--- /dev/null
+From dd218433f2b635d97e8fda3eed047151fd528ce4 Mon Sep 17 00:00:00 2001
+From: Wang Ming <machel@vivo.com>
+Date: Thu, 27 Jul 2023 14:37:50 -0500
+Subject: firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
+
+From: Wang Ming <machel@vivo.com>
+
+commit dd218433f2b635d97e8fda3eed047151fd528ce4 upstream.
+
+The devm_memremap() function returns error pointers.
+It never returns NULL. Fix the check.
+
+Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Wang Ming <machel@vivo.com>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Link: https://lore.kernel.org/r/20230727193750.983795-1-dinguyen@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/stratix10-svc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/firmware/stratix10-svc.c
++++ b/drivers/firmware/stratix10-svc.c
+@@ -623,7 +623,7 @@ svc_create_memory_pool(struct platform_d
+ paddr = begin;
+ size = end - begin;
+ va = devm_memremap(dev, paddr, size, MEMREMAP_WC);
+- if (!va) {
++ if (IS_ERR(va)) {
+ dev_err(dev, "fail to remap shared memory\n");
+ return ERR_PTR(-EINVAL);
+ }
--- /dev/null
+From 3a1d7aff6e65ad6e285e28abe55abbfd484997ee Mon Sep 17 00:00:00 2001
+From: Juerg Haefliger <juerg.haefliger@canonical.com>
+Date: Wed, 28 Jun 2023 11:50:39 +0200
+Subject: fsi: master-ast-cf: Add MODULE_FIRMWARE macro
+
+From: Juerg Haefliger <juerg.haefliger@canonical.com>
+
+commit 3a1d7aff6e65ad6e285e28abe55abbfd484997ee upstream.
+
+The module loads firmware so add a MODULE_FIRMWARE macro to provide that
+information via modinfo.
+
+Fixes: 6a794a27daca ("fsi: master-ast-cf: Add new FSI master using Aspeed ColdFire")
+Cc: stable@vger.kernel.org # 4.19+
+Signed-off-by: Juerg Haefliger <juerg.haefliger@canonical.com>
+Link: https://lore.kernel.org/r/20230628095039.26218-1-juerg.haefliger@canonical.com
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/fsi/fsi-master-ast-cf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/fsi/fsi-master-ast-cf.c
++++ b/drivers/fsi/fsi-master-ast-cf.c
+@@ -1439,3 +1439,4 @@ static struct platform_driver fsi_master
+
+ module_platform_driver(fsi_master_acf);
+ MODULE_LICENSE("GPL");
++MODULE_FIRMWARE(FW_FILE_NAME);
--- /dev/null
+From f83913f8c5b882a312e72b7669762f8a5c9385e4 Mon Sep 17 00:00:00 2001
+From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Date: Sat, 5 Aug 2023 22:20:38 +0900
+Subject: nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers()
+
+From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+
+commit f83913f8c5b882a312e72b7669762f8a5c9385e4 upstream.
+
+A syzbot stress test reported that create_empty_buffers() called from
+nilfs_lookup_dirty_data_buffers() can cause a general protection fault.
+
+Analysis using its reproducer revealed that the back reference "mapping"
+from a page/folio has been changed to NULL after dirty page/folio gang
+lookup in nilfs_lookup_dirty_data_buffers().
+
+Fix this issue by excluding pages/folios from being collected if, after
+acquiring a lock on each page/folio, its back reference "mapping" differs
+from the pointer to the address space struct that held the page/folio.
+
+Link: https://lkml.kernel.org/r/20230805132038.6435-1-konishi.ryusuke@gmail.com
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Reported-by: syzbot+0ad741797f4565e7e2d2@syzkaller.appspotmail.com
+Closes: https://lkml.kernel.org/r/0000000000002930a705fc32b231@google.com
+Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+fs/nilfs2/segment.c | 5 +++++
+ fs/nilfs2/segment.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -725,6 +725,11 @@ static size_t nilfs_lookup_dirty_data_bu
+ struct page *page = pvec.pages[i];
+
+ lock_page(page);
++ if (unlikely(page->mapping != mapping)) {
++ /* Exclude pages removed from the address space */
++ unlock_page(page);
++ continue;
++ }
+ if (!page_has_buffers(page))
+ create_empty_buffers(page, i_blocksize(inode), 0);
+ unlock_page(page);
--- /dev/null
+From 8ece7b754bc34ffd7fcc8269ccb9128e72ca76d8 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Fri, 14 Jul 2023 15:02:13 +0200
+Subject: serial: qcom-geni: fix opp vote on shutdown
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 8ece7b754bc34ffd7fcc8269ccb9128e72ca76d8 upstream.
+
+The operating-performance-point vote needs to be dropped when shutting
+down the port to avoid wasting power by keeping resources like power
+domains in an unnecessarily high performance state (e.g. when a UART
+connected Bluetooth controller is not in use).
+
+Fixes: a5819b548af0 ("tty: serial: qcom_geni_serial: Use OPP API to set clk/perf state")
+Cc: stable@vger.kernel.org # 5.9
+Cc: Rajendra Nayak <quic_rjendra@quicinc.com>
+Cc: Matthias Kaehlcke <mka@chromium.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230714130214.14552-2-johan+linaro@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/qcom_geni_serial.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -125,6 +125,7 @@ struct qcom_geni_serial_port {
+ u32 tx_fifo_width;
+ u32 rx_fifo_depth;
+ bool setup;
++ unsigned long clk_rate;
+ int (*handle_rx)(struct uart_port *uport, u32 bytes, bool drop);
+ unsigned int baud;
+ void *rx_fifo;
+@@ -1022,6 +1023,7 @@ static void qcom_geni_serial_set_termios
+ goto out_restart_rx;
+
+ uport->uartclk = clk_rate;
++ port->clk_rate = clk_rate;
+ dev_pm_opp_set_rate(uport->dev, clk_rate);
+ ser_clk_cfg = SER_CLK_EN;
+ ser_clk_cfg |= clk_div << CLK_DIV_SHFT;
+@@ -1291,10 +1293,13 @@ static void qcom_geni_serial_pm(struct u
+
+ if (new_state == UART_PM_STATE_ON && old_state == UART_PM_STATE_OFF) {
+ geni_icc_enable(&port->se);
++ if (port->clk_rate)
++ dev_pm_opp_set_rate(uport->dev, port->clk_rate);
+ geni_se_resources_on(&port->se);
+ } else if (new_state == UART_PM_STATE_OFF &&
+ old_state == UART_PM_STATE_ON) {
+ geni_se_resources_off(&port->se);
++ dev_pm_opp_set_rate(uport->dev, 0);
+ geni_icc_disable(&port->se);
+ }
+ }
--- /dev/null
+From 2861ed4d6e6d1a2c9de9bf5b0abd996c2dc673d0 Mon Sep 17 00:00:00 2001
+From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Date: Mon, 7 Aug 2023 17:45:51 -0400
+Subject: serial: sc16is7xx: fix broken port 0 uart init
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+
+commit 2861ed4d6e6d1a2c9de9bf5b0abd996c2dc673d0 upstream.
+
+The sc16is7xx_config_rs485() function is called only for the second
+port (index 1, channel B), causing initialization problems for the
+first port.
+
+For the sc16is7xx driver, port->membase and port->mapbase are not set,
+and their default values are 0. And we set port->iobase to the device
+index. This means that when the first device is registered using the
+uart_add_one_port() function, the following values will be in the port
+structure:
+ port->membase = 0
+ port->mapbase = 0
+ port->iobase = 0
+
+Therefore, the function uart_configure_port() in serial_core.c will
+exit early because of the following check:
+ /*
+ * If there isn't a port here, don't do anything further.
+ */
+ if (!port->iobase && !port->mapbase && !port->membase)
+ return;
+
+Typically, I2C and SPI drivers do not set port->membase and
+port->mapbase.
+
+The max310x driver sets port->membase to ~0 (all ones). By
+implementing the same change in this driver, uart_configure_port() is
+now correctly executed for all ports.
+
+Fixes: dfeae619d781 ("serial: sc16is7xx")
+Cc: stable@vger.kernel.org
+Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Lech Perczak <lech.perczak@camlingroup.com>
+Tested-by: Lech Perczak <lech.perczak@camlingroup.com>
+Link: https://lore.kernel.org/r/20230807214556.540627-2-hugo@hugovil.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/sc16is7xx.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -1258,6 +1258,12 @@ static int sc16is7xx_probe(struct device
+ s->p[i].port.fifosize = SC16IS7XX_FIFO_SIZE;
+ s->p[i].port.flags = UPF_FIXED_TYPE | UPF_LOW_LATENCY;
+ s->p[i].port.iobase = i;
++ /*
++ * Use all ones as membase to make sure uart_configure_port() in
++ * serial_core.c does not abort for SPI/I2C devices where the
++ * membase address is not applicable.
++ */
++ s->p[i].port.membase = (void __iomem *)~0;
+ s->p[i].port.iotype = UPIO_PORT;
+ s->p[i].port.uartclk = freq;
+ s->p[i].port.rs485_config = sc16is7xx_config_rs485;
--- /dev/null
+From 9baeea723c0fb9c3ba9a336369f758ed9bc6831d Mon Sep 17 00:00:00 2001
+From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Date: Mon, 7 Aug 2023 17:45:55 -0400
+Subject: serial: sc16is7xx: fix bug when first setting GPIO direction
+
+From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+
+commit 9baeea723c0fb9c3ba9a336369f758ed9bc6831d upstream.
+
+When configuring a pin as an output pin with a value of logic 0, we
+end up as having a value of logic 1 on the output pin. Setting a
+logic 0 a second time (or more) after that will correctly output a
+logic 0 on the output pin.
+
+By default, all GPIO pins are configured as inputs. When we enter
+sc16is7xx_gpio_direction_output() for the first time, we first set the
+desired value in IOSTATE, and then we configure the pin as an output.
+The datasheet states that writing to IOSTATE register will trigger a
+transfer of the value to the I/O pin configured as output, so if the
+pin is configured as an input, nothing will be transferred.
+
+Therefore, set the direction first in IODIR, and then set the desired
+value in IOSTATE.
+
+This is what is done in NXP application note AN10587.
+
+Fixes: dfeae619d781 ("serial: sc16is7xx")
+Cc: stable@vger.kernel.org
+Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Reviewed-by: Lech Perczak <lech.perczak@camlingroup.com>
+Tested-by: Lech Perczak <lech.perczak@camlingroup.com>
+Link: https://lore.kernel.org/r/20230807214556.540627-6-hugo@hugovil.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/sc16is7xx.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -1170,9 +1170,18 @@ static int sc16is7xx_gpio_direction_outp
+ state |= BIT(offset);
+ else
+ state &= ~BIT(offset);
+- sc16is7xx_port_write(port, SC16IS7XX_IOSTATE_REG, state);
++
++ /*
++ * If we write IOSTATE first, and then IODIR, the output value is not
++ * transferred to the corresponding I/O pin.
++ * The datasheet states that each register bit will be transferred to
++ * the corresponding I/O pin programmed as output when writing to
++ * IOSTATE. Therefore, configure direction first with IODIR, and then
++ * set value after with IOSTATE.
++ */
+ sc16is7xx_port_update(port, SC16IS7XX_IODIR_REG, BIT(offset),
+ BIT(offset));
++ sc16is7xx_port_write(port, SC16IS7XX_IOSTATE_REG, state);
+
+ return 0;
+ }
staging-rtl8712-fix-race-condition.patch
bluetooth-btsdio-fix-use-after-free-bug-in-btsdio_remove-due-to-race-condition.patch
wifi-mt76-mt7921-do-not-support-one-stream-on-secondary-antenna-only.patch
+serial-qcom-geni-fix-opp-vote-on-shutdown.patch
+serial-sc16is7xx-fix-broken-port-0-uart-init.patch
+serial-sc16is7xx-fix-bug-when-first-setting-gpio-direction.patch
+firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-probe.patch
+fsi-master-ast-cf-add-module_firmware-macro.patch
+tcpm-avoid-soft-reset-when-partner-does-not-support-get_status.patch
+nilfs2-fix-general-protection-fault-in-nilfs_lookup_dirty_data_buffers.patch
--- /dev/null
+From 78e0ea4277546debf7e96797ac3b768539cc44f6 Mon Sep 17 00:00:00 2001
+From: Badhri Jagan Sridharan <badhri@google.com>
+Date: Sun, 20 Aug 2023 04:44:48 +0000
+Subject: tcpm: Avoid soft reset when partner does not support get_status
+
+From: Badhri Jagan Sridharan <badhri@google.com>
+
+commit 78e0ea4277546debf7e96797ac3b768539cc44f6 upstream.
+
+When partner does not support get_status message, tcpm right now
+responds with soft reset message. This causes PD renegotiation to
+happen and resets PPS link. Avoid soft resetting the link when
+partner does not support get_status message to mitigate PPS resets.
+
+[ 208.926752] Setting voltage/current limit 9500 mV 2450 mA
+[ 208.930407] set_auto_vbus_discharge_threshold mode:3 pps_active:y vbus:9500 ret:0
+[ 208.930418] state change SNK_TRANSITION_SINK -> SNK_READY [rev3 POWER_NEGOTIATION]
+[ 208.930455] AMS POWER_NEGOTIATION finished
+
+// ALERT message from the Source
+[ 213.948442] PD RX, header: 0x19a6 [1]
+[ 213.948451] state change SNK_READY -> GET_STATUS_SEND [rev3 GETTING_SOURCE_SINK_STATUS]
+[ 213.948457] PD TX, header: 0x492
+[ 213.950402] PD TX complete, status: 0
+[ 213.950427] pending state change GET_STATUS_SEND -> GET_STATUS_SEND_TIMEOUT @ 60 ms [rev3 GETTING_SOURCE_SINK_STATUS]
+
+// NOT_SUPPORTED from the Source
+[ 213.959954] PD RX, header: 0xbb0 [1]
+
+// sink sends SOFT_RESET
+[ 213.959958] state change GET_STATUS_SEND -> SNK_SOFT_RESET [rev3 GETTING_SOURCE_SINK_STATUS]
+[ 213.959962] AMS GETTING_SOURCE_SINK_STATUS finished
+[ 213.959964] AMS SOFT_RESET_AMS start
+[ 213.959966] state change SNK_SOFT_RESET -> AMS_START [rev3 SOFT_RESET_AMS]
+[ 213.959969] state change AMS_START -> SOFT_RESET_SEND [rev3 SOFT_RESET_AMS]
+
+Cc: stable@vger.kernel.org
+Fixes: 8dea75e11380 ("usb: typec: tcpm: Protocol Error handling")
+Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
+Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20230820044449.1005889-1-badhri@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/tcpm/tcpm.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/typec/tcpm/tcpm.c
++++ b/drivers/usb/typec/tcpm/tcpm.c
+@@ -2689,6 +2689,13 @@ static void tcpm_pd_ctrl_request(struct
+ port->sink_cap_done = true;
+ tcpm_set_state(port, ready_state(port), 0);
+ break;
++ /*
++ * Some port partners do not support GET_STATUS, avoid soft reset the link to
++ * prevent redundant power re-negotiation
++ */
++ case GET_STATUS_SEND:
++ tcpm_set_state(port, ready_state(port), 0);
++ break;
+ case SRC_READY:
+ case SNK_READY:
+ if (port->vdm_state > VDM_STATE_READY) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
