Merge drm/drm-fixes into drm-misc-fixes

Backmerging to get updates from v6.15-rc1.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>

Merge branch 'next' into for-linus

Prepare input updates for 6.15 merge window.

Merge drm/drm-next into drm-xe-next

Sync to fix conlicts between drm-xe-next and drm-intel-next.

Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>

Merge tag 'v6.14-rc4' into next

Sync up with the mainline.

Merge drm/drm-next into drm-misc-next

Bring rc1 to start the new release dev.

Signed-off-by: Maxime Ripard <mripard@kernel.org>

Merge tag 'v6.14-rc1' into perf-tools-next

To get the various fixes in the current master.

Signed-off-by: Namhyung Kim <namhyung@kernel.org>

Merge drm/drm-next into drm-intel-next

Sync with v6.14-rc1.

Signed-off-by: Jani Nikula <jani.nikula@intel.com>

Merge drm/drm-next into drm-intel-gt-next

We need
4ba4f1afb6a9 ("perf: Generic hotplug support for a PMU with a scope")
in order to land a i915 PMU simplification and a fix. That landed in 6.12
and

Merge drm/drm-next into drm-intel-gt-next

We need
4ba4f1afb6a9 ("perf: Generic hotplug support for a PMU with a scope")
in order to land a i915 PMU simplification and a fix. That landed in 6.12
and we are stuck at 6.9 so lets bump things forward.

Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>

show more ...

Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux

Pull clk updates from Stephen Boyd:
"A pretty quiet cycle this time around. We have a bunch of new Qualcomm
cl

Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux

Pull clk updates from Stephen Boyd:
"A pretty quiet cycle this time around. We have a bunch of new Qualcomm
clk drivers, per usual, and then a handful of drivers for other SoCs.
Then the usual pile of cleanups is fairly small data fixes or
converting DT bindings to YAML so they can be validated.

No changes to the core framework besides an OF node refcount bump that
never got decremented.

New Drivers:

- 5L35023 variant of Versa 3 clock generator

- Various Qualcomm clk controllers: IPQ CMN PLL, SM6115 LPASS, SM750
global, tcsr, rpmh, and display. X Plus GPU and global. QCS615 rpmh
and MSM8937 and MSM8940 RPM.

- Qualcomm Pongo and Taycan Alpha PLLs

- Qualcomm IPQ5424 NoC-related interconnect clks

- Renesas RZ/G3E (R9A09G047) SoC clk driver

- SAMA7D65 SoC clk driver

- Samsung Exynos990 SoC clk driver"

* tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (159 commits)
clk: analogbits: Fix incorrect calculation of vco rate delta
clk: bcm: rpi: Add disp clock
clk: bcm: rpi: Create helper to retrieve private data
clk: bcm: rpi: Enable minimize for all firmware clocks
clk: bcm: rpi: Allow cpufreq driver to also adjust gpu clocks
clk: bcm: rpi: Add ISP to exported clocks
clk: stm32f4: support spread spectrum clock generation
clk: stm32f4: use FIELD helpers to access the PLLCFGR fields
dt-bindings: clock: st,stm32-rcc: support spread spectrum clocking
dt-bindings: clock: convert stm32 rcc bindings to json-schema
clk: Use str_enable_disable-like helpers
clk: clk-loongson2: Fix the number count of clk provider
clk: clk-loongson2: Switch to use devm_clk_hw_register_fixed_rate_parent_data()
clk: starfive: Make _clk_get become a common helper function
clk: en7523: Add clock for eMMC for EN7581
dt-bindings: clock: add ID for eMMC for EN7581
dt-bindings: clock: drop NUM_CLOCKS define for EN7581
clk: en7523: Rework clock handling for different clock numbers
clk: thead: Fix cpu2vp_clk for TH1520 AP_SUBSYS clocks
clk: thead: Add CLK_IGNORE_UNUSED to fix TH1520 boot
...

show more ...

Merge branch 'clk-fixes' into clk-next

* clk-fixes:
clk: clk-loongson2: Fix the number count of clk provider
clk: mmp2: call pm_genpd_init() only after genpd.name is set
clk: sunxi-ng: a100: e

Merge branch 'clk-fixes' into clk-next

* clk-fixes:
clk: clk-loongson2: Fix the number count of clk provider
clk: mmp2: call pm_genpd_init() only after genpd.name is set
clk: sunxi-ng: a100: enable MMC clock reparenting
clk: clk-imx8mp-audiomix: fix function signature
clk: thead: Fix TH1520 emmc and shdci clock rate

show more ...

Merge branch 'next' into for-linus

Prepare input updates for 6.14 merge window.

clk: clk-loongson2: Fix the number count of clk provider

Since commit 02fb4f008433 ("clk: clk-loongson2: Fix potential buffer
overflow in flexible-array member access"), the clk provider register is

clk: clk-loongson2: Fix the number count of clk provider

Since commit 02fb4f008433 ("clk: clk-loongson2: Fix potential buffer
overflow in flexible-array member access"), the clk provider register is
failed.

The count of `clks_num` is shown below:

for (p = data; p->name; p++)
clks_num++;

In fact, `clks_num` represents the number of SoC clocks and should be
expressed as the maximum value of the clock binding id in use (p->id + 1).

Now we fix it to avoid the following error when trying to register a clk
provider:

[ 13.409595] of_clk_hw_onecell_get: invalid index 17

Cc: stable@vger.kernel.org
Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
Fixes: 02fb4f008433 ("clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access")
Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
Link: https://lore.kernel.org/r/82e43d89a9a6791129cf8ea14f4eeb666cd87be4.1736856470.git.zhoubinbin@loongson.cn
Signed-off-by: Stephen Boyd <sboyd@kernel.org>

show more ...

clk: clk-loongson2: Switch to use devm_clk_hw_register_fixed_rate_parent_data()

Since commit 706ae6446494 ("clk: fixed-rate: add
devm_clk_hw_register_fixed_rate_parent_data()"), we can use the
devm_

clk: clk-loongson2: Switch to use devm_clk_hw_register_fixed_rate_parent_data()

Since commit 706ae6446494 ("clk: fixed-rate: add
devm_clk_hw_register_fixed_rate_parent_data()"), we can use the
devm_clk_hw_register_fixed_rate_parent_data() helper and from then on
there is no need to manually unregister the fixed rate hw.

Since clk_hw_unregister_fixed_rate() was not called before, we also fix
the memory leak that was present.

Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
Link: https://lore.kernel.org/r/8733a7485619bdb791de25201a3d7984d1849c9f.1736856470.git.zhoubinbin@loongson.cn
Signed-off-by: Stephen Boyd <sboyd@kernel.org>

show more ...

Merge remote-tracking branch 'pm/opp/linux-next' into HEAD

Merge pm/opp tree to get dev_pm_opp_get_bw()

Signed-off-by: Rob Clark <robdclark@chromium.org>

Merge branch 'linus' into x86/mm, to pick up fixes

Signed-off-by: Ingo Molnar <mingo@kernel.org>

Merge tag 'v6.13-rc3' into next

Sync up with the mainline.

Merge drm/drm-next into drm-intel-next

Catching up with 6.13-rc2.

Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

Merge tag 'asoc-fix-v6.13-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Fixes for v6.13

A few small fixes for v6.13, all system specific - the biggest t

Merge tag 'asoc-fix-v6.13-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Fixes for v6.13

A few small fixes for v6.13, all system specific - the biggest thing is
the fix for jack handling over suspend on some Intel laptops.

show more ...

Merge drm/drm-next into drm-xe-next

A backmerge to get the PMT preparation work for
merging the BMG PMT support.

Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

Merge drm/drm-next into drm-misc-next

Kickstart 6.14 cycle.

Signed-off-by: Maxime Ripard <mripard@kernel.org>

Merge tag 'v6.13-rc1' into perf/core, to refresh the branch

Signed-off-by: Ingo Molnar <mingo@kernel.org>

Merge branch 'ovl.fixes'

Bring in an overlayfs fix for v6.13-rc1 that fixes a bug introduced by
the overlayfs changes merged for v6.13.

Signed-off-by: Christian Brauner <brauner@kernel.org>

Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux

Pull clk updates from Stephen Boyd:
"The core framework gained a clk provider helper, a clk consumer
helper, a

Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux

Pull clk updates from Stephen Boyd:
"The core framework gained a clk provider helper, a clk consumer
helper, and some unit tests for the assigned clk rates feature in
DeviceTree. On the vendor driver side, we gained a whole pile of SoC
driver support detailed below. The majority in the diffstat is
Qualcomm, but there's also quite a few Samsung and Mediatek clk driver
additions in here as well. The top vendors is quite common, but the
sheer amount of new drivers is uncommon, so I'm anticipating a larger
number of fixes for clk drivers this cycle.

Core:
- devm_clk_bulk_get_all_enabled() to return number of clks acquired
- devm_clk_hw_register_gate_parent_hw() helper to modernize drivers
- KUnit tests for clk-assigned-rates{,-u64}

New Drivers:
- Marvell PXA1908 SoC clks
- Mobileye EyeQ5, EyeQ6L and EyeQ6H clk driver
- TWL6030 clk driver
- Nuvoton Arbel BMC NPCM8XX SoC clks
- MediaTek MT6735 SoC clks
- MediaTek MT7620, MT7628 and MT7688 MMC clks
- Add a driver for gated fixed rate clocks
- Global clock controllers for Qualcomm QCS8300 and IPQ5424 SoCs
- Camera, display and video clock controllers for Qualcomm SA8775P
SoCs
- Global, display, GPU, TCSR, and RPMh clock controllers for Qualcomm
SAR2130P
- Global, camera, display, GPU, and video clock controllers for
Qualcomm SM8475 SoCs
- RTC power domain and Battery Backup Function (VBATTB) clock support
for the Renesas RZ/G3S SoC
- Qualcomm IPQ9574 alpha PLLs
- Support for i.MX91 CCM in the i.MX93 driver
- Microchip LAN969X SoC clks
- Cortex-A55 core clocks and Interrupt Control Unit (ICU) clock and
reset on Renesas RZ/V2H(P)
- Samsung ExynosAutov920 clk drivers for PERIC1, MISC, HSI0 and HSI1
- Samsung Exynos8895 clk drivers for FSYS0/1, PERIC0/1, PERIS and TOP

Updates:
- Convert more clk bindings to YAML
- Various clk driver cleanups: NULL checks, add const, etc.
- Remove END/NUM #defines that count number of clks in various
binding headers
- Continue moving reset drivers to drivers/reset via auxiliary bus"

* tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (162 commits)
clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access
clk: Fix invalid execution of clk_set_rate
clk: clk-loongson2: Fix memory corruption bug in struct loongson2_clk_provider
clk: lan966x: make it selectable for ARCH_LAN969X
clk: eyeq: add EyeQ6H west fixed factor clocks
clk: eyeq: add EyeQ6H central fixed factor clocks
clk: eyeq: add EyeQ5 fixed factor clocks
clk: eyeq: add fixed factor clocks infrastructure
clk: eyeq: require clock index with phandle in all cases
clk: fixed-factor: add clk_hw_register_fixed_factor_index() function
dt-bindings: clock: eyeq: add more Mobileye EyeQ5/EyeQ6H clocks
dt-bindings: soc: mobileye: set `#clock-cells = <1>` for all compatibles
clk: clk-axi-clkgen: make sure to enable the AXI bus clock
dt-bindings: clock: axi-clkgen: include AXI clk
clk: mmp: Add Marvell PXA1908 MPMU driver
clk: mmp: Add Marvell PXA1908 APMU driver
clk: mmp: Add Marvell PXA1908 APBCP driver
clk: mmp: Add Marvell PXA1908 APBC driver
dt-bindings: clock: Add Marvell PXA1908 clock bindings
clk: mmp: Switch to use struct u32_fract instead of custom one
...

show more ...

clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access

Flexible-array member `hws` in `struct clk_hw_onecell_data` is annotated
with the `counted_by()` attribute. This mea

clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access

Flexible-array member `hws` in `struct clk_hw_onecell_data` is annotated
with the `counted_by()` attribute. This means that when memory is
allocated for this array, the _counter_, which in this case is member
`num` in the flexible structure, should be set to the maximum number of
elements the flexible array can contain, or fewer.

In this case, the total number of elements for the flexible array is
determined by variable `clks_num` when allocating heap space via
`devm_kzalloc()`, as shown below:

289 struct loongson2_clk_provider *clp;
...
296 for (p = data; p->name; p++)
297 clks_num++;
298
299 clp = devm_kzalloc(dev, struct_size(clp, clk_data.hws, clks_num),
300 GFP_KERNEL);

So, `clp->clk_data.num` should be set to `clks_num` or less, and not
exceed `clks_num`, as is currently the case. Otherwise, if data is
written into `clp->clk_data.hws[clks_num]`, the instrumentation
provided by the compiler won't detect the overflow, leading to a
memory corruption bug at runtime.

Fix this issue by setting `clp->clk_data.num` to `clks_num`.

Fixes: 9796ec0bd04b ("clk: clk-loongson2: Refactor driver for adding new platforms")
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/r/ZzaN5MpmMr0hwHw9@kspp
Signed-off-by: Stephen Boyd <sboyd@kernel.org>

show more ...

clk: clk-loongson2: Fix memory corruption bug in struct loongson2_clk_provider

Some heap space is allocated for the flexible structure `struct
clk_hw_onecell_data` and its flexible-array member `hws

clk: clk-loongson2: Fix memory corruption bug in struct loongson2_clk_provider

Some heap space is allocated for the flexible structure `struct
clk_hw_onecell_data` and its flexible-array member `hws` through
the composite structure `struct loongson2_clk_provider` in function
`loongson2_clk_probe()`, as shown below:

289 struct loongson2_clk_provider *clp;
...
296 for (p = data; p->name; p++)
297 clks_num++;
298
299 clp = devm_kzalloc(dev, struct_size(clp, clk_data.hws, clks_num),
300 GFP_KERNEL);

Then some data is written into the flexible array:

350 clp->clk_data.hws[p->id] = hw;

This corrupts `clk_lock`, which is the spinlock variable immediately
following the `clk_data` member in `struct loongson2_clk_provider`:

struct loongson2_clk_provider {
void __iomem *base;
struct device *dev;
struct clk_hw_onecell_data clk_data;
spinlock_t clk_lock; /* protect access to DIV registers */
};

The problem is that the flexible structure is currently placed in the
middle of `struct loongson2_clk_provider` instead of at the end.

Fix this by moving `struct clk_hw_onecell_data clk_data;` to the end of
`struct loongson2_clk_provider`. Also, add a code comment to help
prevent this from happening again in case new members are added to the
structure in the future.

This change also fixes the following -Wflex-array-member-not-at-end
warning:

drivers/clk/clk-loongson2.c:32:36: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]

Fixes: 9796ec0bd04b ("clk: clk-loongson2: Refactor driver for adding new platforms")
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/r/ZzZ-cd_EFXs6qFaH@kspp
Signed-off-by: Stephen Boyd <sboyd@kernel.org>

show more ...