Fixes for 4.14

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-4.14/mcb-lpc-reallocate-memory-region-to-avoid-memory-ove.patch b/queue-4.14/mcb-lpc-reallocate-memory-region-to-avoid-memory-ove.patch
new file mode 100644 (file)
index 0000000..e1e93a0
--- /dev/null
+++ b/queue-4.14/mcb-lpc-reallocate-memory-region-to-avoid-memory-ove.patch
@@ -0,0 +1,93 @@
+From 2aeee1b4420b1af095819a5f153d98ba76000272 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 10:33:29 +0200
+Subject: mcb-lpc: Reallocate memory region to avoid memory overlapping
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rodríguez Barbarin, José Javier <JoseJavier.Rodriguez@duagon.com>
+
+[ Upstream commit 2025b2ca8004c04861903d076c67a73a0ec6dfca ]
+
+mcb-lpc requests a fixed-size memory region to parse the chameleon
+table, however, if the chameleon table is smaller that the allocated
+region, it could overlap with the IP Cores' memory regions.
+
+After parsing the chameleon table, drop/reallocate the memory region
+with the actual chameleon table size.
+
+Co-developed-by: Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
+Signed-off-by: Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
+Signed-off-by: Javier Rodriguez <josejavier.rodriguez@duagon.com>
+Signed-off-by: Johannes Thumshirn <jth@kernel.org>
+Link: https://lore.kernel.org/r/20230411083329.4506-4-jth@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mcb/mcb-lpc.c | 35 +++++++++++++++++++++++++++++++----
+ 1 file changed, 31 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mcb/mcb-lpc.c b/drivers/mcb/mcb-lpc.c
+index 945091a883546..7d292acbba539 100644
+--- a/drivers/mcb/mcb-lpc.c
++++ b/drivers/mcb/mcb-lpc.c
+@@ -26,7 +26,7 @@ static int mcb_lpc_probe(struct platform_device *pdev)
+ {
+       struct resource *res;
+       struct priv *priv;
+-      int ret = 0;
++      int ret = 0, table_size;
+ 
+       priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+       if (!priv)
+@@ -61,16 +61,43 @@ static int mcb_lpc_probe(struct platform_device *pdev)
+ 
+       ret = chameleon_parse_cells(priv->bus, priv->mem->start, priv->base);
+       if (ret < 0) {
+-              mcb_release_bus(priv->bus);
+-              return ret;
++              goto out_mcb_bus;
+       }
+ 
+-      dev_dbg(&pdev->dev, "Found %d cells\n", ret);
++      table_size = ret;
++
++      if (table_size < CHAM_HEADER_SIZE) {
++              /* Release the previous resources */
++              devm_iounmap(&pdev->dev, priv->base);
++              devm_release_mem_region(&pdev->dev, priv->mem->start, resource_size(priv->mem));
++
++              /* Then, allocate it again with the actual chameleon table size */
++              res = devm_request_mem_region(&pdev->dev, priv->mem->start,
++                                            table_size,
++                                            KBUILD_MODNAME);
++              if (!res) {
++                      dev_err(&pdev->dev, "Failed to request PCI memory\n");
++                      ret = -EBUSY;
++                      goto out_mcb_bus;
++              }
++
++              priv->base = devm_ioremap(&pdev->dev, priv->mem->start, table_size);
++              if (!priv->base) {
++                      dev_err(&pdev->dev, "Cannot ioremap\n");
++                      ret = -ENOMEM;
++                      goto out_mcb_bus;
++              }
++
++              platform_set_drvdata(pdev, priv);
++      }
+ 
+       mcb_bus_add_devices(priv->bus);
+ 
+       return 0;
+ 
++out_mcb_bus:
++      mcb_release_bus(priv->bus);
++      return ret;
+ }
+ 
+ static int mcb_lpc_remove(struct platform_device *pdev)
+-- 
+2.42.0
+

diff --git a/queue-4.14/mcb-return-actual-parsed-size-when-reading-chameleon.patch b/queue-4.14/mcb-return-actual-parsed-size-when-reading-chameleon.patch
new file mode 100644 (file)
index 0000000..f798676
--- /dev/null
+++ b/queue-4.14/mcb-return-actual-parsed-size-when-reading-chameleon.patch
@@ -0,0 +1,81 @@
+From 658381deaeda9062ce98a276465487bcce137429 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 10:33:27 +0200
+Subject: mcb: Return actual parsed size when reading chameleon table
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rodríguez Barbarin, José Javier <JoseJavier.Rodriguez@duagon.com>
+
+[ Upstream commit a889c276d33d333ae96697510f33533f6e9d9591 ]
+
+The function chameleon_parse_cells() returns the number of cells
+parsed which has an undetermined size. This return value is only
+used for error checking but the number of cells is never used.
+
+Change return value to be number of bytes parsed to allow for
+memory management improvements.
+
+Co-developed-by: Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
+Signed-off-by: Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
+Signed-off-by: Javier Rodriguez <josejavier.rodriguez@duagon.com>
+Signed-off-by: Johannes Thumshirn <jth@kernel.org>
+Link: https://lore.kernel.org/r/20230411083329.4506-2-jth@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mcb/mcb-parse.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c
+index 08a85e43ef885..b7354232221e6 100644
+--- a/drivers/mcb/mcb-parse.c
++++ b/drivers/mcb/mcb-parse.c
+@@ -127,7 +127,7 @@ static void chameleon_parse_bar(void __iomem *base,
+       }
+ }
+ 
+-static int chameleon_get_bar(char __iomem **base, phys_addr_t mapbase,
++static int chameleon_get_bar(void __iomem **base, phys_addr_t mapbase,
+                            struct chameleon_bar **cb)
+ {
+       struct chameleon_bar *c;
+@@ -176,12 +176,13 @@ int chameleon_parse_cells(struct mcb_bus *bus, phys_addr_t mapbase,
+ {
+       struct chameleon_fpga_header *header;
+       struct chameleon_bar *cb;
+-      char __iomem *p = base;
++      void __iomem *p = base;
+       int num_cells = 0;
+       uint32_t dtype;
+       int bar_count;
+       int ret;
+       u32 hsize;
++      u32 table_size;
+ 
+       hsize = sizeof(struct chameleon_fpga_header);
+ 
+@@ -236,12 +237,16 @@ int chameleon_parse_cells(struct mcb_bus *bus, phys_addr_t mapbase,
+               num_cells++;
+       }
+ 
+-      if (num_cells == 0)
+-              num_cells = -EINVAL;
++      if (num_cells == 0) {
++              ret = -EINVAL;
++              goto free_bar;
++      }
+ 
++      table_size = p - base;
++      pr_debug("%d cell(s) found. Chameleon table size: 0x%04x bytes\n", num_cells, table_size);
+       kfree(cb);
+       kfree(header);
+-      return num_cells;
++      return table_size;
+ 
+ free_bar:
+       kfree(cb);
+-- 
+2.42.0
+

diff --git a/queue-4.14/series b/queue-4.14/series
new file mode 100644 (file)
index 0000000..3406e55
--- /dev/null
+++ b/queue-4.14/series
@@ -0,0 +1,2 @@
+mcb-return-actual-parsed-size-when-reading-chameleon.patch
+mcb-lpc-reallocate-memory-region-to-avoid-memory-ove.patch