From 1c23070f17c5934e31db5c2dda79c681eedea538 Mon Sep 17 00:00:00 2001 From: Mark Brown Date: Fri, 28 Jan 2022 19:24:43 +0000 Subject: ASoC: ops: Check for negative values before reading them The controls allow inputs to be specified as negative but our manipulating them into register fields need to be done on unsigned variables so the checks for negative numbers weren't taking effect properly. Do the checks for negative values on the variable in the ABI struct rather than on our local unsigned copy. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20220128192443.3504823-1-broonie@kernel.org Signed-off-by: Mark Brown --- sound/soc/soc-ops.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index e73360e9de8f..d867f449d82d 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -316,26 +316,26 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol, if (sign_bit) mask = BIT(sign_bit + 1) - 1; + if (ucontrol->value.integer.value[0] < 0) + return -EINVAL; val = ucontrol->value.integer.value[0]; if (mc->platform_max && ((int)val + min) > mc->platform_max) return -EINVAL; if (val > max - min) return -EINVAL; - if (val < 0) - return -EINVAL; val = (val + min) & mask; if (invert) val = max - val; val_mask = mask << shift; val = val << shift; if (snd_soc_volsw_is_stereo(mc)) { + if (ucontrol->value.integer.value[1] < 0) + return -EINVAL; val2 = ucontrol->value.integer.value[1]; if (mc->platform_max && ((int)val2 + min) > mc->platform_max) return -EINVAL; if (val2 > max - min) return -EINVAL; - if (val2 < 0) - return -EINVAL; val2 = (val2 + min) & mask; if (invert) val2 = max - val2; @@ -430,13 +430,13 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol, int ret; unsigned int val, val_mask; + if (ucontrol->value.integer.value[0] < 0) + return -EINVAL; val = ucontrol->value.integer.value[0]; if (mc->platform_max && val > mc->platform_max) return -EINVAL; if (val > max - min) return -EINVAL; - if (val < 0) - return -EINVAL; val_mask = mask << shift; val = (val + min) & mask; val = val << shift; -- cgit v1.2.3 From 416f4b76240400260aaf0c4200565d63f49290d7 Mon Sep 17 00:00:00 2001 From: Mark Brown Date: Wed, 11 May 2022 14:41:36 +0100 Subject: ASoC: ops: Fix bounds check for _sx controls For _sx controls the semantics of the max field is not the usual one, max is the number of steps rather than the maximum value. This means that our check in snd_soc_put_volsw_sx() needs to just check against the maximum value. Fixes: 4f1e50d6a9cf9c1b ("ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx()") Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20220511134137.169575-1-broonie@kernel.org Signed-off-by: Mark Brown --- sound/soc/soc-ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index d867f449d82d..dfd7455c9f7a 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -435,7 +435,7 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol, val = ucontrol->value.integer.value[0]; if (mc->platform_max && val > mc->platform_max) return -EINVAL; - if (val > max - min) + if (val > max) return -EINVAL; val_mask = mask << shift; val = (val + min) & mask; -- cgit v1.2.3 From d62dd3e291e061d66e088401e32f1119bcfdc7f3 Mon Sep 17 00:00:00 2001 From: Mark Brown Date: Wed, 11 May 2022 14:41:37 +0100 Subject: ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() The bounds checks in snd_soc_put_volsw_sx() are only being applied to the first channel, meaning it is possible to write out of bounds values to the second channel in stereo controls. Add appropriate checks. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20220511134137.169575-2-broonie@kernel.org Signed-off-by: Mark Brown --- sound/soc/soc-ops.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index dfd7455c9f7a..8c0e7ad66eb2 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -451,6 +451,12 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol, val_mask = mask << rshift; val2 = (ucontrol->value.integer.value[1] + min) & mask; + + if (mc->platform_max && val2 > mc->platform_max) + return -EINVAL; + if (val2 > max) + return -EINVAL; + val2 = val2 << rshift; err = snd_soc_component_update_bits(component, reg2, val_mask, -- cgit v1.2.3 From 6f668d2cbd2e2b87a3f347070704714453383712 Mon Sep 17 00:00:00 2001 From: Mark Brown Date: Thu, 2 Jun 2022 11:29:20 +0200 Subject: ASoC: ops: Clarify snd_soc_info_volsw_sx() Currently snd_soc_info_volsw_sx() is implemented indirectly, wrapping snd_soc_info_volsw() and modifying the values it sets up rather than directly setting up the values reported to userspace. This makes it much harder to follow what the intended behaviour of these controls is. Let's rewrite the function to be self contained with a clarifying comment at the top in an effort to help maintainability. Signed-off-by: Mark Brown Reviewed-by: Charles Keepax Tested-by: Charles Keepax Link: https://lore.kernel.org/r/20220602092921.3302713-1-broonie@kernel.org Signed-off-by: Mark Brown --- sound/soc/soc-ops.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index 8c0e7ad66eb2..7e1cbc23bba5 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -203,7 +203,8 @@ EXPORT_SYMBOL_GPL(snd_soc_info_volsw); * Callback to provide information about a single mixer control, or a double * mixer control that spans 2 registers of the SX TLV type. SX TLV controls * have a range that represents both positive and negative values either side - * of zero but without a sign bit. + * of zero but without a sign bit. min is the minimum register value, max is + * the number of steps. * * Returns 0 for success. */ @@ -212,12 +213,21 @@ int snd_soc_info_volsw_sx(struct snd_kcontrol *kcontrol, { struct soc_mixer_control *mc = (struct soc_mixer_control *)kcontrol->private_value; + int max; - snd_soc_info_volsw(kcontrol, uinfo); - /* Max represents the number of levels in an SX control not the - * maximum value, so add the minimum value back on - */ - uinfo->value.integer.max += mc->min; + if (mc->platform_max) + max = mc->platform_max; + else + max = mc->max; + + if (max == 1 && !strstr(kcontrol->id.name, " Volume")) + uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN; + else + uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER; + + uinfo->count = snd_soc_volsw_is_stereo(mc) ? 2 : 1; + uinfo->value.integer.min = 0; + uinfo->value.integer.max = max; return 0; } -- cgit v1.2.3 From 339ba37942c9de7aeb7647b6a225c49cc3d7e0dc Mon Sep 17 00:00:00 2001 From: Mark Brown Date: Thu, 2 Jun 2022 12:18:33 +0200 Subject: ASoC: ops: Remove unneeded delay.h inclusion The ops code does not do any sleeps or delays so does not need delay.h. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20220602101833.3481641-1-broonie@kernel.org Signed-off-by: Mark Brown --- sound/soc/soc-ops.c | 1 - 1 file changed, 1 deletion(-) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index 7e1cbc23bba5..a25656c4d978 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -14,7 +14,6 @@ #include #include #include -#include #include #include #include -- cgit v1.2.3 From a6656a017abeb3675049eb6711a918aa61ac5bd6 Mon Sep 17 00:00:00 2001 From: Chancel Liu Date: Wed, 4 Jan 2023 10:57:54 +0800 Subject: ASoC: fsl_micfil: Correct the number of steps on SX controls The parameter "max" of SOC_SINGLE_SX_TLV() means the number of steps rather than maximum value. This patch corrects the minimum value to -8 and the number of steps to 15. Signed-off-by: Chancel Liu Acked-by: Shengjiu Wang Link: https://lore.kernel.org/r/20230104025754.3019235-1-chancel.liu@nxp.com Signed-off-by: Mark Brown --- sound/soc/fsl/fsl_micfil.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/sound/soc/fsl/fsl_micfil.c b/sound/soc/fsl/fsl_micfil.c index ca0d0ef6f5a7..1ec2993de516 100644 --- a/sound/soc/fsl/fsl_micfil.c +++ b/sound/soc/fsl/fsl_micfil.c @@ -656,21 +656,21 @@ static DECLARE_TLV_DB_SCALE(gain_tlv, 0, 100, 0); static const struct snd_kcontrol_new fsl_micfil_snd_controls[] = { SOC_SINGLE_SX_TLV("CH0 Volume", REG_MICFIL_OUT_CTRL, - MICFIL_OUTGAIN_CHX_SHIFT(0), 0xF, 0x7, gain_tlv), + MICFIL_OUTGAIN_CHX_SHIFT(0), 0x8, 0xF, gain_tlv), SOC_SINGLE_SX_TLV("CH1 Volume", REG_MICFIL_OUT_CTRL, - MICFIL_OUTGAIN_CHX_SHIFT(1), 0xF, 0x7, gain_tlv), + MICFIL_OUTGAIN_CHX_SHIFT(1), 0x8, 0xF, gain_tlv), SOC_SINGLE_SX_TLV("CH2 Volume", REG_MICFIL_OUT_CTRL, - MICFIL_OUTGAIN_CHX_SHIFT(2), 0xF, 0x7, gain_tlv), + MICFIL_OUTGAIN_CHX_SHIFT(2), 0x8, 0xF, gain_tlv), SOC_SINGLE_SX_TLV("CH3 Volume", REG_MICFIL_OUT_CTRL, - MICFIL_OUTGAIN_CHX_SHIFT(3), 0xF, 0x7, gain_tlv), + MICFIL_OUTGAIN_CHX_SHIFT(3), 0x8, 0xF, gain_tlv), SOC_SINGLE_SX_TLV("CH4 Volume", REG_MICFIL_OUT_CTRL, - MICFIL_OUTGAIN_CHX_SHIFT(4), 0xF, 0x7, gain_tlv), + MICFIL_OUTGAIN_CHX_SHIFT(4), 0x8, 0xF, gain_tlv), SOC_SINGLE_SX_TLV("CH5 Volume", REG_MICFIL_OUT_CTRL, - MICFIL_OUTGAIN_CHX_SHIFT(5), 0xF, 0x7, gain_tlv), + MICFIL_OUTGAIN_CHX_SHIFT(5), 0x8, 0xF, gain_tlv), SOC_SINGLE_SX_TLV("CH6 Volume", REG_MICFIL_OUT_CTRL, - MICFIL_OUTGAIN_CHX_SHIFT(6), 0xF, 0x7, gain_tlv), + MICFIL_OUTGAIN_CHX_SHIFT(6), 0x8, 0xF, gain_tlv), SOC_SINGLE_SX_TLV("CH7 Volume", REG_MICFIL_OUT_CTRL, - MICFIL_OUTGAIN_CHX_SHIFT(7), 0xF, 0x7, gain_tlv), + MICFIL_OUTGAIN_CHX_SHIFT(7), 0x8, 0xF, gain_tlv), SOC_ENUM_EXT("MICFIL Quality Select", fsl_micfil_quality_enum, snd_soc_get_enum_double, snd_soc_put_enum_double), -- cgit v1.2.3 From 340935f2bc5ec4fb7566063709b403d00ac22e1e Mon Sep 17 00:00:00 2001 From: Vabhav Sharma Date: Fri, 25 Nov 2022 18:07:54 +0530 Subject: LF-6722: drivers/crypto: caam/snvs: SNVS state during linux boot SNVS HP state is read incorrectly because there is Software dependency between SECVIO and CAAM driver. Added code to read SNVS version ID register which contain non-zero constants to identify the endianness of the device. This register includes a 16-bit field called IP_ID, and seems to have one of four different values 0x003A, 0x003C, 0x003E or 0x003F. Signed-off-by: Vabhav Sharma Reviewed-by: Pankaj Gupta Reviewed-by: Horia Geanta --- drivers/crypto/caam/secvio.c | 62 ++++++++++++++++++++++++++++++++++++------ drivers/crypto/caam/snvsregs.h | 6 ++++ 2 files changed, 60 insertions(+), 8 deletions(-) diff --git a/drivers/crypto/caam/secvio.c b/drivers/crypto/caam/secvio.c index d6ebe0af40fc..e319677132cf 100644 --- a/drivers/crypto/caam/secvio.c +++ b/drivers/crypto/caam/secvio.c @@ -3,7 +3,7 @@ * SNVS Security Violation Handler * * Copyright 2012-2016 Freescale Semiconductor, Inc. - * Copyright 2017-2019 NXP + * Copyright 2017-2019, 2023 NXP */ #include "compat.h" @@ -54,6 +54,24 @@ static const u8 *snvs_ssm_state_name[] = { "secure", }; +static DEFINE_STATIC_KEY_TRUE(snvs_little_end); + +static inline u32 secvio_read(void __iomem *reg) +{ + if (static_branch_likely(&snvs_little_end)) + return ioread32(reg); + else + return ioread32be(reg); +} + +static inline void secvio_write(void __iomem *reg, u32 data) +{ + if (static_branch_likely(&snvs_little_end)) + iowrite32(data, reg); + else + iowrite32be(data, reg); +} + /* Top-level security violation interrupt */ static irqreturn_t snvs_secvio_interrupt(int irq, void *snvsdev) { @@ -62,8 +80,8 @@ static irqreturn_t snvs_secvio_interrupt(int irq, void *snvsdev) clk_enable(svpriv->clk); /* Check the HP secvio status register */ - svpriv->irqcause = rd_reg32(&svpriv->svregs->hp.secvio_status) & - HP_SECVIOST_SECVIOMASK; + svpriv->irqcause = secvio_read(&svpriv->svregs->hp.secvio_status) & + HP_SECVIOST_SECVIOMASK; if (!svpriv->irqcause) { clk_disable(svpriv->clk); @@ -192,7 +210,7 @@ static int snvs_secvio_remove(struct platform_device *pdev) clk_enable(svpriv->clk); /* Set all sources to nonfatal */ - wr_reg32(&svpriv->svregs->hp.secvio_intcfg, 0); + secvio_write(&svpriv->svregs->hp.secvio_intcfg, 0); /* Remove tasklets and release interrupt */ for_each_possible_cpu(i) @@ -216,6 +234,7 @@ static int snvs_secvio_probe(struct platform_device *pdev) u32 hpstate; const void *jtd, *wtd, *itd, *etd; u32 td_en; + u32 ipidr, ipid; svpriv = kzalloc(sizeof(struct snvs_secvio_drv_private), GFP_KERNEL); if (!svpriv) @@ -281,9 +300,36 @@ static int snvs_secvio_probe(struct platform_device *pdev) clk_prepare_enable(svpriv->clk); + /* + * Reading SNVS version ID register HPVIDR1 to identify the endianness + * of the device which contain non-zero constants including 16-bit field + * called IP_ID[Bit 31-16] having one of the four values 0x003A, 0x003C, + * 0x003E, 0x003F. + */ + ipidr = secvio_read(&svpriv->svregs->vid); + ipid = ipidr >> SNVS_HPVIDR_BLOCK_ID; + if (ipid == SNVS_ID1 || ipid == SNVS_ID2 || ipid == SNVS_ID3 || ipid == SNVS_ID4) { + dev_info(svdev, "ipid matched - 0x%x\n", ipid); + } else { + /* + * Device endianness is not LE.Reading again SNVS version ID + * register value to identify the endianness of device is BE. + */ + ipid = (ipidr & (u32)0x0000FF00) >> 8; + if (ipid == SNVS_ID1 || ipid == SNVS_ID2 || ipid == SNVS_ID3 || ipid == SNVS_ID4) { + dev_info(svdev, "ipid matched - 0x%x\n", ipid); + static_branch_disable(&snvs_little_end); + } else { + dev_err(svdev, "unable to identify secvio endianness\n"); + iounmap(svpriv->svregs); + kfree(svpriv); + return -EINVAL; + } + } + /* Write the Secvio Enable Config the SVCR */ - wr_reg32(&svpriv->svregs->hp.secvio_ctl, td_en); - wr_reg32(&svpriv->svregs->hp.secvio_intcfg, td_en); + secvio_write(&svpriv->svregs->hp.secvio_ctl, td_en); + secvio_write(&svpriv->svregs->hp.secvio_intcfg, td_en); /* Device data set up. Now init interrupt source descriptions */ for (i = 0; i < MAX_SECVIO_SOURCES; i++) { @@ -306,8 +352,8 @@ static int snvs_secvio_probe(struct platform_device *pdev) return -EINVAL; } - hpstate = (rd_reg32(&svpriv->svregs->hp.status) & - HP_STATUS_SSM_ST_MASK) >> HP_STATUS_SSM_ST_SHIFT; + hpstate = (secvio_read(&svpriv->svregs->hp.status) & + HP_STATUS_SSM_ST_MASK) >> HP_STATUS_SSM_ST_SHIFT; dev_info(svdev, "violation handlers armed - %s state\n", snvs_ssm_state_name[hpstate]); diff --git a/drivers/crypto/caam/snvsregs.h b/drivers/crypto/caam/snvsregs.h index 4a7e7693328f..278d811919e9 100644 --- a/drivers/crypto/caam/snvsregs.h +++ b/drivers/crypto/caam/snvsregs.h @@ -236,4 +236,10 @@ struct snvs_full { u32 opt_rev; /* 0xbfc HP Options / Revision (VID 2) */ }; +#define SNVS_HPVIDR_BLOCK_ID 16 /* SNVS Block ID 31-16 bit */ +#define SNVS_ID1 58 /* SNVS Block ID 0x3A */ +#define SNVS_ID2 60 /* SNVS Block ID 0x3C */ +#define SNVS_ID3 62 /* SNVS Block ID 0x3E */ +#define SNVS_ID4 63 /* SNVS Block ID 0x3F */ + #endif /* SNVSREGS_H */ -- cgit v1.2.3 From 2eb8561aa867d1788f7207d1d384fd41e508bdf0 Mon Sep 17 00:00:00 2001 From: Ming Qian Date: Thu, 12 Jan 2023 10:47:02 +0100 Subject: media: imx-jpeg: Apply clk_bulk api instead of operating specific clk using the api of clk_bulk can simplify the code. and the clock of the jpeg codec may be changed, the clk_bulk api can be compatible with the future change. Fixes: 4c2e5156d9fa ("media: imx-jpeg: Add pm-runtime support for imx-jpeg") Signed-off-by: Ming Qian Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 35 ++++++-------------------- drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h | 4 +-- 2 files changed, 10 insertions(+), 29 deletions(-) diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c index b4588760ad4e..4f08bf6954d0 100644 --- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c @@ -2482,19 +2482,12 @@ static int mxc_jpeg_probe(struct platform_device *pdev) jpeg->mode = mode; /* Get clocks */ - jpeg->clk_ipg = devm_clk_get(dev, "ipg"); - if (IS_ERR(jpeg->clk_ipg)) { - dev_err(dev, "failed to get clock: ipg\n"); - ret = PTR_ERR(jpeg->clk_ipg); - goto err_clk; - } - - jpeg->clk_per = devm_clk_get(dev, "per"); - if (IS_ERR(jpeg->clk_per)) { - dev_err(dev, "failed to get clock: per\n"); - ret = PTR_ERR(jpeg->clk_per); + ret = devm_clk_bulk_get_all(&pdev->dev, &jpeg->clks); + if (ret < 0) { + dev_err(dev, "failed to get clock\n"); goto err_clk; } + jpeg->num_clks = ret; ret = mxc_jpeg_attach_pm_domains(jpeg); if (ret < 0) { @@ -2591,32 +2584,20 @@ static int mxc_jpeg_runtime_resume(struct device *dev) struct mxc_jpeg_dev *jpeg = dev_get_drvdata(dev); int ret; - ret = clk_prepare_enable(jpeg->clk_ipg); - if (ret < 0) { - dev_err(dev, "failed to enable clock: ipg\n"); - goto err_ipg; - } - - ret = clk_prepare_enable(jpeg->clk_per); + ret = clk_bulk_prepare_enable(jpeg->num_clks, jpeg->clks); if (ret < 0) { - dev_err(dev, "failed to enable clock: per\n"); - goto err_per; + dev_err(dev, "failed to enable clock\n"); + return ret; } return 0; - -err_per: - clk_disable_unprepare(jpeg->clk_ipg); -err_ipg: - return ret; } static int mxc_jpeg_runtime_suspend(struct device *dev) { struct mxc_jpeg_dev *jpeg = dev_get_drvdata(dev); - clk_disable_unprepare(jpeg->clk_ipg); - clk_disable_unprepare(jpeg->clk_per); + clk_bulk_disable_unprepare(jpeg->num_clks, jpeg->clks); return 0; } diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h index 660dcaca8658..62e5d039f023 100644 --- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h +++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h @@ -119,8 +119,8 @@ struct mxc_jpeg_dev { spinlock_t hw_lock; /* hardware access lock */ unsigned int mode; struct mutex lock; /* v4l2 ioctls serialization */ - struct clk *clk_ipg; - struct clk *clk_per; + struct clk_bulk_data *clks; + int num_clks; struct platform_device *pdev; struct device *dev; void __iomem *base_reg; -- cgit v1.2.3 From 36ed5a6ab1473aa5305e49cc3be0c84b743d8af8 Mon Sep 17 00:00:00 2001 From: Ming Qian Date: Fri, 16 Dec 2022 09:30:33 +0100 Subject: media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data The curr pointer has advanced 14 bytes in jpeg_parse_app14_data. 1. jpeg_get_word_be(stream), it goes forward 2 bytes. 2. jpeg_skip(stream, 11), it goes forward 11 bytes. 3. jpeg_get_byte(stream), it goes forward 1 bytes. so the remain bytes of this segment should be (lp - 2 - 11 - 1), but not (lp - 2 - 11). if driver skip 1 extra bytes, the following parsing may go wrong. Fixes: b8035f7988a8 ("media: Add parsing for APP14 data segment in jpeg helpers") Signed-off-by: Ming Qian Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- drivers/media/v4l2-core/v4l2-jpeg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/v4l2-core/v4l2-jpeg.c b/drivers/media/v4l2-core/v4l2-jpeg.c index c2513b775f6a..75c2af763d55 100644 --- a/drivers/media/v4l2-core/v4l2-jpeg.c +++ b/drivers/media/v4l2-core/v4l2-jpeg.c @@ -474,7 +474,7 @@ static int jpeg_parse_app14_data(struct jpeg_stream *stream, *tf = ret; /* skip the rest of the segment, this ensures at least it is complete */ - skip = lp - 2 - 11; + skip = lp - 2 - 11 - 1; return jpeg_skip(stream, skip); } -- cgit v1.2.3 From 4b13ab58d1d71cb92e178a3c55ca0754d2835e93 Mon Sep 17 00:00:00 2001 From: Ming Qian Date: Fri, 16 Dec 2022 10:08:44 +0100 Subject: media: v4l2-jpeg: ignore the unknown APP14 marker The legal identifier of APP14 is "Adobe\0", but sometimes it may be "This is an unknown APP marker . Compliant decoders must ignore it." In this case, just ignore it. It won't affect the decode result. Fixes: b8035f7988a8 ("media: Add parsing for APP14 data segment in jpeg helpers") Signed-off-by: Ming Qian Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- drivers/media/v4l2-core/v4l2-jpeg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/v4l2-core/v4l2-jpeg.c b/drivers/media/v4l2-core/v4l2-jpeg.c index 75c2af763d55..94435a7b6816 100644 --- a/drivers/media/v4l2-core/v4l2-jpeg.c +++ b/drivers/media/v4l2-core/v4l2-jpeg.c @@ -460,7 +460,7 @@ static int jpeg_parse_app14_data(struct jpeg_stream *stream, /* Check for "Adobe\0" in Ap1..6 */ if (stream->curr + 6 > stream->end || strncmp(stream->curr, "Adobe\0", 6)) - return -EINVAL; + return jpeg_skip(stream, lp - 2); /* get to Ap12 */ ret = jpeg_skip(stream, 11); -- cgit v1.2.3 From 4d715e34d9cf81b3b476e0377984542d2b580207 Mon Sep 17 00:00:00 2001 From: Xu Yang Date: Thu, 15 Dec 2022 13:54:09 +0800 Subject: usb: chipidea: core: fix possible constant 0 if use IS_ERR(ci->role_switch) After successfully probed, ci->role_switch would only be NULL or a valid pointer. IS_ERR(ci->role_switch) will always return 0. So no need to wrap it with IS_ERR, otherwise the logic is wrong. Fixes: e1b5d2bed67c ("usb: chipidea: core: handle usb role switch in a common way") cc: Signed-off-by: Xu Yang Link: https://lore.kernel.org/r/20221215055409.3760523-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/chipidea/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c index cf53bcee0a8f..4a15b8bec631 100644 --- a/drivers/usb/chipidea/core.c +++ b/drivers/usb/chipidea/core.c @@ -1355,12 +1355,12 @@ static void ci_extcon_wakeup_int(struct ci_hdrc *ci) cable_id = &ci->platdata->id_extcon; cable_vbus = &ci->platdata->vbus_extcon; - if ((!IS_ERR(cable_id->edev) || !IS_ERR(ci->role_switch)) + if ((!IS_ERR(cable_id->edev) || ci->role_switch) && ci->is_otg && (otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS)) ci_irq(ci); - if ((!IS_ERR(cable_vbus->edev) || !IS_ERR(ci->role_switch)) + if ((!IS_ERR(cable_vbus->edev) || ci->role_switch) && ci->is_otg && (otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS)) ci_irq(ci); -- cgit v1.2.3 From 574606349f5420c920eaf16c811ccad196df1134 Mon Sep 17 00:00:00 2001 From: Feng Guo Date: Tue, 3 Jan 2023 17:43:21 +0800 Subject: LF-7941 ethosu: fix potential out-of-bounds issue Fix coverity Issue CID 24233199-24233208,24233210,22841322 1. The index will out-of-bounds when rsp->ifm_count or rsp->ofm_count is larger than ETHOSU_CORE_BUFFER_MAX, so add checking for these two counters. 2. Add return value checking for wait_for_completion_interruptible. Signed-off-by: Feng Guo Reviewed-by: Peng Fan Acked-by: Jason Liu --- drivers/staging/ethosu/ethosu_device.c | 4 +--- drivers/staging/ethosu/ethosu_network_info.c | 2 +- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/staging/ethosu/ethosu_device.c b/drivers/staging/ethosu/ethosu_device.c index fdc44ec9a075..b0be4bcba7a1 100644 --- a/drivers/staging/ethosu/ethosu_device.c +++ b/drivers/staging/ethosu/ethosu_device.c @@ -228,10 +228,8 @@ static int ethosu_open(struct inode *inode, if (!ret && atomic_read(&rproc->power) == 0) { init_completion(&edev->erp.rpmsg_ready); ret = rproc_boot(rproc); - if (ret) + if (ret || wait_for_completion_interruptible(&edev->erp.rpmsg_ready)) dev_err(edev->dev, "could not boot a remote processor\n"); - else - wait_for_completion_interruptible(&edev->erp.rpmsg_ready); } else { dev_err(edev->dev, "can't change firmware or remote processor is running\n"); } diff --git a/drivers/staging/ethosu/ethosu_network_info.c b/drivers/staging/ethosu/ethosu_network_info.c index 5584666071b0..3b8ad935505a 100644 --- a/drivers/staging/ethosu/ethosu_network_info.c +++ b/drivers/staging/ethosu/ethosu_network_info.c @@ -147,7 +147,7 @@ void ethosu_network_info_rsp(struct ethosu_device *edev, goto signal_complete; } - if (rsp->ifm_count > ETHOSU_FD_MAX || rsp->ofm_count > ETHOSU_FD_MAX) { + if (rsp->ifm_count > ETHOSU_CORE_BUFFER_MAX || rsp->ofm_count > ETHOSU_CORE_BUFFER_MAX) { info->errno = -ENFILE; goto signal_complete; } -- cgit v1.2.3 From 2387b23055aafbdf079e45dd4b1de8b636752fe6 Mon Sep 17 00:00:00 2001 From: Guangliu Ding Date: Fri, 17 Mar 2023 16:05:23 +0800 Subject: MGS-7080: Fix memory leak in DPU bliteng fence Memory leak is caused by bliteng fence not freed. sync_file_create and sync_file_get_fence calls dma_fence_get and will increase refcount in bliteng fence. bliteng fence will be freed after refcount returns to 0. Need to call dma_fence_put to decrease refcount. Signed-off-by: Guangliu Ding Acked-by: Jason Liu --- drivers/gpu/imx/dpu-blit/dpu-blit.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/imx/dpu-blit/dpu-blit.c b/drivers/gpu/imx/dpu-blit/dpu-blit.c index 72e1c5f234ba..eef1f41156dd 100644 --- a/drivers/gpu/imx/dpu-blit/dpu-blit.c +++ b/drivers/gpu/imx/dpu-blit/dpu-blit.c @@ -301,6 +301,8 @@ int dpu_be_get_fence(struct dpu_bliteng *dpu_be) goto failed; } + dma_fence_put(&fence->base); + /* Get the unused file descriptor */ fd = get_unused_fd_flags(O_CLOEXEC); if (fd < 0) { @@ -369,9 +371,8 @@ int dpu_be_set_fence(struct dpu_bliteng *dpu_be, int fd) /* Setup the fence and active it asynchronously */ dpu_be_emit_fence(dpu_be, fence, false); - /* Increase fence and base reference */ + /* Increase fence reference */ atomic_inc(&fence->refcnt); - dma_fence_get(&fence->base); return 0; } -- cgit v1.2.3 From 68b8d7ba3da0dd70e384e164a33ef5ee88ce8ca1 Mon Sep 17 00:00:00 2001 From: Pankaj Gupta Date: Thu, 23 Mar 2023 17:14:43 +0530 Subject: LF-7709-1 arm64: dts: imx8ulp: use a reserved mem-ranges to constrain ele-mu dma-range EdgeLock Enclave are has a hardware limitation of restricted access to the DDR memory range: - 0x80000000 0x9FFFFFFF ELE-MU driver requireis 1MB of memory. In this patch the we are reserving 1MB of ddr memory region from the lower 32-bit range. Initially the driver was dependent on the dma-ranges property, added as part of the commit: e24cdd398372. Although dma-ranges property can restrict the dma-mask, but allocation is not reliable. This due to the memory allocation strategy as the followings: - dma-allocate_coherent -> alloc pages -> check dma regions -> re-alloc pages from DMA/32_ZONES->check dma regions. The flow is alloc pages then check the regions, which will result in returning failure when region checks failed in the last step. So, using dma-regions is likely returned failure, and not reliable even if there is plenty of memory in the system which is suitable. This could cause the HSM operation to fail, resulting in a kernel crash. This patch fixes the limitation associated with the dma-ranges property. Since, original approach of using dma-ranges was not stable, this patch should be squashed with the old commit. Signed-off-by: Dong Aisheng Signed-off-by: Pankaj Gupta Reviewed-by: Jason Liu --- arch/arm64/boot/dts/freescale/imx8ulp-evk.dts | 10 ++++++++++ arch/arm64/boot/dts/freescale/imx8ulp.dtsi | 3 --- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/arch/arm64/boot/dts/freescale/imx8ulp-evk.dts b/arch/arm64/boot/dts/freescale/imx8ulp-evk.dts index e19e35ab0474..c4e2b8c31394 100644 --- a/arch/arm64/boot/dts/freescale/imx8ulp-evk.dts +++ b/arch/arm64/boot/dts/freescale/imx8ulp-evk.dts @@ -89,6 +89,12 @@ no-map; }; + ele_reserved: ele-reserved@90000000 { + compatible = "shared-dma-pool"; + reg = <0 0x90000000 0 0x100000>; + no-map; + }; + vdev0vring0: vdev0vring0@aff00000 { reg = <0 0xaff00000 0 0x8000>; no-map; @@ -220,6 +226,10 @@ status = "okay"; }; +&ele_mu { + memory-region = <&ele_reserved>; +}; + &fec { pinctrl-names = "default", "sleep"; pinctrl-0 = <&pinctrl_enet>; diff --git a/arch/arm64/boot/dts/freescale/imx8ulp.dtsi b/arch/arm64/boot/dts/freescale/imx8ulp.dtsi index 9ffb78622891..445d36f8c7d8 100644 --- a/arch/arm64/boot/dts/freescale/imx8ulp.dtsi +++ b/arch/arm64/boot/dts/freescale/imx8ulp.dtsi @@ -257,8 +257,6 @@ }; ele_mu: ele-mu { - #address-cells = <1>; - #size-cells = <1>; compatible = "fsl,imx-ele"; mboxes = <&s4muap 0 0 &s4muap 1 0>; mbox-names = "tx", "rx"; @@ -266,7 +264,6 @@ fsl,ele_mu_id = <2>; fsl,ele_mu_max_users = <4>; status = "okay"; - dma-ranges = <0x80000000 0x80000000 0x20000000>; sram-pool = <&sram0>; }; -- cgit v1.2.3 From 119ff3c05b0bf025b49326884e239334d5857d06 Mon Sep 17 00:00:00 2001 From: Pankaj Gupta Date: Thu, 8 Dec 2022 17:58:27 +0530 Subject: LF-7709-2 firmware: imx: ele: reserved mem-ranges to constrain ele-mu dma-range Enforcing the use of reserved mem-ranges to constrain ele-mu dma-range, in the ele-mu driver. As part ele-mu driver remove-module, release reserved mem-ranges. Signed-off-by: Dong Aisheng Signed-off-by: Gaurav Jain Signed-off-by: Pankaj Gupta --- drivers/firmware/imx/ele_mu.c | 28 ++++++++++++++++++++++++++++ drivers/firmware/imx/ele_mu.h | 4 ++++ 2 files changed, 32 insertions(+) diff --git a/drivers/firmware/imx/ele_mu.c b/drivers/firmware/imx/ele_mu.c index 7b7d4c64407c..ada5e4689ad6 100644 --- a/drivers/firmware/imx/ele_mu.c +++ b/drivers/firmware/imx/ele_mu.c @@ -19,6 +19,7 @@ #include #include #include +#include #include #include #include @@ -30,22 +31,27 @@ #define ELE_PING_INTERVAL (3600 * HZ) #define ELE_TRNG_STATE_OK 0x203 +#define RESERVED_DMA_POOL BIT(1) + struct ele_mu_priv *ele_priv_export; struct imx_info { bool socdev; /* platform specific flag to enable/disable the Sentinel True RNG */ bool enable_ele_trng; + bool reserved_dma_ranges; }; static const struct imx_info imx8ulp_info = { .socdev = true, .enable_ele_trng = false, + .reserved_dma_ranges = true, }; static const struct imx_info imx93_info = { .socdev = false, .enable_ele_trng = true, + .reserved_dma_ranges = false, }; static const struct of_device_id ele_mu_match[] = { @@ -990,6 +996,16 @@ static int ele_mu_probe(struct platform_device *pdev) ele_priv_export = priv; + if (info && info->reserved_dma_ranges) { + ret = of_reserved_mem_device_init(dev); + if (ret) { + dev_err(dev, "failed to init reserved memory region %d\n", ret); + priv->flags &= (~RESERVED_DMA_POOL); + goto exit; + } + priv->flags |= RESERVED_DMA_POOL; + } + if (info && info->socdev) { ret = imx_soc_device_register(pdev); if (ret) { @@ -1015,6 +1031,13 @@ static int ele_mu_probe(struct platform_device *pdev) return devm_of_platform_populate(dev); exit: + /* if execution control reaches here, ele-mu probe fail. + * hence doing the cleanup + */ + if (priv->flags & RESERVED_DMA_POOL) { + of_reserved_mem_device_release(dev); + priv->flags &= (~RESERVED_DMA_POOL); + } return ret; } @@ -1027,6 +1050,11 @@ static int ele_mu_remove(struct platform_device *pdev) mbox_free_channel(priv->tx_chan); mbox_free_channel(priv->rx_chan); + if (priv->flags & RESERVED_DMA_POOL) { + of_reserved_mem_device_release(&pdev->dev); + priv->flags &= (~RESERVED_DMA_POOL); + } + return 0; } diff --git a/drivers/firmware/imx/ele_mu.h b/drivers/firmware/imx/ele_mu.h index 6584142a4c38..bfe891b3a7ab 100644 --- a/drivers/firmware/imx/ele_mu.h +++ b/drivers/firmware/imx/ele_mu.h @@ -135,6 +135,10 @@ struct ele_mu_priv { struct ele_api_msg tx_msg, rx_msg; struct completion done; spinlock_t lock; + /* Flag to retain the state of initialization done at + * the time of ele-mu probe. + */ + int flags; }; int get_ele_mu_priv(struct ele_mu_priv **export); -- cgit v1.2.3 From 8f5bcc2d38347368828b3aacadfe5276533827e5 Mon Sep 17 00:00:00 2001 From: Gaurav Jain Date: Wed, 21 Dec 2022 12:23:47 +0530 Subject: LF-7787: firmware: imx: ele: wake up list of dev-ctx on driver resume Created list of all dev-ctx during ele mu driver probe. on driver resume, this list is used to wakeup all the dev-ctx. This way all dev-ctx resume their task. Signed-off-by: Gaurav Jain Reviewed-by: Pankaj Gupta Reviewed-by: Varun Sethi --- drivers/firmware/imx/ele_mu.c | 24 ++++++++++++++++++++++++ drivers/firmware/imx/ele_mu.h | 2 ++ 2 files changed, 26 insertions(+) diff --git a/drivers/firmware/imx/ele_mu.c b/drivers/firmware/imx/ele_mu.c index ada5e4689ad6..4b2c91fa93e5 100644 --- a/drivers/firmware/imx/ele_mu.c +++ b/drivers/firmware/imx/ele_mu.c @@ -942,6 +942,9 @@ static int ele_mu_probe(struct platform_device *pdev) goto exit; } + priv->max_dev_ctx = max_nb_users; + priv->ctxs = devm_kzalloc(dev, sizeof(dev_ctx) * max_nb_users, GFP_KERNEL); + /* Create users */ for (i = 0; i < max_nb_users; i++) { dev_ctx = devm_kzalloc(dev, sizeof(*dev_ctx), GFP_KERNEL); @@ -955,6 +958,9 @@ static int ele_mu_probe(struct platform_device *pdev) dev_ctx->dev = dev; dev_ctx->status = MU_FREE; dev_ctx->priv = priv; + + priv->ctxs[i] = dev_ctx; + /* Default value invalid for an header. */ init_waitqueue_head(&dev_ctx->wq); @@ -1058,10 +1064,28 @@ static int ele_mu_remove(struct platform_device *pdev) return 0; } +#ifdef CONFIG_PM_SLEEP +static int ele_mu_resume(struct device *dev) +{ + struct ele_mu_priv *priv = dev_get_drvdata(dev); + int i; + + for (i = 0; i < priv->max_dev_ctx; i++) + wake_up_interruptible(&priv->ctxs[i]->wq); + + return 0; +} +#endif + +static const struct dev_pm_ops ele_mu_pm = { + SET_SYSTEM_SLEEP_PM_OPS(NULL, ele_mu_resume) +}; + static struct platform_driver ele_mu_driver = { .driver = { .name = "fsl-ele-mu", .of_match_table = ele_mu_match, + .pm = &ele_mu_pm, }, .probe = ele_mu_probe, .remove = ele_mu_remove, diff --git a/drivers/firmware/imx/ele_mu.h b/drivers/firmware/imx/ele_mu.h index bfe891b3a7ab..fded52d1d3d9 100644 --- a/drivers/firmware/imx/ele_mu.h +++ b/drivers/firmware/imx/ele_mu.h @@ -139,6 +139,8 @@ struct ele_mu_priv { * the time of ele-mu probe. */ int flags; + int max_dev_ctx; + struct ele_mu_device_ctx **ctxs; }; int get_ele_mu_priv(struct ele_mu_priv **export); -- cgit v1.2.3 From 3206376137e9e1ac9accc8fa2e87b583ae93add6 Mon Sep 17 00:00:00 2001 From: Gaurav Jain Date: Tue, 20 Dec 2022 18:15:30 +0530 Subject: LF-7786-1: firmware: imx: ele: split ele_trng_enable code ele start rng is required for all platforms with sentinel. so added common api ele_do_start_rng to start sentinel rng. hwrng initialization is needed for i.MX93, hence separated ele_trng_init from start rng. Signed-off-by: Gaurav Jain Reviewed-by: Pankaj Gupta Reviewed-by: Varun Sethi --- drivers/firmware/imx/ele_mu.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/drivers/firmware/imx/ele_mu.c b/drivers/firmware/imx/ele_mu.c index 4b2c91fa93e5..8c5061dad5ca 100644 --- a/drivers/firmware/imx/ele_mu.c +++ b/drivers/firmware/imx/ele_mu.c @@ -237,7 +237,7 @@ static int imx_soc_device_register(struct platform_device *pdev) return 0; } -static int ele_trng_enable(struct platform_device *pdev) +static int ele_do_start_rng(void) { int ret; int count = 5; @@ -268,8 +268,9 @@ static int ele_trng_enable(struct platform_device *pdev) return -EIO; } - return ele_trng_init(&pdev->dev); + return 0; } + /* * File operations for user-space */ @@ -1021,8 +1022,13 @@ static int ele_mu_probe(struct platform_device *pdev) } } - if (info && info->enable_ele_trng) { - ret = ele_trng_enable(pdev); + /* start ele rng */ + ret = ele_do_start_rng(); + if (ret) + dev_err(dev, "Failed to start ele rng\n"); + + if (!ret && info && info->enable_ele_trng) { + ret = ele_trng_init(dev); if (ret) dev_err(dev, "Failed to init ele-trng\n"); } @@ -1068,11 +1074,15 @@ static int ele_mu_remove(struct platform_device *pdev) static int ele_mu_resume(struct device *dev) { struct ele_mu_priv *priv = dev_get_drvdata(dev); - int i; + int i, ret; for (i = 0; i < priv->max_dev_ctx; i++) wake_up_interruptible(&priv->ctxs[i]->wq); + ret = ele_do_start_rng(); + if (ret) + dev_err(dev, "Failed to start ele rng on resume\n"); + return 0; } #endif -- cgit v1.2.3 From 82819a6460f35e6801809e7cfa98a00e0b8b52b8 Mon Sep 17 00:00:00 2001 From: Gaurav Jain Date: Thu, 23 Mar 2023 16:37:09 +0530 Subject: LF-8071-1 arm64: dts: imx93: use a reserved mem-ranges to constrain ele-mu dma-range sentinel cannot read/write DDR in the range - 0xE0000000 0xFFFFFFFF while genrating random numbers with hwrng device, sometimes output address is allocated from the range which is not accessible to sentinel. so we are reserving 1MB of ddr memory to make sure that the memory is allocated from the reserved mem range. Fixes: 45df0f582836 ("LF-7285: firmware: imx: ele: Add support for ELE HW Random Number Generator") Signed-off-by: Gaurav Jain --- arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts | 10 ++++++++++ arch/arm64/boot/dts/freescale/imx93-9x9-qsb.dts | 10 ++++++++++ arch/arm64/boot/dts/freescale/imx93.dtsi | 3 --- 3 files changed, 20 insertions(+), 3 deletions(-) diff --git a/arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts b/arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts index 13e9e844d8fe..e86c578a455a 100644 --- a/arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts +++ b/arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts @@ -8,6 +8,10 @@ #include #include "imx93.dtsi" +&ele_mu { + memory-region = <&ele_reserved>; +}; + / { model = "NXP i.MX93 11X11 EVK board"; compatible = "fsl,imx93-11x11-evk", "fsl,imx93"; @@ -65,6 +69,12 @@ reg = <0 0xa4020000 0 0x100000>; no-map; }; + + ele_reserved: ele-reserved@a4120000 { + compatible = "shared-dma-pool"; + reg = <0 0xa4120000 0 0x100000>; + no-map; + }; }; cm33: imx93-cm33 { diff --git a/arch/arm64/boot/dts/freescale/imx93-9x9-qsb.dts b/arch/arm64/boot/dts/freescale/imx93-9x9-qsb.dts index 561c3ede79ce..a97df512c5f2 100644 --- a/arch/arm64/boot/dts/freescale/imx93-9x9-qsb.dts +++ b/arch/arm64/boot/dts/freescale/imx93-9x9-qsb.dts @@ -8,6 +8,10 @@ #include #include "imx93.dtsi" +&ele_mu { + memory-region = <&ele_reserved>; +}; + / { model = "NXP i.MX93 9x9 Quick Start Board"; compatible = "fsl,imx93-9x9-qsb", "fsl,imx93"; @@ -58,6 +62,12 @@ reg = <0 0xa4020000 0 0x100000>; no-map; }; + + ele_reserved: ele-reserved@a4120000 { + compatible = "shared-dma-pool"; + reg = <0 0xa4120000 0 0x100000>; + no-map; + }; }; cm33: imx93-cm33 { diff --git a/arch/arm64/boot/dts/freescale/imx93.dtsi b/arch/arm64/boot/dts/freescale/imx93.dtsi index 62d2b4fe45f9..6e4248d228a3 100644 --- a/arch/arm64/boot/dts/freescale/imx93.dtsi +++ b/arch/arm64/boot/dts/freescale/imx93.dtsi @@ -1259,8 +1259,6 @@ }; ele_mu: ele-mu { - #address-cells = <1>; - #size-cells = <1>; compatible = "fsl,imx93-ele"; mboxes = <&s4muap 0 0 &s4muap 1 0>; mbox-names = "tx", "rx"; @@ -1268,7 +1266,6 @@ fsl,ele_mu_id = <2>; fsl,ele_mu_max_users = <4>; status = "okay"; - dma-ranges = <0x80000000 0x80000000 0x20000000>; }; media_blk_ctrl: blk-ctrl@4ac10000 { -- cgit v1.2.3 From d286e4718112144c5dfb3c9407932a38ddf0b2a8 Mon Sep 17 00:00:00 2001 From: Gaurav Jain Date: Wed, 12 Apr 2023 12:06:33 +0530 Subject: LF-8071-2 firmware: imx: ele: imx93: reserved mem-ranges to constrain ele-mu dma-range Enforcing the use of reserved mem-ranges to constrain ele-mu dma-range, in the ele-mu driver. Fixes: 45df0f582836 ("LF-7285: firmware: imx: ele: Add support for ELE HW Random Number Generator") Signed-off-by: Gaurav Jain --- drivers/firmware/imx/ele_mu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/firmware/imx/ele_mu.c b/drivers/firmware/imx/ele_mu.c index 8c5061dad5ca..a99689f90334 100644 --- a/drivers/firmware/imx/ele_mu.c +++ b/drivers/firmware/imx/ele_mu.c @@ -51,7 +51,7 @@ static const struct imx_info imx8ulp_info = { static const struct imx_info imx93_info = { .socdev = false, .enable_ele_trng = true, - .reserved_dma_ranges = false, + .reserved_dma_ranges = true, }; static const struct of_device_id ele_mu_match[] = { -- cgit v1.2.3 From c076f80fd42605b682a79f531ea43066edb7dd81 Mon Sep 17 00:00:00 2001 From: Jessie Hao Date: Fri, 28 Jul 2023 17:53:33 +0800 Subject: MA-21513 [#imx-3206] Fix AXI BUS ERROR on more than 4G DDR board. Meet GPU dump when run the below case on more than 4G DDR board. CtsNNAPITestCases TestRandomGraph/RandomGraphTest#LargeGraph_TENSOR_FLOAT16_Rank* The above 4G address can be rejected when doing _UserMemoryAttach. But will be used by _UserMemoryPhysical as os->paddingPage is allocated with __GFP_HIGHMEM. Here change __GFP_HIGHMEM to __GFP_DMA32 to avoid the GPU dump. Signed-off-by: Jessie Hao --- drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_os.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_os.c b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_os.c index 3b667aa1ea7c..09579f9efa34 100644 --- a/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_os.c +++ b/drivers/mxc/gpu-viv/hal/os/linux/kernel/gc_hal_kernel_os.c @@ -762,7 +762,12 @@ gckOS_Construct( gcmkONERROR(gcvSTATUS_OUT_OF_MEMORY); } - os->paddingPage = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | gcdNOWARN); +#if defined(CONFIG_ZONE_DMA32) && LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37) + os->paddingPage = alloc_page(GFP_KERNEL | __GFP_DMA32 | gcdNOWARN); +#else + os->paddingPage = alloc_page(GFP_KERNEL | __GFP_DMA | gcdNOWARN); +#endif + if (os->paddingPage == gcvNULL) { /* Out of memory. */ -- cgit v1.2.3 From 43276baa8af830eb56434a3a104b04e17deb5a48 Mon Sep 17 00:00:00 2001 From: Guangliu Ding Date: Thu, 27 Jul 2023 17:44:10 +0800 Subject: MGS-7293: arm64: dts: imx8mq: Update sign-off GPU frequency According to sign-off clock frequency, we update gpu_ahb from 800MHz to 400MHz on 8MQ. Signed-off-by: Guangliu Ding --- arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/boot/dts/freescale/imx8mq.dtsi b/arch/arm64/boot/dts/freescale/imx8mq.dtsi index a778acfeb1f5..6afbe75d6c7b 100755 --- a/arch/arm64/boot/dts/freescale/imx8mq.dtsi +++ b/arch/arm64/boot/dts/freescale/imx8mq.dtsi @@ -1652,7 +1652,7 @@ <&clk IMX8MQ_GPU_PLL_OUT>, <&clk IMX8MQ_GPU_PLL_OUT>, <&clk IMX8MQ_GPU_PLL_OUT>; - assigned-clock-rates = <800000000>, <800000000>, <800000000>, <800000000>; + assigned-clock-rates = <800000000>, <800000000>, <800000000>, <400000000>; power-domains = <&pgc_gpu>; status = "disabled"; }; -- cgit v1.2.3 From 81c3db7712e1509de4f967140145839a39f20cad Mon Sep 17 00:00:00 2001 From: Shengjiu Wang Date: Thu, 9 Mar 2023 15:13:37 +0800 Subject: ASoC: soc-pcm: fix hw->formats cleared by soc_pcm_hw_init() for dpcm The hw->formats may be set by snd_dmaengine_pcm_refine_runtime_hwparams() in component's startup()/open(), but soc_pcm_hw_init() will init hw->formats in dpcm_runtime_setup_fe() after component's startup()/open(), which causes the valuable hw->formats to be cleared. So need to store the hw->formats before initialization, then restore it after initialization. Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1678346017-3660-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown (cherry picked from commit 083a25b18d6ad9f1f540e629909aa3eaaaf01823) --- sound/soc/soc-pcm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 48f71bb81a2f..2d38b2619590 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -1557,10 +1557,14 @@ static void dpcm_runtime_setup_fe(struct snd_pcm_substream *substream) struct snd_pcm_hardware *hw = &runtime->hw; struct snd_soc_dai *dai; int stream = substream->stream; + u64 formats = hw->formats; int i; soc_pcm_hw_init(hw); + if (formats) + hw->formats &= formats; + for_each_rtd_cpu_dais(fe, i, dai) { struct snd_soc_pcm_stream *cpu_stream; -- cgit v1.2.3 From 81611e96ffc9bb937f272f46f86043f37dd0a084 Mon Sep 17 00:00:00 2001 From: Hui Wang Date: Thu, 13 Jul 2023 16:19:08 +0800 Subject: MA-21468-1 [#imx-3151] Fix GPU deadlock issue when do video stream stress test CL693528 [KERNEL SPACE] 6.4.x_234062: Merge CL693076 from 64x for IMX-3151 - GPU deadlock issue when do video stream stress test. Disable TX clock gating for QM_c0/m815/m865/m850D/m845s/8ULP/8.5 board to workaround HW bug#2385. By: xuan.huang. This picks VSI 0001-CL693528-KERNEL-SPACE-6.4.x_234062-Merge-CL693076-fr.patch Signed-off-by: Hui Wang --- drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_hardware.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_hardware.c b/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_hardware.c index e10d229bd8c1..227338b95d02 100644 --- a/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_hardware.c +++ b/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_hardware.c @@ -3079,6 +3079,12 @@ gckHARDWARE_InitializeHardware( || _IsHardwareMatch(Hardware, gcv7000, 0x6202) || _IsHardwareMatch(Hardware, gcv7000, 0x6203) || _IsHardwareMatch(Hardware, gcv7000, 0x6204) + || _IsHardwareMatch(Hardware, gcv7000, 0x6205) + || _IsHardwareMatch(Hardware, gcv7000, 0x6212) + || _IsHardwareMatch(Hardware, gcv7000, 0x6214) + || _IsHardwareMatch(Hardware, gcv600, 0x4653) + || _IsHardwareMatch(Hardware, gcv8000, 0x6201) + || _IsHardwareMatch(Hardware, gcv8000, 0x6204) || (gckHARDWARE_IsFeatureAvailable(Hardware, gcvFEATURE_TX_DESCRIPTOR) && !gckHARDWARE_IsFeatureAvailable(Hardware, gcvFEATURE_TX_DESC_CACHE_CLOCKGATE_FIX) ) -- cgit v1.2.3 From 614eaca710ed8a3f92c3b2f4a76e4f5823dad515 Mon Sep 17 00:00:00 2001 From: Julien Vuillaumier Date: Wed, 17 May 2023 09:07:48 +0200 Subject: MGS-7214: gpu: imx: dpu-blit: add generic dma-buf cache coherency management This change adds DRM_IOCTL_IMX_DPU_SYNC_DMABUF ioctl, that enables cache coherency handling for dma-bufs from a generic exporter, that are used with the DPU driver. Use case is typically for buffers that require read/write by CPU at some point and that are accessed through CPU cache for performance reasons. Signed-off-by: Julien Vuillaumier Reviewed-by: Xianzhong Li Reviewed-by: Guangliu Ding --- drivers/gpu/drm/imx/dpu/dpu-blit.c | 52 ++++++++++++++++++++++++++++++++++++-- drivers/gpu/drm/imx/dpu/dpu-blit.h | 4 +-- include/uapi/drm/imx_drm.h | 21 ++++++++++++++- 3 files changed, 72 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/imx/dpu/dpu-blit.c b/drivers/gpu/drm/imx/dpu/dpu-blit.c index 35d8429a400f..de59482668d1 100644 --- a/drivers/gpu/drm/imx/dpu/dpu-blit.c +++ b/drivers/gpu/drm/imx/dpu/dpu-blit.c @@ -1,5 +1,5 @@ /* - * Copyright 2017,2021-2022 NXP + * Copyright 2017,2021-2023 NXP * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -19,6 +19,7 @@ #include #include #include +#include #include #include #include @@ -215,13 +216,60 @@ static int imx_drm_dpu_get_param_ioctl(struct drm_device *drm_dev, void *data, return ret; } -const struct drm_ioctl_desc imx_drm_dpu_ioctls[3] = { +static int imx_drm_dpu_sync_dmabuf_ioctl(struct drm_device *drm_dev, void *data, + struct drm_file *file) +{ + struct drm_imx_dpu_sync_dmabuf *flush = data; + struct dma_buf *dmabuf; + struct dma_buf_attachment *attachment; + struct sg_table *sgt; + int direction; + int ret = 0; + + if (flush->direction == IMX_DPU_SYNC_TO_BOTH) + direction = DMA_BIDIRECTIONAL; + else if (flush->direction == IMX_DPU_SYNC_TO_DEVICE) + direction = DMA_TO_DEVICE; + else if (flush->direction == IMX_DPU_SYNC_TO_CPU) + direction = DMA_FROM_DEVICE; + else + direction = DMA_NONE; + + dmabuf = dma_buf_get(flush->dmabuf_fd); + if (IS_ERR(dmabuf)) { + drm_err(drm_dev, "failed to get dmabuf\n"); + return PTR_ERR(dmabuf); + } + attachment = dma_buf_attach(dmabuf, drm_dev->dev); + if (IS_ERR(attachment)) { + ret = PTR_ERR(attachment); + drm_err(drm_dev, "failed to attach dmabuf\n"); + goto err_put; + } + sgt = dma_buf_map_attachment(attachment, direction); + if (IS_ERR(sgt)) { + ret = PTR_ERR(sgt); + drm_err(drm_dev, "failed to get dmabuf sg_table\n"); + goto err_detach; + } + dma_buf_unmap_attachment(attachment, sgt, direction); +err_detach: + dma_buf_detach(dmabuf, attachment); +err_put: + dma_buf_put(dmabuf); + + return ret; +} + +const struct drm_ioctl_desc imx_drm_dpu_ioctls[4] = { DRM_IOCTL_DEF_DRV(IMX_DPU_SET_CMDLIST, imx_drm_dpu_set_cmdlist_ioctl, DRM_RENDER_ALLOW), DRM_IOCTL_DEF_DRV(IMX_DPU_WAIT, imx_drm_dpu_wait_ioctl, DRM_RENDER_ALLOW), DRM_IOCTL_DEF_DRV(IMX_DPU_GET_PARAM, imx_drm_dpu_get_param_ioctl, DRM_RENDER_ALLOW), + DRM_IOCTL_DEF_DRV(IMX_DPU_SYNC_DMABUF, imx_drm_dpu_sync_dmabuf_ioctl, + DRM_RENDER_ALLOW), }; static int dpu_bliteng_bind(struct device *dev, struct device *master, diff --git a/drivers/gpu/drm/imx/dpu/dpu-blit.h b/drivers/gpu/drm/imx/dpu/dpu-blit.h index cf429086cdf4..3af1bba1e5ff 100644 --- a/drivers/gpu/drm/imx/dpu/dpu-blit.h +++ b/drivers/gpu/drm/imx/dpu/dpu-blit.h @@ -1,7 +1,7 @@ /* SPDX-License-Identifier: GPL-2.0+ */ /* - * Copyright 2021 NXP + * Copyright 2021,2023 NXP */ #ifndef _DPU_DRM_BLIT_H_ @@ -10,7 +10,7 @@ #include #ifdef CONFIG_DRM_IMX_DPU -extern const struct drm_ioctl_desc imx_drm_dpu_ioctls[3]; +extern const struct drm_ioctl_desc imx_drm_dpu_ioctls[4]; #else const struct drm_ioctl_desc imx_drm_dpu_ioctls[] = {}; #endif diff --git a/include/uapi/drm/imx_drm.h b/include/uapi/drm/imx_drm.h index 8578e075f316..7d2189f67a74 100644 --- a/include/uapi/drm/imx_drm.h +++ b/include/uapi/drm/imx_drm.h @@ -1,5 +1,5 @@ /* - * Copyright 2017,2022 NXP + * Copyright 2017,2022-2023 NXP * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -43,6 +43,7 @@ struct drm_imx_dpu_frame_info { #define DRM_IMX_DPU_SET_CMDLIST 0x00 #define DRM_IMX_DPU_WAIT 0x01 #define DRM_IMX_DPU_GET_PARAM 0x02 +#define DRM_IMX_DPU_SYNC_DMABUF 0x03 #define DRM_IOCTL_IMX_DPU_SET_CMDLIST DRM_IOWR(DRM_COMMAND_BASE + \ DRM_IMX_DPU_SET_CMDLIST, struct drm_imx_dpu_set_cmdlist) @@ -50,6 +51,8 @@ struct drm_imx_dpu_frame_info { DRM_IMX_DPU_WAIT, struct drm_imx_dpu_wait) #define DRM_IOCTL_IMX_DPU_GET_PARAM DRM_IOWR(DRM_COMMAND_BASE + \ DRM_IMX_DPU_GET_PARAM, enum drm_imx_dpu_param) +#define DRM_IOCTL_IMX_DPU_SYNC_DMABUF DRM_IOW(DRM_COMMAND_BASE + \ + DRM_IMX_DPU_SYNC_DMABUF, struct drm_imx_dpu_sync_dmabuf) /** * struct drm_imx_dpu_set_cmdlist - ioctl argument for @@ -73,6 +76,22 @@ struct drm_imx_dpu_wait { __u64 user_data; }; +enum drm_imx_dpu_sync_direction { + IMX_DPU_SYNC_TO_CPU = 0, + IMX_DPU_SYNC_TO_DEVICE = 1, + IMX_DPU_SYNC_TO_BOTH = 2, +}; + +/** + * struct drm_imx_dpu_sync_dmabuf - ioctl argument for + * DRM_IMX_DPU_SYNC_DMABUF. + * + */ +struct drm_imx_dpu_sync_dmabuf { + __u32 dmabuf_fd; + __u32 direction; +}; + /** * enum drm_imx_dpu_param - ioctl argument for * DRM_IMX_DPU_GET_PARAM. -- cgit v1.2.3 From a7bd64fdace52efdce646b10b77fc6686434f99a Mon Sep 17 00:00:00 2001 From: Hui Wang Date: Thu, 13 Jul 2023 17:19:08 +0800 Subject: MA-21468-2 [#imx-3151] Fix GPU deadlock issue when do video stream stress test CL696036 [KERNEL SPACE] 6.4.x_234062: Merge CL696034 from 64x for IMX-3151 - GPU deadlock issue when do video stream stress test. Disable TX clock gating for 8QM board to workaround HW bug#2385. By: xuan.huang. This picks VSI 0002-CL696036-KERNEL-SPACE-6.4.x_234062-Merge-CL696034-fr.patch Signed-off-by: Hui Wang --- drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_hardware.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_hardware.c b/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_hardware.c index 227338b95d02..9638878bbccf 100644 --- a/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_hardware.c +++ b/drivers/mxc/gpu-viv/hal/kernel/arch/gc_hal_kernel_hardware.c @@ -3076,6 +3076,7 @@ gckHARDWARE_InitializeHardware( if (_IsHardwareMatch(Hardware, gcv4000, 0x5222) || _IsHardwareMatch(Hardware, gcv2000, 0x5108) + || _IsHardwareMatch(Hardware, gcv7000, 0x6009) || _IsHardwareMatch(Hardware, gcv7000, 0x6202) || _IsHardwareMatch(Hardware, gcv7000, 0x6203) || _IsHardwareMatch(Hardware, gcv7000, 0x6204) -- cgit v1.2.3 From 2c1973840fd8f7541c56853e104fe3504b402a84 Mon Sep 17 00:00:00 2001 From: Julien Vuillaumier Date: Tue, 4 Jul 2023 10:27:19 +0200 Subject: MGS-7214: gpu: imx: import DMA_BUF module namespace Build breaks when compiled as module, as follows: MODPOST Module.symvers ERROR: modpost: module imx-dpu-render uses symbol dma_buf_attach from namespace DMA_BUF, but does not import it. ERROR: modpost: module imx-dpu-render uses symbol dma_buf_map_attachment from namespace DMA_BUF, but does not import it. ERROR: modpost: module imx-dpu-render uses symbol dma_buf_unmap_attachment from namespace DMA_BUF, but does not import it. ERROR: modpost: module imx-dpu-render uses symbol dma_buf_get from namespace DMA_BUF, but does not import it. ERROR: modpost: module imx-dpu-render uses symbol dma_buf_put from namespace DMA_BUF, but does not import it. ERROR: modpost: module imx-dpu-render uses symbol dma_buf_detach from namespace DMA_BUF, but does not import it. Fixes: 5b8ce4a90377 ("MGS-7214: gpu: imx: dpu-blit: add generic dma-buf cache coherency management") Signed-off-by: Julien Vuillaumier Reviewed-by: Xianzhong Li Reviewed-by: Guangliu Ding --- drivers/gpu/drm/imx/dpu/dpu-blit.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/imx/dpu/dpu-blit.c b/drivers/gpu/drm/imx/dpu/dpu-blit.c index de59482668d1..deb88c2d7234 100644 --- a/drivers/gpu/drm/imx/dpu/dpu-blit.c +++ b/drivers/gpu/drm/imx/dpu/dpu-blit.c @@ -392,3 +392,4 @@ module_platform_driver(dpu_bliteng_driver); MODULE_LICENSE("GPL"); MODULE_AUTHOR("NXP Semiconductor"); MODULE_DESCRIPTION("i.MX DRM DPU BLITENG"); +MODULE_IMPORT_NS(DMA_BUF); -- cgit v1.2.3 From 50912be386017c8d2ca7f0c9c0a32fa7ac84a283 Mon Sep 17 00:00:00 2001 From: Rahul Kumar Yadav Date: Wed, 14 Jun 2023 17:09:50 +0530 Subject: LF-7374: firmware: imx: fix coverity issue in seco-mu Fix the coverity issue: 24243097: Untrusted value as argument, found in the SECO MU driver. Added max length condition for io.length, in case of flag SECO_MU_IO_FLAGS_SHE_V2X enabled Signed-off-by: Rahul Kumar Yadav (cherry picked from commit 018531830f1fb1354e1956521b5c873a755a1372) --- drivers/firmware/imx/seco_mu.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/firmware/imx/seco_mu.c b/drivers/firmware/imx/seco_mu.c index 75c721100915..ee84889029be 100644 --- a/drivers/firmware/imx/seco_mu.c +++ b/drivers/firmware/imx/seco_mu.c @@ -680,6 +680,12 @@ static int seco_mu_ioctl_setup_iobuf_handler(struct seco_mu_device_ctx *dev_ctx, shared_mem->pos += round_up(io.length, 8u); io.seco_addr = (u64)shared_mem->dma_addr + pos; } else { + if (io.length > MAX_DATA_SIZE_PER_USER) { + devctx_err(dev_ctx, "Buffer length exceeded the max limit\n"); + err = -ENOMEM; + goto exit; + } + io.seco_addr = (u64)addr; } -- cgit v1.2.3 From 9220bf6c14dc5477c6638f5016f8dd88c646990f Mon Sep 17 00:00:00 2001 From: Max Krummenacher Date: Mon, 19 Feb 2024 18:44:06 +0100 Subject: Revert "ASoC: ops: Remove unneeded delay.h inclusion" This reverts commit 339ba37942c9de7aeb7647b6a225c49cc3d7e0dc. --- sound/soc/soc-ops.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index a25656c4d978..7e1cbc23bba5 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -14,6 +14,7 @@ #include #include #include +#include #include #include #include -- cgit v1.2.3 From 8da9ec7456dcc055bccc8fefc81c026034a7676c Mon Sep 17 00:00:00 2001 From: Max Krummenacher Date: Mon, 19 Feb 2024 18:44:10 +0100 Subject: Revert "ASoC: ops: Clarify snd_soc_info_volsw_sx()" This reverts commit 6f668d2cbd2e2b87a3f347070704714453383712. --- sound/soc/soc-ops.c | 22 ++++++---------------- 1 file changed, 6 insertions(+), 16 deletions(-) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index 7e1cbc23bba5..8c0e7ad66eb2 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -203,8 +203,7 @@ EXPORT_SYMBOL_GPL(snd_soc_info_volsw); * Callback to provide information about a single mixer control, or a double * mixer control that spans 2 registers of the SX TLV type. SX TLV controls * have a range that represents both positive and negative values either side - * of zero but without a sign bit. min is the minimum register value, max is - * the number of steps. + * of zero but without a sign bit. * * Returns 0 for success. */ @@ -213,21 +212,12 @@ int snd_soc_info_volsw_sx(struct snd_kcontrol *kcontrol, { struct soc_mixer_control *mc = (struct soc_mixer_control *)kcontrol->private_value; - int max; - if (mc->platform_max) - max = mc->platform_max; - else - max = mc->max; - - if (max == 1 && !strstr(kcontrol->id.name, " Volume")) - uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN; - else - uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER; - - uinfo->count = snd_soc_volsw_is_stereo(mc) ? 2 : 1; - uinfo->value.integer.min = 0; - uinfo->value.integer.max = max; + snd_soc_info_volsw(kcontrol, uinfo); + /* Max represents the number of levels in an SX control not the + * maximum value, so add the minimum value back on + */ + uinfo->value.integer.max += mc->min; return 0; } -- cgit v1.2.3 From 3a47e76770c777f1d6d3601d11f595a55fb51d0b Mon Sep 17 00:00:00 2001 From: Max Krummenacher Date: Mon, 19 Feb 2024 18:44:11 +0100 Subject: Revert "ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()" This reverts commit d62dd3e291e061d66e088401e32f1119bcfdc7f3. --- sound/soc/soc-ops.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index 8c0e7ad66eb2..dfd7455c9f7a 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -451,12 +451,6 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol, val_mask = mask << rshift; val2 = (ucontrol->value.integer.value[1] + min) & mask; - - if (mc->platform_max && val2 > mc->platform_max) - return -EINVAL; - if (val2 > max) - return -EINVAL; - val2 = val2 << rshift; err = snd_soc_component_update_bits(component, reg2, val_mask, -- cgit v1.2.3 From 80c8662762f98e2f55374dff45698e002b90372f Mon Sep 17 00:00:00 2001 From: Max Krummenacher Date: Mon, 19 Feb 2024 18:44:12 +0100 Subject: Revert "ASoC: ops: Fix bounds check for _sx controls" This reverts commit 416f4b76240400260aaf0c4200565d63f49290d7. --- sound/soc/soc-ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index dfd7455c9f7a..d867f449d82d 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -435,7 +435,7 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol, val = ucontrol->value.integer.value[0]; if (mc->platform_max && val > mc->platform_max) return -EINVAL; - if (val > max) + if (val > max - min) return -EINVAL; val_mask = mask << shift; val = (val + min) & mask; -- cgit v1.2.3 From 711c394d90cf2e055e8fa90a8559fb29ca07233f Mon Sep 17 00:00:00 2001 From: Max Krummenacher Date: Mon, 19 Feb 2024 18:44:13 +0100 Subject: Revert "ASoC: ops: Check for negative values before reading them" This reverts commit 1c23070f17c5934e31db5c2dda79c681eedea538. --- sound/soc/soc-ops.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c index d867f449d82d..e73360e9de8f 100644 --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -316,26 +316,26 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol, if (sign_bit) mask = BIT(sign_bit + 1) - 1; - if (ucontrol->value.integer.value[0] < 0) - return -EINVAL; val = ucontrol->value.integer.value[0]; if (mc->platform_max && ((int)val + min) > mc->platform_max) return -EINVAL; if (val > max - min) return -EINVAL; + if (val < 0) + return -EINVAL; val = (val + min) & mask; if (invert) val = max - val; val_mask = mask << shift; val = val << shift; if (snd_soc_volsw_is_stereo(mc)) { - if (ucontrol->value.integer.value[1] < 0) - return -EINVAL; val2 = ucontrol->value.integer.value[1]; if (mc->platform_max && ((int)val2 + min) > mc->platform_max) return -EINVAL; if (val2 > max - min) return -EINVAL; + if (val2 < 0) + return -EINVAL; val2 = (val2 + min) & mask; if (invert) val2 = max - val2; @@ -430,13 +430,13 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol, int ret; unsigned int val, val_mask; - if (ucontrol->value.integer.value[0] < 0) - return -EINVAL; val = ucontrol->value.integer.value[0]; if (mc->platform_max && val > mc->platform_max) return -EINVAL; if (val > max - min) return -EINVAL; + if (val < 0) + return -EINVAL; val_mask = mask << shift; val = (val + min) & mask; val = val << shift; -- cgit v1.2.3