Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pinctrl: starfive: switch to regmap for gpio registers #36

Closed
wants to merge 51 commits into from
Closed

pinctrl: starfive: switch to regmap for gpio registers #36

wants to merge 51 commits into from

Conversation

pdp7
Copy link

@pdp7 pdp7 commented Jul 25, 2021

switch from readl() and writel() to regmap_read() and regmap_write() for the GPIO registers. Leave the padctl registers with using readl and writel for now as that is a different io memory range.

teknoraver and others added 30 commits July 25, 2021 20:59
Patch series "lib/string: optimized mem* functions", v2.

Rewrite the generic mem{cpy,move,set} so that memory is accessed with the
widest size possible, but without doing unaligned accesses.

This was originally posted as C string functions for RISC-V[1], but as
there was no specific RISC-V code, it was proposed for the generic
lib/string.c implementation.

Tested on RISC-V and on x86_64 by undefining __HAVE_ARCH_MEM{CPY,SET,MOVE}
and HAVE_EFFICIENT_UNALIGNED_ACCESS.

These are the performances of memcpy() and memset() of a RISC-V machine on
a 32 mbyte buffer:

memcpy:
original aligned:	 75 Mb/s
original unaligned:	 75 Mb/s
new aligned:		114 Mb/s
new unaligned:		107 Mb/s

memset:
original aligned:	140 Mb/s
original unaligned:	140 Mb/s
new aligned:		241 Mb/s
new unaligned:		241 Mb/s

The size increase is negligible:

$ scripts/bloat-o-meter vmlinux.orig vmlinux
add/remove: 0/0 grow/shrink: 4/1 up/down: 427/-6 (421)
Function                                     old     new   delta
memcpy                                        29     351    +322
memset                                        29     117     +88
strlcat                                       68      78     +10
strlcpy                                       50      57      +7
memmove                                       56      50      -6
Total: Before=8556964, After=8557385, chg +0.00%

These functions will be used for RISC-V initially.

[1] https://lore.kernel.org/linux-riscv/[email protected]/

This patch (of 3):

Rewrite the generic memcpy() to copy a word at time, without generating
unaligned accesses.

The procedure is made of three steps: First copy data one byte at time
until the destination buffer is aligned to a long boundary.  Then copy the
data one long at time shifting the current and the next long to compose a
long at every cycle.  Finally, copy the remainder one byte at time.

This is the improvement on RISC-V:

original aligned:	 75 Mb/s
original unaligned:	 75 Mb/s
new aligned:		114 Mb/s
new unaligned:		107 Mb/s

and this the binary size increase according to bloat-o-meter:

Function     old     new   delta
memcpy        36     324    +288

Link: https://lkml.kernel.org/r/[email protected]
Link: https://lkml.kernel.org/r/[email protected]
Signed-off-by: Matteo Croce <[email protected]>
Cc: Nick Kossifidis <[email protected]>
Cc: Guo Ren <[email protected]>
Cc: Christoph Hellwig <[email protected]>
Cc: David Laight <[email protected]>
Cc: Palmer Dabbelt <[email protected]>
Cc: Emil Renner Berthing <[email protected]>
Cc: Drew Fustini <[email protected]>
Cc: Nick Desaulniers <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Stephen Rothwell <[email protected]>
When the destination buffer is before the source one, or when the buffers
doesn't overlap, it's safe to use memcpy() instead, which is optimized to
use a bigger data size possible.

This "optimization" only covers a common case.  In future, proper code
which does the same thing as memcpy() does but backwards can be done.

Link: https://lkml.kernel.org/r/[email protected]
Signed-off-by: Matteo Croce <[email protected]>
Cc: Christoph Hellwig <[email protected]>
Cc: David Laight <[email protected]>
Cc: Drew Fustini <[email protected]>
Cc: Emil Renner Berthing <[email protected]>
Cc: Guo Ren <[email protected]>
Cc: Nick Desaulniers <[email protected]>
Cc: Nick Kossifidis <[email protected]>
Cc: Palmer Dabbelt <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Stephen Rothwell <[email protected]>
The generic memset is defined as a byte at time write.  This is always
safe, but it's slower than a 4 byte or even 8 byte write.

Write a generic memset which fills the data one byte at time until the
destination is aligned, then fills using the largest size allowed, and
finally fills the remaining data one byte at time.

On a RISC-V machine the speed goes from 140 Mb/s to 241 Mb/s, and this the
binary size increase according to bloat-o-meter:

Function     old     new   delta
memset        32     148    +116

Link: https://lkml.kernel.org/r/[email protected]
Signed-off-by: Matteo Croce <[email protected]>
Cc: Christoph Hellwig <[email protected]>
Cc: David Laight <[email protected]>
Cc: Drew Fustini <[email protected]>
Cc: Emil Renner Berthing <[email protected]>
Cc: Guo Ren <[email protected]>
Cc: Nick Desaulniers <[email protected]>
Cc: Nick Kossifidis <[email protected]>
Cc: Palmer Dabbelt <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Stephen Rothwell <[email protected]>
Use the generic routines which handle alignment properly.

Signed-off-by: Matteo Croce <[email protected]>
Signed-off-by: Emil Renner Berthing <[email protected]>
Add DT binding documentation for the StarFive JH7100 Soc [1] and the
BeagleV Starlight JH7100 board [2].

[1] https:/starfive-tech/beaglev_doc
[2] https:/beagleboard/beaglev-starlight

Signed-off-by: Drew Fustini <[email protected]>
Add all clock outputs for the StarFive JH7100 Clock Generator.

Based on work by Ahmad Fatoum for Barebox, with "JH7100_" prefixes added
to all definitions.

Signed-off-by: Geert Uytterhoeven <[email protected]>
Add all resets for the StarFive JH7100 Reset Controller.

Based on work by Ahmad Fatoum for Barebox, with "JH7100_" prefixes added
to all definitions.

Signed-off-by: Geert Uytterhoeven <[email protected]>
Add preliminary Device Tree bindings for the StarFive JH7100 Clock
Generator.

To be verified against documentation when it becomes available.

Signed-off-by: Geert Uytterhoeven <[email protected]>
Make clk_ignore_unused public, so the StarFive JH7100 Clock Generator
driver can set the flag.

Signed-off-by: Geert Uytterhoeven <[email protected]>
Add a preliminary driver for the StarFive JH7100 Clock Generator,
based on work by Ahmad Fatoum for Barebox.

Functional differences compared to the Barebox driver:
  - Addition of starfive_clk_pll_mult(), to make the PLL outputs
    reasonable,
  - Add temporary overrides for critical clocks (uart, i2c, spi) until
    we get the clock tree right, so we don't have to keep dummy clocks
    like uartclk and hs_uartclk in the DTS.

This driver sets clk_ignore_unused, else the system locks up when all
clocks deemed unused are disabled.

To be updated when the documentation becomes available.

Signed-off-by: Geert Uytterhoeven <[email protected]>
Add bindings for the temperature sensor on the StarFive JH7100 SoC.

Signed-off-by: Emil Renner Berthing <[email protected]>
Reviewed-by: Rob Herring <[email protected]>
Register definitions and conversion constants based on sfctemp driver by
Samin in the StarFive 5.10 kernel.

Signed-off-by: Emil Renner Berthing <[email protected]>
Signed-off-by: Samin Guo <[email protected]>
This converts the tps65086.txt binding description to YAML schema so
dts files can be verified automatically.

Signed-off-by: Emil Renner Berthing <[email protected]>
The BeagleV Starlight v0.9 board[1] doesn't have the IRQB line routed to
the SoC, but it is still useful to be able to reach the PMIC over I2C
for the other functionality it provides such as GPIOs and regulator
settings.

[1] https:/beagleboard/beaglev-starlight

Signed-off-by: Emil Renner Berthing <[email protected]>
Acked-for-MFD-by: Lee Jones <[email protected]>
The only way to reset the BeagleV Starlight v0.9 board[1] properly is to
tell the PMIC to reset itself which will then assert the external reset
lines of the SoC, USB hub and ethernet phy.

This adds a driver to register a reset handler to do just that.

[1] https:/beagleboard/beaglev-starlight

Signed-off-by: Emil Renner Berthing <[email protected]>
Acked-by: Sebastian Reichel <[email protected]>
The only way to reset the BeagleV Starlight v0.9 board[1] properly is to
tell the PMIC to reset itself which will then assert the external reset
lines of the SoC, USB hub and ethernet phy.

This adds an mfd cell entry for the reset driver doing just that.

[1] https:/beagleboard/beaglev-starlight

Signed-off-by: Emil Renner Berthing <[email protected]>
The first DMAC instance in the StarFive JH7100 SoC supports 16 DMA
channels.

FIXME Given there are more changes to the driver than just increasing
      DMAC_MAX_CHANNELS, we probably need a new compatible value, too.

Signed-off-by: Geert Uytterhoeven <[email protected]>
This makes it easier to find out which driver passes a wrong address
range.

Signed-off-by: Geert Uytterhoeven <[email protected]>
[Emil: fix suggested by Geert Uytterhoeven <[email protected]>]

Signed-off-by: Atish Patra <[email protected]>
Signed-off-by: Emil Renner Berthing <[email protected]>
Clear CNTR of PWM after setting period & duty_cycle
Descriptor management was simplified with commit:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ef6fb2d6f1abd56cc067c694253ea362159b5ac3

Code added to dw-axi-dmac-platform driver due to VIC7100 Cache Coherency
issues needed follow those changes.

Signed-off-by: Michael Scott <[email protected]>
iort_dma_setup() is being removed by commit db59e1b ("ACPI:
arm64: Move DMA setup operations out of IORT") in iommu/next:

    drivers/dma/dw-axi-dmac-starfive/starfive_dmaengine_memcpy.c: In function ‘dw_dma_async_
    do_memcpy’:
    drivers/dma/dw-axi-dmac-starfive/starfive_dmaengine_memcpy.c:152:2: error: implicit decl
    aration of function ‘iort_dma_setup’ [-Werror=implicit-function-declaration]
      152 |  iort_dma_setup(dma_dev, &dma_addr, &dma_size);
	  |  ^~~~~~~~~~~~~~
    drivers/dma/dw-axi-dmac-starfive/starfive_dmaengine_memcpy.c:153:8: warning: assignment to ‘const struct iommu_ops *’ from ‘int’ makes pointer from integer without a cast [-Wint-conversion]
      153 |  iommu = iort_iommu_configure_id(dma_dev, NULL);
	  |        ^
    drivers/dma/dw-axi-dmac-starfive/starfive_dmaengine_memcpy.c: In function ‘dw_dma_memcpy_raw’:
    drivers/dma/dw-axi-dmac-starfive/starfive_dmaengine_memcpy.c:223:8: warning: assignment to ‘const struct iommu_ops *’ from ‘int’ makes pointer from integer without a cast [-Wint-conversion]
      223 |  iommu = iort_iommu_configure_id(dma_dev, NULL);
	  |        ^

iort_dma_setup() and iort_iommu_configure_id() are part of the ARM64
ACPI implementation.  As CONFIG_ACPI_IORT cannot be enabled on RISC-V,
they were dummies anyway, so these calls can just be removed.

[Emil: remove unused local variables too]

Signed-off-by: Geert Uytterhoeven <[email protected]>
Signed-off-by: Emil Renner Berthing <[email protected]>
---
Boot-tested, but the affected code paths were not exercised.
farzadfch and others added 9 commits July 25, 2021 21:02
Additional update from Prashant Gaikwad <[email protected]>
Adapted for Linux 5.13 and the BeagleV Starlight board by
<[email protected]>
This IP is also used on the StarFive JH7100 riscv64 SoC and presumably
also the upcoming JH7110 SoC.

Signed-off-by: Emil Renner Berthing <[email protected]>
** Do not upstream **

This is hacky fix just for testing. The actual patch would read the
RISCV_UNCACHED_OFFSET from the DT for only the non-coherent devices.
All other devices on beagleV and all other platform should just set
dma_default_coherent to true.

[Emil: remove spurious whitespace and fix format string warning]

Signed-off-by: Atish Patra <[email protected]>
Signed-off-by: Emil Renner Berthing <[email protected]>
Based on the device tree in https:/starfive-tech/u-boot/
with contributions from:
yanhong.wang <[email protected]>
Huan.Feng <[email protected]>
ke.zhu <[email protected]>
yiming.li <[email protected]>
jack.zhu <[email protected]>
Samin Guo <[email protected]>
Chenjieqin <[email protected]>
bo.li <[email protected]>

Rearranged, cleanups, fixes and TPS65086 added by Emil.
Cleanups, fixes, LED and clocks added by Geert.
Cleanups and GPIO fixes from Drew.
Thermal zone added by Stephen.

Signed-off-by: Emil Renner Berthing <[email protected]>
Signed-off-by: Geert Uytterhoeven <[email protected]>
Signed-off-by: Stephen L Arnold <[email protected]>
Signed-off-by: Drew Fustini <[email protected]>
For convenience this also adds a small beaglev_defconfig and the
firmware needed for the brcmfmac driver along with the signed regulatory
database.

The firmware is from the linux-firmware repo and the regulatory database
from the wireless-regdb Fedora package.

Signed-off-by: Emil Renner Berthing <[email protected]>
Signed-off-by: Geert Uytterhoeven <[email protected]>
Signed-off-by: Drew Fustini <[email protected]>
The GPIO code is adapted from the StarFive GPIO driver by
Huan Feng <[email protected]> with cleanups
by Drew and me.

Signed-off-by: Emil Renner Berthing <[email protected]>
Signed-off-by: Drew Fustini <[email protected]>
Current u-boot doesn't seem to take into account that some GPIOs are
configured as inputs/outputs of certain peripherals on power-up. This
means it ends up configuring some GPIOs as inputs to more than one
peripheral which the documentation explicitly says is illegal. Similarly
it also ends up configuring more than one GPIO as output of the same
peripheral. While not explicitly mentioned by the documentation this
also seems like a bad idea.

The easiest way to remedy this mess is to just disconnect all GPIOs from
peripherals and have our pinmux configuration set everything up
properly. This, however, means that we'd disconnect the serial console
from its pins for a while, so add a device tree property to keep
certain GPIOs from being reset.

Signed-off-by: Emil Renner Berthing <[email protected]>
switch from readl() and writel() to regmap_read() and regmap_write()
for the GPIO registers.  Leave the padctl registers with using readl
writel for now as that is a different io memory range.

Signed-off-by: Drew Fustini <[email protected]>
@esmil
Copy link
Owner

esmil commented Jul 26, 2021

I don't think just wrapping readl() and writel() in regmap_read() and regmap_write() like this adds any value. What would add value is reusing some gpio wrappers like drivers/gpio/gpio-mmap.c or drivers/gpio/gpio-regmap.c.

For gpio-mmap I don't think we can use it as is because it assumes every GPIO is represented as 1 bit in each type of register, and the number GPIOs matches the register width. We have 64 GPIOs in 32bit register pairs, and the output and output enable functionality has a full 32bit register each. Maybe it could be modelled with 2 gpio_chips with 32 GPIOs each, but that just seems awkward and then userspace would need to know that GPIO42 is actually GPIO 10 on the 2nd gpiochip.

I think gpio-regmap could be brought to work, but I don't think it'll help making the code any more understandable. In particular the fact that the DOUT and DOEN registers are used for both pinmuxing and output/output enable respectively will be hidden inside the reg_mask_xlate callback. Also gpio-regmap doesn't implement the add_pin_ranges and set_config callbacks. The first is used to set up the gpio to pin mapping which depends on the chosen signal group (IO_PADSHARE_SEL value) and the second makes gpiomon -B pull-up work.

@esmil esmil force-pushed the beaglev-pinctrl branch 2 times, most recently from 9f8f1c5 to bd2d42e Compare July 27, 2021 18:40
@pdp7
Copy link
Author

pdp7 commented Jul 27, 2021

I do think regmap_write() and regmap_read() are useful as they decouple void pointer to io memory from the address offset. This allows the offsets to be calculated as regular unsigned values.

Regarding the higher levels of abstraction, I agree I'm not sure how bgpio_init() could help given gpio-mmio seems to not fit this starfive soc. Linus W did not respond yet but I think it would take a lot of gpio-mmio changes for it to support an soc like this. In that case, is it still really "generic"?

It seems like the xlate functionality in regmap-gpio could be used, but I am not quite sure. I'm interested to see Michael Walle's response and how much he thinks it would be good to improve regmap-gpio for additional use cases. The StarFive SoC is much more complicated than the hardware that Michael's sl28cpld driver targets.

@esmil
Copy link
Owner

esmil commented Jul 27, 2021

I do think regmap_write() and regmap_read() are useful as they decouple void pointer to io memory from the address offset. This allows the offsets to be calculated as regular unsigned values.

Hmm.. I'm not exactly sure why unsigned arithmetic is any better that pointer arithmetic. But if it is, couldn't you accomplish exactly the same with

static void starfive_reg_set(struct starfive_pinctrl *sfp, unsigned int offset, u32 value)
{
    writel_relaxed(value, sfp->base + offset);
}

static u32 starfive_reg_get(struct starfive_pinctrl *sfp, unsigned int offset)
{
    return readl_relaxed(sfp->base + offset);
}

..which regmaps on mmio eventually amounts to, except this version will be inlined by the compiler and hence cost nothing unlike regmaps?

@esmil esmil force-pushed the beaglev-pinctrl branch 4 times, most recently from de555d7 to d866d57 Compare July 30, 2021 11:18
@esmil esmil deleted the branch esmil:beaglev-pinctrl August 5, 2021 10:48
@esmil esmil closed this Aug 5, 2021
@pdp7
Copy link
Author

pdp7 commented Aug 5, 2021

Yes, after the discussion with Michael Walle on IRC, I don't think it really makes sense to try to leverage gpio-regmap. Too much would need to be added to it for it to work with this SoC. At which point the value in being generic goes away.

I think the structure of this SoC really does mean it is needs to handle all the gpio and pinctrl in a single driver that does not leverage gpio-regmap or gpio-mmio. I guess it could be interesting to find a common abstraction if there is any other SoC that has similar register structure but I am not aware of any.

@esmil
Copy link
Owner

esmil commented Aug 6, 2021

Thank you for following up on this.

esmil pushed a commit that referenced this pull request Nov 21, 2021
When optional counter support was added the allocation of the memory
holding the counter descriptors was not cleared properly. This caused
WARN_ON()s in the IB/sysfs code to be hit.

This is because the uninitialized memory made some of the counters wrongly
look like optional counters. Use kzalloc.

While here change the sizeof() calls to use the pointer rather than the
name of the type.

  WARNING: CPU: 0 PID: 32644 at drivers/infiniband/core/sysfs.c:1064 ib_setup_port_attrs+0x7e1/0x890 [ib_core]
  CPU: 0 PID: 32644 Comm: kworker/0:2 Tainted: G S      W 5.15.0+ #36
  Hardware name: Intel Corporation S2600WTT/S2600WTT, BIOS SE5C610.86B.01.01.0018.C4.072020161249 07/20/2016
  Workqueue: events work_for_cpu_fn
  RIP: 0010:ib_setup_port_attrs+0x7e1/0x890 [ib_core]
  RSP: 0018:ffffc90006ea3c40 EFLAGS: 00010202
  RAX: 0000000000000068 RBX: ffff888106ad8000 RCX: 0000000000000138
  RDX: ffff888126c84c00 RSI: ffff888103c41000 RDI: 0000000000000124
  RBP: ffff88810f63a801 R08: ffff888126c8a000 R09: 0000000000000001
  R10: ffffffffa09acf20 R11: 0000000000000065 R12: ffff88810f63a800
  R13: ffff88810f63a800 R14: ffff88810f63a8e0 R15: 0000000000000001
  FS:  0000000000000000(0000) GS:ffff888667a00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00005590102cb078 CR3: 000000000240a003 CR4: 00000000001706f0
  Call Trace:
   ib_register_device.cold.44+0x23e/0x2d0 [ib_core]
   rvt_register_device+0xfa/0x230 [rdmavt]
   hfi1_register_ib_device+0x623/0x690 [hfi1]
   init_one.cold.36+0x2d1/0x49b [hfi1]
   local_pci_probe+0x45/0x80
   work_for_cpu_fn+0x16/0x20
   process_one_work+0x1b1/0x360
   worker_thread+0x1d4/0x3a0
   kthread+0x11a/0x140
   ret_from_fork+0x22/0x30

Fixes: 5e2ddd1 ("RDMA/counter: Add optional counter support")
Link: https://lore.kernel.org/r/[email protected]
Reviewed-by: Mike Marciniszyn <[email protected]>
Signed-off-by: Dennis Dalessandro <[email protected]>
Signed-off-by: Jason Gunthorpe <[email protected]>
esmil pushed a commit that referenced this pull request Dec 5, 2021
[Why]
IGT bypass test will set crc source as DPRX,and display DM didn`t check
connection type, it run the test on the HDMI connector ,then the kernel
will be crashed because aux->transfer is set null for HDMI connection.
This patch will skip the invalid connection test and fix kernel crash issue.

[How]
Check the connector type while setting the pipe crc source as DPRX or
auto,if the type is not DP or eDP, the crtc crc source will not be set
and report error code to IGT test,IGT will show the this subtest as no
valid crtc/connector combinations found.

116.779714] [IGT] amd_bypass: starting subtest 8bpc-bypass-mode
[ 117.730996] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 117.731001] #PF: supervisor instruction fetch in kernel mode
[ 117.731003] #PF: error_code(0x0010) - not-present page
[ 117.731004] PGD 0 P4D 0
[ 117.731006] Oops: 0010 [#1] SMP NOPTI
[ 117.731009] CPU: 11 PID: 2428 Comm: amd_bypass Tainted: G OE 5.11.0-34-generic #36~20.04.1-Ubuntu
[ 117.731011] Hardware name: AMD CZN/, BIOS AB.FD 09/07/2021
[ 117.731012] RIP: 0010:0x0
[ 117.731015] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
[ 117.731016] RSP: 0018:ffffa8d64225bab8 EFLAGS: 00010246
[ 117.731017] RAX: 0000000000000000 RBX: 0000000000000020 RCX: ffffa8d64225bb5e
[ 117.731018] RDX: ffff93151d921880 RSI: ffffa8d64225bac8 RDI: ffff931511a1a9d8
[ 117.731022] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 117.731023] CR2: ffffffffffffffd6 CR3: 000000010d5a4000 CR4: 0000000000750ee0
[ 117.731023] PKRU: 55555554
[ 117.731024] Call Trace:
[ 117.731027] drm_dp_dpcd_access+0x72/0x110 [drm_kms_helper]
[ 117.731036] drm_dp_dpcd_read+0xb7/0xf0 [drm_kms_helper]
[ 117.731040] drm_dp_start_crc+0x38/0xb0 [drm_kms_helper]
[ 117.731047] amdgpu_dm_crtc_set_crc_source+0x1ae/0x3e0 [amdgpu]
[ 117.731149] crtc_crc_open+0x174/0x220 [drm]
[ 117.731162] full_proxy_open+0x168/0x1f0
[ 117.731165] ? open_proxy_open+0x100/0x100

BugLink: https://gitlab.freedesktop.org/drm/amd/-/issues/1546
Reviewed-by: Harry Wentland <[email protected]>
Reviewed-by: Rodrigo Siqueira <[email protected]>
Signed-off-by: Perry Yuan <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
esmil pushed a commit that referenced this pull request Dec 20, 2021
[ Upstream commit 2da34b7 ]

[Why]
IGT bypass test will set crc source as DPRX,and display DM didn`t check
connection type, it run the test on the HDMI connector ,then the kernel
will be crashed because aux->transfer is set null for HDMI connection.
This patch will skip the invalid connection test and fix kernel crash issue.

[How]
Check the connector type while setting the pipe crc source as DPRX or
auto,if the type is not DP or eDP, the crtc crc source will not be set
and report error code to IGT test,IGT will show the this subtest as no
valid crtc/connector combinations found.

116.779714] [IGT] amd_bypass: starting subtest 8bpc-bypass-mode
[ 117.730996] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 117.731001] #PF: supervisor instruction fetch in kernel mode
[ 117.731003] #PF: error_code(0x0010) - not-present page
[ 117.731004] PGD 0 P4D 0
[ 117.731006] Oops: 0010 [#1] SMP NOPTI
[ 117.731009] CPU: 11 PID: 2428 Comm: amd_bypass Tainted: G OE 5.11.0-34-generic #36~20.04.1-Ubuntu
[ 117.731011] Hardware name: AMD CZN/, BIOS AB.FD 09/07/2021
[ 117.731012] RIP: 0010:0x0
[ 117.731015] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
[ 117.731016] RSP: 0018:ffffa8d64225bab8 EFLAGS: 00010246
[ 117.731017] RAX: 0000000000000000 RBX: 0000000000000020 RCX: ffffa8d64225bb5e
[ 117.731018] RDX: ffff93151d921880 RSI: ffffa8d64225bac8 RDI: ffff931511a1a9d8
[ 117.731022] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 117.731023] CR2: ffffffffffffffd6 CR3: 000000010d5a4000 CR4: 0000000000750ee0
[ 117.731023] PKRU: 55555554
[ 117.731024] Call Trace:
[ 117.731027] drm_dp_dpcd_access+0x72/0x110 [drm_kms_helper]
[ 117.731036] drm_dp_dpcd_read+0xb7/0xf0 [drm_kms_helper]
[ 117.731040] drm_dp_start_crc+0x38/0xb0 [drm_kms_helper]
[ 117.731047] amdgpu_dm_crtc_set_crc_source+0x1ae/0x3e0 [amdgpu]
[ 117.731149] crtc_crc_open+0x174/0x220 [drm]
[ 117.731162] full_proxy_open+0x168/0x1f0
[ 117.731165] ? open_proxy_open+0x100/0x100

BugLink: https://gitlab.freedesktop.org/drm/amd/-/issues/1546
Reviewed-by: Harry Wentland <[email protected]>
Reviewed-by: Rodrigo Siqueira <[email protected]>
Signed-off-by: Perry Yuan <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
esmil pushed a commit that referenced this pull request Feb 13, 2022
…egulator

The interrupt pin of the external ethernet phy is used, instead of the
enable-gpio pin of the tf-io regulator. The GPIOE_2 pin is located in
the gpio_ao bank.

This causes phy interrupt problems at system startup.
[   76.645190] irq 36: nobody cared (try booting with the "irqpoll" option)
[   76.649617] CPU: 0 PID: 1416 Comm: irq/36-0.0:00 Not tainted 5.16.0 #2
[   76.649629] Hardware name: Hardkernel ODROID-HC4 (DT)
[   76.649635] Call trace:
[   76.649638]  dump_backtrace+0x0/0x1c8
[   76.649658]  show_stack+0x14/0x60
[   76.649667]  dump_stack_lvl+0x64/0x7c
[   76.649676]  dump_stack+0x14/0x2c
[   76.649683]  __report_bad_irq+0x38/0xe8
[   76.649695]  note_interrupt+0x220/0x3a0
[   76.649704]  handle_irq_event_percpu+0x58/0x88
[   76.649713]  handle_irq_event+0x44/0xd8
[   76.649721]  handle_fasteoi_irq+0xa8/0x130
[   76.649730]  generic_handle_domain_irq+0x38/0x58
[   76.649738]  gic_handle_irq+0x9c/0xb8
[   76.649747]  call_on_irq_stack+0x28/0x38
[   76.649755]  do_interrupt_handler+0x7c/0x80
[   76.649763]  el1_interrupt+0x34/0x80
[   76.649772]  el1h_64_irq_handler+0x14/0x20
[   76.649781]  el1h_64_irq+0x74/0x78
[   76.649788]  irq_finalize_oneshot.part.56+0x68/0xf8
[   76.649796]  irq_thread_fn+0x5c/0x98
[   76.649804]  irq_thread+0x13c/0x260
[   76.649812]  kthread+0x144/0x178
[   76.649822]  ret_from_fork+0x10/0x20
[   76.649830] handlers:
[   76.653170] [<0000000025a6cd31>] irq_default_primary_handler threaded [<0000000093580eb7>] phy_interrupt
[   76.661256] Disabling IRQ #36

Fixes: 1f80a5c ("arm64: dts: meson-sm1-odroid: add missing enable gpio and supply for tf_io regulator")
Signed-off-by: Lutz Koschorreck <[email protected]>
Reviewed-by: Neil Armstrong <[email protected]>
Signed-off-by: Neil Armstrong <[email protected]>
[narmstrong: removed spurious invalid & blank lines from commit message]
Link: https://lore.kernel.org/r/20220127130537.GA187347@odroid-VirtualBox
esmil pushed a commit that referenced this pull request Feb 22, 2022
…egulator

[ Upstream commit 323ca76 ]

The interrupt pin of the external ethernet phy is used, instead of the
enable-gpio pin of the tf-io regulator. The GPIOE_2 pin is located in
the gpio_ao bank.

This causes phy interrupt problems at system startup.
[   76.645190] irq 36: nobody cared (try booting with the "irqpoll" option)
[   76.649617] CPU: 0 PID: 1416 Comm: irq/36-0.0:00 Not tainted 5.16.0 #2
[   76.649629] Hardware name: Hardkernel ODROID-HC4 (DT)
[   76.649635] Call trace:
[   76.649638]  dump_backtrace+0x0/0x1c8
[   76.649658]  show_stack+0x14/0x60
[   76.649667]  dump_stack_lvl+0x64/0x7c
[   76.649676]  dump_stack+0x14/0x2c
[   76.649683]  __report_bad_irq+0x38/0xe8
[   76.649695]  note_interrupt+0x220/0x3a0
[   76.649704]  handle_irq_event_percpu+0x58/0x88
[   76.649713]  handle_irq_event+0x44/0xd8
[   76.649721]  handle_fasteoi_irq+0xa8/0x130
[   76.649730]  generic_handle_domain_irq+0x38/0x58
[   76.649738]  gic_handle_irq+0x9c/0xb8
[   76.649747]  call_on_irq_stack+0x28/0x38
[   76.649755]  do_interrupt_handler+0x7c/0x80
[   76.649763]  el1_interrupt+0x34/0x80
[   76.649772]  el1h_64_irq_handler+0x14/0x20
[   76.649781]  el1h_64_irq+0x74/0x78
[   76.649788]  irq_finalize_oneshot.part.56+0x68/0xf8
[   76.649796]  irq_thread_fn+0x5c/0x98
[   76.649804]  irq_thread+0x13c/0x260
[   76.649812]  kthread+0x144/0x178
[   76.649822]  ret_from_fork+0x10/0x20
[   76.649830] handlers:
[   76.653170] [<0000000025a6cd31>] irq_default_primary_handler threaded [<0000000093580eb7>] phy_interrupt
[   76.661256] Disabling IRQ #36

Fixes: 1f80a5c ("arm64: dts: meson-sm1-odroid: add missing enable gpio and supply for tf_io regulator")
Signed-off-by: Lutz Koschorreck <[email protected]>
Reviewed-by: Neil Armstrong <[email protected]>
Signed-off-by: Neil Armstrong <[email protected]>
[narmstrong: removed spurious invalid & blank lines from commit message]
Link: https://lore.kernel.org/r/20220127130537.GA187347@odroid-VirtualBox
Signed-off-by: Sasha Levin <[email protected]>
esmil pushed a commit that referenced this pull request Nov 17, 2022
In ata_tdev_add(), the return value of transport_add_device() is
not checked. As a result, it causes null-ptr-deref while removing
the module, because transport_remove_device() is called to remove
the device that was not added.

Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0
CPU: 13 PID: 13603 Comm: rmmod Kdump: loaded Tainted: G        W          6.1.0-rc3+ #36
pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : device_del+0x48/0x3a0
lr : device_del+0x44/0x3a0
Call trace:
 device_del+0x48/0x3a0
 attribute_container_class_device_del+0x28/0x40
 transport_remove_classdev+0x60/0x7c
 attribute_container_device_trigger+0x118/0x120
 transport_remove_device+0x20/0x30
 ata_tdev_delete+0x24/0x50 [libata]
 ata_tlink_delete+0x40/0xa0 [libata]
 ata_tport_delete+0x2c/0x60 [libata]
 ata_port_detach+0x148/0x1b0 [libata]
 ata_pci_remove_one+0x50/0x80 [libata]
 ahci_remove_one+0x4c/0x8c [ahci]

Fix this by checking and handling return value of transport_add_device()
in ata_tdev_add(). In the error path, device_del() is called to delete
the device which was added earlier in this function, and ata_tdev_free()
is called to free ata_dev.

Fixes: d902747 ("[libata] Add ATA transport class")
Signed-off-by: Yang Yingliang <[email protected]>
Signed-off-by: Damien Le Moal <[email protected]>
esmil pushed a commit that referenced this pull request Mar 23, 2024
829  if (request->complete) {
830          spin_unlock(&priv_dev->lock);
831          usb_gadget_giveback_request(&priv_ep->endpoint,
832                                    request);
833          spin_lock(&priv_dev->lock);
834  }
835
836  if (request->buf == priv_dev->zlp_buf)
837      cdns3_gadget_ep_free_request(&priv_ep->endpoint, request);

Driver append an additional zero packet request when queue a packet, which
length mod max packet size is 0. When transfer complete, run to line 831,
usb_gadget_giveback_request() will free this requestion. 836 condition is
true, so cdns3_gadget_ep_free_request() free this request again.

Log:

[ 1920.140696][  T150] BUG: KFENCE: use-after-free read in cdns3_gadget_giveback+0x134/0x2c0 [cdns3]
[ 1920.140696][  T150]
[ 1920.151837][  T150] Use-after-free read at 0x000000003d1cd10b (in kfence-#36):
[ 1920.159082][  T150]  cdns3_gadget_giveback+0x134/0x2c0 [cdns3]
[ 1920.164988][  T150]  cdns3_transfer_completed+0x438/0x5f8 [cdns3]

Add check at line 829, skip call usb_gadget_giveback_request() if it is
additional zero length packet request. Needn't call
usb_gadget_giveback_request() because it is allocated in this driver.

Cc: [email protected]
Fixes: 7733f6c ("usb: cdns3: Add Cadence USB3 DRD Driver")
Signed-off-by: Frank Li <[email protected]>
Reviewed-by: Roger Quadros <[email protected]>
Acked-by: Peter Chen <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
esmil pushed a commit that referenced this pull request May 14, 2024
There is a race condition between l2cap_chan_timeout() and
l2cap_chan_del(). When we use l2cap_chan_del() to delete the
channel, the chan->conn will be set to null. But the conn could
be dereferenced again in the mutex_lock() of l2cap_chan_timeout().
As a result the null pointer dereference bug will happen. The
KASAN report triggered by POC is shown below:

[  472.074580] ==================================================================
[  472.075284] BUG: KASAN: null-ptr-deref in mutex_lock+0x68/0xc0
[  472.075308] Write of size 8 at addr 0000000000000158 by task kworker/0:0/7
[  472.075308]
[  472.075308] CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.9.0-rc5-00356-g78c0094a146b #36
[  472.075308] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4
[  472.075308] Workqueue: events l2cap_chan_timeout
[  472.075308] Call Trace:
[  472.075308]  <TASK>
[  472.075308]  dump_stack_lvl+0x137/0x1a0
[  472.075308]  print_report+0x101/0x250
[  472.075308]  ? __virt_addr_valid+0x77/0x160
[  472.075308]  ? mutex_lock+0x68/0xc0
[  472.075308]  kasan_report+0x139/0x170
[  472.075308]  ? mutex_lock+0x68/0xc0
[  472.075308]  kasan_check_range+0x2c3/0x2e0
[  472.075308]  mutex_lock+0x68/0xc0
[  472.075308]  l2cap_chan_timeout+0x181/0x300
[  472.075308]  process_one_work+0x5d2/0xe00
[  472.075308]  worker_thread+0xe1d/0x1660
[  472.075308]  ? pr_cont_work+0x5e0/0x5e0
[  472.075308]  kthread+0x2b7/0x350
[  472.075308]  ? pr_cont_work+0x5e0/0x5e0
[  472.075308]  ? kthread_blkcg+0xd0/0xd0
[  472.075308]  ret_from_fork+0x4d/0x80
[  472.075308]  ? kthread_blkcg+0xd0/0xd0
[  472.075308]  ret_from_fork_asm+0x11/0x20
[  472.075308]  </TASK>
[  472.075308] ==================================================================
[  472.094860] Disabling lock debugging due to kernel taint
[  472.096136] BUG: kernel NULL pointer dereference, address: 0000000000000158
[  472.096136] #PF: supervisor write access in kernel mode
[  472.096136] #PF: error_code(0x0002) - not-present page
[  472.096136] PGD 0 P4D 0
[  472.096136] Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI
[  472.096136] CPU: 0 PID: 7 Comm: kworker/0:0 Tainted: G    B              6.9.0-rc5-00356-g78c0094a146b #36
[  472.096136] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4
[  472.096136] Workqueue: events l2cap_chan_timeout
[  472.096136] RIP: 0010:mutex_lock+0x88/0xc0
[  472.096136] Code: be 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88
[  472.096136] RSP: 0018:ffff88800744fc78 EFLAGS: 00000246
[  472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865
[  472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78
[  472.096136] RBP: 0000000000000158 R08: ffff88800744fc7f R09: 1ffff11000e89f8f
[  472.096136] R10: dffffc0000000000 R11: ffffed1000e89f90 R12: dffffc0000000000
[  472.096136] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00
[  472.096136] FS:  0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000
[  472.096136] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  472.096136] CR2: 0000000000000158 CR3: 000000000da32000 CR4: 00000000000006f0
[  472.096136] Call Trace:
[  472.096136]  <TASK>
[  472.096136]  ? __die_body+0x8d/0xe0
[  472.096136]  ? page_fault_oops+0x6b8/0x9a0
[  472.096136]  ? kernelmode_fixup_or_oops+0x20c/0x2a0
[  472.096136]  ? do_user_addr_fault+0x1027/0x1340
[  472.096136]  ? _printk+0x7a/0xa0
[  472.096136]  ? mutex_lock+0x68/0xc0
[  472.096136]  ? add_taint+0x42/0xd0
[  472.096136]  ? exc_page_fault+0x6a/0x1b0
[  472.096136]  ? asm_exc_page_fault+0x26/0x30
[  472.096136]  ? mutex_lock+0x75/0xc0
[  472.096136]  ? mutex_lock+0x88/0xc0
[  472.096136]  ? mutex_lock+0x75/0xc0
[  472.096136]  l2cap_chan_timeout+0x181/0x300
[  472.096136]  process_one_work+0x5d2/0xe00
[  472.096136]  worker_thread+0xe1d/0x1660
[  472.096136]  ? pr_cont_work+0x5e0/0x5e0
[  472.096136]  kthread+0x2b7/0x350
[  472.096136]  ? pr_cont_work+0x5e0/0x5e0
[  472.096136]  ? kthread_blkcg+0xd0/0xd0
[  472.096136]  ret_from_fork+0x4d/0x80
[  472.096136]  ? kthread_blkcg+0xd0/0xd0
[  472.096136]  ret_from_fork_asm+0x11/0x20
[  472.096136]  </TASK>
[  472.096136] Modules linked in:
[  472.096136] CR2: 0000000000000158
[  472.096136] ---[ end trace 0000000000000000 ]---
[  472.096136] RIP: 0010:mutex_lock+0x88/0xc0
[  472.096136] Code: be 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88
[  472.096136] RSP: 0018:ffff88800744fc78 EFLAGS: 00000246
[  472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865
[  472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78
[  472.096136] RBP: 0000000000000158 R08: ffff88800744fc7f R09: 1ffff11000e89f8f
[  472.132932] R10: dffffc0000000000 R11: ffffed1000e89f90 R12: dffffc0000000000
[  472.132932] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00
[  472.132932] FS:  0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000
[  472.132932] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  472.132932] CR2: 0000000000000158 CR3: 000000000da32000 CR4: 00000000000006f0
[  472.132932] Kernel panic - not syncing: Fatal exception
[  472.132932] Kernel Offset: disabled
[  472.132932] ---[ end Kernel panic - not syncing: Fatal exception ]---

Add a check to judge whether the conn is null in l2cap_chan_timeout()
in order to mitigate the bug.

Fixes: 3df91ea ("Bluetooth: Revert to mutexes from RCU list")
Signed-off-by: Duoming Zhou <[email protected]>
Signed-off-by: Luiz Augusto von Dentz <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

10 participants