From: Sasha Levin Date: Thu, 11 Apr 2024 08:03:23 +0000 (-0400) Subject: Fixes for 6.6 X-Git-Tag: v4.19.312~32 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=51c5c97ccbf235f88bf1bbda0a1e9271929a41b3;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.6/media-mediatek-vcodec-adding-lock-to-protect-decoder.patch b/queue-6.6/media-mediatek-vcodec-adding-lock-to-protect-decoder.patch new file mode 100644 index 00000000000..92a2ca008a2 --- /dev/null +++ b/queue-6.6/media-mediatek-vcodec-adding-lock-to-protect-decoder.patch @@ -0,0 +1,158 @@ +From 936b03b46dd5744faed854d1c7292548b1cf6079 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 20:30:08 +0800 +Subject: media: mediatek: vcodec: adding lock to protect decoder context list + +From: Yunfei Dong + +[ Upstream commit 6467cda18c9f9b5f2f9a0aa1e2861c653e41f382 ] + +Add a lock for the ctx_list, to avoid accessing a NULL pointer +within the 'vpu_dec_ipi_handler' function when the ctx_list has +been deleted due to an unexpected behavior on the SCP IP block. + +Hardware name: Google juniper sku16 board (DT) +pstate: 20400005 (nzCv daif +PAN -UAO -TCO BTYPE=--) +pc : vpu_dec_ipi_handler+0x58/0x1f8 [mtk_vcodec_dec] +lr : scp_ipi_handler+0xd0/0x194 [mtk_scp] +sp : ffffffc0131dbbd0 +x29: ffffffc0131dbbd0 x28: 0000000000000000 +x27: ffffff9bb277f348 x26: ffffff9bb242ad00 +x25: ffffffd2d440d3b8 x24: ffffffd2a13ff1d4 +x23: ffffff9bb7fe85a0 x22: ffffffc0133fbdb0 +x21: 0000000000000010 x20: ffffff9b050ea328 +x19: ffffffc0131dbc08 x18: 0000000000001000 +x17: 0000000000000000 x16: ffffffd2d461c6e0 +x15: 0000000000000242 x14: 000000000000018f +x13: 000000000000004d x12: 0000000000000000 +x11: 0000000000000001 x10: fffffffffffffff0 +x9 : ffffff9bb6e793a8 x8 : 0000000000000000 +x7 : 0000000000000000 x6 : 000000000000003f +x5 : 0000000000000040 x4 : fffffffffffffff0 +x3 : 0000000000000020 x2 : ffffff9bb6e79080 +x1 : 0000000000000010 x0 : ffffffc0131dbc08 +Call trace: +vpu_dec_ipi_handler+0x58/0x1f8 [mtk_vcodec_dec (HASH:6c3f 2)] +scp_ipi_handler+0xd0/0x194 [mtk_scp (HASH:7046 3)] +mt8183_scp_irq_handler+0x44/0x88 [mtk_scp (HASH:7046 3)] +scp_irq_handler+0x48/0x90 [mtk_scp (HASH:7046 3)] +irq_thread_fn+0x38/0x94 +irq_thread+0x100/0x1c0 +kthread+0x140/0x1fc +ret_from_fork+0x10/0x30 +Code: 54000088 f94ca50a eb14015f 54000060 (f9400108) +---[ end trace ace43ce36cbd5c93 ]--- +Kernel panic - not syncing: Oops: Fatal exception +SMP: stopping secondary CPUs +Kernel Offset: 0x12c4000000 from 0xffffffc010000000 +PHYS_OFFSET: 0xffffffe580000000 +CPU features: 0x08240002,2188200c +Memory Limit: none + +Fixes: 655b86e52eac ("media: mediatek: vcodec: Fix possible invalid memory access for decoder") +Signed-off-by: Yunfei Dong +Reviewed-by: Nicolas Dufresne +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Sebastian Fricke +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c | 4 ++-- + .../platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c | 5 +++++ + .../platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h | 2 ++ + drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c | 2 ++ + 4 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c +index 0849ffb0dcd45..831ec3d48b274 100644 +--- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c ++++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c +@@ -50,12 +50,12 @@ static void mtk_vcodec_vpu_reset_dec_handler(void *priv) + + dev_err(&dev->plat_dev->dev, "Watchdog timeout!!"); + +- mutex_lock(&dev->dev_mutex); ++ mutex_lock(&dev->dev_ctx_lock); + list_for_each_entry(ctx, &dev->ctx_list, list) { + ctx->state = MTK_STATE_ABORT; + mtk_v4l2_vdec_dbg(0, ctx, "[%d] Change to state MTK_STATE_ABORT", ctx->id); + } +- mutex_unlock(&dev->dev_mutex); ++ mutex_unlock(&dev->dev_ctx_lock); + } + + static void mtk_vcodec_vpu_reset_enc_handler(void *priv) +diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c +index 0a89ce452ac32..20c0b1acf6186 100644 +--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c ++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c +@@ -268,7 +268,9 @@ static int fops_vcodec_open(struct file *file) + + ctx->dev->vdec_pdata->init_vdec_params(ctx); + ++ mutex_lock(&dev->dev_ctx_lock); + list_add(&ctx->list, &dev->ctx_list); ++ mutex_unlock(&dev->dev_ctx_lock); + mtk_vcodec_dbgfs_create(ctx); + + mutex_unlock(&dev->dev_mutex); +@@ -311,7 +313,9 @@ static int fops_vcodec_release(struct file *file) + v4l2_ctrl_handler_free(&ctx->ctrl_hdl); + + mtk_vcodec_dbgfs_remove(dev, ctx->id); ++ mutex_lock(&dev->dev_ctx_lock); + list_del_init(&ctx->list); ++ mutex_unlock(&dev->dev_ctx_lock); + kfree(ctx); + mutex_unlock(&dev->dev_mutex); + return 0; +@@ -378,6 +382,7 @@ static int mtk_vcodec_probe(struct platform_device *pdev) + for (i = 0; i < MTK_VDEC_HW_MAX; i++) + mutex_init(&dev->dec_mutex[i]); + mutex_init(&dev->dev_mutex); ++ mutex_init(&dev->dev_ctx_lock); + spin_lock_init(&dev->irqlock); + + snprintf(dev->v4l2_dev.name, sizeof(dev->v4l2_dev.name), "%s", +diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h +index 7e36b2c69b7d1..b3a59af7c8ac5 100644 +--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h ++++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h +@@ -231,6 +231,7 @@ struct mtk_vcodec_dec_ctx { + * + * @dec_mutex: decoder hardware lock + * @dev_mutex: video_device lock ++ * @dev_ctx_lock: the lock of context list + * @decode_workqueue: decode work queue + * + * @irqlock: protect data access by irq handler and work thread +@@ -270,6 +271,7 @@ struct mtk_vcodec_dec_dev { + /* decoder hardware mutex lock */ + struct mutex dec_mutex[MTK_VDEC_HW_MAX]; + struct mutex dev_mutex; ++ struct mutex dev_ctx_lock; + struct workqueue_struct *decode_workqueue; + + spinlock_t irqlock; +diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c +index 82e57ae983d55..da6be556727bb 100644 +--- a/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c ++++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c +@@ -77,12 +77,14 @@ static bool vpu_dec_check_ap_inst(struct mtk_vcodec_dec_dev *dec_dev, struct vde + struct mtk_vcodec_dec_ctx *ctx; + int ret = false; + ++ mutex_lock(&dec_dev->dev_ctx_lock); + list_for_each_entry(ctx, &dec_dev->ctx_list, list) { + if (!IS_ERR_OR_NULL(ctx) && ctx->vpu_inst == vpu) { + ret = true; + break; + } + } ++ mutex_unlock(&dec_dev->dev_ctx_lock); + + return ret; + } +-- +2.43.0 + diff --git a/queue-6.6/media-mediatek-vcodec-adding-lock-to-protect-encoder.patch b/queue-6.6/media-mediatek-vcodec-adding-lock-to-protect-encoder.patch new file mode 100644 index 00000000000..ed9f3269823 --- /dev/null +++ b/queue-6.6/media-mediatek-vcodec-adding-lock-to-protect-encoder.patch @@ -0,0 +1,120 @@ +From d7f74492a7759c536de9ade2a6187854a6f7f698 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 20:30:09 +0800 +Subject: media: mediatek: vcodec: adding lock to protect encoder context list + +From: Yunfei Dong + +[ Upstream commit afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad ] + +Add a lock for the ctx_list, to avoid accessing a NULL pointer +within the 'vpu_enc_ipi_handler' function when the ctx_list has +been deleted due to an unexpected behavior on the SCP IP block. + +Fixes: 1972e32431ed ("media: mediatek: vcodec: Fix possible invalid memory access for encoder") +Signed-off-by: Yunfei Dong +Reviewed-by: Nicolas Dufresne +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Sebastian Fricke +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c | 4 ++-- + .../platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c | 5 +++++ + .../platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h | 2 ++ + drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c | 2 ++ + 4 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c +index 831ec3d48b274..42ce58c41e4f4 100644 +--- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c ++++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c +@@ -65,12 +65,12 @@ static void mtk_vcodec_vpu_reset_enc_handler(void *priv) + + dev_err(&dev->plat_dev->dev, "Watchdog timeout!!"); + +- mutex_lock(&dev->dev_mutex); ++ mutex_lock(&dev->dev_ctx_lock); + list_for_each_entry(ctx, &dev->ctx_list, list) { + ctx->state = MTK_STATE_ABORT; + mtk_v4l2_vdec_dbg(0, ctx, "[%d] Change to state MTK_STATE_ABORT", ctx->id); + } +- mutex_unlock(&dev->dev_mutex); ++ mutex_unlock(&dev->dev_ctx_lock); + } + + static const struct mtk_vcodec_fw_ops mtk_vcodec_vpu_msg = { +diff --git a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c +index 6319f24bc714b..3cb8a16222220 100644 +--- a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c ++++ b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c +@@ -177,7 +177,9 @@ static int fops_vcodec_open(struct file *file) + mtk_v4l2_venc_dbg(2, ctx, "Create instance [%d]@%p m2m_ctx=%p ", + ctx->id, ctx, ctx->m2m_ctx); + ++ mutex_lock(&dev->dev_ctx_lock); + list_add(&ctx->list, &dev->ctx_list); ++ mutex_unlock(&dev->dev_ctx_lock); + + mutex_unlock(&dev->dev_mutex); + mtk_v4l2_venc_dbg(0, ctx, "%s encoder [%d]", dev_name(&dev->plat_dev->dev), +@@ -212,7 +214,9 @@ static int fops_vcodec_release(struct file *file) + v4l2_fh_exit(&ctx->fh); + v4l2_ctrl_handler_free(&ctx->ctrl_hdl); + ++ mutex_lock(&dev->dev_ctx_lock); + list_del_init(&ctx->list); ++ mutex_unlock(&dev->dev_ctx_lock); + kfree(ctx); + mutex_unlock(&dev->dev_mutex); + return 0; +@@ -294,6 +298,7 @@ static int mtk_vcodec_probe(struct platform_device *pdev) + + mutex_init(&dev->enc_mutex); + mutex_init(&dev->dev_mutex); ++ mutex_init(&dev->dev_ctx_lock); + spin_lock_init(&dev->irqlock); + + snprintf(dev->v4l2_dev.name, sizeof(dev->v4l2_dev.name), "%s", +diff --git a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h +index a042f607ed8d1..0bd85d0fb379a 100644 +--- a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h ++++ b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h +@@ -178,6 +178,7 @@ struct mtk_vcodec_enc_ctx { + * + * @enc_mutex: encoder hardware lock. + * @dev_mutex: video_device lock ++ * @dev_ctx_lock: the lock of context list + * @encode_workqueue: encode work queue + * + * @enc_irq: h264 encoder irq resource +@@ -205,6 +206,7 @@ struct mtk_vcodec_enc_dev { + /* encoder hardware mutex lock */ + struct mutex enc_mutex; + struct mutex dev_mutex; ++ struct mutex dev_ctx_lock; + struct workqueue_struct *encode_workqueue; + + int enc_irq; +diff --git a/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c b/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c +index 84ad1cc6ad171..51bb7ee141b9e 100644 +--- a/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c ++++ b/drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c +@@ -47,12 +47,14 @@ static bool vpu_enc_check_ap_inst(struct mtk_vcodec_enc_dev *enc_dev, struct ven + struct mtk_vcodec_enc_ctx *ctx; + int ret = false; + ++ mutex_lock(&enc_dev->dev_ctx_lock); + list_for_each_entry(ctx, &enc_dev->ctx_list, list) { + if (!IS_ERR_OR_NULL(ctx) && ctx->vpu_inst == vpu) { + ret = true; + break; + } + } ++ mutex_unlock(&enc_dev->dev_ctx_lock); + + return ret; + } +-- +2.43.0 + diff --git a/queue-6.6/media-mediatek-vcodec-fix-oops-when-hevc-init-fails.patch b/queue-6.6/media-mediatek-vcodec-fix-oops-when-hevc-init-fails.patch new file mode 100644 index 00000000000..727ee43542c --- /dev/null +++ b/queue-6.6/media-mediatek-vcodec-fix-oops-when-hevc-init-fails.patch @@ -0,0 +1,84 @@ +From 9fc2a55eb36bfa044b545adf660d5a57b7293fbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Feb 2024 16:19:52 -0500 +Subject: media: mediatek: vcodec: Fix oops when HEVC init fails + +From: Nicolas Dufresne + +[ Upstream commit 97c75ee5de060d271d80109b0c47cb6008439e5b ] + +The stateless HEVC decoder saves the instance pointer in the context +regardless if the initialization worked or not. This caused a use after +free, when the pointer is freed in case of a failure in the deinit +function. +Only store the instance pointer when the initialization was successful, +to solve this issue. + + Hardware name: Acer Tomato (rev3 - 4) board (DT) + pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec] + lr : vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec] + sp : ffff80008750bc20 + x29: ffff80008750bc20 x28: ffff1299f6d70000 x27: 0000000000000000 + x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 + x23: ffff80008750bc98 x22: 000000000000a003 x21: ffffd45c4cfae000 + x20: 0000000000000010 x19: ffff1299fd668310 x18: 000000000000001a + x17: 000000040044ffff x16: ffffd45cb15dc648 x15: 0000000000000000 + x14: ffff1299c08da1c0 x13: ffffd45cb1f87a10 x12: ffffd45cb2f5fe80 + x11: 0000000000000001 x10: 0000000000001b30 x9 : ffffd45c4d12b488 + x8 : 1fffe25339380d81 x7 : 0000000000000001 x6 : ffff1299c9c06c00 + x5 : 0000000000000132 x4 : 0000000000000000 x3 : 0000000000000000 + x2 : 0000000000000010 x1 : ffff80008750bc98 x0 : 0000000000000000 + Call trace: + vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec] + vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec] + vpu_dec_deinit+0x1c/0x30 [mtk_vcodec_dec] + vdec_hevc_slice_deinit+0x30/0x98 [mtk_vcodec_dec] + vdec_if_deinit+0x38/0x68 [mtk_vcodec_dec] + mtk_vcodec_dec_release+0x20/0x40 [mtk_vcodec_dec] + fops_vcodec_release+0x64/0x118 [mtk_vcodec_dec] + v4l2_release+0x7c/0x100 + __fput+0x80/0x2d8 + __fput_sync+0x58/0x70 + __arm64_sys_close+0x40/0x90 + invoke_syscall+0x50/0x128 + el0_svc_common.constprop.0+0x48/0xf0 + do_el0_svc+0x24/0x38 + el0_svc+0x38/0xd8 + el0t_64_sync_handler+0xc0/0xc8 + el0t_64_sync+0x1a8/0x1b0 + Code: d503201f f9401660 b900127f b900227f (f9400400) + +Signed-off-by: Nicolas Dufresne +Fixes: 2674486aac7d ("media: mediatek: vcodec: support stateless hevc decoder") +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Sebastian Fricke +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c +index 06ed47df693bf..21836dd6ef85a 100644 +--- a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c ++++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_hevc_req_multi_if.c +@@ -869,7 +869,6 @@ static int vdec_hevc_slice_init(struct mtk_vcodec_dec_ctx *ctx) + inst->vpu.codec_type = ctx->current_codec; + inst->vpu.capture_type = ctx->capture_fourcc; + +- ctx->drv_handle = inst; + err = vpu_dec_init(&inst->vpu); + if (err) { + mtk_vdec_err(ctx, "vdec_hevc init err=%d", err); +@@ -898,6 +897,7 @@ static int vdec_hevc_slice_init(struct mtk_vcodec_dec_ctx *ctx) + mtk_vdec_debug(ctx, "lat hevc instance >> %p, codec_type = 0x%x", + inst, inst->vpu.codec_type); + ++ ctx->drv_handle = inst; + return 0; + error_free_inst: + kfree(inst); +-- +2.43.0 + diff --git a/queue-6.6/platform-x86-intel-vbtn-update-tablet-mode-switch-at.patch b/queue-6.6/platform-x86-intel-vbtn-update-tablet-mode-switch-at.patch new file mode 100644 index 00000000000..b04d26b3602 --- /dev/null +++ b/queue-6.6/platform-x86-intel-vbtn-update-tablet-mode-switch-at.patch @@ -0,0 +1,80 @@ +From c0777d362cc99683eaee7e49f21243d4f0973860 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 07:32:06 -0700 +Subject: platform/x86: intel-vbtn: Update tablet mode switch at end of probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Gwendal Grignou + +[ Upstream commit 434e5781d8cd2d0ed512d920c6cdeba4b33a2e81 ] + +ACER Vivobook Flip (TP401NAS) virtual intel switch is implemented as +follow: + + Device (VGBI) + { + Name (_HID, EisaId ("INT33D6") ... + Name (VBDS, Zero) + Method (_STA, 0, Serialized) // _STA: Status ... + Method (VBDL, 0, Serialized) + { + PB1E |= 0x20 + VBDS |= 0x40 + } + Method (VGBS, 0, Serialized) + { + Return (VBDS) /* \_SB_.PCI0.SBRG.EC0_.VGBI.VBDS */ + } + ... + } + +By default VBDS is set to 0. At boot it is set to clamshell (bit 6 set) +only after method VBDL is executed. + +Since VBDL is now evaluated in the probe routine later, after the device +is registered, the retrieved value of VBDS was still 0 ("tablet mode") +when setting up the virtual switch. + +Make sure to evaluate VGBS after VBDL, to ensure the +convertible boots in clamshell mode, the expected default. + +Fixes: 26173179fae1 ("platform/x86: intel-vbtn: Eval VBDL after registering our notifier") +Signed-off-by: Gwendal Grignou +Reviewed-by: Kuppuswamy Sathyanarayanan +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20240329143206.2977734-3-gwendal@chromium.org +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/vbtn.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/intel/vbtn.c b/drivers/platform/x86/intel/vbtn.c +index 084c355c86f5f..5d13452bb947a 100644 +--- a/drivers/platform/x86/intel/vbtn.c ++++ b/drivers/platform/x86/intel/vbtn.c +@@ -136,8 +136,6 @@ static int intel_vbtn_input_setup(struct platform_device *device) + priv->switches_dev->id.bustype = BUS_HOST; + + if (priv->has_switches) { +- detect_tablet_mode(&device->dev); +- + ret = input_register_device(priv->switches_dev); + if (ret) + return ret; +@@ -316,6 +314,9 @@ static int intel_vbtn_probe(struct platform_device *device) + if (ACPI_FAILURE(status)) + dev_err(&device->dev, "Error VBDL failed with ACPI status %d\n", status); + } ++ // Check switches after buttons since VBDL may have side effects. ++ if (has_switches) ++ detect_tablet_mode(&device->dev); + + device_init_wakeup(&device->dev, true); + /* +-- +2.43.0 + diff --git a/queue-6.6/randomize_kstack-improve-entropy-diffusion.patch b/queue-6.6/randomize_kstack-improve-entropy-diffusion.patch new file mode 100644 index 00000000000..ec5867d42f4 --- /dev/null +++ b/queue-6.6/randomize_kstack-improve-entropy-diffusion.patch @@ -0,0 +1,37 @@ +From ebcd951dcbe98a5c15790b13f1923c040f105278 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Mar 2024 12:24:48 -0800 +Subject: randomize_kstack: Improve entropy diffusion + +From: Kees Cook + +[ Upstream commit 9c573cd313433f6c1f7236fe64b9b743500c1628 ] + +The kstack_offset variable was really only ever using the low bits for +kernel stack offset entropy. Add a ror32() to increase bit diffusion. + +Suggested-by: Arnd Bergmann +Fixes: 39218ff4c625 ("stack: Optionally randomize kernel stack offset each syscall") +Link: https://lore.kernel.org/r/20240309202445.work.165-kees@kernel.org +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + include/linux/randomize_kstack.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/randomize_kstack.h b/include/linux/randomize_kstack.h +index 5d868505a94e4..6d92b68efbf6c 100644 +--- a/include/linux/randomize_kstack.h ++++ b/include/linux/randomize_kstack.h +@@ -80,7 +80,7 @@ DECLARE_PER_CPU(u32, kstack_offset); + if (static_branch_maybe(CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT, \ + &randomize_kstack_offset)) { \ + u32 offset = raw_cpu_read(kstack_offset); \ +- offset ^= (rand); \ ++ offset = ror32(offset, 5) ^ (rand); \ + raw_cpu_write(kstack_offset, offset); \ + } \ + } while (0) +-- +2.43.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 2d6305c8213..75dc2419df0 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -103,3 +103,8 @@ fbmon-prevent-division-by-zero-in-fb_videomode_from_.patch alsa-hda-realtek-add-quirks-for-some-clevo-laptops.patch gcc-plugins-stackleak-avoid-.head.text-section.patch selftests-mptcp-display-simult-in-extra_msg.patch +media-mediatek-vcodec-fix-oops-when-hevc-init-fails.patch +media-mediatek-vcodec-adding-lock-to-protect-decoder.patch +media-mediatek-vcodec-adding-lock-to-protect-encoder.patch +randomize_kstack-improve-entropy-diffusion.patch +platform-x86-intel-vbtn-update-tablet-mode-switch-at.patch