linux.git/drivers/of/fdt.c, branch v6.0

of: fdt: fix off-by-one error in unflatten_dt_nodes()

2022-08-16T17:29:57+00:00

Commit 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree")
forgot to fix up the depth check in the loop body in unflatten_dt_nodes()
which makes it possible to overflow the nps[] buffer...

Found by Linux Verification Center (linuxtesting.org) with the SVACE static
analysis tool.

Fixes: 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree")
Signed-off-by: Sergey Shtylyov 
Signed-off-by: Rob Herring 
Link: https://lore.kernel.org/r/7c354554-006f-6b31-c195-cdfe4caee392@omp.ru

Merge tag 'tty-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2022-08-08T18:31:40+00:00

Pull tty / serial driver updates from Greg KH:
 "Here is the big set of tty and serial driver changes for 6.0-rc1.

  It was delayed from last week as I wanted to make sure the last commit
  here got some good testing in linux-next and elsewhere as it seemed to
  show up only late in testing for some reason.

  Nothing major here, just lots of cleanups from Jiri and Ilpo to make
  the tty core cleaner (Jiri) and the rs485 code simpler to use (Ilpo).

  Also included in here is the obligatory n_gsm updates from Daniel
  Starke and lots of tiny driver updates and minor fixes and tweaks for
  other smaller serial drivers.

  All of these have been in linux-next for a while with no reported
  problems"

* tag 'tty-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (186 commits)
  tty: serial: qcom-geni-serial: Fix %lu -> %u in print statements
  tty: amiserial: Fix comment typo
  tty: serial: document uart_get_console()
  tty: serial: serial_core, reformat kernel-doc for functions
  Documentation: serial: link uart_ops properly
  Documentation: serial: move GPIO kernel-doc to the functions
  Documentation: serial: dedup kernel-doc for uart functions
  Documentation: serial: move uart_ops documentation to the struct
  dt-bindings: serial: snps-dw-apb-uart: Document Rockchip RV1126
  serial: mvebu-uart: uart2 error bits clearing
  tty: serial: fsl_lpuart: correct the count of break characters
  serial: stm32: make info structs static to avoid sparse warnings
  serial: fsl_lpuart: zero out parity bit in CS7 mode
  tty: serial: qcom-geni-serial: Fix get_clk_div_rate() which otherwise could return a sub-optimal clock rate.
  serial: 8250_bcm2835aux: Add missing clk_disable_unprepare()
  tty: vt: initialize unicode screen buffer
  serial: remove VR41XX serial driver
  serial: 8250: lpc18xx: Remove redundant sanity check for RS485 flags
  serial: 8250_dwlib: remove redundant sanity check for RS485 flags
  dt_bindings: rs485: Correct delay values
  ...

Merge tag 'mm-stable-2022-08-03' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2022-08-05T23:32:45+00:00

Pull MM updates from Andrew Morton:
 "Most of the MM queue. A few things are still pending.

  Liam's maple tree rework didn't make it. This has resulted in a few
  other minor patch series being held over for next time.

  Multi-gen LRU still isn't merged as we were waiting for mapletree to
  stabilize. The current plan is to merge MGLRU into -mm soon and to
  later reintroduce mapletree, with a view to hopefully getting both
  into 6.1-rc1.

  Summary:

   - The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
     Lin, Yang Shi, Anshuman Khandual and Mike Rapoport

   - Some kmemleak fixes from Patrick Wang and Waiman Long

   - DAMON updates from SeongJae Park

   - memcg debug/visibility work from Roman Gushchin

   - vmalloc speedup from Uladzislau Rezki

   - more folio conversion work from Matthew Wilcox

   - enhancements for coherent device memory mapping from Alex Sierra

   - addition of shared pages tracking and CoW support for fsdax, from
     Shiyang Ruan

   - hugetlb optimizations from Mike Kravetz

   - Mel Gorman has contributed some pagealloc changes to improve
     latency and realtime behaviour.

   - mprotect soft-dirty checking has been improved by Peter Xu

   - Many other singleton patches all over the place"

 [ XFS merge from hell as per Darrick Wong in

   https://lore.kernel.org/all/YshKnxb4VwXycPO8@magnolia/ ]

* tag 'mm-stable-2022-08-03' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (282 commits)
  tools/testing/selftests/vm/hmm-tests.c: fix build
  mm: Kconfig: fix typo
  mm: memory-failure: convert to pr_fmt()
  mm: use is_zone_movable_page() helper
  hugetlbfs: fix inaccurate comment in hugetlbfs_statfs()
  hugetlbfs: cleanup some comments in inode.c
  hugetlbfs: remove unneeded header file
  hugetlbfs: remove unneeded hugetlbfs_ops forward declaration
  hugetlbfs: use helper macro SZ_1{K,M}
  mm: cleanup is_highmem()
  mm/hmm: add a test for cross device private faults
  selftests: add soft-dirty into run_vmtests.sh
  selftests: soft-dirty: add test for mprotect
  mm/mprotect: fix soft-dirty check in can_change_pte_writable()
  mm: memcontrol: fix potential oom_lock recursion deadlock
  mm/gup.c: fix formatting in check_and_migrate_movable_page()
  xfs: fail dax mount if reflink is enabled on a partition
  mm/memcontrol.c: remove the redundant updating of stats_flush_threshold
  userfaultfd: don't fail on unrecognized features
  hugetlb_cgroup: fix wrong hugetlb cgroup numa stat
  ...

of/fdt: declared return type does not match actual return type

2022-08-01T16:13:41+00:00

The commit 649cab56de8e (“of: properly check for error returned
by fdt_get_name()”) changed the return value type from bool to int,
but forgot to change the return value simultaneously.

populate_node was only called in unflatten_dt_nodes, and returns
with values greater than or equal to 0 were discarded without further
processing. Considering that return 0 usually indicates success,
return 0 instead of return true.

Fixes: 649cab56de8e (“of: properly check for error returned by fdt_get_name()”)
Signed-off-by: Xu Qiang 
Signed-off-by: Rob Herring 
Link: https://lore.kernel.org/r/20220801120506.11461-2-xuqiang36@huawei.com

of/fdt: Clean up early_init_dt_reserve_memory_arch()

2022-07-25T19:58:03+00:00

As of commit 18250b43f7b6 ("of: fdt: Remove
early_init_dt_reserve_memory_arch() override capability") this is
no longer an arch hook, so rename it to remove the confusing _arch
suffix. Also remove some unnecessary indirection from all but one of
the callers by calling memblock_reserve() directly instead.

Signed-off-by: Peter Collingbourne 
Link: https://linux-review.googlesource.com/id/I3362bdd92ae6e47e8f5bac01aa228d32f9d01aad
Signed-off-by: Rob Herring 
Link: https://lore.kernel.org/r/20220723015331.1607029-1-pcc@google.com

earlycon: prevent multiple register_console()

2022-06-30T15:10:11+00:00

If the earlycon parameter is given twice, the kernel will spit out a
WARN() in register_console() because it was already registered. The
non-dt variant setup_earlycon() already handles that gracefully. The dt
variant of_setup_earlycon() doesn't. Add the check there and add the
-EALREADY handling in early_init_dt_scan_chosen_stdout().

FWIW, this doesn't happen if CONFIG_ACPI_SPCR_TABLE is set. In that case
the registration is delayed until after earlycon parameter(s) are
parsed.

Reviewed-by: Rob Herring 
Signed-off-by: Michael Walle 
Link: https://lore.kernel.org/r/20220628120705.200617-1-michael@walle.cc
Signed-off-by: Greg Kroah-Hartman

of: reserved-memory: Print allocation/reservation failures as error

2022-06-28T20:15:36+00:00

If the allocation/reservation of reserved-memory fails, it is normally
an error, so print it as an error so that it doesn't get hidden from the
console due to the loglevel.  Also make the allocation failure include
the size just like the reservation failure.

Signed-off-by: Vincent Whitchurch 
Signed-off-by: Rob Herring 
Link: https://lore.kernel.org/r/20220628113540.2790835-1-vincent.whitchurch@axis.com

mm: kmemleak: remove kmemleak_not_leak_phys() and the min_count argument to kmemleak_alloc_phys()

2022-06-17T02:48:30+00:00

Patch series "mm: kmemleak: store objects allocated with physical address
separately and check when scan", v4.

The kmemleak_*_phys() interface uses "min_low_pfn" and "max_low_pfn" to
check address.  But on some architectures, kmemleak_*_phys() is called
before those two variables initialized.  The following steps will be
taken:

1) Add OBJECT_PHYS flag and rbtree for the objects allocated
   with physical address
2) Store physical address in objects if allocated with OBJECT_PHYS
3) Check the boundary when scan instead of in kmemleak_*_phys()

This patch set will solve:
https://lore.kernel.org/r/20220527032504.30341-1-yee.lee@mediatek.com
https://lore.kernel.org/r/9dd08bb5-f39e-53d8-f88d-bec598a08c93@gmail.com

v3: https://lore.kernel.org/r/20220609124950.1694394-1-patrick.wang.shcn@gmail.com
v2: https://lore.kernel.org/r/20220603035415.1243913-1-patrick.wang.shcn@gmail.com
v1: https://lore.kernel.org/r/20220531150823.1004101-1-patrick.wang.shcn@gmail.com


This patch (of 4):

Remove the unused kmemleak_not_leak_phys() function.  And remove the
min_count argument to kmemleak_alloc_phys() function, assume it's 0.

Link: https://lkml.kernel.org/r/20220611035551.1823303-1-patrick.wang.shcn@gmail.com
Link: https://lkml.kernel.org/r/20220611035551.1823303-2-patrick.wang.shcn@gmail.com
Signed-off-by: Patrick Wang 
Suggested-by: Catalin Marinas 
Reviewed-by: Catalin Marinas 
Cc: Yee Lee 
Signed-off-by: Andrew Morton

Merge tag 'devicetree-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

2022-05-25T21:56:06+00:00

Pull devicetree updates from Rob Herring:
 "Bindings:

   - Convert smsc,lan91c111, qcom,spi-qup, qcom,msm-uartdm,
     qcom,i2c-qup, qcom,gsbi, i2c-mt65xx, TI wkup_m3_ipc (and new
     props), qcom,smp2p, TI timer, Mediatek gnss, Mediatek topckgen,
     Mediatek apmixedsys, Mediatek infracfg, fsl,ls-extirq,
     fsl,layerscape-dcfg, QCom PMIC SPMI, rda,8810pl-timer, Xilinx
     zynqmp_ipi, uniphier-pcie, and Ilitek touchscreen controllers

   - Convert various Arm Ltd peripheral IP bindings to schemas

   - New bindings for Menlo board CPLD, DH electronics board CPLD,
     Qualcomm Geni based QUP I2C, Renesas RZ/G2UL OSTM, Broafcom BCM4751
     GNSS, MT6360 PMIC, ASIX USB Ethernet controllers, and
     Microchip/SMSC LAN95xx USB Ethernet controllers

   - Add vendor prefix for Enclustra

   - Add various compatible string additions

   - Various example fixes and cleanups

   - Remove unused hisilicon,hi6220-reset binding

   - Treewide fix properties missing type definition

   - Drop some empty and unreferenced .txt bindings

   - Documentation improvements for writing schemas

  DT driver core:

   - Drop static IRQ resources for DT platform devices as IRQ setup is
     dynamic and drivers have all been converted to use
     platform_get_irq() and friends

   - Rework memory allocations and frees for overlays

   - Continue overlay notifier callbacks on successful calls and add
     unittests

   - Handle 'interrupts-extended' in early DT IRQ setup

   - Fix of_property_read_string() errors to match documentation

   - Ignore disabled nodes in FDT API calls"

* tag 'devicetree-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (86 commits)
  of/irq: fix typo in comment
  dt-bindings: Fix properties without any type
  Revert "dt-bindings: mailbox: qcom-ipcc: add missing properties into example"
  dt-bindings: input: touchscreen: ilitek_ts_i2c: Absorb ili2xxx bindings
  dt-bindings: timer: samsung,exynos4210-mct: define strict clock order
  dt-bindings: timer: samsung,exynos4210-mct: drop unneeded minItems
  dt-bindings: timer: cdns,ttc: drop unneeded minItems
  dt-bindings: mailbox: zynqmp_ipi: convert to yaml
  dt-bindings: usb: ci-hdrc-usb2: fix node node for ethernet controller
  dt-bindings: net: add schema for Microchip/SMSC LAN95xx USB Ethernet controllers
  dt-bindings: net: add schema for ASIX USB Ethernet controllers
  of/fdt: Ignore disabled memory nodes
  dt-bindings: arm: fix typos in compatible
  dt-bindings: mfd: Add bindings child nodes for the Mediatek MT6360
  dt-bindings: display: convert Arm Komeda to DT schema
  dt-bindings: display: convert Arm Mali-DP to DT schema
  dt-bindings: display: convert Arm HDLCD to DT schema
  dt-bindings: display: convert PL110/PL111 to DT schema
  dt-bindings: arm: convert vexpress-config to DT schema
  dt-bindings: arm: convert vexpress-sysregs to DT schema
  ...

of/fdt: Ignore disabled memory nodes

2022-05-17T18:06:32+00:00

When we boot a machine using a devicetree, the generic DT code goes
through all nodes with a 'device_type = "memory"' property, and collects
all memory banks mentioned there. However it does not check for the
status property, so any nodes which are explicitly "disabled" will still
be added as a memblock.
This ends up badly for QEMU, when booting with secure firmware on
arm/arm64 machines, because QEMU adds a node describing secure-only
memory:
===================
	secram@e000000 {
		secure-status = "okay";
		status = "disabled";
		reg = <0x00 0xe000000 0x00 0x1000000>;
		device_type = "memory";
	};
===================

The kernel will eventually use that memory block (which is located below
the main DRAM bank), but accesses to that will be answered with an
SError:
===================
[    0.000000] Internal error: synchronous external abort: 96000050 [#1] PREEMPT SMP
[    0.000000] Modules linked in:
[    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0-rc6-00014-g10c8acb8b679 #524
[    0.000000] Hardware name: linux,dummy-virt (DT)
[    0.000000] pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    0.000000] pc : new_slab+0x190/0x340
[    0.000000] lr : new_slab+0x184/0x340
[    0.000000] sp : ffff80000a4b3d10
....
==================
The actual crash location and call stack will be somewhat random, and
depend on the specific allocation of that physical memory range.

As the DT spec[1] explicitly mentions standard properties, add a simple
check to skip over disabled memory nodes, so that we only use memory
that is meant for non-secure code to use.

That fixes booting a QEMU arm64 VM with EL3 enabled ("secure=on"), when
not using UEFI. In this case the QEMU generated DT will be handed on
to the kernel, which will see the secram node.
This issue is reproducible when using TF-A together with U-Boot as
firmware, then booting with the "booti" command.

When using U-Boot as an UEFI provider, the code there [2] explicitly
filters for disabled nodes when generating the UEFI memory map, so we
are safe.
EDK/2 only reads the first bank of the first DT memory node [3] to learn
about memory, so we got lucky there.

[1] https://github.com/devicetree-org/devicetree-specification/blob/main/source/chapter3-devicenodes.rst#memory-node (after the table)
[2] https://source.denx.de/u-boot/u-boot/-/blob/master/lib/fdtdec.c#L1061-1063
[3] https://github.com/tianocore/edk2/blob/master/ArmVirtPkg/PrePi/FdtParser.c

Reported-by: Ross Burton 
Signed-off-by: Andre Przywara 
Signed-off-by: Rob Herring 
Link: https://lore.kernel.org/r/20220517101410.3493781-1-andre.przywara@arm.com