Commit graph

1,267,977 commits

Author SHA1 Message Date
Raag Jadav
3ee35fd12b pwm: dwc: access driver_data using dev_get_drvdata()
Now that we're setting driver_data using dev_set_drvdata(), we can use
dev_get_drvdata() for accessing it.

Signed-off-by: Raag Jadav <raag.jadav@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20240212130247.9985-6-raag.jadav@intel.com
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
2024-02-15 12:29:20 +01:00
Dharma Balasubiramani
0fa319a142 dt-bindings: atmel,hlcdc: convert pwm bindings to json-schema
Convert device tree bindings for Atmel's HLCDC PWM controller to YAML
format.

Signed-off-by: Dharma Balasubiramani <dharma.b@microchip.com>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://lore.kernel.org/r/20240202001733.91455-3-dharma.b@microchip.com
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
2024-02-15 12:28:03 +01:00
Uwe Kleine-König
1706175c68 pwm: imx27: Don't use pwm consumer API
Lowlevel driver callbacks are not supposed to use the consumer API
functions. Currently this works, but with the upcoming locking changes
this maybe results in dead locks. So directly access pwm->state.

Link: https://lore.kernel.org/r/20240126101624.2056801-2-u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
2024-02-15 12:28:02 +01:00
Uwe Kleine-König
f8b403f544 pwm: atmel: Don't use pwm consumer API
Lowlevel driver callbacks are not supposed to use the consumer API
functions. Currently this works, but with the upcoming locking changes
this probably results in dead locks.

Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
Link: https://lore.kernel.org/r/20240129085627.2386470-2-u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
2024-02-15 12:28:02 +01:00
Uwe Kleine-König
c6c3f7e73d pwm: atmel-hlcdc: Don't use pwm consumer API
Lowlevel driver callbacks are not supposed to use the consumer API
functions. Currently this works, but with the upcoming locking changes
this probably results in dead locks.

Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
Link: https://lore.kernel.org/r/6e34607828b290cd64ca9f82df40872853069f07.1706269232.git.u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
2024-02-15 12:28:02 +01:00
Uwe Kleine-König
65a63bf94a pwm: bcm2835: Drop write-only member of driver private data
Since commit fcc7607293 ("pwm: bcm2835: Allow PWM driver to be used in
atomic context") struct bcm2835_pwm::dev is only assigned a value, but
it's never used. So the dev member can just be dropped.

Link: https://lore.kernel.org/r/20240129081029.2355612-2-u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
2024-02-15 12:28:02 +01:00
Uwe Kleine-König
62928315ad pwm: Reorder symbols in core.c
This moves the functions called by pwm consumers above the functions
called by pwm providers. When character device support is added later
this is hooked into the chip registration functions. As the needed
callbacks are a kind of consumer and make use of the consumer functions,
having this order is more natural and prevents having to add
declarations for static functions.

Also move the global variables for pwm tables to the respective
functions to have them properly grouped.

Link: https://lore.kernel.org/r/eed83de07bdfb69b5ceba0b9aed757ee612dea8f.1706182805.git.u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
2024-02-15 12:28:02 +01:00
Duje Mihanović
bdc585f987 dt-bindings: pxa-pwm: Convert to YAML
Convert the PXA PWM binding file from TXT to YAML.

The original binding does not mention any clocks, but the PWM controller
will not probe without a clock.

Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Duje Mihanović <duje.mihanovic@skole.hr>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20240107-pxa-pwm-yaml-v3-1-92ac90911c3f@skole.hr
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
2024-02-15 12:28:02 +01:00
Uwe Kleine-König
e92ce0e8f9 pwm: mediatek: Update kernel doc for struct pwm_mediatek_of_data
The struct never had a member called clk_freq. This fixes the W=1
warning:

	drivers/pwm/pwm-mediatek.c:60: warning: Excess struct member 'clk_freq' description in 'pwm_mediatek_chip'

Fixes: efecdeb82f ("pwm: mediatek: Allocate the clks array dynamically")
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20240125085649.1571268-2-u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
2024-02-15 12:28:02 +01:00
Uwe Kleine-König
91bb23493f pwm: Drop duplicate check against chip->npwm in of_pwm_xlate_with_flags()
args->args[0] is passed as parameter "index" to pwm_request_from_chip().
The latter function also checks for index >= npwm, so
of_pwm_xlate_with_flags() doesn't need to do that.

Link: https://lore.kernel.org/r/b06e445a6ed62a339add727eccb969a33d678386.1704835845.git.u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
2024-02-15 12:28:02 +01:00
Uwe Kleine-König
0e253d4193 pwm: clps711x: Drop custom .of_xlate() callback
The default of_xlate callback (of_pwm_xlate_with_flags()) does
everything the drivers expects from its .of_xlate() callback. So drop
the custom implementation.

Link: https://lore.kernel.org/r/f58336c298d536107de5cab6a57e19f957ab326c.1704835845.git.u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
2024-02-15 12:28:02 +01:00
Uwe Kleine-König
40ade0c2e7 pwm: Let the of_xlate callbacks accept references without period
With this extension of_pwm_xlate_with_flags() is suitable to replace the
custom xlate function of the pwm-clps711x driver.

While touching these very similar functions align their implementations.

Link: https://lore.kernel.org/r/127622315d07d9d419ae8e6373c7e5be7fab7a62.1704835845.git.u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
2024-02-15 12:28:02 +01:00
Uwe Kleine-König
4e77431cda pwm: Drop useless member .of_pwm_n_cells of struct pwm_chip
Apart from the two of_xlate implementations this member is write-only.
In the of_xlate functions of_pwm_xlate_with_flags() and
of_pwm_single_xlate() it's more sensible to check for args->args_count
because this is what is actually used in the device tree.

Acked-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/53d8c545aa8f79a920358be9e72e382b3981bdc4.1704835845.git.u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
2024-02-15 12:28:01 +01:00
Raag Jadav
7cfce2b80d pwm: dwc: use pm_sleep_ptr() macro
Since we don't have runtime PM handles here, we should be using
pm_sleep_ptr() macro, so that the compiler can discard it in case
CONFIG_PM_SLEEP=n.

Fixes: 30b5b066fa ("pwm: dwc: Use DEFINE_SIMPLE_DEV_PM_OPS for PM functions")
Signed-off-by: Raag Jadav <raag.jadav@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20240212130247.9985-2-raag.jadav@intel.com
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
2024-02-15 12:27:50 +01:00
Andy Shevchenko
2327960f0c auxdisplay: linedisp: Free allocated resources in ->release()
While there is no issue currently with the resources allocation,
the code may still be made more robust by deallocating message
in the ->release() callback.

Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Tested-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2024-02-15 13:24:54 +02:00
Andy Shevchenko
a8fc3d587f auxdisplay: img-ascii-lcd: Make container_of() no-op for struct linedisp
Move embedded struct linedisp member to make container_of() no-op.

Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Tested-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2024-02-15 13:24:53 +02:00
Andy Shevchenko
b33190d0fd auxdisplay: panel: Switch to use module_parport_driver()
Switch to use module_parport_driver() to reduce boilerplate code.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2024-02-15 13:24:53 +02:00
Nicolas Escande
3ab6aff579 wifi: ath11k: remove unused scan_events from struct scan_req_params
As discussed lets remove the unused scan_events field from struct
scan_req_params. Also, as it is not needed anymore, remove the underlying union
wrapping too. No functionnal changes.

Link: https://lore.kernel.org/all/4be7d62e-cb59-462d-aac2-94e27efc22ff@quicinc.com/
Signed-off-by: Nicolas Escande <nico.escande@gmail.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://msgid.link/20240211151036.1950292-1-nico.escande@gmail.com
2024-02-15 13:24:18 +02:00
Baochen Qiang
5dc9d1a55e wifi: ath11k: add support for QCA2066
QCA2066 is a PCI based DBS device. It is very similar to WCN6855
overall: they share the same PCI device ID, the same major and
minor version numbers, the same register address, and same HAL
descriptors etc. The most significant difference is that QCA2066
supports 3-antenna configuration while WCN6855 does not. To differentiate
them, subversion numbers are used. Currently four numbers are used
by QCA2066: 0x1019A0E1, 0x1019B0E1, 0x1019C0E1 and 0x1019D0E1.

Tested-on: QCA2066 hw2.1 PCI WLAN.HSP.1.1-03737-QCAHSPSWPL_V2_SILICONZ_CE-1
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3

Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://msgid.link/20240109021336.4143-3-quic_bqiang@quicinc.com
2024-02-15 13:23:50 +02:00
Baochen Qiang
515bcdf587 wifi: ath11k: move pci.ops registration ahead
In ath11k_pci_probe() there is a switch statement that, based
upon the PCI device ID, assigns pci_ops. After the switch,
ath11k_pcic_register_pci_ops() is called to register the pci_ops.

Unfortunately, this registration is too late if any of the cases
in the switch need to perform operations that require the pci_ops
to already be registered. In particular, an upcoming patch for
QCA2066 needs to call ath11k_pcic_read32().

To address this issue, call ath11k_pcic_register_pci_ops() from
each case instead of doing so after the switch. That way the ops
will be registered if any subsequent operations within the case
processing require the ops to be present.

Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3

Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://msgid.link/20240109021336.4143-2-quic_bqiang@quicinc.com
2024-02-15 13:23:50 +02:00
Carl Huang
24395ec117 wifi: ath11k: provide address list if chip supports 2 stations
Provide address list to mac80211 so user doesn't need to specify addresses when
a second interface is added because the address can be allocated from the list
by mac80211.

The derived addresses have LAA (Local Administered Address) bit set, and only
the first byte is changed. Take the 00:03:7f:xx:xx:xx as example to derive:

addresses[0] is unchanged, it's still 00:03:7f:xx:xx:xx,
addresses[1] is 02:03:7f:xx:xx:xx,
addresses[2] is 12:03:7f:xx:xx:xx,
addresses[3] is 22:03:7f:xx:xx:xx,
addresses[4] is 32:03:7f:xx:xx:xx.

However as only 3 addresses are reported now, so addresses[3] and addresses[4]
aren't actually derived.

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3

Signed-off-by: Carl Huang <quic_cjhuang@quicinc.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://msgid.link/20230714023801.2621802-3-quic_cjhuang@quicinc.com
2024-02-15 13:22:46 +02:00
Carl Huang
f019f4dff2 wifi: ath11k: support 2 station interfaces
Add hardware parameter support_dual_stations to indicate whether 2 station
interfaces are supported. For chips which support this feature, limit total
number of AP interface and mesh point to 1. The max interfaces are 3 for such
chips.

The chips affected are:

 QCA6390 hw2.0
 WCN6855 hw2.0
 WCN6855 hw2.1

Other chips are not affected.

For affected chips, remove radar_detect_widths because now
num_different_channels is set to 2. radar_detect_widths can be set only when
num_different_channels is 1, see mac80211 function wiphy_verify_combinations
for details. This means that in affectected chips DFS cannot be enabled in AP
mode.

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3

Signed-off-by: Carl Huang <quic_cjhuang@quicinc.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://msgid.link/20230714023801.2621802-2-quic_cjhuang@quicinc.com
2024-02-15 13:22:46 +02:00
Ole P. Orhagen
bd2cb11fd7 ARM: dts: vexpress: Set stdout-path to serial0 in the chosen node
Specify v2m_serial0 as the device for boot console output through the
stdout-path in the chosen node.

Signed-off-by: Ole P. Orhagen <ole.orhagen@northern.tech>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20240209112807.1345164-2-ole.orhagen@northern.tech
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
2024-02-15 11:14:51 +00:00
Bitterblue Smith
42ffccd0a3 wifi: rtlwifi: rtl_usb: Store the endpoint addresses
And use the stored addresses in rtl8192cu instead of hardcoding them.

This is what the vendor drivers do.

Perhaps this is not strictly necessary for RTL8192CU devices. However,
the dual mac version of RTL8192DU has two USB interfaces, each with its
own set of endpoints. Hardcoding their addresses in the upcoming
rtl8192du driver would require making some assumptions which I'm not
qualified to make.

Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/7b6a602a-6101-4bab-958d-bcff4d565b40@gmail.com
2024-02-15 13:11:10 +02:00
Bitterblue Smith
bcfcbf23a9 wifi: rtlwifi: rtl8192cu: Fix 2T2R chip type detection
rtl8192cu handles 1T1R devices (RTL8188CUS), 1T2R devices (RTL8191CU),
and 2T2R devices (RTL8192CU). The 2T2R devices were incorrectly detected
as 1T2R because of a mistake in the IS_92C_1T2R macro.

The visible effect of this is that the firmware was allowed to use
TX rates only up to MCS7.

Fix the IS_92C_1T2R macro.

Now my 2T2R device has much better upload speed.
Before: 46 Mbps.
After:  82 Mbps.

Also fix a debug message which was printing "RF_1T1R" even for 1T2R
chips.

Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/ed960059-5c77-422d-ac4e-fe9fc9d0d296@gmail.com
2024-02-15 13:10:47 +02:00
Ping-Ke Shih
63d94f7496 wifi: rtw89: fw: remove unnecessary rcu_read_unlock() for punctured
The rcu_read_unlock() is accidentally added, and sparse warn:

  drivers/net/wireless/realtek/rtw89/fw.c:2807:17:
    warning: context imbalance in 'rtw89_fw_h2c_assoc_cmac_tbl_g7' - unexpected unlock

Fixes: b82730bf57 ("wifi: cfg80211/mac80211: move puncturing into chandef")
Cc: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20240213122556.9593-1-pkshih@realtek.com
2024-02-15 13:10:24 +02:00
Zong-Zhe Yang
441a6014d0 wifi: rtw89: 8922a: declare to support two chanctx
We are going to allow MCC (multi-channel concurrency) on RTL8922A.
So, increase 8922a::support_chanctx_num up to 2 first.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20240213073514.23796-6-pkshih@realtek.com
2024-02-15 13:09:49 +02:00
Zong-Zhe Yang
f931cce310 wifi: rtw89: chan: support MCC on Wi-Fi 7 chips
On Wi-Fi 7 chips, concurrent stuffs are supported by FW MRC series
(multi-role concurrent) functions. And, driver has implemented the
corresponding SW handling in patches in front of this one. Now, we
extend SW MCC (multi-channel concurrent) flow to work on Wi-Fi 7
chips.

In SW point of view, things look as below.

|  SW  |                 |  FW func      |
|      |                 |  H2C/C2H      |
--------------------------------------------
|      |              ax                 |
|      |            /----|  FW MCC func  |
|  MCC | -- chip --+                     |
|      |            \----|  FW MRC func  |
|      |              be                 |

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20240213073514.23796-5-pkshih@realtek.com
2024-02-15 13:09:48 +02:00
Zong-Zhe Yang
9de7829aa6 wifi: rtw89: fw: implement MRC H2C command functions
Implement MRC (multiple role concurrent) H2C commands. Mainly deal with
H2C format, LE type built from CPU value, default setting on some fields,
and then sending the command to FW. Besides, MRC start, MRC delete, and
MRC request TSF need to wait for a report from C2H events.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20240213073514.23796-4-pkshih@realtek.com
2024-02-15 13:09:48 +02:00
Zong-Zhe Yang
b8e59e5534 wifi: rtw89: mac: implement MRC C2H event handling
Add handling of MRC (multiple role concurrent) C2H events including
TSF report and status report. Parse report data and then complete the
corresponding H2C commands, which will be implemented in the following.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20240213073514.23796-3-pkshih@realtek.com
2024-02-15 13:09:48 +02:00
Zong-Zhe Yang
6ca3b88c32 wifi: rtw89: fw: add definition of H2C command and C2H event for MRC series
For Wi-Fi 7 chips, FW supports MRC (multi-role concurrent) functions
including H2C commands and C2H events. We can consider FW MRC functions
as a superset of FW MCC (multi-channel concurrent) functions. And, MRC
functions can take MLO things into account.

Basically before MLO, SW can also manipulate FW MRC to work original
SW MCC flow. So, we add them first and implement the handling in the
following. And then, SW MCC will call different series of FW functions
according to chip later.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20240213073514.23796-2-pkshih@realtek.com
2024-02-15 13:09:48 +02:00
David Mosberger-Tang
dd2f633eaf wifi: wilc1000: validate chip id during bus probe
Previously, the driver created a net device (typically wlan0) as soon
as the module was loaded.  This commit changes the driver to follow
normal Linux convention of creating the net device only when bus
probing detects a supported chip.

Signed-off-by: David Mosberger-Tang <davidm@egauge.net>
Tested-By: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20240212202057.3468714-1-davidm@egauge.net
2024-02-15 13:09:16 +02:00
Alexander Stein
5b6df373ec
arm64: dts: mediatek: Replace deprecated extcon-usb-gpio id-gpio/vbus-gpio properties
Use id-gpios and vbus-gpios instead.

Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Acked-by: Shawn Guo <shawnguo@kernel.org>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20240215093214.796821-3-alexander.stein@ew.tq-group.com
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
2024-02-15 12:09:07 +01:00
Alexis Lothoré
cb5942b77c wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces
wilc_netdev_cleanup currently triggers a KASAN warning, which can be
observed on interface registration error path, or simply by
removing the module/unbinding device from driver:

echo spi0.1 > /sys/bus/spi/drivers/wilc1000_spi/unbind

==================================================================
BUG: KASAN: slab-use-after-free in wilc_netdev_cleanup+0x508/0x5cc
Read of size 4 at addr c54d1ce8 by task sh/86

CPU: 0 PID: 86 Comm: sh Not tainted 6.8.0-rc1+ #117
Hardware name: Atmel SAMA5
 unwind_backtrace from show_stack+0x18/0x1c
 show_stack from dump_stack_lvl+0x34/0x58
 dump_stack_lvl from print_report+0x154/0x500
 print_report from kasan_report+0xac/0xd8
 kasan_report from wilc_netdev_cleanup+0x508/0x5cc
 wilc_netdev_cleanup from wilc_bus_remove+0xc8/0xec
 wilc_bus_remove from spi_remove+0x8c/0xac
 spi_remove from device_release_driver_internal+0x434/0x5f8
 device_release_driver_internal from unbind_store+0xbc/0x108
 unbind_store from kernfs_fop_write_iter+0x398/0x584
 kernfs_fop_write_iter from vfs_write+0x728/0xf88
 vfs_write from ksys_write+0x110/0x1e4
 ksys_write from ret_fast_syscall+0x0/0x1c

[...]

Allocated by task 1:
 kasan_save_track+0x30/0x5c
 __kasan_kmalloc+0x8c/0x94
 __kmalloc_node+0x1cc/0x3e4
 kvmalloc_node+0x48/0x180
 alloc_netdev_mqs+0x68/0x11dc
 alloc_etherdev_mqs+0x28/0x34
 wilc_netdev_ifc_init+0x34/0x8ec
 wilc_cfg80211_init+0x690/0x910
 wilc_bus_probe+0xe0/0x4a0
 spi_probe+0x158/0x1b0
 really_probe+0x270/0xdf4
 __driver_probe_device+0x1dc/0x580
 driver_probe_device+0x60/0x140
 __driver_attach+0x228/0x5d4
 bus_for_each_dev+0x13c/0x1a8
 bus_add_driver+0x2a0/0x608
 driver_register+0x24c/0x578
 do_one_initcall+0x180/0x310
 kernel_init_freeable+0x424/0x484
 kernel_init+0x20/0x148
 ret_from_fork+0x14/0x28

Freed by task 86:
 kasan_save_track+0x30/0x5c
 kasan_save_free_info+0x38/0x58
 __kasan_slab_free+0xe4/0x140
 kfree+0xb0/0x238
 device_release+0xc0/0x2a8
 kobject_put+0x1d4/0x46c
 netdev_run_todo+0x8fc/0x11d0
 wilc_netdev_cleanup+0x1e4/0x5cc
 wilc_bus_remove+0xc8/0xec
 spi_remove+0x8c/0xac
 device_release_driver_internal+0x434/0x5f8
 unbind_store+0xbc/0x108
 kernfs_fop_write_iter+0x398/0x584
 vfs_write+0x728/0xf88
 ksys_write+0x110/0x1e4
 ret_fast_syscall+0x0/0x1c
 [...]

David Mosberger-Tan initial investigation [1] showed that this
use-after-free is due to netdevice unregistration during vif list
traversal. When unregistering a net device, since the needs_free_netdev has
been set to true during registration, the netdevice object is also freed,
and as a consequence, the corresponding vif object too, since it is
attached to it as private netdevice data. The next occurrence of the loop
then tries to access freed vif pointer to the list to move forward in the
list.

Fix this use-after-free thanks to two mechanisms:
- navigate in the list with list_for_each_entry_safe, which allows to
  safely modify the list as we go through each element. For each element,
  remove it from the list with list_del_rcu
- make sure to wait for RCU grace period end after each vif removal to make
  sure it is safe to free the corresponding vif too (through
  unregister_netdev)

Since we are in a RCU "modifier" path (not a "reader" path), and because
such path is expected not to be concurrent to any other modifier (we are
using the vif_mutex lock), we do not need to use RCU list API, that's why
we can benefit from list_for_each_entry_safe.

[1] https://lore.kernel.org/linux-wireless/ab077dbe58b1ea5de0a3b2ca21f275a07af967d2.camel@egauge.net/

Fixes: 8399918f30 ("staging: wilc1000: use RCU list to maintain vif interfaces list")
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20240212-wilc_rework_deinit-v1-1-9203ae56c27f@bootlin.com
2024-02-15 13:08:55 +02:00
Vadim Fedorenko
488b6d91b0 net-timestamp: make sk_tskey more predictable in error path
When SOF_TIMESTAMPING_OPT_ID is used to ambiguate timestamped datagrams,
the sk_tskey can become unpredictable in case of any error happened
during sendmsg(). Move increment later in the code and make decrement of
sk_tskey in error path. This solution is still racy in case of multiple
threads doing snedmsg() over the very same socket in parallel, but still
makes error path much more predictable.

Fixes: 09c2d251b7 ("net-timestamp: add key to disambiguate concurrent datagrams")
Reported-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Vadim Fedorenko <vadfed@meta.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/r/20240213110428.1681540-1-vadfed@meta.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2024-02-15 12:04:04 +01:00
Robert Marko
3be0d950b6 net: phy: qca807x: move interface mode check to .config_init_once
Currently, we are checking whether the PHY package mode matches the
individual PHY interface modes at PHY package probe time, but at that time
we only know the PHY package mode and not the individual PHY interface
modes as of_get_phy_mode() that populates it will only get called once the
netdev to which PHY-s are attached to is being probed and thus this check
will always fail and return -EINVAL.

So, lets move this check to .config_init_once as at that point individual
PHY interface modes should be populated.

Fixes: d1cb613efb ("net: phy: qcom: add support for QCA807x PHY Family")
Signed-off-by: Robert Marko <robimarko@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://lore.kernel.org/r/20240212115043.1725918-1-robimarko@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2024-02-15 11:27:53 +01:00
Lukas Bulwahn
0955723ef9 sparc: remove obsolete config ARCH_ATU
Before consolidation of commit 4965a68780 ("arch: define the
ARCH_DMA_ADDR_T_64BIT config symbol in lib/Kconfig"), the config ARCH_ATU
was used to control the state of the config ARCH_DMA_ADDR_T_64BIT. After
this consolidation, the config ARCH_ATU has been without use and effect.

Remove this obsolete config.

Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Link: https://lore.kernel.org/r/20231211083029.22078-1-lukas.bulwahn@gmail.com
2024-02-15 11:27:14 +01:00
Johannes Berg
f78c137533 wifi: nl80211: reject iftype change with mesh ID change
It's currently possible to change the mesh ID when the
interface isn't yet in mesh mode, at the same time as
changing it into mesh mode. This leads to an overwrite
of data in the wdev->u union for the interface type it
currently has, causing cfg80211_change_iface() to do
wrong things when switching.

We could probably allow setting an interface to mesh
while setting the mesh ID at the same time by doing a
different order of operations here, but realistically
there's no userspace that's going to do this, so just
disallow changes in iftype when setting mesh ID.

Cc: stable@vger.kernel.org
Fixes: 29cbe68c51 ("cfg80211/mac80211: add mesh join/leave commands")
Reported-by: syzbot+dd4779978217b1973180@syzkaller.appspotmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2024-02-15 11:00:37 +01:00
Johannes Berg
414532d8aa wifi: cfg80211: use IEEE80211_MAX_MESH_ID_LEN appropriately
Even if that's the same as IEEE80211_MAX_SSID_LEN, we really
should just use IEEE80211_MAX_MESH_ID_LEN for mesh, rather
than having the BUILD_BUG_ON()s.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2024-02-15 10:59:08 +01:00
Miri Korenblit
7777018992 wifi: iwlwifi: cancel session protection only if there is one
mac80211 might (due to an unavoidable race) cancel a ROC that has already
expired. In that case the driver should not send the session protection
cmd to cancel the ROC.
When session protection is supported, the te_data::id field is reused
to save the configuration id. Check it before sending the cmd.

Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20240205211151.30176bf869d9.Id811c20d3746b870cbe0c946bbfe1c0ab0a290cb@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2024-02-15 10:58:36 +01:00
Miri Korenblit
35c1bbd93c wifi: iwlwifi: mvm: remove IWL_MVM_STATUS_NEED_FLUSH_P2P
This is set when a P2P ROC ends, and uses as an indication inside
iwl_mvm_roc_done_wk that the resources used for this ROC (sta/link)
needs to be flushed/deactivated (respectively).
But we also have IWL_MVM_STATUS_ROC_RUNNING, which is set whenever
P2P ROC starts, and is not even used in iwl_mvm_roc_done_wk.
Use IWL_MVM_STATUS_ROC_RUNNING as an indicator, and remove the redundant
bit.
While at it, add a call to synchronize_net also for the
AUX ROC case, which is missing in the existing code.

Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20240205211151.0494f75de311.Ic4aacacf7581a5c9046c4f1df87cbb67470853e7@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2024-02-15 10:58:36 +01:00
Biju Das
6bcff5f958 media: platform: rzg2l-cru: rzg2l-video: Fix start reception procedure
As per section 35.3.1 Starting Reception for the MIPI CSI-2 Input on the
latest hardware manual (R01UH0914EJ0145 Rev.1.45) we need to supply all
the clocks and then release the CRU resets. Currently we are releasing
the resets and then supplying the clocks. So, fix the start reception
procedure.

Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://lore.kernel.org/r/20240213181233.242316-6-biju.das.jz@bp.renesas.com
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-02-15 10:57:54 +01:00
Biju Das
fdc7bd5b3a media: platform: rzg2l-cru: rzg2l-csi2: Restructure vclk handling
As per section 35.3.1 Starting Reception for the MIPI CSI-2 Input on the
latest hardware manual (R01UH0914EJ0145 Rev.1.45) we need to disable the
vclk before enabling the LINK reception and enable the vclk after enabling
the link Reception. So restructure vclk handling as per the HW manual.

Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://lore.kernel.org/r/20240213181233.242316-5-biju.das.jz@bp.renesas.com
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-02-15 10:57:54 +01:00
Biju Das
2767394855 media: platform: rzg2l-cru: rzg2l-video: Fix image processing initialization
As per section 35.3.1 Starting Reception for the MIPI CSI-2 Input on the
latest hardware manual (R01UH0914EJ0140 Rev.1.40) it is mentioned that
initialize the AXI master first and then initialize the image processing.
Fix the start procedure as per the hardware manual.

Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Link: https://lore.kernel.org/r/20240213181233.242316-4-biju.das.jz@bp.renesas.com
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-02-15 10:57:54 +01:00
Biju Das
9c7fa014ca media: platform: rzg2l-cru: rzg2l-ip: Add delay after D-PHY reset
As per section 35.3.1 Starting Reception for the MIPI CSI-2 Input on the
latest hardware manual (R01UH0914EJ0140 Rev.1.40) it is mentioned that
after DPHY reset, we need to wait for 1 msec or more before start
receiving data from the sensor. So add a delay after pre_streamon().

Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Link: https://lore.kernel.org/r/20240213181233.242316-3-biju.das.jz@bp.renesas.com
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-02-15 10:57:54 +01:00
Biju Das
f243df0a0b media: platform: rzg2l-cru: rzg2l-csi2: Switch to RUNTIME_PM_OPS()
Replace the old SET_RUNTIME_PM_OPS() helpers with its modern alternative
RUNTIME_PM_OPS(). The usage of pm_ptr and RUNTIME_PM_OPS() allows the
compiler to see where it's used but still drop the dead code. After this
we can get rid of the unnecessary '__maybe_unused' annotations on PM
functions.

Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Link: https://lore.kernel.org/r/20240213181233.242316-2-biju.das.jz@bp.renesas.com
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
2024-02-15 10:57:54 +01:00
Johannes Berg
cd882e2fb2 Merge wireless into wireless-next
There's a conflict already and some upcoming changes
also depend on changes in wireless for being conflict-
free, so pull wireless in to make all that easier.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2024-02-15 09:56:42 +01:00
Arnd Bergmann
455dae7549 drm/xe: avoid function cast warnings
clang-16 warns about a cast between incompatible function types:

drivers/gpu/drm/xe/xe_range_fence.c:155:10: error: cast from 'void (*)(const void *)' to 'void (*)(struct xe_range_fence *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
  155 |         .free = (void (*)(struct xe_range_fence *rfence)) kfree,
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Avoid this with a trivial helper function that calls kfree() here.

v2:
- s/* rfence/*rfence/ (Thomas)

Fixes: 845f64bdbf ("drm/xe: Introduce a range-fence utility")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240213095719.454865-1-arnd@kernel.org
(cherry picked from commit f2c9364db5)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2024-02-15 09:53:38 +01:00
Thomas Hellström
8cb92dc730 drm/xe/pt: Allow for stricter type- and range checking
Distinguish between xe_pt and the xe_pt_dir subclass when
allocating and freeing. Also use a fixed-size array for the
xe_pt_dir page entries to make life easier for dynamic range-
checkers. Finally rename the page-directory child pointer array
to "children".

While no functional change, this fixes ubsan splats similar to:

[   51.463021] ------------[ cut here ]------------
[   51.463022] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/xe/xe_pt.c:47:9
[   51.463023] index 0 is out of range for type 'xe_ptw *[*]'
[   51.463024] CPU: 5 PID: 2778 Comm: xe_vm Tainted: G     U             6.8.0-rc1+ #218
[   51.463026] Hardware name: ASUS System Product Name/PRIME B560M-A AC, BIOS 2001 02/01/2023
[   51.463027] Call Trace:
[   51.463028]  <TASK>
[   51.463029]  dump_stack_lvl+0x47/0x60
[   51.463030]  __ubsan_handle_out_of_bounds+0x95/0xd0
[   51.463032]  xe_pt_destroy+0xa5/0x150 [xe]
[   51.463088]  __xe_pt_unbind_vma+0x36c/0x9b0 [xe]
[   51.463144]  xe_vm_unbind+0xd8/0x580 [xe]
[   51.463204]  ? drm_exec_prepare_obj+0x3f/0x60 [drm_exec]
[   51.463208]  __xe_vma_op_execute+0x5da/0x910 [xe]
[   51.463268]  ? __drm_gpuvm_sm_unmap+0x1cb/0x220 [drm_gpuvm]
[   51.463272]  ? radix_tree_node_alloc.constprop.0+0x89/0xc0
[   51.463275]  ? drm_gpuva_it_remove+0x1f3/0x2a0 [drm_gpuvm]
[   51.463279]  ? drm_gpuva_remove+0x2f/0xc0 [drm_gpuvm]
[   51.463283]  xe_vm_bind_ioctl+0x1a55/0x20b0 [xe]
[   51.463344]  ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe]
[   51.463414]  drm_ioctl_kernel+0xb6/0x120
[   51.463416]  drm_ioctl+0x287/0x4e0
[   51.463418]  ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe]
[   51.463481]  __x64_sys_ioctl+0x94/0xd0
[   51.463484]  do_syscall_64+0x86/0x170
[   51.463486]  ? syscall_exit_to_user_mode+0x7d/0x200
[   51.463488]  ? do_syscall_64+0x96/0x170
[   51.463490]  ? do_syscall_64+0x96/0x170
[   51.463492]  entry_SYSCALL_64_after_hwframe+0x6e/0x76
[   51.463494] RIP: 0033:0x7f246bfe817d
[   51.463498] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00
[   51.463501] RSP: 002b:00007ffc1bd19ad0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   51.463502] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f246bfe817d
[   51.463504] RDX: 00007ffc1bd19b60 RSI: 0000000040886445 RDI: 0000000000000003
[   51.463505] RBP: 00007ffc1bd19b20 R08: 0000000000000000 R09: 0000000000000000
[   51.463506] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc1bd19b60
[   51.463508] R13: 0000000040886445 R14: 0000000000000003 R15: 0000000000010000
[   51.463510]  </TASK>
[   51.463517] ---[ end trace ]---

v2
- Fix kerneldoc warning (Matthew Brost)

Fixes: dd08ebf6c3 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240209112655.4872-1-thomas.hellstrom@linux.intel.com
(cherry picked from commit 157261c58b)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2024-02-15 09:53:18 +01:00
Matthew Auld
c2626b7387 drm/xe/display: fix i915_gem_object_is_shmem() wrapper
shmem ensures the memory is cleared on allocation, however here we are
using TTM, which doesn't natively support shmem (other than for swap),
but instead just allocates normal system memory. And we only zero such
memory for userspace allocations. In the case of intel_fbdev we are
missing the memset_io() since display path incorrectly thinks object is
shmem based.

Fixes: 44e694958b ("drm/xe/display: Implement display support")
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240205153110.38340-2-matthew.auld@intel.com
(cherry picked from commit 63fb531fbf)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2024-02-15 09:53:11 +01:00