summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2025-05-21wifi: mt76: Remove an unneeded local variable in mt76x02_dma_init()Christophe JAILLET1-1/+0
Remove 't' which is unneeded since commit f3950a414143 ("mt76: set txwi_size according to the driver value") This slightly simplifies the code. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Link: https://patch.msgid.link/e86d5602bdd8b6bd22258ee69536992f39470bf5.1744928865.git.christophe.jaillet@wanadoo.fr Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7996: prevent uninit return in mt7996_mac_sta_add_linksQasim Ijaz1-3/+9
If link_conf_dereference_protected() or mt7996_vif_link() or link_sta_dereference_protected() fail the code jumps to the error_unlink label and returns ret which is uninitialised. Fix this by setting err before jumping to error_unlink. Fixes: c7e4fc362443 ("wifi: mt76: mt7996: Update mt7996_mcu_add_sta to MLO support") Fixes: dd82a9e02c05 ("wifi: mt76: mt7996: Rely on mt7996_sta_link in sta_add/sta_remove callbacks") Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> Link: https://patch.msgid.link/20250421110550.9839-1-qasdev00@gmail.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21Revert "wifi: mt76: mt7996: fill txd by host driver"Shayne Chen1-4/+9
This reverts commit 3b522cadedfe6e9e0e8193d7d4ab5aa8d0c73209. The MTK connac3 has introduced new hardware, SDO (Software Defined Offload), to offload the process of filling the TX descriptor. Initially, there were some issues, but after several fixes, it should now be stable, allowing us to revert this commit. Additionally, activating SDO is essential for the proper functioning of features like TX checksum offload. Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20250328022847.1612082-1-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7996: Add NULL check in mt7996_thermal_initCharles Han1-0/+3
devm_kasprintf() can return a NULL pointer on failure,but this returned value in mt7996_thermal_init() is not checked. Add NULL check in mt7996_thermal_init(), to handle kernel NULL pointer dereference error. Fixes: 69d54ce7491d ("wifi: mt76: mt7996: switch to single multi-radio wiphy") Signed-off-by: Charles Han <hanchunchao@inspur.com> Link: https://patch.msgid.link/20250407095551.32127-1-hanchunchao@inspur.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7925: add EHT preamble puncturingAllan Wang4-0/+61
Add mt7925 EHT preamble puncturing. Signed-off-by: Allan Wang <allan.wang@mediatek.com> Link: https://patch.msgid.link/20250401083525.2734333-1-allan.wang@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7925: Fix logical vs bitwise typoDan Carpenter1-1/+1
This was supposed to be & instead of &&. Fixes: f0317215b367 ("wifi: mt76: mt7925: add EHT control support based on the CLC data") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://patch.msgid.link/d323a443-4e81-4064-8563-b62274b53ef4@stanley.mountain Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7996: rework radar HWRDD idxStanleyYP Wang5-69/+75
The definition of MT_RX_SEL (for rdd_rx_sel) is mixed with the definition of HWRDD idx. For example, MT_RX_SEL2 is for background HWRDD idx, not an option of rdd_rx_sel. Additionally, HWRDD idx does not exactly map to band idx for Connac 3 chips. So, add mt7996_get_rdd_idx as a helper function. Finally, remove some parts of the code inherited from the legacy chips. For instance, 1. rdd_state is used for single-band-dual-HWRDD chips (for 80+80), especially the 76xx series. 2. rdd_rx_sel is also used for single-band-dual-HWRDD chips rx_sel = 0 => RDD0 for WF0, RDD1 for WF2 rx_sel = 1 => RDD0 for WF1, RDD1 for WF3 Chip Variants | 5G rdd idx | Background rdd idx ---------------------------|----------------|------------------- MT7996 (except 205/255) | 1 | 2 MT7992 | 1 | 2 MT7990 | 1 | 2 Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Reviewed-by: Shayne Chen <shayne.chen@mediatek.com> Reviewed-by: Money Wang <money.wang@mediatek.com> Link: https://patch.msgid.link/20250320015926.3948672-1-StanleyYP.Wang@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7915: rework radar HWRDD idxStanleyYP Wang5-60/+87
The definition of MT_RX_SEL (for rdd_rx_sel) is mixed with the definition of HWRDD idx. For example, MT_RX_SEL2 is for background HWRDD idx, not an option of rdd_rx_sel. Therefore, add mt7915_get_rdd_idx as a helper function to get the HWRDD idx for each variants. Additionally, remove some parts of the code inherited from the legacy chips. For instance, 1. rdd_state is used for single-band-dual-HWRDD chips (for 80+80), especially the 76xx series. 2. rdd_rx_sel is also used for single-band-dual-HWRDD chips rx_sel = 0 => RDD0 for WF0, RDD1 for WF2 rx_sel = 1 => RDD0 for WF1, RDD1 for WF3 Chip Variants | 5G rdd idx(=bandidx)| Background rdd idx -------------------------------|---------------------|------------------- MT7915A | 0 | 2 MT7915D | 1 | 2 MT7916 2G + 5G (2T2R+1R) | 1 | 2 MT7916 2G + 5G (3T3R) | 1 | N/A MT7981 2G + 5G | 1 | N/A MT7986 2G + 5G (one adie DBDC) | 1 | N/A MT7986 5G (one adie) | 1 (bandidx=MT_BAND1)| N/A MT7986 2G + 5G (dual adie) | 1 | N/A Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Reviewed-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20250320015918.3948643-1-StanleyYP.Wang@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7915: set correct background radar capabilityStanleyYP Wang6-8/+49
Some of the variants do not support background radar, so add a helper to report background radar capability. For mt7916, only the variant of 5G 2T2R + 1R supports background radar. Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Reviewed-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20250320015909.3948612-1-StanleyYP.Wang@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7996: add PCI device id for mt7990Peter Chiu1-2/+6
Add PCI device IDs to enable support for mt7990 chipsets. Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20250409140750.724437-11-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7996: rework background radar check for mt7990StanleyYP Wang3-20/+29
The MT7990 comes in 2T2R and 3T3R variants, with only the 2T2R supporting background radar. Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20250409140750.724437-10-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: connac: rework TX descriptor and TX free for mt7990Shayne Chen2-6/+37
Adjust the TX descriptor and TX free for updated hardware fields. This is a preliminary patch to support mt7990 chipset. Co-developed-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Co-developed-by: Benjamin Lin <benjamin-jw.lin@mediatek.com> Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com> Co-developed-by: Peter Chiu <chui-hao.chiu@mediatek.com> Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20250409140750.724437-9-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7996: adjust HW capabilities for mt7990Peter Chiu2-5/+8
This is a preliminary patch to support mt7990 chipset. Co-developed-by: Howard Hsu <howard-yh.hsu@mediatek.com> Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com> Co-developed-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com> Link: https://patch.msgid.link/20250409140750.724437-8-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7996: add eeprom support for mt7990StanleyYP Wang3-0/+16
Add eeprom definition and default bin file for mt7990. This is a preliminary patch to support mt7990 chipset. Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20250409140750.724437-7-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7996: rework register mapping for mt7990StanleyYP Wang2-25/+208
Rework register offset and l1/l2/cbtop mapping for mt7990. This is a preliminary patch to support mt7990 chipset. Co-developed-by: Peter Chiu <chui-hao.chiu@mediatek.com> Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com> Co-developed-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Link: https://patch.msgid.link/20250409140750.724437-6-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7996: rework DMA configuration for mt7990Peter Chiu3-63/+135
Modify DMA ring setting for mt7990. This is a preliminary patch to support mt7990 chipset. Co-developed-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20250409140750.724437-5-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7996: rework WA mcu command for mt7990Peter Chiu3-8/+50
Since mt7990 lacks WA firmware, some WA commands are not supported or need to be refactored to use the SDO command. This is a preliminary patch to support mt7990 chipset. Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20250409140750.724437-4-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: connac: add support to load firmware for mt7990StanleyYP Wang5-11/+36
Add firmware download support. Note that mt7990 does not have WA and DSP firmwares. This is a preliminary patch to support mt7990 chipset. Co-developed-by: Peter Chiu <chui-hao.chiu@mediatek.com> Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com> Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20250409140750.724437-3-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21wifi: mt76: mt7996: add macros for pci device idsShayne Chen7-22/+28
The chipset name (i.e., brand name) used by the driver may cause confusion with the PCI device ID when adding support for new chipsets. | Chipset name | PCI device id | |--------------|----------------| | 7996 | 0x7990, 0x7991 | | 7992 | 0x7992, 0x799a | | 7990 | 0x7993, 0x799b | To prevent confusion, replace the code that directly uses the device ID with macros. This is a preliminary patch to support mt7990 chipset. Co-developed-by: Peter Chiu <chui-hao.chiu@mediatek.com> Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com> Signed-off-by: Shayne Chen <shayne.chen@mediatek.com> Link: https://patch.msgid.link/20250409140750.724437-2-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau <nbd@nbd.name>
2025-05-21misc: amd-sbi: Add support for register xferAkshay Gupta1-0/+29
- Provide user register access over IOCTL. Both register read and write are supported. - APML interface does not provide a synchronization method. By defining, a register access path, we use APML modules and library for all APML transactions. Without having to use external tools such as i2c-tools, which may cause race conditions. Reviewed-by: Naveen Krishna Chatradhi <naveenkrishna.chatradhi@amd.com> Signed-off-by: Akshay Gupta <akshay.gupta@amd.com> Link: https://lore.kernel.org/r/20250428063034.2145566-10-akshay.gupta@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21misc: amd-sbi: Add support for read MCA register protocolAkshay Gupta1-0/+114
- AMD provides custom protocol to read Machine Check Architecture(MCA) registers over sideband. The information is accessed for range of MCA registers by passing register address and thread ID to the protocol. MCA register read command using the register address to access Core::X86::Msr::MCG_CAP which determines the number of MCA banks. Access is read-only Reviewed-by: Naveen Krishna Chatradhi <naveenkrishna.chatradhi@amd.com> Signed-off-by: Akshay Gupta <akshay.gupta@amd.com> Link: https://lore.kernel.org/r/20250428063034.2145566-9-akshay.gupta@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21misc: amd-sbi: Add support for CPUID protocolAkshay Gupta2-1/+172
- AMD provides custom protocol to read Processor feature capabilities and configuration information through side band. The information is accessed by providing CPUID Function, extended function and thread ID to the protocol. Undefined function returns 0. Reviewed-by: Naveen Krishna Chatradhi <naveenkrishna.chatradhi@amd.com> Signed-off-by: Akshay Gupta <akshay.gupta@amd.com> Link: https://lore.kernel.org/r/20250428063034.2145566-8-akshay.gupta@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21misc: amd-sbi: Add support for AMD_SBI IOCTLAkshay Gupta4-32/+113
The present sbrmi module only support reporting power via hwmon. However, AMD data center range of processors support various system management functionality using custom protocols defined in Advanced Platform Management Link (APML) specification. Register a miscdevice, which creates a device /dev/sbrmiX with an IOCTL interface for the user space to invoke the APML Mailbox protocol, which is already defined in sbrmi_mailbox_xfer(). The APML protocols depend on a set of RMI registers. Having an IOCTL as a single entry point will help in providing synchronization among these protocols as multiple transactions on RMI register set may create race condition. Support for other protocols will be added in subsequent patches. APML mailbox protocol returns additional error codes written by SMU firmware in the out-bound register 0x37. These errors include, invalid core, message not supported over platform and others. This additional error codes can be used to provide more details to user space. Open-sourced and widely used https://github.com/amd/esmi_oob_library will continue to provide user-space programmable API. Reviewed-by: Naveen Krishna Chatradhi <naveenkrishna.chatradhi@amd.com> Signed-off-by: Akshay Gupta <akshay.gupta@amd.com> Link: https://lore.kernel.org/r/20250428063034.2145566-7-akshay.gupta@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21misc: amd-sbi: Optimize the wait condition for mailbox command completionAkshay Gupta1-15/+4
- optimize the wait condition to indicate command completion by replacing the do while loop with regmap subsystem API regmap_read_poll_timeout() Reviewed-by: Naveen Krishna Chatradhi <naveenkrishna.chatradhi@amd.com> Signed-off-by: Akshay Gupta <akshay.gupta@amd.com> Link: https://lore.kernel.org/r/20250428063034.2145566-6-akshay.gupta@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21misc: amd-sbi: Use regmap subsystemAkshay Gupta3-27/+30
- regmap subsystem provides multiple benefits over direct smbus APIs - subsystem adds another abstraction layer on top of struct i2c_client to make it easy to read or write registers. - The subsystem can be helpful in following cases - Different types of bus (i2c/i3c), we have plans to support i3c. - Different Register address size (1byte/2byte) Reviewed-by: Naveen Krishna Chatradhi <naveenkrishna.chatradhi@amd.com> Signed-off-by: Akshay Gupta <akshay.gupta@amd.com> Link: https://lore.kernel.org/r/20250428063034.2145566-5-akshay.gupta@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21misc: amd-sbi: Move hwmon device sensor as separate entityAkshay Gupta5-104/+142
- Move hwmon device sensor to misc as only power is reported through hwmon sensor. Reviewed-by: Naveen Krishna Chatradhi <naveenkrishna.chatradhi@amd.com> Signed-off-by: Akshay Gupta <akshay.gupta@amd.com> Link: https://lore.kernel.org/r/20250428063034.2145566-4-akshay.gupta@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21misc: amd-sbi: Move protocol functionality to core fileAkshay Gupta5-162/+192
- This is done to utilize the protocol functionality into other domains. - Increase the scalability of the module with different bus(i2c/i3c) Reviewed-by: Naveen Krishna Chatradhi <naveenkrishna.chatradhi@amd.com> Signed-off-by: Akshay Gupta <akshay.gupta@amd.com> Link: https://lore.kernel.org/r/20250428063034.2145566-3-akshay.gupta@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21hwmon/misc: amd-sbi: Move core sbrmi from hwmon to miscAkshay Gupta6-10/+13
This is done to support other functionality provided by the SBRMI, which does not fit in the hwmon subsystem. Reviewed-by: Naveen Krishna Chatradhi <naveenkrishna.chatradhi@amd.com> Signed-off-by: Akshay Gupta <akshay.gupta@amd.com> Acked-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20250428063034.2145566-2-akshay.gupta@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21misc: microchip: pci1xxxx: Add GPIO Wakeup SupportRengarajan S1-0/+61
The patch adds PIO asynchronous wakeup support while PIO PCIe Endpoint function is in D3 state. When such a wakeup event occurs, the PIO asserts a PIO_WAKE signal, which in turn triggers PCIe Wake signaling. This wake request should trigger the PCIe Host to take the PIO PCIe Endpoint function into the D0 device state. The device supports up to 96 PIOs distributed across three GPIO banks. During suspend and resume, the driver checks the status of each GPIO bank to determine if any GPIOs with wake masking enabled have triggered an event. Upon resume, PIOxx_STATUS register must be cleared by software explicitly to enable the detection of the next transition. Signed-off-by: Rengarajan S <rengarajan.s@microchip.com> Link: https://lore.kernel.org/r/20250513091557.3660-3-rengarajan.s@microchip.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21misc: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and ↵Rengarajan S1-0/+31
later devices Systems that issue PCIe hot reset requests during a suspend/resume cycle cause PCI1XXXX device revisions prior to C0 to get its GPIO configuration registers reset to hardware default values. This results in device inaccessibility and GPIO read/write failure. Starting with Revision C0, support was added in the device hardware (via the Hot Reset Disable Bit) to allow resetting only the PCIe interface and its associated logic, but preserving the GPIO configurations during a hot reset. This patch enables the hot reset disable feature during suspend/ resume for C0 and later revisions of the device. mchp_pci1xxxx_gpio is an auxiliary child of mchp_pci1xxxx_gp and does not have access to system register address space for reading the device revision. Hence, the device revision is retrieved directly from PCIe config space. Signed-off-by: Rengarajan S <rengarajan.s@microchip.com> Link: https://lore.kernel.org/r/20250513091557.3660-2-rengarajan.s@microchip.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21misc: lis3lv02d: Fix correct sysfs directory path for lis3lv02dRoxana Nicolescu1-2/+2
The lis3lv02d driver does not create a platform device anymore. It was recently changed to use a faux device instead. Therefore the sysfs path has changed from /sys/devices/platform/lis3lv02d to /sys/devices/faux/lis3lv02d. Fixes: 3b18ccb5472b ("misc: lis3lv02d: convert to use faux_device") Signed-off-by: Roxana Nicolescu <nicolescu.roxana@protonmail.com> Link: https://lore.kernel.org/r/20250506110002.36477-1-nicolescu.roxana@protonmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21binder: Create safe versions of binder log filesTiffany Y. Yang1-27/+79
Binder defines several seq_files that can be accessed via debugfs or binderfs. Some of these files (e.g., 'state' and 'transactions') contain more granular information about binder's internal state that is helpful for debugging, but they also leak userspace address data through user-defined 'cookie' or 'ptr' values. Consequently, access to these files must be heavily restricted. Add two new files, 'state_hashed' and 'transactions_hashed', that reproduce the information in the original files but use the kernel's raw pointer obfuscation to hash any potential user addresses. This approach allows systems to grant broader access to the new files without having to change the security policy around the existing ones. In practice, userspace populates these fields with user addresses, but within the driver, these values only serve as unique identifiers for their associated binder objects. Consequently, binder logs can obfuscate these values and still retain meaning. While this strategy prevents leaking information about the userspace memory layout in the existing log files, it also decouples log messages about binder objects from their user-defined identifiers. Acked-by: Carlos Llamas <cmllamas@google.com> Tested-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: "Tiffany Y. Yang" <ynaffit@google.com> Link: https://lore.kernel.org/r/20250510013435.1520671-7-ynaffit@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21binder: Refactor binder_node print synchronizationTiffany Y. Yang1-51/+68
The binder driver outputs information about each dead binder node by iterating over the dead nodes list, and it prints the state of each live node in the system by traversing each binder_proc's proc->nodes tree. Both cases require similar logic to maintain the global lock ordering while accessing each node. Create a helper function to synchronize around printing binder nodes in a list. Opportunistically make minor cosmetic changes to binder print functions. Acked-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: "Tiffany Y. Yang" <ynaffit@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Link: https://lore.kernel.org/r/20250510013435.1520671-5-ynaffit@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21binder: fix use-after-free in binderfs_evict_inode()Dmitry Antipov3-5/+20
Running 'stress-ng --binderfs 16 --timeout 300' under KASAN-enabled kernel, I've noticed the following: BUG: KASAN: slab-use-after-free in binderfs_evict_inode+0x1de/0x2d0 Write of size 8 at addr ffff88807379bc08 by task stress-ng-binde/1699 CPU: 0 UID: 0 PID: 1699 Comm: stress-ng-binde Not tainted 6.14.0-rc7-g586de92313fc-dirty #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x1c2/0x2a0 ? __pfx_dump_stack_lvl+0x10/0x10 ? __pfx__printk+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? __virt_addr_valid+0x18c/0x540 ? __virt_addr_valid+0x469/0x540 print_report+0x155/0x840 ? __virt_addr_valid+0x18c/0x540 ? __virt_addr_valid+0x469/0x540 ? __phys_addr+0xba/0x170 ? binderfs_evict_inode+0x1de/0x2d0 kasan_report+0x147/0x180 ? binderfs_evict_inode+0x1de/0x2d0 binderfs_evict_inode+0x1de/0x2d0 ? __pfx_binderfs_evict_inode+0x10/0x10 evict+0x524/0x9f0 ? __pfx_lock_release+0x10/0x10 ? __pfx_evict+0x10/0x10 ? do_raw_spin_unlock+0x4d/0x210 ? _raw_spin_unlock+0x28/0x50 ? iput+0x697/0x9b0 __dentry_kill+0x209/0x660 ? shrink_kill+0x8d/0x2c0 shrink_kill+0xa9/0x2c0 shrink_dentry_list+0x2e0/0x5e0 shrink_dcache_parent+0xa2/0x2c0 ? __pfx_shrink_dcache_parent+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? __pfx_do_raw_spin_lock+0x10/0x10 do_one_tree+0x23/0xe0 shrink_dcache_for_umount+0xa0/0x170 generic_shutdown_super+0x67/0x390 kill_litter_super+0x76/0xb0 binderfs_kill_super+0x44/0x90 deactivate_locked_super+0xb9/0x130 cleanup_mnt+0x422/0x4c0 ? lockdep_hardirqs_on+0x9d/0x150 task_work_run+0x1d2/0x260 ? __pfx_task_work_run+0x10/0x10 resume_user_mode_work+0x52/0x60 syscall_exit_to_user_mode+0x9a/0x120 do_syscall_64+0x103/0x210 ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0xcac57b Code: c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 31 f6 e9 05 00 00 00 0f 1f 44 00 00 f3 0f 1e fa b8 RSP: 002b:00007ffecf4226a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007ffecf422720 RCX: 0000000000cac57b RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffecf422850 RBP: 00007ffecf422850 R08: 0000000028d06ab1 R09: 7fffffffffffffff R10: 3fffffffffffffff R11: 0000000000000246 R12: 00007ffecf422718 R13: 00007ffecf422710 R14: 00007f478f87b658 R15: 00007ffecf422830 </TASK> Allocated by task 1705: kasan_save_track+0x3e/0x80 __kasan_kmalloc+0x8f/0xa0 __kmalloc_cache_noprof+0x213/0x3e0 binderfs_binder_device_create+0x183/0xa80 binder_ctl_ioctl+0x138/0x190 __x64_sys_ioctl+0x120/0x1b0 do_syscall_64+0xf6/0x210 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 1705: kasan_save_track+0x3e/0x80 kasan_save_free_info+0x46/0x50 __kasan_slab_free+0x62/0x70 kfree+0x194/0x440 evict+0x524/0x9f0 do_unlinkat+0x390/0x5b0 __x64_sys_unlink+0x47/0x50 do_syscall_64+0xf6/0x210 entry_SYSCALL_64_after_hwframe+0x77/0x7f This 'stress-ng' workload causes the concurrent deletions from 'binder_devices' and so requires full-featured synchronization to prevent list corruption. I've found this issue independently but pretty sure that syzbot did the same, so Reported-by: and Closes: should be applicable here as well. Cc: stable@vger.kernel.org Reported-by: syzbot+353d7b75658a95aa955a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=353d7b75658a95aa955a Fixes: e77aff5528a18 ("binderfs: fix use-after-free in binder_devices") Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Acked-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Link: https://lore.kernel.org/r/20250517170957.1317876-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-21can: dev: add struct data_bittiming_params to group FD parametersVincent Mailhol20-101/+101
This is a preparation patch for the introduction of CAN XL. CAN FD and CAN XL uses similar bittiming parameters. Add one level of nesting for all the CAN FD parameters. Typically: priv->can.data_bittiming; becomes: priv->can.fd.data_bittiming; This way, the CAN XL equivalent (to be introduced later) would be: priv->can.xl.data_bittiming; Add the new struct data_bittiming_params which contains all the data bittiming parameters, including the TDC and the callback functions. This done, update all the CAN FD drivers to make use of the new layout. Acked-by: Oliver Hartkopp <socketcan@hartkopp.net> Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr> Link: https://patch.msgid.link/20250501171213.2161572-2-mailhol.vincent@wanadoo.fr [mkl: fix rcar_canfd] Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-05-21can: rcar_canfd: Add RZ/G3E supportBiju Das1-0/+23
The CAN-FD IP found on the RZ/G3E SoC is similar to R-Car Gen4, but it has no external clock instead it has clk_ram, it has 6 channels and supports 20 interrupts. Add support for RZ/G3E CAN-FD driver. Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/20250417054320.14100-20-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-05-21can: rcar_canfd: Enhance multi_channel_irqs handlingBiju Das1-2/+5
Currently multi_channel_irqs has only 2 channels. But RZ/G3E has six channels. Enhance multi_channel_irqs handling to support more than two channels. Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/20250417054320.14100-19-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-05-21can: rcar_canfd: Add external_clk variable to struct rcar_canfd_hw_infoBiju Das1-1/+5
All existing SoCs support an external clock, but RZ/G3E has only internal clocks. Add external_clk variable to struct rcar_canfd_hw_info to handle this difference. Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/20250417054320.14100-18-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-05-21can: rcar_canfd: Add sh variable to struct rcar_canfd_hw_infoBiju Das1-19/+45
R-Car Gen3 and Gen4 have some differences in the shift bits. Introduce a struct rcar_canfd_shift_data to hold these values and add the struct rcar_canfd_shift_data variable sh to struct rcar_canfd_hw_info to handle these differences. After this, drop the unused functions reg_gen4() and is_gen4(). Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/20250417054320.14100-17-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-05-21can: rcar_canfd: Add struct rcanfd_regs variable to struct rcar_canfd_hw_infoBiju Das1-7/+41
R-Car Gen3 and Gen4 have some differences in the register offsets. Add struct rcanfd_regs variable regs to the struct rcar_canfd_hw_info to handle these differences. Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/20250417054320.14100-16-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-05-21can: rcar_canfd: Add shared_can_regs variable to struct rcar_canfd_hw_infoBiju Das1-5/+9
R-Car Gen4 has shared regs for both CAN-FD and Classical CAN operations. Add shared_can_regs variable to struct rcar_canfd_hw_info to handle this difference. Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/20250417054320.14100-15-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-05-21can: rcar_canfd: Add ch_interface_mode variable to struct rcar_canfd_hw_infoBiju Das1-1/+5
R-Car Gen4 has channel specific interface mode bit for setting CAN-FD or Classical CAN mode whereas on R-Car Gen3 it is global. Add a ch_interface_mode variable to struct rcar_canfd_hw_info to handle this difference. Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/20250417054320.14100-14-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-05-21can: rcar_canfd: Add {nom,data}_bittiming variables to struct rcar_canfd_hw_infoBiju Das1-11/+42
Both R-Car Gen4 and R-Car Gen3 have different bit timing parameters Add {nom,data}_bittiming variables to struct rcar_canfd_hw_info to handle this difference. Since the mask used in the macros are max value - 1, replace that as well. Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/20250417054320.14100-13-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-05-21can: rcar_canfd: Add max_cftml variable to struct rcar_canfd_hw_infoBiju Das1-2/+9
R-Car Gen3 has CFTML max positional value is 15 whereas on R-Car Gen4 it is 31. Add a max_cftml variable to struct rcar_canfd_hw_info to handle this difference. While at it, rename the parameter x->cftml in RCANFD_CFCC_CFTML macro to make it clear. Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/20250417054320.14100-12-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-05-21can: rcar_canfd: Add max_aflpn variable to struct rcar_canfd_hw_infoBiju Das1-1/+5
R-Car Gen3 has maximum acceptance filter list page number of 31 whereas on R-Car Gen4 it is 127. Add max_aflpn variable to struct rcar_canfd_hw_info in order to support RZ/G3E that has max AFLPN of 63. While at it, rename the parameter x->page_num in RCANFD_GAFLECTR_AFLPN macro to make it clear. Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/20250417054320.14100-11-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-05-21can: rcar_canfd: Add rnc_field_width variable to struct rcar_canfd_hw_infoBiju Das1-2/+7
The shift and w value in rcar_canfd_setrnc() are dictated by the field width: - R-Car Gen4 packs 2 values in a 32-bit word, using a field width of 16 bits, - R-Car Gen3 packs up to 4 values in a 32-bit word, using a field width of 8 bits. Add rnc_field_width variable to struct rcar_canfd_hw_info to handle this difference. The rnc_stride is 32 / rnc_field_width and the index parameter w is calculated by ch / rnc_stride. The shift value in rcar_canfd_setrnc() is computed by using (32 - (ch % rnc_stride + 1) * rnc_field_width). Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/20250417054320.14100-10-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-05-21can: rcar_canfd: Update RCANFD_GAFLCFG macroBiju Das1-2/+3
Update RCANFD_GAFLCFG macro by replacing the parameter ch->w, where w is the GAFLCFG index used in the hardware manual. Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/20250417054320.14100-9-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-05-21can: rcar_canfd: Add rcar_canfd_setrnc()Biju Das1-7/+11
Add rcar_canfd_setrnc() to replace the macro RCANFD_GAFLCFG_SETRNC. While at it, replace int->unsigned int for local variables offset, page and num_rules in rcar_canfd_configure_afl_rules(). Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/20250417054320.14100-8-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-05-21can: rcar_canfd: Drop the mask operation in RCANFD_GAFLCFG_SETRNC macroBiju Das1-2/+1
Drop the mask operation in RCANFD_GAFLCFG_SETRNC macro as the num_rules can never be larger than number of supported rules. Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/20250417054320.14100-7-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-05-21can: rcar_canfd: Update RCANFD_GERFL_ERR macroBiju Das1-7/+8
Replace the macro RCANFD_GERFL_EEF0_7->RCANFD_GERFL_EEF. The macros RCANFD_GERFL_EEF* in RCANFD_GERFL_ERR can be replaced by FIELD_PREP() and drop the redundant macro RCANFD_GERFL_EEF(ch). Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20250417054320.14100-6-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
generated by cgit v1.2.3 (git 2.39.0) at 2025-09-13 16:52:25 +0300