kernel.git/drivers/of/fdt.c, branch linux-5.19.y

of: fdt: fix off-by-one error in unflatten_dt_nodes()

2022-09-23T12:14:01Z

[ Upstream commit 2f945a792f67815abca26fa8a5e863ccf3fa1181 ] Commit 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree") forgot to fix up the depth check in the loop body in unflatten_dt_nodes() which makes it possible to overflow the nps[] buffer... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Fixes: 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree") Signed-off-by: Sergey Shtylyov Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/7c354554-006f-6b31-c195-cdfe4caee392@omp.ru Signed-off-by: Sasha Levin

of/fdt: declared return type does not match actual return type

2022-08-17T13:15:41Z

[ Upstream commit 7913145afa51bbed9eaf8e5b4ee55fa9884a71e5 ] The commit 649cab56de8e (“of: properly check for error returned by fdt_get_name()”) changed the return value type from bool to int, but forgot to change the return value simultaneously. populate_node was only called in unflatten_dt_nodes, and returns with values greater than or equal to 0 were discarded without further processing. Considering that return 0 usually indicates success, return 0 instead of return true. Fixes: 649cab56de8e (“of: properly check for error returned by fdt_get_name()”) Signed-off-by: Xu Qiang Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220801120506.11461-2-xuqiang36@huawei.com Signed-off-by: Sasha Levin

Merge tag 'devicetree-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

2022-05-25T21:56:06Z

Pull devicetree updates from Rob Herring: "Bindings: - Convert smsc,lan91c111, qcom,spi-qup, qcom,msm-uartdm, qcom,i2c-qup, qcom,gsbi, i2c-mt65xx, TI wkup_m3_ipc (and new props), qcom,smp2p, TI timer, Mediatek gnss, Mediatek topckgen, Mediatek apmixedsys, Mediatek infracfg, fsl,ls-extirq, fsl,layerscape-dcfg, QCom PMIC SPMI, rda,8810pl-timer, Xilinx zynqmp_ipi, uniphier-pcie, and Ilitek touchscreen controllers - Convert various Arm Ltd peripheral IP bindings to schemas - New bindings for Menlo board CPLD, DH electronics board CPLD, Qualcomm Geni based QUP I2C, Renesas RZ/G2UL OSTM, Broafcom BCM4751 GNSS, MT6360 PMIC, ASIX USB Ethernet controllers, and Microchip/SMSC LAN95xx USB Ethernet controllers - Add vendor prefix for Enclustra - Add various compatible string additions - Various example fixes and cleanups - Remove unused hisilicon,hi6220-reset binding - Treewide fix properties missing type definition - Drop some empty and unreferenced .txt bindings - Documentation improvements for writing schemas DT driver core: - Drop static IRQ resources for DT platform devices as IRQ setup is dynamic and drivers have all been converted to use platform_get_irq() and friends - Rework memory allocations and frees for overlays - Continue overlay notifier callbacks on successful calls and add unittests - Handle 'interrupts-extended' in early DT IRQ setup - Fix of_property_read_string() errors to match documentation - Ignore disabled nodes in FDT API calls" * tag 'devicetree-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (86 commits) of/irq: fix typo in comment dt-bindings: Fix properties without any type Revert "dt-bindings: mailbox: qcom-ipcc: add missing properties into example" dt-bindings: input: touchscreen: ilitek_ts_i2c: Absorb ili2xxx bindings dt-bindings: timer: samsung,exynos4210-mct: define strict clock order dt-bindings: timer: samsung,exynos4210-mct: drop unneeded minItems dt-bindings: timer: cdns,ttc: drop unneeded minItems dt-bindings: mailbox: zynqmp_ipi: convert to yaml dt-bindings: usb: ci-hdrc-usb2: fix node node for ethernet controller dt-bindings: net: add schema for Microchip/SMSC LAN95xx USB Ethernet controllers dt-bindings: net: add schema for ASIX USB Ethernet controllers of/fdt: Ignore disabled memory nodes dt-bindings: arm: fix typos in compatible dt-bindings: mfd: Add bindings child nodes for the Mediatek MT6360 dt-bindings: display: convert Arm Komeda to DT schema dt-bindings: display: convert Arm Mali-DP to DT schema dt-bindings: display: convert Arm HDLCD to DT schema dt-bindings: display: convert PL110/PL111 to DT schema dt-bindings: arm: convert vexpress-config to DT schema dt-bindings: arm: convert vexpress-sysregs to DT schema ...

of/fdt: Ignore disabled memory nodes

2022-05-17T18:06:32Z

When we boot a machine using a devicetree, the generic DT code goes through all nodes with a 'device_type = "memory"' property, and collects all memory banks mentioned there. However it does not check for the status property, so any nodes which are explicitly "disabled" will still be added as a memblock. This ends up badly for QEMU, when booting with secure firmware on arm/arm64 machines, because QEMU adds a node describing secure-only memory: =================== secram@e000000 { secure-status = "okay"; status = "disabled"; reg = <0x00 0xe000000 0x00 0x1000000>; device_type = "memory"; }; =================== The kernel will eventually use that memory block (which is located below the main DRAM bank), but accesses to that will be answered with an SError: =================== [ 0.000000] Internal error: synchronous external abort: 96000050 [#1] PREEMPT SMP [ 0.000000] Modules linked in: [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0-rc6-00014-g10c8acb8b679 #524 [ 0.000000] Hardware name: linux,dummy-virt (DT) [ 0.000000] pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 0.000000] pc : new_slab+0x190/0x340 [ 0.000000] lr : new_slab+0x184/0x340 [ 0.000000] sp : ffff80000a4b3d10 .... ================== The actual crash location and call stack will be somewhat random, and depend on the specific allocation of that physical memory range. As the DT spec[1] explicitly mentions standard properties, add a simple check to skip over disabled memory nodes, so that we only use memory that is meant for non-secure code to use. That fixes booting a QEMU arm64 VM with EL3 enabled ("secure=on"), when not using UEFI. In this case the QEMU generated DT will be handed on to the kernel, which will see the secram node. This issue is reproducible when using TF-A together with U-Boot as firmware, then booting with the "booti" command. When using U-Boot as an UEFI provider, the code there [2] explicitly filters for disabled nodes when generating the UEFI memory map, so we are safe. EDK/2 only reads the first bank of the first DT memory node [3] to learn about memory, so we got lucky there. [1] https://github.com/devicetree-org/devicetree-specification/blob/main/source/chapter3-devicenodes.rst#memory-node (after the table) [2] https://source.denx.de/u-boot/u-boot/-/blob/master/lib/fdtdec.c#L1061-1063 [3] https://github.com/tianocore/edk2/blob/master/ArmVirtPkg/PrePi/FdtParser.c Reported-by: Ross Burton Signed-off-by: Andre Przywara Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220517101410.3493781-1-andre.przywara@arm.com

of: fdt: Add memory for devices by DT property "linux,usable-memory-range"

2022-05-07T18:54:33Z

When reserving crashkernel in high memory, some low memory is reserved for crash dump kernel devices and never mapped by the first kernel. This memory range is advertised to crash dump kernel via DT property under /chosen, linux,usable-memory-range = We reused the DT property linux,usable-memory-range and made the low memory region as the second range "BASE2 SIZE2", which keeps compatibility with existing user-space and older kdump kernels. Crash dump kernel reads this property at boot time and call memblock_add() to add the low memory region after memblock_cap_memory_range() has been called. Signed-off-by: Chen Zhou Co-developed-by: Zhen Lei Signed-off-by: Zhen Lei Reviewed-by: Rob Herring Tested-by: Dave Kleikamp Acked-by: Baoquan He Link: https://lore.kernel.org/r/20220506114402.365-5-thunder.leizhen@huawei.com Signed-off-by: Catalin Marinas

of/fdt: move elfcorehdr reservation early for crash dump kernel

2022-02-17T23:13:52Z

elfcorehdr_addr is fixed address passed to Second kernel which may be conflicted with potential reserved memory in Second kernel,so fdt_reserve_elfcorehdr() ahead of fdt_init_reserved_mem() can relieve this situation. Signed-off-by: Nikhil Gupta Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220128042321.15228-1-nikhil.gupta@nxp.com

Merge branch 'akpm' (patches from Andrew)

2022-01-15T18:37:06Z

Merge misc updates from Andrew Morton: "146 patches. Subsystems affected by this patch series: kthread, ia64, scripts, ntfs, squashfs, ocfs2, vfs, and mm (slab-generic, slab, kmemleak, dax, kasan, debug, pagecache, gup, shmem, frontswap, memremap, memcg, selftests, pagemap, dma, vmalloc, memory-failure, hugetlb, userfaultfd, vmscan, mempolicy, oom-kill, hugetlbfs, migration, thp, ksm, page-poison, percpu, rmap, zswap, zram, cleanups, hmm, and damon)" * emailed patches from Andrew Morton : (146 commits) mm/damon: hide kernel pointer from tracepoint event mm/damon/vaddr: hide kernel pointer from damon_va_three_regions() failure log mm/damon/vaddr: use pr_debug() for damon_va_three_regions() failure logging mm/damon/dbgfs: remove an unnecessary variable mm/damon: move the implementation of damon_insert_region to damon.h mm/damon: add access checking for hugetlb pages Docs/admin-guide/mm/damon/usage: update for schemes statistics mm/damon/dbgfs: support all DAMOS stats Docs/admin-guide/mm/damon/reclaim: document statistics parameters mm/damon/reclaim: provide reclamation statistics mm/damon/schemes: account how many times quota limit has exceeded mm/damon/schemes: account scheme actions that successfully applied mm/damon: remove a mistakenly added comment for a future feature Docs/admin-guide/mm/damon/usage: update for kdamond_pid and (mk|rm)_contexts Docs/admin-guide/mm/damon/usage: mention tracepoint at the beginning Docs/admin-guide/mm/damon/usage: remove redundant information Docs/admin-guide/mm/damon/usage: update for scheme quotas and watermarks mm/damon: convert macro functions to static inline functions mm/damon: modify damon_rand() macro to static inline function mm/damon: move damon_rand() definition into damon.h ...

mm: kmemleak: alloc gray object for reserved region with direct map

2022-01-15T14:30:25Z

Reserved regions with direct mapping may contain references to other regions. CMA region with fixed location is reserved without creating kmemleak_object for it. So add them as gray kmemleak objects. Link: https://lkml.kernel.org/r/20211123090641.3654006-1-calvinzhang.cool@gmail.com Signed-off-by: Calvin Zhang Cc: Rob Herring Cc: Frank Rowand Cc: Catalin Marinas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

Merge branch 'dt/linus' into dt/next

2022-01-12T16:14:09Z

Pick a fix which didn't make it into v5.16.

of/fdt: Don't worry about non-memory region overlap for no-map

2022-01-08T14:50:39Z

In commit 8a5a75e5e9e5 ("of/fdt: Make sure no-map does not remove already reserved regions") we returned -EBUSY when trying to mark regions as no-map when they intersect with reserved memory. The goal was to find bad no-map reserved memory DT nodes that would unmap the kernel text/data sections. The problem is the reserved memory check will still trigger if the DT has a /memreserve/ that completely subsumes the no-map memory carveouts in the reserved memory node _and_ that region is also not part of the memory reg property. For example in sc7180.dtsi we have the following reserved-memory and memory node: memory@80000000 { /* We expect the bootloader to fill in the size */ reg = <0 0x80000000 0 0>; }; smem_mem: memory@80900000 { reg = <0x0 0x80900000 0x0 0x200000>; no-map; }; and the memreserve filled in by the bootloader is /memreserve/ 0x80800000 0x400000; while the /memory node is transformed into memory@80000000 { /* The bootloader fills in the size, and adds another region */ reg = <0 0x80000000 0 0x00800000>, <0 0x80c00000 0 0x7f200000>; }; The smem region is doubly reserved via /memreserve/ and by not being part of the /memory reg property. This leads to the following warning printed at boot. OF: fdt: Reserved memory: failed to reserve memory for node 'memory@80900000': base 0x0000000080900000, size 2 MiB Otherwise nothing really goes wrong because the smem region is not going to be mapped by the kernel's direct linear mapping given that it isn't part of the memory node. Therefore, let's only consider this to be a problem if we're trying to mark a region as no-map and it is actually memory that we're intending to keep out of the kernel's direct mapping but it's already been reserved. Acked-by: Mike Rapoport Cc: Douglas Anderson Cc: Nicolas Boichat Cc: Quentin Perret Cc: Jan Kiszka Fixes: 8a5a75e5e9e5 ("of/fdt: Make sure no-map does not remove already reserved regions") Signed-off-by: Stephen Boyd Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220107194233.2793146-1-swboyd@chromium.org