- Sep 29, 2023
-
-
Phil Elwell authored
reset_control_reset should not be used with shared reset controllers. Add support for reset_control_assert and _deassert to get the desired behaviour and avoid ugly warnings in the kernel log. Signed-off-by: Phil Elwell <phil@raspberrypi.com>
-
Phil Elwell authored
irqchip: irq-bcm2712-mip: specify bitmap search size as ilog2(N) not N Freeing also has the same interface. irqchip: irq-bcm2712-mip: Fix build warnings Signed-off-by: Phil Elwell <phil@raspberrypi.com> irqchip: bcm2712-mip: add a quick hack to optionally shift MSI vectors There are two MIP peripherals in bcm2712, the first gets a first-class treatment where 64 consecutive GIC SPIs are assigned to all 64 output vectors. The second gets an agglomeration of 17 GIC SPIs, but only 8 of these are consecutive starting at the 8th output vector. For now, allow the use of this smaller contiguous range within a larger whole. Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
-
Nick Hollinghurst authored
media: bcm2712: Initial commit of the PiSP BE driver Signed-off-by: Naushir Patuck <naush@raspberrypi.com> media: bcm2712_pisp_be: PiSP driver updates. - Start registering video nodes from /dev/video20 - Formatting fixes - Define MODULE_DEVICE_TABLE() to probe correctly Signed-off-by: Naushir Patuck <naush@raspberrypi.com> media: pisp_be: Improve image format support Add a new format table that lists the V4L2 format enums and their properties. Keep the exising 'RPBP' format to support the userland verification tools. This format requires userland to fill all plane properties. Standard V4L2 formats will derive these properties from the format table. Signed-off-by: Naushir Patuck <naush@raspberrypi.com> media: pisp_be: Advertise the meta output format explictily. Signed-off-by: Naushir Patuck <naush@raspberrypi.com> drivers: pisp_be: Various updates and cleanups - Switch to a single node group for now. - Add a node description table to simplify node handling. - Switch HoG output to V4L2_CAP_META_CAPTURE type. - Use string descriptions for node names in logging messages. Signed-off-by: Naushir Patuck <naush@raspberrypi.com> pisp_be: Updates for libcamera usage: - Remove indexes from device entity names - Add enumframesize and enumfmts ioctls - Add default format to all nodes. Signed-off-by: Naushir Patuck <naush@raspberrypi.com> v4l2: pisp_be: Move format definitions into v4l2 core Signed-off-by: Naushir Patuck <naush@raspberrypi.com> media: raspberrypi: Move PiSP common headers to a single location Signed-off-by: Naushir Patuck <naush@raspberrypi.com> media: raspberrypi: Remove old pispbe driver. This is now supersede by the driver in drivers/media/platform/raspberrypi/ Signed-off-by: Naushir Patuck <naush@raspberrypi.com> PISP-BE Driver: Automate buffer-cycling for TDN and Stitch state. Remove "tdn-input" and "stitch-input" nodes altogether (the output nodes must still be opened and REQBUFS called with 1 or 2 buffers). Also, a bit of tidying of buffer address handling and locking. PISP-BE driver: Turn debug level right down to reduce overly-chatty messages media: bcm2712: Depend on CONFIG_PM Depend on CONFIG_PM as the driver uses the runtime_pm infrastructure. Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> drivers: media: pisp_be: Move BE driver to a raspberrypi directory Move the pisp_be driver from drivers/media/platform/raspberrypi/ to drivers/media/platform/raspberrypi/pisp_be/. This seems the accepted convention in the drivers/media/platform/ directory structure. Also rename the driver module from bcm2712_pisp_be to pisp_be. Signed-off-by: Naushir Patuck <naush@raspberrypi.com> pisp_be: Updates for libcamera streaming: - Add some required v4l2 formats - Add buf_prepare ioctl - Set plane offsets correctly before reprogramming pisp_be: Reduce logging verbosity Signed-off-by: Naushir Patuck <naush@raspberrypi.com> pisp_be: Add buffer timestamps While at it, remove duplicate code when checking if the HW has completed multiple jobs. Signed-off-by: Naushir Patuck <naush@raspberrypi.com> pisp_be: Remove queue size allocation constraint PISP-BE driver: Fix ISR to handle multiple done/start events. PISP-BE: Fix variable-name shadowing bugette PISP-BE: Support for two node groups. Reorganize the driver. To support 2 concurrent libcamera applications, we need 2 node groups, need to allow multiple opens of each node (because libcamera does this) and create a separate media device per group (to support file-locking). This triggered significant rearrangement of the driver. Some calls that we formerly intercepted have been delegated back to v4l2/vb2. Logging changes arising from multiple v4l2_dev. Refactored probe() and initialization. Avoid dynamically-allocated entity name strings. drivers: media: pisp_be: Add vidioc_enum_fmt_meta_out This was missing in the struct v4l2_ioctl_ops definition. Signed-off-by: Naushir Patuck <naush@raspberrypi.com> drivers: media: pispe_be: Add Bayer compressed formats Add PiSP Bayer compressed formats to the list of supported pixel formats for the PiSP backend driver. Signed-off-by: Naushir Patuck <naush@raspberrypi.com> drivers: meida: pisp_be: Fix overflow in plane size calculations The calculations for buffer plane sizes can overflow because of the plane factor shift. Fix this by using u64 integers for the calculations. Signed-off-by: Naushir Patuck <naush@raspberrypi.com> drivers: media: pisp_be: Use 0P3 for plane factors Use less precision for the plane factors to avoid any nasty overflows. Signed-off-by: Naushir Patuck <naush@raspberrypi.com> media: pisp: Checkpatch and coding style fixups Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> media: pisp_be: More coding style fixups media: platform: bcm2712: pisp_be: Fix crash when buffer format not set Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com> media: platform: bcm2712: pisp_be: Allow non-SRGB colour spaces on RGB outputs Allow colour spaces other than SRGB when the output format in question is an RGB output. This commit merely ports over existing changes from the vc4 ISP driver. Signed-off-by: David Plowman <david.plowman@raspberrypi.com> media: platform: bcm2712: Tweak list of BE supported image formats Remove RGB565 and 10- and 12-bit packed raw formats, which ISP-BE can't support for input or output. Add NV12M and NV21M which it can. (I didn't bother adding YUV422P, which apparently is not widely used.) Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com> pisp_be: Fill the hardware revision in the media entity struct This can be used by userland to determine the hardware capabilities. Signed-off-by: Naushir Patuck <naush@raspberrypi.com> bcm2712: Use BIT() macro Use the BIT() macro instead of plain bit shifting. Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> bcm2712: Invert condition in pispbe_schedule_internal() Return earlier and save one indentation level Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> bcm2712: Invert condition in for loop Save one indentation level by continuing if the node is not streaming. Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> bcm2712: Do not declare a local variable There already is a truct pispbe_node *node in the function scope. Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> bcm21712: Siplify pispbe_schedule_one() A little more verbose but easier to follow ? Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> bcm2712: Rename pispbe_schedule_all() to pispbe_schedule_any() The pispbe_schedule_all() function name is misleading, as the function schedule a single job from any of the node groups. Rename it. Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> media: platform: bcm2712: Remove buffer auto-cycling from ISP-BE Previously, the ISP-BE driver tried to automate "ping pong" buffers for TDN and HDR state, but did not fully conceal them from users. The automation has been removed: there are now separate output and capture queues for each of TDN and Stitch, which must be managed by user code (DMABUFs may be used to circulate buffers between queues). Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com> drivers: media: pisp_be: Cache BE config buffer vaddr When programming a new job, we access at the config buffer, possibly from ISR context. So fetch and the virtual address when queuing the buffer. Signed-off-by: Naushir Patuck <naush@raspberrypi.com> drivers: media: pisp_be: Remove all traces of ctrls and request API These APIs are not (and will not) be used by the driver, so remove them. Signed-off-by: Naushir Patuck <naush@raspberrypi.com> media: bcm2712: Replace v4l2_dbg with dev_dbg Replace the v4l2 debug helpers with the device debug once, which are preferred. Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> media: bcm2712: Remove of_match_ptr() The of_match_ptr() usage could cause a compiler warning if CONFIG_OF is not enabled, as the pispbe_of_match variable would result unused. As the of_match_table field of struct platform_driver exists unconditionally, drop of_match_ptr() to avoid a warning. Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> drivers: media: pispbe: Add local config buffer DMA allocation When initialiasing the driver, allocate a number of tiles + config structures used for storing hardware config internally in the driver. Signed-off-by: Naushir Patuck <naush@raspberrypi.com> drivers: media: pispbe: Use local config buffers Store a copy of the config + tiles buffer locally when the buffer gets queued. This resolves the security issue where a userland process may modify the config buffer after it has been queued. Signed-off-by: Naushir Patuck <naush@raspberrypi.com> drivers: media: pispbe: Validate config buffers Perform a basic config validation on the device output nodes to ensure the buffer size and stride values do not result in a buffer overrun. Signed-off-by: Naushir Patuck <naush@raspberrypi.com> media: bcm2712: Rework probe sequence order Rework the probe sequence to: 1) Use dev_err_probe() when failing to get clocks 2) Disable clock on error path 3) Disable the node groups if they have been enabled and propagate the error up Also disable clocks in the remove() function. Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> media: bcm2712: Use pm_runtime_ops Introduce usage of runtime resume and suspend operations. The diver only uses a single clock source which is enable/disabled at resume and suspend time. Implement file open and release operations to control enablement of the clock provider. Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> media: bcm2712: Demote info message Demote info message about clock enablement to dev_dbg() Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> media: bcm2712: Move pm_runtime calls to streamon/streamoff Move the calls to pm_runtime_resume_and_get() and pm_runtime_put() to the streamon and streamoff ioctl handlers. Remove custom handlers for the open and close file operations and use the framework provided helpers. Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> media: bcm2712: Use pm_runtime_autosuspend() Use the _autosuspend() version of runtime_pm_put() in order to avoid resuming and suspending the peripheral in between streaming sessions closely apart one from the other. Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> drivers: media: pisp_be: Conditionally check buffers when preparing jobs When preparing a job, check the global enables in the config structure to see if the Output0/1, Tdn and Stitch blocks are enabled, and only test for a buffer queued if they are. This will allow userland to control the outputs selectively without disabling/re-enabling the respective device nodes. Signed-off-by: Naushir Patuck <naush@raspberrypi.com> media: bcm2712: Rework media controller registration The current implementation register the v4l2_device and the video devices first, then creates the media controller and manually registers entities there. Rework the registration procedure to first create the v4l2_device and register the media_device with it. Then create the video nodes which gets automatically registered in the media graph by the core. Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> media: bcm2712: Create v4l2_subdev for ISP entity Create a v4l2 subdevice to represent the PISPBE ISP entity. Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> media: bcm2712: Fix v4l2-compliance warn on QUERYCAP Fix: warn: v4l2-compliance.cpp(669): media bus_info 'platform:1000880000.pisp_be' differs from V4L2 bus_info 'platform:pispbe' by populating the driver caps bus_info by using dev_name(). Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> media: bcm2712: Fix v4l2-compliance warn on invalid pixfmt The V4L2 API for the TRY_FMT/S_FMT ioctl allows the ioctl handler to return an error code only in specific conditions. If an invalid pixel format is supplied it should be adjusted instead of an error being returned. Albeit, v4l2-compliance treats this situation as a warning and not as an error because the behaviour has been discussed in length in the past. warn: v4l2-test-formats.cpp(794): TRY_FMT cannot handle an invalid pixelformat. warn: v4l2-test-formats.cpp(795): This may or may not be a problem. For more information see: warn: v4l2-test-formats.cpp(796): http://www.mail-archive.com/linux-media@vger.kernel.org/msg56550.html VIDIOC_TRY_FMT returned -1 (Invalid argument) Regardless of the warning vs failure decision, adjust the try_format() function implementation to use V4L2_PIX_FMT_YUV420M as default pixel format if the supplied one is invalid. Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> media: bcm2712: Fix v4l2-compliance warn on HOG pix format The try_format() implementation for the HOG video device node returns an error if the supplied pixel format is not correct. As per the video device output and capture video nodes, this contradicts the V4L2 specification even if it is treated as a warning by v4l2-compliance. Fix this by forcing the buffer pixel format and size to the default supported one. While at here, use the BIT() macro in the format initialization function. Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> media: bcm2712: Fix formats enumeration Right now a single implementation of enum_fmt() is used for all nodes in a group. This means that all the BE supported formats are listed for all the nodes. This is incorrect as the meta capture and output node formats should be restricted, and the meta formats should not be enumerated for video output and capture devices. Fix this by restricting the enumeration of META formats to the config and hog nodes. Split out from the list of supported_formats the V4L2_META_FMT_RPI_BE_CFG which is only used for the meta_out node, while V4L2_PIX_FMT_RPI_BE is kept in the list of supported_formats as it can be used as an opaque format for both meta_cap, video_cap and video_out nodes. Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> media: bcm2712: Minor fixes to support PiSP regression tests Allow RGB input, not just Bayer (but only of those at once); Allow Wallpaper image formats. XXX They are not yet size-checked; Set "chicken bits" to test BURST_TRIM and AXI AWID/BID variation. Convert some v4l2_err() to dev_err() Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com> drivers: media: pisp_be: Use the maximum number of config buffers Set PISP_BE_NUM_CONFIG_BUFFERS the the maximum number of possible buffers. In the worst case, this overallocates config buffers, but given their size, it's not too much of a problem. Signed-off-by: Naushir Patuck <naush@raspberrypi.com> media: pisp_be: Fix extra PM runtime put vidioc_streamoff callback can be called even if vidioc_streamon was never called. The driver currently does PM runtime get/put in these callbacks, which may lead to a put without a matching get. Fix this by moving the PM runtime get/put to vb2_ops's start_streaming & stop_streaming, which the framework makes sure won't get extra calls. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> drivers: media: pisp_be: Don't report V4L2_PIX_FMT_RPI_BE format This is an internal opaque format, not to be reported in enum_fmt. Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
-
Phil Elwell authored
sdhci: remove PYA0_INTR_BUG quirk. Add quirks to disable some of the higher SDR speeds at 1.8v.
-
Ulf Hansson authored
BCM2712 has an SD Express capable SDHCI implementation and uses the SDIO CFG register block present on other STB chips. Add plumbing for SD Express handover and BCM2712-specific functions. Due to the common bus infrastructure between BCM2711 and BCM2712, the driver also needs to implement 32-bit IO accessors. mmc: brcmstb: override card presence if broken-cd is set Not just if the card is declared as nonremovable. sdhci: brcmstb: align SD express switchover with SD spec v8.00 Part 1 of the Physical specification, figure 3-24, details the switch sequence for cards initially probed as SD. Add a missing check for DAT2 level after switching VDD2 on. sdhci: brcmstb: clean up SD Express probe and error handling Refactor to avoid spurious error messages in dmesg if the requisite SD Express DT nodes aren't present. Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com> mmc: sdhci-brcmstb: only use the delay line PHY for tuneable speeds The MMC core has a 200MHz core clock which allows the use of DDR50 and below without incremental phase tuning. SDR50/SDR104 and the EMMC HS200 speeds require tuning. Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
-
Dom Cobley authored
-
Phil Elwell authored
pinctrl: bcm2712: Reject invalid pulls Reject attempts to set pulls on aon-sgpios, and fix pull shift values. pinctrl: bcm2712: Add 7712 support, fix 2712 count Signed-off-by: Phil Elwell <phil@raspberrypi.com> pinctrl-bcm2712: add EMMC pins so pulls can be set These pins have pad controls but not mux controls. They look enough like GPIOs to squeeze in at the end of the list though. pinctrl: bcm2712: correct BCM2712C0 AON_GPIO pad pull control offset Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com> pinctrl: bcm2712: on C0 the regular GPIO pad control register moves too Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com> pinctrl: bcm2712: Implement (partially) pinconf_get Signed-off-by: Phil Elwell <phil@raspberrypi.com> pinctrl: bcm2712: Convert to generic pinconf Remove the legacy brcm,* pin configuration support and replace it with a proper generic pinconf interface, using named functions instead of alt function numbers. This is nicer for users, less error-prone, and immune to some of the C0->D0 changes. Signed-off-by: Phil Elwell <phil@raspberrypi.com> pinctrl: bcm2712: Remove vestigial pull parameter Now the legacy brcm, pinconf parameters are no longer supported, this custom pin config parameter is not needed. Signed-off-by: Phil Elwell <phil@raspberrypi.com> pinctrl: bcm2712: Guard against bad func numbers Signed-off-by: Phil Elwell <phil@raspberrypi.com> pinctrl: bcm2712: A better attempt at D0 support The BCM2712D0 sparse pinctrl maps play havoc with the old GPIO_REGS macro, so make the bit positions explicit. And delete the unwanted GPIO and pinmux declarations on D0. Note that a Pi 5 with D0 requires a separate DTS file with "bcm2712d0" compatible strings. Signed-off-by: Phil Elwell <phil@raspberrypi.com> pinctrl: bcm2712: Delete base register constants BCM2712D0 deletes many GPIOs and their associated mux and pad bits, so much so that the offsets to the start of the pad control registers changes. Remove the constant offsets from the *GPIO_REGS macros, compensating by adjusting the per-GPIO values. Signed-off-by: Phil Elwell <phil@raspberrypi.com>
-
Phil Elwell authored
-
Dom Cobley authored
gpio-brcmstb: Report the correct bank width gpio: brcmstb: Use bank address as gpiochip label If the path to the device node is used as gpiochip label then gpio-brcmstb instances with multiple banks end up with duplicated names. Instead, use a combination of the driver name with the physical address of the bank, which is both unique and helpful for devmem debugging. Signed-off-by: Phil Elwell <phil@raspberrypi.com> gpio: mmio: Add DIRECT mode for shared access The generic MMIO GPIO library uses shadow registers for efficiency, but this breaks attempts by raspi-gpio to change other GPIOs in the same bank. Add a DIRECT mode that makes fewer assumptions about the existing register contents, but note that genuinely simultaneous accesses are likely to lose updates. Signed-off-by: Phil Elwell <phil@raspberrypi.com> gpio: brcmstb: Don't always clear interrupt mask If the GPIO controller is not being used as an interrupt source leave the interrupt mask register alone. On BCM2712 it might be used to generate interrupts to the VPU firmware, and on other devices it doesn't matter since no interrupts will be generated. Signed-off-by: Phil Elwell <phil@raspberrypi.com>
-
popcornmix authored
-
Dom Cobley authored
dtoverlays: Fix up edt5406 entries to match with vc4-kms-dsi-7inch vc4-kms-dsi-7inch expects the touch fragment to be named ts_i2c_frag, but edt5406 didn't do this. Fixes: 736d601fb38c ("dts: 2712: Update for device tree") Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
-
Dom Cobley authored
-
Dom Cobley authored
This reverts commit c0ea202f.
-
- Sep 23, 2023
-
-
Phil Elwell authored
The HAT map is way of associating named overlays with HATs whose EEPROMs were programmed with the contents of the overlay. Unfortunately, change in the DT and kernel drivers has meant that some of these embedded overlays no longer function, or even don't apply. The HAT map is a mapping from HAT UUIDs to overlay names. If a HAT with a listed UUID is detected, the embedded overlay is ignored and the overlay named in the mapping is loaded in its place. Signed-off-by: Phil Elwell <phil@raspberrypi.com>
-
- Sep 20, 2023
-
-
Dom Cobley authored
This reverts commit 2bcf744d.
-
- Sep 19, 2023
-
-
Dom Cobley authored
-
Dom Cobley authored
Hardware that fails to read the edid is quite common. The kernel provides a mechanism to use one a of a few pre-built generic edid files for getting a basic video mode. However there is no easy was to add basic audio support, which requires a CTA extension block to report capabilities. Add an module option to request this. Signed-off-by: Dom Cobley <popcornmix@gmail.com>
-
Greg Kroah-Hartman authored
Link: https://lore.kernel.org/r/20230917191040.964416434@linuxfoundation.org Tested-by: SeongJae Park <sj@kernel.org> Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com> Tested-by: Bagas Sanjaya <bagasdotme@gmail.com> Tested-by: Conor Dooley <conor.dooley@microchip.com> Tested-by: Ron Economos <re@w6rz.net> Tested-by: Jon Hunter <jonathanh@nvidia.com> Tested-by: Salvatore Bonaccorso <carnil@debian.org> Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> Tested-by: Guenter Roeck <linux@roeck-us.net> Tested-by: Linux Kernel Functional Testing <lkft@linaro.org> Tested-by: Shuah Khan <skhan@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Wesley Chalmers authored
commit 3d028d5d upstream. [WHY] Currently, when insert_plane is called with insert_above_mpcc parameter that is equal to tree->opp_list, the function returns NULL. [HOW] Instead, the function should insert the plane at the top of the tree. Cc: Mario Limonciello <mario.limonciello@amd.com> Cc: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org Reviewed-by: Jun Lei <jun.lei@amd.com> Acked-by: Tom Chung <chiahsuan.chung@amd.com> Signed-off-by: Wesley Chalmers <wesley.chalmers@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Maciej W. Rozycki authored
commit 4fe4a637 upstream. We have originally guarded fiddling with CHECKFLAGS in our arch Makefile by checking for the CONFIG_MIPS variable, not set for targets such as `distclean', etc. that neither include `.config' nor use the compiler. Starting from commit 805b2e1d ("kbuild: include Makefile.compiler only when compiler is needed") we have had a generic `need-compiler' variable explicitly telling us if the compiler will be used and thus its capabilities need to be checked and expressed in the form of compilation flags. If this variable is not set, then `make' functions such as `cc-option' are undefined, causing all kinds of weirdness to happen if we expect specific results to be returned, most recently: cc1: error: '-mloongson-mmi' must be used with '-mhard-float' messages with configurations such as `fuloong2e_defconfig' and the `modules_install' target, which does include `.config' and yet does not use the compiler. Replace the check for CONFIG_MIPS with one for `need-compiler' instead, so as to prevent the compiler from being ever called for CHECKFLAGS when not needed. Reported-by: Guillaume Tucker <guillaume.tucker@collabora.com> Closes: https://lore.kernel.org/r/85031c0c-d981-031e-8a50-bc4fad2ddcd8@collabora.com/ Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk> Fixes: 805b2e1d ("kbuild: include Makefile.compiler only when compiler is needed") Cc: stable@vger.kernel.org # v5.13+ Reported-by: "kernelci.org bot" <bot@kernelci.org> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Kuniyuki Iwashima authored
[ Upstream commit a22730b1 ] syzkaller found a memory leak in kcm_sendmsg(), and commit c821a88b ("kcm: Fix memory leak in error path of kcm_sendmsg()") suppressed it by updating kcm_tx_msg(head)->last_skb if partial data is copied so that the following sendmsg() will resume from the skb. However, we cannot know how many bytes were copied when we get the error. Thus, we could mess up the MSG_MORE queue. When kcm_sendmsg() fails for SOCK_DGRAM, we should purge the queue as we do so for UDP by udp_flush_pending_frames(). Even without this change, when the error occurred, the following sendmsg() resumed from a wrong skb and the queue was messed up. However, we have yet to get such a report, and only syzkaller stumbled on it. So, this can be changed safely. Note this does not change SOCK_SEQPACKET behaviour. Fixes: c821a88b ("kcm: Fix memory leak in error path of kcm_sendmsg()") Fixes: ab7ac4eb ("kcm: Kernel Connection Multiplexor module") Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://lore.kernel.org/r/20230912022753.33327-1-kuniyu@amazon.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
-
Vadim Fedorenko authored
[ Upstream commit 3c44191d ] The commit in fixes introduced flags to control the status of hardware configuration while processing packets. At the same time another structure is used to provide configuration of timestamper to user-space applications. The way it was coded makes this structures go out of sync easily. The repro is easy for 82599 chips: [root@hostname ~]# hwstamp_ctl -i eth0 -r 12 -t 1 current settings: tx_type 0 rx_filter 0 new settings: tx_type 1 rx_filter 12 The eth0 device is properly configured to timestamp any PTPv2 events. [root@hostname ~]# hwstamp_ctl -i eth0 -r 1 -t 1 current settings: tx_type 1 rx_filter 12 SIOCSHWTSTAMP failed: Numerical result out of range The requested time stamping mode is not supported by the hardware. The error is properly returned because HW doesn't support all packets timestamping. But the adapter->flags is cleared of timestamp flags even though no HW configuration was done. From that point no RX timestamps are received by user-space application. But configuration shows good values: [root@hostname ~]# hwstamp_ctl -i eth0 current settings: tx_type 1 rx_filter 12 Fix the issue by applying new flags only when the HW was actually configured. Fixes: a9763f3c ("ixgbe: Update PTP to support X550EM_x devices") Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Reviewed-by: Simon Horman <horms@kernel.org> Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>
-
Kuniyuki Iwashima authored
[ Upstream commit c48ef9c4 ] Since bhash2 was introduced, the example below does not work as expected. These two bind() should conflict, but the 2nd bind() now succeeds. from socket import * s1 = socket(AF_INET6, SOCK_STREAM) s1.bind(('::ffff:127.0.0.1', 0)) s2 = socket(AF_INET, SOCK_STREAM) s2.bind(('127.0.0.1', s1.getsockname()[1])) During the 2nd bind() in inet_csk_get_port(), inet_bind2_bucket_find() fails to find the 1st socket's tb2, so inet_bind2_bucket_create() allocates a new tb2 for the 2nd socket. Then, we call inet_csk_bind_conflict() that checks conflicts in the new tb2 by inet_bhash2_conflict(). However, the new tb2 does not include the 1st socket, thus the bind() finally succeeds. In this case, inet_bind2_bucket_match() must check if AF_INET6 tb2 has the conflicting v4-mapped-v6 address so that inet_bind2_bucket_find() returns the 1st socket's tb2. Note that if we bind two sockets to 127.0.0.1 and then ::FFFF:127.0.0.1, the 2nd bind() fails properly for the same reason mentinoed in the previous commit. Fixes: 28044fc1 ("net: Add a bhash2 table hashed by port and address") Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Acked-by: Andrei Vagin <avagin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>
-
Kuniyuki Iwashima authored
[ Upstream commit aa99e5f8 ] Andrei Vagin reported bind() regression with strace logs. If we bind() a TCPv6 socket to ::FFFF:0.0.0.0 and then bind() a TCPv4 socket to 127.0.0.1, the 2nd bind() should fail but now succeeds. from socket import * s1 = socket(AF_INET6, SOCK_STREAM) s1.bind(('::ffff:0.0.0.0', 0)) s2 = socket(AF_INET, SOCK_STREAM) s2.bind(('127.0.0.1', s1.getsockname()[1])) During the 2nd bind(), if tb->family is AF_INET6 and sk->sk_family is AF_INET in inet_bind2_bucket_match_addr_any(), we still need to check if tb has the v4-mapped-v6 wildcard address. The example above does not work after commit 5456262d ("net: Fix incorrect address comparison when searching for a bind2 bucket"), but the blamed change is not the commit. Before the commit, the leading zeros of ::FFFF:0.0.0.0 were treated as 0.0.0.0, and the sequence above worked by chance. Technically, this case has been broken since bhash2 was introduced. Note that if we bind() two sockets to 127.0.0.1 and then ::FFFF:0.0.0.0, the 2nd bind() fails properly because we fall back to using bhash to detect conflicts for the v4-mapped-v6 address. Fixes: 28044fc1 ("net: Add a bhash2 table hashed by port and address") Reported-by: Andrei Vagin <avagin@google.com> Closes: https://lore.kernel.org/netdev/ZPuYBOFC8zsK6r9T@google.com/ Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>
-
Kuniyuki Iwashima authored
[ Upstream commit c6d27706 ] This is a prep patch to make the following patches cleaner that touch inet_bind2_bucket_match() and inet_bind2_bucket_match_addr_any(). Both functions have duplicated comparison for netns, port, and l3mdev. Let's factorise them. Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Stable-dep-of: aa99e5f8 ("tcp: Fix bind() regression for v4-mapped-v6 wildcard address.") Signed-off-by: Sasha Levin <sashal@kernel.org>
-
Kuniyuki Iwashima authored
[ Upstream commit 8cdc3223 ] Some code defines the IPv6 wildcard address as a local variable and use it with memcmp() or ipv6_addr_equal(). Let's use in6addr_any and ipv6_addr_any() instead. Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Reviewed-by: David Ahern <dsahern@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net> Stable-dep-of: aa99e5f8 ("tcp: Fix bind() regression for v4-mapped-v6 wildcard address.") Signed-off-by: Sasha Levin <sashal@kernel.org>
-
Eric Dumazet authored
[ Upstream commit 8cdd9f1a ] ip6_sock_set_addr_preferences() second argument should be an integer. SUNRPC attempts to set IPV6_PREFER_SRC_PUBLIC were translated to IPV6_PREFER_SRC_TMP Fixes: 18d5ad62 ("ipv6: add ip6_sock_set_addr_preferences") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Chuck Lever <chuck.lever@oracle.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://lore.kernel.org/r/20230911154213.713941-1-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
-
Sascha Hauer authored
[ Upstream commit 403f0e77 ] macb_set_tx_clk() is called under a spinlock but itself calls clk_set_rate() which can sleep. This results in: | BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580 | pps pps1: new PPS source ptp1 | in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 40, name: kworker/u4:3 | preempt_count: 1, expected: 0 | RCU nest depth: 0, expected: 0 | 4 locks held by kworker/u4:3/40: | #0: ffff000003409148 | macb ff0c0000.ethernet: gem-ptp-timer ptp clock registered. | ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x14c/0x51c | #1: ffff8000833cbdd8 ((work_completion)(&pl->resolve)){+.+.}-{0:0}, at: process_one_work+0x14c/0x51c | #2: ffff000004f01578 (&pl->state_mutex){+.+.}-{4:4}, at: phylink_resolve+0x44/0x4e8 | #3: ffff000004f06f50 (&bp->lock){....}-{3:3}, at: macb_mac_link_up+0x40/0x2ac | irq event stamp: 113998 | hardirqs last enabled at (113997): [<ffff800080e8503c>] _raw_spin_unlock_irq+0x30/0x64 | hardirqs last disabled at (113998): [<ffff800080e84478>] _raw_spin_lock_irqsave+0xac/0xc8 | softirqs last enabled at (113608): [<ffff800080010630>] __do_softirq+0x430/0x4e4 | softirqs last disabled at (113597): [<ffff80008001614c>] ____do_softirq+0x10/0x1c | CPU: 0 PID: 40 Comm: kworker/u4:3 Not tainted 6.5.0-11717-g9355ce8b2f50-dirty #368 | Hardware name: ... ZynqMP ... (DT) | Workqueue: events_power_efficient phylink_resolve | Call trace: | dump_backtrace+0x98/0xf0 | show_stack+0x18/0x24 | dump_stack_lvl+0x60/0xac | dump_stack+0x18/0x24 | __might_resched+0x144/0x24c | __might_sleep+0x48/0x98 | __mutex_lock+0x58/0x7b0 | mutex_lock_nested+0x24/0x30 | clk_prepare_lock+0x4c/0xa8 | clk_set_rate+0x24/0x8c | macb_mac_link_up+0x25c/0x2ac | phylink_resolve+0x178/0x4e8 | process_one_work+0x1ec/0x51c | worker_thread+0x1ec/0x3e4 | kthread+0x120/0x124 | ret_from_fork+0x10/0x20 The obvious fix is to move the call to macb_set_tx_clk() out of the protected area. This seems safe as rx and tx are both disabled anyway at this point. It is however not entirely clear what the spinlock shall protect. It could be the read-modify-write access to the NCFGR register, but this is accessed in macb_set_rx_mode() and macb_set_rxcsum_feature() as well without holding the spinlock. It could also be the register accesses done in mog_init_rings() or macb_init_buffers(), but again these functions are called without holding the spinlock in macb_hresp_error_task(). The locking seems fishy in this driver and it might deserve another look before this patch is applied. Fixes: 633e98a7 ("net: macb: use resolved link config in mac_link_up()") Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Link: https://lore.kernel.org/r/20230908112913.1701766-1-s.hauer@pengutronix.de Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
-
Harini Katakam authored
[ Upstream commit ee4e92c2 ] Enable transmission and reception of PTP unicast packets by updating PTP unicast config bit and setting current HW mac address as allowed address in PTP unicast filter registers. Signed-off-by: Harini Katakam <harini.katakam@xilinx.com> Signed-off-by: Michal Simek <michal.simek@xilinx.com> Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Stable-dep-of: 403f0e77 ("net: macb: fix sleep inside spinlock") Signed-off-by: Sasha Levin <sashal@kernel.org>
-
Liu Jian authored
[ Upstream commit cfaa80c9 ] I got the below warning when do fuzzing test: BUG: KASAN: null-ptr-deref in scatterwalk_copychunks+0x320/0x470 Read of size 4 at addr 0000000000000008 by task kworker/u8:1/9 CPU: 0 PID: 9 Comm: kworker/u8:1 Tainted: G OE Hardware name: linux,dummy-virt (DT) Workqueue: pencrypt_parallel padata_parallel_worker Call trace: dump_backtrace+0x0/0x420 show_stack+0x34/0x44 dump_stack+0x1d0/0x248 __kasan_report+0x138/0x140 kasan_report+0x44/0x6c __asan_load4+0x94/0xd0 scatterwalk_copychunks+0x320/0x470 skcipher_next_slow+0x14c/0x290 skcipher_walk_next+0x2fc/0x480 skcipher_walk_first+0x9c/0x110 skcipher_walk_aead_common+0x380/0x440 skcipher_walk_aead_encrypt+0x54/0x70 ccm_encrypt+0x13c/0x4d0 crypto_aead_encrypt+0x7c/0xfc pcrypt_aead_enc+0x28/0x84 padata_parallel_worker+0xd0/0x2dc process_one_work+0x49c/0xbdc worker_thread+0x124/0x880 kthread+0x210/0x260 ret_from_fork+0x10/0x18 This is because the value of rec_seq of tls_crypto_info configured by the user program is too large, for example, 0xffffffffffffff. In addition, TLS is asynchronously accelerated. When tls_do_encryption() returns -EINPROGRESS and sk->sk_err is set to EBADMSG due to rec_seq overflow, skmsg is released before the asynchronous encryption process ends. As a result, the UAF problem occurs during the asynchronous processing of the encryption module. If the operation is asynchronous and the encryption module returns EINPROGRESS, do not free the record information. Fixes: 635d9398 ("net/tls: free record only on encryption error") Signed-off-by: Liu Jian <liujian56@huawei.com> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Link: https://lore.kernel.org/r/20230909081434.2324940-1-liujian56@huawei.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
-
Geert Uytterhoeven authored
[ Upstream commit 0a138f16 ] The only probing method supported by the Nvidia SN2201 platform driver is probing through an ACPI match table. Hence add a dependency on ACPI, to prevent asking the user about this driver when configuring a kernel without ACPI support. Fixes: 662f2482 ("platform/mellanox: Add support for new SN2201 system") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Acked-by: Vadim Pasternak <vadimp@nvidia.com> Acked-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/ec5a4071691ab08d58771b7732a9988e89779268.1693828363.git.geert+renesas@glider.be Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
-
Shravan Kumar Ramani authored
[ Upstream commit 0f596945 ] This fix involves 2 changes: - All event regs have a reset value of 0, which is not a valid event_number as per the event_list for most blocks and hence seen as an error. Add a "disable" event with event_number 0 for all blocks. - The enable bit for each counter need not be checked before reading the event info, and hence removed. Fixes: 1a218d31 ("platform/mellanox: mlxbf-pmc: Add Mellanox BlueField PMC driver") Signed-off-by: Shravan Kumar Ramani <shravankr@nvidia.com> Reviewed-by: Vadim Pasternak <vadimp@nvidia.com> Reviewed-by: David Thompson <davthompson@nvidia.com> Link: https://lore.kernel.org/r/04d0213932d32681de1c716b54320ed894e52425.1693917738.git.shravankr@nvidia.com Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
-
Shravan Kumar Ramani authored
[ Upstream commit 80ccd405 ] Replace sprintf with sysfs_emit where possible. Size check in mlxbf_pmc_event_list_show should account for "\0". Fixes: 1a218d31 ("platform/mellanox: mlxbf-pmc: Add Mellanox BlueField PMC driver") Signed-off-by: Shravan Kumar Ramani <shravankr@nvidia.com> Reviewed-by: Vadim Pasternak <vadimp@nvidia.com> Reviewed-by: David Thompson <davthompson@nvidia.com> Link: https://lore.kernel.org/r/bef39ef32319a31b32f999065911f61b0d3b17c3.1693917738.git.shravankr@nvidia.com Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
-
Liming Sun authored
[ Upstream commit fc4c6558 ] This commit drops over-sized network packets to avoid tmfifo queue stuck. Fixes: 1357dfd7 ("platform/mellanox: Add TmFifo driver for Mellanox BlueField Soc") Signed-off-by: Liming Sun <limings@nvidia.com> Reviewed-by: Vadim Pasternak <vadimp@nvidia.com> Reviewed-by: David Thompson <davthompson@nvidia.com> Link: https://lore.kernel.org/r/9318936c2447f76db475c985ca6d91f057efcd41.1693322547.git.limings@nvidia.com Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
-
Liming Sun authored
[ Upstream commit 78034cbe ] This commit fixes tmfifo console stuck issue when the virtual networking interface is in down state. In such case, the network Rx descriptors runs out and causes the Rx network packet staying in the head of the tmfifo thus blocking the console packets. The fix is to drop the Rx network packet when no more Rx descriptors. Function name mlxbf_tmfifo_release_pending_pkt() is also renamed to mlxbf_tmfifo_release_pkt() to be more approperiate. Fixes: 1357dfd7 ("platform/mellanox: Add TmFifo driver for Mellanox BlueField Soc") Signed-off-by: Liming Sun <limings@nvidia.com> Reviewed-by: Vadim Pasternak <vadimp@nvidia.com> Reviewed-by: David Thompson <davthompson@nvidia.com> Link: https://lore.kernel.org/r/8c0177dc938ae03f52ff7e0b62dbeee74b7bec09.1693322547.git.limings@nvidia.com Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
-
Shigeru Yoshida authored
[ Upstream commit c821a88b ] syzbot reported a memory leak like below: BUG: memory leak unreferenced object 0xffff88810b088c00 (size 240): comm "syz-executor186", pid 5012, jiffies 4294943306 (age 13.680s) hex dump (first 32 bytes): 00 89 08 0b 81 88 ff ff 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff83e5d5ff>] __alloc_skb+0x1ef/0x230 net/core/skbuff.c:634 [<ffffffff84606e59>] alloc_skb include/linux/skbuff.h:1289 [inline] [<ffffffff84606e59>] kcm_sendmsg+0x269/0x1050 net/kcm/kcmsock.c:815 [<ffffffff83e479c6>] sock_sendmsg_nosec net/socket.c:725 [inline] [<ffffffff83e479c6>] sock_sendmsg+0x56/0xb0 net/socket.c:748 [<ffffffff83e47f55>] ____sys_sendmsg+0x365/0x470 net/socket.c:2494 [<ffffffff83e4c389>] ___sys_sendmsg+0xc9/0x130 net/socket.c:2548 [<ffffffff83e4c536>] __sys_sendmsg+0xa6/0x120 net/socket.c:2577 [<ffffffff84ad7bb8>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff84ad7bb8>] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd In kcm_sendmsg(), kcm_tx_msg(head)->last_skb is used as a cursor to append newly allocated skbs to 'head'. If some bytes are copied, an error occurred, and jumped to out_error label, 'last_skb' is left unmodified. A later kcm_sendmsg() will use an obsoleted 'last_skb' reference, corrupting the 'head' frag_list and causing the leak. This patch fixes this issue by properly updating the last allocated skb in 'last_skb'. Fixes: ab7ac4eb ("kcm: Kernel Connection Multiplexor module") Reported-and-tested-by: <syzbot+6f98de741f7dbbfc4ccb@syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=6f98de741f7dbbfc4ccb Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>
-
Hayes Wang authored
[ Upstream commit a7b8d60b ] According to the document of napi, there is no rx process when the budget is 0. Therefore, r8152_poll() has to return 0 directly when the budget is equal to 0. Fixes: d2187f8e ("r8152: divide the tx and rx bottom functions") Signed-off-by: Hayes Wang <hayeswang@realtek.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>
-
Vladimir Oltean authored
[ Upstream commit 86899e9e ] Currently, when we add the first sja1105 port to a bridge with vlan_filtering 1, then we sometimes see this output: sja1105 spi2.2: port 4 failed to read back entry for be:79:b4:9e:9e:96 vid 3088: -ENOENT sja1105 spi2.2: Reset switch and programmed static config. Reason: VLAN filtering sja1105 spi2.2: port 0 failed to add be:79:b4:9e:9e:96 vid 0 to fdb: -2 It is because sja1105_fdb_add() runs from the dsa_owq which is no longer serialized with switch resets since it dropped the rtnl_lock() in the blamed commit. Either performing the FDB accesses before the reset, or after the reset, is equally fine, because sja1105_static_fdb_change() backs up those changes in the static config, but FDB access during reset isn't ok. Make sja1105_static_config_reload() take the fdb_lock to fix that. Fixes: 0faf890f ("net: dsa: drop rtnl_lock from dsa_slave_switchdev_event_work") Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>
-
Vladimir Oltean authored
[ Upstream commit ea32690d ] sja1105_fdb_add() runs from the dsa_owq, and sja1105_port_mcast_flood() runs from switchdev_deferred_process_work(). Prior to the blamed commit, they used to be indirectly serialized through the rtnl_lock(), which no longer holds true because dsa_owq dropped that. So, it is now possible that we traverse the static config BLK_IDX_L2_LOOKUP elements concurrently compared to when we change them, in sja1105_static_fdb_change(). That is not ideal, since it might result in data corruption. Introduce a mutex which serializes accesses to the hardware FDB and to the static config elements for the L2 Address Lookup table. I can't find a good reason to add locking around sja1105_fdb_dump(). I'll add it later if needed. Fixes: 0faf890f ("net: dsa: drop rtnl_lock from dsa_slave_switchdev_event_work") Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>
-
Vladimir Oltean authored
[ Upstream commit 7cef293b ] The commit cited in Fixes: did 2 things: it refactored the read-back polling from sja1105_dynamic_config_read() into a new function, sja1105_dynamic_config_wait_complete(), and it called that from sja1105_dynamic_config_write() too. What is problematic is the refactoring. The refactored code from sja1105_dynamic_config_poll_valid() works like the previous one, but the problem is that it uses another packed_buf[] SPI buffer, and there was code at the end of sja1105_dynamic_config_read() which was relying on the read-back packed_buf[]: /* Don't dereference possibly NULL pointer - maybe caller * only wanted to see whether the entry existed or not. */ if (entry) ops->entry_packing(packed_buf, entry, UNPACK); After the change, the packed_buf[] that this code sees is no longer the entry read back from hardware, but the original entry that the caller passed to the sja1105_dynamic_config_read(), packed into this buffer. This difference is the most notable with the SJA1105_SEARCH uses from sja1105pqrs_fdb_add() - used for both fdb and mdb. There, we have logic added by commit 728db843 ("net: dsa: sja1105: ignore the FDB entry for unknown multicast when adding a new address") to figure out whether the address we're trying to add matches on any existing hardware entry, with the exception of the catch-all multicast address. That logic was broken, because with sja1105_dynamic_config_read() not working properly, it doesn't return us the entry read back from hardware, but the entry that we passed to it. And, since for multicast, a match will always exist, it will tell us that any mdb entry already exists at index=0 L2 Address Lookup table. It is index=0 because the caller doesn't know the index - it wants to find it out, and sja1105_dynamic_config_read() does: if (index < 0) { // SJA1105_SEARCH /* Avoid copying a signed negative number to an u64 */ cmd.index = 0; // <- this cmd.search = true; } else { cmd.index = index; cmd.search = false; } So, to the caller of sja1105_dynamic_config_read(), the returned info looks entirely legit, and it will add all mdb entries to FDB index 0. There, they will always overwrite each other (not to mention, potentially they can also overwrite a pre-existing bridge fdb entry), and the user-visible impact will be that only the last mdb entry will be forwarded as it should. The others won't (will be flooded or dropped, depending on the egress flood settings). Fixing is a bit more complicated, and involves either passing the same packed_buf[] to sja1105_dynamic_config_wait_complete(), or moving all the extra processing on the packed_buf[] to sja1105_dynamic_config_wait_complete(). I've opted for the latter, because it makes sja1105_dynamic_config_wait_complete() a bit more self-contained. Fixes: df405910 ("net: dsa: sja1105: wait for dynamic config command completion on writes too") Reported-by: Yanan Yang <yanan.yang@nxp.com> Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>
-