Fixes for 6.6

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-6.6/media-mediatek-vcodec-adding-lock-to-protect-decoder.patch b/queue-6.6/media-mediatek-vcodec-adding-lock-to-protect-decoder.patch
new file mode 100644 (file)
index 0000000..92a2ca0
--- /dev/null
+++ b/queue-6.6/media-mediatek-vcodec-adding-lock-to-protect-decoder.patch
@@ -0,0 +1,158 @@
+From 936b03b46dd5744faed854d1c7292548b1cf6079 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Mar 2024 20:30:08 +0800
+Subject: media: mediatek: vcodec: adding lock to protect decoder context list
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit 6467cda18c9f9b5f2f9a0aa1e2861c653e41f382 ]
+
+Add a lock for the ctx_list, to avoid accessing a NULL pointer
+within the 'vpu_dec_ipi_handler' function when the ctx_list has
+been deleted due to an unexpected behavior on the SCP IP block.
+
+Hardware name: Google juniper sku16 board (DT)
+pstate: 20400005 (nzCv daif +PAN -UAO -TCO BTYPE=--)
+pc : vpu_dec_ipi_handler+0x58/0x1f8 [mtk_vcodec_dec]
+lr : scp_ipi_handler+0xd0/0x194 [mtk_scp]
+sp : ffffffc0131dbbd0
+x29: ffffffc0131dbbd0 x28: 0000000000000000
+x27: ffffff9bb277f348 x26: ffffff9bb242ad00
+x25: ffffffd2d440d3b8 x24: ffffffd2a13ff1d4
+x23: ffffff9bb7fe85a0 x22: ffffffc0133fbdb0
+x21: 0000000000000010 x20: ffffff9b050ea328
+x19: ffffffc0131dbc08 x18: 0000000000001000
+x17: 0000000000000000 x16: ffffffd2d461c6e0
+x15: 0000000000000242 x14: 000000000000018f
+x13: 000000000000004d x12: 0000000000000000
+x11: 0000000000000001 x10: fffffffffffffff0
+x9 : ffffff9bb6e793a8 x8 : 0000000000000000
+x7 : 0000000000000000 x6 : 000000000000003f
+x5 : 0000000000000040 x4 : fffffffffffffff0
+x3 : 0000000000000020 x2 : ffffff9bb6e79080
+x1 : 0000000000000010 x0 : ffffffc0131dbc08
+Call trace:
+vpu_dec_ipi_handler+0x58/0x1f8 [mtk_vcodec_dec (HASH:6c3f 2)]
+scp_ipi_handler+0xd0/0x194 [mtk_scp (HASH:7046 3)]
+mt8183_scp_irq_handler+0x44/0x88 [mtk_scp (HASH:7046 3)]
+scp_irq_handler+0x48/0x90 [mtk_scp (HASH:7046 3)]
+irq_thread_fn+0x38/0x94
+irq_thread+0x100/0x1c0
+kthread+0x140/0x1fc
+ret_from_fork+0x10/0x30
+Code: 54000088 f94ca50a eb14015f 54000060 (f9400108)
+---[ end trace ace43ce36cbd5c93 ]---
+Kernel panic - not syncing: Oops: Fatal exception
+SMP: stopping secondary CPUs
+Kernel Offset: 0x12c4000000 from 0xffffffc010000000
+PHYS_OFFSET: 0xffffffe580000000
+CPU features: 0x08240002,2188200c
+Memory Limit: none
+
+Fixes: 655b86e52eac ("media: mediatek: vcodec: Fix possible invalid memory access for decoder")
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c      | 4 ++--
+ .../platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c    | 5 +++++
+ .../platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h    | 2 ++
+ drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c | 2 ++
+ 4 files changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
+index 0849ffb0dcd45..831ec3d48b274 100644
+--- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
++++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
+@@ -50,12 +50,12 @@ static void mtk_vcodec_vpu_reset_dec_handler(void *priv)
+ 
+       dev_err(&dev->plat_dev->dev, "Watchdog timeout!!");
+ 
+-      mutex_lock(&dev->dev_mutex);
++      mutex_lock(&dev->dev_ctx_lock);
+       list_for_each_entry(ctx, &dev->ctx_list, list) {
+               ctx->state = MTK_STATE_ABORT;
+               mtk_v4l2_vdec_dbg(0, ctx, "[%d] Change to state MTK_STATE_ABORT", ctx->id);
+       }
+-      mutex_unlock(&dev->dev_mutex);
++      mutex_unlock(&dev->dev_ctx_lock);
+ }
+ 
+ static void mtk_vcodec_vpu_reset_enc_handler(void *priv)
+diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
+index 0a89ce452ac32..20c0b1acf6186 100644
+--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
+@@ -268,7 +268,9 @@ static int fops_vcodec_open(struct file *file)
+ 
+       ctx->dev->vdec_pdata->init_vdec_params(ctx);
+ 
++      mutex_lock(&dev->dev_ctx_lock);
+       list_add(&ctx->list, &dev->ctx_list);
++      mutex_unlock(&dev->dev_ctx_lock);
+       mtk_vcodec_dbgfs_create(ctx);
+ 
+       mutex_unlock(&dev->dev_mutex);
+@@ -311,7 +313,9 @@ static int fops_vcodec_release(struct file *file)
+       v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
+ 
+       mtk_vcodec_dbgfs_remove(dev, ctx->id);
++      mutex_lock(&dev->dev_ctx_lock);
+       list_del_init(&ctx->list);
++      mutex_unlock(&dev->dev_ctx_lock);
+       kfree(ctx);
+       mutex_unlock(&dev->dev_mutex);
+       return 0;
+@@ -378,6 +382,7 @@ static int mtk_vcodec_probe(struct platform_device *pdev)
+       for (i = 0; i < MTK_VDEC_HW_MAX; i++)
+               mutex_init(&dev->dec_mutex[i]);
+       mutex_init(&dev->dev_mutex);
++      mutex_init(&dev->dev_ctx_lock);
+       spin_lock_init(&dev->irqlock);
+ 
+       snprintf(dev->v4l2_dev.name, sizeof(dev->v4l2_dev.name), "%s",
+diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h
+index 7e36b2c69b7d1..b3a59af7c8ac5 100644
+--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h
++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h
+@@ -231,6 +231,7 @@ struct mtk_vcodec_dec_ctx {
+  *
+  * @dec_mutex: decoder hardware lock
+  * @dev_mutex: video_device lock
++ * @dev_ctx_lock: the lock of context list
+  * @decode_workqueue: decode work queue
+  *
+  * @irqlock: protect data access by irq handler and work thread
+@@ -270,6 +271,7 @@ struct mtk_vcodec_dec_dev {
+       /* decoder hardware mutex lock */
+       struct mutex dec_mutex[MTK_VDEC_HW_MAX];
+       struct mutex dev_mutex;
++      struct mutex dev_ctx_lock;
+       struct workqueue_struct *decode_workqueue;
+ 
+       spinlock_t irqlock;
+diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c
+index 82e57ae983d55..da6be556727bb 100644
+--- a/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c
++++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c
+@@ -77,12 +77,14 @@ static bool vpu_dec_check_ap_inst(struct mtk_vcodec_dec_dev *dec_dev, struct vde
+       struct mtk_vcodec_dec_ctx *ctx;
+       int ret = false;
+ 
++      mutex_lock(&dec_dev->dev_ctx_lock);
+       list_for_each_entry(ctx, &dec_dev->ctx_list, list) {
+               if (!IS_ERR_OR_NULL(ctx) && ctx->vpu_inst == vpu) {
+                       ret = true;
+                       break;
+               }
+       }
++      mutex_unlock(&dec_dev->dev_ctx_lock);
+ 
+       return ret;
+ }
+-- 
+2.43.0
+

diff --git a/queue-6.6/media-mediatek-vcodec-adding-lock-to-protect-encoder.patch b/queue-6.6/media-mediatek-vcodec-adding-lock-to-protect-encoder.patch
new file mode 100644 (file)
index 0000000..ed9f326
--- /dev/null
+++ b/queue-6.6/media-mediatek-vcodec-adding-lock-to-protect-encoder.patch
@@ -0,0 +1,120 @@
+From d7f74492a7759c536de9ade2a6187854a6f7f698 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Mar 2024 20:30:09 +0800
+Subject: media: mediatek: vcodec: adding lock to protect encoder context list
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad ]
+
+Add a lock for the ctx_list, to avoid accessing a NULL pointer
+within the 'vpu_enc_ipi_handler' function when the ctx_list has
+been deleted due to an unexpected behavior on the SCP IP block.
+
+Fixes: 1972e32431ed ("media: mediatek: vcodec: Fix possible invalid memory access for encoder")
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c      | 4 ++--
+ .../platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c    | 5 +++++
+ .../platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h    | 2 ++
+ drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c | 2 ++
+ 4 files changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
+index 831ec3d48b274..42ce58c41e4f4 100644
+--- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
++++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
+@@ -65,12 +65,12 @@ static void mtk_vcodec_vpu_reset_enc_handler(void *priv)
+ 
+       dev_err(&dev->plat_dev->dev, "Watchdog timeout!!");
+ 
+-      mutex_lock(&dev->dev_mutex);
++      mutex_lock(&dev->dev_ctx_lock);
+       list_for_each_entry(ctx, &dev->ctx_list, list) {
+               ctx->state = MTK_STATE_ABORT;
+               mtk_v4l2_vdec_dbg(0, ctx, "[%d] Change to state MTK_STATE_ABORT", ctx->id);
+       }
+-      mutex_unlock(&dev->dev_mutex);
++      mutex_unlock(&dev->dev_ctx_lock);
+ }
+ 
+ static const struct mtk_vcodec_fw_ops mtk_vcodec_vpu_msg = {
+diff --git a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c
+index 6319f24bc714b..3cb8a16222220 100644
+--- a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c
++++ b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c
+@@ -177,7 +177,9 @@ static int fops_vcodec_open(struct file *file)
+       mtk_v4l2_venc_dbg(2, ctx, "Create instance [%d]@%p m2m_ctx=%p ",
+                         ctx->id, ctx, ctx->m2m_ctx);
+ 
++      mutex_lock(&dev->dev_ctx_lock);
+       list_add(&ctx->list, &dev->ctx_list);
++      mutex_unlock(&dev->dev_ctx_lock);
+ 
+       mutex_unlock(&dev->dev_mutex);
+       mtk_v4l2_venc_dbg(0, ctx, "%s encoder [%d]", dev_name(&dev->plat_dev->dev),
+@@ -212,7 +214,9 @@ static int fops_vcodec_release(struct file *file)
+       v4l2_fh_exit(&ctx->fh);
+       v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
+ 
++      mutex_lock(&dev->dev_ctx_lock);
+       list_del_init(&ctx->list);
++      mutex_unlock(&dev->dev_ctx_lock);
+       kfree(ctx);
+       mutex_unlock(&dev->dev_mutex);
+       return 0;
+@@ -294,6 +298,7 @@ static int mtk_vcodec_probe(struct platform_device *pdev)
+ 
+       mutex_init(&dev->enc_mutex);
+       mutex_init(&dev->dev_mutex);
++      mutex_init(&dev->dev_ctx_lock);
+       spin_lock_init(&dev->irqlock);
+ 
+       snprintf(dev->v4l2_dev.name, sizeof(dev->v4l2_dev.name), "%s",
+diff --git a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h
+index a042f607ed8d1..0bd85d0fb379a 100644
+--- a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h
++++ b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h
+@@ -178,6 +178,7 @@ struct mtk_vcodec_enc_ctx {
+  *
+  * @enc_mutex: encoder hardware lock.
+  * @dev_mutex: video_device lock
++ * @dev_ctx_lock: the lock of context list
+  * @encode_workqueue: encode work queue
+  *
+  * @enc_irq: h264 encoder irq resource
+@@ -205,6 +206,7 @@ struct mtk_vcodec_enc_dev {
+       /* encoder hardware mutex lock */
+       struct mutex enc_mutex;
+       struct mutex dev_mutex;
++      struct mutex dev_ctx_lock;
+       struct workqueue_struct *encode_workqueue;
+ 
+       int enc_irq;
+diff --git a/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c b/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c
+index 84ad1cc6ad171..51bb7ee141b9e 100644
+--- a/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c
++++ b/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c
+@@ -47,12 +47,14 @@ static bool vpu_enc_check_ap_inst(struct mtk_vcodec_enc_dev *enc_dev, struct ven
+       struct mtk_vcodec_enc_ctx *ctx;
+       int ret = false;
+ 
++      mutex_lock(&enc_dev->dev_ctx_lock);
+       list_for_each_entry(ctx, &enc_dev->ctx_list, list) {
+               if (!IS_ERR_OR_NULL(ctx) && ctx->vpu_inst == vpu) {
+                       ret = true;
+                       break;
+               }
+       }
++      mutex_unlock(&enc_dev->dev_ctx_lock);
+ 
+       return ret;
+ }
+-- 
+2.43.0
+

diff --git a/queue-6.6/media-mediatek-vcodec-fix-oops-when-hevc-init-fails.patch b/queue-6.6/media-mediatek-vcodec-fix-oops-when-hevc-init-fails.patch
new file mode 100644 (file)
index 0000000..727ee43
--- /dev/null
+++ b/queue-6.6/media-mediatek-vcodec-fix-oops-when-hevc-init-fails.patch
@@ -0,0 +1,84 @@
+From 9fc2a55eb36bfa044b545adf660d5a57b7293fbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Feb 2024 16:19:52 -0500
+Subject: media: mediatek: vcodec: Fix oops when HEVC init fails
+
+From: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+
+[ Upstream commit 97c75ee5de060d271d80109b0c47cb6008439e5b ]
+
+The stateless HEVC decoder saves the instance pointer in the context
+regardless if the initialization worked or not. This caused a use after
+free, when the pointer is freed in case of a failure in the deinit
+function.
+Only store the instance pointer when the initialization was successful,
+to solve this issue.
+
+ Hardware name: Acer Tomato (rev3 - 4) board (DT)
+ pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+ pc : vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec]
+ lr : vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec]
+ sp : ffff80008750bc20
+ x29: ffff80008750bc20 x28: ffff1299f6d70000 x27: 0000000000000000
+ x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
+ x23: ffff80008750bc98 x22: 000000000000a003 x21: ffffd45c4cfae000
+ x20: 0000000000000010 x19: ffff1299fd668310 x18: 000000000000001a
+ x17: 000000040044ffff x16: ffffd45cb15dc648 x15: 0000000000000000
+ x14: ffff1299c08da1c0 x13: ffffd45cb1f87a10 x12: ffffd45cb2f5fe80
+ x11: 0000000000000001 x10: 0000000000001b30 x9 : ffffd45c4d12b488
+ x8 : 1fffe25339380d81 x7 : 0000000000000001 x6 : ffff1299c9c06c00
+ x5 : 0000000000000132 x4 : 0000000000000000 x3 : 0000000000000000
+ x2 : 0000000000000010 x1 : ffff80008750bc98 x0 : 0000000000000000
+ Call trace:
+  vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec]
+  vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec]
+  vpu_dec_deinit+0x1c/0x30 [mtk_vcodec_dec]
+  vdec_hevc_slice_deinit+0x30/0x98 [mtk_vcodec_dec]
+  vdec_if_deinit+0x38/0x68 [mtk_vcodec_dec]
+  mtk_vcodec_dec_release+0x20/0x40 [mtk_vcodec_dec]
+  fops_vcodec_release+0x64/0x118 [mtk_vcodec_dec]
+  v4l2_release+0x7c/0x100
+  __fput+0x80/0x2d8
+  __fput_sync+0x58/0x70
+  __arm64_sys_close+0x40/0x90
+  invoke_syscall+0x50/0x128
+  el0_svc_common.constprop.0+0x48/0xf0
+  do_el0_svc+0x24/0x38
+  el0_svc+0x38/0xd8
+  el0t_64_sync_handler+0xc0/0xc8
+  el0t_64_sync+0x1a8/0x1b0
+ Code: d503201f f9401660 b900127f b900227f (f9400400)
+
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Fixes: 2674486aac7d ("media: mediatek: vcodec: support stateless hevc decoder")
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c       | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c
+index 06ed47df693bf..21836dd6ef85a 100644
+--- a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c
++++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c
+@@ -869,7 +869,6 @@ static int vdec_hevc_slice_init(struct mtk_vcodec_dec_ctx *ctx)
+       inst->vpu.codec_type = ctx->current_codec;
+       inst->vpu.capture_type = ctx->capture_fourcc;
+ 
+-      ctx->drv_handle = inst;
+       err = vpu_dec_init(&inst->vpu);
+       if (err) {
+               mtk_vdec_err(ctx, "vdec_hevc init err=%d", err);
+@@ -898,6 +897,7 @@ static int vdec_hevc_slice_init(struct mtk_vcodec_dec_ctx *ctx)
+       mtk_vdec_debug(ctx, "lat hevc instance >> %p, codec_type = 0x%x",
+                      inst, inst->vpu.codec_type);
+ 
++      ctx->drv_handle = inst;
+       return 0;
+ error_free_inst:
+       kfree(inst);
+-- 
+2.43.0
+

diff --git a/queue-6.6/platform-x86-intel-vbtn-update-tablet-mode-switch-at.patch b/queue-6.6/platform-x86-intel-vbtn-update-tablet-mode-switch-at.patch
new file mode 100644 (file)
index 0000000..b04d26b
--- /dev/null
+++ b/queue-6.6/platform-x86-intel-vbtn-update-tablet-mode-switch-at.patch
@@ -0,0 +1,80 @@
+From c0777d362cc99683eaee7e49f21243d4f0973860 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Mar 2024 07:32:06 -0700
+Subject: platform/x86: intel-vbtn: Update tablet mode switch at end of probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Gwendal Grignou <gwendal@chromium.org>
+
+[ Upstream commit 434e5781d8cd2d0ed512d920c6cdeba4b33a2e81 ]
+
+ACER Vivobook Flip (TP401NAS) virtual intel switch is implemented as
+follow:
+
+   Device (VGBI)
+   {
+       Name (_HID, EisaId ("INT33D6") ...
+       Name (VBDS, Zero)
+       Method (_STA, 0, Serialized)  // _STA: Status ...
+       Method (VBDL, 0, Serialized)
+       {
+           PB1E |= 0x20
+           VBDS |= 0x40
+       }
+       Method (VGBS, 0, Serialized)
+       {
+           Return (VBDS) /* \_SB_.PCI0.SBRG.EC0_.VGBI.VBDS */
+       }
+       ...
+    }
+
+By default VBDS is set to 0. At boot it is set to clamshell (bit 6 set)
+only after method VBDL is executed.
+
+Since VBDL is now evaluated in the probe routine later, after the device
+is registered, the retrieved value of VBDS was still 0 ("tablet mode")
+when setting up the virtual switch.
+
+Make sure to evaluate VGBS after VBDL, to ensure the
+convertible boots in clamshell mode, the expected default.
+
+Fixes: 26173179fae1 ("platform/x86: intel-vbtn: Eval VBDL after registering our notifier")
+Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20240329143206.2977734-3-gwendal@chromium.org
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/vbtn.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/intel/vbtn.c b/drivers/platform/x86/intel/vbtn.c
+index 084c355c86f5f..5d13452bb947a 100644
+--- a/drivers/platform/x86/intel/vbtn.c
++++ b/drivers/platform/x86/intel/vbtn.c
+@@ -136,8 +136,6 @@ static int intel_vbtn_input_setup(struct platform_device *device)
+       priv->switches_dev->id.bustype = BUS_HOST;
+ 
+       if (priv->has_switches) {
+-              detect_tablet_mode(&device->dev);
+-
+               ret = input_register_device(priv->switches_dev);
+               if (ret)
+                       return ret;
+@@ -316,6 +314,9 @@ static int intel_vbtn_probe(struct platform_device *device)
+               if (ACPI_FAILURE(status))
+                       dev_err(&device->dev, "Error VBDL failed with ACPI status %d\n", status);
+       }
++      // Check switches after buttons since VBDL may have side effects.
++      if (has_switches)
++              detect_tablet_mode(&device->dev);
+ 
+       device_init_wakeup(&device->dev, true);
+       /*
+-- 
+2.43.0
+

diff --git a/queue-6.6/randomize_kstack-improve-entropy-diffusion.patch b/queue-6.6/randomize_kstack-improve-entropy-diffusion.patch
new file mode 100644 (file)
index 0000000..ec5867d
--- /dev/null
+++ b/queue-6.6/randomize_kstack-improve-entropy-diffusion.patch
@@ -0,0 +1,37 @@
+From ebcd951dcbe98a5c15790b13f1923c040f105278 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Mar 2024 12:24:48 -0800
+Subject: randomize_kstack: Improve entropy diffusion
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 9c573cd313433f6c1f7236fe64b9b743500c1628 ]
+
+The kstack_offset variable was really only ever using the low bits for
+kernel stack offset entropy. Add a ror32() to increase bit diffusion.
+
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Fixes: 39218ff4c625 ("stack: Optionally randomize kernel stack offset each syscall")
+Link: https://lore.kernel.org/r/20240309202445.work.165-kees@kernel.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/randomize_kstack.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/randomize_kstack.h b/include/linux/randomize_kstack.h
+index 5d868505a94e4..6d92b68efbf6c 100644
+--- a/include/linux/randomize_kstack.h
++++ b/include/linux/randomize_kstack.h
+@@ -80,7 +80,7 @@ DECLARE_PER_CPU(u32, kstack_offset);
+       if (static_branch_maybe(CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT, \
+                               &randomize_kstack_offset)) {            \
+               u32 offset = raw_cpu_read(kstack_offset);               \
+-              offset ^= (rand);                                       \
++              offset = ror32(offset, 5) ^ (rand);                     \
+               raw_cpu_write(kstack_offset, offset);                   \
+       }                                                               \
+ } while (0)
+-- 
+2.43.0
+

diff --git a/queue-6.6/series b/queue-6.6/series
index 2d6305c82132e90ceb690335b0fc0c73a1b54527..75dc2419df0cd8b5ffd32127b58dca497060a234 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -103,3 +103,8 @@ fbmon-prevent-division-by-zero-in-fb_videomode_from_.patch
 alsa-hda-realtek-add-quirks-for-some-clevo-laptops.patch
 gcc-plugins-stackleak-avoid-.head.text-section.patch
 selftests-mptcp-display-simult-in-extra_msg.patch
+media-mediatek-vcodec-fix-oops-when-hevc-init-fails.patch
+media-mediatek-vcodec-adding-lock-to-protect-decoder.patch
+media-mediatek-vcodec-adding-lock-to-protect-encoder.patch
+randomize_kstack-improve-entropy-diffusion.patch
+platform-x86-intel-vbtn-update-tablet-mode-switch-at.patch