summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2023-09-19media: imx-mipi-csis: Remove an incorrect fwnode_handle_put() callChristophe JAILLET
The commit in Fixes has removed an fwnode_graph_get_endpoint_by_id() call in mipi_csis_subdev_init(). So the reference that was taken should not be released anymore in the error handling path of the probe and in the remove function. Remove the now incorrect fwnode_handle_put() calls. Fixes: 1029939b3782 ("media: v4l: async: Simplify async sub-device fwnode matching") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Rui Miguel Silva <rmfrfs@gmail.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2023-09-19xen: simplify evtchn_do_upcall() call mazeJuergen Gross
There are several functions involved for performing the functionality of evtchn_do_upcall(): - __xen_evtchn_do_upcall() doing the real work - xen_hvm_evtchn_do_upcall() just being a wrapper for __xen_evtchn_do_upcall(), exposed for external callers - xen_evtchn_do_upcall() calling __xen_evtchn_do_upcall(), too, but without any user Simplify this maze by: - removing the unused xen_evtchn_do_upcall() - removing xen_hvm_evtchn_do_upcall() as the only left caller of __xen_evtchn_do_upcall(), while renaming __xen_evtchn_do_upcall() to xen_evtchn_do_upcall() Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Juergen Gross <jgross@suse.com>
2023-09-18vfio/pds: Use proper PF device access helperShixiong Ou
The pci_physfn() helper exists to support cases where the physfn field may not be compiled into the pci_dev structure. We've declared this driver dependent on PCI_IOV to avoid this problem, but regardless we should follow the precedent not to access this field directly. Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn> Reviewed-by: Brett Creeley <brett.creeley@amd.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Link: https://lore.kernel.org/r/20230914021332.1929155-1-oushixiong@kylinos.cn Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2023-09-18vfio/pds: Add missing PCI_IOV dependsShixiong Ou
If PCI_ATS isn't set, then pdev->physfn is not defined. it causes a compilation issue: ../drivers/vfio/pci/pds/vfio_dev.c:165:30: error: ‘struct pci_dev’ has no member named ‘physfn’; did you mean ‘is_physfn’? 165 | __func__, pci_dev_id(pdev->physfn), pci_id, vf_id, | ^~~~~~ So adding PCI_IOV depends to select PCI_ATS. Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn> Reviewed-by: Brett Creeley <brett.creeley@amd.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Link: https://lore.kernel.org/r/20230906014942.1658769-1-oushixiong@kylinos.cn Fixes: 63f77a7161a2 ("vfio/pds: register with the pds_core PF") Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2023-09-18hwmon: (nct6775) Fix non-existent ALARM warningAhmad Khalifa
Skip non-existent ALARM attribute to avoid a shift-out-of-bounds dmesg warning. Reported-by: Doug Smythies <dsmythies@telus.net> Closes: https://lore.kernel.org/linux-hwmon/ZQVzdlHgWdFhOVyQ@debian.me/T/#mc69b690660eb50734a6b07506d74a119e0266f1b Fixes: b7f1f7b2523a ("hwmon: (nct6775) Additional TEMP registers for nct6799") Signed-off-by: Ahmad Khalifa <ahmad@khalifa.ws> Link: https://lore.kernel.org/r/20230918184722.2033225-1-ahmad@khalifa.ws Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2023-09-18ice: check netlist before enabling ICE_F_GNSSJacob Keller
Similar to the change made for ICE_F_SMA_CTRL, check the netlist before enabling support for ICE_F_GNSS. This ensures that the driver only enables the GNSS feature on devices which actually have the feature enabled in the firmware device configuration. Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Tested-by: Sunitha Mekala <sunithax.d.mekala@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2023-09-18ice: introduce ice_pf_src_tmr_ownedJacob Keller
Add ice_pf_src_tmr_owned() macro to check the function capability bit indicating if the current function owns the PTP hardware clock. This is slightly shorter than the more verbose access via hw.func_caps.ts_func_info.src_tmr_owned. Use this where possible rather than open coding its equivalent. Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2023-09-18ice: fix pin assignment for E810-T without SMA controlJacob Keller
Since commit 43c4958a3ddb ("ice: Merge pin initialization of E810 and E810T adapters"), the ice_ptp_setup_pins_e810() function has been used for both E810 and E810-T devices. The new implementation only distinguishes between whether the device has SMA control or not. It was assumed this is always true for E810-T devices. In addition, it does not set the n_per_out value appropriately when SMA control is enabled. In some cases, the E810-T device may not have access to SMA control. In that case, the E810-T device actually has access to fewer pins than a standard E810 device. Fix the implementation to correctly assign the appropriate pin counts for E810-T devices both with and without SMA control. The mentioned commit already includes the appropriate macro values for these pin counts but they were unused. Instead of assigning the default E810 values and then overwriting them, handle the cases separately in order of E810-T with SMA, E810-T without SMA, and then standard E810. This flow makes following the logic easier. Fixes: 43c4958a3ddb ("ice: Merge pin initialization of E810 and E810T adapters") Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Tested-by: Sunitha Mekala <sunithax.d.mekala@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2023-09-18ice: remove ICE_F_PTP_EXTTS feature flagJacob Keller
The ICE_F_PTP_EXTTS feature flag is ostensibly intended to support checking whether the device supports external timestamp pins. It is only checked in E810-specific code flows, and is enabled for all E810-based devices. E822 and E823 flows unconditionally enable external timestamp support. This makes the feature flag meaningless, as it is always enabled. Just unconditionally enable support for external timestamp pins and remove this unnecessary flag. Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Tested-by: Sunitha Mekala <sunithax.d.mekala@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2023-09-18ice: PTP: move quad value check inside ice_fill_phy_msg_e822Karol Kolacinski
The callers of ice_fill_phy_msg_e822 check for whether the quad number is within the expected range. Move this check inside the ice_fill_phy_msg_e822 function instead of duplicating it twice. Signed-off-by: Karol Kolacinski <karol.kolacinski@intel.com> Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2023-09-18ice: PTP: Rename macros used for PHY/QUAD port definitionsKarol Kolacinski
The ice_fill_phy_msg_e822 function uses several macros to specify the correct address when sending a sideband message to the PHY block in hardware. The names of these macros are fairly generic and confusing. Future development is going to extend the driver to support new hardware families which have different relationships between PHY and QUAD. Rename the macros for clarity and to indicate that they are E822 specific. This also matches closer to the hardware specification in the data sheet. Signed-off-by: Karol Kolacinski <karol.kolacinski@intel.com> Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2023-09-18ice: PTP: Clean up timestamp registers correctlyKarol Kolacinski
E822 PHY TS registers should not be written and the only way to clean up them is to reset QUAD memory. To ensure that the status bit for the timestamp index is cleared, ensure that ice_clear_phy_tstamp implementations first read the timestamp out. Implementations which can write the register continue to do so. Add a note to indicate this function should only be called on timestamps which have their valid bit set. Update the dynamic debug messages to reflect the actual action taken. Signed-off-by: Karol Kolacinski <karol.kolacinski@intel.com> Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2023-09-18ice: introduce hw->phy_model for handling PTP PHY differencesJacob Keller
The ice driver has PTP support which works across a couple of different device families. The device families each have different PHY hardware which have unique requirements for programming. Today, there is E810-based hardware, and E822-based hardware. To handle this, the driver checks the ice_is_e810() function to separate between the two existing families of hardware. Future development is going to add new hardware designs which have further unique requirements. To make this easier, introduce a phy_model field to the HW structure. This field represents what PHY model the current device has, and is used to allow distinguishing which logic a particular device needs. This will make supporting future upcoming hardware easier, by providing an obvious place to initialize the PHY model, and by already using switch/case statements instead of the previous if statements. Astute reviewers may notice that there are a handful of remaining checks for ice_is_e810() left in ice_ptp.c These conflict with some other cleanup patches in development, and will be fixed in the near future. Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2023-09-18ice: Support cross-timestamping for E823 devicesJacob Keller
The E822 hardware has cross timestamping support using a device feature termed "Hammock Harbor" by the data sheet. This device feature is similar to PCIe PTM, and captures the Always Running Timer (ART) simultaneously with the PTP hardware clock time. This functionality also exists on E823 devices, but is not currently enabled. Rename the cross-timestamp functions to use the _e82x postfix, indicating that the support works across the E82x family of devices and not just the E822 hardware. The flow for capturing a cross-timestamp requires an additional step on E823 devices. The GLTSYN_CMD register must be programmed with the READ_TIME command. Otherwise, the cross timestamp will always report a value of zero for the PTP hardware clock time. To fix this, call ice_ptp_src_cmd() prior to initiating the cross timestamp logic. Once the cross timestamp has completed, call ice_ptp_src_cmd() with ICE_PTP_OP to ensure that the timer command registers are cleared. Co-developed-by: Sergey Temerkhanov <sergey.temerkhanov@intel.com> Signed-off-by: Sergey Temerkhanov <sergey.temerkhanov@intel.com> Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2023-09-18ice: retry acquiring hardware semaphore during cross-timestamp requestKarol Kolacinski
The hardware for performing a cross-timestamp on E822 uses a hardware semaphore which we must acquire before initiating the cross-timestamp operation. The current implementation only attempts to acquire the semaphore once, and assumes that it will succeed. If the semaphore is busy for any reason, the cross-timestamp operation fails with -EFAULT. Instead of immediately failing, try the acquire the lock a few times with a small sleep between attempts. This ensures that most requests will go through without issue. Additionally, return -EBUSY instead of -EFAULT if the operation can't continue due to the semaphore being busy. Signed-off-by: Karol Kolacinski <karol.kolacinski@intel.com> Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2023-09-18ice: prefix clock timer command enumeration values with ICE_PTPSergey Temerkhanov
The ice driver has an enumeration for the various commands that can be programmed to the MAC and PHY for setting up hardware clock operations. Prefix these with ICE_PTP so that they are clearly namespaced to the ice driver. Signed-off-by: Sergey Temerkhanov <sergey.temerkhanov@intel.com> Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
2023-09-18wifi: wlcore: Convert to platform remove callback returning voidUwe Kleine-König
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. wlcore_remove() returned zero unconditionally. With that converted to return void instead, the wl12xx and wl18xx driver can be converted to .remove_new trivially. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230912171249.755901-1-u.kleine-koenig@pengutronix.de
2023-09-18wifi: rtl8xxxu: Add a description about the device ID 0x7392:0xb722Zenm Chen
According to the driver provided by EDIMAX, the device ID 0x7392:0xb722 belongs to EDIMAX EW-7722UTn V3, so add a comment about this. Signed-off-by: Zenm Chen <zenmchen@gmail.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230912053614.10644-1-zenmchen@gmail.com
2023-09-18wifi: rtw89: add mac_gen pointer to access mac port registersPing-Ke Shih
Using mac_gen pointer to reuse the code with WiFi 7 chips, and define MAC ports registers for WiFi 7 chips. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230911082049.33541-7-pkshih@realtek.com
2023-09-18wifi: rtw89: consolidate registers of mac port to structPing-Ke Shih
MAC port is a design to support virtual interface on single MAC hardware. For next generation chips, register addresses are changed but definitions are the same, so move registers together to be easier to reuse codes. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230911082049.33541-6-pkshih@realtek.com
2023-09-18wifi: rtw89: add chip_info::txwd_info size to generalize TX WD submitPing-Ke Shih
For existing chips, size of TX WD info is 6 words, but upcoming WiFi 7 chips become 8 words, so add a chip_info to reuse the code. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230911082049.33541-5-pkshih@realtek.com
2023-09-18wifi: rtw89: add to fill TX descriptor v2Ping-Ke Shih
The format v2 of TX descriptor contains 8-word body and 8-word info, and fields include packet size, MAC_ID, security key ID and etc. By design, it can possibly only fill body to reduce overhead, but this driver keeps thing simple, so always fill body and info currently. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230911082049.33541-4-pkshih@realtek.com
2023-09-18wifi: rtw89: add to fill TX descriptor for firmware command v2Ping-Ke Shih
This kind of TX descriptor is used to download firmware or send firmware command. Because we want to reduce descriptor overhead and this only needs two fields 'size' and 'type', hardware designers choose short form of RX descriptor for it. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230911082049.33541-3-pkshih@realtek.com
2023-09-18wifi: rtw89: add to query RX descriptor format v2Ping-Ke Shih
RX descriptor is used to provide meta data of received data. The WiFi 7 chips use different RX descriptor format, so add this parser along with hardware design. Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230911082049.33541-2-pkshih@realtek.com
2023-09-18wifi: rtw89: mcc: deal with beacon NoA if GO existsZong-Zhe Yang
In MCC STA+GO mode, we calculate NoA information and fill it into the beacon of P2P GO. Since NoA uses only 32 bits to describe time things, we need to deal with renewal when TSF[63:32] is carried. We trigger FW to notify that. Then, we can update NoA information for new time period once we get notification from FW. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908031145.20931-9-pkshih@realtek.com
2023-09-18wifi: rtw89: mcc: deal with BT slot changeZong-Zhe Yang
When receiving request of adjusting BT slot from coex. mechanism, we need to fetch the new BT slot and use the new one to calculate MCC (multi-channel concurrency) pattern. Then, we update the new MCC pattern to FW. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908031145.20931-8-pkshih@realtek.com
2023-09-18wifi: rtw89: mcc: deal with P2P PS changeZong-Zhe Yang
MCC fills duration limit of a role according to NoA description. If P2P PS changes during MCC, we don't process P2P PS via normal flow. Instead, we re-fill duration limit of the role for new NoA description, and then we do MCC update. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908031145.20931-7-pkshih@realtek.com
2023-09-18wifi: rtw89: mcc: track beacon offset and update when neededZong-Zhe Yang
In MCC STA+GC mode, the offset between TBTTs of remote AP and remote GO might change. If the change is larger than tolerance, we should update MCC after re-calculating parameters for new things. So, we track that in rtw89_track_work() now. And, we add MCC update flow to tell FW either to change durations of roles or to replace entire pattern according to how MCC plans BT slot. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908031145.20931-6-pkshih@realtek.com
2023-09-18wifi: rtw89: mcc: update role bitmap when changedZong-Zhe Yang
Each MCC (multi-channel concurrency) role maintains a bitmap of mac IDs. The bitmap is supposed to contain the two points below. * mac ID of itself * mac ID(s) of STA(s) connecting to it Under STA+GC mode, the bitmaps of both roles should not change. However, under STA+GO mode, the bitmap of GO may change due to P2P clients which connect/disconnect to/from it. FW controls (TDMA-based) MCC things via mac IDs in bitmap of each role. For example, mac IDs are required by FW when it wants to pause role1's TX in role0 slot. So, to sync between driver and FW, we update the new mac ID bitmap of GO to FW once it's changed. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908031145.20931-5-pkshih@realtek.com
2023-09-18wifi: rtw89: 52c: rfk: disable DPK during MCCZong-Zhe Yang
DPK is one kind of RF calibration. When MCC (multi-channel concurrency) start/stop, DPK needs to do extra things to be off/on. We add a chanctx callback type, RTW89_CHANCTX_CALLBACK_RFK, and register it for RTL8852C to deal with DPK according to MCC states. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908031145.20931-4-pkshih@realtek.com
2023-09-18wifi: rtw89: rfk: disable driver tracking during MCCZong-Zhe Yang
After MCC (multi-channel concurrency) is started, FW will control channel changes and use the corresponding backup of RF calibration result. And, driver RF calibration (RF-K) won't be able to keep up with the speed at which the channels are changing. So, even if we keep tracking it in driver, the RF-K result might not be good either. To save these unnecessary things, we disable driver RF-K tracking during MCC. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908031145.20931-3-pkshih@realtek.com
2023-09-18wifi: rtw89: 52c: rfk: refine MCC channel info notificationZong-Zhe Yang
RF calibration will notify FW to backup the calibration result after it is done on a channel. For MCC (multi-channel concurrency) flow, when we at RTW89_ENTITY_MODE_MCC_PREPARE mode, RF calibration should execute on second channel of MCC, i.e. RTW89_SUB_ENTITY_1, and then, notify FW to backup the result for the second one. Originally, the RF calibration flow only fit single channel case. We are planning to support MCC on RTL8852C, so we refine its RF calibration flow to fit MCC case. Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908031145.20931-2-pkshih@realtek.com
2023-09-18wifi: cw1200: Avoid processing an invalid TIM IEJeff Johnson
While converting struct ieee80211_tim_ie::virtual_map to be a flexible array it was observed that the TIM IE processing in cw1200_rx_cb() could potentially process a malformed IE in a manner that could result in a buffer over-read. Add logic to verify that the TIM IE length is large enough to hold a valid TIM payload before processing it. Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230831-ieee80211_tim_ie-v3-1-e10ff584ab5d@quicinc.com
2023-09-18wifi: brcmfmac: Replace 1-element arrays with flexible arraysJuerg Haefliger
Since commit 2d47c6956ab3 ("ubsan: Tighten UBSAN_BOUNDS on GCC"), UBSAN_BOUNDS no longer pretends 1-element arrays are unbounded. Walking 'element' and 'channel_list' will trigger warnings, so make them proper flexible arrays. False positive warnings were: UBSAN: array-index-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:6984:20 index 1 is out of range for type '__le32 [1]' UBSAN: array-index-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:1126:27 index 1 is out of range for type '__le16 [1]' for these lines of code: 6884 ch.chspec = (u16)le32_to_cpu(list->element[i]); 1126 params_le->channel_list[i] = cpu_to_le16(chanspec); Cc: stable@vger.kernel.org # 6.5+ Signed-off-by: Juerg Haefliger <juerg.haefliger@canonical.com> Reviewed-by: Kees Cook <keescook@chromium.org> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230914070227.12028-1-juerg.haefliger@canonical.com
2023-09-18wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packetPin-yen Lin
Only skip the code path trying to access the rfc1042 headers when the buffer is too small, so the driver can still process packets without rfc1042 headers. Fixes: 119585281617 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets") Signed-off-by: Pin-yen Lin <treapking@chromium.org> Acked-by: Brian Norris <briannorris@chromium.org> Reviewed-by: Matthew Wang <matthewmwang@chromium.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230908104308.1546501-1-treapking@chromium.org
2023-09-18wifi: rtw88: rtw8723d: Fix MAC address offset in EEPROMSascha Hauer
The MAC address is stored at offset 0x107 in the EEPROM, like correctly stated in the comment. Add a two bytes reserved field right before the MAC address to shift it from offset 0x105 to 0x107. With this the MAC address returned from my RTL8723du wifi stick can be correctly decoded as "Shenzhen Four Seas Global Link Network Technology Co., Ltd." Fixes: 87caeef032fc ("wifi: rtw88: Add rtw8723du chipset support") Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Reported-by: Yanik Fuchs <Yanik.fuchs@mbv.ch> Cc: stable@vger.kernel.org Acked-by: Ping-Ke Shih <pkshih@realtek.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230907071614.2032404-1-s.hauer@pengutronix.de
2023-09-18platform/x86: thinkpad_acpi: Take mutex in hotkey_resumeDennis Bonke
hotkey_status_set expects the hotkey_mutex to be held. It seems like it was missed here and that gives lockdep warnings while resuming. Fixes: 38831eaf7d4c ("platform/x86: thinkpad_acpi: use lockdep annotations") Reviewed-by: Thomas Weißschuh <linux@weissschuh.net> Signed-off-by: Dennis Bonke <admin@dennisbonke.com> Link: https://lore.kernel.org/r/20230914130356.235912-1-admin@dennisbonke.com Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2023-09-18platform/x86: intel_scu_ipc: Fail IPC send if still busyStephen Boyd
It's possible for interrupts to get significantly delayed to the point that callers of intel_scu_ipc_dev_command() and friends can call the function once, hit a timeout, and call it again while the interrupt still hasn't been processed. This driver will get seriously confused if the interrupt is finally processed after the second IPC has been sent with ipc_command(). It won't know which IPC has been completed. This could be quite disastrous if calling code assumes something has happened upon return from intel_scu_ipc_dev_simple_command() when it actually hasn't. Let's avoid this scenario by simply returning -EBUSY in this case. Hopefully higher layers will know to back off or fail gracefully when this happens. It's all highly unlikely anyway, but it's better to be correct here as we have no way to know which IPC the status register is telling us about if we send a second IPC while the previous IPC is still processing. Cc: Prashant Malani <pmalani@chromium.org> Cc: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com> Fixes: ed12f295bfd5 ("ipc: Added support for IPC interrupt mode") Signed-off-by: Stephen Boyd <swboyd@chromium.org> Link: https://lore.kernel.org/r/20230913212723.3055315-5-swboyd@chromium.org Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2023-09-18platform/x86: intel_scu_ipc: Don't override scu in ↵Stephen Boyd
intel_scu_ipc_dev_simple_command() Andy discovered this bug during patch review. The 'scu' argument to this function shouldn't be overridden by the function itself. It doesn't make any sense. Looking at the commit history, we see that commit f57fa18583f5 ("platform/x86: intel_scu_ipc: Introduce new SCU IPC API") removed the setting of the scu to ipcdev in other functions, but not this one. That was an oversight. Remove this line so that we stop overriding the scu instance that is used by this function. Reported-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Closes: https://lore.kernel.org/r/ZPjdZ3xNmBEBvNiS@smile.fi.intel.com Cc: Prashant Malani <pmalani@chromium.org> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com> Fixes: f57fa18583f5 ("platform/x86: intel_scu_ipc: Introduce new SCU IPC API") Signed-off-by: Stephen Boyd <swboyd@chromium.org> Link: https://lore.kernel.org/r/20230913212723.3055315-4-swboyd@chromium.org Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2023-09-18platform/x86: intel_scu_ipc: Check status upon timeout in ↵Stephen Boyd
ipc_wait_for_interrupt() It's possible for the completion in ipc_wait_for_interrupt() to timeout, simply because the interrupt was delayed in being processed. A timeout in itself is not an error. This driver should check the status register upon a timeout to ensure that scheduling or interrupt processing delays don't affect the outcome of the IPC return value. CPU0 SCU ---- --- ipc_wait_for_interrupt() wait_for_completion_timeout(&scu->cmd_complete) [TIMEOUT] status[IPC_STATUS_BUSY]=0 Fix this problem by reading the status bit in all cases, regardless of the timeout. If the completion times out, we'll assume the problem was that the IPC_STATUS_BUSY bit was still set, but if the status bit is cleared in the meantime we know that we hit some scheduling delay and we should just check the error bit. Cc: Prashant Malani <pmalani@chromium.org> Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com> Fixes: ed12f295bfd5 ("ipc: Added support for IPC interrupt mode") Signed-off-by: Stephen Boyd <swboyd@chromium.org> Link: https://lore.kernel.org/r/20230913212723.3055315-3-swboyd@chromium.org Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2023-09-18platform/x86: intel_scu_ipc: Check status after timeout in busy_loop()Stephen Boyd
It's possible for the polling loop in busy_loop() to get scheduled away for a long time. status = ipc_read_status(scu); // status = IPC_STATUS_BUSY <long time scheduled away> if (!(status & IPC_STATUS_BUSY)) If this happens, then the status bit could change while the task is scheduled away and this function would never read the status again after timing out. Instead, the function will return -ETIMEDOUT when it's possible that scheduling didn't work out and the status bit was cleared. Bit polling code should always check the bit being polled one more time after the timeout in case this happens. Fix this by reading the status once more after the while loop breaks. The readl_poll_timeout() macro implements all of this, and it is shorter, so use that macro here to consolidate code and fix this. There were some concerns with using readl_poll_timeout() because it uses timekeeping, and timekeeping isn't running early on or during the late stages of system suspend or early stages of system resume, but an audit of the code concluded that this code isn't called during those times so it is safe to use the macro. Cc: Prashant Malani <pmalani@chromium.org> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com> Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com> Fixes: e7b7ab3847c9 ("platform/x86: intel_scu_ipc: Sleeping is fine when polling") Signed-off-by: Stephen Boyd <swboyd@chromium.org> Link: https://lore.kernel.org/r/20230913212723.3055315-2-swboyd@chromium.org Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2023-09-18spi: imx: Take in account bits per word instead of assuming 8-bitsStefan Moring
The IMX spi driver has a hardcoded 8, breaking the driver for word lengths other than 8. Signed-off-by: Stefan Moring <stefanmoring@gmail.com> Reported-by: Sebastian Reichel <sre@kernel.org> Fixes: 15a6af94a277 ("spi: Increase imx51 ecspi burst length based on transfer length") Tested-by: Sebastian Reichel <sre@kernel.org> Link: https://lore.kernel.org/r/20230917164037.29284-1-stefanmoring@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2023-09-18net: stmmac: make stmmac_{probe|remove}_config_dt staticJisheng Zhang
Now there's no external users of these two functions, make them static so that there aren't any new usages of stmmac_probe_config_dt(). To avoid forward declaration, move stmmac_remove_config_dt() location. Signed-off-by: Jisheng Zhang <jszhang@kernel.org> Suggested-by: Russell King <linux@armlinux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-09-18net: stmmac: rename stmmac_pltfr_remove_no_dt to stmmac_pltfr_removeJisheng Zhang
Now, all users of the old stmmac_pltfr_remove() are converted to the devres helper, it's time to rename stmmac_pltfr_remove_no_dt() back to stmmac_pltfr_remove() and remove the old stmmac_pltfr_remove(). Signed-off-by: Jisheng Zhang <jszhang@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-09-18net: stmmac: dwmac-visconti: use devm_stmmac_probe_config_dt()Jisheng Zhang
Simplify the driver's probe() function by using the devres variant of stmmac_probe_config_dt(). The calling of stmmac_pltfr_remove() now needs to be switched to stmmac_pltfr_remove_no_dt(). Signed-off-by: Jisheng Zhang <jszhang@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-09-18net: stmmac: dwmac-tegra: use devm_stmmac_probe_config_dt()Jisheng Zhang
Simplify the driver's probe() function by using the devres variant of stmmac_probe_config_dt(). The calling of stmmac_pltfr_remove() now needs to be switched to stmmac_pltfr_remove_no_dt(). Signed-off-by: Jisheng Zhang <jszhang@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-09-18net: stmmac: dwmac-sunxi: use devm_stmmac_probe_config_dt()Jisheng Zhang
Simplify the driver's probe() function by using the devres variant of stmmac_probe_config_dt(). The remove_new() callback now needs to be switched to stmmac_pltfr_remove_no_dt(). Signed-off-by: Jisheng Zhang <jszhang@kernel.org> Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-09-18net: stmmac: dwmac-sun8i: use devm_stmmac_probe_config_dt()Jisheng Zhang
Simplify the driver's probe() function by using the devres variant of stmmac_probe_config_dt(). The calling of stmmac_pltfr_remove() now needs to be switched to stmmac_pltfr_remove_no_dt(). Signed-off-by: Jisheng Zhang <jszhang@kernel.org> Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-09-18net: stmmac: dwmac-stm32: use devm_stmmac_probe_config_dt()Jisheng Zhang
Simplify the driver's probe() function by using the devres variant of stmmac_probe_config_dt(). Signed-off-by: Jisheng Zhang <jszhang@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-09-18net: stmmac: dwmac-sti: use devm_stmmac_probe_config_dt()Jisheng Zhang
Simplify the driver's probe() function by using the devres variant of stmmac_probe_config_dt(). Signed-off-by: Jisheng Zhang <jszhang@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>