9eda09e511
988521 Commits
Author | SHA1 | Message | Date | |
---|---|---|---|---|
|
9eda09e511 |
UPSTREAM: ASoC: hdmi-codec: Add a prepare hook
The IEC958 status bit is usually set by the userspace after hw_params has been called, so in order to use whatever is set by the userspace, we need to implement the prepare hook. Let's add it to the hdmi_codec_ops, and mandate that either prepare or hw_params is implemented. Bug: 239396464 Change-Id: I06ccde5d8185955bb60783b597f0205811460968 Signed-off-by: Maxime Ripard <maxime@cerno.tech> Acked-by: Mark Brown <broonie@kernel.org> Link: https://lore.kernel.org/r/20210525132354.297468-6-maxime@cerno.tech Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com> (cherry picked from commit 2fef64eec23a0840c97977b16dd8919afaffa876) |
||
|
4ad97b395f |
UPSTREAM: ASoC: hdmi-codec: Add iec958 controls
The IEC958 status bits can be exposed and modified by the userspace through dedicated ALSA controls. This patch implements those controls for the hdmi-codec driver. It relies on a default value being setup at probe time that can later be overridden by the control put. The hw_params callback is then called with a buffer filled with the proper bits for the current parameters being passed on so the underlying driver can just reuse those bits as is. Bug: 239396464 Change-Id: I99f37b7e74655687e73a75ba19fd2de8041f8646 Signed-off-by: Maxime Ripard <maxime@cerno.tech> Acked-by: Mark Brown <broonie@kernel.org> Link: https://lore.kernel.org/r/20210525132354.297468-5-maxime@cerno.tech Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com> (cherry picked from commit 7a8e1d44211e16eb394b7b9e0b236ee1503a3ad3) |
||
|
c0c2f6962d |
UPSTREAM: ASoC: hdmi-codec: Rework to support more controls
We're going to add more controls to support the IEC958 output, so let's rework the control registration a bit to support more of them. Bug: 239396464 Change-Id: Ia8c0bf8c997638b5a121ae7356fa1eb27746036f Signed-off-by: Maxime Ripard <maxime@cerno.tech> Acked-by: Mark Brown <broonie@kernel.org> Link: https://lore.kernel.org/r/20210525132354.297468-4-maxime@cerno.tech Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com> (cherry picked from commit 366b45b974481bea9603843d308aded519aab7dc) |
||
|
4c6eb3db8a |
UPSTREAM: ALSA: iec958: Split status creation and fill
In some situations, like a codec probe, we need to provide an IEC status default but don't have access to the sampling rate and width yet since no stream has been configured yet. Each and every driver has its own default, whereas the core iec958 code also has some buried in the snd_pcm_create_iec958_consumer functions. Let's split these functions in two to provide a default that doesn't rely on the sampling rate and width, and another function to fill them when available. Bug: 239396464 Change-Id: I277899145367b219b337bc796f2faee8c4917082 Signed-off-by: Maxime Ripard <maxime@cerno.tech> Reviewed-by: Takashi Iwai <tiwai@suse.de> Link: https://lore.kernel.org/r/20210525132354.297468-3-maxime@cerno.tech Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com> (cherry picked from commit 9eafc11f921b8cb7d7e28ab1fdcf6b92fcbcb0be) |
||
|
580d2e7c78 |
UPSTREAM: ALSA: doc: Clarify IEC958 controls iface
The doc currently mentions that the IEC958 Playback Default should be exposed on the PCM iface, and the Playback Mask on the mixer iface. It's a bit confusing to advise to have two related controls on two separate ifaces, and it looks like the drivers that currently expose those controls use any combination of the mixer and PCM ifaces. Let's try to clarify the situation a bit, and encourage to at least have the controls on the same iface. Bug: 239396464 Change-Id: Ie0fb033564972f74154c378c644c581dc4d06dfa Signed-off-by: Maxime Ripard <maxime@cerno.tech> Reviewed-by: Takashi Iwai <tiwai@suse.de> Link: https://lore.kernel.org/r/20210525132354.297468-2-maxime@cerno.tech Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com> (cherry picked from commit aa7899537a4ec63ac3d58c9ece945c2750d22168) |
||
|
8b4bb1bca0 |
UPSTREAM: ASoC: hdmi-codec: remove unused spk_mask member
fix cppcheck warning: sound/soc/codecs/hdmi-codec.c:25:16: style: struct member 'hdmi_codec_channel_map_table::spk_mask' is never used. [unusedStructMember] unsigned long spk_mask; /* speaker position bit mask */ ^ Bug: 239396464 Change-Id: I235b7757db88bfbd059ad0f9795908fbfbb1cfdb Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Link: https://lore.kernel.org/r/20210312182246.5153-12-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com> (cherry picked from commit 9ad869fee5c598d914fa5cf8fb26f5e106e90956) |
||
|
5a2c4a5d1e |
UPSTREAM: ASoC: hdmi-codec: remove useless initialization
Fix cppcheck warning: sound/soc/codecs/hdmi-codec.c:745:5: style: Redundant initialization for 'cf'. The initialized value is overwritten before it is read. [redundantInitialization] cf = dai->playback_dma_data; ^ sound/soc/codecs/hdmi-codec.c:738:31: note: cf is initialized struct hdmi_codec_daifmt *cf = dai->playback_dma_data; ^ sound/soc/codecs/hdmi-codec.c:745:5: note: cf is overwritten cf = dai->playback_dma_data; ^ Bug: 239396464 Change-Id: Ia903635862e043207929827afcaeb531e6344283 Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Link: https://lore.kernel.org/r/20210312182246.5153-11-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com> (cherry picked from commit 3c011ef344cddd15be0a9b2256f7886f6b5eeec5) |
||
|
49e502f0c0 |
UPSTREAM: ASoC: codec: hdmi-codec: Support IEC958 encoded PCM format
Existing hdmi-codec driver only support standard pcm format. Support of IEC958 encoded format pass from ALSA IEC958 plugin is needed so that the IEC958 encoded data can be streamed to the HDMI chip. Bug: 239396464 Change-Id: I01516e34605e380995b5312273035a0d000d36f1 Signed-off-by: Sia Jee Heng <jee.heng.sia@intel.com> Link: https://lore.kernel.org/r/20210204014258.10197-2-jee.heng.sia@intel.com Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com> (cherry picked from commit 28785f548d18e6d52785a1172e5c176784ce74cd) |
||
|
9bf69acb92 |
UPSTREAM: ASoC: hdmi-codec: Fix return value in hdmi_codec_set_jack()
Sound is broken on the DragonBoard 410c (apq8016_sbc) since 5.10:
hdmi-audio-codec hdmi-audio-codec.1.auto: ASoC: error at snd_soc_component_set_jack on hdmi-audio-codec.1.auto: -95
qcom-apq8016-sbc 7702000.sound: Failed to set jack: -95
ADV7533: ASoC: error at snd_soc_link_init on ADV7533: -95
hdmi-audio-codec hdmi-audio-codec.1.auto: ASoC: error at snd_soc_component_set_jack on hdmi-audio-codec.1.auto: -95
qcom-apq8016-sbc: probe of 7702000.sound failed with error -95
This happens because apq8016_sbc calls snd_soc_component_set_jack() on
all codec DAIs and attempts to ignore failures with return code -ENOTSUPP.
-ENOTSUPP is also excluded from error logging in soc_component_ret().
However, hdmi_codec_set_jack() returns -E*OP*NOTSUPP if jack detection
is not supported, which is not handled in apq8016_sbc and soc_component_ret().
Make it return -ENOTSUPP instead to fix sound and silence the errors.
Bug: 239396464
Change-Id: Id38ce1cdfc80daaac7d77212cecd29dd6fa4e877
Cc: Cheng-Yi Chiang <cychiang@chromium.org>
Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Fixes:
|
||
|
056409c7dc |
UPSTREAM: ASoC: hdmi-codec: Add RX support
HDMI interface can also be used as receiver, this patch is to add such support. The most difference compare with TX is that RX don't need to get edid information. Bug: 239396464 Change-Id: Ib5f9f347cd50abe95fa9c8a4856bd1a91117ca67 Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com> Link: https://lore.kernel.org/r/1606372608-2329-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com> (cherry picked from commit 144f836646989783cb018d00fa69f3f8dab58349) |
||
|
5e75deab3a |
UPSTREAM: ASoC: hdmi-codec: Get ELD in before reporting plugged event
In plugged callback, ELD should be updated from display driver so that user space can query information from ELD immediately after receiving jack plugged event. When jack is unplugged, clear ELD buffer so that user space does not get obsolete information of unplugged HDMI. Bug: 239396464 Change-Id: I2245de6e6f7dbc64863267db864dafdd3af95747 Signed-off-by: Cheng-Yi Chiang <cychiang@chromium.org> Link: https://lore.kernel.org/r/20201118043852.1338877-1-cychiang@chromium.org Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com> (cherry picked from commit 25ce4f2b3593fa6bba70ddabbd2ee297b262784f) |
||
|
d6207c39cb |
ANDROID: GKI: rockchip: Add symbols for display driver
DRM display driver has update, new symbols added. Leaf changes summary: 7 artifacts changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 7 Added functions Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable 7 Added functions: [A] 'function drm_connector_status drm_bridge_detect(drm_bridge*)' [A] 'function int drm_bridge_get_modes(drm_bridge*, drm_connector*)' [A] 'function int drm_dp_get_phy_test_pattern(drm_dp_aux*, drm_dp_phy_test_params*)' [A] 'function int drm_dp_read_dpcd_caps(drm_dp_aux*, u8*)' [A] 'function int drm_dp_set_phy_test_pattern(drm_dp_aux*, drm_dp_phy_test_params*, u8)' [A] 'function void drm_self_refresh_helper_cleanup(drm_crtc*)' [A] 'function int drm_self_refresh_helper_init(drm_crtc*)' Bug: 239396464 Signed-off-by: Kever Yang <kever.yang@rock-chips.com> Change-Id: Ic5728516d6f7146912dc44acddb331be75e3d3f8 |
||
|
1c3ed9d481 |
BACKPORT: KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID
commit 9f46c187e2e680ecd9de7983e4d081c3391acc76 upstream. With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference. Fix it trivially by checking for mmu->invlpg before every call. There are other possibilities: - check for CR0.PG, because KVM (like all Intel processors after P5) flushes guest TLB on CR0.PG changes so that INVPCID/INVLPG are a nop with paging disabled - check for EFER.LMA, because KVM syncs and flushes when switching MMU contexts outside of 64-bit mode All of these are tricky, go for the simple solution. This is CVE-2022-1789. Bug: 235691682 Reported-by: Yongkang Jia <kangel@zju.edu.cn> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> [fix conflict due to missing b9e5603c2a3accbadfec570ac501a54431a6bdba] Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: If558163c4ddd4606274b456324278ed3fb5b093c |
||
|
843d3cb41b |
BACKPORT: io_uring: always grab file table for deferred statx
Lee reports that there's a use-after-free of the process file table.
There's an assumption that we don't need the file table for some
variants of statx invocation, but that turns out to be false and we
end up with not grabbing a reference for the request even if the
deferred execution uses it.
Get rid of the REQ_F_NO_FILE_TABLE optimization for statx, and always
grab that reference.
This issues doesn't exist upstream since the native workers got
introduced with 5.12.
Bug: 220738351
Link: https://lore.kernel.org/io-uring/YoOJ%2FT4QRKC+fAZE@google.com/
Reported-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit
|
||
|
784cc16aed |
BACKPORT: Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
commit d0be8347c623e0ac4202a1d4e0373882821f56b0 upstream. This fixes the following trace which is caused by hci_rx_work starting up *after* the final channel reference has been put() during sock_close() but *before* the references to the channel have been destroyed, so instead the code now rely on kref_get_unless_zero/l2cap_chan_hold_unless_zero to prevent referencing a channel that is about to be destroyed. refcount_t: increment on 0; use-after-free. BUG: KASAN: use-after-free in refcount_dec_and_test+0x20/0xd0 Read of size 4 at addr ffffffc114f5bf18 by task kworker/u17:14/705 CPU: 4 PID: 705 Comm: kworker/u17:14 Tainted: G S W 4.14.234-00003-g1fb6d0bd49a4-dirty #28 Hardware name: Qualcomm Technologies, Inc. SM8150 V2 PM8150 Google Inc. MSM sm8150 Flame DVT (DT) Workqueue: hci0 hci_rx_work Call trace: dump_backtrace+0x0/0x378 show_stack+0x20/0x2c dump_stack+0x124/0x148 print_address_description+0x80/0x2e8 __kasan_report+0x168/0x188 kasan_report+0x10/0x18 __asan_load4+0x84/0x8c refcount_dec_and_test+0x20/0xd0 l2cap_chan_put+0x48/0x12c l2cap_recv_frame+0x4770/0x6550 l2cap_recv_acldata+0x44c/0x7a4 hci_acldata_packet+0x100/0x188 hci_rx_work+0x178/0x23c process_one_work+0x35c/0x95c worker_thread+0x4cc/0x960 kthread+0x1a8/0x1c4 ret_from_fork+0x10/0x18 Bug: 165329981 Cc: stable@kernel.org Reported-by: Lee Jones <lee.jones@linaro.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Tested-by: Lee Jones <lee.jones@linaro.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I6efae55d8014740aebc8c3534846c2d249068b29 |
||
|
2b377175a3 |
ANDROID: add two func in mm/memcontrol.c
- page_to_lruvec: get lruvec from page and pgdat. - do_traversal_all_lruvec: traversal all lruvec and do hookss. Bug: 236578020 Signed-off-by: Peifeng Li <lipeifeng@oppo.com> Change-Id: I3d4f5159faaca1ee71ffa65f2fc1341f51da637c |
||
|
e56f8712cf |
ANDROID: vendor_hooks: protect multi-mapcount pages in kernel
Support two hooks as follows to protect multi-mapcount pages in kernel: - trace_android_vh_page_should_be_protect - trace_android_vh_mapped_page_try_sorthead Bug: 236578020 Signed-off-by: Peifeng Li <lipeifeng@oppo.com> Change-Id: I688aceabf17d9de2feac7c3ad7144d307de6ef29 |
||
|
3f775b9367 |
ANDROID: vendor_hooks: account page-mapcount
Support five hooks as follows to account the amount of multi-mapped pages in kernel: - android_vh_show_mapcount_pages - android_vh_do_traversal_lruvec - android_vh_update_page_mapcount - android_vh_add_page_to_lrulist - android_vh_del_page_from_lrulist Bug: 236578020 Signed-off-by: Peifeng Li <lipeifeng@oppo.com> Change-Id: Ia2c7015aab442be7dbb496b8b630b9dff59ab935 |
||
|
1d2287f56e |
FROMGIT: io_uring: Use original task for req identity in io_identity_cow()
This issue is conceptually identical to the one fixed in |
||
|
e0c9da25b2 |
FROMLIST: binder: fix UAF of ref->proc caused by race condition
A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the reference for a node. In this case, the target proc normally releases the failed reference upon close as expected. However, if the target is dying in parallel the call will race with binder_deferred_release(), so the target could have released all of its references by now leaving the cleanup of the new failed reference unhandled. The transaction then ends and the target proc gets released making the ref->proc now a dangling pointer. Later on, ref->node is closed and we attempt to take spin_lock(&ref->proc->inner_lock), which leads to the use-after-free bug reported below. Let's fix this by cleaning up the failed reference on the spot instead of relying on the target to do so. ================================================================== BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150 Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590 CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10 Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: dump_backtrace.part.0+0x1d0/0x1e0 show_stack+0x18/0x70 dump_stack_lvl+0x68/0x84 print_report+0x2e4/0x61c kasan_report+0xa4/0x110 kasan_check_range+0xfc/0x1a4 __kasan_check_write+0x3c/0x50 _raw_spin_lock+0xa8/0x150 binder_deferred_func+0x5e0/0x9b0 process_one_work+0x38c/0x5f0 worker_thread+0x9c/0x694 kthread+0x188/0x190 ret_from_fork+0x10/0x20 Signed-off-by: Carlos Llamas <cmllamas@google.com> Acked-by: Christian Brauner (Microsoft) <brauner@kernel.org> Bug: 239630375 Link: https://lore.kernel.org/all/20220801182511.3371447-1-cmllamas@google.com/ Signed-off-by: Carlos Llamas <cmllamas@google.com> Change-Id: I5085dd0dc805a780a64c057e5819f82dd8f02868 (cherry picked from commit ae3fa5d16a02ba7c7b170e0e1ab56d6f0ba33964) |
||
|
12f4322442 |
ANDROID: vendor_hooks: Guard cgroup struct with CONFIG_CGROUPS
See commit
|
||
|
6532784c78 |
ANDROID: vendor_hooks: add hooks for remove_vm_area.
Provide a vendor hook to remove additional fields when remove_vm_area for slab/vmalloc memory leak debugging. Bug: 240869642 Signed-off-by: Peifeng Li <lipeifeng@oppo.com> Change-Id: Iafecd7c6e75cdc2df0e77ae105283590d8852f74 |
||
|
c9a70dd592 |
ANDROID: GKI: allow mm vendor hooks header inclusion from header files
Introduce PROTECT_TRACE_INCLUDE_PATH to allow trace/hooks/mm.h to be included from a header file. When trace/hooks/mm.h is included from a header file PROTECT_TRACE_INCLUDE_PATH should be defined before the inclusion so that the existing TRACE_INCLUDE_PATH gets preserved. Bug: 236578020 Signed-off-by: Suren Baghdasaryan <surenb@google.com> Change-Id: Ia5890ba51675de41ff3ea4ab38bcb458202df5fb |
||
|
039080d064 |
ANDROID: Update symbol list of mediatek
Leaf changes summary: 3 artifacts changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 2 Added functions Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 1 Added variable 2 Added functions: [A] 'function int __traceiter_android_vh_sched_pelt_multiplier(void*, unsigned int, unsigned int, int*)' [A] 'function int get_pelt_halflife()' 1 Added variable: [A] 'tracepoint __tracepoint_android_vh_sched_pelt_multiplier' Bug: 240896506 Change-Id: Ied73dce8528005b8e71d639a6ba879d4ac123449 Signed-off-by: JianMin Liu <jian-min.liu@mediatek.com> |
||
|
9e8dedef1e |
ANDROID: sched: add vendor hook to PELT multiplier
We add vendor hook at sched_pelt_multiplier for performance tuning. Bug: 240896506 Change-Id: I10e3436a986dd5dd7d375460922407666f27739d Signed-off-by: Jing-Ting Wu <Jing-Ting.Wu@mediatek.com> Signed-off-by: JianMin Liu <jian-min.liu@mediatek.com> |
||
|
573c7f061d |
ANDROID: Guard hooks with their CONFIG_ options
ANDROID_VENDOR_HOOKS has implicit dependencies on the subsystems which
it hooks into whenever it directly uses an "internal" header for that
system. For instance, drivers/scsi/ufs/ufshcd.h doesn't compile unless
CONFIG_SCSI_UFSHCD is enabled:
In file included from drivers/android/vendor_hooks.c:41:
In file included from include/trace/hooks/ufshcd.h:21:
include/../drivers/scsi/ufs/ufshcd.h:675:38: error: field has incomplete type 'struct devfreq_simple_ondemand_data'
struct devfreq_simple_ondemand_data ondemand_data;
^
include/../drivers/scsi/ufs/ufshcd.h:675:9: note: forward declaration of 'struct devfreq_simple_ondemand_data'
struct devfreq_simple_ondemand_data ondemand_data;
To avoid these implicit dependencies, guard any "internal" header
includes with the respective CONFIG_ options when applicable. If the
CONFIG_ option is not enabled, then the forward-declared structs are
used. This is acceptable because those hooks would not have been called
anyway since the underlying subsytem wasn't enabled.
Fixes: commit
|
||
|
14f646cca5 |
ANDROID: fix kernelci issue for allnoconfig builds
'allnoconfig' builds failed with:
kernel/sched/sched.h:1203:50: error: ‘struct rq’ has no member named ‘cpu’
rq->cpu needs to be replaced with cpu_of(rq) for !CONFIG_SMP builds
Fixes:
|
||
|
4442801a43 |
ANDROID: sched: Introducing PELT multiplier
The new sysctl sched_pelt_multiplier allows a user to set a clock multiplier x2 or x4 (x1 being the default). This clock multiplier artificially speed-up PELT ramp up/down similarly to a faster half-life. Indeed, if we write PELT as a first order filter: y(t) = G * (1 - exp(t/tau)) Then we can see that multiplying the time by a constant X, is the same as dividing the time constant tau by X. y(t) = G * (1 - exp((t*X)/tau)) y(t) = G * (1 - exp(t/(tau/X))) Tau being half-life*ln(2), multiplying the PELT time is the same as dividing the half-life: - x1: 32ms half-life - x2: 16ms half-life - x4: 8ms half-life Internally, a new clock is created: rq->clock_task_mult. It sits in the clock hierarchy between rq->clock_task and rq->clock_pelt. Bug: 177593580 Bug: 237219700 Change-Id: I67e6ca7994bebea22bf75732ee11d2b10e0d6b7e Suggested-by: Morten Rasmussen <morten.rasmussen@arm.com> Signed-off-by: Vincent Donnefort <vincent.donnefort@arm.com> Signed-off-by: JianMin Liu <jian-min.liu@mediatek.com> |
||
|
b2e5773ea4 |
FROMGIT: binder: fix redefinition of seq_file attributes
The patchset in [1] exported some definitions to binder_internal.h in order to make the debugfs entries such as 'stats' and 'transaction_log' available in a binderfs instance. However, the DEFINE_SHOW_ATTRIBUTE macro expands into a static function/variable pair, which in turn get redefined each time a source file includes this internal header. This problem was made evident after a report from the kernel test robot <lkp@intel.com> where several W=1 build warnings are seen in downstream kernels. See the following example: include/../drivers/android/binder_internal.h:111:23: warning: 'binder_stats_fops' defined but not used [-Wunused-const-variable=] 111 | DEFINE_SHOW_ATTRIBUTE(binder_stats); | ^~~~~~~~~~~~ include/linux/seq_file.h:174:37: note: in definition of macro 'DEFINE_SHOW_ATTRIBUTE' 174 | static const struct file_operations __name ## _fops = { \ | ^~~~~~ This patch fixes the above issues by moving back the definitions into binder.c and instead creates an array of the debugfs entries which is more convenient to share with binderfs and iterate through. [1] https://lore.kernel.org/all/20190903161655.107408-1-hridya@google.com/ Fixes: |
||
|
9c2a5eef8f |
Merge tag 'android12-5.10.117_r00' into 'android12-5.10'
This is the merge of the upstream LTS release of 5.10.117 into the android12-5.10 branch. It contains the following commits: |
||
|
5fa1e1affc |
ANDROID: GKI: pcie: Fix the broken dw_pcie structure
This patch fix the break to abi dw_pcie structure and keep other code AS IS. Bug: 239396464 Signed-off-by: Kever Yang <kever.yang@rock-chips.com> Change-Id: I138f28812eb4254671fa353a7541e65bddfc1bda |
||
|
51b3e17071 |
UPSTREAM: PCI: dwc: Support multiple ATU memory regions
The current ATU setup only supports a single memory resource which isn't sufficient if there are also prefetchable memory regions. In order to support multiple memory regions, we need to move away from fixed ATU slots and rework the assignment. As there's always an ATU entry for config space, let's assign index 0 to config space. Then we assign memory resources to index 1 and up. Finally, if we have an I/O region and slots remaining, we assign the I/O region last. If there aren't remaining slots, we keep the same config and I/O space sharing. Bug: 239396464 Link: https://lore.kernel.org/r/20201026181652.418729-1-robh@kernel.org Tested-by: Vidya Sagar <vidyas@nvidia.com> Signed-off-by: Rob Herring <robh@kernel.org> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com> Reviewed-by: Vidya Sagar <vidyas@nvidia.com> Acked-by: Jingoo Han <jingoohan1@gmail.com> Cc: Vidya Sagar <vidyas@nvidia.com> Cc: Jingoo Han <jingoohan1@gmail.com> Cc: Gustavo Pimentel <gustavo.pimentel@synopsys.com> Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com> Cc: Bjorn Helgaas <bhelgaas@google.com> Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com> Signed-off-by: Jon Lin <jon.lin@rock-chips.com> Change-Id: Ib945de723c29a80f055227474a01806283bd1873 (cherry picked from commit 9f9e59a4809563f24e3d1377aa804a4b7386a418) Signed-off-by: Kever Yang <kever.yang@rock-chips.com> |
||
|
a8d7f6518e |
ANDROID: oplus: Update the ABI xml and symbol list
Leaf changes summary: 4 artifacts changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 2 Added functions Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 2 Added variables 2 Added functions: [A] 'function int __traceiter_android_vh_alloc_pages_slowpath_begin(void*, gfp_t, unsigned int, unsigned long int*)' [A] 'function int __traceiter_android_vh_alloc_pages_slowpath_end(void*, gfp_t, unsigned int, unsigned long int)' 2 Added variables: [A] 'tracepoint __tracepoint_android_vh_alloc_pages_slowpath_begin' [A] 'tracepoint __tracepoint_android_vh_alloc_pages_slowpath_end' Bug: 182443489 Signed-off-by: liuhailong <liuhailong@oppo.com> Change-Id: I2745cb53ae192e2ce31726d09d7e9746b77ccce3 |
||
|
4536de1b70 |
ANDROID: vendor_hooks: add hooks in __alloc_pages_slowpath
Since android_vh_alloc_pages_slowpath is revert by
commit
|
||
|
d63c961c9d |
ANDROID: GKI: Update symbols to symbol list
Leaf changes summary: 12 artifacts changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 6 Added functions Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 6 Added variables 6 Added functions: [A] 'function int __traceiter_android_vh_mutex_unlock_slowpath_end(void*, mutex*, task_struct*)' [A] 'function int __traceiter_android_vh_rwsem_mark_wake_readers(void*, rw_semaphore*, rwsem_waiter*)' [A] 'function int __traceiter_android_vh_rwsem_set_owner(void*, rw_semaphore*)' [A] 'function int __traceiter_android_vh_rwsem_set_reader_owned(void*, rw_semaphore*)' [A] 'function int __traceiter_android_vh_rwsem_up_read_end(void*, rw_semaphore*)' [A] 'function int __traceiter_android_vh_rwsem_up_write_end(void*, rw_semaphore*)' 6 Added variables: [A] 'tracepoint __tracepoint_android_vh_mutex_unlock_slowpath_end' [A] 'tracepoint __tracepoint_android_vh_rwsem_mark_wake_readers' [A] 'tracepoint __tracepoint_android_vh_rwsem_set_owner' [A] 'tracepoint __tracepoint_android_vh_rwsem_set_reader_owned' [A] 'tracepoint __tracepoint_android_vh_rwsem_up_read_end' [A] 'tracepoint __tracepoint_android_vh_rwsem_up_write_end' Bug: 193384408 Signed-off-by: Liujie Xie <xieliujie@oppo.com> Change-Id: Ib21d33425191850fbe4231a6addc69ca40bcb670 |
||
|
41cbbe08f9 |
FROMGIT: arm64: fix oops in concurrently setting insn_emulation sysctls
emulation_proc_handler() changes table->data for proc_dointvec_minmax
and can generate the following Oops if called concurrently with itself:
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
| Internal error: Oops: 96000006 [#1] SMP
| Call trace:
| update_insn_emulation_mode+0xc0/0x148
| emulation_proc_handler+0x64/0xb8
| proc_sys_call_handler+0x9c/0xf8
| proc_sys_write+0x18/0x20
| __vfs_write+0x20/0x48
| vfs_write+0xe4/0x1d0
| ksys_write+0x70/0xf8
| __arm64_sys_write+0x20/0x28
| el0_svc_common.constprop.0+0x7c/0x1c0
| el0_svc_handler+0x2c/0xa0
| el0_svc+0x8/0x200
To fix this issue, keep the table->data as &insn->current_mode and
use container_of() to retrieve the insn pointer. Another mutex is
used to protect against the current_mode update but not for retrieving
insn_emulation as table->data is no longer changing.
Bug: 237540956
Co-developed-by: hewenliang <hewenliang4@huawei.com>
Signed-off-by: hewenliang <hewenliang4@huawei.com>
Signed-off-by: Haibin Zhang <haibinzhang@tencent.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20220128090324.2727688-1-hewenliang4@huawei.com
Link: https://lore.kernel.org/r/9A004C03-250B-46C5-BF39-782D7551B00E@tencent.com
Signed-off-by: Will Deacon <will@kernel.org>
[Lee: Added Fixes: tag]
(cherry picked from commit af483947d472eccb79e42059276c4deed76f99a6
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-next/core)
Fixes:
|
||
|
c301d142e8 |
FROMGIT: usb: dwc3: core: Do not perform GCTL_CORE_SOFTRESET during bootup
According to the programming guide, it is recommended to perform a GCTL_CORE_SOFTRESET only when switching the mode from device to host or host to device. However, it is found that during bootup when __dwc3_set_mode() is called for the first time, GCTL_CORESOFTRESET is done with suspendable bit(BIT 17) of DWC3_GUSB3PIPECTL set. This some times leads to issues like controller going into bad state and controller registers reading value zero. Until GCTL_CORESOFTRESET is done and run/stop bit is set core initialization is not complete. Setting suspendable bit of DWC3_GUSB3PIPECTL and then performing GCTL_CORESOFTRESET is therefore not recommended. Avoid this by only performing the reset if current_dr_role is set, that is, when doing subsequent role switching. Fixes: f88359e1588b ("usb: dwc3: core: Do core softreset when switch mode") Signed-off-by: Rohith Kollalsi <quic_rkollals@quicinc.com> Link: https://lore.kernel.org/r/20220714045625.20377-1-quic_rkollals@quicinc.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 07903626d98853e605fe63e5ce149f1b7314bbea https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git/ usb-next) BUG: 239121944 Change-Id: Ice6da5dd64896d5deeab425dd1ac5389425a1cc8 Signed-off-by: Rohith Kollalsi <quic_rkollals@quicinc.com> |
||
|
8b19ed264b |
ANDROID: vendor_hooks:vendor hook for mmput
add vendor hook in mmput while mm_users decreased to 0. Bug: 238821038 Change-Id: I42a717cbeeb3176bac14b4b2391fdb2366c972d3 Signed-off-by: xiaofeng <xiaofeng5@xiaomi.com> |
||
|
242b11e574 |
ANDROID: vendor_hooks:vendor hook for pidfd_open
Add vendor hook when detecting process status through pidfd_open. Bug: 238725692 Change-Id: I565988cb8bf6dd44ab4dc15c410c2dcf50703def Signed-off-by: xiaofeng <xiaofeng5@xiaomi.com> |
||
|
0e1cb27700 |
ANDROID: vendor_hook: Add hook in shmem_writepage()
Add vendor hook android_vh_set_shmem_page_flag in shmem_writepage to set a flag in page_ext, which indicates that this page is a shmem page, to be used in android_vh_get_swap_page. The shared page should not be reclaimed to the extended memory, ie, the specified swap location. Bug: 234214858 Signed-off-by: Bing Han <bing.han@transsion.com> Change-Id: I33a9007c88b4d8aab3da044c8a05eb45d7e74f3a |
||
|
8ee37d0bcd |
BACKPORT: iommu/dma: Fix race condition during iova_domain initialization
When many devices share the same iova domain, iommu_dma_init_domain() may be called at the same time. The checking of iovad->start_pfn will all get false in iommu_dma_init_domain() and both enter init_iova_domain() to do iovad initialization. Fix this by protecting init_iova_domain() with iommu_dma_cookie->mutex. Exception backtrace: rb_insert_color(param1=0xFFFFFF80CD2BDB40, param3=1) + 64 init_iova_domain() + 180 iommu_setup_dma_ops() + 260 arch_setup_dma_ops() + 132 of_dma_configure_id() + 468 platform_dma_configure() + 32 really_probe() + 1168 driver_probe_device() + 268 __device_attach_driver() + 524 __device_attach() + 524 bus_probe_device() + 64 deferred_probe_work_func() + 260 process_one_work() + 580 worker_thread() + 1076 kthread() + 332 ret_from_fork() + 16 Signed-off-by: Ning Li <ning.li@mediatek.com> Signed-off-by: Yunfei Wang <yf.wang@mediatek.com> Acked-by: Robin Murphy <robin.murphy@arm.com> Reviewed-by: Miles Chen <miles.chen@mediatek.com> Link: https://lore.kernel.org/r/20220530120748.31733-1-yf.wang@mediatek.com Signed-off-by: Joerg Roedel <jroedel@suse.de> Bug: 236922015 (cherry picked from commit ac9a5d522bb80be50ea84965699e1c8257d745ce https://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu.git core) [Yunfei: Embed iommu_dma_cookie into iommu_dma_cookie_ext to avoid changing struct iommu_dma_cookie] Signed-off-by: Yunfei Wang <yf.wang@mediatek.com> Change-Id: I9b7931bea912837f17d2322713ba68a37122499d (cherry picked from commit 8a410d778a3c3b1f535acecff7f53c542ffb348c) |
||
|
321bf845e1 |
FROMGIT: usb: dwc3: core: Deprecate GCTL.CORESOFTRESET
Synopsys IP DWC_usb32 and DWC_usb31 version 1.90a and above deprecated GCTL.CORESOFTRESET. The DRD mode switching flow is updated to remove the GCTL soft reset. Add version checks to prevent using deprecated setting in mode switching flow. Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://lore.kernel.org/r/9df529fde6e55f5508321b6bc26e92848044ef2b.1655338967.git.Thinh.Nguyen@synopsys.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit afbd04e66e5d16ca3c7ea2e3c56eca25558eacf3 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-next) BUG: 238836938 Change-Id: I69ea5ee3b9cf25d1d972b261c8dff59c50437c04 Signed-off-by: Udipto Goswami <quic_ugoswami@quicinc.com> |
||
|
c5eb0edfde |
FROMGIT: usb: dwc3: gadget: Prevent repeat pullup()
Don't do soft-disconnect if it's previously done. Likewise, don't do soft-connect if the device is currently connected and running. It would break normal operation. Currently the caller of pullup() (udc's sysfs soft_connect) only checks if it had initiated disconnect to prevent repeating soft-disconnect. It doesn't check for soft-connect. To be safe, let's keep the check here regardless whether the udc core is fixed. Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com> Link: https://lore.kernel.org/r/1c1345bd66c97a9d32f77d63aaadd04b7b037143.1650593829.git.Thinh.Nguyen@synopsys.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 69e131d1ac4e52a59ec181ab4f8aa8c48cd8fb64 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git/ usb-next) BUG: 238836938 Change-Id: Ibcb208581948132cfe4736381a67fea33026c372 Signed-off-by: Udipto Goswami <quic_ugoswami@quicinc.com> |
||
|
8de633b735 |
FROMGIT: Binder: add TF_UPDATE_TXN to replace outdated txn
When the target process is busy, incoming oneway transactions are queued in the async_todo list. If the clients continue sending extra oneway transactions while the target process is frozen, this queue can become too large to accommodate new transactions. That's why binder driver introduced ONEWAY_SPAM_DETECTION to detect this situation. It's helpful to debug the async binder buffer exhausting issue, but the issue itself isn't solved directly. In real cases applications are designed to send oneway transactions repeatedly, delivering updated inforamtion to the target process. Typical examples are Wi-Fi signal strength and some real time sensor data. Even if the apps might only care about the lastet information, all outdated oneway transactions are still accumulated there until the frozen process is thawed later. For this kind of situations, there's no existing method to skip those outdated transactions and deliver the latest one only. This patch introduces a new transaction flag TF_UPDATE_TXN. To use it, use apps can set this new flag along with TF_ONE_WAY. When such an oneway transaction is to be queued into the async_todo list of a frozen process, binder driver will check if any previous pending transactions can be superseded by comparing their code, flags and target node. If such an outdated pending transaction is found, the latest transaction will supersede that outdated one. This effectively prevents the async binder buffer running out and saves unnecessary binder read workloads. Acked-by: Todd Kjos <tkjos@google.com> Signed-off-by: Li Li <dualli@google.com> Link: https://lore.kernel.org/r/20220526220018.3334775-2-dualli@chromium.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 231624308 Test: manually check async binder buffer size of frozen apps Test: stress test with kernel 4.14/4.19/5.10/5.15 (cherry picked from commit 9864bb4801331daa48514face9d0f4861e4d485b git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-next) Change-Id: I1c4bff1eda1ca15aaaad5bf696c8fc00be743176 |
||
|
e8fce59434 |
BACKPORT: FROMGIT: cgroup: Use separate src/dst nodes when preloading css_sets for migration
Each cset (css_set) is pinned by its tasks. When we're moving tasks around
across csets for a migration, we need to hold the source and destination
csets to ensure that they don't go away while we're moving tasks about. This
is done by linking cset->mg_preload_node on either the
mgctx->preloaded_dst_csets or mgctx->preloaded_dst_csets list. Using the
same cset->mg_preload_node for both the src and dst lists was deemed okay as
a cset can't be both the source and destination at the same time.
Unfortunately, this overloading becomes problematic when multiple tasks are
involved in a migration and some of them are identity noop migrations while
others are actually moving across cgroups. For example, this can happen with
the following sequence on cgroup1:
#1> mkdir -p /sys/fs/cgroup/misc/a/b
#2> echo $$ > /sys/fs/cgroup/misc/a/cgroup.procs
#3> RUN_A_COMMAND_WHICH_CREATES_MULTIPLE_THREADS &
#4> PID=$!
#5> echo $PID > /sys/fs/cgroup/misc/a/b/tasks
#6> echo $PID > /sys/fs/cgroup/misc/a/cgroup.procs
the process including the group leader back into a. In this final migration,
non-leader threads would be doing identity migration while the group leader
is doing an actual one.
After #3, let's say the whole process was in cset A, and that after #4, the
leader moves to cset B. Then, during #6, the following happens:
1. cgroup_migrate_add_src() is called on B for the leader.
2. cgroup_migrate_add_src() is called on A for the other threads.
3. cgroup_migrate_prepare_dst() is called. It scans the src list.
3. It notices that B wants to migrate to A, so it tries to A to the dst
list but realizes that its ->mg_preload_node is already busy.
4. and then it notices A wants to migrate to A as it's an identity
migration, it culls it by list_del_init()'ing its ->mg_preload_node and
putting references accordingly.
5. The rest of migration takes place with B on the src list but nothing on
the dst list.
This means that A isn't held while migration is in progress. If all tasks
leave A before the migration finishes and the incoming task pins it, the
cset will be destroyed leading to use-after-free.
This is caused by overloading cset->mg_preload_node for both src and dst
preload lists. We wanted to exclude the cset from the src list but ended up
inadvertently excluding it from the dst list too.
This patch fixes the issue by separating out cset->mg_preload_node into
->mg_src_preload_node and ->mg_dst_preload_node, so that the src and dst
preloadings don't interfere with each other.
Bug: 236582926
Change-Id: Ieaf1c0c8fc23753570897fd6e48a54335ab939ce
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Mukesh Ojha <quic_mojha@quicinc.com>
Reported-by: shisiyuan <shisiyuan19870131@gmail.com>
Link: http://lkml.kernel.org/r/1654187688-27411-1-git-send-email-shisiyuan@xiaomi.com
Link: https://lore.kernel.org/lkml/Yh+RGIJ0f3nrqIiN@slm.duckdns.org/#t
Fixes:
|
||
|
f26c566455 |
UPSTREAM: usb: gadget: f_uac2: allow changing interface name via configfs
This adds "function_name" configfs entry to change string value of the iInterface field. This field will be shown in Windows' audio settings panel, so being able to change it is useful. It will default to "Source/Sink" just as before. Signed-off-by: Yunhao Tian <t123yh.xyz@gmail.com> Link: https://lore.kernel.org/r/20220122112446.1415547-2-t123yh.xyz@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 235196743 (cherry picked from commit 993a44fa85c1ea5989fb5c46236ca2e3cfd71b78) Change-Id: I6061d841eee5b611f18280c901849d0c4b2a17d4 Signed-off-by: Luiz Matheus <luizmmat@motorola.com> |
||
|
98fa7f7dfd |
UPSTREAM: usb: gadget: f_uac1: allow changing interface name via configfs
This adds "function_name" configfs entry to change string value of the iInterface field. This field will be shown in Windows' audio settings panel, so being able to change it is useful. It will default to "AC Interface" just as before if unchanged. Signed-off-by: Yunhao Tian <t123yh.xyz@gmail.com> Link: https://lore.kernel.org/r/20220122112446.1415547-1-t123yh.xyz@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 235196743 (cherry picked from commit dfb05b5dc3afd90e564b69b88ff6be6947a0f32f) Change-Id: Ibd0e417ab82efe1fb3aa6fd5bb33fb70f113cf1a Signed-off-by: Luiz Matheus <luizmmat@motorola.com> |
||
|
29172165ca |
UPSTREAM: usb: gadget: f_uac1: Add suspend callback
Add suspend callback to f_uac1 function, calling corresponding method of u_audio in order to stop the respective PCM streams and to notify subscribed clients about the stop. Signed-off-by: Pavel Hofman <pavel.hofman@ivitera.com> Link: https://lore.kernel.org/r/20220121155308.48794-11-pavel.hofman@ivitera.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 235196743 (cherry picked from commit d1d11dd1306908bc18b6592bbd21ba7d19a931e5) Change-Id: I9d24b3f58aea89b167bae6af39a460adf37c1a2a Signed-off-by: Luiz Matheus <luizmmat@motorola.com> |
||
|
ff5468c71e |
UPSTREAM: usb: gadget: f_uac2: Add suspend callback
When USB cable gets disconnected, the undergoing playback/capture stalls, without any notification to u_audio about the change. Experiments with a dwc2 gadget revealed that Suspend interrupt is thrown at cable disconnection, which the gadget framework translates to calling suspend callback of a function, if it is defined. Add the suspend callback to f_uac2 function, calling corresponding method of u_audio in order to stop the respective PCM streams and to notify subscribed clients at cable disconnection. Signed-off-by: Pavel Hofman <pavel.hofman@ivitera.com> Link: https://lore.kernel.org/r/20220121155308.48794-10-pavel.hofman@ivitera.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 235196743 (cherry picked from commit 7ff4a3b5489959a0256840a361b54d979b822535) Change-Id: I43f5ccd6f84771bd63462ba9b2419a9e42f45746 Signed-off-by: Luiz Matheus <luizmmat@motorola.com> |
||
|
31e6d620c1 |
UPSTREAM: usb: gadget: u_audio: Add suspend call
Add exported method u_audio_suspend which sets stream status to inactive and sends notifications. The method does not free any resources. Signed-off-by: Pavel Hofman <pavel.hofman@ivitera.com> Link: https://lore.kernel.org/r/20220121155308.48794-9-pavel.hofman@ivitera.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 235196743 (cherry picked from commit 62385cf158a7e65b5f347590521d02ee75dc8518) Change-Id: I064ae3c92aaeec52a3f484665b89ee31132e5053 Signed-off-by: Luiz Matheus <luizmmat@motorola.com> |