { map->unmap_ops[i].handle = map->map_ops[i].handle; if (!use_ptemod) alloced++; } if (use_ptemod) { if (map->kmap_ops[i].status == GNTST_okay) { if (map->map_ops[i].status == GNTST_okay) alloced++; map->kunmap_ops[i].handle = map->kmap_ops[i].handle; } } } ... atomic_add(alloced, &map->live_grants); Assume that use_ptemod is true (i.e., the domain mapping the granted pages is a paravirtualized domain). In the code excerpt above, note that the "alloced" variable is only incremented when both kmap_ops[i].status and map_ops[i].status are set to GNTST_okay (i.e., both mapping operations are successful). However, as also noted above, there are cases where a grant mapping operation fails partially, breaking the assumption of the code excerpt above. The aforementioned causes map->live_grants to be incorrectly set. In some cases, all of the map_ops mappings fail, but all of the kmap_ops mappings succeed, meaning that live_grants may remain zero. This in turn makes it impossible to unmap the successfully grant-mapped pages pointed to by kmap_ops, because unmap_grant_pages has the following snippet of code at its beginning: if (atomic_read(&map->live_grants) == 0) return; /* Nothing to do */ In other cases where only some of the map_ops mappings fail but all kmap_ops mappings succeed, live_grants is made positive, but when the user requests unmapping the grant-mapped pages, __unmap_grant_pages_done will then make map->live_grants negative, because the latter function does not check if all of the pages that were requested to be unmapped were actually unmapped, and the same function unconditionally subtracts "data->count" (i.e., a value that can be greater than map->live_grants) from map->live_grants. The side effects of a negative live_grants value have not been studied. The net effect of all of this is that grant references are leaked in one of the above conditions. In Qubes OS v4.1 (which uses Xen's grant mechanism extensively for X11 GUI isolation), this issue manifests itself with warning messages like the following to be printed out by the Linux kernel in the VM that had granted pages (that contain X11 GUI window data) to dom0: "g.e. 0x1234 still pending", especially after the user rapidly resizes GUI VM windows (causing some grant-mapping operations to partially or completely fail, due to the fact that the VM unshares some of the pages as part of the window resizing, making the pages impossible to grant-map from dom0). The fix for this issue involves counting all successful map_ops and kmap_ops mappings separately, and then adding the sum to live_grants. During unmapping, only the number of successfully unmapped grants is subtracted from live_grants. The code is also modified to check for negative live_grants values after the subtraction and warn the user. Link: https://github.com/QubesOS/qubes-issues/issues/7631 Fixes: dbe97cff7dd9 ("xen/gntdev: Avoid blocking in unmap_grant_pages()") Cc: stable@vger.kernel.org Signed-off-by: M. Vefa Bicakci <m.v.b@runbox.com> Acked-by: Demi Marie Obenour <demi@invisiblethingslab.com> Reviewed-by: Juergen Gross <jgross@suse.com> Link: https://lore.kernel.org/r/20221002222006.2077-2-m.v.b@runbox.com Signed-off-by: Juergen Gross <jgross@suse.com>
2022-10-06xen/virtio: Fix potential deadlock when accessing xen_grant_dma_devicesOleksandr Tyshchenko
As find_xen_grant_dma_data() is called from both interrupt and process contexts, the access to xen_grant_dma_devices XArray must be protected by xa_lock_irqsave to avoid deadlock scenario. As XArray API doesn't provide xa_store_irqsave helper, call lockless __xa_store directly and guard it externally. Also move the storage of the XArray's entry to a separate helper. Fixes: d6aca3504c7d ("xen/grant-dma-ops: Add option to restrict memory access under Xen") Signed-off-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Reviewed-by: Juergen Gross <jgross@suse.com> Link: https://lore.kernel.org/r/20221005174823.1800761-3-olekstysh@gmail.com Signed-off-by: Juergen Gross <jgross@suse.com>
2022-10-06xen/virtio: Fix n_pages calculation in xen_grant_dma_map(unmap)_page()Oleksandr Tyshchenko
Take page offset into the account when calculating the number of pages to be granted. Fixes: d6aca3504c7d ("xen/grant-dma-ops: Add option to restrict memory access under Xen") Signed-off-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Reviewed-by: Juergen Gross <jgross@suse.com> Link: https://lore.kernel.org/r/20221005174823.1800761-2-olekstysh@gmail.com Signed-off-by: Juergen Gross <jgross@suse.com>
2022-10-06xen/xenbus: Fix spelling mistake "hardward" -> "hardware"Colin Ian King
There is a spelling mistake in the module description. Fix it. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Reviewed-by: Juergen Gross <jgross@suse.com> Link: https://lore.kernel.org/r/20221004160639.154421-1-colin.i.king@gmail.com Signed-off-by: Juergen Gross <jgross@suse.com>
2022-10-06wifi: mt76: fix rate reporting / throughput regression on mt7915 and newerFelix Fietkau
mt7915 and newer need to report the rate_info that's stored in wcid->rate, since they don't fill info->status.rates. Cc: Jonas Jelonek <jelonek.jonas@gmail.com> Reported-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com> Link: https://lore.kernel.org/all/CABXGCsP0znm9pS-MiKtyxTXR7XiyFVqen0qzNpicGHDZKCzbwg@mail.gmail.com/ Fixes: 44fa75f207d8 ("mac80211: extend current rate control tx status API") Signed-off-by: Felix Fietkau <nbd@nbd.name> Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220927093823.6007-1-nbd@nbd.name
2022-10-05net: ethernet: adi: adin1110: Add check in netdev_eventAlexandru Tachici
Check whether this driver actually is the intended recipient of upper change event. Fixes: bc93e19d088b ("net: ethernet: adi: Add ADIN1110 support") Signed-off-by: Alexandru Tachici <alexandru.tachici@analog.com> Link: https://lore.kernel.org/r/20221003111636.54973-1-alexandru.tachici@analog.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-10-05net: pse-pd: PSE_REGULATOR should depend on REGULATORGeert Uytterhoeven
The Regulator based PSE controller driver relies on regulator support to be enabled. If regulator support is disabled, it will still compile fine, but won't operate correctly. Hence add a dependency on REGULATOR, to prevent asking the user about this driver when configuring a kernel without regulator support. Fixes: 66741b4e94ca7bb1 ("net: pse-pd: add regulator based PSE driver") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Oleksij Rempel <o.rempel@pengutronix.de> Link: https://lore.kernel.org/r/709caac8873ff2a8b72b92091429be7c1a939959.1664900558.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-10-05mailbox: qcom-ipcc: flag IRQ NO_THREADEric Chanudet
PREEMPT_RT forces qcom-ipcc's handler to be threaded with interrupts enabled, which triggers a warning in __handle_irq_event_percpu(): irq 173 handler irq_default_primary_handler+0x0/0x10 enabled interrupts WARNING: CPU: 0 PID: 77 at kernel/irq/handle.c:161 __handle_irq_event_percpu+0x4c4/0x4d0 Mark it IRQF_NO_THREAD to avoid running the handler in a threaded context with threadirqs or PREEMPT_RT enabled. Signed-off-by: Eric Chanudet <echanude@redhat.com> Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
2022-10-05mailbox: pcc: Fix spelling mistake "Plaform" -> "Platform"Colin Ian King
There is a spelling mistake in a pr_err message. Fix it. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
2022-10-05mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sgJack Wang
dma_map_sg return 0 on error, fix the error check, and return -EIO to caller. Fixes: dbc049eee730 ("mailbox: Add driver for Broadcom FlexRM ring manager") Signed-off-by: Jack Wang <jinpu.wang@ionos.com> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
2022-10-05mailbox: qcom-apcs-ipc: add IPQ8074 APSS clock supportRobert Marko
IPQ8074 has the APSS clock controller utilizing the same register space as the APCS, so provide access to the APSS utilizing a child device like IPQ6018. IPQ6018 and IPQ8074 use the same controller and driver, so just utilize IPQ6018 match data for IPQ8074. Signed-off-by: Robert Marko <robimarko@gmail.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
2022-10-05mailbox: mpfs: account for mbox offsets while sendingConor Dooley
The mailbox offset is not only used for receiving messages, but it is also used by messages sent to the system controller by Linux that have a payload, such as the "digital signature service". It is also overloaded by certain other services (reprogramming of the FPGA fabric, see Link:) to have a meaning other than the offset the system controller should read from. When the driver was written, no such services of the latter type were in use & those of the former used an offset of zero so this has gone un-noticed. Link: https://www.microsemi.com/document-portal/doc_download/1245815-polarfire-fpga-and-polarfire-soc-fpga-system-services-user-guide # Section 5.2 Fixes: 83d7b1560810 ("mbox: add polarfire soc system controller mailbox") Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
2022-10-05mailbox: mpfs: fix handling of the reg propertyConor Dooley
The "data" region of the PolarFire SoC's system controller mailbox is not one continuous register space - the system controller's QSPI sits between the control and data registers. Split the "data" reg into two parts: "data" & "control". Optionally get the "data" register address from the 3rd reg property in the devicetree & fall back to using the old base + MAILBOX_REG_OFFSET that the current code uses. Fixes: 83d7b1560810 ("mbox: add polarfire soc system controller mailbox") Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
generated by cgit v1.2.3 (git 2.46.0) at 2025-07-31 01:01:26 +0000