linux-stable.git/drivers/misc, branch v6.3.7

misc: fastrpc: Pass proper scm arguments for secure map request

2023-06-09T08:48:19+00:00

[ Upstream commit a6e766dea0a22918735176e4af862d535962f11e ]

If a map request is made with securemap attribute, the memory
ownership needs to be reassigned to new VMID to allow access
from protection domain. Currently only DSP VMID is passed to
the reassign call which is incorrect as only a combination of
HLOS and DSP VMID is allowed for memory ownership reassignment
and passing only DSP VMID will cause assign call failure.

Also pass proper restoring permissions to HLOS as the source
permission will now carry both HLOS and DSP VMID permission.

Change is also made to get valid physical address from
scatter/gather for this allocation request.

Fixes: e90d91190619 ("misc: fastrpc: Add support to secure memory map")
Cc: stable 
Tested-by: Ekansh Gupta 
Signed-off-by: Ekansh Gupta 
Signed-off-by: Srinivas Kandagatla 
Link: https://lore.kernel.org/r/20230523152550.438363-2-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

firmware: qcom_scm: Use fixed width src vm bitmap

2023-06-09T08:48:18+00:00

[ Upstream commit 968a26a07f75377afbd4f7bb18ef587a1443c244 ]

The maximum VMID for assign_mem is 63. Use a u64 to represent this
bitmap instead of architecture-dependent "unsigned int" which varies in
size on 32-bit and 64-bit platforms.

Acked-by: Kalle Valo  (ath10k)
Tested-by: Gokul krishna Krishnakumar 
Signed-off-by: Elliot Berman 
Reviewed-by: Bjorn Andersson 
Signed-off-by: Bjorn Andersson 
Link: https://lore.kernel.org/r/20230213181832.3489174-1-quic_eberman@quicinc.com
Stable-dep-of: a6e766dea0a2 ("misc: fastrpc: Pass proper scm arguments for secure map request")
Signed-off-by: Sasha Levin

misc: fastrpc: reject new invocations during device removal

2023-06-09T08:48:16+00:00

commit 46248400d81e2aa0b65cd659d6f40188192a58b6 upstream.

The channel's rpmsg object allows new invocations to be made. After old
invocations are already interrupted, the driver shouldn't try to invoke
anymore. Invalidating the rpmsg at the end of the driver removal
function makes it easy to cause a race condition in userspace. Even
closing a file descriptor before the driver finishes its cleanup can
cause an invocation via fastrpc_release_current_dsp_process() and
subsequent timeout.

Invalidate the channel before the invocations are interrupted to make
sure that no invocations can be created to hang after the device closes.

Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: stable 
Signed-off-by: Richard Acayan 
Signed-off-by: Srinivas Kandagatla 
Link: https://lore.kernel.org/r/20230523152550.438363-5-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman

misc: fastrpc: return -EPIPE to invocations on device removal

2023-06-09T08:48:16+00:00

commit b6a062853ddf6b4f653af2d8b75ba45bb9a036ad upstream.

The return value is initialized as -1, or -EPERM. The completion of an
invocation implies that the return value is set appropriately, but
"Permission denied" does not accurately describe the outcome of the
invocation. Set the invocation's return value to a more appropriate
"Broken pipe", as the cleanup breaks the driver's connection with rpmsg.

Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: stable 
Signed-off-by: Richard Acayan 
Reviewed-by: Srinivas Kandagatla 
Signed-off-by: Srinivas Kandagatla 
Link: https://lore.kernel.org/r/20230523152550.438363-4-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Greg Kroah-Hartman

misc: fastrpc: Reassign memory ownership only for remote heap

2023-06-09T08:48:15+00:00

commit 3c7d0079a1831118ef232bd9c2f34d058a1f31c2 upstream.

The userspace map request for remote heap allocates CMA memory.
The ownership of this memory needs to be reassigned to proper
owners to allow access from the protection domain running on
DSP. This reassigning of ownership is not correct if done for
any other supported flags.

When any other flag is requested from userspace, fastrpc is
trying to reassign the ownership of memory and this reassignment
is getting skipped for remote heap request which is incorrect.
Add proper flag check to reassign the memory only if remote heap
is requested.

Fixes: 532ad70c6d44 ("misc: fastrpc: Add mmap request assigning for static PD pool")
Cc: stable 
Tested-by: Ekansh Gupta 
Signed-off-by: Ekansh Gupta 
Reviewed-by: Srinivas Kandagatla 
Signed-off-by: Srinivas Kandagatla 
Link: https://lore.kernel.org/r/20230523152550.438363-3-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman

lkdtm/stackleak: Fix noinstr violation

2023-05-24T16:30:10+00:00

[ Upstream commit f571da059f86fd9d432aea32c9c7e5aaa53245d8 ]

Fixes the following warning:

  vmlinux.o: warning: objtool: check_stackleak_irqoff+0x2b6: call to _printk() leaves .noinstr.text section

Signed-off-by: Josh Poimboeuf 
Signed-off-by: Peter Zijlstra (Intel) 
Link: https://lore.kernel.org/r/ee5209f53aa0a62aea58be18f2b78b17606779a6.1681320026.git.jpoimboe@kernel.org
Signed-off-by: Sasha Levin

vmci_host: fix a race condition in vmci_host_poll() causing GPF

2023-05-11T14:17:25+00:00

[ Upstream commit ae13381da5ff0e8e084c0323c3cc0a945e43e9c7 ]

During fuzzing, a general protection fault is observed in
vmci_host_poll().

general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf]
RIP: 0010:__lock_acquire+0xf3/0x5e00 kernel/locking/lockdep.c:4926
<- omitting registers ->
Call Trace:
 
 lock_acquire+0x1a4/0x4a0 kernel/locking/lockdep.c:5672
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xb3/0x100 kernel/locking/spinlock.c:162
 add_wait_queue+0x3d/0x260 kernel/sched/wait.c:22
 poll_wait include/linux/poll.h:49 [inline]
 vmci_host_poll+0xf8/0x2b0 drivers/misc/vmw_vmci/vmci_host.c:174
 vfs_poll include/linux/poll.h:88 [inline]
 do_pollfd fs/select.c:873 [inline]
 do_poll fs/select.c:921 [inline]
 do_sys_poll+0xc7c/0x1aa0 fs/select.c:1015
 __do_sys_ppoll fs/select.c:1121 [inline]
 __se_sys_ppoll+0x2cc/0x330 fs/select.c:1101
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

Example thread interleaving that causes the general protection fault
is as follows:

CPU1 (vmci_host_poll)               CPU2 (vmci_host_do_init_context)
-----                               -----
// Read uninitialized context
context = vmci_host_dev->context;
                                    // Initialize context
                                    vmci_host_dev->context = vmci_ctx_create();
                                    vmci_host_dev->ct_type = VMCIOBJ_CONTEXT;

if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) {
    // Dereferencing the wrong pointer
    poll_wait(..., &context->host_context);
}

In this scenario, vmci_host_poll() reads vmci_host_dev->context first,
and then reads vmci_host_dev->ct_type to check that
vmci_host_dev->context is initialized. However, since these two reads
are not atomically executed, there is a chance of a race condition as
described above.

To fix this race condition, read vmci_host_dev->context after checking
the value of vmci_host_dev->ct_type so that vmci_host_poll() always
reads an initialized context.

Reported-by: Dae R. Jeong 
Fixes: 8bf503991f87 ("VMCI: host side driver implementation.")
Signed-off-by: Dae R. Jeong 
Link: https://lore.kernel.org/r/ZCGFsdBAU4cYww5l@dragonet
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

misc: ad525x_dpot-i2c: Convert to i2c's .probe_new()

2023-03-09T20:58:45+00:00

.probe_new() doesn't get the i2c_device_id * parameter, so determine
that explicitly in the probe function.

Acked-by: Greg Kroah-Hartman 
Link: https://lore.kernel.org/lkml/20221118224540.619276-483-uwe@kleine-koenig.org
Signed-off-by: Uwe Kleine-König 
Signed-off-by: Wolfram Sang

Merge tag 'soc-drivers-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

2023-02-27T18:04:49+00:00

Pull ARM SoC driver updates from Arnd Bergmann:
 "As usual, there are lots of minor driver changes across SoC platforms
  from NXP, Amlogic, AMD Zynq, Mediatek, Qualcomm, Apple and Samsung.
  These usually add support for additional chip variations in existing
  drivers, but also add features or bugfixes.

  The SCMI firmware subsystem gains a unified raw userspace interface
  through debugfs, which can be used for validation purposes.

  Newly added drivers include:

   - New power management drivers for StarFive JH7110, Allwinner D1 and
     Renesas RZ/V2M

   - A driver for Qualcomm battery and power supply status

   - A SoC device driver for identifying Nuvoton WPCM450 chips

   - A regulator coupler driver for Mediatek MT81xxv"

* tag 'soc-drivers-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (165 commits)
  power: supply: Introduce Qualcomm PMIC GLINK power supply
  soc: apple: rtkit: Do not copy the reg state structure to the stack
  soc: sunxi: SUN20I_PPU should depend on PM
  memory: renesas-rpc-if: Remove redundant division of dummy
  soc: qcom: socinfo: Add IDs for IPQ5332 and its variant
  dt-bindings: arm: qcom,ids: Add IDs for IPQ5332 and its variant
  dt-bindings: power: qcom,rpmpd: add RPMH_REGULATOR_LEVEL_LOW_SVS_L1
  firmware: qcom_scm: Move qcom_scm.h to include/linux/firmware/qcom/
  MAINTAINERS: Update qcom CPR maintainer entry
  dt-bindings: firmware: document Qualcomm SM8550 SCM
  dt-bindings: firmware: qcom,scm: add qcom,scm-sa8775p compatible
  soc: qcom: socinfo: Add Soc IDs for IPQ8064 and variants
  dt-bindings: arm: qcom,ids: Add Soc IDs for IPQ8064 and variants
  soc: qcom: socinfo: Add support for new field in revision 17
  soc: qcom: smd-rpm: Add IPQ9574 compatible
  soc: qcom: pmic_glink: remove redundant calculation of svid
  soc: qcom: stats: Populate all subsystem debugfs files
  dt-bindings: soc: qcom,rpmh-rsc: Update to allow for generic nodes
  soc: qcom: pmic_glink: add CONFIG_NET/CONFIG_OF dependencies
  soc: qcom: pmic_glink: Introduce altmode support
  ...

Merge tag 'pci-v6.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci

2023-02-25T00:51:40+00:00

Pull PCI updates from Bjorn Helgaas:
 "Enumeration:

   - Rework portdrv shutdown so it disables interrupts but doesn't
     disable bus mastering, which leads to hangs on Loongson LS7A

   - Add mechanism to prevent Max_Read_Request_Size (MRRS) increases,
     again to avoid hardware issues on Loongson LS7A (and likely other
     devices based on DesignWare IP)

   - Ignore devices with a firmware (DT or ACPI) node that says the
     device is disabled

  Resource management:

   - Distribute spare resources to unconfigured hotplug bridges at
     boot-time (not just when hot-adding such a bridge), which makes
     hot-adding devices to docks work better. Tried this in v6.1 but had
     to revert for regressions, so try again

   - Fix root bus issue that dropped resources that happened to end
     at 0, e.g., [bus 00]

  PCI device hotplug:

   - Remove device locking when marking device as disconnected so this
     doesn't have to wait for concurrent driver bind/unbind to complete

   - Quirk more Qualcomm bridges that don't fully implement the PCIe
     Slot Status 'Command Completed' bit

  Power management:

   - Account for _S0W of the target bridge in acpi_pci_bridge_d3() so we
     don't miss hot-add notifications for USB4 docks, Thunderbolt, etc

  Reset:

   - Observe delay after reset, e.g., resuming from system sleep,
     regardless of whether a bridge can suspend to D3cold at runtime

   - Wait for secondary bus to become ready after a bridge reset

  Virtualization:

   - Avoid FLR on some AMD FCH AHCI adapters where it doesn't work

   - Allow independent IOMMU groups for some Wangxun NICs that prevent
     peer-to-peer transactions but don't advertise an ACS Capability

  Error handling:

   - Configure End-to-End-CRC (ECRC) only if Linux owns the AER
     Capability

   - Remove redundant Device Control Error Reporting Enable in the AER
     service driver since this is already done for all devices during
     enumeration

  ASPM:

   - Add pci_enable_link_state() interface to allow drivers to enable
     ASPM link state

  Endpoint framework:

   - Move dra7xx and tegra194 linkup processing from hard IRQ to
     threaded IRQ handler

   - Add a separate lock for endpoint controller list of endpoint
     function drivers to prevent deadlock in callbacks

   - Pass events from endpoint controller to endpoint function drivers
     via callbacks instead of notifiers

  Synopsys DesignWare eDMA controller driver (acked by Vinod):

   - Fix CPU vs PCI address issues

   - Fix source vs destination address issues

   - Fix issues with interleaved transfer semantics

   - Fix channel count initialization issue (issue still exists in
     several other drivers)

   - Clean up and improve debugfs usage so it will work on platforms
     with several eDMA devices

  Baikal T-1 PCIe controller driver:

   - Set a 64-bit DMA mask

  Freescale i.MX6 PCIe controller driver:

   - Add i.MX8MM, i.MX8MQ, i.MX8MP endpoint mode DT binding and driver
     support

  Intel VMD host bridge driver:

   - Add quirk to configure PCIe ASPM and LTR. This is normally done by
     BIOS, and will be for future products

  Marvell MVEBU PCIe controller driver:

   - Mark this driver as broken in Kconfig since bugs prevent its daily
     usage

  MediaTek MT7621 PCIe controller driver:

   - Delay PHY port initialization to improve boot reliability for ZBT
     WE1326, ZBT WF3526-P, and some Netgear models

  Qualcomm PCIe controller driver:

   - Add MSM8998 DT compatible string

   - Unify MSM8996 and MSM8998 clock orderings

   - Add SM8350 DT binding and driver support

   - Add IPQ8074 Gen3 DT binding and driver support

   - Correct qcom,perst-regs in DT binding

   - Add qcom_pcie_host_deinit() so the PHY is powered off and
     regulators and clocks are disabled on late host-init errors

  Socionext UniPhier Pro5 controller driver:

   - Clean up uniphier-ep reg, clocks, resets, and their names in DT
     binding

  Synopsys DesignWare PCIe controller driver:

   - Restrict coherent DMA mask to 32 bits for MSI, but allow controller
     drivers to set 64-bit streaming DMA mask

   - Add eDMA engine support in both Root Port and Endpoint controllers

  Miscellaneous:

   - Remove MODULE_LICENSE from boolean drivers so they don't look like
     modules so modprobe can complain about them"

* tag 'pci-v6.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (86 commits)
  PCI: dwc: Add Root Port and Endpoint controller eDMA engine support
  PCI: bt1: Set 64-bit DMA mask
  PCI: dwc: Restrict only coherent DMA mask for MSI address allocation
  dmaengine: dw-edma: Prepare dw_edma_probe() for builtin callers
  dmaengine: dw-edma: Depend on DW_EDMA instead of selecting it
  dmaengine: dw-edma: Add mem-mapped LL-entries support
  PCI: Remove MODULE_LICENSE so boolean drivers don't look like modules
  PCI: hv: Drop duplicate PCI_MSI dependency
  PCI/P2PDMA: Annotate RCU dereference
  PCI/sysfs: Constify struct kobj_type pci_slot_ktype
  PCI: hotplug: Allow marking devices as disconnected during bind/unbind
  PCI: pciehp: Add Qualcomm quirk for Command Completed erratum
  PCI: qcom: Add IPQ8074 Gen3 port support
  dt-bindings: PCI: qcom: Add IPQ8074 Gen3 port
  dt-bindings: PCI: qcom: Sort compatibles alphabetically
  PCI: qcom: Fix host-init error handling
  PCI: qcom: Add SM8350 support
  dt-bindings: PCI: qcom: Add SM8350
  dt-bindings: PCI: qcom-ep: Correct qcom,perst-regs
  dt-bindings: PCI: qcom: Unify MSM8996 and MSM8998 clock order
  ...