summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2020-12-07media: ccs-pll: Add support for extended input PLL clock dividerSakari Ailus
CCS allows odd PLL dividers other than 1, granted that the corresponding capability bit is set. Support this both in the PLL calculator and the CCS driver. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07s390/qeth: make qeth_qdio_handle_aob() more robustJulian Wiedmann
When qeth_qdio_handle_aob() frees dangling allocations in the notified TX buffer, there are rare tear-down cases where qeth_drain_output_queue() would later call qeth_clear_output_buffer() for the same buffer - and thus end up walking the buffer a second time to check for dangling kmem_cache allocations. Luckily current code previously scrubs such a buffer, so qeth_clear_output_buffer() would find buf->buffer->element[i].addr as NULL and not do anything. But this is fragile, and we can easily improve it by consistently clearing the ->is_header flag after freeing the allocation. Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-12-07s390/qeth: remove QETH_QDIO_BUF_HANDLED_DELAYED stateJulian Wiedmann
Reuse the QETH_QDIO_BUF_EMPTY state to indicate that a TX buffer has been completed with a QAOB notification, and may be cleaned up by qeth_cleanup_handled_pending(). Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-12-07s390/qeth: don't replace a fully completed async TX bufferJulian Wiedmann
For TX buffers that require an additional async notification via QAOB, the TX completion code can now manage all the necessary processing if the notification has already occurred (or is occurring concurrently). In such cases we can avoid replacing the metadata that is associated with the buffer's slot on the ring, and just keep using the current one. As qeth_clear_output_buffer() will also handle any kmem cache-allocated memory that was mapped into the TX buffer, qeth_qdio_handle_aob() doesn't need to worry about it. While at it, also remove the unneeded forward declaration for qeth_init_qdio_out_buf(). Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-12-07s390/qeth: use dev->groups for common sysfs attributesJulian Wiedmann
All qeth devices have a minimum set of sysfs attributes, and non-OSN devices share a group of additional attributes. Depending on whether the device is forced to use a specific discipline, the device_type then specifies further attributes. Shift the common attributes into dev->groups, so that the device_type only contains the discipline-specific attributes. This avoids exposing the common attributes to the disciplines, and nicely cleans up our sysfs code. While replacing the qeth_l*_*_device_attributes() helpers, switch from sysfs_*_groups() to the more generic device_*_groups(). Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-12-07s390/ccwgroup: use bus->dev_groups for bus-based sysfs attributesJulian Wiedmann
Bus drivers have their own way of describing the sysfs attributes that all devices on a bus should provide. Switch ccwgroup_attr_groups over to use bus->dev_groups, and thus free up dev->groups for usage by the ccwgroup device drivers. While adjusting the attribute naming, use ATTRIBUTE_GROUPS() to get rid of some boilerplate code. Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> Acked-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-12-07s390/qeth: don't call INIT_LIST_HEAD() on iob's list entryJulian Wiedmann
INIT_LIST_HEAD() only needs to be called on actual list heads. While at it clarify the naming of the field. Suggested-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2020-12-07media: ccs-pll: Add support for decoupled OP domain calculationSakari Ailus
Add support for decoupled OP domain clock calculation. This means that the number of VT and OP domain clocks are no longer dependent on the number of CSI-2 lanes in the lane speed mode. The support also replaces the existing quirk flag to calculate OP domain clocks per lane. Also support decoupled OP domain calculation in the CCS driver. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07media: ccs: Add support for lane speed modelSakari Ailus
Convey the relevant PLL flags to the PLL calculator. Also the lane speed model affects how the link rate is calculated on the CSI-2 bus, as the rate is total of all lanes. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07media: ccs-pll: Add support for lane speed modelSakari Ailus
CCS PLL includes a capability to calculate the VT clocks on per-lane basis. Add support for this feature. Move calculation of the pixel rate on the CSI-2 bus early in the function as everything needed to calculate it is already available. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07media: ccs-pll: Use explicit 32-bit unsigned typeSakari Ailus
Use uint32_t instead of unsigned int for a variable that contains explicitly 32-bit numbers. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07media: ccs-pll: Fix check for PLL multiplier upper boundSakari Ailus
The additional multiplier (for higher VT timing) of the PLL multiplier was checked against the upper limit but the result was rounded up, possibly producing too high additional multiplier. Round down instead to keep within hardware limits. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07media: ccs-pll: Fix comment on check against maximum PLL multiplierSakari Ailus
The comment is about minimum PLL multiplier but the related check really deals with the maximum PLL multiplier. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07media: ccs-pll: Avoid overflow in pre-PLL divisor lower bound searchSakari Ailus
The external clock frequency times the PLL multiplier may exceed the value range of 32-bit unsigned integers. Instead perform the same calculation y using two divisions. The result has some potential to be different, but that's ok: this number is used to limit the range of pre-PLL divisors to find optimal values. So the effect of the rare case of a different result here would mean an invalid pre-PLL divisor is tried. That will be found out a little later in any case. Also guard against dividing by zero if the external clock frequency is higher than the maximum OP PLL output clock --- a rather improbable case. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07media: ccs-pll: Fix condition for pre-PLL divider lower boundSakari Ailus
The lower bound of the pre-PLL divider was calculated based on OP SYS clock frequency which is also affected by the OP SYS clock divider. This is wrong. The right clock frequency is that of the PLL output clock. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07media: ccs-pll: Begin calculation from OP system clock frequencySakari Ailus
The OP system clock frequency defines the CSI-2 bus clock frequency, not the PLL output clock frequency. Both values were overwritten in the end, but the wrong limit value was used for the OP system clock frequency, possibly leading to too high frequencies being used. Also remove now duplicated calculation of OP system clock frequency later in the PLL calculator. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07media: ccs-pll: Use the BIT macroSakari Ailus
Use the BIT macro for setting individual bits. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07media: ccs-pll: Document the structs in the header as well as the functionSakari Ailus
The CCS pll is used by the CCS driver at the moment, but documenting the interface makes sense. It's non-trivial and the calculator could be used elsewhere. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07media: ccs-pll: Move the flags field down, away from 8-bit fieldsSakari Ailus
This way the struct will use less memory, with better packing and no waste due to unsigned long. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07media: ccs-pll: Differentiate between CSI-2 D-PHY and C-PHYSakari Ailus
Differentiate between CSI-2 D-PHY and C-PHY. This does not yet include support for C-PHY. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07media: ccs-pll: Remove parallel bus supportSakari Ailus
The parallel bus PLL calculation has no users. Remove it. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07media: ccs-pll: End search if there are no better values availableSakari Ailus
The VT divisor search can be ended if we've already found the value that corresponds exactly the total divisor, as there are no better (lower) values available. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07media: ccs-pll: Use correct VT divisor for calculating VT SYS divisorSakari Ailus
Use the correct video timing divisor to calculate the SYS divisor. Instead of the current value, the minimum was used. This could have resulted in a too low SYS divisor. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07media: ccs-pll: Split limits and PLL configuration into front and back partsSakari Ailus
The CCS spec supports a lot of variation in the PLL. Split the PLL in front and back parts to better prepare for supporting it. Also use CCS compliant naming for IP and OP PLL frequencies (i.e. include "clk" in the name). Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07media: ccs-pll: Don't use div_u64 to divide a 32-bit numberSakari Ailus
pll->pll_op_clk_freq is a 32-bit number. It does not need div_u64 to divide it. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2020-12-07USB: add RESET_RESUME quirk for Snapscan 1212Oliver Neukum
I got reports that some models of this old scanner need this when using runtime PM. Signed-off-by: Oliver Neukum <oneukum@suse.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20201207130323.23857-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-07usb: typec: tps6598x: Export some power supply propertiesGuido Günther
This allows downstream supplies and userspace to detect whether external power is supplied. Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Signed-off-by: Guido Günther <agx@sigxcpu.org> Link: https://lore.kernel.org/r/2c8e81d9da9ff05b065f66edba915edd11f74065.1607166657.git.agx@sigxcpu.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-07usb: typec: tps6598x: Select USB_ROLE_SWITCH and REGMAP_I2CGuido Günther
This is more in line with what tcpm does and will be needed to avoid recursive dependency like > drivers/power/supply/Kconfig:2:error: recursive dependency detected! drivers/power/supply/Kconfig:2: symbol POWER_SUPPLY is selected by TYPEC_TPS6598X drivers/usb/typec/Kconfig:64: symbol TYPEC_TPS6598X depends on REGMAP_I2C drivers/base/regmap/Kconfig:19: symbol REGMAP_I2C is selected by CHARGER_ADP5061 drivers/power/supply/Kconfig:93: symbol CHARGER_ADP5061 depends on POWER_SUPPLY For a resolution refer to Documentation/kbuild/kconfig-language.rst subsection "Kconfig recursive dependency limitations" when selecting POWER_SUPPLY. Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com> Signed-off-by: Guido Günther <agx@sigxcpu.org> Link: https://lore.kernel.org/r/6d11417c42d82caf66e08af160397959eb7d0d60.1607166657.git.agx@sigxcpu.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-07usb: mtu3: fix memory corruption in mtu3_debugfs_regset()Dan Carpenter
This code is using the wrong sizeof() so it does not allocate enough memory. It allocates 32 bytes but 72 are required. That will lead to memory corruption. Fixes: ae07809255d3 ("usb: mtu3: add debugfs interface files") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/X8ikqc4Mo2/0G72j@mwanda Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-07USB: dummy-hcd: Fix uninitialized array use in init()Bui Quang Minh
This error path err_add_pdata: for (i = 0; i < mod_data.num; i++) kfree(dum[i]); can be triggered when not all dum's elements are initialized. Fix this by initializing all dum's elements to NULL. Acked-by: Alan Stern <stern@rowland.harvard.edu> Cc: stable <stable@vger.kernel.org> Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com> Link: https://lore.kernel.org/r/1607063090-3426-1-git-send-email-minhquangbui99@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-07usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ulFabio Estevam
According to the i.MX6UL Errata document: https://www.nxp.com/docs/en/errata/IMX6ULCE.pdf ERR007881 also affects i.MX6UL, so pass the CI_HDRC_DISABLE_DEVICE_STREAMING flag to workaround the issue. Fixes: 52fe568e5d71 ("usb: chipidea: imx: add imx6ul usb support") Cc: <stable@vger.kernel.org> Signed-off-by: Fabio Estevam <festevam@gmail.com> Signed-off-by: Peter Chen <peter.chen@nxp.com> Link: https://lore.kernel.org/r/20201207020909.22483-2-peter.chen@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-07USB: core: drop pipe-type check from new control-message helpersJohan Hovold
The new control-message helpers include a pipe-type check which is almost completely redundant. Control messages are generally sent to the default pipe which always exists and is of the correct type since its endpoint representation is created by USB core as part of enumeration for all devices. There is currently only one instance of a driver in the tree which use a control endpoint other than endpoint 0 (and it does not use the new helpers). Drivers should be testing for the existence of their resources at probe rather than at runtime, but to catch drivers failing to do so USB core already does a sanity check on URB submission and triggers a WARN(). Having the same sanity check done in the helper only suppresses the warning without allowing us to find and fix the drivers. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20201204085110.20055-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-07spi: atmel-quadspi: Fix use-after-free on unbindLukas Wunner
atmel_qspi_remove() accesses the driver's private data after calling spi_unregister_controller() even though that function releases the last reference on the spi_controller and thereby frees the private data. Fix by switching over to the new devm_spi_alloc_master() helper which keeps the private data accessible until the driver has unbound. Fixes: 2d30ac5ed633 ("mtd: spi-nor: atmel-quadspi: Use spi-mem interface for atmel-quadspi driver") Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: <stable@vger.kernel.org> # v5.0+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation Cc: <stable@vger.kernel.org> # v5.0+ Cc: Piotr Bugalski <bugalski.piotr@gmail.com> Link: https://lore.kernel.org/r/4b05c65cf6f1ea3251484fe9a00b4c65478a1ae3.1607286887.git.lukas@wunner.de Signed-off-by: Mark Brown <broonie@kernel.org>
2020-12-07spi: npcm-fiu: Disable clock in probe error pathLukas Wunner
If the call to devm_spi_register_master() fails on probe of the NPCM FIU SPI driver, the clock "fiu->clk" is erroneously not unprepared and disabled. Fix it. Fixes: ace55c411b11 ("spi: npcm-fiu: add NPCM FIU controller driver") Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: <stable@vger.kernel.org> # v5.4+ Cc: Tomer Maimon <tmaimon77@gmail.com> Link: https://lore.kernel.org/r/9ae62f4e1cfe542bec57ac2743e6fca9f9548f55.1607286887.git.lukas@wunner.de Signed-off-by: Mark Brown <broonie@kernel.org>
2020-12-07spi: ar934x: Don't leak SPI master in probe error pathLukas Wunner
If the call to devm_spi_register_controller() fails on probe of the Qualcomm Atheros AR934x/QCA95xx SPI driver, the spi_controller struct is erroneously not freed. Fix by switching over to the new devm_spi_alloc_master() helper. Moreover, the controller's clock is enabled on probe but not disabled if any of the subsequent probe steps fail. Finally, there's an ordering issue in ar934x_spi_remove() wherein the clock is disabled even though the controller is not yet unregistered. It is unregistered after ar934x_spi_remove() by the devres framework. As long as it is not unregistered, SPI transfers may still be ongoing and disabling the clock may break them. It is not possible to use devm_spi_register_controller() in this case, so move to the non-devm variant. All of these bugs have existed since the driver was first introduced, so it seems fair to fix them together in a single commit. Fixes: 047980c582af ("spi: add driver for ar934x spi controller") Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: <stable@vger.kernel.org> # v5.7+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation Cc: <stable@vger.kernel.org> # v5.7+ Cc: Chuanhong Guo <gch981213@gmail.com> Link: https://lore.kernel.org/r/1d58367d74d55741e0c2730a51a2b65012c8ab33.1607286887.git.lukas@wunner.de Signed-off-by: Mark Brown <broonie@kernel.org>
2020-12-07spi: mt7621: Don't leak SPI master in probe error pathLukas Wunner
If the calls to device_reset() or devm_spi_register_controller() fail on probe of the MediaTek MT7621 SPI driver, the spi_controller struct is erroneously not freed. Fix by switching over to the new devm_spi_alloc_master() helper. Additionally, there's an ordering issue in mt7621_spi_remove() wherein the spi_controller is unregistered after disabling the SYS clock. The correct order is to call spi_unregister_controller() *before* this teardown step because bus accesses may still be ongoing until that function returns. All of these bugs have existed since the driver was first introduced, so it seems fair to fix them together in a single commit. Fixes: 1ab7f2a43558 ("staging: mt7621-spi: add mt7621 support") Signed-off-by: Lukas Wunner <lukas@wunner.de> Reviewed-by: Stefan Roese <sr@denx.de> Cc: <stable@vger.kernel.org> # v4.17+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation Cc: <stable@vger.kernel.org> # v4.17+ Link: https://lore.kernel.org/r/72b680796149f5fcda0b3f530ffb7ee73b04f224.1607286887.git.lukas@wunner.de Signed-off-by: Mark Brown <broonie@kernel.org>
2020-12-07spi: mt7621: Disable clock in probe error pathLukas Wunner
Commit 702b15cb9712 ("spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe") sought to disable the SYS clock on probe errors, but only did so for 2 of 3 potentially failing calls: The clock needs to be disabled on failure of devm_spi_register_controller() as well. Moreover, the commit purports to fix a bug in commit cbd66c626e16 ("spi: mt7621: Move SPI driver out of staging") but in reality the bug has existed since the driver was first introduced. Fixes: 1ab7f2a43558 ("staging: mt7621-spi: add mt7621 support") Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: <stable@vger.kernel.org> # v4.17+: 702b15cb9712: spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe Cc: <stable@vger.kernel.org> # v4.17+ Cc: Qinglang Miao <miaoqinglang@huawei.com> Link: https://lore.kernel.org/r/36ad42760087952fb7c10aae7d2628547c26a7ec.1607286887.git.lukas@wunner.de Signed-off-by: Mark Brown <broonie@kernel.org>
2020-12-07media: netup_unidvb: Don't leak SPI master in probe error pathLukas Wunner
If the call to spi_register_master() fails on probe of the NetUP Universal DVB driver, the spi_master struct is erroneously not freed. Likewise, if spi_new_device() fails, the spi_controller struct is not unregistered. Plug the leaks. While at it, fix an ordering issue in netup_spi_release() wherein spi_unregister_master() is called after fiddling with the IRQ control register. The correct order is to call spi_unregister_master() *before* this teardown step because bus accesses may still be ongoing until that function returns. Fixes: 52b1eaf4c59a ("[media] netup_unidvb: NetUP Universal DVB-S/S2/T/T2/C PCI-E card driver") Signed-off-by: Lukas Wunner <lukas@wunner.de> Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Cc: <stable@vger.kernel.org> # v4.3+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation Cc: <stable@vger.kernel.org> # v4.3+ Cc: Kozlov Sergey <serjk@netup.ru> Link: https://lore.kernel.org/r/c4c24f333fc7840f4a3db24789e6e10dd660bede.1607286887.git.lukas@wunner.de Signed-off-by: Mark Brown <broonie@kernel.org>
2020-12-07spi: sc18is602: Don't leak SPI master in probe error pathLukas Wunner
If the call to devm_gpiod_get_optional() fails on probe of the NXP SC18IS602/603 SPI driver, the spi_master struct is erroneously not freed. Fix by switching over to the new devm_spi_alloc_master() helper. Fixes: f99008013e19 ("spi: sc18is602: Add reset control via gpio pin.") Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: <stable@vger.kernel.org> # v4.9+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation Cc: <stable@vger.kernel.org> # v4.9+ Cc: Phil Reid <preid@electromag.com.au> Link: https://lore.kernel.org/r/d5f715527b894b91d530fe11a86f51b3184a4e1a.1607286887.git.lukas@wunner.de Signed-off-by: Mark Brown <broonie@kernel.org>
2020-12-07spi: rb4xx: Don't leak SPI master in probe error pathLukas Wunner
If the calls to devm_clk_get(), devm_spi_register_master() or clk_prepare_enable() fail on probe of the Mikrotik RB4xx SPI driver, the spi_master struct is erroneously not freed. Fix by switching over to the new devm_spi_alloc_master() helper. Fixes: 05aec357871f ("spi: Add SPI driver for Mikrotik RB4xx series boards") Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: <stable@vger.kernel.org> # v4.2+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation Cc: <stable@vger.kernel.org> # v4.2+ Cc: Bert Vermeulen <bert@biot.com> Link: https://lore.kernel.org/r/369bf26d71927f60943b1d9d8f51810f00b0237d.1607286887.git.lukas@wunner.de Signed-off-by: Mark Brown <broonie@kernel.org>
2020-12-07spi: gpio: Don't leak SPI master in probe error pathLukas Wunner
If the call to devm_spi_register_master() fails on probe of the GPIO SPI driver, the spi_master struct is erroneously not freed: After allocating the spi_master, its reference count is 1. The driver unconditionally decrements the reference count on unbind using a devm action. Before calling devm_spi_register_master(), the driver unconditionally increments the reference count because on success, that function will decrement the reference count on unbind. However on failure, devm_spi_register_master() does *not* decrement the reference count, so the spi_master is leaked. The issue was introduced by commits 8b797490b4db ("spi: gpio: Make sure spi_master_put() is called in every error path") and 79567c1a321e ("spi: gpio: Use devm_spi_register_master()"), which sought to plug leaks introduced by 9b00bc7b901f ("spi: spi-gpio: Rewrite to use GPIO descriptors") but missed this remaining leak. The situation was later aggravated by commit d3b0ffa1d75d ("spi: gpio: prevent memory leak in spi_gpio_probe"), which introduced a use-after-free because it releases a reference on the spi_master if devm_add_action_or_reset() fails even though the function already does that. Fix by switching over to the new devm_spi_alloc_master() helper. Fixes: 9b00bc7b901f ("spi: spi-gpio: Rewrite to use GPIO descriptors") Signed-off-by: Lukas Wunner <lukas@wunner.de> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Cc: <stable@vger.kernel.org> # v4.17+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation Cc: <stable@vger.kernel.org> # v5.1-: 8b797490b4db: spi: gpio: Make sure spi_master_put() is called in every error path Cc: <stable@vger.kernel.org> # v5.1-: 45beec351998: spi: bitbang: Introduce spi_bitbang_init() Cc: <stable@vger.kernel.org> # v5.1-: 79567c1a321e: spi: gpio: Use devm_spi_register_master() Cc: <stable@vger.kernel.org> # v5.4-: d3b0ffa1d75d: spi: gpio: prevent memory leak in spi_gpio_probe Cc: <stable@vger.kernel.org> # v4.17+ Cc: Navid Emamdoost <navid.emamdoost@gmail.com> Cc: Andrey Smirnov <andrew.smirnov@gmail.com> Link: https://lore.kernel.org/r/86eaed27431c3d709e3748eb76ceecbfc790dd37.1607286887.git.lukas@wunner.de Signed-off-by: Mark Brown <broonie@kernel.org>
2020-12-07spi: spi-mtk-nor: Don't leak SPI master in probe error pathLukas Wunner
If the call to devm_spi_register_controller() fails on probe of the MediaTek SPI NOR driver, the spi_controller struct is erroneously not freed. Since commit a1daaa991ed1 ("spi: spi-mtk-nor: use dma_alloc_coherent() for bounce buffer"), the same happens if the call to dmam_alloc_coherent() fails. Since commit 3bfd9103c7af ("spi: spi-mtk-nor: Add power management support"), the same happens if the call to mtk_nor_enable_clk() fails. Fix by switching over to the new devm_spi_alloc_master() helper. Fixes: 881d1ee9fe81 ("spi: add support for mediatek spi-nor controller") Signed-off-by: Lukas Wunner <lukas@wunner.de> Reviewed-by: Ikjoon Jang <ikjn@chromium.org> Cc: <stable@vger.kernel.org> # v5.7+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation Cc: <stable@vger.kernel.org> # v5.7+ Cc: Chuanhong Guo <gch981213@gmail.com> Link: https://lore.kernel.org/r/d5b9f0289465394e73dedb8ec51e180a8f1dffc9.1607286887.git.lukas@wunner.de Signed-off-by: Mark Brown <broonie@kernel.org>
2020-12-07spi: mxic: Don't leak SPI master in probe error pathLukas Wunner
If the calls to devm_clk_get() or devm_ioremap_resource() fail on probe of the Macronix SPI driver, the spi_master struct is erroneously not freed. Fix by switching over to the new devm_spi_alloc_master() helper. Fixes: b942d80b0a39 ("spi: Add MXIC controller driver") Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: <stable@vger.kernel.org> # v5.0+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation Cc: <stable@vger.kernel.org> # v5.0+ Cc: Mason Yang <masonccyang@mxic.com.tw> Link: https://lore.kernel.org/r/4fa6857806e7e75741c05d057ac9df3564460114.1607286887.git.lukas@wunner.de Signed-off-by: Mark Brown <broonie@kernel.org>
2020-12-07spi: rpc-if: Fix use-after-free on unbindLukas Wunner
rpcif_spi_remove() accesses the driver's private data after calling spi_unregister_controller() even though that function releases the last reference on the spi_controller and thereby frees the private data. Fix by switching over to the new devm_spi_alloc_master() helper which keeps the private data accessible until the driver has unbound. Fixes: eb8d6d464a27 ("spi: add Renesas RPC-IF driver") Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: <stable@vger.kernel.org> # v5.9+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation Cc: <stable@vger.kernel.org> # v5.9+ Cc: Sergei Shtylyov <s.shtylyov@omprussia.ru> Link: https://lore.kernel.org/r/c5da472c28021da2f6517441685cef033d40b140.1607286887.git.lukas@wunner.de Signed-off-by: Mark Brown <broonie@kernel.org>
2020-12-07spi: pxa2xx: Fix use-after-free on unbindLukas Wunner
pxa2xx_spi_remove() accesses the driver's private data after calling spi_unregister_controller() even though that function releases the last reference on the spi_controller and thereby frees the private data. Fix by switching over to the new devm_spi_alloc_master/slave() helper which keeps the private data accessible until the driver has unbound. Fixes: 32e5b57232c0 ("spi: pxa2xx: Fix controller unregister order") Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: <stable@vger.kernel.org> # v2.6.17+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation Cc: <stable@vger.kernel.org> # v2.6.17+: 32e5b57232c0: spi: pxa2xx: Fix controller unregister order Cc: <stable@vger.kernel.org> # v2.6.17+ Link: https://lore.kernel.org/r/5764b04d4a6e43069ebb7808f64c2f774ac6f193.1607286887.git.lukas@wunner.de Signed-off-by: Mark Brown <broonie@kernel.org>
2020-12-07spi: spi-sh: Fix use-after-free on unbindLukas Wunner
spi_sh_remove() accesses the driver's private data after calling spi_unregister_master() even though that function releases the last reference on the spi_master and thereby frees the private data. Fix by switching over to the new devm_spi_alloc_master() helper which keeps the private data accessible until the driver has unbound. Fixes: 680c1305e259 ("spi/spi_sh: use spi_unregister_master instead of spi_master_put in remove path") Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: <stable@vger.kernel.org> # v3.0+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation Cc: <stable@vger.kernel.org> # v3.0+ Cc: Axel Lin <axel.lin@ingics.com> Link: https://lore.kernel.org/r/6d97628b536baf01d5e3e39db61108f84d44c8b2.1607286887.git.lukas@wunner.de Signed-off-by: Mark Brown <broonie@kernel.org>
2020-12-07spi: spi-qcom-qspi: Fix use-after-free on unbindLukas Wunner
qcom_qspi_remove() accesses the driver's private data after calling spi_unregister_master() even though that function releases the last reference on the spi_master and thereby frees the private data. Fix by switching over to the new devm_spi_alloc_master() helper which keeps the private data accessible until the driver has unbound. Fixes: f79a158d37c2 ("spi: spi-qcom-qspi: Use OPP API to set clk/perf state") Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: <stable@vger.kernel.org> # v5.9+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation Cc: <stable@vger.kernel.org> # v5.9+ Cc: Rajendra Nayak <rnayak@codeaurora.org> Link: https://lore.kernel.org/r/b6d3c4dce571d78a532fd74f27def0d5dc8d8a24.1607286887.git.lukas@wunner.de Signed-off-by: Mark Brown <broonie@kernel.org>
2020-12-07spi: spi-geni-qcom: Fix use-after-free on unbindLukas Wunner
spi_geni_remove() accesses the driver's private data after calling spi_unregister_master() even though that function releases the last reference on the spi_master and thereby frees the private data. Moreover, since commit 1a9e489e6128 ("spi: spi-geni-qcom: Use OPP API to set clk/perf state"), spi_geni_probe() leaks the spi_master allocation if the calls to dev_pm_opp_set_clkname() or dev_pm_opp_of_add_table() fail. Fix by switching over to the new devm_spi_alloc_master() helper which keeps the private data accessible until the driver has unbound and also avoids the spi_master leak on probe. Fixes: 561de45f72bd ("spi: spi-geni-qcom: Add SPI driver support for GENI based QUP") Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: <stable@vger.kernel.org> # v4.20+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation Cc: <stable@vger.kernel.org> # v4.20+ Cc: Rajendra Nayak <rnayak@codeaurora.org> Cc: Girish Mahadevan <girishm@codeaurora.org> Link: https://lore.kernel.org/r/dfa1d8c41b8acdfad87ec8654cd124e6e3cb3f31.1607286887.git.lukas@wunner.de Signed-off-by: Mark Brown <broonie@kernel.org>
2020-12-07spi: davinci: Fix use-after-free on unbindLukas Wunner
davinci_spi_remove() accesses the driver's private data after it's been freed with spi_master_put(). Fix by moving the spi_master_put() to the end of the function. Fixes: fe5fd2540947 ("spi: davinci: Use dma_request_chan() for requesting DMA channel") Signed-off-by: Lukas Wunner <lukas@wunner.de> Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Cc: <stable@vger.kernel.org> # v4.7+ Link: https://lore.kernel.org/r/412f7eb1cf8990e0a3a2153f4c577298deab623e.1607286887.git.lukas@wunner.de Signed-off-by: Mark Brown <broonie@kernel.org>
2020-12-07spi: atmel-quadspi: Move common code outside of if elseTudor Ambarus
QSPI_IFR is set as the last QSPI Instruction Frame register regardless of the sama5d2 or sam9x60 version of the IP. Move the writing of QSPI_IFR outside of the IP specific code. Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com> Link: https://lore.kernel.org/r/20201207135959.154124-5-tudor.ambarus@microchip.com Signed-off-by: Mark Brown <broonie@kernel.org>