pm24.git/drivers/of, branch v6.11

Merge tag 'drm-misc-fixes-2024-08-29' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

2024-08-30T01:28:11Z

A revert for a previous TTM commit causing stuttering, 3 fixes for vmwgfx related to buffer operations, a fix for video/aperture with non-VGA primary devices, and a preemption status fix for v3d Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20240829-efficient-swift-from-lemuria-f60c05@houat

video/aperture: optionally match the device in sysfb_disable()

2024-08-26T23:14:48Z

In aperture_remove_conflicting_pci_devices(), we currently only call sysfb_disable() on vga class devices. This leads to the following problem when the pimary device is not VGA compatible: 1. A PCI device with a non-VGA class is the boot display 2. That device is probed first and it is not a VGA device so sysfb_disable() is not called, but the device resources are freed by aperture_detach_platform_device() 3. Non-primary GPU has a VGA class and it ends up calling sysfb_disable() 4. NULL pointer dereference via sysfb_disable() since the resources have already been freed by aperture_detach_platform_device() when it was called by the other device. Fix this by passing a device pointer to sysfb_disable() and checking the device to determine if we should execute it or not. v2: Fix build when CONFIG_SCREEN_INFO is not set v3: Move device check into the mutex Drop primary variable in aperture_remove_conflicting_pci_devices() Drop __init on pci sysfb_pci_dev_is_enabled() Fixes: 5ae3716cfdcd ("video/aperture: Only remove sysfb on the default vga pci device") Cc: Javier Martinez Canillas Cc: Thomas Zimmermann Cc: Helge Deller Cc: Sam Ravnborg Cc: Daniel Vetter Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Javier Martinez Canillas Reviewed-by: Thomas Zimmermann Signed-off-by: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20240821191135.829765-1-alexander.deucher@amd.com

of/irq: Prevent device address out-of-bounds read in interrupt map walk

2024-08-13T21:17:24Z

When of_irq_parse_raw() is invoked with a device address smaller than the interrupt parent node (from #address-cells property), KASAN detects the following out-of-bounds read when populating the initial match table (dyndbg="func of_irq_parse_* +p"): OF: of_irq_parse_one: dev=/soc@0/picasso/watchdog, index=0 OF: parent=/soc@0/pci@878000000000/gpio0@17,0, intsize=2 OF: intspec=4 OF: of_irq_parse_raw: ipar=/soc@0/pci@878000000000/gpio0@17,0, size=2 OF: -> addrsize=3 ================================================================== BUG: KASAN: slab-out-of-bounds in of_irq_parse_raw+0x2b8/0x8d0 Read of size 4 at addr ffffff81beca5608 by task bash/764 CPU: 1 PID: 764 Comm: bash Tainted: G O 6.1.67-484c613561-nokia_sm_arm64 #1 Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.01-12.24.03-dirty 01/01/2023 Call trace: dump_backtrace+0xdc/0x130 show_stack+0x1c/0x30 dump_stack_lvl+0x6c/0x84 print_report+0x150/0x448 kasan_report+0x98/0x140 __asan_load4+0x78/0xa0 of_irq_parse_raw+0x2b8/0x8d0 of_irq_parse_one+0x24c/0x270 parse_interrupts+0xc0/0x120 of_fwnode_add_links+0x100/0x2d0 fw_devlink_parse_fwtree+0x64/0xc0 device_add+0xb38/0xc30 of_device_add+0x64/0x90 of_platform_device_create_pdata+0xd0/0x170 of_platform_bus_create+0x244/0x600 of_platform_notify+0x1b0/0x254 blocking_notifier_call_chain+0x9c/0xd0 __of_changeset_entry_notify+0x1b8/0x230 __of_changeset_apply_notify+0x54/0xe4 of_overlay_fdt_apply+0xc04/0xd94 ... The buggy address belongs to the object at ffffff81beca5600 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 8 bytes inside of 128-byte region [ffffff81beca5600, ffffff81beca5680) The buggy address belongs to the physical page: page:00000000230d3d03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1beca4 head:00000000230d3d03 order:1 compound_mapcount:0 compound_pincount:0 flags: 0x8000000000010200(slab|head|zone=2) raw: 8000000000010200 0000000000000000 dead000000000122 ffffff810000c300 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffff81beca5500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffffff81beca5600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffffff81beca5680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5700: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ================================================================== OF: -> got it ! Prevent the out-of-bounds read by copying the device address into a buffer of sufficient size. Signed-off-by: Stefan Wiehler Link: https://lore.kernel.org/r/20240812100652.3800963-1-stefan.wiehler@nokia.com Signed-off-by: Rob Herring (Arm)

Merge tag 'iommu-updates-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux

2024-07-19T16:59:58Z

Pull iommu updates from Will Deacon: "Core: - Support for the "ats-supported" device-tree property - Removal of the 'ops' field from 'struct iommu_fwspec' - Introduction of iommu_paging_domain_alloc() and partial conversion of existing users - Introduce 'struct iommu_attach_handle' and provide corresponding IOMMU interfaces which will be used by the IOMMUFD subsystem - Remove stale documentation - Add missing MODULE_DESCRIPTION() macro - Misc cleanups Allwinner Sun50i: - Ensure bypass mode is disabled on H616 SoCs - Ensure page-tables are allocated below 4GiB for the 32-bit page-table walker - Add new device-tree compatible strings AMD Vi: - Use try_cmpxchg64() instead of cmpxchg64() when updating pte Arm SMMUv2: - Print much more useful information on context faults - Fix Qualcomm TBU probing when CONFIG_ARM_SMMU_QCOM_DEBUG=n - Add new Qualcomm device-tree bindings Arm SMMUv3: - Support for hardware update of access/dirty bits and reporting via IOMMUFD - More driver rework from Jason, this time updating the PASID/SVA support to prepare for full IOMMUFD support - Add missing MODULE_DESCRIPTION() macro - Minor fixes and cleanups NVIDIA Tegra: - Fix for benign fwspec initialisation issue exposed by rework on the core branch Intel VT-d: - Use try_cmpxchg64() instead of cmpxchg64() when updating pte - Use READ_ONCE() to read volatile descriptor status - Remove support for handling Execute-Requested requests - Avoid calling iommu_domain_alloc() - Minor fixes and refactoring Qualcomm MSM: - Updates to the device-tree bindings" * tag 'iommu-updates-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (72 commits) iommu/tegra-smmu: Pass correct fwnode to iommu_fwspec_init() iommu/vt-d: Fix identity map bounds in si_domain_init() iommu: Move IOMMU_DIRTY_NO_CLEAR define dt-bindings: iommu: Convert msm,iommu-v0 to yaml iommu/vt-d: Fix aligned pages in calculate_psi_aligned_address() iommu/vt-d: Limit max address mask to MAX_AGAW_PFN_WIDTH docs: iommu: Remove outdated Documentation/userspace-api/iommu.rst arm64: dts: fvp: Enable PCIe ATS for Base RevC FVP iommu/of: Support ats-supported device-tree property dt-bindings: PCI: generic: Add ats-supported property iommu: Remove iommu_fwspec ops OF: Simplify of_iommu_configure() ACPI: Retire acpi_iommu_fwspec_ops() iommu: Resolve fwspec ops automatically iommu/mediatek-v1: Clean up redundant fwspec checks RDMA/usnic: Use iommu_paging_domain_alloc() wifi: ath11k: Use iommu_paging_domain_alloc() wifi: ath10k: Use iommu_paging_domain_alloc() drm/msm: Use iommu_paging_domain_alloc() vhost-vdpa: Use iommu_paging_domain_alloc() ...

Merge tag 'devicetree-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

2024-07-18T01:07:31Z

Pull devicetree updates from Rob Herring: "DT Bindings: - Convert and add a bunch of IBM FSI related bindings - Add a new schema listing legacy compatibles which will (probably) never be documented. This will silence various checks warning about them. - Add bindings for Sierra Wireless mangOH Green SPI IoT interface, new Arm 2024 Cortex and Neoverse CPUs, QCom sc8180x PDC, QCom SDX75 GPI DMA, imx8mp/imx8qxp fsl,irqsteer, and Renesas RZ/G2UL CRU and CSI-2 blocks - Convert Spreadtrum sprd-timer, FSL cpm_qe, FSL fsl,ls-scfg-msi, FSL q(b)man-*, FSL qoriq-mc, and img,pdc-wdt bindings to DT schema - Drop obsolete stericsson,abx500.txt DT core: - Update dtc to upstream version v1.7.0-93-g1df7b047fe43 - Add support to run DT validation on DTs with applied overlays - Add helper for creating boolean properties in dynamic nodes and use that for dynamic PCI nodes - Clean-up early parsing of '#{address,size}-cells'" * tag 'devicetree-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (39 commits) dt-bindings: timer: sprd-timer: convert to YAML dt-bindings: incomplete-devices: document devices without bindings dt-bindings: trivial-devices: document the Sierra Wireless mangOH Green SPI IoT interface scripts/dtc: Update to upstream version v1.7.0-93-g1df7b047fe43 dt-bindings: soc: fsl: Add fsl,ls1028a-reset for reset syscon node dt-bindings: soc: fsl: cpm_qe: convert to yaml format dt-bindings: i2c: i2c-fsi: Convert to json-schema dt-bindings: fsi: Document the FSI Hub Controller dt-bindings: fsi: Document the AST2700 FSI controller dt-bindings: fsi: ast2600-fsi-master: Convert to json-schema dt-bindings: fsi: ibm,i2cr-fsi-master: Reference common FSI controller dt-bindings: fsi: Document the FSI controller common properties dt-bindings: fsi: Document the IBM SBEFIFO engine dt-bindings: fsi: p9-occ: Convert to json-schema dt-bindings: fsi: Document the IBM SCOM engine dt-bindings: fsi: fsi2spi: Document SPI controller child nodes dt-bindings: interrupt-controller: convert fsl,ls-scfg-msi to yaml dt-bindings: soc: fsl: Convert q(b)man-* to yaml format dt-bindings: misc: fsl,qoriq-mc: convert to yaml format dt-bindings: drop stale Anson Huang from maintainers ...

of: unittest: Add a test case for of_changeset_add_prop_bool()

2024-07-08T23:40:30Z

Improve of_unittest_changeset_prop() to have a test case for the newly introduced of_changeset_add_prop_bool(). Signed-off-by: Herve Codina Link: https://lore.kernel.org/r/20240527161450.326615-17-herve.codina@bootlin.com Signed-off-by: Rob Herring (Arm)

of: dynamic: Introduce of_changeset_add_prop_bool()

2024-07-08T23:40:30Z

APIs to add some properties in a changeset exist but nothing to add a DT boolean property (i.e. a property without any values). Fill this lack with of_changeset_add_prop_bool(). Signed-off-by: Herve Codina Link: https://lore.kernel.org/r/20240527161450.326615-16-herve.codina@bootlin.com Signed-off-by: Rob Herring (Arm)

of: unittest: Add tests for changeset properties adding

2024-07-08T23:40:30Z

No test cases are present to test the of_changes_add_prop_*() function family. Add a new test to fill this lack. Functions tested are: - of_changes_add_prop_string() - of_changes_add_prop_string_array() - of_changeset_add_prop_u32() - of_changeset_add_prop_u32_array() Signed-off-by: Herve Codina Link: https://lore.kernel.org/r/20240527161450.326615-15-herve.codina@bootlin.com Signed-off-by: Rob Herring (Arm)

of: dynamic: Constify parameter in of_changeset_add_prop_string_array()

2024-07-08T23:40:30Z

The str_array parameter has no reason to be an un-const array. Indeed, elements of the 'str_array' array are not changed by the code. Constify the 'str_array' array parameter. With this const qualifier added, the following construction is allowed: static const char * const tab_str[] = { "string1", "string2" }; of_changeset_add_prop_string_array(..., tab_str, ARRAY_SIZE(tab_str)); Signed-off-by: Herve Codina Link: https://lore.kernel.org/r/20240527161450.326615-14-herve.codina@bootlin.com Signed-off-by: Rob Herring (Arm)

of/irq: Disable "interrupt-map" parsing for PASEMI Nemo

2024-07-08T21:42:20Z

Once again, we've broken PASEMI Nemo boards with its incomplete "interrupt-map" translations. Commit 935df1bd40d4 ("of/irq: Factor out parsing of interrupt-map parent phandle+args from of_irq_parse_raw()") changed the behavior resulting in the existing work-around not taking effect. Rework the work-around to just skip parsing "interrupt-map" up front by using the of_irq_imap_abusers list. Fixes: 935df1bd40d4 ("of/irq: Factor out parsing of interrupt-map parent phandle+args from of_irq_parse_raw()") Reported-by: Christian Zigotzky Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/86ed8ba2sp.wl-maz@kernel.org Signed-off-by: Rob Herring (Arm)