linux-toradex.git/drivers/pinctrl/sunxi, branch v5.0

pinctrl: sunxi: Correct number of IRQ banks on H6 main pin controller

2019-01-22T09:52:39+00:00

The H6 main pin controller has four banks of interrupt-triggering pins.
The driver as originally submitted only specified three, but had pin
descriptions referencing a fourth bank. This results in a out-of-bounds
access into .irq_array of struct sunxi_pinctrl. This however did not
result in a crash until v4.20, with commit a66d972465d1 ("devres: Align
data[] to ARCH_KMALLOC_MINALIGN"), which changed the alignment of memory
region returned by devm_kcalloc(). The increase likely moved the
out-of-bounds access into the next, unmapped page.

With KASAN on, the bug is quite clear:

    BUG: KASAN: slab-out-of-bounds in sunxi_pinctrl_init_with_variant+0x49c/0x12b8
    Write of size 4 at addr ffff80002c680280 by task swapper/0/1

    CPU: 2 PID: 1 Comm: swapper/0 Not tainted 5.0.0-rc1-00016-gc480a5e6a077 #3
    Hardware name: OrangePi Lite2 (DT)
    Call trace:
     dump_backtrace+0x0/0x220
     show_stack+0x14/0x20
     dump_stack+0xac/0xd4
     print_address_description+0x60/0x25c
     kasan_report+0x14c/0x1ac
     __asan_store4+0x80/0xa0
     sunxi_pinctrl_init_with_variant+0x49c/0x12b8
     h6_pinctrl_probe+0x18/0x20
     platform_drv_probe+0x6c/0xc8
     really_probe+0x244/0x4b0
     driver_probe_device.part.4+0x11c/0x164
     __driver_attach+0x120/0x190
     bus_for_each_dev+0xe8/0x158
     driver_attach+0x30/0x40
     bus_add_driver+0x308/0x318
     driver_register+0xbc/0x1d0
     __platform_driver_register+0x7c/0x88
     h6_pinctrl_driver_init+0x18/0x20
     do_one_initcall+0xd4/0x208
     kernel_init_freeable+0x230/0x2c8
     kernel_init+0x10/0x108
     ret_from_fork+0x10/0x1c

    Allocated by task 1:
     kasan_kmalloc.part.0+0x4c/0x100
     kasan_kmalloc+0xc4/0xe8
     kasan_slab_alloc+0x14/0x20
     __kmalloc_track_caller+0x130/0x238
     devm_kmalloc+0x34/0xd0
     sunxi_pinctrl_init_with_variant+0x1d8/0x12b8
     h6_pinctrl_probe+0x18/0x20
     platform_drv_probe+0x6c/0xc8
     really_probe+0x244/0x4b0
     driver_probe_device.part.4+0x11c/0x164
     __driver_attach+0x120/0x190
     bus_for_each_dev+0xe8/0x158
     driver_attach+0x30/0x40
     bus_add_driver+0x308/0x318
     driver_register+0xbc/0x1d0
     __platform_driver_register+0x7c/0x88
     h6_pinctrl_driver_init+0x18/0x20
     do_one_initcall+0xd4/0x208
     kernel_init_freeable+0x230/0x2c8
     kernel_init+0x10/0x108
     ret_from_fork+0x10/0x1c

    Freed by task 0:
    (stack is not available)

    The buggy address belongs to the object at ffff80002c680080
     which belongs to the cache kmalloc-512 of size 512
    The buggy address is located 0 bytes to the right of
     512-byte region [ffff80002c680080, ffff80002c680280)
    The buggy address belongs to the page:
    page:ffff7e0000b1a000 count:1 mapcount:0 mapping:ffff80002e00c780 index:0xffff80002c683c80 compound_mapcount: 0
    flags: 0x10200(slab|head)
    raw: 0000000000010200 ffff80002e003a10 ffff80002e003a10 ffff80002e00c780
    raw: ffff80002c683c80 0000000000100001 00000001ffffffff 0000000000000000
    page dumped because: kasan: bad access detected

    Memory state around the buggy address:
     ffff80002c680180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
     ffff80002c680200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    >ffff80002c680280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
		       ^
     ffff80002c680300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
     ffff80002c680380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

Correct the number of IRQ banks so there are no more mismatches.

Fixes: c8a830904991 ("pinctrl: sunxi: add support for the Allwinner H6 main pin controller")
Cc: 
Signed-off-by: Chen-Yu Tsai 
Tested-by: Neil Armstrong 
Acked-by: Maxime Ripard 
Signed-off-by: Linus Walleij

pinctrl: sunxi: Consider pin_base when calculating regulator array index

2019-01-14T15:12:59+00:00

On most newer Allwinner SoCs, there are two pinctrl devices, the PIO and
R_PIO. PIO covers pin-banks PA to PI (PJ and PK have not been seen),
while R_PIO covers PL to PN. The regulator array only has space for 12
entries, which was designed to cover PA to PL. On the A80, the pin banks
go up to PN, which would be the 14th entry in the regulator array.
However since the driver only needs to track regulators for its own pin
banks, the array only needs to have 9 entries, and also take in to
account the value of pin_base, such that the regulator for the first
pin-bank of the pinctrl device, be it "PA" or "PL" uses the first entry
of the array.

Base the regulator array index on pin_base, such that "PA" for PIO and
"PL" for R_PIO both take the first element within their respective
device's regulator array.

Also decrease the size of the regulator array to 9, just enough to cover
"PA" to "PI".

Fixes: 9a2a566adb00 ("pinctrl: sunxi: Deal with per-bank regulators")
Signed-off-by: Chen-Yu Tsai 
Signed-off-by: Linus Walleij

pinctrl: sunxi: Fix and simplify pin bank regulator handling

2019-01-14T15:09:27+00:00

The new per-pin-bank regulator handling code in the sunxi pinctrl driver
has mismatched conditions for enabling and disabling the regulator: it
is enabled each time a pin is requested, but only disabled when the
pin-bank's reference count reaches zero.

Since we are doing reference counting already, there's no need to enable
the regulator each time a pin is requested. Instead we can just do it
for the first requested pin of each pin-bank. Thus we can reverse the
test and bail out early if it's not the first occurrence.

Fixes: 9a2a566adb00 ("pinctrl: sunxi: Deal with per-bank regulators")
Acked-by: Maxime Ripard 
Signed-off-by: Chen-Yu Tsai 
Signed-off-by: Linus Walleij

Merge tag 'pinctrl-v4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

2019-01-01T21:19:16+00:00

Pull pin control updates from Linus Walleij:
 "We have no core changes but lots of incremental development in drivers
  all over the place: Renesas, NXP, Mediatek and Actions Semiconductor
  keep churning out new SoCs.

  I have some subtree maintainers for Renesas and Intel helping out to
  keep down the load, it's been working smoothly (Samsung also have a
  subtree but it was not used this cycle.)

  New drivers:

   - NXP (ex Freescale) i.MX 8 QXP SoC driver.

   - Mediatek MT6797 SoC driver.

   - Mediatek MT7629 SoC driver.

   - Actions Semiconductor S700 SoC driver.

   - Renesas RZ/A2 SoC driver.

   - Allwinner sunxi suniv F1C100 SoC driver.

   - Qualcomm PMS405 PMIC driver.

   - Microsemi Ocelot Jaguar2 SoC driver.

  Improvements:

   - Some RT improvements (using raw spinlocks where appropriate).

   - A lot of new pin sets on the Renesas PFC pin controllers.

   - GPIO hogs now work on the Qualcomm SPMI/SSBI pin controller GPIO
     chips, and Xway.

   - Major modernization of the Intel pin control drivers.

   - STM32 pin control driver will now synchronize usage of pins with
     another CPU using a hardware spinlock"

* tag 'pinctrl-v4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (145 commits)
  dt-bindings: arm: fsl-scu: add imx8qm pinctrl support
  pinctrl: freescale: Break dependency on SOC_IMX8MQ for i.MX8MQ
  pinctrl: imx-scu: Depend on IMX_SCU
  pinctrl: ocelot: Add dependency on HAS_IOMEM
  pinctrl: ocelot: add MSCC Jaguar2 support
  pinctrl: bcm: ns: support updated DT binding as syscon subnode
  dt-bindings: pinctrl: bcm4708-pinmux: rework binding to use syscon
  MAINTAINERS: merge at91 pinctrl entries
  pinctrl: imx8qxp: break the dependency on SOC_IMX8QXP
  pinctrl: uniphier: constify uniphier_pinctrl_socdata
  pinctrl: mediatek: improve Kconfig dependencies
  pinctrl: msm: mark PM functions as __maybe_unused
  dt-bindings: pinctrl: sunxi: Add supply properties
  pinctrl: meson: meson8b: add the missing GPIO_GROUPs for BOOT and CARD
  pinctrl: meson: meson8: add the missing GPIO_GROUPs for BOOT and CARD
  pinctrl: meson: meson8: rename the "gpio" function to "gpio_periphs"
  pinctrl: meson: meson8: rename the "gpio" function to "gpio_periphs"
  pinctrl: meson: meson8b: fix the GPIO function for the GPIOAO pins
  pinctrl: meson: meson8: fix the GPIO function for the GPIOAO pins
  pinctrl: sh-pfc: Make pinmux_cfg_reg.var_field_width[] variable-length
  ...

pinctrl: sunxi: Deal with per-bank regulators

2018-12-14T15:07:59+00:00

The Allwinner SoCs have on most of their GPIO banks a regulator input.

This issue was mainly ignored so far because either the regulator was a
static regulator that would be providing power anyway, or the bank was used
for a feature unsupported so far (CSI). For the odd cases, enabling it in
the bootloader was the preferred option.

However, now that we are starting to support those features, and that we
can't really rely on the bootloader for this, we need to model those
regulators as such in the DT.

This is slightly more complicated than what it looks like, since some
regulators will be tied to the PMIC, and in order to have access to the
PMIC bus, you need to mux its pins, which will need the pinctrl driver,
that needs the regulator driver to be registered. And this is how you get a
circular dependency.

In practice however, the hardware cannot fall into this case since it would
result in a completely unusable bus. In order to avoid that circular
dependency, we can thus get and enable the regulators at pin_request time.
We'll then need to account for the references of all the pins of a
particular branch to know when to put the reference, but it works pretty
nicely once implemented.

Signed-off-by: Maxime Ripard 
Signed-off-by: Linus Walleij

pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11

2018-12-07T12:32:19+00:00

Pin PH11 is used on various A83T board to detect a change in the OTG
port's ID pin, as in when an OTG host cable is plugged in.

The incorrect offset meant the gpiochip/irqchip was activating the wrong
pin for interrupts.

Fixes: 4730f33f0d82 ("pinctrl: sunxi: add allwinner A83T PIO controller support")
Cc: 
Signed-off-by: Chen-Yu Tsai 
Acked-by: Maxime Ripard 
Signed-off-by: Linus Walleij

pinctrl: sunxi: a64: Rename function ts0 to ts

2018-12-07T12:29:28+00:00

The A64 only has one TS (transport stream) controller. The datasheet
also lists the function as TS_XXX instead of TS0_XXX.

Rename the function names now before any there are any users.

Fixes: 96851d391d02 ("drivers: pinctrl: add driver for Allwinner A64 SoC")
Signed-off-by: Chen-Yu Tsai 
Acked-by: Maxime Ripard 
Signed-off-by: Linus Walleij

pinctrl: sunxi: a64: Rename function csi0 to csi

2018-12-07T12:28:50+00:00

The A64 only has one CSI (camera sensor interface) controller. The
datasheet also lists the function as CSI_XXX instead of CSI0_XXX.

Rename the function names now before any there are any users.

Fixes: 96851d391d02 ("drivers: pinctrl: add driver for Allwinner A64 SoC")
Signed-off-by: Chen-Yu Tsai 
Acked-by: Maxime Ripard 
Signed-off-by: Linus Walleij

pinctrl: sunxi: add support for suniv F1C100s (newer F-series SoCs)

2018-11-25T12:49:10+00:00

The suniv F1C100s chip (several new F-series SoCs) of Allwinner has a
pin
controller like other SoCs from Allwinner.

Add support for it.

Signed-off-by: Mesih Kilinc 
Acked-by: Maxime Ripard 
Signed-off-by: Linus Walleij

pinctrl: sunxi: Fix a memory leak in 'sunxi_pinctrl_build_state()'

2018-10-16T08:03:48+00:00

If 'krealloc()' fails, 'pctl->functions' is set to NULL.
We should instead use a temp variable in order to be able to free the
previously allocated memeory, in case of OOM.

Signed-off-by: Christophe JAILLET 
Acked-by: Maxime Ripard 
Signed-off-by: Linus Walleij