Merge tag 'LA.UM.9.1.r1-14600-SMxxx0.QSSI14.0' of msm-4.14 into fourteen

"LA.UM.9.1.r1-14600-SMxxx0.QSSI14.0"

drivers/gpu/msm/kgsl_iommu.c

@@ -1,5 +1,5 @@
 /* Copyright (c) 2011-2021, The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
  * only version 2 as published by the Free Software Foundation.
@@ -2508,14 +2508,18 @@ static uint64_t kgsl_iommu_find_svm_region(struct kgsl_pagetable *pagetable,
 static bool iommu_addr_in_svm_ranges(struct kgsl_iommu_pt *pt,
 	u64 gpuaddr, u64 size)
 {
+	u64 end = gpuaddr + size;
+
+	/* Make sure size is not zero and we don't wrap around */
+	if (end <= gpuaddr)
+		return false;
+
 	if ((gpuaddr >= pt->compat_va_start && gpuaddr < pt->compat_va_end) &&
-		((gpuaddr + size) > pt->compat_va_start &&
-			(gpuaddr + size) <= pt->compat_va_end))
+		(end > pt->compat_va_start && end <= pt->compat_va_end))
 		return true;
 
 	if ((gpuaddr >= pt->svm_start && gpuaddr < pt->svm_end) &&
-		((gpuaddr + size) > pt->svm_start &&
-			(gpuaddr + size) <= pt->svm_end))
+		(end > pt->svm_start && end <= pt->svm_end))
 		return true;
 
 	return false;

drivers/iommu/io-pgtable-arm.c

@@ -671,9 +671,11 @@ static int arm_lpae_map_sg(struct io_pgtable_ops *ops, unsigned long iova,
 				arm_lpae_iopte *ptep = ms.pgtable +
 					ARM_LPAE_LVL_IDX(iova, MAP_STATE_LVL,
 							 data);
-				arm_lpae_init_pte(
+				ret = arm_lpae_init_pte(
 					data, iova, phys, prot, MAP_STATE_LVL,
 					ptep, ms.prev_pgtable, false);
+				if (ret)
+					goto out_err;
 				ms.num_pte++;
 			} else {
 				ret = __arm_lpae_map(data, iova, phys, pgsize,

drivers/irqchip/irq-gic.c

@@ -93,11 +93,6 @@ struct gic_chip_data {
 #ifdef CONFIG_GIC_NON_BANKED
 	void __iomem *(*get_base)(union gic_base *);
 #endif
-#ifdef CONFIG_PM
-	unsigned int irq_offset;
-	unsigned int wakeup_irqs[32];
-	unsigned int enabled_irqs[32];
-#endif
 };
 
 #ifdef CONFIG_BL_SWITCHER
@@ -238,41 +233,8 @@ static void gic_unmask_irq(struct irq_data *d)
 
 #ifdef CONFIG_PM
 
-static DEFINE_RAW_SPINLOCK(irq_controller_lock);
-
-#ifndef MAX_GIC_NR
-#define MAX_GIC_NR	1
-#endif
-
-static int gic_suspend_one(struct gic_chip_data *gic)
-{
-	unsigned int i;
-	void __iomem *base = gic_data_dist_base(gic);
-
-	if (base == NULL)
-		return 0;
-
-	for (i = 0; i * 32 < gic->gic_irqs; i++) {
-		gic->enabled_irqs[i]
-			= readl_relaxed(base + GIC_DIST_ENABLE_SET + i * 4);
-		/* disable all of them */
-		writel_relaxed(0xffffffff,
-			base + GIC_DIST_ENABLE_CLEAR + i * 4);
-		/* enable the wakeup set */
-		writel_relaxed(gic->wakeup_irqs[i],
-			base + GIC_DIST_ENABLE_SET + i * 4);
-	}
-	/* make sure all gic setting finished */
-	mb();
-	return 0;
-}
-
 static int gic_suspend(void)
 {
-	int i;
-
-	for (i = 0; i < MAX_GIC_NR; i++)
-		gic_suspend_one(&gic_data[i]);
 	return 0;
 }
 
@@ -286,20 +248,20 @@ static void gic_show_resume_irq(struct gic_chip_data *gic)
 	if (base == NULL)
 		return;
 
-	raw_spin_lock(&irq_controller_lock);
+	if (!msm_show_resume_irq_mask)
+		return;
+
 	for (i = 0; i * 32 < gic->gic_irqs; i++) {
 		enabled = readl_relaxed(base + GIC_DIST_ENABLE_CLEAR + i * 4);
 		pending[i] = readl_relaxed(base + GIC_DIST_PENDING_SET + i * 4);
 		pending[i] &= enabled;
 	}
-	raw_spin_unlock(&irq_controller_lock);
 
 	for (i = find_first_bit((unsigned long *)pending, gic->gic_irqs);
 		i < gic->gic_irqs;
 		i = find_next_bit((unsigned long *)pending,
 				gic->gic_irqs, i+1)) {
-		unsigned int irq = irq_find_mapping(gic->domain,
-						i + gic->irq_offset);
+		unsigned int irq = irq_find_mapping(gic->domain, i);
 		struct irq_desc *desc = irq_to_desc(irq);
 		const char *name = "null";
 
@@ -308,34 +270,20 @@ static void gic_show_resume_irq(struct gic_chip_data *gic)
 		else if (desc->action && desc->action->name)
 			name = desc->action->name;
 
-		pr_warn("%s: %d triggered %s\n", __func__,
-					i + gic->irq_offset, name);
+		pr_warn("%s: %d triggered %s\n", __func__, i, name);
 	}
 }
 
 static void gic_resume_one(struct gic_chip_data *gic)
 {
-	unsigned int i;
-	void __iomem *base = gic_data_dist_base(gic);
-
 	gic_show_resume_irq(gic);
-	for (i = 0; i * 32 < gic->gic_irqs; i++) {
-		/* disable all of them */
-		writel_relaxed(0xffffffff,
-			base + GIC_DIST_ENABLE_CLEAR + i * 4);
-		/* enable the enabled set */
-		writel_relaxed(gic->enabled_irqs[i],
-			base + GIC_DIST_ENABLE_SET + i * 4);
-	}
-	/* make sure all gic setting finished */
-	mb();
 }
 
 static void gic_resume(void)
 {
 	int i;
 
-	for (i = 0; i < MAX_GIC_NR; i++)
+	for (i = 0; i < CONFIG_ARM_GIC_MAX_NR; i++)
 		gic_resume_one(&gic_data[i]);
 }
 
@@ -467,30 +415,6 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
 }
 #endif
 
-#ifdef CONFIG_PM
-static int gic_set_wake(struct irq_data *d, unsigned int on)
-{
-	int ret = 0;
-
-	unsigned int reg_offset, bit_offset;
-	unsigned int gicirq = gic_irq(d);
-	struct gic_chip_data *gic_data = irq_data_get_irq_chip_data(d);
-
-	/* per-cpu interrupts cannot be wakeup interrupts */
-	WARN_ON(gicirq < 32);
-
-	reg_offset = gicirq / 32;
-	bit_offset = gicirq % 32;
-
-	if (on)
-		gic_data->wakeup_irqs[reg_offset] |=  1 << bit_offset;
-	else
-		gic_data->wakeup_irqs[reg_offset] &=  ~(1 << bit_offset);
-
-	return ret;
-}
-#endif
-
 static void __exception_irq_entry gic_handle_irq(struct pt_regs *regs)
 {
 	u32 irqstat, irqnr;
@@ -565,15 +489,9 @@ static const struct irq_chip gic_chip = {
 	.irq_set_type		= gic_set_type,
 	.irq_get_irqchip_state	= gic_irq_get_irqchip_state,
 	.irq_set_irqchip_state	= gic_irq_set_irqchip_state,
-#ifdef CONFIG_PM
-	.irq_set_wake		= gic_set_wake,
-	.flags			= IRQCHIP_SET_TYPE_MASKED |
-				  IRQCHIP_MASK_ON_SUSPEND,
-#else
 	.flags			= IRQCHIP_SET_TYPE_MASKED |
 				  IRQCHIP_SKIP_SET_WAKE |
 				  IRQCHIP_MASK_ON_SUSPEND,
-#endif
 };
 
 void __init gic_cascade_irq(unsigned int gic_nr, unsigned int irq)

drivers/media/platform/msm/npu_v2/npu_mgr.c

@@ -2556,6 +2556,13 @@ int32_t npu_host_unload_network(struct npu_client *client,
 		return -EINVAL;
 	}
 
+	if (network->is_unloading) {
+		NPU_ERR("network is unloading\n");
+		network_put(network);
+		mutex_unlock(&host_ctx->lock);
+		return -EINVAL;
+	}
+
 	if (!network->is_active) {
 		NPU_ERR("network is not active\n");
 		network_put(network);
@@ -2573,6 +2580,8 @@ int32_t npu_host_unload_network(struct npu_client *client,
 		goto free_network;
 	}
 
+	network->is_unloading = true;
+
 	NPU_DBG("Unload network %lld\n", network->id);
 	/* prepare IPC packet for UNLOAD */
 	unload_packet.header.cmd_type = NPU_IPC_CMD_UNLOAD;
@@ -2703,6 +2712,11 @@ int32_t npu_host_exec_network_v2(struct npu_client *client,
 		return -EINVAL;
 	}
 
+	if (network->is_unloading) {
+		NPU_ERR("network is unloading\n");
+		ret = -EINVAL;
+		goto exec_v2_done;
+	}
 	if (!network->is_active) {
 		NPU_ERR("network is not active\n");
 		ret = -EINVAL;

drivers/media/platform/msm/npu_v2/npu_mgr.h

@@ -91,6 +91,7 @@ struct npu_network {
 	atomic_t ref_cnt;
 	bool is_valid;
 	bool is_active;
+	bool is_unloading;
 	bool fw_error;
 	struct npu_client *client;
 	struct list_head cmd_list;

drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_fltrt_i.h

@@ -51,7 +51,7 @@ enum ipa_fltrt_equations {
 #define IPA3_0_HW_TBL_ADDR_MASK (127)
 #define IPA3_0_HW_RULE_BUF_SIZE (256)
 #define IPA3_0_HW_RULE_START_ALIGNMENT (7)
-#define IPA3_0_HW_RULE_PREFETCH_BUF_SIZE (128)
+#define IPA3_0_HW_RULE_PREFETCH_BUF_SIZE (256)
 
 
 /*

fs/exec.c

@@ -1800,6 +1800,9 @@ static int do_execveat_common(int fd, struct filename *filename,
 		goto out_unmark;
 
 	bprm->argc = count(argv, MAX_ARG_STRINGS);
+	if (bprm->argc == 0)
+		pr_warn_once("process '%s' launched '%s' with NULL argv: empty string added\n",
+			     current->comm, bprm->filename);
 	if ((retval = bprm->argc) < 0)
 		goto out;
 
@@ -1824,6 +1827,20 @@ static int do_execveat_common(int fd, struct filename *filename,
 	if (retval < 0)
 		goto out;
 
+	/*
+	 * When argv is empty, add an empty string ("") as argv[0] to
+	 * ensure confused userspace programs that start processing
+	 * from argv[1] won't end up walking envp. See also
+	 * bprm_stack_limits().
+	 */
+	if (bprm->argc == 0) {
+		const char *argv[] = { "", NULL };
+		retval = copy_strings_kernel(1, argv, bprm);
+		if (retval < 0)
+			goto out;
+		bprm->argc = 1;
+	}
+
 	retval = exec_binprm(bprm);
 	if (retval < 0)
 		goto out;