From: Sasha Levin Date: Mon, 7 Nov 2022 04:04:23 +0000 (-0500) Subject: Fixes for 5.15 X-Git-Tag: v4.9.333~79 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4f0854556e0dad1cd0f59e50f1eb4155341fcbdc;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/acpi-apei-fix-integer-overflow-in-ghes_estatus_pool_.patch b/queue-5.15/acpi-apei-fix-integer-overflow-in-ghes_estatus_pool_.patch new file mode 100644 index 00000000000..43bbc785fb6 --- /dev/null +++ b/queue-5.15/acpi-apei-fix-integer-overflow-in-ghes_estatus_pool_.patch @@ -0,0 +1,83 @@ +From ae5ec365358563ad3a9b114b28cf2e6cc697b25e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Oct 2022 16:32:53 +0000 +Subject: ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init() + +From: Ashish Kalra + +[ Upstream commit 43d2748394c3feb86c0c771466f5847e274fc043 ] + +Change num_ghes from int to unsigned int, preventing an overflow +and causing subsequent vmalloc() to fail. + +The overflow happens in ghes_estatus_pool_init() when calculating +len during execution of the statement below as both multiplication +operands here are signed int: + +len += (num_ghes * GHES_ESOURCE_PREALLOC_MAX_SIZE); + +The following call trace is observed because of this bug: + +[ 9.317108] swapper/0: vmalloc error: size 18446744071562596352, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1 +[ 9.317131] Call Trace: +[ 9.317134] +[ 9.317137] dump_stack_lvl+0x49/0x5f +[ 9.317145] dump_stack+0x10/0x12 +[ 9.317146] warn_alloc.cold+0x7b/0xdf +[ 9.317150] ? __device_attach+0x16a/0x1b0 +[ 9.317155] __vmalloc_node_range+0x702/0x740 +[ 9.317160] ? device_add+0x17f/0x920 +[ 9.317164] ? dev_set_name+0x53/0x70 +[ 9.317166] ? platform_device_add+0xf9/0x240 +[ 9.317168] __vmalloc_node+0x49/0x50 +[ 9.317170] ? ghes_estatus_pool_init+0x43/0xa0 +[ 9.317176] vmalloc+0x21/0x30 +[ 9.317177] ghes_estatus_pool_init+0x43/0xa0 +[ 9.317179] acpi_hest_init+0x129/0x19c +[ 9.317185] acpi_init+0x434/0x4a4 +[ 9.317188] ? acpi_sleep_proc_init+0x2a/0x2a +[ 9.317190] do_one_initcall+0x48/0x200 +[ 9.317195] kernel_init_freeable+0x221/0x284 +[ 9.317200] ? rest_init+0xe0/0xe0 +[ 9.317204] kernel_init+0x1a/0x130 +[ 9.317205] ret_from_fork+0x22/0x30 +[ 9.317208] + +Signed-off-by: Ashish Kalra +[ rjw: Subject and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/apei/ghes.c | 2 +- + include/acpi/ghes.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index d490670f8d55..8678e162181f 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -163,7 +163,7 @@ static void ghes_unmap(void __iomem *vaddr, enum fixed_addresses fixmap_idx) + clear_fixmap(fixmap_idx); + } + +-int ghes_estatus_pool_init(int num_ghes) ++int ghes_estatus_pool_init(unsigned int num_ghes) + { + unsigned long addr, len; + int rc; +diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h +index 34fb3431a8f3..292a5c40bd0c 100644 +--- a/include/acpi/ghes.h ++++ b/include/acpi/ghes.h +@@ -71,7 +71,7 @@ int ghes_register_vendor_record_notifier(struct notifier_block *nb); + void ghes_unregister_vendor_record_notifier(struct notifier_block *nb); + #endif + +-int ghes_estatus_pool_init(int num_ghes); ++int ghes_estatus_pool_init(unsigned int num_ghes); + + /* From drivers/edac/ghes_edac.c */ + +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-imx6qdl-gw59-10-13-fix-user-pushbutton-gpio-.patch b/queue-5.15/arm-dts-imx6qdl-gw59-10-13-fix-user-pushbutton-gpio-.patch new file mode 100644 index 00000000000..732c14723ed --- /dev/null +++ b/queue-5.15/arm-dts-imx6qdl-gw59-10-13-fix-user-pushbutton-gpio-.patch @@ -0,0 +1,50 @@ +From 044594529bb9d384b864d8cea00e86c6428884d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Sep 2022 12:52:22 -0700 +Subject: ARM: dts: imx6qdl-gw59{10,13}: fix user pushbutton GPIO offset + +From: Tim Harvey + +[ Upstream commit bb5ad73941dc3f4e3c2241348f385da6501d50ea ] + +The GW5910 and GW5913 have a user pushbutton that is tied to the +Gateworks System Controller GPIO offset 2. Fix the invalid offset of 0. + +Fixes: 64bf0a0af18d ("ARM: dts: imx6qdl-gw: add Gateworks System Controller support") +Signed-off-by: Tim Harvey +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-gw5910.dtsi | 2 +- + arch/arm/boot/dts/imx6qdl-gw5913.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-gw5910.dtsi b/arch/arm/boot/dts/imx6qdl-gw5910.dtsi +index 68e5ab2e27e2..6bb4855d13ce 100644 +--- a/arch/arm/boot/dts/imx6qdl-gw5910.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-gw5910.dtsi +@@ -29,7 +29,7 @@ gpio-keys { + + user-pb { + label = "user_pb"; +- gpios = <&gsc_gpio 0 GPIO_ACTIVE_LOW>; ++ gpios = <&gsc_gpio 2 GPIO_ACTIVE_LOW>; + linux,code = ; + }; + +diff --git a/arch/arm/boot/dts/imx6qdl-gw5913.dtsi b/arch/arm/boot/dts/imx6qdl-gw5913.dtsi +index 8e23cec7149e..696427b487f0 100644 +--- a/arch/arm/boot/dts/imx6qdl-gw5913.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-gw5913.dtsi +@@ -26,7 +26,7 @@ gpio-keys { + + user-pb { + label = "user_pb"; +- gpios = <&gsc_gpio 0 GPIO_ACTIVE_LOW>; ++ gpios = <&gsc_gpio 2 GPIO_ACTIVE_LOW>; + linux,code = ; + }; + +-- +2.35.1 + diff --git a/queue-5.15/arm64-dts-imx8-correct-clock-order.patch b/queue-5.15/arm64-dts-imx8-correct-clock-order.patch new file mode 100644 index 00000000000..a7d939dafea --- /dev/null +++ b/queue-5.15/arm64-dts-imx8-correct-clock-order.patch @@ -0,0 +1,68 @@ +From a08e64efab740ecee00dd93f6030bf64e1a5c31c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 18:07:47 +0800 +Subject: arm64: dts: imx8: correct clock order + +From: Peng Fan + +[ Upstream commit 06acb824d7d00a30e9400f67eee481b218371b5a ] + +Per bindings/mmc/fsl-imx-esdhc.yaml, the clock order is ipg, ahb, per, +otherwise warning: " +mmc@5b020000: clock-names:1: 'ahb' was expected +mmc@5b020000: clock-names:2: 'per' was expected " + +Fixes: 16c4ea7501b1 ("arm64: dts: imx8: switch to new lpcg clock binding") +Signed-off-by: Peng Fan +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../arm64/boot/dts/freescale/imx8-ss-conn.dtsi | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8-ss-conn.dtsi b/arch/arm64/boot/dts/freescale/imx8-ss-conn.dtsi +index a79f42a9618e..639220dbff00 100644 +--- a/arch/arm64/boot/dts/freescale/imx8-ss-conn.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8-ss-conn.dtsi +@@ -38,9 +38,9 @@ usdhc1: mmc@5b010000 { + interrupts = ; + reg = <0x5b010000 0x10000>; + clocks = <&sdhc0_lpcg IMX_LPCG_CLK_4>, +- <&sdhc0_lpcg IMX_LPCG_CLK_5>, +- <&sdhc0_lpcg IMX_LPCG_CLK_0>; +- clock-names = "ipg", "per", "ahb"; ++ <&sdhc0_lpcg IMX_LPCG_CLK_0>, ++ <&sdhc0_lpcg IMX_LPCG_CLK_5>; ++ clock-names = "ipg", "ahb", "per"; + power-domains = <&pd IMX_SC_R_SDHC_0>; + status = "disabled"; + }; +@@ -49,9 +49,9 @@ usdhc2: mmc@5b020000 { + interrupts = ; + reg = <0x5b020000 0x10000>; + clocks = <&sdhc1_lpcg IMX_LPCG_CLK_4>, +- <&sdhc1_lpcg IMX_LPCG_CLK_5>, +- <&sdhc1_lpcg IMX_LPCG_CLK_0>; +- clock-names = "ipg", "per", "ahb"; ++ <&sdhc1_lpcg IMX_LPCG_CLK_0>, ++ <&sdhc1_lpcg IMX_LPCG_CLK_5>; ++ clock-names = "ipg", "ahb", "per"; + power-domains = <&pd IMX_SC_R_SDHC_1>; + fsl,tuning-start-tap = <20>; + fsl,tuning-step= <2>; +@@ -62,9 +62,9 @@ usdhc3: mmc@5b030000 { + interrupts = ; + reg = <0x5b030000 0x10000>; + clocks = <&sdhc2_lpcg IMX_LPCG_CLK_4>, +- <&sdhc2_lpcg IMX_LPCG_CLK_5>, +- <&sdhc2_lpcg IMX_LPCG_CLK_0>; +- clock-names = "ipg", "per", "ahb"; ++ <&sdhc2_lpcg IMX_LPCG_CLK_0>, ++ <&sdhc2_lpcg IMX_LPCG_CLK_5>; ++ clock-names = "ipg", "ahb", "per"; + power-domains = <&pd IMX_SC_R_SDHC_2>; + status = "disabled"; + }; +-- +2.35.1 + diff --git a/queue-5.15/arm64-dts-juno-add-thermal-critical-trip-points.patch b/queue-5.15/arm64-dts-juno-add-thermal-critical-trip-points.patch new file mode 100644 index 00000000000..b7134f24bf3 --- /dev/null +++ b/queue-5.15/arm64-dts-juno-add-thermal-critical-trip-points.patch @@ -0,0 +1,62 @@ +From 797f1256499d044904f7167a3e3b33956d7c8c71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Oct 2022 15:08:33 +0100 +Subject: arm64: dts: juno: Add thermal critical trip points + +From: Cristian Marussi + +[ Upstream commit c4a7b9b587ca1bb4678d48d8be7132492b23a81c ] + +When thermnal zones are defined, trip points definitions are mandatory. +Define a couple of critical trip points for monitoring of existing +PMIC and SOC thermal zones. + +This was lost between txt to yaml conversion and was re-enforced recently +via the commit 8c596324232d ("dt-bindings: thermal: Fix missing required property") + +Cc: Rob Herring +Cc: Krzysztof Kozlowski +Cc: devicetree@vger.kernel.org +Signed-off-by: Cristian Marussi +Fixes: f7b636a8d83c ("arm64: dts: juno: add thermal zones for scpi sensors") +Link: https://lore.kernel.org/r/20221028140833.280091-8-cristian.marussi@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/arm/juno-base.dtsi | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/arch/arm64/boot/dts/arm/juno-base.dtsi b/arch/arm64/boot/dts/arm/juno-base.dtsi +index 34e5549ea748..a00b0f14c222 100644 +--- a/arch/arm64/boot/dts/arm/juno-base.dtsi ++++ b/arch/arm64/boot/dts/arm/juno-base.dtsi +@@ -597,12 +597,26 @@ pmic { + polling-delay = <1000>; + polling-delay-passive = <100>; + thermal-sensors = <&scpi_sensors0 0>; ++ trips { ++ pmic_crit0: trip0 { ++ temperature = <90000>; ++ hysteresis = <2000>; ++ type = "critical"; ++ }; ++ }; + }; + + soc { + polling-delay = <1000>; + polling-delay-passive = <100>; + thermal-sensors = <&scpi_sensors0 3>; ++ trips { ++ soc_crit0: trip0 { ++ temperature = <80000>; ++ hysteresis = <2000>; ++ type = "critical"; ++ }; ++ }; + }; + + big_cluster_thermal_zone: big-cluster { +-- +2.35.1 + diff --git a/queue-5.15/arm64-dts-ls1088a-specify-clock-frequencies-for-the-.patch b/queue-5.15/arm64-dts-ls1088a-specify-clock-frequencies-for-the-.patch new file mode 100644 index 00000000000..9a1faae04a9 --- /dev/null +++ b/queue-5.15/arm64-dts-ls1088a-specify-clock-frequencies-for-the-.patch @@ -0,0 +1,50 @@ +From a7fc2f464662c2c6ea0168ba802b6370322e1ced Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Oct 2022 17:41:16 +0300 +Subject: arm64: dts: ls1088a: specify clock frequencies for the MDIO + controllers + +From: Ioana Ciornei + +[ Upstream commit d78a57426e64fc4c61e6189e450a0432d24536ca ] + +Up until now, the external MDIO controller frequency values relied +either on the default ones out of reset or on those setup by u-boot. +Let's just properly specify the MDC frequency in the DTS so that even +without u-boot's intervention Linux can drive the MDIO bus. + +Fixes: bbe75af7b092 ("arm64: dts: ls1088a: add external MDIO device nodes") +Signed-off-by: Ioana Ciornei +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi +index 605072317243..63441028622a 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi +@@ -758,6 +758,9 @@ emdio1: mdio@8b96000 { + little-endian; + #address-cells = <1>; + #size-cells = <0>; ++ clock-frequency = <2500000>; ++ clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL ++ QORIQ_CLK_PLL_DIV(1)>; + status = "disabled"; + }; + +@@ -767,6 +770,9 @@ emdio2: mdio@8b97000 { + little-endian; + #address-cells = <1>; + #size-cells = <0>; ++ clock-frequency = <2500000>; ++ clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL ++ QORIQ_CLK_PLL_DIV(1)>; + status = "disabled"; + }; + +-- +2.35.1 + diff --git a/queue-5.15/arm64-dts-ls208xa-specify-clock-frequencies-for-the-.patch b/queue-5.15/arm64-dts-ls208xa-specify-clock-frequencies-for-the-.patch new file mode 100644 index 00000000000..6b07cb7f371 --- /dev/null +++ b/queue-5.15/arm64-dts-ls208xa-specify-clock-frequencies-for-the-.patch @@ -0,0 +1,50 @@ +From 37ef3a26e6f138580f8b1e068abee7523ef59dfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Oct 2022 17:41:17 +0300 +Subject: arm64: dts: ls208xa: specify clock frequencies for the MDIO + controllers + +From: Ioana Ciornei + +[ Upstream commit d5c921a53c80dfa942f6dff36253db5a50775a5f ] + +Up until now, the external MDIO controller frequency values relied +either on the default ones out of reset or on those setup by u-boot. +Let's just properly specify the MDC frequency in the DTS so that even +without u-boot's intervention Linux can drive the MDIO bus. + +Fixes: 0420dde30a90 ("arm64: dts: ls208xa: add the external MDIO nodes") +Signed-off-by: Ioana Ciornei +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi +index 1282b61da8a5..12e59777363f 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi +@@ -525,6 +525,9 @@ emdio1: mdio@8b96000 { + little-endian; + #address-cells = <1>; + #size-cells = <0>; ++ clock-frequency = <2500000>; ++ clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL ++ QORIQ_CLK_PLL_DIV(2)>; + status = "disabled"; + }; + +@@ -534,6 +537,9 @@ emdio2: mdio@8b97000 { + little-endian; + #address-cells = <1>; + #size-cells = <0>; ++ clock-frequency = <2500000>; ++ clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL ++ QORIQ_CLK_PLL_DIV(2)>; + status = "disabled"; + }; + +-- +2.35.1 + diff --git a/queue-5.15/arm64-dts-lx2160a-specify-clock-frequencies-for-the-.patch b/queue-5.15/arm64-dts-lx2160a-specify-clock-frequencies-for-the-.patch new file mode 100644 index 00000000000..d2b81faaed1 --- /dev/null +++ b/queue-5.15/arm64-dts-lx2160a-specify-clock-frequencies-for-the-.patch @@ -0,0 +1,51 @@ +From 1e2f18e951b37ee93faf3d673bc84d4f09ce28e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Oct 2022 17:41:15 +0300 +Subject: arm64: dts: lx2160a: specify clock frequencies for the MDIO + controllers + +From: Ioana Ciornei + +[ Upstream commit c126a0abc5dadd7df236f20aae6d8c3d103f095c ] + +Up until now, the external MDIO controller frequency values relied +either on the default ones out of reset or on those setup by u-boot. +Let's just properly specify the MDC frequency in the DTS so that even +without u-boot's intervention Linux can drive the MDIO bus. + +Fixes: 6e1b8fae892d ("arm64: dts: lx2160a: add emdio1 node") +Fixes: 5705b9dcda57 ("arm64: dts: lx2160a: add emdio2 node") +Signed-off-by: Ioana Ciornei +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi b/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi +index 51c4f61007cd..1bc7f538f690 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi +@@ -1369,6 +1369,9 @@ emdio1: mdio@8b96000 { + #address-cells = <1>; + #size-cells = <0>; + little-endian; ++ clock-frequency = <2500000>; ++ clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL ++ QORIQ_CLK_PLL_DIV(2)>; + status = "disabled"; + }; + +@@ -1379,6 +1382,9 @@ emdio2: mdio@8b97000 { + little-endian; + #address-cells = <1>; + #size-cells = <0>; ++ clock-frequency = <2500000>; ++ clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL ++ QORIQ_CLK_PLL_DIV(2)>; + status = "disabled"; + }; + +-- +2.35.1 + diff --git a/queue-5.15/block-fix-possible-memory-leak-for-rq_wb-on-add_disk.patch b/queue-5.15/block-fix-possible-memory-leak-for-rq_wb-on-add_disk.patch new file mode 100644 index 00000000000..3b1297cd46e --- /dev/null +++ b/queue-5.15/block-fix-possible-memory-leak-for-rq_wb-on-add_disk.patch @@ -0,0 +1,67 @@ +From f9a1ffa3c7172ae14865e663a8f0e07c74f4d03a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Oct 2022 15:13:55 +0800 +Subject: block: Fix possible memory leak for rq_wb on add_disk failure + +From: Chen Zhongjin + +[ Upstream commit fa81cbafbf5764ad5053512152345fab37a1fe18 ] + +kmemleak reported memory leaks in device_add_disk(): + +kmemleak: 3 new suspected memory leaks + +unreferenced object 0xffff88800f420800 (size 512): + comm "modprobe", pid 4275, jiffies 4295639067 (age 223.512s) + hex dump (first 32 bytes): + 04 00 00 00 08 00 00 00 01 00 00 00 00 00 00 00 ................ + 00 e1 f5 05 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<00000000d3662699>] kmalloc_trace+0x26/0x60 + [<00000000edc7aadc>] wbt_init+0x50/0x6f0 + [<0000000069601d16>] wbt_enable_default+0x157/0x1c0 + [<0000000028fc393f>] blk_register_queue+0x2a4/0x420 + [<000000007345a042>] device_add_disk+0x6fd/0xe40 + [<0000000060e6aab0>] nbd_dev_add+0x828/0xbf0 [nbd] + ... + +It is because the memory allocated in wbt_enable_default() is not +released in device_add_disk() error path. +Normally, these memory are freed in: + +del_gendisk() + rq_qos_exit() + rqos->ops->exit(rqos); + wbt_exit() + +So rq_qos_exit() is called to free the rq_wb memory for wbt_init(). +However in the error path of device_add_disk(), only +blk_unregister_queue() is called and make rq_wb memory leaked. + +Add rq_qos_exit() to the error path to fix it. + +Fixes: 83cbce957446 ("block: add error handling for device_add_disk / add_disk") +Signed-off-by: Chen Zhongjin +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20221029071355.35462-1-chenzhongjin@huawei.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/genhd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/block/genhd.c b/block/genhd.c +index 74e19d67ceab..68065189ca17 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -527,6 +527,7 @@ int device_add_disk(struct device *parent, struct gendisk *disk, + bdi_unregister(disk->bdi); + out_unregister_queue: + blk_unregister_queue(disk); ++ rq_qos_exit(disk->queue); + out_put_slave_dir: + kobject_put(disk->slave_dir); + out_put_holder_dir: +-- +2.35.1 + diff --git a/queue-5.15/clk-qcom-update-the-force-mem-core-bit-for-gpu-clock.patch b/queue-5.15/clk-qcom-update-the-force-mem-core-bit-for-gpu-clock.patch new file mode 100644 index 00000000000..0ab549a089b --- /dev/null +++ b/queue-5.15/clk-qcom-update-the-force-mem-core-bit-for-gpu-clock.patch @@ -0,0 +1,53 @@ +From 1ce24b16b6a4871c4f3b40ecf5f5932977f12ad9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 11:35:35 +0530 +Subject: clk: qcom: Update the force mem core bit for GPU clocks + +From: Taniya Das + +[ Upstream commit ffa20aa581cf5377fc397b0d0ff9d67ea823629b ] + +There are few GPU clocks which are powering up the memories +and thus enable the FORCE_MEM_PERIPH always for these clocks +to force the periph_on signal to remain active during halt +state of the clock. + +Fixes: a3cc092196ef ("clk: qcom: Add Global Clock controller (GCC) driver for SC7280") +Fixes: 3e0f01d6c7e7 ("clk: qcom: Add graphics clock controller driver for SC7280") +Signed-off-by: Taniya Das +Signed-off-by: Satya Priya +Link: https://lore.kernel.org/r/1666159535-6447-1-git-send-email-quic_c_skakit@quicinc.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sc7280.c | 1 + + drivers/clk/qcom/gpucc-sc7280.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/clk/qcom/gcc-sc7280.c b/drivers/clk/qcom/gcc-sc7280.c +index ce7c5ba2b9b7..d10efbf260b7 100644 +--- a/drivers/clk/qcom/gcc-sc7280.c ++++ b/drivers/clk/qcom/gcc-sc7280.c +@@ -3571,6 +3571,7 @@ static int gcc_sc7280_probe(struct platform_device *pdev) + regmap_update_bits(regmap, 0x28004, BIT(0), BIT(0)); + regmap_update_bits(regmap, 0x28014, BIT(0), BIT(0)); + regmap_update_bits(regmap, 0x71004, BIT(0), BIT(0)); ++ regmap_update_bits(regmap, 0x7100C, BIT(13), BIT(13)); + + ret = qcom_cc_register_rcg_dfs(regmap, gcc_dfs_clocks, + ARRAY_SIZE(gcc_dfs_clocks)); +diff --git a/drivers/clk/qcom/gpucc-sc7280.c b/drivers/clk/qcom/gpucc-sc7280.c +index 9a832f2bcf49..1490cd45a654 100644 +--- a/drivers/clk/qcom/gpucc-sc7280.c ++++ b/drivers/clk/qcom/gpucc-sc7280.c +@@ -463,6 +463,7 @@ static int gpu_cc_sc7280_probe(struct platform_device *pdev) + */ + regmap_update_bits(regmap, 0x1170, BIT(0), BIT(0)); + regmap_update_bits(regmap, 0x1098, BIT(0), BIT(0)); ++ regmap_update_bits(regmap, 0x1098, BIT(13), BIT(13)); + + return qcom_cc_really_probe(pdev, &gpu_cc_sc7280_desc, regmap); + } +-- +2.35.1 + diff --git a/queue-5.15/drm-amdgpu-set-vm_update_mode-0-as-default-for-sienn.patch b/queue-5.15/drm-amdgpu-set-vm_update_mode-0-as-default-for-sienn.patch new file mode 100644 index 00000000000..bc7408f091e --- /dev/null +++ b/queue-5.15/drm-amdgpu-set-vm_update_mode-0-as-default-for-sienn.patch @@ -0,0 +1,87 @@ +From b27f7a670c1b78c94b4aaa307786ac0bbc66ce4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Oct 2022 15:39:44 +0200 +Subject: drm/amdgpu: set vm_update_mode=0 as default for Sienna Cichlid in + SRIOV case + +From: Danijel Slivka + +[ Upstream commit 65f8682b9aaae20c2cdee993e6fe52374ad513c9 ] + +For asic with VF MMIO access protection avoid using CPU for VM table updates. +CPU pagetable updates have issues with HDP flush as VF MMIO access protection +blocks write to mmBIF_BX_DEV0_EPF0_VF0_HDP_MEM_COHERENCY_FLUSH_CNTL register +during sriov runtime. + +v3: introduce virtualization capability flag AMDGPU_VF_MMIO_ACCESS_PROTECT +which indicates that VF MMIO write access is not allowed in sriov runtime + +Signed-off-by: Danijel Slivka +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 6 ++++++ + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 4 ++++ + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +++++- + 3 files changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +index a0803425b456..b508126a9738 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +@@ -706,6 +706,12 @@ void amdgpu_detect_virtualization(struct amdgpu_device *adev) + adev->virt.caps |= AMDGPU_PASSTHROUGH_MODE; + } + ++ if (amdgpu_sriov_vf(adev) && adev->asic_type == CHIP_SIENNA_CICHLID) ++ /* VF MMIO access (except mailbox range) from CPU ++ * will be blocked during sriov runtime ++ */ ++ adev->virt.caps |= AMDGPU_VF_MMIO_ACCESS_PROTECT; ++ + /* we have the ability to check now */ + if (amdgpu_sriov_vf(adev)) { + switch (adev->asic_type) { +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h +index 9adfb8d63280..ce31d4fdee93 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h +@@ -31,6 +31,7 @@ + #define AMDGPU_SRIOV_CAPS_IS_VF (1 << 2) /* this GPU is a virtual function */ + #define AMDGPU_PASSTHROUGH_MODE (1 << 3) /* thw whole GPU is pass through for VM */ + #define AMDGPU_SRIOV_CAPS_RUNTIME (1 << 4) /* is out of full access mode */ ++#define AMDGPU_VF_MMIO_ACCESS_PROTECT (1 << 5) /* MMIO write access is not allowed in sriov runtime */ + + /* all asic after AI use this offset */ + #define mmRCC_IOV_FUNC_IDENTIFIER 0xDE5 +@@ -278,6 +279,9 @@ struct amdgpu_video_codec_info; + #define amdgpu_passthrough(adev) \ + ((adev)->virt.caps & AMDGPU_PASSTHROUGH_MODE) + ++#define amdgpu_sriov_vf_mmio_access_protection(adev) \ ++((adev)->virt.caps & AMDGPU_VF_MMIO_ACCESS_PROTECT) ++ + static inline bool is_virtual_machine(void) + { + #ifdef CONFIG_X86 +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +index fd37bb39774c..01710cd0d972 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -3224,7 +3224,11 @@ void amdgpu_vm_manager_init(struct amdgpu_device *adev) + */ + #ifdef CONFIG_X86_64 + if (amdgpu_vm_update_mode == -1) { +- if (amdgpu_gmc_vram_full_visible(&adev->gmc)) ++ /* For asic with VF MMIO access protection ++ * avoid using CPU for VM table updates ++ */ ++ if (amdgpu_gmc_vram_full_visible(&adev->gmc) && ++ !amdgpu_sriov_vf_mmio_access_protection(adev)) + adev->vm_manager.vm_update_mode = + AMDGPU_VM_USE_CPU_FOR_COMPUTE; + else +-- +2.35.1 + diff --git a/queue-5.15/efi-tpm-pass-correct-address-to-memblock_reserve.patch b/queue-5.15/efi-tpm-pass-correct-address-to-memblock_reserve.patch new file mode 100644 index 00000000000..30a9408efed --- /dev/null +++ b/queue-5.15/efi-tpm-pass-correct-address-to-memblock_reserve.patch @@ -0,0 +1,46 @@ +From add1c12e2d86dd7ff41328a9614ee426d3206d3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Oct 2022 08:23:52 -0700 +Subject: efi/tpm: Pass correct address to memblock_reserve + +From: Jerry Snitselaar + +[ Upstream commit f4cd18c5b2000df0c382f6530eeca9141ea41faf ] + +memblock_reserve() expects a physical address, but the address being +passed for the TPM final events log is what was returned from +early_memremap(). This results in something like the following: + +[ 0.000000] memblock_reserve: [0xffffffffff2c0000-0xffffffffff2c00e4] efi_tpm_eventlog_init+0x324/0x370 + +Pass the address from efi like what is done for the TPM events log. + +Fixes: c46f3405692d ("tpm: Reserve the TPM final events table") +Cc: Matthew Garrett +Cc: Jarkko Sakkinen +Cc: Bartosz Szczepanek +Cc: Ard Biesheuvel +Signed-off-by: Jerry Snitselaar +Acked-by: Jarkko Sakkinen +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/tpm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c +index 8f665678e9e3..e8d69bd548f3 100644 +--- a/drivers/firmware/efi/tpm.c ++++ b/drivers/firmware/efi/tpm.c +@@ -97,7 +97,7 @@ int __init efi_tpm_eventlog_init(void) + goto out_calc; + } + +- memblock_reserve((unsigned long)final_tbl, ++ memblock_reserve(efi.tpm_final_log, + tbl_size + sizeof(*final_tbl)); + efi_tpm_final_log_size = tbl_size; + +-- +2.35.1 + diff --git a/queue-5.15/firmware-arm_scmi-fix-devres-allocation-device-in-vi.patch b/queue-5.15/firmware-arm_scmi-fix-devres-allocation-device-in-vi.patch new file mode 100644 index 00000000000..cfa6ee1f947 --- /dev/null +++ b/queue-5.15/firmware-arm_scmi-fix-devres-allocation-device-in-vi.patch @@ -0,0 +1,52 @@ +From 9a747cd60dbe9f1d0e0125a73cd9a4bba39ca94b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Oct 2022 15:08:30 +0100 +Subject: firmware: arm_scmi: Fix devres allocation device in virtio transport + +From: Cristian Marussi + +[ Upstream commit 5ffc1c4cb896f8d2cf10309422da3633a616d60f ] + +SCMI virtio transport device managed allocations must use the main +platform device in devres operations instead of the channel devices. + +Cc: Peter Hilber +Fixes: 46abe13b5e3d ("firmware: arm_scmi: Add virtio transport") +Signed-off-by: Cristian Marussi +Link: https://lore.kernel.org/r/20221028140833.280091-5-cristian.marussi@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/virtio.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/virtio.c b/drivers/firmware/arm_scmi/virtio.c +index 87039c5c03fd..0c351eeee746 100644 +--- a/drivers/firmware/arm_scmi/virtio.c ++++ b/drivers/firmware/arm_scmi/virtio.c +@@ -247,19 +247,19 @@ static int virtio_chan_setup(struct scmi_chan_info *cinfo, struct device *dev, + for (i = 0; i < vioch->max_msg; i++) { + struct scmi_vio_msg *msg; + +- msg = devm_kzalloc(cinfo->dev, sizeof(*msg), GFP_KERNEL); ++ msg = devm_kzalloc(dev, sizeof(*msg), GFP_KERNEL); + if (!msg) + return -ENOMEM; + + if (tx) { +- msg->request = devm_kzalloc(cinfo->dev, ++ msg->request = devm_kzalloc(dev, + VIRTIO_SCMI_MAX_PDU_SIZE, + GFP_KERNEL); + if (!msg->request) + return -ENOMEM; + } + +- msg->input = devm_kzalloc(cinfo->dev, VIRTIO_SCMI_MAX_PDU_SIZE, ++ msg->input = devm_kzalloc(dev, VIRTIO_SCMI_MAX_PDU_SIZE, + GFP_KERNEL); + if (!msg->input) + return -ENOMEM; +-- +2.35.1 + diff --git a/queue-5.15/firmware-arm_scmi-make-rx-chan_setup-fail-on-memory-.patch b/queue-5.15/firmware-arm_scmi-make-rx-chan_setup-fail-on-memory-.patch new file mode 100644 index 00000000000..14b44b26326 --- /dev/null +++ b/queue-5.15/firmware-arm_scmi-make-rx-chan_setup-fail-on-memory-.patch @@ -0,0 +1,46 @@ +From 5ad8344b3c42587ded1aa4df57df23f06ca6a997 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Oct 2022 15:08:29 +0100 +Subject: firmware: arm_scmi: Make Rx chan_setup fail on memory errors + +From: Cristian Marussi + +[ Upstream commit be9ba1f7f9e0b565b19f4294f5871da9d654bc6d ] + +SCMI Rx channels are optional and they can fail to be setup when not +present but anyway channels setup routines must bail-out on memory errors. + +Make channels setup, and related probing, fail when memory errors are +reported on Rx channels. + +Fixes: 5c8a47a5a91d ("firmware: arm_scmi: Make scmi core independent of the transport type") +Signed-off-by: Cristian Marussi +Link: https://lore.kernel.org/r/20221028140833.280091-4-cristian.marussi@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/driver.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c +index 2c1d5f943dd3..16569af4a2ba 100644 +--- a/drivers/firmware/arm_scmi/driver.c ++++ b/drivers/firmware/arm_scmi/driver.c +@@ -1516,8 +1516,12 @@ scmi_txrx_setup(struct scmi_info *info, struct device *dev, int prot_id) + { + int ret = scmi_chan_setup(info, dev, prot_id, true); + +- if (!ret) /* Rx is optional, hence no error check */ +- scmi_chan_setup(info, dev, prot_id, false); ++ if (!ret) { ++ /* Rx is optional, report only memory errors */ ++ ret = scmi_chan_setup(info, dev, prot_id, false); ++ if (ret && ret != -ENOMEM) ++ ret = 0; ++ } + + return ret; + } +-- +2.35.1 + diff --git a/queue-5.15/firmware-arm_scmi-suppress-the-driver-s-bind-attribu.patch b/queue-5.15/firmware-arm_scmi-suppress-the-driver-s-bind-attribu.patch new file mode 100644 index 00000000000..3f7eab68420 --- /dev/null +++ b/queue-5.15/firmware-arm_scmi-suppress-the-driver-s-bind-attribu.patch @@ -0,0 +1,36 @@ +From e81db40424bb464c694fef0524e229462b0f100b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Oct 2022 15:08:27 +0100 +Subject: firmware: arm_scmi: Suppress the driver's bind attributes + +From: Cristian Marussi + +[ Upstream commit fd96fbc8fad35d6b1872c90df8a2f5d721f14d91 ] + +Suppress the capability to unbind the core SCMI driver since all the +SCMI stack protocol drivers depend on it. + +Fixes: aa4f886f3893 ("firmware: arm_scmi: add basic driver infrastructure for SCMI") +Signed-off-by: Cristian Marussi +Link: https://lore.kernel.org/r/20221028140833.280091-2-cristian.marussi@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/driver.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c +index e815b8f98739..2c1d5f943dd3 100644 +--- a/drivers/firmware/arm_scmi/driver.c ++++ b/drivers/firmware/arm_scmi/driver.c +@@ -2009,6 +2009,7 @@ MODULE_DEVICE_TABLE(of, scmi_of_match); + static struct platform_driver scmi_driver = { + .driver = { + .name = "arm-scmi", ++ .suppress_bind_attrs = true, + .of_match_table = scmi_of_match, + .dev_groups = versions_groups, + }, +-- +2.35.1 + diff --git a/queue-5.15/hid-saitek-add-madcatz-variant-of-mmo7-mouse-device-.patch b/queue-5.15/hid-saitek-add-madcatz-variant-of-mmo7-mouse-device-.patch new file mode 100644 index 00000000000..f374da38bab --- /dev/null +++ b/queue-5.15/hid-saitek-add-madcatz-variant-of-mmo7-mouse-device-.patch @@ -0,0 +1,61 @@ +From f2747ce47edae2409c325b004f70897195627f47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Oct 2022 19:51:23 +0100 +Subject: HID: saitek: add madcatz variant of MMO7 mouse device ID + +From: Samuel Bailey + +[ Upstream commit 79425b297f56bd481c6e97700a9a4e44c7bcfa35 ] + +The MadCatz variant of the MMO7 mouse has the ID 0738:1713 and the same +quirks as the Saitek variant. + +Signed-off-by: Samuel Bailey +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-quirks.c | 1 + + drivers/hid/hid-saitek.c | 2 ++ + 3 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index a5aac9cc2075..c8a313c84a57 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -845,6 +845,7 @@ + #define USB_DEVICE_ID_MADCATZ_BEATPAD 0x4540 + #define USB_DEVICE_ID_MADCATZ_RAT5 0x1705 + #define USB_DEVICE_ID_MADCATZ_RAT9 0x1709 ++#define USB_DEVICE_ID_MADCATZ_MMO7 0x1713 + + #define USB_VENDOR_ID_MCC 0x09db + #define USB_DEVICE_ID_MCC_PMD1024LS 0x0076 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 544d1197aca4..8d36cb7551cf 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -608,6 +608,7 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_MMO7) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT5) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_MMO7) }, + #endif + #if IS_ENABLED(CONFIG_HID_SAMSUNG) + { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_IR_REMOTE) }, +diff --git a/drivers/hid/hid-saitek.c b/drivers/hid/hid-saitek.c +index c7bf14c01960..b84e975977c4 100644 +--- a/drivers/hid/hid-saitek.c ++++ b/drivers/hid/hid-saitek.c +@@ -187,6 +187,8 @@ static const struct hid_device_id saitek_devices[] = { + .driver_data = SAITEK_RELEASE_MODE_RAT7 }, + { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_MMO7), + .driver_data = SAITEK_RELEASE_MODE_MMO7 }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_MMO7), ++ .driver_data = SAITEK_RELEASE_MODE_MMO7 }, + { } + }; + +-- +2.35.1 + diff --git a/queue-5.15/i2c-piix4-fix-adapter-not-be-removed-in-piix4_remove.patch b/queue-5.15/i2c-piix4-fix-adapter-not-be-removed-in-piix4_remove.patch new file mode 100644 index 00000000000..d360aa53428 --- /dev/null +++ b/queue-5.15/i2c-piix4-fix-adapter-not-be-removed-in-piix4_remove.patch @@ -0,0 +1,81 @@ +From 73cd01eb388e0c8d277ed7979984f8ffa49cf658 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 20:13:53 +0800 +Subject: i2c: piix4: Fix adapter not be removed in piix4_remove() + +From: Chen Zhongjin + +[ Upstream commit 569bea74c94d37785682b11bab76f557520477cd ] + +In piix4_probe(), the piix4 adapter will be registered in: + + piix4_probe() + piix4_add_adapters_sb800() / piix4_add_adapter() + i2c_add_adapter() + +Based on the probed device type, piix4_add_adapters_sb800() or single +piix4_add_adapter() will be called. +For the former case, piix4_adapter_count is set as the number of adapters, +while for antoher case it is not set and kept default *zero*. + +When piix4 is removed, piix4_remove() removes the adapters added in +piix4_probe(), basing on the piix4_adapter_count value. +Because the count is zero for the single adapter case, the adapter won't +be removed and makes the sources allocated for adapter leaked, such as +the i2c client and device. + +These sources can still be accessed by i2c or bus and cause problems. +An easily reproduced case is that if a new adapter is registered, i2c +will get the leaked adapter and try to call smbus_algorithm, which was +already freed: + +Triggered by: rmmod i2c_piix4 && modprobe max31730 + + BUG: unable to handle page fault for address: ffffffffc053d860 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + Oops: 0000 [#1] PREEMPT SMP KASAN + CPU: 0 PID: 3752 Comm: modprobe Tainted: G + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) + RIP: 0010:i2c_default_probe (drivers/i2c/i2c-core-base.c:2259) i2c_core + RSP: 0018:ffff888107477710 EFLAGS: 00000246 + ... + + i2c_detect (drivers/i2c/i2c-core-base.c:2302) i2c_core + __process_new_driver (drivers/i2c/i2c-core-base.c:1336) i2c_core + bus_for_each_dev (drivers/base/bus.c:301) + i2c_for_each_dev (drivers/i2c/i2c-core-base.c:1823) i2c_core + i2c_register_driver (drivers/i2c/i2c-core-base.c:1861) i2c_core + do_one_initcall (init/main.c:1296) + do_init_module (kernel/module/main.c:2455) + ... + + ---[ end trace 0000000000000000 ]--- + +Fix this problem by correctly set piix4_adapter_count as 1 for the +single adapter so it can be normally removed. + +Fixes: 528d53a1592b ("i2c: piix4: Fix probing of reserved ports on AMD Family 16h Model 30h") +Signed-off-by: Chen Zhongjin +Reviewed-by: Jean Delvare +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-piix4.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c +index 39cb1b7bb865..809fbd014cd6 100644 +--- a/drivers/i2c/busses/i2c-piix4.c ++++ b/drivers/i2c/busses/i2c-piix4.c +@@ -1080,6 +1080,7 @@ static int piix4_probe(struct pci_dev *dev, const struct pci_device_id *id) + "", &piix4_main_adapters[0]); + if (retval < 0) + return retval; ++ piix4_adapter_count = 1; + } + + /* Check for auxiliary SMBus on some AMD chipsets */ +-- +2.35.1 + diff --git a/queue-5.15/i2c-xiic-add-platform-module-alias.patch b/queue-5.15/i2c-xiic-add-platform-module-alias.patch new file mode 100644 index 00000000000..0b34138dafe --- /dev/null +++ b/queue-5.15/i2c-xiic-add-platform-module-alias.patch @@ -0,0 +1,38 @@ +From 71bed7cb59771c27fc0de8638bf45a3c093cebbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 16:03:37 +0200 +Subject: i2c: xiic: Add platform module alias +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martin Tůma + +[ Upstream commit b8caf0a0e04583fb71e21495bef84509182227ea ] + +The missing "platform" alias is required for the mgb4 v4l2 driver to load +the i2c controller driver when probing the HW. + +Signed-off-by: Martin Tůma +Acked-by: Michal Simek +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-xiic.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index 612343771ce2..34b8da949462 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -934,6 +934,7 @@ static struct platform_driver xiic_i2c_driver = { + + module_platform_driver(xiic_i2c_driver); + ++MODULE_ALIAS("platform:" DRIVER_NAME); + MODULE_AUTHOR("info@mocean-labs.com"); + MODULE_DESCRIPTION("Xilinx I2C bus driver"); + MODULE_LICENSE("GPL v2"); +-- +2.35.1 + diff --git a/queue-5.15/media-atomisp-ensure-that-userptr-pointers-are-page-.patch b/queue-5.15/media-atomisp-ensure-that-userptr-pointers-are-page-.patch new file mode 100644 index 00000000000..74ade702be5 --- /dev/null +++ b/queue-5.15/media-atomisp-ensure-that-userptr-pointers-are-page-.patch @@ -0,0 +1,44 @@ +From dc1828398789d9b3595ded4c295cc0657372ba4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Aug 2022 20:29:06 +0200 +Subject: media: atomisp: Ensure that USERPTR pointers are page aligned + +From: Hans de Goede + +[ Upstream commit 6e6c4ae0f0ba295dbf6cbd48d93bec169d6ce431 ] + +The atomisp code needs USERPTR pointers to be page aligned, +otherwise bad things (scribbling over other parts of the +process' RAM) happen. + +Add a check to ensure this and exit VIDIOC_QBUF calls with +unaligned pointers with -EINVAL. + +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c +index b7dda4b96d49..b98074418718 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c +@@ -1291,6 +1291,12 @@ static int atomisp_qbuf(struct file *file, void *fh, struct v4l2_buffer *buf) + * address and reprograme out page table properly + */ + if (buf->memory == V4L2_MEMORY_USERPTR) { ++ if (offset_in_page(buf->m.userptr)) { ++ dev_err(isp->dev, "Error userptr is not page aligned.\n"); ++ ret = -EINVAL; ++ goto error; ++ } ++ + vb = pipe->capq.bufs[buf->index]; + vm_mem = vb->priv; + if (!vm_mem) { +-- +2.35.1 + diff --git a/queue-5.15/media-atomisp-fix-v4l2_fh-resource-leak-on-open-erro.patch b/queue-5.15/media-atomisp-fix-v4l2_fh-resource-leak-on-open-erro.patch new file mode 100644 index 00000000000..c0b61c97162 --- /dev/null +++ b/queue-5.15/media-atomisp-fix-v4l2_fh-resource-leak-on-open-erro.patch @@ -0,0 +1,35 @@ +From 76cdb51b98fdd048bd718c5d58c4d278b14a2004 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 12:35:43 +0200 +Subject: media: atomisp: Fix v4l2_fh resource leak on open errors + +From: Hans de Goede + +[ Upstream commit 5b9853ad1329be49343a608d574eb232ff1273d0 ] + +When atomisp_open() fails then it must call v4l2_fh_release() to undo +the results of v4l2_fh_open(). + +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/pci/atomisp_fops.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/staging/media/atomisp/pci/atomisp_fops.c b/drivers/staging/media/atomisp/pci/atomisp_fops.c +index 18fff47bd25d..cb61ffb7d3b2 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_fops.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_fops.c +@@ -890,6 +890,7 @@ static int atomisp_open(struct file *file) + error: + hmm_pool_unregister(HMM_POOL_TYPE_DYNAMIC); + rt_mutex_unlock(&isp->mutex); ++ v4l2_fh_release(file); + return ret; + } + +-- +2.35.1 + diff --git a/queue-5.15/media-atomisp-fix-vidioc_try_fmt.patch b/queue-5.15/media-atomisp-fix-vidioc_try_fmt.patch new file mode 100644 index 00000000000..a07dbecb835 --- /dev/null +++ b/queue-5.15/media-atomisp-fix-vidioc_try_fmt.patch @@ -0,0 +1,53 @@ +From 96b3a660a7ae5e37b1ec9d685447e9f04188521a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Aug 2022 16:53:00 +0200 +Subject: media: atomisp: Fix VIDIOC_TRY_FMT + +From: Hans de Goede + +[ Upstream commit 4d3aafb9c9bba59c9b6f6df8ea6c89483bfed8d4 ] + +atomisp_try_fmt() calls the sensor's try_fmt handler but it does +not copy the result back to the passed in v4l2_pix_format under +some circumstances. + +Potentially returning an unsupported resolution to userspace, +which VIDIOC_TRY_FMT is not supposed to do. + +atomisp_set_fmt() also uses atomisp_try_fmt() and relies +on this wrong behavior. The VIDIOC_TRY_FMT call passes NULL for +the res_overflow argument where as the atomisp_set_fmt() call +passes non NULL. + +Use the res_overflow argument to differentiate between the 2 callers +and always propagate the sensors result in the VIDIOC_TRY_FMT case. + +This fixes the resolution list in camorama showing resolutions like e.g. +1584x1184 instead of 1600x1200. + +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/pci/atomisp_cmd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/media/atomisp/pci/atomisp_cmd.c b/drivers/staging/media/atomisp/pci/atomisp_cmd.c +index 88db9818e083..1c36e0108b1d 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_cmd.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_cmd.c +@@ -4954,8 +4954,8 @@ int atomisp_try_fmt(struct video_device *vdev, struct v4l2_pix_format *f, + return 0; + } + +- if (snr_mbus_fmt->width < f->width +- && snr_mbus_fmt->height < f->height) { ++ if (!res_overflow || (snr_mbus_fmt->width < f->width && ++ snr_mbus_fmt->height < f->height)) { + f->width = snr_mbus_fmt->width; + f->height = snr_mbus_fmt->height; + /* Set the flag when resolution requested is +-- +2.35.1 + diff --git a/queue-5.15/media-cros-ec-cec-limit-msg.len-to-cec_max_msg_size.patch b/queue-5.15/media-cros-ec-cec-limit-msg.len-to-cec_max_msg_size.patch new file mode 100644 index 00000000000..66f3094804d --- /dev/null +++ b/queue-5.15/media-cros-ec-cec-limit-msg.len-to-cec_max_msg_size.patch @@ -0,0 +1,35 @@ +From a88d9bb9dc525e76719ba703ba411999a0c1243a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 09:06:19 +0200 +Subject: media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE + +From: Hans Verkuil + +[ Upstream commit 2dc73b48665411a08c4e5f0f823dea8510761603 ] + +I expect that the hardware will have limited this to 16, but just in +case it hasn't, check for this corner case. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/platform/cros-ec/cros-ec-cec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/cec/platform/cros-ec/cros-ec-cec.c b/drivers/media/cec/platform/cros-ec/cros-ec-cec.c +index 2d95e16cd248..f66699d5dc66 100644 +--- a/drivers/media/cec/platform/cros-ec/cros-ec-cec.c ++++ b/drivers/media/cec/platform/cros-ec/cros-ec-cec.c +@@ -44,6 +44,8 @@ static void handle_cec_message(struct cros_ec_cec *cros_ec_cec) + uint8_t *cec_message = cros_ec->event_data.data.cec_message; + unsigned int len = cros_ec->event_size; + ++ if (len > CEC_MAX_MSG_SIZE) ++ len = CEC_MAX_MSG_SIZE; + cros_ec_cec->rx_msg.len = len; + memcpy(cros_ec_cec->rx_msg.msg, cec_message, len); + +-- +2.35.1 + diff --git a/queue-5.15/media-dvb-frontends-drxk-initialize-err-to-0.patch b/queue-5.15/media-dvb-frontends-drxk-initialize-err-to-0.patch new file mode 100644 index 00000000000..dd126623b82 --- /dev/null +++ b/queue-5.15/media-dvb-frontends-drxk-initialize-err-to-0.patch @@ -0,0 +1,42 @@ +From 3efd7cf0b7b724d397b69f9dc6accd9790cfb923 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Aug 2022 07:59:24 +0200 +Subject: media: dvb-frontends/drxk: initialize err to 0 + +From: Hans Verkuil + +[ Upstream commit 20694e96ca089ce6693c2348f8f628ee621e4e74 ] + +Fix a compiler warning: + +drivers/media/dvb-frontends/drxk_hard.c: In function 'drxk_read_ucblocks': +drivers/media/dvb-frontends/drxk_hard.c:6673:21: warning: 'err' may be used uninitialized [-Wmaybe-uninitialized] + 6673 | *ucblocks = (u32) err; + | ^~~~~~~~~ +drivers/media/dvb-frontends/drxk_hard.c:6663:13: note: 'err' was declared here + 6663 | u16 err; + | ^~~ + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-frontends/drxk_hard.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/dvb-frontends/drxk_hard.c b/drivers/media/dvb-frontends/drxk_hard.c +index d7fc2595f15b..efe92eef67db 100644 +--- a/drivers/media/dvb-frontends/drxk_hard.c ++++ b/drivers/media/dvb-frontends/drxk_hard.c +@@ -6673,7 +6673,7 @@ static int drxk_read_snr(struct dvb_frontend *fe, u16 *snr) + static int drxk_read_ucblocks(struct dvb_frontend *fe, u32 *ucblocks) + { + struct drxk_state *state = fe->demodulator_priv; +- u16 err; ++ u16 err = 0; + + dprintk(1, "\n"); + +-- +2.35.1 + diff --git a/queue-5.15/media-meson-vdec-fix-possible-refcount-leak-in-vdec_.patch b/queue-5.15/media-meson-vdec-fix-possible-refcount-leak-in-vdec_.patch new file mode 100644 index 00000000000..8d8a7db7515 --- /dev/null +++ b/queue-5.15/media-meson-vdec-fix-possible-refcount-leak-in-vdec_.patch @@ -0,0 +1,43 @@ +From 7b33e9412cf2fe2fd953a53d2348a2ca8b582d16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Sep 2022 09:46:30 +0200 +Subject: media: meson: vdec: fix possible refcount leak in vdec_probe() + +From: Hangyu Hua + +[ Upstream commit 7718999356234d9cc6a11b4641bb773928f1390f ] + +v4l2_device_unregister need to be called to put the refcount got by +v4l2_device_register when vdec_probe fails or vdec_remove is called. + +Signed-off-by: Hangyu Hua +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/meson/vdec/vdec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c +index e51d69c4729d..040ed56eb24f 100644 +--- a/drivers/staging/media/meson/vdec/vdec.c ++++ b/drivers/staging/media/meson/vdec/vdec.c +@@ -1105,6 +1105,7 @@ static int vdec_probe(struct platform_device *pdev) + + err_vdev_release: + video_device_release(vdev); ++ v4l2_device_unregister(&core->v4l2_dev); + return ret; + } + +@@ -1113,6 +1114,7 @@ static int vdec_remove(struct platform_device *pdev) + struct amvdec_core *core = platform_get_drvdata(pdev); + + video_unregister_device(core->vdev_dec); ++ v4l2_device_unregister(&core->v4l2_dev); + + return 0; + } +-- +2.35.1 + diff --git a/queue-5.15/media-rkisp1-don-t-pass-the-quantization-to-rkisp1_c.patch b/queue-5.15/media-rkisp1-don-t-pass-the-quantization-to-rkisp1_c.patch new file mode 100644 index 00000000000..53f6146fb87 --- /dev/null +++ b/queue-5.15/media-rkisp1-don-t-pass-the-quantization-to-rkisp1_c.patch @@ -0,0 +1,60 @@ +From 1a7bef74e57a9df01d3186bf1030758586fe9e7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Aug 2022 00:44:14 +0200 +Subject: media: rkisp1: Don't pass the quantization to rkisp1_csm_config() + +From: Laurent Pinchart + +[ Upstream commit 711d91497e203b058cf0a08c0f7d41c04efbde76 ] + +The rkisp1_csm_config() function takes a pointer to the rkisp1_params +structure which contains the quantization value. There's no need to pass +it separately to the function. Drop it from the function parameters. + +Signed-off-by: Laurent Pinchart +Reviewed-by: Dafna Hirschfeld +Reviewed-by: Paul Elder +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rockchip/rkisp1/rkisp1-params.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c +index 8fa5b0abf1f9..8461e88c1288 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c +@@ -751,7 +751,7 @@ static void rkisp1_ie_enable(struct rkisp1_params *params, bool en) + } + } + +-static void rkisp1_csm_config(struct rkisp1_params *params, bool full_range) ++static void rkisp1_csm_config(struct rkisp1_params *params) + { + static const u16 full_range_coeff[] = { + 0x0026, 0x004b, 0x000f, +@@ -765,7 +765,7 @@ static void rkisp1_csm_config(struct rkisp1_params *params, bool full_range) + }; + unsigned int i; + +- if (full_range) { ++ if (params->quantization == V4L2_QUANTIZATION_FULL_RANGE) { + for (i = 0; i < ARRAY_SIZE(full_range_coeff); i++) + rkisp1_write(params->rkisp1, full_range_coeff[i], + RKISP1_CIF_ISP_CC_COEFF_0 + i * 4); +@@ -1235,11 +1235,7 @@ static void rkisp1_params_config_parameter(struct rkisp1_params *params) + rkisp1_param_set_bits(params, RKISP1_CIF_ISP_HIST_PROP, + rkisp1_hst_params_default_config.mode); + +- /* set the range */ +- if (params->quantization == V4L2_QUANTIZATION_FULL_RANGE) +- rkisp1_csm_config(params, true); +- else +- rkisp1_csm_config(params, false); ++ rkisp1_csm_config(params); + + spin_lock_irq(¶ms->config_lock); + +-- +2.35.1 + diff --git a/queue-5.15/media-rkisp1-initialize-color-space-on-resizer-sink-.patch b/queue-5.15/media-rkisp1-initialize-color-space-on-resizer-sink-.patch new file mode 100644 index 00000000000..67a849fe691 --- /dev/null +++ b/queue-5.15/media-rkisp1-initialize-color-space-on-resizer-sink-.patch @@ -0,0 +1,41 @@ +From 805833de7b44cc11db937745abd20efacecac118 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Aug 2022 00:44:14 +0200 +Subject: media: rkisp1: Initialize color space on resizer sink and source pads + +From: Laurent Pinchart + +[ Upstream commit 83b9296e399367862845d3b19984444fc756bd61 ] + +Initialize the four color space fields on the sink and source video pads +of the resizer in the .init_cfg() operation. The resizer can't perform +any color space conversion, so set the sink and source color spaces to +the same defaults, which match the ISP source video pad default. + +Signed-off-by: Laurent Pinchart +Reviewed-by: Paul Elder +Reviewed-by: Dafna Hirschfeld +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rockchip/rkisp1/rkisp1-resizer.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-resizer.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-resizer.c +index 2070f4b06705..a166ede40967 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-resizer.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-resizer.c +@@ -510,6 +510,10 @@ static int rkisp1_rsz_init_config(struct v4l2_subdev *sd, + sink_fmt->height = RKISP1_DEFAULT_HEIGHT; + sink_fmt->field = V4L2_FIELD_NONE; + sink_fmt->code = RKISP1_DEF_FMT; ++ sink_fmt->colorspace = V4L2_COLORSPACE_SRGB; ++ sink_fmt->xfer_func = V4L2_XFER_FUNC_SRGB; ++ sink_fmt->ycbcr_enc = V4L2_YCBCR_ENC_601; ++ sink_fmt->quantization = V4L2_QUANTIZATION_LIM_RANGE; + + sink_crop = v4l2_subdev_get_try_crop(sd, sd_state, + RKISP1_RSZ_PAD_SINK); +-- +2.35.1 + diff --git a/queue-5.15/media-rkisp1-use-correct-macro-for-gradient-register.patch b/queue-5.15/media-rkisp1-use-correct-macro-for-gradient-register.patch new file mode 100644 index 00000000000..bcc52e026da --- /dev/null +++ b/queue-5.15/media-rkisp1-use-correct-macro-for-gradient-register.patch @@ -0,0 +1,65 @@ +From 97f5294e7f8031b20caf7346d082401ba0903d77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 01:53:57 +0200 +Subject: media: rkisp1: Use correct macro for gradient registers + +From: Laurent Pinchart + +[ Upstream commit 4c3501f13e8e60f6e7e7308c77ac4404e1007c18 ] + +The rkisp1_lsc_config() function incorrectly uses the +RKISP1_CIF_ISP_LSC_SECT_SIZE() macro for the gradient registers. Replace +it with the correct macro, and rename it from +RKISP1_CIF_ISP_LSC_GRAD_SIZE() to RKISP1_CIF_ISP_LSC_SECT_GRAD() as the +corresponding registers store the gradients for each sector, not a size. +This doesn't cause any functional change as the two macros are defined +identically (the size and gradient registers store fields in the same +number of bits at the same positions). + +Signed-off-by: Laurent Pinchart +Reviewed-by: Dafna Hirschfeld +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rockchip/rkisp1/rkisp1-params.c | 4 ++-- + drivers/media/platform/rockchip/rkisp1/rkisp1-regs.h | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c +index 8461e88c1288..e0e7d0b4ea04 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c +@@ -275,7 +275,7 @@ static void rkisp1_lsc_config(struct rkisp1_params *params, + RKISP1_CIF_ISP_LSC_XSIZE_01 + i * 4); + + /* program x grad tables */ +- data = RKISP1_CIF_ISP_LSC_SECT_SIZE(arg->x_grad_tbl[i * 2], ++ data = RKISP1_CIF_ISP_LSC_SECT_GRAD(arg->x_grad_tbl[i * 2], + arg->x_grad_tbl[i * 2 + 1]); + rkisp1_write(params->rkisp1, data, + RKISP1_CIF_ISP_LSC_XGRAD_01 + i * 4); +@@ -287,7 +287,7 @@ static void rkisp1_lsc_config(struct rkisp1_params *params, + RKISP1_CIF_ISP_LSC_YSIZE_01 + i * 4); + + /* program y grad tables */ +- data = RKISP1_CIF_ISP_LSC_SECT_SIZE(arg->y_grad_tbl[i * 2], ++ data = RKISP1_CIF_ISP_LSC_SECT_GRAD(arg->y_grad_tbl[i * 2], + arg->y_grad_tbl[i * 2 + 1]); + rkisp1_write(params->rkisp1, data, + RKISP1_CIF_ISP_LSC_YGRAD_01 + i * 4); +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-regs.h b/drivers/media/platform/rockchip/rkisp1/rkisp1-regs.h +index fa33080f51db..f584ccfe0286 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-regs.h ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-regs.h +@@ -480,7 +480,7 @@ + (((v0) & 0xFFF) | (((v1) & 0xFFF) << 12)) + #define RKISP1_CIF_ISP_LSC_SECT_SIZE(v0, v1) \ + (((v0) & 0xFFF) | (((v1) & 0xFFF) << 16)) +-#define RKISP1_CIF_ISP_LSC_GRAD_SIZE(v0, v1) \ ++#define RKISP1_CIF_ISP_LSC_SECT_GRAD(v0, v1) \ + (((v0) & 0xFFF) | (((v1) & 0xFFF) << 16)) + + /* LSC: ISP_LSC_TABLE_SEL */ +-- +2.35.1 + diff --git a/queue-5.15/media-rkisp1-zero-v4l2_subdev_format-fields-in-when-.patch b/queue-5.15/media-rkisp1-zero-v4l2_subdev_format-fields-in-when-.patch new file mode 100644 index 00000000000..c8f8f4c1ade --- /dev/null +++ b/queue-5.15/media-rkisp1-zero-v4l2_subdev_format-fields-in-when-.patch @@ -0,0 +1,47 @@ +From 81922696315353701adb2d54fccb0ef247cf92c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Aug 2022 17:11:36 +0200 +Subject: media: rkisp1: Zero v4l2_subdev_format fields in when validating + links + +From: Laurent Pinchart + +[ Upstream commit c53e3a049f35978a150526671587fd46b1ae7ca1 ] + +The local sd_fmt variable in rkisp1_capture_link_validate() has +uninitialized fields, which causes random failures when calling the +subdev .get_fmt() operation. Fix it by initializing the variable when +declaring it, which zeros all other fields. + +Signed-off-by: Laurent Pinchart +Reviewed-by: Paul Elder +Reviewed-by: Dafna Hirschfeld +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c +index 41988eb0ec0a..0f980f68058c 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c +@@ -1270,11 +1270,12 @@ static int rkisp1_capture_link_validate(struct media_link *link) + struct rkisp1_capture *cap = video_get_drvdata(vdev); + const struct rkisp1_capture_fmt_cfg *fmt = + rkisp1_find_fmt_cfg(cap, cap->pix.fmt.pixelformat); +- struct v4l2_subdev_format sd_fmt; ++ struct v4l2_subdev_format sd_fmt = { ++ .which = V4L2_SUBDEV_FORMAT_ACTIVE, ++ .pad = link->source->index, ++ }; + int ret; + +- sd_fmt.which = V4L2_SUBDEV_FORMAT_ACTIVE; +- sd_fmt.pad = link->source->index; + ret = v4l2_subdev_call(sd, pad, get_fmt, NULL, &sd_fmt); + if (ret) + return ret; +-- +2.35.1 + diff --git a/queue-5.15/media-s5p_cec-limit-msg.len-to-cec_max_msg_size.patch b/queue-5.15/media-s5p_cec-limit-msg.len-to-cec_max_msg_size.patch new file mode 100644 index 00000000000..cb5c64b59b4 --- /dev/null +++ b/queue-5.15/media-s5p_cec-limit-msg.len-to-cec_max_msg_size.patch @@ -0,0 +1,35 @@ +From d6b1d1cab7e167b095e8ada17e7a56b9c190ae7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 09:02:42 +0200 +Subject: media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE + +From: Hans Verkuil + +[ Upstream commit 93f65ce036863893c164ca410938e0968964b26c ] + +I expect that the hardware will have limited this to 16, but just in +case it hasn't, check for this corner case. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/platform/s5p/s5p_cec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/cec/platform/s5p/s5p_cec.c b/drivers/media/cec/platform/s5p/s5p_cec.c +index 028a09a7531e..102f1af01000 100644 +--- a/drivers/media/cec/platform/s5p/s5p_cec.c ++++ b/drivers/media/cec/platform/s5p/s5p_cec.c +@@ -115,6 +115,8 @@ static irqreturn_t s5p_cec_irq_handler(int irq, void *priv) + dev_dbg(cec->dev, "Buffer overrun (worker did not process previous message)\n"); + cec->rx = STATE_BUSY; + cec->msg.len = status >> 24; ++ if (cec->msg.len > CEC_MAX_MSG_SIZE) ++ cec->msg.len = CEC_MAX_MSG_SIZE; + cec->msg.rx_status = CEC_RX_STATUS_OK; + s5p_cec_get_rx_buf(cec, cec->msg.len, + cec->msg.msg); +-- +2.35.1 + diff --git a/queue-5.15/media-v4l-subdev-fail-graciously-when-getting-try-da.patch b/queue-5.15/media-v4l-subdev-fail-graciously-when-getting-try-da.patch new file mode 100644 index 00000000000..170ff846c30 --- /dev/null +++ b/queue-5.15/media-v4l-subdev-fail-graciously-when-getting-try-da.patch @@ -0,0 +1,57 @@ +From d23821b1196ff333e8a97647b57f55eecc2f40bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 13:53:58 +0200 +Subject: media: v4l: subdev: Fail graciously when getting try data for NULL + state + +From: Sakari Ailus + +[ Upstream commit 2ba3e38517f5a4ebf9c997168079dca01b7f9fc6 ] + +The state argument for the functions for obtaining various parts of the +state is NULL if it is called by drivers for active state. Fail graciously +in that case instead of dereferencing a NULL pointer. + +Suggested-by: Bingbu Cao +Signed-off-by: Sakari Ailus +Reviewed-by: Tomi Valkeinen +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + include/media/v4l2-subdev.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/include/media/v4l2-subdev.h b/include/media/v4l2-subdev.h +index 95ec18c2f49c..9a476f902c42 100644 +--- a/include/media/v4l2-subdev.h ++++ b/include/media/v4l2-subdev.h +@@ -995,6 +995,8 @@ v4l2_subdev_get_try_format(struct v4l2_subdev *sd, + struct v4l2_subdev_state *state, + unsigned int pad) + { ++ if (WARN_ON(!state)) ++ return NULL; + if (WARN_ON(pad >= sd->entity.num_pads)) + pad = 0; + return &state->pads[pad].try_fmt; +@@ -1013,6 +1015,8 @@ v4l2_subdev_get_try_crop(struct v4l2_subdev *sd, + struct v4l2_subdev_state *state, + unsigned int pad) + { ++ if (WARN_ON(!state)) ++ return NULL; + if (WARN_ON(pad >= sd->entity.num_pads)) + pad = 0; + return &state->pads[pad].try_crop; +@@ -1031,6 +1035,8 @@ v4l2_subdev_get_try_compose(struct v4l2_subdev *sd, + struct v4l2_subdev_state *state, + unsigned int pad) + { ++ if (WARN_ON(!state)) ++ return NULL; + if (WARN_ON(pad >= sd->entity.num_pads)) + pad = 0; + return &state->pads[pad].try_compose; +-- +2.35.1 + diff --git a/queue-5.15/scsi-core-restrict-legal-sdev_state-transitions-via-.patch b/queue-5.15/scsi-core-restrict-legal-sdev_state-transitions-via-.patch new file mode 100644 index 00000000000..1d2e5672d08 --- /dev/null +++ b/queue-5.15/scsi-core-restrict-legal-sdev_state-transitions-via-.patch @@ -0,0 +1,54 @@ +From c513d26b3eec21b3ae2e96eaef48499ff1623888 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Sep 2022 18:02:42 -0600 +Subject: scsi: core: Restrict legal sdev_state transitions via sysfs + +From: Uday Shankar + +[ Upstream commit 2331ce6126be8864b39490e705286b66e2344aac ] + +Userspace can currently write to sysfs to transition sdev_state to RUNNING +or OFFLINE from any source state. This causes issues because proper +transitioning out of some states involves steps besides just changing +sdev_state, so allowing userspace to change sdev_state regardless of the +source state can result in inconsistencies; e.g. with ISCSI we can end up +with sdev_state == SDEV_RUNNING while the device queue is quiesced. Any +task attempting I/O on the device will then hang, and in more recent +kernels, iscsid will hang as well. + +More detail about this bug is provided in my first attempt: + +https://groups.google.com/g/open-iscsi/c/PNKca4HgPDs/m/CXaDkntOAQAJ + +Link: https://lore.kernel.org/r/20220924000241.2967323-1-ushankar@purestorage.com +Signed-off-by: Uday Shankar +Suggested-by: Mike Christie +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_sysfs.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index 920aae661c5b..774864b54b97 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -816,6 +816,14 @@ store_state_field(struct device *dev, struct device_attribute *attr, + } + + mutex_lock(&sdev->state_mutex); ++ switch (sdev->sdev_state) { ++ case SDEV_RUNNING: ++ case SDEV_OFFLINE: ++ break; ++ default: ++ mutex_unlock(&sdev->state_mutex); ++ return -EINVAL; ++ } + if (sdev->sdev_state == SDEV_RUNNING && state == SDEV_RUNNING) { + ret = 0; + } else { +-- +2.35.1 + diff --git a/queue-5.15/series b/queue-5.15/series index 1b742881e68..2ee5c5b9fa9 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -68,3 +68,33 @@ s390-uaccess-add-missing-ex_table-entries-to-__clear.patch s390-boot-add-secure-boot-trailer.patch s390-cio-derive-cdev-information-only-for-io-subchan.patch s390-cio-fix-out-of-bounds-access-on-cio_ignore-free.patch +media-rkisp1-don-t-pass-the-quantization-to-rkisp1_c.patch +media-rkisp1-initialize-color-space-on-resizer-sink-.patch +media-rkisp1-use-correct-macro-for-gradient-register.patch +media-rkisp1-zero-v4l2_subdev_format-fields-in-when-.patch +media-s5p_cec-limit-msg.len-to-cec_max_msg_size.patch +media-cros-ec-cec-limit-msg.len-to-cec_max_msg_size.patch +media-dvb-frontends-drxk-initialize-err-to-0.patch +media-meson-vdec-fix-possible-refcount-leak-in-vdec_.patch +media-v4l-subdev-fail-graciously-when-getting-try-da.patch +media-atomisp-fix-vidioc_try_fmt.patch +media-atomisp-ensure-that-userptr-pointers-are-page-.patch +media-atomisp-fix-v4l2_fh-resource-leak-on-open-erro.patch +acpi-apei-fix-integer-overflow-in-ghes_estatus_pool_.patch +scsi-core-restrict-legal-sdev_state-transitions-via-.patch +hid-saitek-add-madcatz-variant-of-mmo7-mouse-device-.patch +drm-amdgpu-set-vm_update_mode-0-as-default-for-sienn.patch +i2c-xiic-add-platform-module-alias.patch +efi-tpm-pass-correct-address-to-memblock_reserve.patch +clk-qcom-update-the-force-mem-core-bit-for-gpu-clock.patch +arm-dts-imx6qdl-gw59-10-13-fix-user-pushbutton-gpio-.patch +arm64-dts-imx8-correct-clock-order.patch +arm64-dts-lx2160a-specify-clock-frequencies-for-the-.patch +arm64-dts-ls1088a-specify-clock-frequencies-for-the-.patch +arm64-dts-ls208xa-specify-clock-frequencies-for-the-.patch +block-fix-possible-memory-leak-for-rq_wb-on-add_disk.patch +firmware-arm_scmi-suppress-the-driver-s-bind-attribu.patch +firmware-arm_scmi-make-rx-chan_setup-fail-on-memory-.patch +firmware-arm_scmi-fix-devres-allocation-device-in-vi.patch +arm64-dts-juno-add-thermal-critical-trip-points.patch +i2c-piix4-fix-adapter-not-be-removed-in-piix4_remove.patch