Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

A15 porting other patches #12

Merged
merged 7 commits into from
Dec 8, 2024
Merged

A15 porting other patches #12

merged 7 commits into from
Dec 8, 2024

Conversation

xyzhao2018
Copy link
Contributor

No description provided.

6ZhangWei and others added 6 commits December 5, 2024 21:43
@6ZhangWei @xyzhao2018
media: platform: Add virtio-camera
492d84b 
Porting virtio-camera driver for the Android14.

This driver is originally designed by
Dmitry Osipenko <[email protected]>.
Link:
https://gitlab.collabora.com/dmitry.osipenko/
linux-kernel-rd/-/tree/virtio-camera

Also extend its functions to support multiple video streams
for one virtio-camera instance.
Per stream per /dev/videoX.

Tracked-On: OAM-125247
Tracked-On: OAM-127456
Tracked-On: OAM-127455
Tracked-On: OAM-125249
Signed-off-by: Zhangwei6 <[email protected]>
Signed-off-by: Zhao, Shirley <[email protected]>
@6ZhangWei @xyzhao2018
update: virtio_fs support multi-queues and done-work
9cf3749 
Now the virtio-fs has a bad performance.
For improves its performance, we let the virtio-fs
driver to support multiple virtqueues and
create a separate done-work queue.

Keeping these improvements in the virtio-fs driver,
and combining them with changes and parameter configurations
in the backend, we can see some performance
improvements. For example, rand_read performance can be
increased from the original 300+MB/s to 400+MB/s.

Test done:
   Configure virtio-fs, then start the VM
   and you can use virtio-fs normally in the VM
   Also use the fio tool to see its performance.

Tracked-On: OAM-125247
Tracked-On: OAM-127456
Tracked-On: OAM-127455
Tracked-On: OAM-125249
Signed-off-by: Zhangwei6 <[email protected]>
Signed-off-by: Shiqing Gao <[email protected]>
Signed-off-by: Zhao, Shirley <[email protected]>
@weichenli-intel @xyzhao2018
Modify virtio camera for ivshmem
aa7125b 
This patch add alloc memory from ivshmem feature.

move the virtio-camera patch to open source repo.

Tracked-On: OAM-125247
Tracked-On: OAM-127456
Tracked-On: OAM-127455
Tracked-On: OAM-125249
Signed-off-by: Zhao, Shirley <[email protected]>
Signed-off-by: Chenli Wei <[email protected]>
@izhouwu @xyzhao2018
QNX: W/A for virtio-input over shmem
ca06059 
For virtio-input devices, writing to config area is defined as selecting
config pages. But in virtio over shmem implement, this operation is not
supported. The W/A is to update config area upon config selection in BE,
and delay a short while after cfg write in FE. This delay does not reduce
performance as it only happens during init stage.

Test done:
Using keyboard/mouse/touchscreen over virtio-input on QNX

Tracked-On: OAM-125247
Tracked-On: OAM-127456
Tracked-On: OAM-127455
Tracked-On: OAM-125249
Signed-off-by: Zhao, Shirley <[email protected]>
Signed-off-by: Wu Zhou <[email protected]>
@yonghuah @xyzhao2018
uio: extend uio driver to supports msix
2312923 
 This patch extends UIO PCI generic driver to
  support MSI-X interrupt.

Tracked-On: OAM-125247
Tracked-On: OAM-127456
Tracked-On: OAM-127455
Tracked-On: OAM-125249
Signed-off-by: Yuan Liu <[email protected]>
Signed-off-by: Yonghua Huang <[email protected]>
Signed-off-by: Zhao, Shirley <[email protected]>
@yonghuah @xyzhao2018
uio: enable per-application notification with ivshemem
7314f34 
  this patch to enable per-application notification support
  when enabling ivhsmem doorbell feature.

Tracked-On: OAM-125247
Tracked-On: OAM-127456
Tracked-On: OAM-127455
Tracked-On: OAM-125249
Signed-off-by: Zhao, Shirley <[email protected]>
Signed-off-by: Yonghua Huang <[email protected]>
@sysopenci
Copy link

Android CI has started Engineering Build for this issue ,Please check the linked Tracked-On issue/Android CI Web for more details.

@sysopenci
Copy link

SUCCESS: Android CI has completed Engineering Build for this issue.Please check the linked Tracked-On issue/Android CI Web for more details.

@sysopenci
Copy link

Android CI has started MERGE Build for this pr ,Please check the linked Tracked-On issue/Android CI Web for more details.

@sysopenci sysopenci merged commit dcc17ba into projectceladon:main Dec 8, 2024
26 checks passed
@sysopenci
Copy link

Android CI has completed MERGE Build for this pr, build is SUCCESS. Please check the linked Tracked-On issue/Android CI Web for more details. For Binaries: /cactus-absp-or-local/celadon-merge/864

simonami99 pushed a commit that referenced this pull request Jan 15, 2025
@l1k @gregkh
PCI: Fix use-after-free of slot->bus on hot remove
e5d5c04 
commit c7acef99642b763ba585f4a43af999fcdbcc3dc4 upstream.

Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock.

Since commit 0fc7088 ("thunderbolt: Reset USB4 v2 host router") and
commit 59a54c5f3dbd ("thunderbolt: Reset topology created by the boot
firmware"), USB4 v2 and v1 Host Routers are reset on probe of the
thunderbolt driver.

The reset clears the Presence Detect State and Data Link Layer Link Active
bits at the USB4 Host Router's Root Port and thus causes hot removal of the
dock.

The crash occurs when pciehp is unbound from one of the dock's Downstream
Ports:  pciehp creates a pci_slot on bind and destroys it on unbind.  The
pci_slot contains a pointer to the pci_bus below the Downstream Port, but
a reference on that pci_bus is never acquired.  The pci_bus is destroyed
before the pci_slot, so a use-after-free ensues when pci_slot_release()
accesses slot->bus.

In principle this should not happen because pci_stop_bus_device() unbinds
pciehp (and therefore destroys the pci_slot) before the pci_bus is
destroyed by pci_remove_bus_device().

However the stacktrace provided by Dennis shows that pciehp is unbound from
pci_remove_bus_device() instead of pci_stop_bus_device().  To understand
the significance of this, one needs to know that the PCI core uses a two
step process to remove a portion of the hierarchy:  It first unbinds all
drivers in the sub-hierarchy in pci_stop_bus_device() and then actually
removes the devices in pci_remove_bus_device().  There is no precaution to
prevent driver binding in-between pci_stop_bus_device() and
pci_remove_bus_device().

In Dennis' case, it seems removal of the hierarchy by pciehp races with
driver binding by pci_bus_add_devices().  pciehp is bound to the
Downstream Port after pci_stop_bus_device() has run, so it is unbound by
pci_remove_bus_device() instead of pci_stop_bus_device().  Because the
pci_bus has already been destroyed at that point, accesses to it result in
a use-after-free.

One might conclude that driver binding needs to be prevented after
pci_stop_bus_device() has run.  However it seems risky that pci_slot points
to pci_bus without holding a reference.  Solely relying on correct ordering
of driver unbind versus pci_bus destruction is certainly not defensive
programming.

If pci_slot has a need to access data in pci_bus, it ought to acquire a
reference.  Amend pci_create_slot() accordingly.  Dennis reports that the
crash is not reproducible with this change.

Abridged stacktrace:

  pcieport 0000:00:07.0: PME: Signaling with IRQ 156
  pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+
  pci_bus 0000:20: dev 00, created physical slot 12
  pcieport 0000:00:07.0: pciehp: Slot(12): Card not present
  ...
  pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0
  Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI
  CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1
  RIP: 0010:dev_driver_string+0x12/0x40
  pci_destroy_slot
  pciehp_remove
  pcie_port_remove_service
  device_release_driver_internal
  bus_remove_device
  device_del
  device_unregister
  remove_iter
  device_for_each_child
  pcie_portdrv_remove
  pci_device_remove
  device_release_driver_internal
  bus_remove_device
  device_del
  pci_remove_bus_device (recursive invocation)
  pci_remove_bus_device
  pciehp_unconfigure_device
  pciehp_disable_slot
  pciehp_handle_presence_or_link_change
  pciehp_ist

Link: https://lore.kernel.org/r/4bfd4c0e976c1776cd08e76603903b338cf25729.1728579288.git.lukas@wunner.de
Reported-by: Dennis Wassenberg <[email protected]>
Closes: https://lore.kernel.org/r/[email protected]/
Tested-by: Dennis Wassenberg <[email protected]>
Signed-off-by: Lukas Wunner <[email protected]>
Signed-off-by: Bjorn Helgaas <[email protected]>
Reviewed-by: Mika Westerberg <[email protected]>
Cc: [email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@yaoxinshi-intel yaoxinshi-intel yaoxinshi-intel approved these changes

@dyang23 dyang23 Awaiting requested review from dyang23

Assignees
No one assigned
Labels
Developer Approved Engineering Build Successful PR approved Valid commit message
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
9 participants
@xyzhao2018 @sysopenci @dyang23 @yaoxinshi-intel @6ZhangWei @weichenli-intel @izhouwu @yonghuah @sunausti