linux-stable.git/drivers/soc/qcom, branch linux-6.7.y

soc: qcom: llcc: Check return value on Broadcast_OR reg read

2024-03-26T22:18:13+00:00

[ Upstream commit ceeaddc19a90039861564d8e1078b778a8f95101 ]

Commit c72ca343f911 ("soc: qcom: llcc: Add v4.1 HW version support")
introduced a new 4.1 if statement in llcc_update_act_ctrl() without
considering that ret might be overwritten. So, add return value check
after Broadcast_OR register read in llcc_update_act_ctrl().

Fixes: c72ca343f911 ("soc: qcom: llcc: Add v4.1 HW version support")
Signed-off-by: Unnathi Chalicheemala 
Reviewed-by: Elliot Berman 
Reviewed-by: Mukesh Ojha 
Link: https://lore.kernel.org/r/20240212183515.433873-1-quic_uchalich@quicinc.com
Signed-off-by: Bjorn Andersson 
Signed-off-by: Sasha Levin

soc: qcom: socinfo: rename PM2250 to PM4125

2024-03-26T22:18:05+00:00

[ Upstream commit 5155e48128826d0c5999dc9f47aa746df54da448 ]

It seems, the only actual mentions of PM2250 can be found are related to
the Qualcomm RB1 platform. However even RB1 schematics use PM4125 as a
PMIC name. Rename PM2250 to PM4125 to follow the documentation.

Fixes: 082f9bc60f33 ("soc: qcom: spmi-pmic: add more PMIC SUBTYPE IDs")
Fixes: 112d96fd2927 ("soc: qcom: socinfo: Add some PMICs")
Acked-by: Konrad Dybcio 
Signed-off-by: Dmitry Baryshkov 
Link: https://lore.kernel.org/r/20240128-pm2250-pm4125-rename-v2-1-d51987e9f83a@linaro.org
Signed-off-by: Bjorn Andersson 
Signed-off-by: Sasha Levin

soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free

2024-03-26T22:17:49+00:00

commit b979f2d50a099f3402418d7ff5f26c3952fb08bb upstream.

A recent DRM series purporting to simplify support for "transparent
bridges" and handling of probe deferrals ironically exposed a
use-after-free issue on pmic_glink_altmode probe deferral.

This has manifested itself as the display subsystem occasionally failing
to initialise and NULL-pointer dereferences during boot of machines like
the Lenovo ThinkPad X13s.

Specifically, the dp-hpd bridge is currently registered before all
resources have been acquired which means that it can also be
deregistered on probe deferrals.

In the meantime there is a race window where the new aux bridge driver
(or PHY driver previously) may have looked up the dp-hpd bridge and
stored a (non-reference-counted) pointer to the bridge which is about to
be deallocated.

When the display controller is later initialised, this triggers a
use-after-free when attaching the bridges:

	dp -> aux -> dp-hpd (freed)

which may, for example, result in the freed bridge failing to attach:

	[drm:drm_bridge_attach [drm]] *ERROR* failed to attach bridge /soc@0/phy@88eb000 to encoder TMDS-31: -16

or a NULL-pointer dereference:

	Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
	...
	Call trace:
	  drm_bridge_attach+0x70/0x1a8 [drm]
	  drm_aux_bridge_attach+0x24/0x38 [aux_bridge]
	  drm_bridge_attach+0x80/0x1a8 [drm]
	  dp_bridge_init+0xa8/0x15c [msm]
	  msm_dp_modeset_init+0x28/0xc4 [msm]

The DRM bridge implementation is clearly fragile and implicitly built on
the assumption that bridges may never go away. In this case, the fix is
to move the bridge registration in the pmic_glink_altmode driver to
after all resources have been looked up.

Incidentally, with the new dp-hpd bridge implementation, which registers
child devices, this is also a requirement due to a long-standing issue
in driver core that can otherwise lead to a probe deferral loop (see
commit fbc35b45f9f6 ("Add documentation on meaning of -EPROBE_DEFER")).

[DB: slightly fixed commit message by adding the word 'commit']
Fixes: 080b4e24852b ("soc: qcom: pmic_glink: Introduce altmode support")
Fixes: 2bcca96abfbf ("soc: qcom: pmic-glink: switch to DRM_AUX_HPD_BRIDGE")
Cc:       # 6.3
Cc: Bjorn Andersson 
Cc: Dmitry Baryshkov 
Signed-off-by: Johan Hovold 
Reviewed-by: Bjorn Andersson 
Reviewed-by: Dmitry Baryshkov 
Signed-off-by: Dmitry Baryshkov 
Link: https://patchwork.freedesktop.org/patch/msgid/20240217150228.5788-4-johan+linaro@kernel.org
[ johan: backport to 6.7 which does not have DRM aux bridge ]
Signed-off-by: Johan Hovold 
Signed-off-by: Sasha Levin

soc: qcom: pmic_glink: Fix boot when QRTR=m

2024-03-06T14:53:56+00:00

commit f79ee78767ca60e7a2c89eacd2dbdf237d97e838 upstream.

We need to bail out before adding/removing devices if we are going to
-EPROBE_DEFER. Otherwise boot can get stuck in a probe deferral loop due
to a long-standing issue in driver core (see commit fbc35b45f9f6 ("Add
documentation on meaning of -EPROBE_DEFER")).

Deregistering the altmode child device can potentially also trigger bugs
in the DRM bridge implementation, which does not expect bridges to go
away.

[DB: slightly fixed commit message by adding the word 'commit']
Suggested-by: Dmitry Baryshkov 
Signed-off-by: Rob Clark 
Link: https://lore.kernel.org/r/20231213210644.8702-1-robdclark@gmail.com
[ johan: rebase on 6.8-rc4, amend commit message and mention DRM ]
Fixes: 58ef4ece1e41 ("soc: qcom: pmic_glink: Introduce base PMIC GLINK driver")
Cc:       # 6.3
Cc: Bjorn Andersson 
Signed-off-by: Johan Hovold 
Reviewed-by: Bjorn Andersson 
Reviewed-by: Dmitry Baryshkov 
Reviewed-by: Neil Armstrong 
Signed-off-by: Dmitry Baryshkov 
Link: https://patchwork.freedesktop.org/patch/msgid/20240217150228.5788-5-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman

soc: qcom: pmic_glink_altmode: fix port sanity check

2024-02-01T00:20:55+00:00

commit c4fb7d2eac9ff9bfc35a2e4d40c7169a332416e0 upstream.

The PMIC GLINK altmode driver currently supports at most two ports.

Fix the incomplete port sanity check on notifications to avoid
accessing and corrupting memory beyond the port array if we ever get a
notification for an unsupported port.

Fixes: 080b4e24852b ("soc: qcom: pmic_glink: Introduce altmode support")
Cc: stable@vger.kernel.org	# 6.3
Signed-off-by: Johan Hovold 
Reviewed-by: Dmitry Baryshkov 
Reviewed-by: Konrad Dybcio 
Link: https://lore.kernel.org/r/20231109093100.19971-1-johan+linaro@kernel.org
Signed-off-by: Bjorn Andersson 
Signed-off-by: Greg Kroah-Hartman

soc: qcom: llcc: Fix LLCC_TRP_ATTR2_CFGn offset

2024-01-25T23:44:53+00:00

[ Upstream commit 110cb8d861cc1a040cdab495b22ac436c49d1454 ]

According to documentation, it has increments of 4, not 8.

Fixes: c72ca343f911 ("soc: qcom: llcc: Add v4.1 HW version support")
Reported-by: Unnathi Chalicheemala 
Reviewed-by: Satya Durga Srinivasu Prabhala 
Reviewed-by: Konrad Dybcio 
Signed-off-by: Abel Vesa 
Link: https://lore.kernel.org/r/20231012160509.184891-1-abel.vesa@linaro.org
Signed-off-by: Bjorn Andersson 
Signed-off-by: Sasha Levin

soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration

2024-01-25T23:44:53+00:00

[ Upstream commit eed6e57e9f3e2beac37563eb6a0129549daa330e ]

Commit c14e64b46944 ("soc: qcom: llcc: Support chipsets that can
 write to llcc") add the support for chipset where capacity based
allocation and retention through power collapse can be programmed
based on content of SCT table mentioned in the llcc driver where
the target like sdm845 where the entire programming related to it
is controlled in firmware. However, the commit introduces a bug
where capacity/retention register get overwritten each time it
gets programmed for each slice and that results in misconfiguration
of the register based on SCT table and that is not expected
behaviour instead it should be read modify write to retain the
configuration of other slices.

This issue is totally caught from code review and programming test
and not through any power/perf numbers so, it is not known what
impact this could make if we don't have this change however,
this feature are for these targets and they should have been
programmed accordingly as per their configuration mentioned in
SCT table like others bits information.

This change brings one difference where it keeps capacity/retention
bits of the slices that are not mentioned in SCT table in unknown
state where as earlier it was initialized to zero.

Fixes: c14e64b46944 ("soc: qcom: llcc: Support chipsets that can write to llcc")
Signed-off-by: Atul Dhudase 
Signed-off-by: Mukesh Ojha 
Reviewed-by: Douglas Anderson 
Link: https://lore.kernel.org/r/1701876771-10695-1-git-send-email-quic_mojha@quicinc.com
Signed-off-by: Bjorn Andersson 
Signed-off-by: Sasha Levin

Merge tag 'soc-drivers-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

2023-11-02T00:46:51+00:00

Pull SoC driver updates from Arnd Bergmann:
 "The highlights for the driver support this time are

   - Qualcomm platforms gain support for the Qualcomm Secure Execution
     Environment firmware interface to access EFI variables on certain
     devices, and new features for multiple platform and firmware
     drivers.

   - Arm FF-A firmware support gains support for v1.1 specification
     features, in particular notification and memory transaction
     descriptor changes.

   - SCMI firmware support now support v3.2 features for clock and DVFS
     configuration and a new transport for Qualcomm platforms.

   - Minor cleanups and bugfixes are added to pretty much all the active
     platforms: qualcomm, broadcom, dove, ti-k3, rockchip, sifive,
     amlogic, atmel, tegra, aspeed, vexpress, mediatek, samsung and
     more.

     In particular, this contains portions of the treewide conversion to
     use __counted_by annotations and the device_get_match_data helper"

* tag 'soc-drivers-6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (156 commits)
  soc: qcom: pmic_glink_altmode: Print return value on error
  firmware: qcom: scm: remove unneeded 'extern' specifiers
  firmware: qcom: scm: add a missing forward declaration for struct device
  firmware: qcom: move Qualcomm code into its own directory
  soc: samsung: exynos-chipid: Convert to platform remove callback returning void
  soc: qcom: apr: Add __counted_by for struct apr_rx_buf and use struct_size()
  soc: qcom: pmic_glink: fix connector type to be DisplayPort
  soc: ti: k3-socinfo: Avoid overriding return value
  soc: ti: k3-socinfo: Fix typo in bitfield documentation
  soc: ti: knav_qmss_queue: Use device_get_match_data()
  firmware: ti_sci: Use device_get_match_data()
  firmware: qcom: qseecom: add missing include guards
  soc/pxa: ssp: Convert to platform remove callback returning void
  soc/mediatek: mtk-mmsys: Convert to platform remove callback returning void
  soc/mediatek: mtk-devapc: Convert to platform remove callback returning void
  soc/loongson: loongson2_guts: Convert to platform remove callback returning void
  soc/litex: litex_soc_ctrl: Convert to platform remove callback returning void
  soc/ixp4xx: ixp4xx-qmgr: Convert to platform remove callback returning void
  soc/ixp4xx: ixp4xx-npe: Convert to platform remove callback returning void
  soc/hisilicon: kunpeng_hccs: Convert to platform remove callback returning void
  ...

soc: qcom: pmic_glink_altmode: Print return value on error

2023-10-22T16:20:40+00:00

It can be useful to know with which return value for example the
typec_retimer_set call failed, so include this info in the dev_err
prints.

Signed-off-by: Luca Weiss 
Link: https://lore.kernel.org/r/20231017-glink-altmode-ret-v2-1-921aa7cfc381@fairphone.com
Signed-off-by: Bjorn Andersson

soc: qcom: apr: Add __counted_by for struct apr_rx_buf and use struct_size()

2023-10-16T18:45:17+00:00

Prepare for the coming implementation by GCC and Clang of the __counted_by
attribute. Flexible array members annotated with __counted_by can have
their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for
array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family
functions).

While there, use struct_size() helper, instead of the open-coded
version, to calculate the size for the allocation of the whole
flexible structure, including of course, the flexible-array member.

This code was found with the help of Coccinelle, and audited and
fixed manually.

Signed-off-by: "Gustavo A. R. Silva" 
Reviewed-by: Justin Stitt 
Reviewed-by: Kees Cook 
Link: https://lore.kernel.org/r/ZSRw6RNi3Crhd32H@work
Signed-off-by: Bjorn Andersson