aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2022-08-30dt-bindings: phy: qcom,msm8996-qmp-pcie: deprecate reset namesJohan Hovold1-5/+2
Deprecate the PHY node 'reset-names' property which specified that the reset name should have an unnecessary "lane" suffix. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20220830112923.3725-12-johan+linaro@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2022-08-30dt-bindings: phy: qcom,msm8996-qmp-pcie: deprecate PIPE clock namesJohan Hovold1-4/+1
Deprecate the PHY node 'clock-names' property which specified that the PIPE clock name should have an unnecessary "lane" suffix. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20220830112923.3725-11-johan+linaro@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2022-08-30dt-bindings: phy: qcom,msm8996-qmp-pcie: add missing child node schemaJohan Hovold1-0/+49
Add the missing the description of the PHY-provider child nodes which were ignored when converting to DT schema. Fixes: ccf51c1cedfd ("dt-bindings: phy: qcom,qmp: Convert QMP PHY bindings to yaml") Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20220830112923.3725-10-johan+linaro@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2022-08-30dt-bindings: phy: add qcom,msm8996-qmp-pcie-phy schemaJohan Hovold2-26/+146
The QMP PHY DT schema is getting unwieldy. Break out the odd-bird msm8996-qmp-pcie-phy which is the only QMP PHY that uses separate "per-lane" nodes. Add an example node based on a cleaned up version of msm8996.dtsi. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20220830112923.3725-9-johan+linaro@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2022-08-30dt-bindings: phy: qcom,qmp: drop child-node commentJohan Hovold1-1/+0
Drop the redundant comment about child nodes being required that was copied from the old binding documentation. Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20220830112923.3725-8-johan+linaro@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2022-08-30dt-bindings: phy: qcom,qmp: clean up exampleJohan Hovold1-2/+5
Clean up the example node somewhat by grouping consumer and provider properties in the child node. Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20220830112923.3725-7-johan+linaro@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2022-08-30dt-bindings: phy: qcom,qmp: clean up descriptionsJohan Hovold1-3/+3
Clean up the remaining descriptions by using uppercase "PHY" consistently and dropping redundant information from the register descriptions. Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20220830112923.3725-6-johan+linaro@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2022-08-30dt-bindings: phy: qcom,qmp: fix child node descriptionJohan Hovold1-3/+1
Fix the incorrect description of the child nodes which claimed that one node is required per lane rather than per PHY. Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20220830112923.3725-5-johan+linaro@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2022-08-30dt-bindings: phy: qcom,qmp: drop redundant descriptionsJohan Hovold1-83/+25
Drop the redundant supply and clock descriptions which did not add much information beyond what can be inferred from the corresponding resource names. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20220830112923.3725-4-johan+linaro@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2022-08-30dt-bindings: phy: qcom,qmp: sort compatible stringsJohan Hovold1-7/+7
Sort the compatible strings alphabetically to make it easier to look up entries and add new ones. Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20220830112923.3725-3-johan+linaro@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2022-08-30dt-bindings: phy: qcom,qmp: fix bogus clock-cells propertyJohan Hovold1-5/+0
The QMP PHY wrapper node is not a clock provider so drop the bogus '#clock-cells' property that was added when converting to DT schema. Fixes: ccf51c1cedfd ("dt-bindings: phy: qcom,qmp: Convert QMP PHY bindings to yaml") Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Johan Hovold <johan+linaro@kernel.org> Link: https://lore.kernel.org/r/20220830112923.3725-2-johan+linaro@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org>
2022-08-30media: platform: fix some double free in meson-ge2d and mtk-jpeg and s5p-mfcHangyu Hua3-4/+1
video_unregister_device will release device internally. There is no need to call video_device_release after video_unregister_device. Signed-off-by: Hangyu Hua <hbh25y@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30media: amphion: don't change the colorspace reported by decoder.Ming Qian1-8/+8
decoder will report the colorspace information which is parsed from the sequence header, if they are unspecified, just let application to determine it, don't change it in driver. Fixes: 6de8d628df6ef ("media: amphion: add v4l2 m2m vpu decoder stateful driver") Signed-off-by: Ming Qian <ming.qian@nxp.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30net/sched: fix netdevice reference leaks in attach_default_qdiscs()Wang Hai1-15/+16
In attach_default_qdiscs(), if a dev has multiple queues and queue 0 fails to attach qdisc because there is no memory in attach_one_default_qdisc(). Then dev->qdisc will be noop_qdisc by default. But the other queues may be able to successfully attach to default qdisc. In this case, the fallback to noqueue process will be triggered. If the original attached qdisc is not released and a new one is directly attached, this will cause netdevice reference leaks. The following is the bug log: veth0: default qdisc (fq_codel) fail, fallback to noqueue unregister_netdevice: waiting for veth0 to become free. Usage count = 32 leaked reference. qdisc_alloc+0x12e/0x210 qdisc_create_dflt+0x62/0x140 attach_one_default_qdisc.constprop.41+0x44/0x70 dev_activate+0x128/0x290 __dev_open+0x12a/0x190 __dev_change_flags+0x1a2/0x1f0 dev_change_flags+0x23/0x60 do_setlink+0x332/0x1150 __rtnl_newlink+0x52f/0x8e0 rtnl_newlink+0x43/0x70 rtnetlink_rcv_msg+0x140/0x3b0 netlink_rcv_skb+0x50/0x100 netlink_unicast+0x1bb/0x290 netlink_sendmsg+0x37c/0x4e0 sock_sendmsg+0x5f/0x70 ____sys_sendmsg+0x208/0x280 Fix this bug by clearing any non-noop qdiscs that may have been assigned before trying to re-attach. Fixes: bf6dba76d278 ("net: sched: fallback to qdisc noqueue if default qdisc setup fail") Signed-off-by: Wang Hai <wanghai38@huawei.com> Link: https://lore.kernel.org/r/20220826090055.24424-1-wanghai38@huawei.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2022-08-30media: amphion: adjust the encoder's value range of gop sizeMing Qian1-1/+1
adjust the value range of gop size from [0, 65535] to [1, 8000]. when the gop size is set to a too large value, it may affect the encoded picture quality. so constrain it to a reasonable range. Fixes: 0401e659c1f92 ("media: amphion: add v4l2 m2m vpu encoder stateful driver") Signed-off-by: Ming Qian <ming.qian@nxp.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30media: amphion: insert picture startcode after seek for vc1g formatMing Qian1-1/+1
For format vc1, the amphion vpu requires driver to help insert some custom startcode before sequence and frame. the startcode is different for vc1l and vc1g format. But the sequence startcode is only needed at the beginning, and it's not expected after seek. driver need to treat the codec header and the first frame after seek as a normal frame, and insert picture startcode for it. In previous patch, I just fix it for vc1l format, and should fix the similar issue for vc1g too. Fixes: e670f5d672ef (media: amphion: only insert the first sequence startcode for vc1l format) Signed-off-by: Ming Qian <ming.qian@nxp.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30media: cedrus: Fix endless loop in cedrus_h265_skip_bits()Dmitry Osipenko1-2/+3
The busy status bit may never de-assert if number of programmed skip bits is incorrect, resulting in a kernel hang because the bit is polled endlessly in the code. Fix it by adding timeout for the bit-polling. This problem is reproducible by setting the data_bit_offset field of the HEVC slice params to a wrong value by userspace. Cc: stable@vger.kernel.org Fixes: 7678c5462680 (media: cedrus: Fix decoding for some HEVC videos) Reported-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30media: cedrus: Set the platform driver data earlierDmitry Osipenko1-2/+2
The cedrus_hw_resume() crashes with NULL deference on driver probe if runtime PM is disabled because it uses platform data that hasn't been set up yet. Fix this by setting the platform data earlier during probe. Cc: stable@vger.kernel.org Fixes: 50e761516f2b (media: platform: Add Cedrus VPU decoder driver) Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Reviewed-by: Samuel Holland <samuel@sholland.org> Acked-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30drm/i915/selftests: allow misaligned_pin test work with unmappable memoryAndrzej Hajda1-1/+1
In case of Small BAR configurations stolen local memory can be unmappable. Since the test does not touch the memory, passing I915_BO_ALLOC_GPU_ONLY flag to i915_gem_object_create_region, will prevent -ENOSPC error from _i915_gem_object_stolen_init. Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6565 Signed-off-by: Andrzej Hajda <andrzej.hajda@intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Signed-off-by: Matthew Auld <matthew.auld@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220825154239.52343-1-andrzej.hajda@intel.com
2022-08-30media: cedrus: Fix watchdog race conditionNicolas Dufresne1-2/+2
The watchdog needs to be scheduled before we trigger the decode operation, otherwise there is a risk that the decoder IRQ will be called before we have schedule the watchdog. As a side effect, the watchdog would never be cancelled and its function would be called at an inappropriate time. This was observed while running Fluster with GStreamer as a backend. Some programming error would cause the decoder IRQ to be call very quickly after the trigger. Later calls into the driver would deadlock due to the unbalanced state. Cc: stable@vger.kernel.org Fixes: 7c38a551bda1 ("media: cedrus: Add watchdog for job completion") Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Reviewed-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30media: videobuf2: Remove vb2_find_timestamp()Ezequiel Garcia2-29/+0
Now that we've transitioned all users to vb2_find_buffer API, remove the unused vb2_find_timestamp(). Signed-off-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar> Acked-by: Tomasz Figa <tfiga@chromium.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30media: cedrus: Use vb2_find_bufferEzequiel Garcia5-82/+47
Use the newly introduced vb2_find_buffer API to get a vb2_buffer given a buffer timestamp. Cc: Maxime Ripard <mripard@kernel.org> Cc: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Cc: Jernej Skrabec <jernej.skrabec@gmail.com> Signed-off-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar> Acked-by: Tomasz Figa <tfiga@chromium.org> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30media: mediatek: vcodec: Skip non CBR bitrate modeHirokazu Honda1-1/+2
V4L2_MPEG_VIDEO_BITRATE_MODE_CBR is the only bitrate mode supported by the mediatek driver. The other bitrates must be skipped in QUERY_MENU. Fixes: d8e8aa866ed8 ("media: mediatek: vcodec: Report supported bitrate modes") Signed-off-by: Hirokazu Honda <hiroh@chromium.org> Reviewed-by: Chen-Yu Tsai <wenst@chromium.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30media: mediatek: vcodec: Add mt8188 encoder's chip nameYunfei Dong1-0/+2
Getting mt8188's chip name according to encoder compatible name. Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30tty: n_gsm: avoid call of sleeping functions from atomic contextFedor Pchelkin1-29/+24
Syzkaller reports the following problem: BUG: sleeping function called from invalid context at kernel/printk/printk.c:2347 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1105, name: syz-executor423 3 locks held by syz-executor423/1105: #0: ffff8881468b9098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x90 drivers/tty/tty_ldisc.c:266 #1: ffff8881468b9130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: tty_write_lock drivers/tty/tty_io.c:952 [inline] #1: ffff8881468b9130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: do_tty_write drivers/tty/tty_io.c:975 [inline] #1: ffff8881468b9130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: file_tty_write.constprop.0+0x2a8/0x8e0 drivers/tty/tty_io.c:1118 #2: ffff88801b06c398 (&gsm->tx_lock){....}-{2:2}, at: gsmld_write+0x5e/0x150 drivers/tty/n_gsm.c:2717 irq event stamp: 3482 hardirqs last enabled at (3481): [<ffffffff81d13343>] __get_reqs_available+0x143/0x2f0 fs/aio.c:946 hardirqs last disabled at (3482): [<ffffffff87d39722>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (3482): [<ffffffff87d39722>] _raw_spin_lock_irqsave+0x52/0x60 kernel/locking/spinlock.c:159 softirqs last enabled at (3408): [<ffffffff87e01002>] asm_call_irq_on_stack+0x12/0x20 softirqs last disabled at (3401): [<ffffffff87e01002>] asm_call_irq_on_stack+0x12/0x20 Preemption disabled at: [<0000000000000000>] 0x0 CPU: 2 PID: 1105 Comm: syz-executor423 Not tainted 5.10.137-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x107/0x167 lib/dump_stack.c:118 ___might_sleep.cold+0x1e8/0x22e kernel/sched/core.c:7304 console_lock+0x19/0x80 kernel/printk/printk.c:2347 do_con_write+0x113/0x1de0 drivers/tty/vt/vt.c:2909 con_write+0x22/0xc0 drivers/tty/vt/vt.c:3296 gsmld_write+0xd0/0x150 drivers/tty/n_gsm.c:2720 do_tty_write drivers/tty/tty_io.c:1028 [inline] file_tty_write.constprop.0+0x502/0x8e0 drivers/tty/tty_io.c:1118 call_write_iter include/linux/fs.h:1903 [inline] aio_write+0x355/0x7b0 fs/aio.c:1580 __io_submit_one fs/aio.c:1952 [inline] io_submit_one+0xf45/0x1a90 fs/aio.c:1999 __do_sys_io_submit fs/aio.c:2058 [inline] __se_sys_io_submit fs/aio.c:2028 [inline] __x64_sys_io_submit+0x18c/0x2f0 fs/aio.c:2028 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xc6 The problem happens in the following control flow: gsmld_write(...) spin_lock_irqsave(&gsm->tx_lock, flags) // taken a spinlock on TX data con_write(...) do_con_write(...) console_lock() might_sleep() // -> bug As far as console_lock() might sleep it should not be called with spinlock held. The patch replaces tx_lock spinlock with mutex in order to avoid the problem. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 32dd59f96924 ("tty: n_gsm: fix race condition in gsmld_write()") Cc: stable <stable@kernel.org> Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Link: https://lore.kernel.org/r/20220829131640.69254-3-pchelkin@ispras.ru Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-30tty: n_gsm: replace kicktimer with delayed_workFedor Pchelkin1-8/+8
A kick_timer timer_list is replaced with kick_timeout delayed_work to be able to synchronize with mutexes as a prerequisite for the introduction of tx_mutex. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: c568f7086c6e ("tty: n_gsm: fix missing timer to handle stalled links") Cc: stable <stable@kernel.org> Reviewed-by: Jiri Slaby <jirislaby@kernel.org> Suggested-by: Hillf Danton <hdanton@sina.com> Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Link: https://lore.kernel.org/r/20220829131640.69254-2-pchelkin@ispras.ru Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-30tty: n_gsm: initialize more members at gsm_alloc_mux()Tetsuo Handa1-11/+6
syzbot is reporting use of uninitialized spinlock at gsmld_write() [1], for commit 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()") allows accessing gsm->tx_lock before gsm_activate_mux() initializes it. Since object initialization should be done right after allocation in order to avoid accessing uninitialized memory, move initialization of timer/work/waitqueue/spinlock from gsmld_open()/gsm_activate_mux() to gsm_alloc_mux(). Link: https://syzkaller.appspot.com/bug?extid=cf155def4e717db68a12 [1] Fixes: 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()") Reported-by: syzbot <syzbot+cf155def4e717db68a12@syzkaller.appspotmail.com> Tested-by: syzbot <syzbot+cf155def4e717db68a12@syzkaller.appspotmail.com> Cc: stable <stable@kernel.org> Acked-by: Jiri Slaby <jirislaby@kernel.org> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Link: https://lore.kernel.org/r/2110618e-57f0-c1ce-b2ad-b6cacef3f60e@I-love.SAKURA.ne.jp Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-30tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf()Mazin Al Haddad1-1/+2
A null pointer dereference can happen when attempting to access the "gsm->receive()" function in gsmld_receive_buf(). Currently, the code assumes that gsm->recieve is only called after MUX activation. Since the gsmld_receive_buf() function can be accessed without the need to initialize the MUX, the gsm->receive() function will not be set and a NULL pointer dereference will occur. Fix this by avoiding the call to "gsm->receive()" in case the function is not initialized by adding a sanity check. Call Trace: <TASK> gsmld_receive_buf+0x1c2/0x2f0 drivers/tty/n_gsm.c:2861 tiocsti drivers/tty/tty_io.c:2293 [inline] tty_ioctl+0xa75/0x15d0 drivers/tty/tty_io.c:2692 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Link: https://syzkaller.appspot.com/bug?id=bdf035c61447f8c6e0e6920315d577cb5cc35ac5 Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open") Cc: stable <stable@kernel.org> Reported-and-tested-by: syzbot+e3563f0c94e188366dbb@syzkaller.appspotmail.com Signed-off-by: Mazin Al Haddad <mazinalhaddad05@gmail.com> Link: https://lore.kernel.org/r/20220814015211.84180-1-mazinalhaddad05@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-30media: mediatek: vcodec: add decoder compatible to support mt8188Yunfei Dong2-0/+6
1: add mt8188's compatible name: mediatek,mt8188-vcodec-dec. 2: mt8188 is lat single core architecture, using mtk_lat_sig_core_pdata to initialize private data. 3: Getting mt8188's chip name according to decoder compatible name. Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30tty: serial: atmel: Preserve previous USART mode if RS485 disabledSergiu Moga1-3/+1
Whenever the atmel_rs485_config() driver method would be called, the USART mode is reset to normal mode before even checking if RS485 flag is set, thus resulting in losing the previous USART mode in the case where the checking fails. Some tools, such as `linux-serial-test`, lead to the driver calling this method when doing the setup of the serial port: after setting the port mode (Hardware Flow Control, Normal Mode, RS485 Mode, etc.), `linux-serial-test` tries to enable/disable RS485 depending on the commandline arguments that were passed. Example of how this issue could reveal itself: When doing a serial communication with Hardware Flow Control through `linux-serial-test`, the tool would lead to the driver roughly doing the following: - set the corresponding bit to 1 (ATMEL_US_USMODE_HWHS bit in the ATMEL_US_MR register) through the atmel_set_termios() to enable Hardware Flow Control - disable RS485 through the atmel_config_rs485() method Thus, when the latter is called, the mode will be reset and the previously set bit is unset, leaving USART in normal mode instead of the expected Hardware Flow Control mode. This fix ensures that this reset is only done if the checking for RS485 succeeds and that the previous mode is preserved otherwise. Fixes: e8faff7330a35 ("ARM: 6092/1: atmel_serial: support for RS485 communications") Cc: stable <stable@kernel.org> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Sergiu Moga <sergiu.moga@microchip.com> Link: https://lore.kernel.org/r/20220824142902.502596-1-sergiu.moga@microchip.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-30media: dt-bindings: media: mediatek: vcodec: add decoder dt-bindings for mt8188Yunfei Dong1-0/+1
Add decoder document in dt-bindings yaml file for mt8188 platform. Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30media: mediatek: vcodec: Use ctx vb2_queue mutex instead of device mutexIrui Wang3-3/+7
There is only one device mutex to lock vb2_queue when running multi-instance encoding, it can be set by each encoder context. [hverkuil: fix q_mutex documentation in the header] Signed-off-by: Irui Wang <irui.wang@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30tty: serial: lpuart: disable flow control while waiting for the transmit engine to completeSherry Sun1-0/+1
When the user initializes the uart port, and waits for the transmit engine to complete in lpuart32_set_termios(), if the UART TX fifo has dirty data and the UARTMODIR enable the flow control, the TX fifo may never be empty. So here we should disable the flow control first to make sure the transmit engin can complete. Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support") Cc: stable <stable@kernel.org> Signed-off-by: Sherry Sun <sherry.sun@nxp.com> Link: https://lore.kernel.org/r/20220821101527.10066-1-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-30media: mediatek: vcodec: Fix bitstream crop information errorIrui Wang1-4/+4
Usually, the real bitstream width and height will set to driver by vidioc_s_fmt, and vidioc_try_fmt() does align to get the buffer width and height, driver calculate the encoded bitstream crop information through them. The aligned resolution will be set as real resolution now if user didn't set crop info by V4L2_SEL_TGT_CROP, and the encoded bitstream may exist green line because of crop information error. Fixs: 'b6c57d313f5f8 ("media: mtk-vcodec: venc: remove redundant code")' Signed-off-by: Irui Wang <irui.wang@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30tty: Fix lookahead_buf crash with serdevVincent Whitchurch1-5/+9
Do not follow a NULL pointer if the tty_port_client_operations does not implement the ->lookahead_buf() callback, which is the case with serdev's ttyport. Reported-by: Hans de Goede <hdegoede@redhat.com> Fixes: 6bb6fa6908ebd3 ("tty: Implement lookahead to process XON/XOFF timely") Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com> Link: https://lore.kernel.org/r/20220818115026.2237893-1-vincent.whitchurch@axis.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-30media: mediatek: vcodec: Remove encoder driver get IRQ resourceIrui Wang1-8/+0
The "platform_get_resource(pdev, IORESOURCE_IRQ, 0)" is no longer used after commit a1a2b7125e107("of/platform: Drop static setup of IRQ resource from DT core"), so just remove the function in encoder driver to avoid driver probe failed. Signed-off-by: Irui Wang <irui.wang@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30serial: fsl_lpuart: RS485 RTS polariy is inverseShenwei Wang1-2/+2
The setting of RS485 RTS polarity is inverse in the current driver. When the property of 'rs485-rts-active-low' is enabled in the dts node, the RTS signal should be LOW during sending. Otherwise, if there is no such a property, the RTS should be HIGH during sending. Fixes: 03895cf41d18 ("tty: serial: fsl_lpuart: Add support for RS-485") Cc: stable <stable@kernel.org> Signed-off-by: Nicolas Diaz <nicolas.diaz@nxp.com> Signed-off-by: Shenwei Wang <shenwei.wang@nxp.com> Link: https://lore.kernel.org/r/20220805144529.604856-1-shenwei.wang@nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-30media: mediatek: vcodec: Add mt8188 encoder driverIrui Wang1-0/+13
Add mt8188's compatible "mediatek,mt8188-vcodec-enc". Add mt8188's device private data "mt8188_pdata". Signed-off-by: Irui Wang <irui.wang@mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30vt: Clear selection before changing the fontHelge Deller1-4/+8
When changing the console font with ioctl(KDFONTOP) the new font size can be bigger than the previous font. A previous selection may thus now be outside of the new screen size and thus trigger out-of-bounds accesses to graphics memory if the selection is removed in vc_do_resize(). Prevent such out-of-memory accesses by dropping the selection before the various con_font_set() console handlers are called. Reported-by: syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com Cc: stable <stable@kernel.org> Tested-by: Khalid Masum <khalid.masum.92@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de> Link: https://lore.kernel.org/r/YuV9apZGNmGfjcor@p100 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-30media: dt-bindings: media: mediatek: vcodec: Add encoder dt-bindings for mt8188Irui Wang1-0/+1
Add encoder dt-bindings for mt8188. Signed-off-by: Irui Wang <irui.wang@mediatek.com> Acked-by: Rob Herring <robh@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30media: mediatek: vcodec: Add encoder driver support for 34-bit iovaIrui Wang4-37/+266
Encoder driver got iova from IOMMU is 34-bit, for example: Here is the sample code: encoder input frame buffer dma address is: frm_buf = vb2_dma_contig_plane_dma_addr(&vb2_v4l2_buffer->vb2_buf, 0); the value of frm_buf is 0x1_ff30_0000. encoder driver got the frm_buf and send the iova to SCP firmware through SCP IPI message, then write to encoder hardware in SCP. The iova is stored in IPI message as uint32_t data type, so the value will be truncated from *0x1_ff30_0000* to *0xff30_0000*, and then *0xff30_0000* will be written to encoder hardware, but IOMMU will help to add the high *0x1_* bit back, so IOMMU can translate the iova to PA correctly, encoder hardware can access the correct memory for encoding. Another reason to do this is the encoder hardware can't access the 34-bit iova, IOMMU will help to add the remaining high bits of iova. But for mt8188, encoder hardware can access 34-bit iova directly, and encoder driver need write all 34 bits because IOMMU can't help driver do this if the hardware support access 34-bit iova. For the reasons above, this patch is added to support transfer 34-bit iova between kernel and SCP encoder driver. Use uint64_t data type to store the iova, for compatibility with old chipsets, add some new struct definitions for 34-bit. [hverkuil: initialize wb and wb_34 to NULL] Signed-off-by: Irui Wang <irui.wang@mediatek.com> Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30serial: tegra: Remove custom frame size calculationIlpo Järvinen1-9/+3
The number of bits can be calculated using tty_get_frame_size(), no need for the driver to do it on its own. Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://lore.kernel.org/r/20220830084925.5608-6-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-30serial: sunsab: Remove frame size calculation dead-codeIlpo Järvinen1-12/+8
The driver features a custom frame length calculation but the result is never used. Remove it. Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://lore.kernel.org/r/20220830084925.5608-5-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-30serial: fsl_lpuart: Remove custom frame size calculationIlpo Järvinen1-7/+2
The number of bits can be calculated using tty_get_frame_size(), no need for the driver to do it on its own. Change bits to unsigned and baud too since we're touching the declarations line anyway (the respective core functions are typed unsigned). Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://lore.kernel.org/r/20220830084925.5608-4-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-30serial: cpm_uart: Remove custom frame size calculationIlpo Järvinen1-21/+10
The number of bits can be calculated using helpers in core, no need for the driver to do it on its own. The mode register is programmed with frame bits minus 1, rearrange the comments related to that "feature" closer to the actual write. Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://lore.kernel.org/r/20220830084925.5608-3-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-30serial: ucc_uart: Remove custom frame size calculationIlpo Järvinen1-14/+1
The number of bits can be calculated using tty_get_frame_size(), no need for the driver to do it on its own. Also remove a comment on number of bits that doesn't match the code nor the comment on ucc_uart_pram's rx_length ("minus 1" part differs). That comment seems a verbatim copy of that in cpm_uart/cpm_uart_core.c anyway so perhaps it was just copied over w/o much thinking. Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://lore.kernel.org/r/20220830084925.5608-2-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-30media: ti: cal: fix wdma irq for metadataTomi Valkeinen1-4/+27
CAL HW interrupts are inherently racy. If we get both start and end interrupts, we don't know what has happened: did the DMA for a single frame start and end, or did one frame end and a new frame start? Usually for normal pixel frames we get the interrupts separately. If we do get both, we have to guess. The assumption in the code is that the active vertical area is larger than the blanking vertical area, and thus it is more likely that we get the end of the old frame and the start of a new frame. However, for embedded data, which is only a few lines high, we always get both interrupts. Here the assumption is that we get both for the same frame. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30Merge back thermal control material for v6.1.Rafael J. Wysocki462-4899/+8215
2022-08-30media: ti: cal: combine wdma irq handlingTomi Valkeinen1-34/+25
Instead of handling the WDMA START and END interrupts separately, we need to handle both at the same time to better manage the inherent race conditions related to CAL interrupts. Change the code so that we have a single function, cal_irq_handle_wdma(), which gets two booleans, start and end, as parameters, which allows us to manage the race conditions in the following patch. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-08-30termios: get rid of stray asm/termios.h include in n_hdlc.cAl Viro1-1/+0
that's the only one outside of include/uapi/linux/termios.h and it's not even needed there - we have linux/tty.h already pulled and that pulls linux/termios.h Normally I would not consider that a sufficient reason, but there's a plenty of linux/tty.h users, and this is the only one that follows that with asm/termios.h. The situation with termios.h is genuinely convoluted, and this complicates it for no good reason. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Link: https://lore.kernel.org/r/20220821010239.1554132-2-viro@zeniv.linux.org.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>