From: Greg Kroah-Hartman Date: Wed, 21 Feb 2024 12:10:15 +0000 (+0100) Subject: 5.15-stable patches X-Git-Tag: v4.19.307~14 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5a9e237c147dc3d648d6b83e7d44afa0448d6270;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: media-revert-media-rkisp1-drop-irqf_shared.patch staging-fbtft-core-set-smem_len-before-fb_deferred_io_init-call.patch usb-dwc3-gadget-don-t-delay-end-transfer-on-delayed_status.patch usb-dwc3-gadget-execute-gadget-stop-after-halting-the-controller.patch --- diff --git a/queue-5.15/media-revert-media-rkisp1-drop-irqf_shared.patch b/queue-5.15/media-revert-media-rkisp1-drop-irqf_shared.patch new file mode 100644 index 00000000000..6c7f5169736 --- /dev/null +++ b/queue-5.15/media-revert-media-rkisp1-drop-irqf_shared.patch @@ -0,0 +1,38 @@ +From a107d643b2a3382e0a2d2c4ef08bf8c6bff4561d Mon Sep 17 00:00:00 2001 +From: Tomi Valkeinen +Date: Mon, 18 Dec 2023 08:54:00 +0100 +Subject: media: Revert "media: rkisp1: Drop IRQF_SHARED" + +From: Tomi Valkeinen + +commit a107d643b2a3382e0a2d2c4ef08bf8c6bff4561d upstream. + +This reverts commit 85d2a31fe4d9be1555f621ead7a520d8791e0f74. + +The rkisp1 does share interrupt lines on some platforms, after all. Thus +we need to revert this, and implement a fix for the rkisp1 shared irq +handling in a follow-up patch. + +Closes: https://lore.kernel.org/all/87o7eo8vym.fsf@gmail.com/ +Link: https://lore.kernel.org/r/20231218-rkisp-shirq-fix-v1-1-173007628248@ideasonboard.com + +Reported-by: Mikhail Rudenko +Signed-off-by: Tomi Valkeinen +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c +@@ -482,7 +482,7 @@ static int rkisp1_probe(struct platform_ + if (irq < 0) + return irq; + +- ret = devm_request_irq(dev, irq, rkisp1_isr, 0, ++ ret = devm_request_irq(dev, irq, rkisp1_isr, IRQF_SHARED, + dev_driver_string(dev), dev); + if (ret) { + dev_err(dev, "request irq failed: %d\n", ret); diff --git a/queue-5.15/series b/queue-5.15/series index bff89783ee3..14feb064e52 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -470,3 +470,7 @@ revert-selftests-bpf-test-tail-call-counting-with-bpf2bpf-and-data-on-stack.patc net-bcmgenet-fix-eee-implementation.patch fs-ntfs3-add-null-pointer-checks.patch smb3-replace-smb2pdu-1-element-arrays-with-flex-arrays.patch +staging-fbtft-core-set-smem_len-before-fb_deferred_io_init-call.patch +usb-dwc3-gadget-don-t-delay-end-transfer-on-delayed_status.patch +usb-dwc3-gadget-execute-gadget-stop-after-halting-the-controller.patch +media-revert-media-rkisp1-drop-irqf_shared.patch diff --git a/queue-5.15/staging-fbtft-core-set-smem_len-before-fb_deferred_io_init-call.patch b/queue-5.15/staging-fbtft-core-set-smem_len-before-fb_deferred_io_init-call.patch new file mode 100644 index 00000000000..f0325856465 --- /dev/null +++ b/queue-5.15/staging-fbtft-core-set-smem_len-before-fb_deferred_io_init-call.patch @@ -0,0 +1,40 @@ +From 81e878887ff82a7dd42f22951391069a5d520627 Mon Sep 17 00:00:00 2001 +From: Peter Suti +Date: Wed, 27 Jul 2022 09:35:50 +0200 +Subject: staging: fbtft: core: set smem_len before fb_deferred_io_init call + +From: Peter Suti + +commit 81e878887ff82a7dd42f22951391069a5d520627 upstream. + +The fbtft_framebuffer_alloc() calls fb_deferred_io_init() before +initializing info->fix.smem_len. It is set to zero by the +framebuffer_alloc() function. It will trigger a WARN_ON() at the +start of fb_deferred_io_init() and the function will not do anything. + +Fixes: 856082f021a2 ("fbdev: defio: fix the pagelist corruption") +Signed-off-by: Peter Suti +Link: https://lore.kernel.org/r/20220727073550.1491126-1-peter.suti@streamunlimited.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/fbtft/fbtft-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/fbtft/fbtft-core.c ++++ b/drivers/staging/fbtft/fbtft-core.c +@@ -657,7 +657,6 @@ struct fb_info *fbtft_framebuffer_alloc( + fbdefio->delay = HZ / fps; + fbdefio->sort_pagereflist = true; + fbdefio->deferred_io = fbtft_deferred_io; +- fb_deferred_io_init(info); + + snprintf(info->fix.id, sizeof(info->fix.id), "%s", dev->driver->name); + info->fix.type = FB_TYPE_PACKED_PIXELS; +@@ -668,6 +667,7 @@ struct fb_info *fbtft_framebuffer_alloc( + info->fix.line_length = width * bpp / 8; + info->fix.accel = FB_ACCEL_NONE; + info->fix.smem_len = vmem_size; ++ fb_deferred_io_init(info); + + info->var.rotate = pdata->rotate; + info->var.xres = width; diff --git a/queue-5.15/usb-dwc3-gadget-don-t-delay-end-transfer-on-delayed_status.patch b/queue-5.15/usb-dwc3-gadget-don-t-delay-end-transfer-on-delayed_status.patch new file mode 100644 index 00000000000..09623352fa5 --- /dev/null +++ b/queue-5.15/usb-dwc3-gadget-don-t-delay-end-transfer-on-delayed_status.patch @@ -0,0 +1,55 @@ +From 4db0fbb601361767144e712beb96704b966339f5 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Tue, 18 Oct 2022 19:39:01 -0700 +Subject: usb: dwc3: gadget: Don't delay End Transfer on delayed_status + +From: Thinh Nguyen + +commit 4db0fbb601361767144e712beb96704b966339f5 upstream. + +The gadget driver may wait on the request completion when it sets the +USB_GADGET_DELAYED_STATUS. Make sure that the End Transfer command can +go through if the dwc->delayed_status is set so that the request can +complete. When the delayed_status is set, the Setup packet is already +processed, and the next phase should be either Data or Status. It's +unlikely that the host would cancel the control transfer and send a new +Setup packet during End Transfer command. But if that's the case, we can +try again when ep0state returns to EP0_SETUP_PHASE. + +Fixes: e1ee843488d5 ("usb: dwc3: gadget: Force sending delayed status during soft disconnect") +Cc: stable@vger.kernel.org +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/3f9f59e5d74efcbaee444cf4b30ef639cc7b124e.1666146954.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1680,6 +1680,16 @@ static int __dwc3_stop_active_transfer(s + cmd |= DWC3_DEPCMD_PARAM(dep->resource_index); + memset(¶ms, 0, sizeof(params)); + ret = dwc3_send_gadget_ep_cmd(dep, cmd, ¶ms); ++ /* ++ * If the End Transfer command was timed out while the device is ++ * not in SETUP phase, it's possible that an incoming Setup packet ++ * may prevent the command's completion. Let's retry when the ++ * ep0state returns to EP0_SETUP_PHASE. ++ */ ++ if (ret == -ETIMEDOUT && dep->dwc->ep0state != EP0_SETUP_PHASE) { ++ dep->flags |= DWC3_EP_DELAY_STOP; ++ return 0; ++ } + WARN_ON_ONCE(ret); + dep->resource_index = 0; + +@@ -3701,7 +3711,7 @@ void dwc3_stop_active_transfer(struct dw + * timeout. Delay issuing the End Transfer command until the Setup TRB is + * prepared. + */ +- if (dwc->ep0state != EP0_SETUP_PHASE) { ++ if (dwc->ep0state != EP0_SETUP_PHASE && !dwc->delayed_status) { + dep->flags |= DWC3_EP_DELAY_STOP; + return; + } diff --git a/queue-5.15/usb-dwc3-gadget-execute-gadget-stop-after-halting-the-controller.patch b/queue-5.15/usb-dwc3-gadget-execute-gadget-stop-after-halting-the-controller.patch new file mode 100644 index 00000000000..2269f82a22e --- /dev/null +++ b/queue-5.15/usb-dwc3-gadget-execute-gadget-stop-after-halting-the-controller.patch @@ -0,0 +1,55 @@ +From 39674be56fba1cd3a03bf4617f523a35f85fd2c1 Mon Sep 17 00:00:00 2001 +From: Wesley Cheng +Date: Thu, 20 Apr 2023 14:27:58 -0700 +Subject: usb: dwc3: gadget: Execute gadget stop after halting the controller + +From: Wesley Cheng + +commit 39674be56fba1cd3a03bf4617f523a35f85fd2c1 upstream. + +Do not call gadget stop until the poll for controller halt is +completed. DEVTEN is cleared as part of gadget stop, so the intention to +allow ep0 events to continue while waiting for controller halt is not +happening. + +Fixes: c96683798e27 ("usb: dwc3: ep0: Don't prepare beyond Setup stage") +Cc: stable@vger.kernel.org +Acked-by: Thinh Nguyen +Signed-off-by: Wesley Cheng +Link: https://lore.kernel.org/r/20230420212759.29429-2-quic_wcheng@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2517,7 +2517,6 @@ static int dwc3_gadget_soft_disconnect(s + * bit. + */ + dwc3_stop_active_transfers(dwc); +- __dwc3_gadget_stop(dwc); + spin_unlock_irqrestore(&dwc->lock, flags); + + /* +@@ -2547,7 +2546,19 @@ static int dwc3_gadget_soft_disconnect(s + * remaining event generated by the controller while polling for + * DSTS.DEVCTLHLT. + */ +- return dwc3_gadget_run_stop(dwc, false); ++ ret = dwc3_gadget_run_stop(dwc, false); ++ ++ /* ++ * Stop the gadget after controller is halted, so that if needed, the ++ * events to update EP0 state can still occur while the run/stop ++ * routine polls for the halted state. DEVTEN is cleared as part of ++ * gadget stop. ++ */ ++ spin_lock_irqsave(&dwc->lock, flags); ++ __dwc3_gadget_stop(dwc); ++ spin_unlock_irqrestore(&dwc->lock, flags); ++ ++ return ret; + } + + static int dwc3_gadget_soft_connect(struct dwc3 *dwc)