linux-stable.git/drivers/mfd, branch linux-6.10.y Linux kernel stable tree mfd: omap-usb-tll: Use struct_size to allocate tll 2024-08-03T07:00:03+00:00 Javier Carrasco javier.carrasco.cruz@gmail.com 2024-06-26T19:37:03+00:00 fecdddd8524d6817de66da7def22d4917e071480 [ Upstream commit 40176714c818b0b6a2ca8213cdb7654fbd49b742 ] Commit 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once") changed the memory allocation of 'tll' to consolidate it into a single allocation, introducing an incorrect size calculation. In particular, the allocation for the array of pointers was converted into a single-pointer allocation. The memory allocation used to occur in two steps: tll = devm_kzalloc(dev, sizeof(struct usbtll_omap), GFP_KERNEL); tll->ch_clk = devm_kzalloc(dev, sizeof(struct clk *) * tll->nch, GFP_KERNEL); And it turned that into the following allocation: tll = devm_kzalloc(dev, sizeof(*tll) + sizeof(tll->ch_clk[nch]), GFP_KERNEL); sizeof(tll->ch_clk[nch]) returns the size of a single pointer instead of the expected nch pointers. This bug went unnoticed because the allocation size was small enough to fit within the minimum size of a memory allocation for this particular case [1]. The complete allocation can still be done at once with the struct_size macro, which comes in handy for structures with a trailing flexible array. Fix the memory allocation to obtain the original size again. Link: https://lore.kernel.org/all/202406261121.2FFD65647@keescook/ [1] Fixes: 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once") Reviewed-by: Kees Cook <kees@kernel.org> Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com> Fixes: commit 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once") Link: https://lore.kernel.org/r/20240626-omap-usb-tll-counted_by-v2-1-4bedf20d1b51@gmail.com Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 40176714c818b0b6a2ca8213cdb7654fbd49b742 ]

Commit 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once")
changed the memory allocation of 'tll' to consolidate it into a single
allocation, introducing an incorrect size calculation.

In particular, the allocation for the array of pointers was converted
into a single-pointer allocation.

The memory allocation used to occur in two steps:

tll = devm_kzalloc(dev, sizeof(struct usbtll_omap), GFP_KERNEL);
tll->ch_clk = devm_kzalloc(dev, sizeof(struct clk *) * tll->nch,
                           GFP_KERNEL);

And it turned that into the following allocation:

tll = devm_kzalloc(dev, sizeof(*tll) + sizeof(tll->ch_clk[nch]),
                   GFP_KERNEL);

sizeof(tll->ch_clk[nch]) returns the size of a single pointer instead of
the expected nch pointers.

This bug went unnoticed because the allocation size was small enough to
fit within the minimum size of a memory allocation for this particular
case [1].

The complete allocation can still be done at once with the struct_size
macro, which comes in handy for structures with a trailing flexible
array.

Fix the memory allocation to obtain the original size again.

Link: https://lore.kernel.org/all/202406261121.2FFD65647@keescook/ [1]
Fixes: 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once")
Reviewed-by: Kees Cook <kees@kernel.org>
Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Fixes: commit 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once")
Link: https://lore.kernel.org/r/20240626-omap-usb-tll-counted_by-v2-1-4bedf20d1b51@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
mfd: rsmu: Split core code into separate module 2024-08-03T07:00:03+00:00 Arnd Bergmann arnd@arndb.de 2024-05-29T09:48:47+00:00 abf9d5c35453a46de3c8309660134ec9756b3000 [ Upstream commit c879a8c39dd55e7fabdd8d13341f7bc5200db377 ] Linking a file into two modules can have unintended side-effects and produces a W=1 warning: scripts/Makefile.build:236: drivers/mfd/Makefile: rsmu_core.o is added to multiple modules: rsmu-i2c rsmu-spi Make this one a separate module instead. Fixes: a1867f85e06e ("mfd: Add Renesas Synchronization Management Unit (SMU) support") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://lore.kernel.org/r/20240529094856.1869543-1-arnd@kernel.org Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit c879a8c39dd55e7fabdd8d13341f7bc5200db377 ]

Linking a file into two modules can have unintended side-effects
and produces a W=1 warning:

scripts/Makefile.build:236: drivers/mfd/Makefile: rsmu_core.o is added to multiple modules: rsmu-i2c rsmu-spi

Make this one a separate module instead.

Fixes: a1867f85e06e ("mfd: Add Renesas Synchronization Management Unit (SMU) support")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20240529094856.1869543-1-arnd@kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
mfd: axp20x: AXP717: Fix missing IRQ status registers range 2024-06-14T07:43:39+00:00 Andre Przywara andre.przywara@arm.com 2024-06-13T23:31:04+00:00 68f860426d500cfb697b505799244c7dfff604b1 While we list the "IRQ status *and acknowledge*" registers as volatile in the MFD description, they are missing from the writable range array, so acknowledging any interrupts was met with an -EIO error. This error propagates up, leading to the whole AXP717 driver failing to probe, which is fatal to most systems using this PMIC, since most peripherals refer one of the PMIC voltage rails. This wasn't noticed on the initial submission, since the interrupt was completely missing at this point, but the DTs now merged describe the interrupt, creating the problem. Add the five registers that hold those bits to the writable array. This fixes the boot on the Anbernic systems using the AXP717 PMIC. Fixes: b5bfc8ab2484 ("mfd: axp20x: Add support for AXP717 PMIC") Reported-by: Chris Morgan <macromorgan@hotmail.com> Signed-off-by: Andre Przywara <andre.przywara@arm.com> Reviewed-by: John Watts <contact@jookia.org> Link: https://lore.kernel.org/r/20240613233104.17529-1-andre.przywara@arm.com Signed-off-by: Lee Jones <lee@kernel.org> 
While we list the "IRQ status *and acknowledge*" registers as volatile
in the MFD description, they are missing from the writable range array,
so acknowledging any interrupts was met with an -EIO error.
This error propagates up, leading to the whole AXP717 driver failing to
probe, which is fatal to most systems using this PMIC, since most
peripherals refer one of the PMIC voltage rails.
This wasn't noticed on the initial submission, since the interrupt was
completely missing at this point, but the DTs now merged describe the
interrupt, creating the problem.

Add the five registers that hold those bits to the writable array.

This fixes the boot on the Anbernic systems using the AXP717 PMIC.

Fixes: b5bfc8ab2484 ("mfd: axp20x: Add support for AXP717 PMIC")
Reported-by: Chris Morgan <macromorgan@hotmail.com>
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Reviewed-by: John Watts <contact@jookia.org>
Link: https://lore.kernel.org/r/20240613233104.17529-1-andre.przywara@arm.com
Signed-off-by: Lee Jones <lee@kernel.org>
mfd: rsmu: support I2C SMBus access 2024-05-10T14:39:18+00:00 Min Li min.li.xe@renesas.com 2024-05-01T16:32:55+00:00 53d3ff7be4a67841d7302c8d5e6521124959fdc1 8a3400x device implements its own reg_read and reg_write, which only supports I2C bus access. This patch adds support for SMBus access. Signed-off-by: Min Li <min.li.xe@renesas.com> Link: https://lore.kernel.org/r/LV3P220MB12021342F302AADEB6C1601CA0192@LV3P220MB1202.NAMP220.PROD.OUTLOOK.COM Signed-off-by: Lee Jones <lee@kernel.org> 
8a3400x device implements its own reg_read and reg_write,
which only supports I2C bus access. This patch adds support
for SMBus access.

Signed-off-by: Min Li <min.li.xe@renesas.com>
Link: https://lore.kernel.org/r/LV3P220MB12021342F302AADEB6C1601CA0192@LV3P220MB1202.NAMP220.PROD.OUTLOOK.COM
Signed-off-by: Lee Jones <lee@kernel.org>
mfd: ssbi: Remove unused field 'slave' from 'struct ssbi' 2024-05-10T14:39:17+00:00 Christophe JAILLET christophe.jaillet@wanadoo.fr 2024-04-24T15:10:29+00:00 57b323b3dff6bdc318244bcc43d086e563b36b61 In 'struct ssbi, the 'slave' field is unused. Remove it. Found with cppcheck, unusedStructMember. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Link: https://lore.kernel.org/r/8a76de25cefb533d94dfe35062bbd9a8e72f4bb9.1713971415.git.christophe.jaillet@wanadoo.fr Signed-off-by: Lee Jones <lee@kernel.org> 
In 'struct ssbi, the 'slave' field is unused. Remove it.

Found with cppcheck, unusedStructMember.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/8a76de25cefb533d94dfe35062bbd9a8e72f4bb9.1713971415.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Lee Jones <lee@kernel.org>
mfd: kempld: Remove custom DMI matching code 2024-05-10T14:39:17+00:00 Andy Shevchenko andriy.shevchenko@linux.intel.com 2024-04-23T21:06:44+00:00 9e36775c22c74015dfa438263a00bdd169235a21 The ->init() open codes the functionality of DMI matching code. Moreover, all DMI quirks are using the same callback and driver_data. With this in mind, refactor the DMI matching code. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20240423210706.3709568-1-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones <lee@kernel.org> 
The ->init() open codes the functionality of DMI matching code.
Moreover, all DMI quirks are using the same callback and driver_data.
With this in mind, refactor the DMI matching code.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20240423210706.3709568-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Lee Jones <lee@kernel.org>
mfd: cs42l43: Update patching revision check 2024-05-10T14:39:17+00:00 Charles Keepax ckeepax@opensource.cirrus.com 2024-04-23T10:23:39+00:00 20677b34cf326262f2ba0a5eccf66d07e30c760f The firmware can only be patched once. The current code checks if the firmware supports the features required by the driver and then patches if it does not. This could lead to the device being patched twice if the device was patched before the driver took control, but with a firmware that doesn't support the features the driver requires. This would fail but potentially in unpredictable ways. The check should actually check the device is at the ROM version, and patch the device if it is. Then a separate later check should error out if the devices firmware is still too old to be supported. This will at least fail in a clean way with a nice error message. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://lore.kernel.org/r/20240423102339.2363400-1-ckeepax@opensource.cirrus.com Signed-off-by: Lee Jones <lee@kernel.org> 
The firmware can only be patched once. The current code checks if the
firmware supports the features required by the driver and then patches
if it does not. This could lead to the device being patched twice if
the device was patched before the driver took control, but with a
firmware that doesn't support the features the driver requires. This
would fail but potentially in unpredictable ways.

The check should actually check the device is at the ROM version, and
patch the device if it is. Then a separate later check should error out
if the devices firmware is still too old to be supported. This will at
least fail in a clean way with a nice error message.

Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20240423102339.2363400-1-ckeepax@opensource.cirrus.com
Signed-off-by: Lee Jones <lee@kernel.org>
mfd: timberdale: Remove redundant assignment to variable err 2024-05-10T14:39:17+00:00 Colin Ian King colin.i.king@gmail.com 2024-04-15T10:26:32+00:00 11db5421837a6627bd02efb48973f19e64804559 The variable err is being assigned -ENODEV and then err is being re-assigned the same error value via the error exit label err_mfd. The assignment is redundant and can be removed. Cleans up clang scan build warning: drivers/mfd/timberdale.c:768:3: warning: Value stored to 'err' is never read [deadcode.DeadStores] Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Link: https://lore.kernel.org/r/20240415102632.484411-1-colin.i.king@gmail.com Signed-off-by: Lee Jones <lee@kernel.org> 
The variable err is being assigned -ENODEV and then err is being
re-assigned the same error value via the error exit label err_mfd.
The assignment is redundant and can be removed.

Cleans up clang scan build warning:
drivers/mfd/timberdale.c:768:3: warning: Value stored to 'err' is
never read [deadcode.DeadStores]

Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Link: https://lore.kernel.org/r/20240415102632.484411-1-colin.i.king@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
mfd: axp20x: Convert to use Maple Tree register cache 2024-05-10T14:39:17+00:00 wangkaiyuan wangkaiyuan@inspur.com 2024-04-29T02:45:47+00:00 248327d6a06cb093a9ac973a8ac765967b92d266 The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: wangkaiyuan <wangkaiyuan@inspur.com> Link: https://lore.kernel.org/r/20240429024547.27724-1-wangkaiyuan@inspur.com Signed-off-by: Lee Jones <lee@kernel.org> 
The maple tree register cache is based on a much more modern data structure
than the rbtree cache and makes optimisation choices which are probably
more appropriate for modern systems than those made by the rbtree cache.

Signed-off-by: wangkaiyuan <wangkaiyuan@inspur.com>
Link: https://lore.kernel.org/r/20240429024547.27724-1-wangkaiyuan@inspur.com
Signed-off-by: Lee Jones <lee@kernel.org>
mfd: intel-m10-bmc: Change staging size to a variable 2024-05-10T14:39:16+00:00 Ilpo Järvinen ilpo.jarvinen@linux.intel.com 2024-04-02T18:49:25+00:00 74c6317df04bbfbb82ffed9dbb530e4075c7abed The secure update driver does a sanity-check of the image size in comparison to the size of the staging area in FLASH. Instead of hard-wiring M10BMC_STAGING_SIZE, move the staging size to the m10bmc_csr_map structure to make the size assignment more flexible. Co-developed-by: Russ Weight <russell.h.weight@intel.com> Signed-off-by: Russ Weight <russell.h.weight@intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Peter Colberg <peter.colberg@intel.com> Reviewed-by: Xu Yilun <yilun.xu@intel.com> Link: https://lore.kernel.org/r/20240402184925.1065932-1-peter.colberg@intel.com Signed-off-by: Lee Jones <lee@kernel.org> 
The secure update driver does a sanity-check of the image size in
comparison to the size of the staging area in FLASH. Instead of
hard-wiring M10BMC_STAGING_SIZE, move the staging size to the
m10bmc_csr_map structure to make the size assignment more flexible.

Co-developed-by: Russ Weight <russell.h.weight@intel.com>
Signed-off-by: Russ Weight <russell.h.weight@intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Peter Colberg <peter.colberg@intel.com>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/20240402184925.1065932-1-peter.colberg@intel.com
Signed-off-by: Lee Jones <lee@kernel.org>