Skip to content
Snippets Groups Projects
Select Git revision
  • 6.10-rocket-multiple-devices-2
  • toradex_6.6-2.0.x-imx
  • 6.10-rocket
  • 6.10-rocket-schema-subnodes
  • 6.10-rocket-multiple-devices
  • 6.10-rocket-multiple-iommus
  • 6.10-rocket-multiple-devices-power
  • rocket
  • v6.6-for-mesa-ci
  • 6.8-rknpu
  • v6.7-for-mesa-ci
  • vim3-npu-6.6
  • vim3-npu-5.17
  • drm-ci-tests
  • drm-next-external-fixes
  • vim3-npu
  • drm-ci-tests-external-fixes
  • tmp
  • msm-ci-tests
  • drm-fixes-staging
  • v6.6.21-mesa-97aedf
  • v6.6.21-mesa-3c388
  • v6.6.16-mesa-af4e
  • v6.6.16-mesa-f87d
  • v6.6.16-mesa-c32f
  • v6.6.12-for-mesa-ci-7e067ddc8e81
  • v6.7-for-mesa-ci-fedbf6bdf526
  • v6.7-for-mesa-ci-a0696b9f4b32
  • v6.7-for-mesa-ci-b1a8999d4d5c
  • v6.7-for-mesa-ci-7335f9e58fbf
  • v5.11-for-mesa-ci-adcee9973be5
  • v5.5-rc1-panfrost-fixes
  • drm-misc-panfrost-locking-fixes
  • heap+noexec
  • heap-noexec-2
  • noexec
  • v4.19-rc2
  • v4.19-rc1
  • v4.18
  • v4.18-rc8
40 results
Search by author
  • Any Author
  • Tomeu Vizoso Tomeu Vizoso tomeu
1 author
  1. Mar 29, 2022
  3. Jan 28, 2022
    • danglin44's avatar
      parisc: Fix sglist access in ccio-dma.c · d7da660c
      danglin44 authored and Helge Deller's avatar Helge Deller committed 
      
This patch implements the same bug fix to ccio-dma.c as to sba_iommu.c.
It ensures that only the allocated entries of the sglist are accessed.

Signed-off-by: default avatarJohn David Anglin <dave.anglin@bell.net>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      d7da660c
    • danglin44's avatar
      parisc: Fix data TLB miss in sba_unmap_sg · b7d6f44a
      danglin44 authored and Helge Deller's avatar Helge Deller committed 
      
Rolf Eike Beer reported the following bug:

[1274934.746891] Bad Address (null pointer deref?): Code=15 (Data TLB miss fault) at addr 0000004140000018
[1274934.746891] CPU: 3 PID: 5549 Comm: cmake Not tainted 5.15.4-gentoo-parisc64 #4
[1274934.746891] Hardware name: 9000/785/C8000
[1274934.746891]
[1274934.746891]      YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI
[1274934.746891] PSW: 00001000000001001111111000001110 Not tainted
[1274934.746891] r00-03  000000ff0804fe0e 0000000040bc9bc0 00000000406760e4 0000004140000000
[1274934.746891] r04-07  0000000040b693c0 0000004140000000 000000004a2b08b0 0000000000000001
[1274934.746891] r08-11  0000000041f98810 0000000000000000 000000004a0a7000 0000000000000001
[1274934.746891] r12-15  0000000040bddbc0 0000000040c0cbc0 0000000040bddbc0 0000000040bddbc0
[1274934.746891] r16-19  0000000040bde3c0 0000000040bddbc0 0000000040bde3c0 0000000000000007
[1274934.746891] r20-23  0000000000000006 000000004a368950 0000000000000000 0000000000000001
[1274934.746891] r24-27  0000000000001fff 000000000800000e 000000004a1710f0 0000000040b693c0
[1274934.746891] r28-31  0000000000000001 0000000041f988b0 0000000041f98840 000000004a171118
[1274934.746891] sr00-03  00000000066e5800 0000000000000000 0000000000000000 00000000066e5800
[1274934.746891] sr04-07  0000000000000000 0000000000000000 0000000000000000 0000000000000000
[1274934.746891]
[1274934.746891] IASQ: 0000000000000000 0000000000000000 IAOQ: 00000000406760e8 00000000406760ec
[1274934.746891]  IIR: 48780030    ISR: 0000000000000000  IOR: 0000004140000018
[1274934.746891]  CPU:        3   CR30: 00000040e3a9c000 CR31: ffffffffffffffff
[1274934.746891]  ORIG_R28: 0000000040acdd58
[1274934.746891]  IAOQ[0]: sba_unmap_sg+0xb0/0x118
[1274934.746891]  IAOQ[1]: sba_unmap_sg+0xb4/0x118
[1274934.746891]  RP(r2): sba_unmap_sg+0xac/0x118
[1274934.746891] Backtrace:
[1274934.746891]  [<00000000402740cc>] dma_unmap_sg_attrs+0x6c/0x70
[1274934.746891]  [<000000004074d6bc>] scsi_dma_unmap+0x54/0x60
[1274934.746891]  [<00000000407a3488>] mptscsih_io_done+0x150/0xd70
[1274934.746891]  [<0000000040798600>] mpt_interrupt+0x168/0xa68
[1274934.746891]  [<0000000040255a48>] __handle_irq_event_percpu+0xc8/0x278
[1274934.746891]  [<0000000040255c34>] handle_irq_event_percpu+0x3c/0xd8
[1274934.746891]  [<000000004025ecb4>] handle_percpu_irq+0xb4/0xf0
[1274934.746891]  [<00000000402548e0>] generic_handle_irq+0x50/0x70
[1274934.746891]  [<000000004019a254>] call_on_stack+0x18/0x24
[1274934.746891]
[1274934.746891] Kernel panic - not syncing: Bad Address (null pointer deref?)

The bug is caused by overrunning the sglist and incorrectly testing
sg_dma_len(sglist) before nents. Normally this doesn't cause a crash,
but in this case sglist crossed a page boundary. This occurs in the
following code:

	while (sg_dma_len(sglist) && nents--) {

The fix is simply to test nents first and move the decrement of nents
into the loop.

Reported-by: default avatarRolf Eike Beer <eike-kernel@sf-tec.de>
Signed-off-by: default avatarJohn David Anglin <dave.anglin@bell.net>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      b7d6f44a
  5. Jan 22, 2022
  7. Jan 21, 2022
  9. Jan 07, 2022
  11. Sep 09, 2021
  13. Sep 01, 2021
  15. Aug 30, 2021
  17. Aug 09, 2021
  19. Jul 01, 2021
  21. Oct 06, 2020
    • Christoph Hellwig's avatar
      dma-mapping: split <linux/dma-mapping.h> · 0a0f0d8b
      Christoph Hellwig authored 
      
Split out all the bits that are purely for dma_map_ops implementations
and related code into a new <linux/dma-map-ops.h> header so that they
don't get pulled into all the drivers.  That also means the architecture
specific <asm/dma-mapping.h> is not pulled in by <linux/dma-mapping.h>
any more, which leads to a missing includes that were pulled in by the
x86 or arm versions in a few not overly portable drivers.

Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      0a0f0d8b
  23. Sep 25, 2020
    • Christoph Hellwig's avatar
      dma-mapping: add a new dma_alloc_pages API · efa70f2f
      Christoph Hellwig authored 
      
This API is the equivalent of alloc_pages, except that the returned memory
is guaranteed to be DMA addressable by the passed in device.  The
implementation will also be used to provide a more sensible replacement
for DMA_ATTR_NON_CONSISTENT flag.

Additionally dma_alloc_noncoherent is switched over to use dma_alloc_pages
as its backend.

Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Acked-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> (MIPS part)
      efa70f2f
  25. Sep 03, 2020
    • Nicolin Chen's avatar
      dma-mapping: introduce dma_get_seg_boundary_nr_pages() · 1e9d90db
      Nicolin Chen authored 
      
We found that callers of dma_get_seg_boundary mostly do an ALIGN
with page mask and then do a page shift to get number of pages:
    ALIGN(boundary + 1, 1 << shift) >> shift

However, the boundary might be as large as ULONG_MAX, which means
that a device has no specific boundary limit. So either "+ 1" or
passing it to ALIGN() would potentially overflow.

According to kernel defines:
    #define ALIGN_MASK(x, mask) (((x) + (mask)) & ~(mask))
    #define ALIGN(x, a)	ALIGN_MASK(x, (typeof(x))(a) - 1)

We can simplify the logic here into a helper function doing:
  ALIGN(boundary + 1, 1 << shift) >> shift
= ALIGN_MASK(b + 1, (1 << s) - 1) >> s
= {[b + 1 + (1 << s) - 1] & ~[(1 << s) - 1]} >> s
= [b + 1 + (1 << s) - 1] >> s
= [b + (1 << s)] >> s
= (b >> s) + 1

This patch introduces and applies dma_get_seg_boundary_nr_pages()
as an overflow-free helper for the dma_get_seg_boundary() callers
to get numbers of pages. It also takes care of the NULL dev case
for non-DMA API callers.

Suggested-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarNicolin Chen <nicoleotsuka@gmail.com>
Acked-by: default avatarNiklas Schnelle <schnelle@linux.ibm.com>
Acked-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc)
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      1e9d90db
  27. Aug 12, 2020
  29. Jun 26, 2020
  31. Apr 05, 2020
  33. Feb 04, 2020
  35. Jan 06, 2020
  37. Oct 14, 2019
  39. Sep 08, 2019
    • Helge Deller's avatar
      parisc: Disable HP HSC-PCI Cards to prevent kernel crash · 5fa16591
      Helge Deller authored 
      
The HP Dino PCI controller chip can be used in two variants: as on-board
controller (e.g. in B160L), or on an Add-On card ("Card-Mode") to bridge
PCI components to systems without a PCI bus, e.g. to a HSC/GSC bus.  One
such Add-On card is the HP HSC-PCI Card which has one or more DEC Tulip
PCI NIC chips connected to the on-card Dino PCI controller.

Dino in Card-Mode has a big disadvantage: All PCI memory accesses need
to go through the DINO_MEM_DATA register, so Linux drivers will not be
able to use the ioremap() function. Without ioremap() many drivers will
not work, one example is the tulip driver which then simply crashes the
kernel if it tries to access the ports on the HP HSC card.

This patch disables the HP HSC card if it finds one, and as such
fixes the kernel crash on a HP D350/2 machine.

Signed-off-by: default avatarHelge Deller <deller@gmx.de>
Noticed-by: default avatarPhil Scarr <phil.scarr@pm.me>
Cc: stable@vger.kernel.org
      5fa16591
  41. Sep 05, 2019
  43. Sep 04, 2019
    • Christoph Hellwig's avatar
      parisc: don't set ARCH_NO_COHERENT_DMA_MMAP · 5128da32
      Christoph Hellwig authored 
      
parisc is the only architecture that sets ARCH_NO_COHERENT_DMA_MMAP
when an MMU is enabled.  AFAIK this is because parisc CPUs use VIVT
caches, which means exporting normally cachable memory to userspace is
relatively dangrous due to cache aliasing.

But normally cachable memory is only allocated by dma_alloc_coherent
on parisc when using the sba_iommu or ccio_iommu drivers, so just
remove the .mmap implementation for them so that we don't have to set
ARCH_NO_COHERENT_DMA_MMAP, which I plan to get rid of.

Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      5128da32
    • Christoph Hellwig's avatar
      dma-mapping: explicitly wire up ->mmap and ->get_sgtable · f9f3232a
      Christoph Hellwig authored 
      
While the default ->mmap and ->get_sgtable implementations work for the
majority of our dma_map_ops impementations they are inherently safe
for others that don't use the page allocator or CMA and/or use their
own way of remapping not covered by the common code.  So remove the
defaults if these methods are not wired up, but instead wire up the
default implementations for all safe instances.

Fixes: e1c7e324 ("dma-mapping: always provide the dma_map_ops based implementation")
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      f9f3232a
  45. Jun 06, 2019
    • danglin44's avatar
      parisc: Use lpa instruction to load physical addresses in driver code · 116d7533
      danglin44 authored and Helge Deller's avatar Helge Deller committed 
      
Most I/O in the kernel is done using the kernel offset mapping.
However, there is one API that uses aliased kernel address ranges:

> The final category of APIs is for I/O to deliberately aliased address
> ranges inside the kernel.  Such aliases are set up by use of the
> vmap/vmalloc API.  Since kernel I/O goes via physical pages, the I/O
> subsystem assumes that the user mapping and kernel offset mapping are
> the only aliases.  This isn't true for vmap aliases, so anything in
> the kernel trying to do I/O to vmap areas must manually manage
> coherency.  It must do this by flushing the vmap range before doing
> I/O and invalidating it after the I/O returns.

For this reason, we should use the hardware lpa instruction to load the
physical address of kernel virtual addresses in the driver code.

I believe we only use the vmap/vmalloc API with old PA 1.x processors
which don't have a sba, so we don't hit this problem.

Tested on c3750, c8000 and rp3440.

Signed-off-by: default avatarJohn David Anglin <dave.anglin@bell.net>
Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      116d7533
    • danglin44's avatar
      parisc: Use implicit space register selection for loading the coherence index of I/O pdirs · 63923d2c
      danglin44 authored and Helge Deller's avatar Helge Deller committed 
      
We only support I/O to kernel space. Using %sr1 to load the coherence
index may be racy unless interrupts are disabled. This patch changes the
code used to load the coherence index to use implicit space register
selection. This saves one instruction and eliminates the race.

Tested on rp3440, c8000 and c3750.

Signed-off-by: default avatarJohn David Anglin <dave.anglin@bell.net>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      63923d2c
  47. Jun 05, 2019
  49. May 30, 2019
  51. May 21, 2019
  53. May 03, 2019
  55. Apr 06, 2019
  57. Feb 21, 2019