aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2019-11-21habanalabs: make the reset code more consistentOded Gabbay1-1/+1
In the hl_device_reset we ask about the hard_reset argument when we want to differentiate between soft and hard reset, except for three places where we use "from_hard_reset_thread". Replace one of those locations with the hard_reset argument as it is guaranteed that if we reached to that line in the code during hard_reset, it is from a kernel thread. Signed-off-by: Oded Gabbay <[email protected]> Reviewed-by: Tomer Tayar <[email protected]>
2019-11-21habanalabs: expose reset counters via existing INFO IOCTLMoti Haimovski2-0/+28
Expose both soft and hard reset counts via INFO IOCTL. This will allow system management applications to easily check if the device has undergone reset. Signed-off-by: Moti Haimovski <[email protected]> Reviewed-by: Oded Gabbay <[email protected]> Signed-off-by: Oded Gabbay <[email protected]>
2019-11-21habanalabs: make code more conciseOded Gabbay1-13/+9
Instead of doing if inside if, just write them with && operator. Signed-off-by: Oded Gabbay <[email protected]> Reviewed-by: Omer Shpigelman <[email protected]>
2019-11-21habanalabs: use defines for F/W filesOded Gabbay1-6/+5
Make the code more concise and maintainable by using defines for the F/W files. Signed-off-by: Oded Gabbay <[email protected]> Reviewed-by: Omer Shpigelman <[email protected]>
2019-11-21habanalabs: remove prints on successful device initializationOded Gabbay2-7/+1
Successful device initialization is mentioned in kernel log with the message "Successfully added device to habanalabs driver". There is no point of spamming the log with additional messages about successful queue testing, which are implied by the above mentioned message. Signed-off-by: Oded Gabbay <[email protected]> Reviewed-by: Omer Shpigelman <[email protected]>
2019-11-21habanalabs: remove unnecessary checksOmer Shpigelman1-31/+9
Now that the VA block free list is not updated on context close in order to optimize this flow, no need in the sanity checks of the list contents as these will fail for sure. In addition, remove the "context closing with VA in use" print during hard reset as this situation is a side effect of the failure that caused the hard reset. Signed-off-by: Omer Shpigelman <[email protected]> Reviewed-by: Oded Gabbay <[email protected]> Signed-off-by: Oded Gabbay <[email protected]>
2019-11-21habanalabs: invalidate MMU cache only onceOmer Shpigelman1-1/+11
Reduce context close time by performing MMU cache invalidation once at the end of the unmap loop rather in each iteration, in order to avoid hard reset with open contexts. Reset with open contexts can potentially lead to a kernel crash as the generic pool of the MMU hops is destroyed while it is not empty because some unmap operations are not done. The commit affect mainly when running on simulator. Signed-off-by: Omer Shpigelman <[email protected]> Reviewed-by: Oded Gabbay <[email protected]> Signed-off-by: Oded Gabbay <[email protected]>
2019-11-21habanalabs: skip VA block list update in reset flowOmer Shpigelman1-10/+20
Reduce context close time by skipping the VA block free list update in order to avoid hard reset with open contexts. Reset with open contexts can potentially lead to a kernel crash as the generic pool of the MMU hops is destroyed while it is not empty because some unmap operations are not done. The commit affect mainly when running on simulator. Signed-off-by: Omer Shpigelman <[email protected]> Reviewed-by: Oded Gabbay <[email protected]> Signed-off-by: Oded Gabbay <[email protected]>
2019-11-21habanalabs: optimize MMU unmapOmer Shpigelman1-6/+13
Reduce context close time by skipping hash table lookup if possible in order to avoid hard reset with open contexts. Reset with open contexts can potentially lead to a kernel crash as the generic pool of the MMU hops is destroyed while it is not empty because some unmap operations are not done. This commit affect mainly when running on simulator. Signed-off-by: Omer Shpigelman <[email protected]> Reviewed-by: Oded Gabbay <[email protected]> Signed-off-by: Oded Gabbay <[email protected]>
2019-11-21habanalabs: prevent read/write from/to the device during hard resetOmer Shpigelman1-2/+4
During hard reset we should not access the device except of necessary reset operations because the device might be stuck or unresponsive. Signed-off-by: Omer Shpigelman <[email protected]> Reviewed-by: Oded Gabbay <[email protected]> Signed-off-by: Oded Gabbay <[email protected]>
2019-11-21habanalabs: split MMU properties to PCI/DRAMOmer Shpigelman6-148/+268
Split the properties used for MMU mappings to DRAM and PCI (host) types. This is a prerequisite for future ASICs support. Note that in Goya ASIC, the PMMU and DMMU are the same (except of page sizes) as only one MMU mechanism is used for both of the mapping types. Hence this patch should not have any effect on current behavior. Signed-off-by: Omer Shpigelman <[email protected]> Reviewed-by: Oded Gabbay <[email protected]> Signed-off-by: Oded Gabbay <[email protected]>
2019-11-21habanalabs: re-factor MMU masks and documentationOmer Shpigelman3-25/+23
Some cosmetics around the MMU code to make it more self-explanatory. Signed-off-by: Omer Shpigelman <[email protected]> Reviewed-by: Oded Gabbay <[email protected]> Signed-off-by: Oded Gabbay <[email protected]>
2019-11-21habanalabs: type specific MMU cache invalidationOmer Shpigelman3-9/+12
Add the ability to invalidate the necessary MMU cache only. This ability is a prerequisite for future ASICs support. Note that in Goya ASIC, a single cache is used for both host/DRAM mappings and hence this patch should not have any effect on current behavior. Signed-off-by: Omer Shpigelman <[email protected]> Reviewed-by: Oded Gabbay <[email protected]> Signed-off-by: Oded Gabbay <[email protected]>
2019-11-21habanalabs: re-factor memory module codeOmer Shpigelman3-129/+158
Some of the functions in the memory module code were too long and/or contained multiple operations that are not always done together. Re-factor the code by dividing those functions to smaller functions which are more readable and maintainable. Signed-off-by: Omer Shpigelman <[email protected]> Reviewed-by: Oded Gabbay <[email protected]> Signed-off-by: Oded Gabbay <[email protected]>
2019-11-21habanalabs: export uapi defines to user-spaceOded Gabbay2-8/+12
The two defines that control the maximum size of a command buffer and the maximum number of JOBS per CS need to be exported to the user as they are part of the API towards user-space. Signed-off-by: Oded Gabbay <[email protected]> Reviewed-by: Omer Shpigelman <[email protected]>
2019-11-21habanalabs: don't print error when queues are fullOded Gabbay1-3/+4
If the queues are full and we return -EAGAIN to the user, there is no need to print an error, as that case isn't an error and the user is expected to re-submit the work. Signed-off-by: Oded Gabbay <[email protected]> Reviewed-by: Omer Shpigelman <[email protected]>
2019-11-21habanalabs: increase max jobs number to 512Oded Gabbay1-1/+1
In training, there is a need for a large amount of patching to the recipe. This results in many command buffers contains a lot of DMA packets. The number of command buffers per CS is larger than the current maximum of 64, which is an arbitrary number that is enough for inference, but it has no real affect on the code and/or resources of the host machine. Signed-off-by: Oded Gabbay <[email protected]> Reviewed-by: Omer Shpigelman <[email protected]>
2019-11-21habanalabs: set ETR as non-securedOded Gabbay2-1/+5
ETR should always be non-secured as it is used by the users to record profiling/trace data. Signed-off-by: Oded Gabbay <[email protected]> Reviewed-by: Omer Shpigelman <[email protected]>
2019-11-21habanalabs: use registers name defines for ETR blockOded Gabbay3-26/+140
We have a single ETR block in the SOC, so use explicit register name defines for initializing this block. This makes it more readable and maintainable. Signed-off-by: Oded Gabbay <[email protected]> Reviewed-by: Omer Shpigelman <[email protected]>
2019-11-21habanalabs: read F/W versions before failureOded Gabbay1-4/+4
Move the read of the F/W boot versions before exiting on possible failures of the F/W boot. This will help debug boot failures as we will be able to know the F/W boot version. Signed-off-by: Oded Gabbay <[email protected]> Reviewed-by: Omer Shpigelman <[email protected]>
2019-11-21habanalabs: expose card name in INFO IOCTLOded Gabbay3-2/+12
To enable userspace processes, e.g. management utilities, to display the card name to the user, add the card name property to the HW_IP structure that is copied to the user in the INFO IOCTL. Signed-off-by: Oded Gabbay <[email protected]>
2019-11-21habanalabs: remove set but not used variable 'qman_base_addr'YueHaibing1-4/+0
Fixes gcc '-Wunused-but-set-variable' warning: drivers/misc/habanalabs/goya/goya.c: In function 'goya_init_mme_cmdq': drivers/misc/habanalabs/goya/goya.c:1536:6: warning: variable 'qman_base_addr' set but not used [-Wunused-but-set-variable] It is never used, so can be removed. Reported-by: Hulk Robot <[email protected]> Signed-off-by: YueHaibing <[email protected]> Reviewed-by: Oded Gabbay <[email protected]> Signed-off-by: Oded Gabbay <[email protected]>
2019-11-21habanalabs: add opcode to INFO IOCTL to return clock rateOded Gabbay6-6/+74
Add a new opcode to the INFO IOCTL to allow the user application to retrieve the ASIC's current and maximum clock rate. The rate is returned in MHz. Signed-off-by: Oded Gabbay <[email protected]> Reviewed-by: Tomer Tayar <[email protected]>
2019-11-21habanalabs: set TPC Icache to 16 cache linesOded Gabbay2-3/+7
Reduce latency to memory during TPC kernel execution. Signed-off-by: Oded Gabbay <[email protected]> Reviewed-by: Tomer Tayar <[email protected]>
2019-11-21habanalabs: Add a new H/W queue typeTomer Tayar5-101/+308
This patch adds a support for a new H/W queue type. This type of queue is for DMA and compute engines jobs, for which completion notification are sent by H/W. Command buffer for this queue can be created either through the CB IOCTL and using the retrieved CB handle, or by preparing a buffer on the host or device SRAM/DRAM, and using the device address to that buffer. The patch includes the handling of the 2 options, as well as the initialization of the H/W queue and its jobs scheduling. Signed-off-by: Tomer Tayar <[email protected]> Reviewed-by: Oded Gabbay <[email protected]> Signed-off-by: Oded Gabbay <[email protected]>
2019-11-21habanalabs: Mark queue as expecting CB handle or addressTomer Tayar3-1/+9
Jobs on some queues must be provided with a handle to a driver command buffer object, while for other queues, jobs must be provided with an address to a command buffer. Currently the distinction is done based on the queue type, which is less flexible if the same queue type behaves differently on different types of ASICs. This patch adds a new queue property for this target, which is configured per queue type per ASIC type. Signed-off-by: Tomer Tayar <[email protected]> Reviewed-by: Oded Gabbay <[email protected]> Signed-off-by: Oded Gabbay <[email protected]>
2019-11-21habanalabs: Fix typosTomer Tayar3-4/+4
s/paerser/parser/ s/requeusted/requested/ s/an JOB/a JOB/ Signed-off-by: Tomer Tayar <[email protected]> Reviewed-by: Oded Gabbay <[email protected]> Signed-off-by: Oded Gabbay <[email protected]>
2019-11-21habanalabs: remove set but not used variable 'ctx'YueHaibing1-2/+0
Fixes gcc '-Wunused-but-set-variable' warning: drivers/misc/habanalabs/device.c: In function hpriv_release: drivers/misc/habanalabs/device.c:45:17: warning: variable ctx set but not used [-Wunused-but-set-variable] It is never used since commit eb7caf84b029 ("habanalabs: maintain a list of file private data objects") Reported-by: Hulk Robot <[email protected]> Signed-off-by: YueHaibing <[email protected]> Reviewed-by: Oded Gabbay <[email protected]> Signed-off-by: Oded Gabbay <[email protected]>
2019-11-21habanalabs: handle F/W failure for sensor initializationOded Gabbay2-0/+7
In case the F/W fails to initialize the thermal sensors, print an appropriate error message to kernel log and fail the device initialization. Reviewed-by: Tomer Tayar <[email protected]> Signed-off-by: Oded Gabbay <[email protected]>
2019-11-20misc: Fix Kconfig indentationKrzysztof Kozlowski1-8/+8
Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-20char: Fix Kconfig indentationKrzysztof Kozlowski4-19/+19
Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-20intel_th: pci: Add Tiger Lake CPU supportAlexander Shishkin1-0/+5
This adds support for the Trace Hub in Tiger Lake CPU. Signed-off-by: Alexander Shishkin <[email protected]> Reviewed-by: Andy Shevchenko <[email protected]> Cc: [email protected] Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-20intel_th: pci: Add Ice Lake CPU supportAlexander Shishkin1-0/+5
This adds support for the Trace Hub in Ice Lake CPU. Signed-off-by: Alexander Shishkin <[email protected]> Reviewed-by: Andy Shevchenko <[email protected]> Cc: [email protected] Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-20intel_th: Fix a double put_device() in error pathAlexander Shishkin1-6/+2
Commit a753bfcfdb1f ("intel_th: Make the switch allocate its subdevices") factored out intel_th_subdevice_alloc() from intel_th_populate(), but got the error path wrong, resulting in two instances of a double put_device() on a freshly initialized, but not 'added' device. Fix this by only doing one put_device() in the error path. Signed-off-by: Alexander Shishkin <[email protected]> Fixes: a753bfcfdb1f ("intel_th: Make the switch allocate its subdevices") Reported-by: Wen Yang <[email protected]> Reviewed-by: Andy Shevchenko <[email protected]> Cc: [email protected] # v4.14+ Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-19coresight: replicator: Fix missing spin_lock_init()Wei Yongjun1-0/+1
The driver allocates the spinlock but not initialize it. Use spin_lock_init() on it to initialize it correctly. This is detected by Coccinelle semantic patch. Signed-off-by: Wei Yongjun <[email protected]> Tested-by: Yabin Cui <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-19coresight: funnel: Fix missing spin_lock_init()Wei Yongjun1-0/+1
The driver allocates the spinlock but not initialize it. Use spin_lock_init() on it to initialize it correctly. This is detected by Coccinelle semantic patch. Signed-off-by: Wei Yongjun <[email protected]> Tested-by: Yabin Cui <[email protected]> Signed-off-by: Mathieu Poirier <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-19thunderbolt: Power cycle the router if NVM authentication failsMika Westerberg1-12/+42
On zang's Dell XPS 13 9370 after Thunderbolt NVM firmware upgrade the Thunderbolt controller did not come back as expected. Only after the system was rebooted it became available again. It is not entirely clear what happened but I suspect the new NVM firmware image authentication failed for some reason. Regardless of this the router needs to be power cycled if NVM authentication fails in order to get it fully functional again. This modifies the driver to issue a power cycle in case the NVM authentication fails immediately when dma_port_flash_update_auth() returns. We also need to call tb_switch_set_uuid() earlier to be able to fetch possible NVM authentication failure when DMA port is added. Link: https://bugzilla.kernel.org/show_bug.cgi?id=205457 Reported-by: zang <[email protected]> Cc: stable <[email protected]> Signed-off-by: Mika Westerberg <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-16mei: bus: add more client attributes to sysfsAlexander Usyskin3-0/+90
Export more client attributes via sysfs that are usually obtained upon connection. In some cases, for example a monitoring application may wish to know the attributes without actually performing the connection. Added attributes: max number of connections, fixed address, max message length. Signed-off-by: Alexander Usyskin <[email protected]> Signed-off-by: Tomas Winkler <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-14intel_th: Document software sinksAlexander Shishkin1-1/+27
Add documentation for the software sinks API of the MSU driver and the msu-sink module in particular. Signed-off-by: Alexander Shishkin <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-14stm class: Lose the protocol driver when dropping its referenceAlexander Shishkin1-0/+4
Commit c7fd62bc69d02 ("stm class: Introduce framing protocol drivers") forgot to tear down the link between an stm device and its protocol driver when policy is removed. This leads to an invalid pointer reference if one tries to write to an stm device after the policy has been removed and the protocol driver module unloaded, leading to the below splat: > BUG: unable to handle page fault for address: ffffffffc0737068 > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > PGD 3d780f067 P4D 3d780f067 PUD 3d7811067 PMD 492781067 PTE 0 > Oops: 0000 [#1] SMP NOPTI > CPU: 1 PID: 26122 Comm: cat Not tainted 5.4.0-rc5+ #1 > RIP: 0010:stm_output_free+0x40/0xc0 [stm_core] > Call Trace: > stm_char_release+0x3e/0x70 [stm_core] > __fput+0xc6/0x260 > ____fput+0xe/0x10 > task_work_run+0x9d/0xc0 > exit_to_usermode_loop+0x103/0x110 > do_syscall_64+0x19d/0x1e0 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fix this by tearing down the link from an stm device to its protocol driver when the policy involving that driver is removed. Signed-off-by: Alexander Shishkin <[email protected]> Fixes: c7fd62bc69d02 ("stm class: Introduce framing protocol drivers") Reported-by: Ammy Yi <[email protected]> Tested-by: Ammy Yi <[email protected]> CC: [email protected] # v4.20+ Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-14firmware: Fix incompatible function behavior for RSU driverRichard Gong3-25/+43
The older versions of remote system update (RSU) firmware don't support retry and notify features then the kernel module dies when it queries the RSU retry counter or performs notify operation. Update the Intel service layer and RSU drivers to be compatible with all versions of RSU firmware. Reported-by: Radu Barcau <[email protected]> Reported-by: kbuild test robot <[email protected]> Signed-off-by: Richard Gong <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-14misc: rtsx: Add support for RTS5261Rui Feng6-8/+1064
Add support for new chip rts5261. In order to support rts5261, the definitions of some internal registers and workflow have to be modified and are different from its predecessors. So we need this patch to ensure RTS5261 can work. Signed-off-by: Rui Feng <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-14w1: new driver. DS2430 chipAngelo Dureghello3-0/+304
add support for ds2430, 1 page, 256bit (32bytes) eeprom (family 0x14). Tests done: 32 bytes dump: x@y:~# hexdump -C -n 32 /sys/bus/w1/devices/14-00000158556e/eeprom 00000000 39 39 0a 00 00 36 0a ff ff ff ff ff ff ff ff ff 00000010 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00000020 34 bytes dump: 32 only displayed x@y:~# hexdump -C -n 34 /sys/bus/w1/devices/14-00000158556e/eeprom 00000000 39 39 0a 00 00 36 0a ff ff ff ff ff ff ff ff ff 00000010 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00000020 pattern write: x@y:~# echo 123456789 > /sys/bus/w1/devices/14-00000158556e/eeprom x@y:~# hexdump -C -n 54 /sys/bus/w1/devices/14-00000158556e/eeprom 00000000 31 32 33 34 35 36 37 38 39 0a ff ff ff ff ff ff 00000010 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00000020 specific address 1-byte write x@y:~# dd if=/dev/zero of=/sys/bus/w1/devices/14-00000158556e/eeprom \ count=1 bs=1 seek=4 1+0 records in 1+0 records out x@y:~# hexdump -C -n 54 /sys/bus/w1/devices/14-00000158556e/eeprom 00000000 31 32 33 34 00 36 37 38 39 0a ff ff ff ff ff ff 00000010 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00000020 writing binary block x@y:~# cat dump-128bytes.bin > /sys/bus/w1/devices/14-00000158556e/eeprom cat: write error: File too large x@y:~# cat dump-32bytes.bin > /sys/bus/w1/devices/14-00000158556e/eeprom x@y:~# hexdump -C -n 54 /sys/bus/w1/devices/14-00000158556e/eeprom 00000000 10 0b 5b ff ff ff ff ff ff ff ff ff ff ff ff ff 00000010 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 40 00000020 Signed-off-by: Angelo Dureghello <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-14pcmcia: include cs_internal.h for missing declarationsBen Dooks (Codethink)1-0/+2
Include cs_internal.h (and pcmcia/cistpl.h as required by cs_internal.h) for the declearions of cb_alloc and cb_free to silence the following sparse warnings; drivers/pcmcia/cardbus.c:64:11: warning: symbol 'cb_alloc' was not declared. Should it be static? drivers/pcmcia/cardbus.c:103:6: warning: symbol 'cb_free' was not declared. Should it be static? Signed-off-by: Ben Dooks <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-14pcmcia: include <pcmcia/ds.h> for pcmcia_parse_tupleBen Dooks (Codethink)1-0/+1
Include <pcmcia/ds.h> for pcmcia_parse_tuple declaration to fix the following sparse warning: drivers/pcmcia/cistpl.c:1287:5: warning: symbol 'pcmcia_parse_tuple' was not declared. Should it be static? Signed-off-by: Ben Dooks <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-14w1: Fix documentation warning.Dhanuka Warusadura1-0/+1
This patch fixes - warning: Function parameter or member 'of_match_table' not described in 'w1_family' Signed-off-by: Dhanuka Warusadura <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-14uio: fix irq init with dt support & irq not definedAlexandru Ardelean1-10/+4
This change also does a bit of a unification for the IRQ init code. But the actual problem is that UIO_IRQ_NONE == 0, so for the DT case where UIO_IRQ_NONE gets assigned to `uioinfo->irq`, a 2nd initialization will get triggered (for the IRQ) and this one will exit via `goto bad1`. As far as things seem to go, the only case where UIO_IRQ_NONE seems valid, is when using a device-tree. The driver has some legacy support for old platform_data structures. It looks like, for platform_data a non-existent IRQ is an invalid case (or was considered an invalid case). Which is why -ENXIO is treated only when a DT is used. Signed-off-by: Dragos Bogdan <[email protected]> Signed-off-by: Alexandru Ardelean <[email protected]> Acked-by: Damian Hobson-Garcia <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-14binder: Handle start==NULL in binder_update_page_range()Jann Horn1-3/+5
The old loop wouldn't stop when reaching `start` if `start==NULL`, instead continuing backwards to index -1 and crashing. Luckily you need to be highly privileged to map things at NULL, so it's not a big problem. Fix it by adjusting the loop so that the loop variable is always in bounds. This patch is deliberately minimal to simplify backporting, but IMO this function could use a refactor. The jump labels in the second loop body are horrible (the error gotos should be jumping to free_range instead), and both loops would look nicer if they just iterated upwards through indices. And the up_read()+mmput() shouldn't be duplicated like that. Cc: [email protected] Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Signed-off-by: Jann Horn <[email protected]> Acked-by: Christian Brauner <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-14binder: Prevent repeated use of ->mmap() via NULL mappingJann Horn1-5/+6
binder_alloc_mmap_handler() attempts to detect the use of ->mmap() on a binder_proc whose binder_alloc has already been initialized by checking whether alloc->buffer is non-zero. Before commit 880211667b20 ("binder: remove kernel vm_area for buffer space"), alloc->buffer was a kernel mapping address, which is always non-zero, but since that commit, it is a userspace mapping address. A sufficiently privileged user can map /dev/binder at NULL, tricking binder_alloc_mmap_handler() into assuming that the binder_proc has not been mapped yet. This leads to memory unsafety. Luckily, no context on Android has such privileges, and on a typical Linux desktop system, you need to be root to do that. Fix it by using the mapping size instead of the mapping address to distinguish the mapped case. A valid VMA can't have size zero. Fixes: 880211667b20 ("binder: remove kernel vm_area for buffer space") Cc: [email protected] Signed-off-by: Jann Horn <[email protected]> Acked-by: Christian Brauner <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
2019-11-14binder: Fix race between mmap() and binder_alloc_print_pages()Jann Horn1-8/+14
binder_alloc_print_pages() iterates over alloc->pages[0..alloc->buffer_size-1] under alloc->mutex. binder_alloc_mmap_handler() writes alloc->pages and alloc->buffer_size without holding that lock, and even writes them before the last bailout point. Unfortunately we can't take the alloc->mutex in the ->mmap() handler because mmap_sem can be taken while alloc->mutex is held. So instead, we have to locklessly check whether the binder_alloc has been fully initialized with binder_alloc_get_vma(), like in binder_alloc_new_buf_locked(). Fixes: 8ef4665aa129 ("android: binder: Add page usage in binder stats") Cc: [email protected] Signed-off-by: Jann Horn <[email protected]> Acked-by: Christian Brauner <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>