[ Upstream commit 3803584a4e ]
If the number of provided enum IDs in a variable width config register
description does not match the expected number, the checker uses the
expected number for validating the individual enum IDs.
However, this may cause out-of-bounds accesses on the array holding the
enum IDs, leading to bogus enum_id conflict warnings. Worse, if the bug
is an incorrect bit field description (e.g. accidentally using "12"
instead of "-12" for a reserved field), thousands of warnings may be
printed, overflowing the kernel log buffer.
Fix this by limiting the enum ID check to the number of provided enum
IDs.
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/c7385f44f2faebb8856bcbb4e908d846fc1531fb.1705930809.git.geert+renesas@glider.be
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 53cf6b72e0 ]
Previously, the statement looked like:
slpm[x] &= ~BIT(g->grp.pins[i]);
Where:
- slpm is a unsigned int pointer;
- g->grp.pins[i] is a pin number. It can grow to more than 32.
The expected shift amount is a pin bank offset.
This bug does not occur on every group or pin: the altsetting must be
NMK_GPIO_ALT_C and the pin must be 32 or above. It might have occured.
For example, in pinctrl-nomadik-db8500.c, pin group i2c3_c_2 has the
right altsetting and pins 229 and 230.
Fixes: dbfe8ca259 ("pinctrl/nomadik: implement pin multiplexing")
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Link: https://lore.kernel.org/r/20240228-mbly-gpio-v2-5-3ba757474006@bootlin.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 08e8734d87 ]
With "W=1" and "-Wformat-truncation" build options, the kernel test robot
found a possible string truncation warning in pinctrl-s32cc.c, which uses
an 8-byte char array to hold a memory region name "map%u". Since the
maximum number of digits that a u32 value can present is 10, and the "map"
string occupies 3 bytes with a termination '\0', which means the rest 4
bytes cannot fully present the integer "X" that exceeds 4 digits.
Here we check if the number >= 10000, which is the lowest value that
contains more than 4 digits.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202311030159.iyUGjNGF-lkp@intel.com/
Signed-off-by: Chester Lin <clin@suse.com>
Link: https://lore.kernel.org/r/20231107141044.24058-1-clin@suse.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 14694179e5 ]
Trying to suspend to RAM on SAMA5D27 EVK leads to the following lockdep
warning:
============================================
WARNING: possible recursive locking detected
6.7.0-rc5-wt+ #532 Not tainted
--------------------------------------------
sh/92 is trying to acquire lock:
c3cf306c (&irq_desc_lock_class){-.-.}-{2:2}, at: __irq_get_desc_lock+0xe8/0x100
but task is already holding lock:
c3d7c46c (&irq_desc_lock_class){-.-.}-{2:2}, at: __irq_get_desc_lock+0xe8/0x100
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&irq_desc_lock_class);
lock(&irq_desc_lock_class);
*** DEADLOCK ***
May be due to missing lock nesting notation
6 locks held by sh/92:
#0: c3aa0258 (sb_writers#6){.+.+}-{0:0}, at: ksys_write+0xd8/0x178
#1: c4c2df44 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x138/0x284
#2: c32684a0 (kn->active){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x148/0x284
#3: c232b6d4 (system_transition_mutex){+.+.}-{3:3}, at: pm_suspend+0x13c/0x4e8
#4: c387b088 (&dev->mutex){....}-{3:3}, at: __device_suspend+0x1e8/0x91c
#5: c3d7c46c (&irq_desc_lock_class){-.-.}-{2:2}, at: __irq_get_desc_lock+0xe8/0x100
stack backtrace:
CPU: 0 PID: 92 Comm: sh Not tainted 6.7.0-rc5-wt+ #532
Hardware name: Atmel SAMA5
unwind_backtrace from show_stack+0x18/0x1c
show_stack from dump_stack_lvl+0x34/0x48
dump_stack_lvl from __lock_acquire+0x19ec/0x3a0c
__lock_acquire from lock_acquire.part.0+0x124/0x2d0
lock_acquire.part.0 from _raw_spin_lock_irqsave+0x5c/0x78
_raw_spin_lock_irqsave from __irq_get_desc_lock+0xe8/0x100
__irq_get_desc_lock from irq_set_irq_wake+0xa8/0x204
irq_set_irq_wake from atmel_gpio_irq_set_wake+0x58/0xb4
atmel_gpio_irq_set_wake from irq_set_irq_wake+0x100/0x204
irq_set_irq_wake from gpio_keys_suspend+0xec/0x2b8
gpio_keys_suspend from dpm_run_callback+0xe4/0x248
dpm_run_callback from __device_suspend+0x234/0x91c
__device_suspend from dpm_suspend+0x224/0x43c
dpm_suspend from dpm_suspend_start+0x9c/0xa8
dpm_suspend_start from suspend_devices_and_enter+0x1e0/0xa84
suspend_devices_and_enter from pm_suspend+0x460/0x4e8
pm_suspend from state_store+0x78/0xe4
state_store from kernfs_fop_write_iter+0x1a0/0x284
kernfs_fop_write_iter from vfs_write+0x38c/0x6f4
vfs_write from ksys_write+0xd8/0x178
ksys_write from ret_fast_syscall+0x0/0x1c
Exception stack(0xc52b3fa8 to 0xc52b3ff0)
3fa0: 00000004 005a0ae8 00000001 005a0ae8 00000004 00000001
3fc0: 00000004 005a0ae8 00000001 00000004 00000004 b6c616c0 00000020 0059d190
3fe0: 00000004 b6c61678 aec5a041 aebf1a26
This warning is raised because pinctrl-at91-pio4 uses chained IRQ. Whenever
a wake up source configures an IRQ through irq_set_irq_wake, it will
lock the corresponding IRQ desc, and then call irq_set_irq_wake on "parent"
IRQ which will do the same on its own IRQ desc, but since those two locks
share the same class, lockdep reports this as an issue.
Fix lockdep false positive by setting a different class for parent and
children IRQ
Fixes: 776180848b ("pinctrl: introduce driver for Atmel PIO4 controller")
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Link: https://lore.kernel.org/r/20231215-lockdep_warning-v1-1-8137b2510ed5@bootlin.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
commit 4198a9b571 upstream.
When in the list_for_each_entry iteration, reload of p->state->settings
with a local setting from old_state will turn the list iteration into an
infinite loop.
The typical symptom when the issue happens, will be a printk message like:
"not freeing pin xx (xxx) as part of deactivating group xxx - it is
already used for some other setting".
This is a compiler-dependent problem, one instance occurred using Clang
version 10.0 on the arm64 architecture with linux version 4.19.
Fixes: 6e5e959dde ("pinctrl: API changes to support multiple states per device")
Signed-off-by: Maria Yu <quic_aiquny@quicinc.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20231115102824.23727-1-quic_aiquny@quicinc.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The Qualcomm LPASS LPI pin controller driver uses one lock for guarding
Read-Modify-Write code for slew rate registers. However the pin
configuration and muxing registers have exactly the same RMW code but
are not protected.
Pin controller framework does not provide locking here, thus it is
possible to trigger simultaneous change of pin configuration registers
resulting in non-atomic changes.
Protect from concurrent access by re-using the same lock used to cover
the slew rate register. Using the same lock instead of adding second
one will make more sense, once we add support for newer Qualcomm SoC,
where slew rate is configured in the same register as pin
configuration/muxing.
Fixes: 6e261d1090 ("pinctrl: qcom: Add sm8250 lpass lpi pinctrl driver")
Cc: stable@vger.kernel.org
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20231013145705.219954-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
The code in find_pinctrl() takes a mutex and traverses a list of pinctrl
structures. Later the caller bumps up reference count on the found
structure. Such pattern is not safe as pinctrl that was found may get
deleted before the caller gets around to increasing the reference count.
Fix this by taking the reference count in find_pinctrl(), while it still
holds the mutex.
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Link: https://lore.kernel.org/r/ZQs1RgTKg6VJqmPs@google.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
The issue was found when we enabled CONFIG_PM and tested edge events using
libgpiod.
> # gpiomon -r gpiochip0 55
> gpiomon: error waiting for events: Permission denied
`gpiomon` will call irq_chip_pm_get() and then call pm_runtime_resume_and_get()
if (IS_ENABLED(CONFIG_PM) && sfp->gc.irq.domain->pm_dev).
pm_runtime_resume_and_get() will fail if the runtime pm of pinctrl device
is disabled.
As we expect the pinctrl driver can be always working and never suspend
during runtime, unset sfp->gc.irq.domain->pm_dev to make sure
pm_runtime_resume_and_get() won't be called when setting irq.
Fixes: 447976ab62 ("pinctrl: starfive: Add StarFive JH7110 sys controller driver")
Signed-off-by: Hal Feng <hal.feng@starfivetech.com>
Link: https://lore.kernel.org/r/20230905122105.117000-2-hal.feng@starfivetech.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Pull pin control updates from Linus Walleij:
"We have some patches to DTS[I] files in arm and arm64 as well, that
were merged here as DT headers were being changed.
The most interesting stuff is the Intel Tangier chip support and
AMLogic C3 in my opinion.
No core changes this time.
Drivers:
- Intel Tangier SoC pin control support
- AMLogic C3 SoC pin control support
- Texas Instruments AM654 SoC pin control support
- Qualcomm SM8350 and SM6115 LPASS (Low Power Audio Sub-System) pin
control support
- Qualcomm PMX75 and PM7550BA (Power Management) pin control support
- Qualcomm PMC8180 and PMC8180C (Power Management) pin control
support
- DROP the Oxnas driver as there is not enough of community interest
to keep carrying this ARM(11) port
Enhancements:
- Bias control in the MT7986 pin control driver
- Misc device tree binding enhancements such as the Broadcom 11351
being converted to YAML
- New macro: DEFINE_NOIRQ_DEV_PM_OPS() put to use
- Clean up some SPDX headers
- Handle non-unique devicetree subnode names in two Renesas drivers"
* tag 'pinctrl-v6.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (80 commits)
pinctrl: mlxbf3: Remove gpio_disable_free()
pinctrl: use capital "OR" for multiple licenses in SPDX
dt-bindings: pinctrl: renesas,rza2: Use 'additionalProperties' for child nodes
pinctrl: cherryview: fix address_space_handler() argument
pinctrl: intel: consolidate ACPI dependency
pinctrl: tegra: Switch to use DEFINE_NOIRQ_DEV_PM_OPS() helper
pinctrl: renesas: Switch to use DEFINE_NOIRQ_DEV_PM_OPS() helper
pinctrl: mvebu: Switch to use DEFINE_NOIRQ_DEV_PM_OPS() helper
pinctrl: at91: Switch to use DEFINE_NOIRQ_DEV_PM_OPS() helper
pinctrl: cherryview: Switch to use DEFINE_NOIRQ_DEV_PM_OPS() helper
pm: Introduce DEFINE_NOIRQ_DEV_PM_OPS() helper
pinctrl: mediatek: assign functions to configure pin bias on MT7986
pinctrl: mediatek: fix pull_type data for MT7981
dt-bindings: pinctrl: aspeed: Allow only defined pin mux node properties
dt-bindings: pinctrl: Drop 'phandle' properties
pinctrl: lynxpoint: Make use of pm_ptr()
pinctrl: baytrail: Make use of pm_ptr()
pinctrl: intel: Switch to use exported namespace
pinctrl: lynxpoint: reuse common functions from pinctrl-intel
pinctrl: cherryview: reuse common functions from pinctrl-intel
...
Pull spi updates from Mark Brown:
"There's been quite a lot of generic activity here, but more
administrative than featuers. We also have a bunch of new drivers,
including one that's part of a MFD so we pulled in the core parts of
that:
- Lots of work from both Yang Yingliang and Andy Shevchenko on moving
to host/device/controller based terminology for devices.
- QuadSPI SPI support for Allwinner sun6i.
- New device support Cirrus Logic CS43L43, Longsoon, Qualcomm GENI
QuPv3 and StarFive JH7110 QSPI"
* tag 'spi-v6.6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (151 commits)
spi: at91-usart: Use PTR_ERR_OR_ZERO() to simplify code
spi: spi-sn-f-ospi: switch to use modern name
spi: sifive: switch to use modern name
spi: sh: switch to use modern name
spi: sh-sci: switch to use modern name
spi: sh-msiof: switch to use modern name
spi: sh-hspi: switch to use modern name
spi: sc18is602: switch to use modern name
spi: s3c64xx: switch to use modern name
spi: rzv2m-csi: switch to use devm_spi_alloc_host()
spi: rspi: switch to use spi_alloc_host()
spi: rockchip: switch to use modern name
spi: rockchip-sfc: switch to use modern name
spi: realtek-rtl: switch to use devm_spi_alloc_host()
spi: rb4xx: switch to use modern name
spi: qup: switch to use modern name
spi: spi-qcom-qspi: switch to use modern name
spi: pxa2xx: switch to use modern name
spi: ppc4xx: switch to use modern name
spi: spl022: switch to use modern name
...
intel-pinctrl for v6.6-1
* New library driver for Intel MID to deduplicate code (Raag Jadav)
* Reuse common functions from pinctrl-intel to reduce the code (Raag Jadav)
* Move most of the exported functions to the PINCTRL_INTEL namespace
* Make use of pm_ptr() in Bay Trail and Lynxpoint drivers
* Introduce DEFINE_NOIRQ_DEV_PM_OPS() helper and use it in a few drivers
* Consolidata ACPI dependency in Kconfig (Raag Jadav)
* Fix address_space_handler() argument in Cherryview driver (Raag Jadav)
* Optinmize byt_pin_config_set() to avoid IO in error cases (Raag Jadav)
The following is an automated git shortlog grouped by driver:
at91:
- Switch to use DEFINE_NOIRQ_DEV_PM_OPS() helper
baytrail:
- Make use of pm_ptr()
- reuse common functions from pinctrl-intel
- consolidate common mask operation
cherryview:
- fix address_space_handler() argument
- Switch to use DEFINE_NOIRQ_DEV_PM_OPS() helper
- reuse common functions from pinctrl-intel
intel:
- consolidate ACPI dependency
- Switch to use exported namespace
- export common pinctrl functions
lynxpoint:
- Make use of pm_ptr()
- reuse common functions from pinctrl-intel
Merge patch series:
- Merge patch series "Introduce Intel Tangier pinctrl driver"
- Merge patch series "Reuse common functions from pinctrl-intel"
merrifield:
- Adapt to Intel Tangier driver
moorefield:
- Adapt to Intel Tangier driver
mvebu:
- Switch to use DEFINE_NOIRQ_DEV_PM_OPS() helper
pm:
- Introduce DEFINE_NOIRQ_DEV_PM_OPS() helper
renesas:
- Switch to use DEFINE_NOIRQ_DEV_PM_OPS() helper
tangier:
- Introduce Intel Tangier driver
tegra:
- Switch to use DEFINE_NOIRQ_DEV_PM_OPS() helper
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Remove support for gpio_disable_free() because it is called when the libgpiod
command "gpioset" is invoked. This gives the GPIO control back to hardware which
cancels out the effort to set the GPIO value.
Reminder of the code flow to change a GPIO value from software:
1) All GPIOs are controlled by hardware by default
2) To change the GPIO value, enable software control via a mux.
3) Once software has control over the GPIO pin, the gpio-mlxbf3 driver
will be able to change the direction and value of the GPIO.
When the user runs "gpioset gpiochip0 0=0" for example, the gpio
pin value should change from 1 to 0. In this case, mlxbf3_gpio_request_enable()
is called via gpiochip_generic_request(). The latter switches GPIO control from
hardware to software. Then the GPIO value is changed from 1 to 0. However,
gpio_disable_free() is also called which changes control back to hardware
which changes the GPIO value back to 1.
Fixes: d11f932808 ("pinctrl: mlxbf3: Add pinctrl driver support")
Signed-off-by: Asmaa Mnebhi <asmaa@nvidia.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20230818164314.8505-2-asmaa@nvidia.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
First argument of acpi_*_address_space_handler() APIs is acpi_handle of
the device, which is incorrectly passed in driver ->remove() path here.
Fix it by passing the appropriate argument and while at it, make both
API calls consistent using ACPI_HANDLE().
Fixes: a0b028597d ("pinctrl: cherryview: Add support for GMMR GPIO opregion")
Cc: stable@vger.kernel.org
Signed-off-by: Raag Jadav <raag.jadav@intel.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Since pm.h provides a helper for system no-IRQ PM callbacks,
switch the driver to use it instead of open coded variant.
With that switch pm_ptr() to pm_sleep_ptr() as the above
mentioned callbacks are only used for system sleep.
The use of the pm_sleep_ptr() macro allows the compiler
to always see the dev_pm_ops structure and related functions,
while still allowing the unused code to be removed, without
the need for the __maybe_unused markings.
Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
Reviewed-by: Paul Cercueil <paul@crapouillou.net>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Link: https://lore.kernel.org/r/20230717172821.62827-7-andriy.shevchenko@linux.intel.com
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Shubhra reports that their laptop is heating up over s2idle. Even though
it's getting into the deepest state, it appears to be having spurious
wakeup events.
While debugging a tangential issue with the RTC Carsten reports that recent
6.1.y based kernel face a similar problem.
Looking at acpidump and GPIO register comparisons these spurious wakeup
events are from the GPIO associated with the I2C touchpad on both laptops
and occur even when the touchpad is not marked as a wake source by the
kernel.
This means that the boot firmware has programmed these bits and because
Linux didn't touch them lead to spurious wakeup events from that GPIO.
To fix this issue, restore most of the code that previously would clear all
the bits associated with wakeup sources. This will allow the kernel to only
program the wake up sources that are necessary.
This is similar to what was done previously; but only the wake bits are
cleared by default instead of interrupts and wake bits. If any other
problems are reported then it may make sense to clear interrupts again too.
Cc: Sachi King <nakato@nakato.io>
Cc: stable@vger.kernel.org
Cc: Thorsten Leemhuis <regressions@leemhuis.info>
Fixes: 65f6c7c91c ("pinctrl: amd: Revert "pinctrl: amd: disable and mask interrupts on probe"")
Reported-by: Shubhra Prakash Nandi <email2shubhra@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217754
Reported-by: Carsten Hatger <xmb8dsv4@gmail.com>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217626#c28
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://lore.kernel.org/r/20230818144850.1439-1-mario.limonciello@amd.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
pinctrl: renesas: Fixes for v6.5 (take two)
- Fix race conditions in pinctrl group and function creation/remove
calls on the RZ/G2L, RZ/V2M, and RZ/A2 SoC families.
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Cleaning up the driver to use pm_ptr() and *_PM_OPS() macros that
make it simpler and allows the compiler to remove those functions
if built without CONFIG_PM and CONFIG_PM_SLEEP support.
The lp_gpio_resume() is also assigned to .thaw and .restore members.
This is not a problem as the function it enables input pins that
had been disabled by firmware and repetion of that doesn't change
the pin configuration, i.e. it is idempotent.
Reviewed-by: Paul Cercueil <paul@crapouillou.net>
Link: https://lore.kernel.org/r/20230717172821.62827-6-andriy.shevchenko@linux.intel.com
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
