Merge tag 'pci-v4.5-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci

Pull PCI fixes from Bjorn Helgaas:
"These are some Renesas binding updates for PCI host controllers, a
Broadcom fix for a regression we added in v4.5-rc1, and a fix for an
AER use-after-free problem that can cause memory corruption.

Summary:

AER:
Flush workqueue on device remove to avoid use-after-free (Sebastian Andrzej Siewior)

Broadcom iProc host bridge driver:
Allow multiple devices except on PAXC (Ray Jui)

Renesas R-Car host bridge driver:
Add gen2 device tree support for r8a7793 (Simon Horman)
Add device tree support for r8a7793 (Simon Horman)"

* tag 'pci-v4.5-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
PCI: rcar: Add device tree support for r8a7793
PCI: rcar: Add gen2 device tree support for r8a7793
PCI: iproc: Allow multiple devices except on PAXC
PCI/AER: Flush workqueue on device remove to avoid use-after-free

Linus Torvalds 10 years ago 0cbb0b92 29f1bf34

+14 -24

6 changed files

expand all

Documentation

devicetree

bindings

pci

pci-rcar-gen2.txt

rcar-pci.txt

drivers

pci

host

pcie-iproc.c

pcie

aer

aerdrv.c

aerdrv.h

aerdrv_core.c

Documentation/devicetree/bindings/pci/pci-rcar-gen2.txt

··· 8 8 Required properties: 9 9 - compatible: "renesas,pci-r8a7790" for the R8A7790 SoC; 10 10 "renesas,pci-r8a7791" for the R8A7791 SoC; 11 + "renesas,pci-r8a7793" for the R8A7793 SoC; 11 12 "renesas,pci-r8a7794" for the R8A7794 SoC; 12 13 "renesas,pci-rcar-gen2" for a generic R-Car Gen2 compatible device 13 14

Documentation/devicetree/bindings/pci/rcar-pci.txt

··· 4 4 compatible: "renesas,pcie-r8a7779" for the R8A7779 SoC; 5 5 "renesas,pcie-r8a7790" for the R8A7790 SoC; 6 6 "renesas,pcie-r8a7791" for the R8A7791 SoC; 7 + "renesas,pcie-r8a7793" for the R8A7793 SoC; 7 8 "renesas,pcie-r8a7795" for the R8A7795 SoC; 8 9 "renesas,pcie-rcar-gen2" for a generic R-Car Gen2 compatible device. 9 10

+11 -18

drivers/pci/host/pcie-iproc.c

··· 64 64 #define OARR_SIZE_CFG BIT(OARR_SIZE_CFG_SHIFT) 65 65 66 66 #define MAX_NUM_OB_WINDOWS 2 67 - #define MAX_NUM_PAXC_PF 4 68 67 69 68 #define IPROC_PCIE_REG_INVALID 0xffff 70 69 ··· 169 170 writel(val, pcie->base + offset + (window * 8)); 170 171 } 171 172 172 - static inline bool iproc_pcie_device_is_valid(struct iproc_pcie *pcie, 173 - unsigned int slot, 174 - unsigned int fn) 175 - { 176 - if (slot > 0) 177 - return false; 178 - 179 - /* PAXC can only support limited number of functions */ 180 - if (pcie->type == IPROC_PCIE_PAXC && fn >= MAX_NUM_PAXC_PF) 181 - return false; 182 - 183 - return true; 184 - } 185 - 186 173 /** 187 174 * Note access to the configuration registers are protected at the higher layer 188 175 * by 'pci_lock' in drivers/pci/access.c ··· 184 199 u32 val; 185 200 u16 offset; 186 201 187 - if (!iproc_pcie_device_is_valid(pcie, slot, fn)) 188 - return NULL; 189 - 190 202 /* root complex access */ 191 203 if (busno == 0) { 204 + if (slot > 0 || fn > 0) 205 + return NULL; 206 + 192 207 iproc_pcie_write_reg(pcie, IPROC_PCIE_CFG_IND_ADDR, 193 208 where & CFG_IND_ADDR_MASK); 194 209 offset = iproc_pcie_reg_offset(pcie, IPROC_PCIE_CFG_IND_DATA); ··· 197 212 else 198 213 return (pcie->base + offset); 199 214 } 215 + 216 + /* 217 + * PAXC is connected to an internally emulated EP within the SoC. It 218 + * allows only one device. 219 + */ 220 + if (pcie->type == IPROC_PCIE_PAXC) 221 + if (slot > 0) 222 + return NULL; 200 223 201 224 /* EP device access */ 202 225 val = (busno << CFG_ADDR_BUS_NUM_SHIFT) |

+1 -3

drivers/pci/pcie/aer/aerdrv.c

··· 262 262 rpc->rpd = dev; 263 263 INIT_WORK(&rpc->dpc_handler, aer_isr); 264 264 mutex_init(&rpc->rpc_mutex); 265 - init_waitqueue_head(&rpc->wait_release); 266 265 267 266 /* Use PCIe bus function to store rpc into PCIe device */ 268 267 set_service_data(dev, rpc); ··· 284 285 if (rpc->isr) 285 286 free_irq(dev->irq, dev); 286 287 287 - wait_event(rpc->wait_release, rpc->prod_idx == rpc->cons_idx); 288 - 288 + flush_work(&rpc->dpc_handler); 289 289 aer_disable_rootport(rpc); 290 290 kfree(rpc); 291 291 set_service_data(dev, NULL);

-1

drivers/pci/pcie/aer/aerdrv.h

··· 72 72 * recovery on the same 73 73 * root port hierarchy 74 74 */ 75 - wait_queue_head_t wait_release; 76 75 }; 77 76 78 77 struct aer_broadcast_data {

-2

drivers/pci/pcie/aer/aerdrv_core.c

··· 811 811 while (get_e_source(rpc, &e_src)) 812 812 aer_isr_one_error(p_device, &e_src); 813 813 mutex_unlock(&rpc->rpc_mutex); 814 - 815 - wake_up(&rpc->wait_release); 816 814 } 817 815 818 816 /**

Configure Feed

Configure Feed